Malware Infection

DaReelDeel · Aug 1, 2010

Hello, I think it may have done the trick. It seems to have stopped, but I'm not sure. Thanks a bunch for all your help. Here is the new HijackThis log you requested.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:42:02 PM, on 01/08/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Rogers Online Protection\Rogers Servicepoint Agent\RogersServicepointAgent.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=83&bd=Presario&pf=cnnb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=83&bd=Presario&pf=cnnb
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\2.0"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [RogersServicepointAgent.exe] "C:\Program Files\Rogers Online Protection\Rogers Servicepoint Agent\RogersServicepointAgent.exe" /AUTORUN
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [Google Update] "C:\Users\Darlin\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Run YoukuDownloader - {612F6E5C-B314-4bab-93D1-D266AAFBE700} - C:\Program Files\Xmlbar\Youku Downloader\YoukuDownloader(xmlbar).exe (file missing)
O9 - Extra 'Tools' menuitem: Youku Downloader - {612F6E5C-B314-4bab-93D1-D266AAFBE700} - C:\Program Files\Xmlbar\Youku Downloader\YoukuDownloader(xmlbar).exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/MessengerGamesContent/GameContent/Default/uno1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: intu-qt2009 - {03947252-2355-4E9B-B446-8CCC75C43370} - C:\Program Files\QuickTax 2009\ic2009pp.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: Google Update Service (gupdate1ca2cdcaf95cfe9) (gupdate1ca2cdcaf95cfe9) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Recovery Service for Windows - Unknown owner - C:\Windows\SMINST\BLService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 10022 bytes

ken545 · Aug 1, 2010

Great, keep and eye on things and post back in a few days and let me know how its going

DaReelDeel · Aug 3, 2010

When I rebooted my laptop, I noticed the redirecting is back again. Although there are no popups, the links redirect me to other websites.

ken545 · Aug 3, 2010

Lets do this,

Download the HostsXpert 4.3 - Hosts File Manager.

Unzip HostsXpert 4.2.0.0 - Hosts File Manager to a convenient folder such as C:\HostsXpert
Click HostsXpert.exe to Run HostsXpert - Hosts File Manager from its new home
Click "Make Hosts Writable?" in the upper left corner.
Click Restore Microsoft's Hosts file and then click OK.
Click the X to exit the program.
Note: If you were using a custom Hosts file you will need to replace any of those entries yourself.

Backup Your Registry with ERUNT:

Download erunt.zip to your Desktop from here:
http://aumha.org/downloads/erunt.zip
Right-click erunt.zip, select Extract All... and follow the prompts to extract ERUNT to a new folder on your Desktop
Inside the new folder, double-click ERUNT.exe to start the program
OK all the prompts to back up your registry to the default location.

Note: to restore your registry, go to the backup folder and start ERDNT.exe

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

Code:

:OTL
PRC - C:\Windows\Explorer.EXE (Microsoft Corporation)
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-183614.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-183519.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-183518.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-183517.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-183516.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-180651.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-180650.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-180647.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-180645.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-180643.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-180642.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-180641.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-180616.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-180615.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-180614.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-180613.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-180612.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-174936.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-174923.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-174920.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-174919.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-174917.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-174843.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-174842.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-174840.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-174646.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-174644.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-174627.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-173902.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-173617.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-173616.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-173615.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-173608.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-173607.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-173606.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-173605.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-173604.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-173603.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-173602.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-173601.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-173557.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-173518.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-172944.backup
[2010/07/11 16:12:13 | 000,002,731 | RHS- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100711-172848.backup

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Post the log its created please

DaReelDeel · Aug 3, 2010

Hi,

When I ran HostsXpert.exe, the top left read Make Hosts ReadOnly? I just continued to Restore Microsoft's Hosts file. Then I ran ERUNT and the the custom fix on OTL. Here is the log.

All processes killed
========== OTL ==========
No active process named Explorer.EXE was found!
C:\WINDOWS\System32\drivers\etc\hosts.20100711-183614.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-183519.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-183518.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-183517.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-183516.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-180651.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-180650.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-180647.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-180645.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-180643.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-180642.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-180641.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-180616.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-180615.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-180614.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-180613.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-180612.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-174936.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-174923.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-174920.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-174919.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-174917.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-174843.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-174842.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-174840.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-174646.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-174644.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-174627.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-173902.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-173617.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-173616.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-173615.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-173608.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-173607.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-173606.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-173605.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-173604.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-173603.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-173602.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-173601.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-173557.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-173518.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-172944.backup moved successfully.
C:\WINDOWS\System32\drivers\etc\hosts.20100711-172848.backup moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Bhing or J.A
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Darlin
->Temp folder emptied: 2591578 bytes
->Temporary Internet Files folder emptied: 61164015 bytes
->Java cache emptied: 7140 bytes
->FireFox cache emptied: 13512633 bytes
->Google Chrome cache emptied: 347634021 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 8276 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: TEMP
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: TEMP.Darlin-PC
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: TEMP.Darlin-PC.000
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 189131 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 405.00 mb

OTL by OldTimer - Version 3.2.9.1 log created on 08032010_111207

Files\Folders moved on Reboot...
C:\Users\Darlin\AppData\Local\Temp\ehmsas.txt moved successfully.
C:\Users\Darlin\AppData\Local\Temp\VGXFA64.tmp moved successfully.

Registry entries deleted on Reboot...

ken545 · Aug 3, 2010

Go ahead and run OTL again and post a new log please. Have things gotten better ?

DaReelDeel · Aug 4, 2010

Hi. Below is the new OTL log. There is still a problem. When I go to any website, there is always an error saying they can't find the webpage. I have to refresh it several times before I it appears. This problem is on and off. Also, this address is popping up in a new tab. http://results.google-analytics.com/.

OTL logfile created on: 04/08/2010 2:12:52 PM - Run 5
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\Darlin\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 62.00% Memory free
6.00 Gb Paging File | 4.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 223.54 Gb Total Space | 129.69 Gb Free Space | 58.02% Space Free | Partition Type: NTFS
Drive D: | 9.35 Gb Total Space | 1.70 Gb Free Space | 18.16% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DARLIN-PC
Current User Name: Darlin
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Darlin\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
PRC - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
PRC - c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Rogers Online Protection\Rogers Servicepoint Agent\RogersServicepointAgent.exe (Rogers)
PRC - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\SMINST\BLService.exe ()
PRC - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation)

========== Modules (SafeList) ==========

MOD - C:\Users\Darlin\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\System32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (MsMpSvc) -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)
SRV - (WPFFontCache_v0400) -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (FontCache) -- C:\WINDOWS\System32\FntCache.dll (Microsoft Corporation)
SRV - (YahooAUService) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (LiveUpdate) -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE (Symantec Corporation)
SRV - (Recovery Service for Windows) -- C:\WINDOWS\SMINST\BLService.exe ()
SRV - (Automatic LiveUpdate Scheduler) -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (RPSKT) Security Services Driver (x86) -- C:\Windows\System32\DRIVERS\rp_skt32.sys File not found
DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (catchme) -- C:\Users\Darlin\AppData\Local\Temp\catchme.sys File not found
DRV - (MpFilter) -- C:\WINDOWS\System32\drivers\MpFilter.sys (Microsoft Corporation)
DRV - (MpNWMon) -- C:\WINDOWS\System32\drivers\MpNWMon.sys (Microsoft Corporation)
DRV - (eeCtrl) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (BCM43XX) -- C:\WINDOWS\System32\drivers\BCMWL6.SYS (Broadcom Corporation)
DRV - (BCM43XV) -- C:\WINDOWS\System32\drivers\BCMWL6.SYS (Broadcom Corporation)
DRV - (nvlddmkm) -- C:\WINDOWS\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (RTSTOR) -- C:\WINDOWS\System32\drivers\RTSTOR.sys (Realtek Semiconductor Corp.)
DRV - (CnxtHdAudService) -- C:\WINDOWS\System32\drivers\CHDRT32.sys (Conexant Systems Inc.)
DRV - (NVHDA) -- C:\WINDOWS\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
DRV - (nvsmu) -- C:\WINDOWS\System32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (SynTP) -- C:\WINDOWS\System32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (NVENETFD) -- C:\WINDOWS\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel(R) -- C:\WINDOWS\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (HSFHWAZL) -- C:\WINDOWS\System32\drivers\VSTAZL3.SYS (Conexant Systems, Inc.)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (HSF_DPV) -- C:\WINDOWS\System32\drivers\HSX_DPV.sys (Conexant Systems, Inc.)
DRV - (HSXHWAZL) -- C:\WINDOWS\System32\drivers\HSXHWAZL.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (XAudio) -- C:\WINDOWS\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (HpqRemHid) -- C:\WINDOWS\System32\drivers\HpqRemHid.sys (Hewlett-Packard Development Company, L.P.)
DRV - (HpqKbFiltr) -- C:\WINDOWS\System32\drivers\HpqKbFiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (PID_0928) Labtec WebCam(PID_0928) -- C:\WINDOWS\System32\drivers\LV561AV.SYS (Labtec Inc.)
DRV - (LVUSBSta) -- C:\WINDOWS\System32\drivers\LVUSBSta.sys (Labtec Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=83&bd=Presario&pf=cnnb

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local

FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2009/09/11 16:51:04 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/09 19:03:01 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/09 19:03:01 | 000,000,000 | ---D | M]

[2010/03/17 16:27:38 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Extensions
[2009/08/21 19:44:39 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Extensions\mozswing@mozswing.org
[2010/08/01 11:55:27 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions
[2010/07/28 12:11:31 | 000,000,000 | ---D | M] (TwitterBar) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\{1a0c9ebe-ddf9-4b76-b8a3-675c77874d37}
[2010/04/27 17:10:54 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/03/18 20:51:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\{29c4afe1-db19-4298-8785-fcc94d1d6c1d}
[2010/03/18 20:51:56 | 000,000,000 | ---D | M] (AniWeather) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\{4176DFF4-4698-11DE-BEEB-45DA55D89593}
[2010/05/25 20:18:05 | 000,000,000 | ---D | M] (Stylish) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
[2010/03/28 14:09:55 | 000,000,000 | ---D | M] (ScrapBook) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\{53A03D43-5363-4669-8190-99061B2DEBA5}
[2010/07/31 23:04:28 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/03/18 21:34:21 | 000,000,000 | ---D | M] (ColorZilla) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}
[2010/03/18 21:01:38 | 000,000,000 | ---D | M] (ImTranslator) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}
[2010/06/08 11:09:24 | 000,000,000 | ---D | M] (ReminderFox) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\{ada4b710-8346-4b82-8199-5de2b400a6ae}
[2010/07/28 12:11:30 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010/06/30 22:17:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\{CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B}
[2010/07/28 12:11:31 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/03/18 21:34:21 | 000,000,000 | ---D | M] (Pixlr Grabber) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\{d47a9f51-8281-43fa-f450-f28ef8735e9a}
[2010/06/02 19:11:22 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2010/04/12 10:07:01 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010/05/15 21:16:08 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
[2010/03/18 20:51:55 | 000,000,000 | ---D | M] (FoxTab) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}
[2010/07/28 12:11:45 | 000,000,000 | ---D | M] (SearchPreview) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\{EF522540-89F5-46b9-B6FE-1829E2B572C6}
[2010/07/28 12:11:31 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\FirefoxAddon@similarWeb.com
[2010/03/18 21:39:06 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\googletube@googletube.com
[2010/03/18 20:51:55 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\illimitux@illimitux.net
[2010/04/12 10:07:29 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\isreaditlater@ideashower.com
[2010/04/14 10:14:52 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\personas@christopher.beard
[2010/06/29 16:36:48 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\piclens@cooliris.com
[2010/06/29 16:36:48 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\piclens@cooliris.com-trash
[2010/03/18 21:01:33 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\SkipScreen@SkipScreen
[2010/06/16 15:38:34 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\smarterwiki@wikiatic.com
[2010/07/28 12:11:30 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\unplug@compunach
[2010/06/16 15:38:46 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\videosurf_enhanced@videosurf.com
[2010/04/21 10:16:53 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\15fd17a9.default\extensions\YoutubeDownloader@PeterOlayev.com
[2010/03/05 15:29:29 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\ky0tyjts.default\extensions
[2010/03/04 18:20:44 | 000,000,000 | ---D | M] (TwitterBar) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\ky0tyjts.default\extensions\{1a0c9ebe-ddf9-4b76-b8a3-675c77874d37}
[2010/03/04 17:52:54 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\ky0tyjts.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/03/04 17:52:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\ky0tyjts.default\extensions\{29c4afe1-db19-4298-8785-fcc94d1d6c1d}
[2010/03/05 15:04:55 | 000,000,000 | ---D | M] (TV-Fox) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\ky0tyjts.default\extensions\{2f17f610-5e97-4fed-828f-9940b7b577a4}
[2010/03/04 17:52:58 | 000,000,000 | ---D | M] (Stylish) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\ky0tyjts.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
[2010/03/04 18:20:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\ky0tyjts.default\extensions\{99210d54-6321-41e8-bd1b-2b4c55874efb}
[2010/03/04 18:20:43 | 000,000,000 | ---D | M] (ImTranslator) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\ky0tyjts.default\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}
[2010/03/04 17:52:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\ky0tyjts.default\extensions\{CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B}
[2010/03/04 18:20:43 | 000,000,000 | ---D | M] (QuickWiki) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\ky0tyjts.default\extensions\{EE223D7A-F30F-11DD-8F0A-D2AD55D89593}
[2010/03/04 17:52:58 | 000,000,000 | ---D | M] (FoxTab) -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\ky0tyjts.default\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}
[2010/03/04 18:20:44 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\ky0tyjts.default\extensions\en-CA@dictionaries.addons.mozilla.org
[2010/03/04 17:52:55 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\ky0tyjts.default\extensions\FirefoxAddon@myfacebook.com
[2010/03/04 17:53:01 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\ky0tyjts.default\extensions\FirefoxAddon@similarWeb.com
[2010/03/04 18:20:46 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\ky0tyjts.default\extensions\firefox-extension@shareaholic.com
[2010/03/04 18:20:46 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\ky0tyjts.default\extensions\googletube@googletube.com
[2010/03/04 18:20:43 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\ky0tyjts.default\extensions\illimitux@illimitux.net
[2010/03/04 17:52:54 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\ky0tyjts.default\extensions\isreaditlater@ideashower.com
[2010/03/04 17:52:55 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\ky0tyjts.default\extensions\personas@christopher.beard
[2010/03/04 17:53:00 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\ky0tyjts.default\extensions\piclens@cooliris.com
[2010/03/04 17:53:01 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\ky0tyjts.default\extensions\quickdrag@mozilla.ktechcomputing.com
[2010/03/04 18:20:45 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\ky0tyjts.default\extensions\firefox-extension@shareaholic.com\chrome
[2010/03/04 18:32:31 | 000,007,972 | ---- | M] () -- C:\Users\Darlin\AppData\Roaming\Mozilla\Firefox\Profiles\ky0tyjts.default\searchplugins\oneriot-social-web-search.xml
[2010/03/04 17:43:36 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/02/21 06:22:32 | 000,712,704 | ---- | M] (BitComet) -- C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll

O1 HOSTS File: ([2010/08/03 11:04:40 | 000,000,698 | ---- | M]) - C:\WINDOWS\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..\Run: [MSSE] c:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [RogersServicepointAgent.exe] C:\Program Files\Rogers Online Protection\Rogers Servicepoint Agent\RogersServicepointAgent.exe (Rogers)
O4 - HKLM..\Run: [UCam_Menu] C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - Startup: C:\Users\Darlin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 2
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Run YoukuDownloader - {612F6E5C-B314-4bab-93D1-D266AAFBE700} - C:\Program Files\Xmlbar\Youku Downloader\YoukuDownloader(xmlbar).exe File not found
O9 - Extra 'Tools' menuitem : Youku Downloader - {612F6E5C-B314-4bab-93D1-D266AAFBE700} - C:\Program Files\Xmlbar\Youku Downloader\YoukuDownloader(xmlbar).exe File not found
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/MessengerGamesContent/GameContent/Default/uno1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab (Minesweeper Flags Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\intu-qt2009 {03947252-2355-4e9b-B446-8CCC75C43370} - C:\Program Files\QuickTax 2009\ic2009pp.dll (Intuit Canada, a general partnership/une société en nom collectif.)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Darlin\Pictures\wild_shutterstock_8532871.jpg
O24 - Desktop BackupWallPaper: C:\Users\Darlin\Pictures\wild_shutterstock_8532871.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/08/11 09:46:21 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/08/03 11:53:55 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Essentials
[2010/08/03 11:10:08 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\Darlin\Desktop\OTL.exe
[2010/08/01 16:15:08 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2010/07/31 23:09:04 | 000,000,000 | ---D | C] -- C:\Users\Darlin\AppData\Local\Yahoo
[2010/07/31 23:04:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Yahoo! Companion
[2010/07/31 23:03:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Yahoo!
[2010/07/31 15:24:56 | 000,000,000 | ---D | C] -- C:\_OTM
[2010/07/22 14:17:32 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2010/07/22 13:01:49 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2010/07/21 14:10:29 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2010/07/21 14:09:14 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2010/07/21 13:46:04 | 000,000,000 | ---D | C] -- C:\ComboFix
[2010/07/21 13:45:36 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2010/07/19 14:09:04 | 000,000,000 | ---D | C] -- C:\_OTL
[2010/07/18 15:12:02 | 000,000,000 | ---D | C] -- C:\Users\Darlin\AppData\Local\Apple
[2010/07/18 14:54:21 | 000,000,000 | ---D | C] -- C:\Users\Darlin\AppData\Local\Adobe
[2010/07/18 13:28:51 | 000,000,000 | ---D | C] -- C:\Users\Darlin\AppData\Local\Apple Computer
[2010/07/18 12:48:42 | 000,000,000 | ---D | C] -- C:\Users\Darlin\AppData\Roaming\Malwarebytes
[2010/07/18 12:48:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010/07/18 12:48:30 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/07/17 20:50:15 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2010/07/17 20:50:15 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2010/07/17 20:50:15 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2010/07/17 20:50:08 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2010/07/17 20:49:37 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/07/12 12:25:33 | 000,000,000 | ---D | C] -- C:\Program Files\Safer Networking
[2010/07/12 09:25:13 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2010/07/11 19:54:59 | 000,000,000 | ---D | C] -- C:\Program Files\TweetDeck
[2010/07/11 17:16:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2010/07/11 17:16:36 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2010/07/11 14:14:26 | 000,000,000 | -HSD | C] -- C:\ProgramData\SMACCEEAV
[4 C:\Users\Darlin\Documents\*.tmp files -> C:\Users\Darlin\Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/08/04 14:11:33 | 008,388,608 | -HS- | M] () -- C:\Users\Darlin\ntuser.dat
[2010/08/04 13:56:00 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/08/04 13:50:53 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/08/04 13:50:53 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/08/04 13:49:00 | 000,000,912 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1042238982-2704989617-889929576-1000UA.job
[2010/08/04 11:51:00 | 000,048,670 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2010/08/04 11:51:00 | 000,048,670 | ---- | M] () -- C:\ProgramData\nvModes.001
[2010/08/04 11:50:58 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/08/04 09:50:25 | 000,000,868 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2010/08/04 09:48:19 | 000,000,246 | ---- | M] () -- C:\Users\Public\Documents\hpqp.ini
[2010/08/04 09:46:56 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/08/04 09:46:43 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010/08/04 09:46:33 | 2951,114,752 | -HS- | M] () -- C:\hiberfil.sys
[2010/08/03 22:26:40 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2010/08/03 22:26:35 | 000,524,288 | -HS- | M] () -- C:\Users\Darlin\ntuser.dat{222d7bbb-2541-11df-b6a1-001d7263ad85}.TMContainer00000000000000000001.regtrans-ms
[2010/08/03 22:26:35 | 000,065,536 | -HS- | M] () -- C:\Users\Darlin\ntuser.dat{222d7bbb-2541-11df-b6a1-001d7263ad85}.TM.blf
[2010/08/03 22:26:32 | 002,495,150 | -H-- | M] () -- C:\Users\Darlin\AppData\Local\IconCache.db
[2010/08/03 17:49:00 | 000,000,860 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1042238982-2704989617-889929576-1000Core.job
[2010/08/03 11:10:09 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Darlin\Desktop\OTL.exe
[2010/08/03 11:04:40 | 000,000,698 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2010/08/02 20:08:00 | 000,001,804 | ---- | M] () -- C:\Users\Darlin\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk
[2010/08/01 16:16:01 | 000,001,804 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010/07/31 23:03:45 | 000,000,966 | ---- | M] () -- C:\Users\Darlin\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
[2010/07/29 19:01:29 | 002,380,564 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010/07/29 19:01:29 | 000,714,466 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010/07/29 19:01:29 | 000,062,236 | ---- | M] () -- C:\Windows\System32\perfh00C.dat
[2010/07/29 19:01:29 | 000,059,822 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010/07/29 19:01:29 | 000,019,286 | ---- | M] () -- C:\Windows\System32\perfc00C.dat
[2010/07/29 18:44:36 | 000,013,312 | ---- | M] () -- C:\Users\Darlin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/29 12:50:32 | 000,001,356 | ---- | M] () -- C:\Users\Darlin\AppData\Local\d3d9caps.dat
[2010/07/29 12:28:07 | 257,366,390 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010/07/28 18:38:07 | 002,512,767 | ---- | M] () -- C:\Users\Darlin\Documents\Canadian Achievements.pptx
[2010/07/26 21:59:30 | 000,002,047 | ---- | M] () -- C:\Users\Darlin\Desktop\Google Chrome.lnk
[2010/07/26 21:59:30 | 000,002,009 | ---- | M] () -- C:\Users\Darlin\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/07/22 19:06:22 | 000,030,720 | ---- | M] () -- C:\Users\Darlin\Documents\Water Consumption.doc
[2010/07/22 19:06:13 | 000,014,769 | ---- | M] () -- C:\Users\Darlin\Documents\Final Unit Essay.docx
[2010/07/22 14:17:32 | 000,001,874 | ---- | M] () -- C:\Users\Darlin\Desktop\HijackThis.lnk
[2010/07/21 17:04:41 | 000,020,148 | ---- | M] () -- C:\Users\Darlin\Documents\Unit 6 Activity 3.docx
[2010/07/21 14:06:38 | 000,000,215 | ---- | M] () -- C:\Windows\system.ini
[2010/07/20 22:25:46 | 000,019,373 | ---- | M] () -- C:\Users\Darlin\Documents\Unit 5 Activity 5.docx
[2010/07/20 19:57:21 | 000,023,377 | ---- | M] () -- C:\Users\Darlin\Documents\Unit 5 Activity 3.docx
[2010/07/20 14:39:39 | 000,038,252 | ---- | M] () -- C:\Users\Darlin\Documents\Charter.rtf
[2010/07/13 16:47:10 | 000,000,104 | ---- | M] () -- C:\Users\Darlin\Desktop\Recycle Bin - Shortcut.lnk
[2010/07/12 09:25:29 | 000,000,008 | ---- | M] () -- C:\Users\Darlin\AppData\Roaming\vdnxlf.dat
[2010/07/11 19:55:01 | 000,000,762 | ---- | M] () -- C:\Users\Public\Desktop\TweetDeck.lnk
[2010/07/11 19:19:13 | 000,311,040 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010/07/11 17:46:31 | 000,000,088 | ---- | M] () -- C:\Windows\wininit.ini
[2010/07/09 23:20:49 | 000,088,576 | RHS- | M] () -- C:\Users\Darlin\AppData\Roaming\nb-NOM.dll
[4 C:\Users\Darlin\Documents\*.tmp files -> C:\Users\Darlin\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/08/02 20:08:00 | 000,001,804 | ---- | C] () -- C:\Users\Darlin\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk
[2010/08/01 16:16:01 | 000,001,804 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010/07/31 23:03:45 | 000,000,966 | ---- | C] () -- C:\Users\Darlin\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
[2010/07/27 23:08:14 | 002,512,767 | ---- | C] () -- C:\Users\Darlin\Documents\Canadian Achievements.pptx
[2010/07/22 19:06:13 | 000,014,769 | ---- | C] () -- C:\Users\Darlin\Documents\Final Unit Essay.docx
[2010/07/22 16:16:18 | 000,030,720 | ---- | C] () -- C:\Users\Darlin\Documents\Water Consumption.doc
[2010/07/22 14:17:32 | 000,001,874 | ---- | C] () -- C:\Users\Darlin\Desktop\HijackThis.lnk
[2010/07/21 17:04:41 | 000,020,148 | ---- | C] () -- C:\Users\Darlin\Documents\Unit 6 Activity 3.docx
[2010/07/21 14:45:52 | 2951,114,752 | -HS- | C] () -- C:\hiberfil.sys
[2010/07/20 22:25:44 | 000,019,373 | ---- | C] () -- C:\Users\Darlin\Documents\Unit 5 Activity 5.docx
[2010/07/20 19:56:30 | 000,023,377 | ---- | C] () -- C:\Users\Darlin\Documents\Unit 5 Activity 3.docx
[2010/07/20 14:39:39 | 000,038,252 | ---- | C] () -- C:\Users\Darlin\Documents\Charter.rtf
[2010/07/17 20:50:15 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2010/07/17 20:50:15 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010/07/17 20:50:15 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010/07/17 20:50:15 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe
[2010/07/17 20:50:15 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2010/07/13 16:47:10 | 000,000,104 | ---- | C] () -- C:\Users\Darlin\Desktop\Recycle Bin - Shortcut.lnk
[2010/07/12 09:25:28 | 000,000,008 | ---- | C] () -- C:\Users\Darlin\AppData\Roaming\vdnxlf.dat
[2010/07/11 23:08:05 | 257,366,390 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2010/07/11 21:12:54 | 000,001,972 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2010/07/11 21:12:54 | 000,001,111 | ---- | C] () -- C:\Users\Darlin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
[2010/07/11 17:46:31 | 000,000,088 | ---- | C] () -- C:\Windows\wininit.ini
[2010/07/09 23:20:48 | 000,088,576 | RHS- | C] () -- C:\Users\Darlin\AppData\Roaming\nb-NOM.dll
[2009/09/17 16:23:53 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2008/01/20 22:24:38 | 000,033,794 | ---- | C] () -- C:\Windows\System32\unelwin.dll
[2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/03/09 05:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2005/01/19 09:30:54 | 000,009,255 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini

========== LOP Check ==========

[2010/06/02 18:46:13 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\BitComet
[2009/10/09 21:17:54 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\iWin
[2010/07/17 20:48:54 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\LimeWire
[2010/06/08 13:18:41 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Opera
[2009/10/10 23:06:18 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\PlayFirst
[2010/03/10 18:32:47 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Rogers Online Protection
[2009/10/17 15:25:15 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Template
[2009/08/21 21:22:19 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1
[2009/11/30 17:12:48 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
[2009/09/05 19:38:05 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\WildTangent
[2010/08/03 22:26:50 | 000,032,562 | ---- | M] () -- C:\WINDOWS\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Files - Unicode (All) ==========
[2009/10/02 23:23:37 | 000,000,036 | ---- | M] ()(C:\Windows\System32\?????????????????????????????????????????????????) -- C:\Windows\System32\㩃停潲牧浡䘠汩獥剜杯牥⁳湏楬敮倠潲整瑣潩屮潒敧獲传汮湩⁥牐瑯捥楴湯卜晡䍥湯敮瑣䍜湯楦屧噘敩⹷潣普杩
[2009/10/02 23:23:37 | 000,000,036 | ---- | C] ()(C:\Windows\System32\?????????????????????????????????????????????????) -- C:\Windows\System32\㩃停潲牧浡䘠汩獥剜杯牥⁳湏楬敮倠潲整瑣潩屮潒敧獲传汮湩⁥牐瑯捥楴湯卜晡䍥湯敮瑣䍜湯楦屧噘敩⹷潣普杩
< End of report >
[2010/08/04 14:15:07 | 000,000,000 | R--D | M] -- C:\Users\Darlin\Desktop
[2010/08/04 14:11:36 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Local\Temp
[2010/08/04 14:11:33 | 008,388,608 | -HS- | M] () -- C:\Users\Darlin\ntuser.dat
[2010/08/04 14:11:32 | 000,262,144 | -H-- | M] () -- C:\Users\Darlin\ntuser.dat.LOG1
[2010/08/04 13:56:00 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/08/04 13:50:53 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/08/04 13:50:53 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/08/04 13:49:00 | 000,000,912 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1042238982-2704989617-889929576-1000UA.job
[2010/08/04 13:10:55 | 000,000,000 | R--D | M] -- C:\Users\Darlin\Downloads
[2010/08/04 11:51:00 | 000,048,670 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2010/08/04 11:51:00 | 000,048,670 | ---- | M] () -- C:\ProgramData\nvModes.001
[2010/08/04 11:50:58 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/08/04 09:50:25 | 000,000,868 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2010/08/04 09:48:38 | 000,000,000 | ---D | M] -- C:\Users\Darlin\Tracing
[2010/08/04 09:48:19 | 000,000,246 | ---- | M] () -- C:\Users\Public\Documents\hpqp.ini
[2010/08/04 09:46:56 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/08/04 09:46:43 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010/08/03 22:26:40 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2010/08/03 22:26:35 | 000,524,288 | -HS- | M] () -- C:\Users\Darlin\ntuser.dat{222d7bbb-2541-11df-b6a1-001d7263ad85}.TMContainer00000000000000000001.regtrans-ms
[2010/08/03 22:26:35 | 000,065,536 | -HS- | M] () -- C:\Users\Darlin\ntuser.dat{222d7bbb-2541-11df-b6a1-001d7263ad85}.TM.blf
[2010/08/03 22:26:32 | 002,495,150 | -H-- | M] () -- C:\Users\Darlin\AppData\Local\IconCache.db
[2010/08/03 17:49:00 | 000,000,860 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1042238982-2704989617-889929576-1000Core.job
[2010/08/03 11:55:29 | 000,000,000 | ---D | M] -- C:\ProgramData\Yahoo! Companion
[2010/08/03 11:54:11 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Security Essentials
[2010/08/03 11:10:09 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Darlin\Desktop\OTL.exe
[2010/08/02 20:08:00 | 000,001,804 | ---- | M] () -- C:\Users\Darlin\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk
[2010/08/02 17:38:38 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Local\Cooliris
[2010/08/01 16:16:01 | 000,001,804 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010/08/01 16:15:59 | 000,000,000 | ---D | M] -- C:\Program Files\iTunes
[2010/08/01 16:15:08 | 000,000,000 | ---D | M] -- C:\Program Files\iPod
[2010/08/01 16:15:06 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files\Apple
[2010/07/31 23:09:04 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Local\Yahoo
[2010/07/31 23:05:13 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Yahoo!
[2010/07/31 23:04:18 | 000,000,000 | ---D | M] -- C:\ProgramData\Yahoo!
[2010/07/31 23:04:18 | 000,000,000 | ---D | M] -- C:\Program Files\Yahoo!
[2010/07/31 23:03:45 | 000,000,966 | ---- | M] () -- C:\Users\Darlin\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
[2010/07/31 23:03:07 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files\microsoft shared
[2010/07/30 18:52:36 | 000,000,000 | R--D | M] -- C:\Users\Darlin\Documents
[2010/07/30 11:45:24 | 000,000,000 | R--D | M] -- C:\Users\Darlin\Pictures
[2010/07/29 19:01:29 | 002,380,564 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010/07/29 19:01:29 | 000,714,466 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010/07/29 19:01:29 | 000,062,236 | ---- | M] () -- C:\Windows\System32\perfh00C.dat
[2010/07/29 19:01:29 | 000,059,822 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010/07/29 19:01:29 | 000,019,286 | ---- | M] () -- C:\Windows\System32\perfc00C.dat
[2010/07/29 18:44:36 | 000,013,312 | ---- | M] () -- C:\Users\Darlin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/29 12:50:32 | 000,001,356 | ---- | M] () -- C:\Users\Darlin\AppData\Local\d3d9caps.dat
[2010/07/29 12:28:07 | 257,366,390 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010/07/28 18:38:07 | 002,512,767 | ---- | M] () -- C:\Users\Darlin\Documents\Canadian Achievements.pptx
[2010/07/26 21:59:30 | 000,002,047 | ---- | M] () -- C:\Users\Darlin\Desktop\Google Chrome.lnk
[2010/07/26 21:59:30 | 000,002,009 | ---- | M] () -- C:\Users\Darlin\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/07/22 19:06:22 | 000,030,720 | ---- | M] () -- C:\Users\Darlin\Documents\Water Consumption.doc
[2010/07/22 19:06:13 | 000,014,769 | ---- | M] () -- C:\Users\Darlin\Documents\Final Unit Essay.docx
[2010/07/22 14:17:32 | 000,001,874 | ---- | M] () -- C:\Users\Darlin\Desktop\HijackThis.lnk
[2010/07/22 14:17:32 | 000,000,000 | ---D | M] -- C:\Program Files\Trend Micro
[2010/07/22 13:01:49 | 000,000,000 | ---D | M] -- C:\ProgramData\SUPERAntiSpyware.com
[2010/07/21 17:04:41 | 000,020,148 | ---- | M] () -- C:\Users\Darlin\Documents\Unit 6 Activity 3.docx
[2010/07/21 14:13:29 | 000,000,000 | ---D | M] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/07/21 14:06:38 | 000,000,215 | ---- | M] () -- C:\Windows\system.ini
[2010/07/21 14:02:15 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
[2010/07/20 22:25:46 | 000,019,373 | ---- | M] () -- C:\Users\Darlin\Documents\Unit 5 Activity 5.docx
[2010/07/20 19:57:21 | 000,023,377 | ---- | M] () -- C:\Users\Darlin\Documents\Unit 5 Activity 3.docx
[2010/07/20 14:39:39 | 000,038,252 | ---- | M] () -- C:\Users\Darlin\Documents\Charter.rtf
[2010/07/20 14:28:54 | 000,000,000 | ---D | M] -- C:\Program Files\Spybot - Search & Destroy
[2010/07/19 14:56:00 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Local\Adobe
[2010/07/18 15:12:02 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Local\Apple
[2010/07/18 13:28:51 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Local\Apple Computer
[2010/07/18 12:48:42 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Malwarebytes
[2010/07/18 12:48:31 | 000,000,000 | ---D | M] -- C:\ProgramData\Malwarebytes
[2010/07/17 20:48:54 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\LimeWire
[2010/07/17 20:44:29 | 000,000,000 | ---D | M] -- C:\Program Files\LimeWire
[2010/07/15 10:19:17 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Mail
[2010/07/13 22:07:12 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files\Adobe
[2010/07/13 16:47:10 | 000,000,104 | ---- | M] () -- C:\Users\Darlin\Desktop\Recycle Bin - Shortcut.lnk
[2010/07/12 12:25:33 | 000,000,000 | ---D | M] -- C:\Program Files\Safer Networking
[2010/07/12 09:25:29 | 000,000,008 | ---- | M] () -- C:\Users\Darlin\AppData\Roaming\vdnxlf.dat
[2010/07/11 21:18:46 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Local\QuickPlay
[2010/07/11 21:18:23 | 000,000,000 | ---D | M] -- C:\ProgramData\Spybot - Search & Destroy
[2010/07/11 19:55:01 | 000,000,762 | ---- | M] () -- C:\Users\Public\Desktop\TweetDeck.lnk
[2010/07/11 19:54:59 | 000,000,000 | ---D | M] -- C:\Program Files\TweetDeck
[2010/07/11 19:19:13 | 000,311,040 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010/07/11 17:46:31 | 000,000,088 | ---- | M] () -- C:\Windows\wininit.ini
[2010/07/11 14:14:26 | 000,000,000 | -HSD | M] -- C:\ProgramData\SMACCEEAV
[2010/07/11 13:54:58 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\vlc
[2010/07/09 23:20:49 | 000,088,576 | RHS- | M] () -- C:\Users\Darlin\AppData\Roaming\nb-NOM.dll
[2010/07/09 19:03:01 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
[2010/07/05 21:26:21 | 000,000,000 | --SD | M] -- C:\ProgramData\Microsoft
[2010/07/05 21:26:21 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Local\Microsoft
[4 C:\Users\Darlin\Documents\*.tmp files -> C:\Users\Darlin\Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/08/04 14:16:03 | 008,388,608 | -HS- | M] () -- C:\Users\Darlin\ntuser.dat
[2010/08/04 13:56:00 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/08/04 13:50:53 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/08/04 13:50:53 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/08/04 13:49:00 | 000,000,912 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1042238982-2704989617-889929576-1000UA.job
[2010/08/04 11:51:00 | 000,048,670 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2010/08/04 11:51:00 | 000,048,670 | ---- | M] () -- C:\ProgramData\nvModes.001
[2010/08/04 11:50:58 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/08/04 09:50:25 | 000,000,868 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2010/08/04 09:48:19 | 000,000,246 | ---- | M] () -- C:\Users\Public\Documents\hpqp.ini
[2010/08/04 09:46:56 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/08/04 09:46:43 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010/08/04 09:46:33 | 2951,114,752 | -HS- | M] () -- C:\hiberfil.sys
[2010/08/03 22:26:40 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2010/08/03 22:26:35 | 000,524,288 | -HS- | M] () -- C:\Users\Darlin\ntuser.dat{222d7bbb-2541-11df-b6a1-001d7263ad85}.TMContainer00000000000000000001.regtrans-ms
[2010/08/03 22:26:35 | 000,065,536 | -HS- | M] () -- C:\Users\Darlin\ntuser.dat{222d7bbb-2541-11df-b6a1-001d7263ad85}.TM.blf
[2010/08/03 22:26:32 | 002,495,150 | -H-- | M] () -- C:\Users\Darlin\AppData\Local\IconCache.db
[2010/08/03 17:49:00 | 000,000,860 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1042238982-2704989617-889929576-1000Core.job
[2010/08/03 11:10:09 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Darlin\Desktop\OTL.exe
[2010/08/03 11:04:40 | 000,000,698 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2010/08/02 20:08:00 | 000,001,804 | ---- | M] () -- C:\Users\Darlin\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk
[2010/08/01 16:16:01 | 000,001,804 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010/07/31 23:03:45 | 000,000,966 | ---- | M] () -- C:\Users\Darlin\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
[2010/07/29 19:01:29 | 002,380,564 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010/07/29 19:01:29 | 000,714,466 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010/07/29 19:01:29 | 000,062,236 | ---- | M] () -- C:\Windows\System32\perfh00C.dat
[2010/07/29 19:01:29 | 000,059,822 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010/07/29 19:01:29 | 000,019,286 | ---- | M] () -- C:\Windows\System32\perfc00C.dat
[2010/07/29 18:44:36 | 000,013,312 | ---- | M] () -- C:\Users\Darlin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/29 12:50:32 | 000,001,356 | ---- | M] () -- C:\Users\Darlin\AppData\Local\d3d9caps.dat
[2010/07/29 12:28:07 | 257,366,390 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010/07/28 18:38:07 | 002,512,767 | ---- | M] () -- C:\Users\Darlin\Documents\Canadian Achievements.pptx
[2010/07/26 21:59:30 | 000,002,047 | ---- | M] () -- C:\Users\Darlin\Desktop\Google Chrome.lnk
[2010/07/26 21:59:30 | 000,002,009 | ---- | M] () -- C:\Users\Darlin\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/07/22 19:06:22 | 000,030,720 | ---- | M] () -- C:\Users\Darlin\Documents\Water Consumption.doc
[2010/07/22 19:06:13 | 000,014,769 | ---- | M] () -- C:\Users\Darlin\Documents\Final Unit Essay.docx
[2010/07/22 14:17:32 | 000,001,874 | ---- | M] () -- C:\Users\Darlin\Desktop\HijackThis.lnk
[2010/07/21 17:04:41 | 000,020,148 | ---- | M] () -- C:\Users\Darlin\Documents\Unit 6 Activity 3.docx
[2010/07/21 14:06:38 | 000,000,215 | ---- | M] () -- C:\Windows\system.ini
[2010/07/20 22:25:46 | 000,019,373 | ---- | M] () -- C:\Users\Darlin\Documents\Unit 5 Activity 5.docx
[2010/07/20 19:57:21 | 000,023,377 | ---- | M] () -- C:\Users\Darlin\Documents\Unit 5 Activity 3.docx
[2010/07/20 14:39:39 | 000,038,252 | ---- | M] () -- C:\Users\Darlin\Documents\Charter.rtf
[2010/07/13 16:47:10 | 000,000,104 | ---- | M] () -- C:\Users\Darlin\Desktop\Recycle Bin - Shortcut.lnk
[2010/07/12 09:25:29 | 000,000,008 | ---- | M] () -- C:\Users\Darlin\AppData\Roaming\vdnxlf.dat
[2010/07/11 19:55:01 | 000,000,762 | ---- | M] () -- C:\Users\Public\Desktop\TweetDeck.lnk
[2010/07/11 19:19:13 | 000,311,040 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010/07/11 17:46:31 | 000,000,088 | ---- | M] () -- C:\Windows\wininit.ini
[2010/07/09 23:20:49 | 000,088,576 | RHS- | M] () -- C:\Users\Darlin\AppData\Roaming\nb-NOM.dll
[4 C:\Users\Darlin\Documents\*.tmp files -> C:\Users\Darlin\Documents\*.tmp -> ]

========== LOP Check ==========

[2010/06/02 18:46:13 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\BitComet
[2009/10/09 21:17:54 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\iWin
[2010/07/17 20:48:54 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\LimeWire
[2010/06/08 13:18:41 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Opera
[2009/10/10 23:06:18 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\PlayFirst
[2010/03/10 18:32:47 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Rogers Online Protection
[2009/10/17 15:25:15 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\Template
[2009/08/21 21:22:19 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1
[2009/11/30 17:12:48 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
[2009/09/05 19:38:05 | 000,000,000 | ---D | M] -- C:\Users\Darlin\AppData\Roaming\WildTangent
[2010/08/03 22:26:50 | 000,032,562 | ---- | M] () -- C:\WINDOWS\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Files - Unicode (All) ==========
[2009/10/02 23:23:37 | 000,000,036 | ---- | M] ()(C:\Windows\System32\?????????????????????????????????????????????????) -- C:\Windows\System32\㩃停潲牧浡䘠汩獥剜杯牥⁳湏楬敮倠潲整瑣潩屮潒敧獲传汮湩⁥牐瑯捥楴湯卜晡䍥湯敮瑣䍜湯楦屧噘敩⹷潣普杩

< End of report >

ken545 · Aug 4, 2010

Lets flush out your DNS cache

Open Notepad and Copy and paste these lines into Notepad

@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

Save it as Flush.bat
In the dropdown menu save it as All Files
Save it to your desktop
Double click it to run
It will reboot your computer when done
*** note: Win Vista and Win 7 need to right click and choose to "run as Administrator" .. the computer will reboot itself.

Let me know if this helped

DaReelDeel · Aug 5, 2010

Hi! I ran the flush, but there is still an error page saying the webpage is not available.

ken545 · Aug 5, 2010

This may just be a browser issue and not related to malware. Lets update your browser from Version 7 to 8 and see if this does the trick

Open IE and go to Tools > Windows Updates and download and install all critical updates including IE8

You can also download it from here
http://www.microsoft.com/windows/internet-explorer/default.aspx

DaReelDeel · Aug 7, 2010

I updated the browser, but I'm still getting error messages.

ken545 · Aug 7, 2010

What error messages are you getting ? Is it just the pages wont load or are you being redirected or getting popup windows ?

Open IE and go to Tools > Internet Options > Advanced Tab > Reset Internet Explorer Setting > Reset..... may take a few seconds....then ok your way out.

Close IE and then reopen it and see if things are working now.

Post a new DDS log and let me have another look

DaReelDeel · Aug 8, 2010

Hi.I'm still getting the error message that the webpage is not available. I have to refresh it many times for the page to show, but sometimes even refreshing it won't work. Also it redirects me to another website, mostly to this website called searchpro.com. I googled it and it said searchprotocolhost.exe is a virus.
Resetting the internet explorer settings didn't work.

Other than that here is the DDS log and the attach.txt log.

DDS (Ver_10-03-17.01) - NTFSx86
Run by Darlin at 14:40:39.48 on 08/08/2010
Internet Explorer: 7.0.6002.18005
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.2.1033.18.2814.1824 [GMT -4:00]

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\SMINST\BLService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Rogers Online Protection\Rogers Servicepoint Agent\RogersServicepointAgent.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Rogers Online Protection\Rogers Servicepoint Agent\RogersServicepointAgentComHandler.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Darlin\Desktop\dds.scr
C:\Windows\system32\conime.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=83&bd=Presario&pf=cnnb
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=83&bd=Presario&pf=cnnb
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=83&bd=Presario&pf=cnnb
uInternet Settings,ProxyOverride = <local>;*.local
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.2.4204.1700\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [Google Update] "c:\users\darlin\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messenger\YahooMessenger.exe" -quiet
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [UCam_Menu] "c:\program files\cyberlink\youcam\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\youcam" update "software\cyberlink\youcam\2.0"
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [RogersServicepointAgent.exe] "c:\program files\rogers online protection\rogers servicepoint agent\RogersServicepointAgent.exe" /AUTORUN
mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"
mRun: [QlbCtrl.exe] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start
mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [MSSE] "c:\program files\microsoft security essentials\msseces.exe" -hide -runkey
StartupFolder: c:\users\darlin\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 2 (0x2)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {612F6E5C-B314-4bab-93D1-D266AAFBE700} - c:\program files\xmlbar\youku downloader\YoukuDownloader(xmlbar).exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/Default/uno1/GAME_UNO1.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
Handler: intu-qt2009 - {03947252-2355-4e9b-B446-8CCC75C43370} - c:\program files\quicktax 2009\ic2009pp.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"

================= FIREFOX ===================

FF - ProfilePath - c:\users\darlin\appdata\roaming\mozilla\firefox\profiles\15fd17a9.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
FF - component: c:\users\darlin\appdata\roaming\mozilla\firefox\profiles\15fd17a9.default\extensions\{6ac85730-7d0f-4de0-b3fa-21142dd85326}\platform\winnt\components\ColorZilla.dll
FF - component: c:\users\darlin\appdata\roaming\mozilla\firefox\profiles\15fd17a9.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\FFExternalAlert.dll
FF - component: c:\users\darlin\appdata\roaming\mozilla\firefox\profiles\15fd17a9.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\RadioWMPCore.dll
FF - component: c:\users\darlin\appdata\roaming\mozilla\firefox\profiles\15fd17a9.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\google updater\2.4.1698.5652\npCIDetect13.dll
FF - plugin: c:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\rogers online protection\rogers servicepoint agent\nprpspa.dll
FF - plugin: c:\users\darlin\appdata\local\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\users\darlin\appdata\roaming\mozilla\firefox\profiles\15fd17a9.default\extensions\piclens@cooliris.com\plugins\npcoolirisplugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.ytff.general.dontshowhpoffer - truec:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-3-25 151216]
R2 Recovery Service for Windows;Recovery Service for Windows;c:\windows\sminst\BLService.exe [2008-8-11 361808]
R3 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2008-8-11 193840]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-3-25 42368]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-5-9 43040]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate1ca2cdcaf95cfe9;Google Update Service (gupdate1ca2cdcaf95cfe9);c:\program files\google\update\GoogleUpdate.exe [2009-9-3 133104]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

=============== Created Last 30 ================

2010-08-03 15:53:55 0 d-----w- c:\program files\Microsoft Security Essentials
2010-08-01 20:15:08 0 d-----w- c:\program files\iPod
2010-08-01 03:04:16 0 d-----w- c:\programdata\Yahoo! Companion
2010-08-01 03:03:43 0 d-----w- c:\programdata\Yahoo!
2010-07-31 19:24:56 0 d-----w- C:\_OTM
2010-07-22 18:17:32 0 d-----w- c:\program files\Trend Micro
2010-07-22 17:01:49 0 d-----w- c:\programdata\SUPERAntiSpyware.com
2010-07-21 18:09:14 0 d-sh--w- C:\$RECYCLE.BIN
2010-07-21 17:46:04 0 d-----w- C:\ComboFix
2010-07-19 18:09:04 0 d-----w- C:\_OTL
2010-07-18 16:48:42 0 d-----w- c:\users\darlin\appdata\roaming\Malwarebytes
2010-07-18 16:48:31 0 d-----w- c:\programdata\Malwarebytes
2010-07-18 16:48:30 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-18 00:50:15 98816 ----a-w- c:\windows\sed.exe
2010-07-18 00:50:15 77312 ----a-w- c:\windows\MBR.exe
2010-07-18 00:50:15 256512 ----a-w- c:\windows\PEV.exe
2010-07-18 00:50:15 161792 ----a-w- c:\windows\SWREG.exe
2010-07-12 16:25:33 0 d-----w- c:\program files\Safer Networking
2010-07-12 13:25:28 8 ----a-w- c:\users\darlin\appdata\roaming\vdnxlf.dat
2010-07-12 03:08:05 257366390 ----a-w- c:\windows\MEMORY.DMP
2010-07-11 23:54:59 0 d-----w- c:\program files\TweetDeck
2010-07-11 21:46:31 88 ----a-w- c:\windows\wininit.ini
2010-07-11 21:16:36 0 d-----w- c:\programdata\Spybot - Search & Destroy
2010-07-11 21:16:36 0 d-----w- c:\program files\Spybot - Search & Destroy
2010-07-11 18:14:26 0 d-sh--w- c:\programdata\SMACCEEAV
2010-07-10 03:20:48 88576 --sha-r- c:\users\darlin\appdata\roaming\nb-NOM.dll

==================== Find3M ====================

2010-08-08 17:55:48 48670 ----a-w- c:\programdata\nvModes.dat
2010-07-29 23:01:29 62236 ----a-w- c:\windows\system32\perfh00C.dat
2010-07-29 23:01:29 19286 ----a-w- c:\windows\system32\perfc00C.dat
2010-06-20 19:25:57 86016 ----a-w- c:\windows\inf\infstor.dat
2010-06-20 19:25:57 51200 ----a-w- c:\windows\inf\infpub.dat
2010-06-20 19:25:56 143360 ----a-w- c:\windows\inf\infstrng.dat
2010-05-26 17:06:41 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-05-26 14:47:41 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-05-21 18:14:28 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-18 20:35:16 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-05-18 20:35:16 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-04-30 02:15:22 665600 ----a-w- c:\windows\inf\drvindex.dat
2008-08-11 10:55:35 37390 ----a-w- c:\windows\inf\perflib\040c\perfd.dat
2008-08-11 10:55:35 37390 ----a-w- c:\windows\inf\perflib\040c\perfc.dat
2008-08-11 10:55:35 340236 ----a-w- c:\windows\inf\perflib\040c\perfi.dat
2008-08-11 10:55:35 340236 ----a-w- c:\windows\inf\perflib\040c\perfh.dat
2008-01-21 02:43:21 174 --sha-w- c:\program files\desktop.ini
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2010-03-10 23:05:08 59232800 --sha-w- c:\windows\system32\drivers\fidbox.dat
2008-08-11 10:58:25 8192 --sha-w- c:\windows\users\default\NTUSER.DAT

============= FINISH: 14:42:32.60 ===============

DDS (Ver_10-03-17.01)

Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 14/08/2009 2:06:55 PM
System Uptime: 08/08/2010 1:54:50 PM (1 hours ago)

Motherboard: Wistron | | 360A
Processor: AMD Athlon Dual-Core QL-60 | Socket A | 1900/133mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 224 GiB total, 129.031 GiB free.
D: is FIXED (NTFS) - 9 GiB total, 1.698 GiB free.
E: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

==== Installed Programs ======================

32 Bit HP CIO Components Installer
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.2
Adobe Shockwave Player
Adobe Shockwave Player 11.5
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Bonjour
Broadcom 802.11 Wireless LAN Adapter
BufferChm
Cards_Calendar_OrderGift_DoMorePlugout
Compatibility Pack for the 2007 Office system
Conexant HD Audio
CustomerResearchQFolder
CyberLink DVD Suite
CyberLink YouCam
D2500
D2500_Help
DeviceDiscovery
DeviceManagementQFolder
DJ_SF_03_D2500_ProductContext
DJ_SF_03_D2500_Software
DJ_SF_03_D2500_Software_Min
ESU for Microsoft Vista
eSupportQFolder
Free Video to iPod Converter version 3.4
Free YouTube to iPod Converter version 3.2
Google Chrome
Google Earth
Google Update Helper
Google Updater
GPBaseService
Halo Combat Evolved
HDAUDIO Soft Data Fax Modem with SmartCP
Hewlett-Packard Active Check for Health Check
Hewlett-Packard Asset Agent for Health Check
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Active Support Library
HP Customer Experience Enhancements
HP Customer Participation Program 11.0
HP Deskjet D2500 Printer Driver Software 11.0 Rel .3
HP Doc Viewer
HP DVD Play 3.7
HP Easy Setup - Frontend
HP Help and Support
HP Imaging Device Functions 11.0
HP Photosmart Essential 2.5
HP Photosmart Essential 3.0
HP Quick Launch Buttons 6.40 D3
HP Smart Web Printing
HP Solution Center 11.0
HP Total Care Advisor
HP Update
HP User Guides 0118
HP Wireless Assistant
HPNetworkAssistant
HPPhotoSmartDiscLabel_PaperLabel
HPPhotoSmartDiscLabel_PrintOnDisc
HPPhotoSmartDiscLabel_Tattoo
HPPhotoSmartDiscLabelContent1
hpphotosmartdisclabelplugin
HPPhotoSmartPhotobookHolidayPack1
HPPhotoSmartPhotobookModernPack1
HPPhotoSmartPhotobookPlayfulPack1
HPPhotoSmartPhotobookScrapbookPack1
HPPhotoSmartPhotobookWebPack1
HPProductAssistant
iTunes
Java(TM) 6 Update 16
Java(TM) 6 Update 5
LabelPrint
LightScribe System Software 1.12.33.2
LiveUpdate (Symantec Corporation)
MarketResearch
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Antimalware
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office Live Add-in 1.3
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Security Essentials
Microsoft Silverlight
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
Mozilla Firefox (3.6.6)
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
muvee autoProducer 6.1
My HP Games
NetWaiting
NVIDIA Drivers
Power2Go
PowerDirector
PSSWCORE
PVSonyDll
QuickPlay SlingPlayer 0.4.6
QuickTax 2009
QuickTime
Realtek USB 2.0 Card Reader
Rogers Servicepoint Agent 2.0.21
RPS CRT
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for 2007 Microsoft Office System (KB982312)
Security Update for 2007 Microsoft Office System (KB982331)
Security Update for Microsoft Office Excel 2007 (KB982308)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB982158)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB982135)
SmartWebPrinting
SolutionCenter
Spybot - Search & Destroy
Status
Synaptics Pointing Device Driver
The Sims™ 2 Double Deluxe
Toolbox
TrayApp
TweetDeck
Uninstall 1.0.0.1
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
VideoToolkit01
Virtual DJ - Atomix Productions
VLC media player 1.0.1
WebReg
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Upload Tool
Windows Media Player Firefox Plugin
WinRAR archiver
Yahoo! Messenger
Yahoo! Software Update
Yahoo! Toolbar

==== End Of File ===========================

ken545 · Aug 8, 2010

Hi,

We have run so many scans and nothing related to searchpro is showing up

searchprotocolhost.exe <-- This legit , its part of windows

Lets replace your hosts file, lets do it this way.

You already have HostsXpert downloaded to your desktop, if you still have it fine, if not redownload it ...BUT DONT RUN IT YET

Download the HostsXpert 4.3 - Hosts File Manager.

Unzip HostsXpert 4.2.0.0 - Hosts File Manager to a convenient folder such as C:\HostsXpert
Click HostsXpert.exe to Run HostsXpert - Hosts File Manager from its new home
Click "Make Hosts Writable?" in the upper left corner.
Click Restore Microsoft's Hosts file and then click OK.
Click the X to exit the program.
Note: If you were using a custom Hosts file you will need to replace any of those entries yourself.

Please download OTM by OldTimer and save it to your desktop.
Double click the

icon on your desktop.

Paste the following code under the

area.
Do not include the word "Code".

Code:

:Processes
explorer.exe

:Services

:Reg

:Files
c:\windows\system32\drivers\etc\hosts


:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Push the large

button.
OTM may ask to reboot the machine. Please do so if asked.
Copy/Paste the contents under the

line here in your next reply.
If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Now run HostsXpert

Restore Microsoft's Hosts file <-- You will get a message stating that there is no hosts file available do you want to create one SAY YES

DaReelDeel · Aug 9, 2010

Hi. I ran OTM and restored the Microsoft Hosts file. Here is the log for OTM.

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
c:\windows\system32\drivers\etc\hosts moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Bhing or J.A
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Darlin
->Temp folder emptied: 5526065 bytes
->Temporary Internet Files folder emptied: 70163742 bytes
->Java cache emptied: 370065 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 371204103 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 101923 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: TEMP
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: TEMP.Darlin-PC
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: TEMP.Darlin-PC.000
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 547844 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 427.00 mb

OTM by OldTimer - Version 3.1.15.0 log created on 08092010_125437

Files moved on Reboot...
C:\Users\Darlin\AppData\Local\Temp\ehmsas.txt moved successfully.
C:\Users\Darlin\AppData\Local\Temp\VGXFB3F.tmp moved successfully.

Registry entries deleted on Reboot...

ken545 · Aug 9, 2010

Did it fix it ?

DaReelDeel · Aug 10, 2010

No. It didn't seem to work.

ken545 · Aug 10, 2010

ok, we have run about every scan in the book and nothing appears to find and fix this issue, not sure but most likely there is a rootkit type of infection causing this and we wont know until I see a GMER log.

I need you to run GMER, please dont download it from the site you said you downloaded it from to work, download it from the link I am posting, if you still have it on your desktop, drag it to the trash.

We're going to disable your CD drivers, not to worry we will reenable them when were done

Please download DeFogger to your desktop.

Double click DeFogger to run the tool.

The application window will appear
Click the Disable button to disable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.

Do not re-enable these drivers until otherwise instructed.

Next:

Please download GMER from one of the following locations and save it to your desktop:

Main Mirror
This version will download a randomly named file (Recommended)
Zipped Mirror
This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

Disconnect from the Internet and close all running programs.
Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
Now click the Scan button. If you see a rootkit warning window, click OK.
When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
Click the Copy button and paste the results into your next reply.
Exit GMER and re-enable all active protection when done.

To re-enable your Emulation drivers, double click DeFogger to run the tool.

The application window will appear
Click the Re-enable button to re-enable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.

DaReelDeel · Aug 12, 2010

Hello, sorry for the late response. I have followed your instructions and here are the logs.

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 12:24 on 12/08/2010 (Darlin)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...

-=E.O.F=-

defogger_enable by jpshortstuff (23.02.10.1)
Log created at 13:18 on 12/08/2010 (Darlin)

Parsing file...

-=E.O.F=-

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-08-12 13:10:51
Windows 6.0.6002 Service Pack 2
Running: 9524bskr.exe; Driver: C:\Users\Darlin\AppData\Local\Temp\pxryrpod.sys

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Windows\Explorer.EXE[3272] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [742C7817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3272] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [7431A86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3272] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [742CBB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3272] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [742BF695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3272] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [742C75E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3272] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [742BE7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3272] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [742F8395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3272] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [742CDA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3272] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [742BFFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3272] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [742BFF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3272] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [742B71CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3272] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [7434CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3272] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [742EC8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3272] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [742BD968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3272] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [742B6853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3272] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [742B687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3272] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [742C2AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001e37b91a0f
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001e37b91a0f (not active ControlSet)
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0x2E 0xE8 0xE1 0x00 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x71 0x3B 0x04 0x66 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0x25 0xDA 0xEC 0x7E ...
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x86 0x8C 0x21 0x01 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xE9 0x02 0x6C 0xFA ...
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0x50 0x93 0xE5 0xAB ...
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0x31 0x77 0xE1 0xBA ...
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0x01 0x3A 0x48 0xFC ...
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0xB2 0x46 0x9A 0xE2 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0x3D 0xCE 0xEA 0x26 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0xF8 0x31 0x0F 0xA9 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0xFA 0xEA 0x66 0x7F ...

---- EOF - GMER 1.0.15 ----

ken545 · Aug 12, 2010

Leave Defogger disabled and run GMER again this time just check your C: Drive and uncheck all except the Sections Tab

Then run this program
Download http://www.f-secure.com/en_EMEA/security/tools/blacklight/index.html Save it to your desktop

Double-click blbeta.exe
Then accept the agreement
Click > scan then > next
You'll see a list of all items found. There will also be a log on your desktop with the name fsbl.xxxxxxx.log (the xxxxxxx stand for numbers).
Copy and paste this log in your next reply.
Don't choose the rename option yet! I want to see the log first, because legitimate items can also be present there, such as "wbemtest.exe"

Malware Infection

New member

Emeritus-Security Expert

New member

Emeritus-Security Expert

New member

Emeritus-Security Expert

New member

Emeritus-Security Expert

New member

Emeritus-Security Expert

New member

Emeritus-Security Expert

New member

Emeritus-Security Expert

New member

Emeritus-Security Expert

New member

Emeritus-Security Expert

New member

Emeritus-Security Expert