Malware on my computer - lots of popups

sangsy · May 7, 2011

Hello - There is something on my computer that is generating crazy popups. My computer has also gone dead slow and something simple as opening an application or browser takes a long time. I am unable to do this post from the infected computer and am using a different one to do it! Here is the DDS log. I have also included attach.txt as a zip file.

Please help! I appreciate your help in advance.

.
DDS (Ver_11-03-05.01) - NTFSx86
Run by Karthik at 22:50:18.31 on Fri 05/06/2011
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_20
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.190 [GMT -5:00]
.
AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
============== Running Processes ===============
.
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\PROGRA~1\Yahoo!\Messenger\ymsgr_tray.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Documents and Settings\Karthik\Application Data\mjusbsp\magicJack.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Karthik\Desktop\dds.scr
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.bing.com/?pc=ZUGO&form=ZGAPHP
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
BHO: Search Toolbar: {9d425283-d487-4337-bab6-ab8354a81457} - c:\program files\search toolbar\SearchToolbar.dll
BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~1\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
TB: Search Toolbar: {9d425283-d487-4337-bab6-ab8354a81457} - c:\program files\search toolbar\SearchToolbar.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [cdloader] "c:\documents and settings\karthik\application data\mjusbsp\cdloader2.exe" MAGICJACK
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messenger\YahooMessenger.exe" -quiet
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
StartupFolder: c:\docume~1\karthik\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1275683035745
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxsrvc.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\docume~1\karthik\applic~1\mozilla\firefox\profiles\mrvxhml8.default\
FF - prefs.js: browser.search.selectedEngine - Bing
FF - prefs.js: browser.startup.homepage - hxxp://www.bing.com/?pc=ZUGO&form=ZGAPHP
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=ZUGO&form=ZGAADF&q=
FF - component: c:\program files\avg\avg10\firefox4\components\avgssff4.dll
FF - plugin: c:\progra~1\micros~3\office14\NPSPWRAP.DLL
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
.
---- FIREFOX POLICIES ----
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
============= SERVICES / DRIVERS ===============
.
R0 Achernar;Achernar - Storage Filter Drivers;c:\windows\system32\drivers\Achernar.sys [2004-2-11 16855]
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2010-9-13 25680]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2010-9-7 26064]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2010-9-7 251728]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2010-9-7 34384]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2010-11-9 299984]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2011-1-6 6128720]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2010-10-22 265400]
R2 cvhsvc;Client Virtualization Handler;c:\program files\common files\microsoft shared\virtualization handler\CVHSVC.EXE [2010-2-28 821664]
R2 sftlist;Application Virtualization Client;c:\program files\microsoft application virtualization client\sftlist.exe [2009-12-2 483688]
R3 Aldebaran;Aldebaran - Storage Filter Drivers;c:\windows\system32\drivers\Aldebaran.sys [2004-2-11 21808]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2010-8-19 123472]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2010-8-19 30288]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2010-8-19 26192]
R3 Sftfs;Sftfs;c:\windows\system32\drivers\Sftfsxp.sys [2009-12-2 554344]
R3 Sftplay;Sftplay;c:\windows\system32\drivers\Sftplayxp.sys [2009-12-2 211304]
R3 Sftredir;Sftredir;c:\windows\system32\drivers\Sftredirxp.sys [2009-12-2 20584]
R3 Sftvol;Sftvol;c:\windows\system32\drivers\Sftvolxp.sys [2009-12-2 18280]
R3 sftvsa;Application Virtualization Service Agent;c:\program files\microsoft application virtualization client\sftvsa.exe [2009-12-2 209768]
S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]
.
=============== Created Last 30 ================
.
2011-05-06 02:19:52 -------- d-----w- c:\docume~1\karthik\applic~1\Malwarebytes
2011-05-06 02:18:47 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-06 02:18:38 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2011-05-06 02:18:19 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-06 02:18:12 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-05-06 02:14:26 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-05-06 02:14:26 -------- d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2011-05-06 01:39:02 -------- d-----w- c:\docume~1\karthik\applic~1\95E948E7C31F11AE1C3A0FF44693CFCA
2011-05-06 01:25:16 -------- d-----w- c:\docume~1\alluse~1\applic~1\aJ31000LbHnJ31000
2011-05-05 22:42:10 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2011-05-05 22:42:09 89048 ----a-w- c:\program files\mozilla firefox\libEGL.dll
2011-05-05 22:42:09 781272 ----a-w- c:\program files\mozilla firefox\mozsqlite3.dll
2011-05-05 22:42:09 465880 ----a-w- c:\program files\mozilla firefox\libGLESv2.dll
2011-05-05 22:42:09 1974616 ----a-w- c:\program files\mozilla firefox\D3DCompiler_42.dll
2011-05-05 22:42:09 1892184 ----a-w- c:\program files\mozilla firefox\d3dx9_42.dll
2011-05-05 22:42:09 1874904 ----a-w- c:\program files\mozilla firefox\mozjs.dll
2011-05-05 22:42:09 15832 ----a-w- c:\program files\mozilla firefox\mozalloc.dll
2011-04-13 22:40:10 4284416 ----a-w- c:\windows\system32\GPhotos.scr
.
==================== Find3M ====================
.
2011-03-07 05:33:50 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:45:07 434176 ----a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21:11 1857920 ----a-w- c:\windows\system32\win32k.sys
2011-02-17 19:00:29 832512 ----a-w- c:\windows\system32\wininet.dll
2011-02-17 19:00:28 78336 ------w- c:\windows\system32\ieencode.dll
2011-02-17 19:00:28 1830912 ------w- c:\windows\system32\inetcpl.cpl
2011-02-17 19:00:27 17408 ----a-w- c:\windows\system32\corpol.dll
2011-02-17 12:32:12 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2011-02-17 11:44:16 389120 ------w- c:\windows\system32\html.iec
2011-02-15 12:56:39 290432 ----a-w- c:\windows\system32\atmfd.dll
2011-02-09 13:53:52 270848 ----a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53:52 186880 ----a-w- c:\windows\system32\encdec.dll
2011-02-08 13:33:55 978944 ----a-w- c:\windows\system32\mfc42.dll
2011-02-08 13:33:55 974848 ----a-w- c:\windows\system32\mfc42u.dll
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: WDC_WD800BB-75FJA1 rev.14.03G14 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8232D6F0]<<
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x82333a10]; MOV EAX, [0x82333a8c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 nt!IofCallDriver[0x804E37D5] -> \Device\Harddisk0\DR0[0x8236AAB8]
3 CLASSPNP[0xF8578FD7] -> nt!IofCallDriver[0x804E37D5] -> [0x823958A8]
\Driver\atapi[0x8236E1D8] -> IRP_MJ_CREATE -> 0x8232D6F0
error: Read A device attached to the system is not functioning.
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
detected hooks:
\Driver\atapi DriverStartIo -> 0x8232D53B
user & kernel MBR OK
Warning: possible TDL3 rootkit infection !
.
============= FINISH: 22:52:38.64 ===============

ken545 · May 11, 2011

:snwelcome:

Please read Before You Post
While best efforts are made to assist in removing infections safely, unexpected stuff can happen. It is advisable that you back up your important data before starting any clean up procedure. Neither Safer Networking Forums nor the Analyst providing the advice may be held responsible for any loss.

Until we deem your system clean I am going to ask you not to install or uninstall any software or hardware except for the programs we may run.

Your infected with a nasty Rootkit :lip:

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan

On completion of the scan click save log, save it to your desktop and post in your next reply

sangsy · May 11, 2011

aswMBR log

Thanks, Ken545, for helping with this! Here is the aswMBR log.

aswMBR version 0.9.5.256 Copyright(c) 2011 AVAST Software
Run date: 2011-05-10 21:43:19
-----------------------------
21:43:19.028 OS Version: Windows 5.1.2600 Service Pack 3
21:43:19.028 Number of processors: 1 586 0x209
21:43:19.044 ComputerName: KARTHIK-NHG37VT UserName: Karthik
21:43:42.591 Initialize success
21:44:14.638 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
21:44:14.638 Disk 0 Vendor: WDC_WD800BB-75FJA1 14.03G14 Size: 76293MB BusType: 3
21:44:14.638 Device \Driver\atapi -> DriverStartIo 8232d53b
21:44:16.872 Disk 0 MBR read successfully
21:44:16.872 Disk 0 MBR scan
21:44:16.872 Disk 0 TDL4@MBR code has been found
21:44:16.872 Disk 0 Windows XP default MBR code found via API
21:44:16.872 Disk 0 MBR hidden
21:44:16.872 Disk 0 MBR [TDL4] **ROOTKIT**
21:44:16.872 Disk 0 trace - called modules:
21:44:16.872 ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8232d6f0]<<
21:44:16.872 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8236aab8]
21:44:16.872 3 CLASSPNP.SYS[f8578fd7] -> nt!IofCallDriver -> [0x822df030]
21:44:16.872 \Driver\atapi[0x823cb7b0] -> IRP_MJ_CREATE -> 0x8232d6f0
21:44:17.075 Scan finished successfully
21:46:57.841 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Karthik\Desktop\MBR.dat"
21:46:59.372 The log file has been saved successfully to "C:\Documents and Settings\Karthik\Desktop\aswMBR_log.txt"

ken545 · May 11, 2011

Good Morning

Re-Run aswMBR

Click Scan

On completion of the scan

Click Fix

Save the log as before and post in your next reply

sangsy · May 12, 2011

Post aswMBR fix log

I truly appreciate your help. Thanks!

I followed the steps. When I clicked on 'Fix' after scanning, the console showed that the infection had been removed but at the step where it was verifying the same, the computer crashed (blue screen).

I restarted the computer and ran the scan again. This time, it did not report any infections and the 'Fix' button was grayed out. Here is the log from this run of aswMBR.

aswMBR version 0.9.5.256 Copyright(c) 2011 AVAST Software
Run date: 2011-05-11 20:09:55
-----------------------------
20:09:55.093 OS Version: Windows 5.1.2600 Service Pack 3
20:09:55.093 Number of processors: 1 586 0x209
20:09:55.093 ComputerName: KARTHIK-NHG37VT UserName: Karthik
20:10:04.375 Initialize success
20:10:07.312 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
20:10:07.312 Disk 0 Vendor: WDC_WD800BB-75FJA1 14.03G14 Size: 76293MB BusType: 3
20:10:09.343 Disk 0 MBR read successfully
20:10:09.343 Disk 0 MBR scan
20:10:09.343 Disk 0 Windows XP default MBR code
20:10:11.343 Disk 0 scanning sectors +156232125
20:10:11.375 Disk 0 scanning C:\WINDOWS\system32\drivers
20:10:20.265 Service scanning
20:10:21.406 Disk 0 trace - called modules:
20:10:21.406 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll intelide.sys PCIIDEX.SYS
20:10:21.406 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8239bab8]
20:10:21.406 3 CLASSPNP.SYS[f8578fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x82370d98]
20:10:21.406 Scan finished successfully
20:10:48.640 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Karthik\Desktop\MBR.dat"
20:10:48.671 The log file has been saved successfully to "C:\Documents and Settings\Karthik\Desktop\aswMBR_postfix_log.txt"

ken545 · May 12, 2011

Good Morning,

Looks like the Rootkit is gone so you should see a big difference in your computer. With a Rootkit, sometimes friends hop along for a ride so we need to run a few more scans, I am sure there will be more to remove

Please download Malwarebytes from Here or Here

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

Post the report please

OTL by OldTimer

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Click the "Scan All Users" checkbox.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
  Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

sangsy · May 13, 2011

Malwarebytes log

Hello. Thanks for helping!

Here is the malwarebytes log.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6564

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

5/12/2011 8:00:43 PM
mbam-log-2011-05-12 (20-00-42).txt

Scan type: Quick scan
Objects scanned: 160708
Time elapsed: 21 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

--------------------------

sangsy · May 13, 2011

OTL Log

OTL.txt output
--------
OTL logfile created on: 5/12/2011 8:11:40 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Karthik\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.00 Mb Total Physical Memory | 203.00 Mb Available Physical Memory | 40.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 53.00% Paging File free
Paging file location(s): c:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 71.46 Gb Total Space | 27.09 Gb Free Space | 37.90% Space Free | Partition Type: NTFS

Computer Name: KARTHIK-NHG37VT | User Name: Karthik | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Karthik\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Karthik\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (RemoteAccess) -- File not found
SRV - (itlperf) -- File not found
SRV - (helpsvc) -- File not found
SRV - (FastUserSwitchingCompatibility) -- File not found
SRV - (AVGIDSAgent) -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) -- C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (sftvsa) -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (Avgldx86) -- C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgtdix) -- C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Aldebaran) -- C:\WINDOWS\system32\drivers\Aldebaran.sys (An Chen Computer Co., Ltd.)
DRV - (Achernar) -- C:\WINDOWS\system32\Drivers\Achernar.sys (An Chen Computer Co., Ltd.)
DRV - (AVGIDSEH) -- C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgmfx86) -- C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) -- C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSFilter) -- C:\WINDOWS\system32\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSDriver) -- C:\WINDOWS\system32\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSShim) -- C:\WINDOWS\system32\drivers\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (Sftredir) -- C:\WINDOWS\system32\drivers\Sftredirxp.sys (Microsoft Corporation)
DRV - (Sftvol) -- C:\WINDOWS\system32\drivers\Sftvolxp.sys (Microsoft Corporation)
DRV - (Sftplay) -- C:\WINDOWS\system32\drivers\Sftplayxp.sys (Microsoft Corporation)
DRV - (Sftfs) -- C:\WINDOWS\system32\drivers\Sftfsxp.sys (Microsoft Corporation)
DRV - (senfilt) -- C:\WINDOWS\system32\drivers\senfilt.sys (Creative Technology Ltd.)
DRV - (bcm4sbxp) -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (OMCI) -- C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS (Dell Computer Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1417001333-602162358-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/?pc=ZUGO&form=ZGAPHP
IE - HKU\S-1-5-21-1417001333-602162358-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Bing"
FF - prefs.js..browser.startup.homepage: "http://www.bing.com/?pc=ZUGO&form=ZGAPHP"
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1209
FF - prefs.js..keyword.URL: "http://www.bing.com/search?pc=ZUGO&form=ZGAADF&q="

FF - HKLM\software\mozilla\Firefox\extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/03/30 08:11:30 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/05/05 17:42:10 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/05 17:42:08 | 000,000,000 | ---D | M]

[2010/06/04 17:34:59 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Karthik\Application Data\Mozilla\Extensions
[2011/05/05 17:39:53 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Karthik\Application Data\Mozilla\Firefox\Profiles\mrvxhml8.default\extensions
[2011/03/18 20:06:40 | 000,001,919 | ---- | M] () -- C:\Documents and Settings\Karthik\Application Data\Mozilla\Firefox\Profiles\mrvxhml8.default\searchplugins\bing-zugo.xml
[2011/05/05 17:42:10 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) --
[2011/03/30 08:11:30 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG10\FIREFOX4
[2011/04/14 11:26:02 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010/06/06 16:30:49 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/01/01 03:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml

Hosts file not found
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKU\S-1-5-21-1417001333-602162358-682003330-1003\..\Toolbar\WebBrowser: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKU\S-1-5-21-1417001333-602162358-682003330-1003..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Documents and Settings\Karthik\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1417001333-602162358-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1275683035745 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 68.238.96.12
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Karthik\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Karthik\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/06/04 13:56:33 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/05/12 19:36:57 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Karthik\Desktop\OTL.exe
[2011/05/12 19:29:06 | 007,734,208 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Karthik\Desktop\mbam-setup-1.50.1.1100.exe
[2011/05/10 21:40:03 | 000,589,632 | ---- | C] (AVAST Software) -- C:\Documents and Settings\Karthik\Desktop\aswMBR.exe
[2011/05/06 22:49:20 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/05/06 22:48:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\ERUNT
[2011/05/06 22:48:41 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2011/05/06 22:47:59 | 000,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\Karthik\Desktop\erunt-setup.exe
[2011/05/05 21:19:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karthik\Application Data\Malwarebytes
[2011/05/05 21:18:47 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/05 21:18:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/05/05 21:18:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/05/05 21:18:19 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/05/05 21:18:12 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/05/05 21:14:26 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2011/05/05 21:14:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2011/05/05 21:06:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2011/05/05 21:06:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2011/05/05 20:48:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2011/05/05 20:48:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2011/05/05 20:39:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karthik\Application Data\95E948E7C31F11AE1C3A0FF44693CFCA
[2011/05/05 20:25:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\aJ31000LbHnJ31000
[2011/04/26 20:01:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karthik\Desktop\Collages
[2011/04/26 13:32:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karthik\Desktop\2011-04-11 Mrs. Brisko's Class
[2011/04/25 11:07:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karthik\Desktop\from jump drive
[2011/04/22 10:22:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2011/04/19 21:01:56 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Karthik\Desktop\.picasaoriginals
[2011/04/14 06:00:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karthik\Desktop\Annual dance program
[2011/04/13 17:40:10 | 004,284,416 | ---- | C] (Google Inc.) -- C:\WINDOWS\System32\GPhotos.scr
[8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/05/12 19:45:46 | 114,895,907 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/05/12 19:37:01 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Karthik\Desktop\OTL.exe
[2011/05/12 19:29:18 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Karthik\Desktop\mbam-setup-1.50.1.1100.exe
[2011/05/12 19:25:13 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/05/12 19:24:39 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/05/11 20:10:48 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\MBR.dat
[2011/05/11 20:07:55 | 534,872,064 | ---- | M] () -- C:\WINDOWS\MEMORY.DMP
[2011/05/10 21:40:16 | 000,589,632 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Karthik\Desktop\aswMBR.exe
[2011/05/07 07:16:21 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/05/07 06:44:32 | 000,003,335 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\Attach.zip
[2011/05/07 06:15:45 | 000,001,016 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\magicJack.lnk
[2011/05/06 22:49:57 | 000,625,664 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\dds.scr
[2011/05/06 22:48:49 | 000,000,592 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\ERUNT.lnk
[2011/05/06 22:48:00 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\Karthik\Desktop\erunt-setup.exe
[2011/05/06 06:13:33 | 000,137,395 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\cn_macys-coupons__259880p.pdf
[2011/05/05 21:19:00 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/05 17:42:15 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\Karthik\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/05/05 17:42:15 | 000,000,724 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/05/05 16:47:49 | 003,273,551 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\110421_000.mp3
[2011/05/05 16:47:19 | 002,355,165 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\Memo(3).m4a
[2011/05/05 16:46:34 | 000,442,557 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\Memo(2).m4a
[2011/05/05 16:46:02 | 002,351,533 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\Ramachandraya version original.mp3
[2011/05/05 07:18:53 | 000,377,615 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\HUD.pdf
[2011/05/05 07:18:51 | 000,009,328 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\ServiceProviderList.pdf
[2011/05/05 07:18:46 | 000,482,796 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\Combined-UpfrontDocument.pdf
[2011/05/03 20:01:22 | 000,193,581 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\kl3.jpg
[2011/05/03 19:50:42 | 000,126,636 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\kl2.jpg
[2011/05/03 19:49:18 | 000,082,911 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\kl1.jpg
[2011/04/27 09:43:05 | 000,002,265 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2011/04/21 19:36:47 | 000,077,132 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\IMG_3040.jpg
[2011/04/21 19:36:43 | 000,078,516 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\IMG_3039.jpg
[2011/04/21 19:36:40 | 000,084,921 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\IMG_3037.jpg
[2011/04/21 19:36:35 | 000,093,293 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\IMG_3029.jpg
[2011/04/21 09:35:03 | 000,425,363 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\CustomerAgreementBrokerage.pdf
[2011/04/19 21:01:57 | 000,373,345 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\Anika.jpg
[2011/04/15 13:38:34 | 000,048,728 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\ETKT_VRAMESH.pdf
[2011/04/15 06:06:42 | 000,116,560 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/04/14 22:30:02 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/04/14 10:05:47 | 000,087,590 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\macys coupon.pdf
[2011/04/13 17:40:10 | 004,284,416 | ---- | M] (Google Inc.) -- C:\WINDOWS\System32\GPhotos.scr
[8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/05/10 21:46:57 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\MBR.dat
[2011/05/07 06:44:32 | 000,003,335 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\Attach.zip
[2011/05/06 22:49:57 | 000,625,664 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\dds.scr
[2011/05/06 22:48:49 | 000,000,592 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\ERUNT.lnk
[2011/05/06 06:13:33 | 000,137,395 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\cn_macys-coupons__259880p.pdf
[2011/05/05 22:16:01 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/05/05 21:19:00 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/05 17:42:15 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2011/05/05 16:47:48 | 003,273,551 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\110421_000.mp3
[2011/05/05 16:47:19 | 002,355,165 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\Memo(3).m4a
[2011/05/05 16:46:33 | 000,442,557 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\Memo(2).m4a
[2011/05/05 16:46:00 | 002,351,533 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\Ramachandraya version original.mp3
[2011/05/05 07:18:53 | 000,377,615 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\HUD.pdf
[2011/05/05 07:18:50 | 000,009,328 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\ServiceProviderList.pdf
[2011/05/05 07:18:45 | 000,482,796 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\Combined-UpfrontDocument.pdf
[2011/05/03 20:01:21 | 000,193,581 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\kl3.jpg
[2011/05/03 19:50:42 | 000,126,636 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\kl2.jpg
[2011/05/03 19:49:14 | 000,082,911 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\kl1.jpg
[2011/04/21 19:36:46 | 000,077,132 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\IMG_3040.jpg
[2011/04/21 19:36:43 | 000,078,516 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\IMG_3039.jpg
[2011/04/21 19:36:39 | 000,084,921 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\IMG_3037.jpg
[2011/04/21 19:36:34 | 000,093,293 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\IMG_3029.jpg
[2011/04/21 09:35:03 | 000,425,363 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\CustomerAgreementBrokerage.pdf
[2011/04/19 21:01:57 | 000,373,345 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\Anika.jpg
[2011/04/15 13:38:33 | 000,048,728 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\ETKT_VRAMESH.pdf
[2011/04/14 10:05:47 | 000,087,590 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\macys coupon.pdf
[2010/11/04 21:02:16 | 000,005,632 | ---- | C] () -- C:\Documents and Settings\Karthik\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/16 19:01:39 | 000,122,771 | ---- | C] () -- C:\WINDOWS\hpoins14.dat
[2010/06/16 19:01:39 | 000,001,996 | ---- | C] () -- C:\WINDOWS\hpomdl14.dat
[2010/06/16 08:21:24 | 000,000,048 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010/06/04 17:34:54 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/06/04 15:38:55 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2010/06/04 14:02:06 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010/06/04 13:53:01 | 000,022,720 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/06/04 08:47:14 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010/06/04 08:45:50 | 000,116,560 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2003/07/16 11:48:28 | 000,004,594 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2003/07/16 11:48:27 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2003/07/16 11:35:07 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2003/07/16 11:35:06 | 000,312,048 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2003/07/16 11:35:05 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2003/07/16 11:35:03 | 000,040,178 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2003/07/16 11:33:18 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2003/07/16 11:28:25 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2003/07/16 11:28:14 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2003/07/16 11:21:49 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2003/07/16 11:20:48 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin

========== LOP Check ==========

[2011/05/06 20:05:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\aJ31000LbHnJ31000
[2011/05/10 21:29:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG10
[2010/12/13 19:59:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2010/12/13 20:08:50 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2010/08/24 09:50:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\magicJack
[2011/05/05 18:37:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2010/11/03 17:47:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\VirtualizedApplications
[2011/05/06 20:05:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karthik\Application Data\95E948E7C31F11AE1C3A0FF44693CFCA
[2010/12/13 20:10:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karthik\Application Data\AVG10
[2011/05/07 06:16:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karthik\Application Data\mjusbsp
[2010/06/06 16:40:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karthik\Application Data\OpenOffice.org
[2011/01/30 12:11:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karthik\Application Data\SoftGrid Client
[2010/09/29 20:32:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karthik\Application Data\TP
[2011/04/28 02:02:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sangeetha\Application Data\AVG10

========== Purity Check ==========

< End of report >

----------------
Extra.txt output

OTL Extras logfile created on: 5/12/2011 8:11:40 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Karthik\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.00 Mb Total Physical Memory | 203.00 Mb Available Physical Memory | 40.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 53.00% Paging File free
Paging file location(s): c:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 71.46 Gb Total Space | 27.09 Gb Free Space | 37.90% Space Free | Partition Type: NTFS

Computer Name: KARTHIK-NHG37VT | User Name: Karthik | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-1417001333-602162358-682003330-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AVG\AVG10\avgmfapx.exe" = C:\Program Files\AVG\AVG10\avgmfapx.exe:*:Enabled:AVG Installer -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)
"C:\Program Files\AVG\AVG10\avgdiagex.exe" = C:\Program Files\AVG\AVG10\avgdiagex.exe:*:Enabled:AVG Diagnostics 2011 -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG10\avgnsx.exe" = C:\Program Files\AVG\AVG10\avgnsx.exe:*:Enabled:Online Shield -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG10\avgemcx.exe" = C:\Program Files\AVG\AVG10\avgemcx.exe:*:Enabled

ersonal E-mail Scanner -- (AVG Technologies CZ, s.r.o.)
"C:\Documents and Settings\Karthik\Application Data\mjusbsp\magicJack.exe" = C:\Documents and Settings\Karthik\Application Data\mjusbsp\magicJack.exe:*:Enabled:magicJack -- (magicJack L.P.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{22B63674-C542-4CE0-8016-A1FE3C919B82}" = DVD Power Burner
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2F28B3C9-2C89-4206-8B33-8ADC9577C49B}" = Scan
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{52504CE6-E909-4113-B232-4AFEC6543A61}" = Broadcom 440x 10/100 Integrated Controller
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{5A13987D-55F4-4271-A40E-76AC9B1B38FD}" = OpenOffice.org 3.2
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Extreme Graphics Driver
"{90140000-006D-0409-0000-0000000FF1CE}" = Microsoft Office Click-to-Run 2010
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.2
"{AF7FC1CA-79DF-43c3-90A3-33EFEB9294CE}" = AIO_Scan
"{B2C61EBB-F47C-48ba-B375-27A40F8F48F7}" = HP Deskjet All-In-One Software 9.0
"{B3AEF776-7FFF-4C50-A402-9119E3849EE0}" = AVG 2011
"{B4F35A00-24FD-4fb3-BF5E-413D5423434D}" = DJ_AIO_Software_min
"{BFE903DE-4845-4387-9C6C-98B21B8445A3}" = GMATPrep(TM)
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{D4E53304-1F6C-4111-9872-1BCD2CF5B642}" = AVG 2011
"{D78653C3-A8FF-415F-92E6-D774E634FF2D}" = Dell ResourceCD
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1
"{E9C18EBD-85BE-47D0-AA73-3FEDCC976B04}" = Toolbox
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AVG" = AVG 2011
"ERUNT_is1" = ERUNT 1.1j
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{22B63674-C542-4CE0-8016-A1FE3C919B82}" = DVD Power Burner
"InstallShield_{52504CE6-E909-4113-B232-4AFEC6543A61}" = Broadcom 440x 10/100 Integrated Controller
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox 4.0.1 (x86 en-US)" = Mozilla Firefox 4.0.1 (x86 en-US)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Office14.Click2Run" = Microsoft Office Click-to-Run 2010
"Picasa 3" = Picasa 3
"Windows XP Service Pack" = Windows XP Service Pack 3
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Messenger" = Yahoo! Messenger

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1417001333-602162358-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"magicJack" = magicJack

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 5/6/2011 6:46:41 AM | Computer Name = KARTHIK-NHG37VT | Source = crypt32 | ID = 131077
Description = Failed auto update retrieval of third-party root certificate from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/2796BAE63F1801E277261BA0D77770028F20EEE4.crt>
with error: This network connection does not exist.

Error - 5/6/2011 6:46:41 AM | Computer Name = KARTHIK-NHG37VT | Source = crypt32 | ID = 131077
Description = Failed auto update retrieval of third-party root certificate from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/2796BAE63F1801E277261BA0D77770028F20EEE4.crt>
with error: This network connection does not exist.

Error - 5/6/2011 6:55:38 AM | Computer Name = KARTHIK-NHG37VT | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 2.0.1.4120, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 5/6/2011 10:57:24 AM | Computer Name = KARTHIK-NHG37VT | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 2.0.1.4120, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 5/6/2011 11:04:32 AM | Computer Name = KARTHIK-NHG37VT | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 2.0.1.4120, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 5/6/2011 2:39:52 PM | Computer Name = KARTHIK-NHG37VT | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 2.0.1.4120, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 5/6/2011 4:41:48 PM | Computer Name = KARTHIK-NHG37VT | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 2.0.1.4120, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 5/6/2011 6:08:23 PM | Computer Name = KARTHIK-NHG37VT | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 2.0.1.4120, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 5/7/2011 8:00:37 AM | Computer Name = KARTHIK-NHG37VT | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.17096, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 5/12/2011 9:09:19 PM | Computer Name = KARTHIK-NHG37VT | Source = Application Hang | ID = 1002
Description = Hanging application mbam.exe, version 1.50.1.3, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 5/6/2011 9:05:20 PM | Computer Name = KARTHIK-NHG37VT | Source = Service Control Manager | ID = 7000
Description = The Themes service failed to start due to the following error: %%1053

Error - 5/10/2011 10:29:13 PM | Computer Name = KARTHIK-NHG37VT | Source = Service Control Manager | ID = 7023
Description = The Help and Support service terminated with the following error:
%%126

Error - 5/10/2011 10:29:13 PM | Computer Name = KARTHIK-NHG37VT | Source = Service Control Manager | ID = 7023
Description = The Intel CPU service terminated with the following error: %%126

Error - 5/11/2011 9:04:30 PM | Computer Name = KARTHIK-NHG37VT | Source = Service Control Manager | ID = 7023
Description = The Help and Support service terminated with the following error:
%%126

Error - 5/11/2011 9:04:30 PM | Computer Name = KARTHIK-NHG37VT | Source = Service Control Manager | ID = 7023
Description = The Intel CPU service terminated with the following error: %%126

Error - 5/11/2011 9:08:44 PM | Computer Name = KARTHIK-NHG37VT | Source = Service Control Manager | ID = 7023
Description = The Intel CPU service terminated with the following error: %%126

Error - 5/11/2011 9:08:44 PM | Computer Name = KARTHIK-NHG37VT | Source = Service Control Manager | ID = 7023
Description = The Help and Support service terminated with the following error:
%%126

Error - 5/11/2011 9:09:23 PM | Computer Name = KARTHIK-NHG37VT | Source = System Error | ID = 1003
Description = Error code 00000096, parameter1 f898bd1c, parameter2 80562340, parameter3
80562340, parameter4 8232d8da.

Error - 5/12/2011 8:25:10 PM | Computer Name = KARTHIK-NHG37VT | Source = Service Control Manager | ID = 7023
Description = The Help and Support service terminated with the following error:
%%126

Error - 5/12/2011 8:25:10 PM | Computer Name = KARTHIK-NHG37VT | Source = Service Control Manager | ID = 7023
Description = The Intel CPU service terminated with the following error: %%126

< End of report >

ken545 · May 13, 2011

Looking good. How is your system running now ?

ESET Online Scanner
I'd like us to scan your machine with ESET OnlineScan

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
Click the

button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
1. Click on
  
  to download the ESET Smart Installer. Save it to your desktop.
2. Double click on the
  
  icon on your desktop.
Check
Click the

button.
Accept any security warnings from your browser.
Check
Make sure that the option "Remove found threats" is Unchecked
Push the Start button.
ESET will then download updates for itself, install itself, and begin
scanning your computer. Please be patient as this can take some time.
When the scan completes, push
Push

, and save the file to your desktop using a unique name, such as
ESETScan. Include the contents of this report in your next reply.
Push the

button.
Push

Please make sure you include the following items in your next post:
The log that was produced after running ESET Online Scanner.

sangsy · May 13, 2011

ESET log

Hello Ken545. The computer is much better now. It is back to its normal speed. Thank you very much for helping me with this problem. Here is the ESET log.

C:\Documents and Settings\Karthik\Application Data\95E948E7C31F11AE1C3A0FF44693CFCA\enemies-names.txt Win32/Adware.AntimalwareDoctor.AE.Gen application
C:\Documents and Settings\Karthik\Application Data\95E948E7C31F11AE1C3A0FF44693CFCA\local.ini Win32/Adware.AntimalwareDoctor.AE.Gen application
C:\Program Files\Search Toolbar\SearchToolbar.dll Win32/Toolbar.Zugo application

ken545 · May 13, 2011

:bigthumb:

Open OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

Code:

:processes
killallprocesses

:OTL



:Services

:Reg

:Files
C:\Documents and Settings\Karthik\Application Data\95E948E7C31F11AE1C3A0FF44693CFCA
C:\Program Files\Search Toolbar




:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top. <--Not run Scan
Let the program run unhindered, reboot when it is done
Then post the results of the log it produces.
Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

sangsy · May 13, 2011

OTL Logs

Thanks! Here is the log file after running the fix with the custom code.

All processes killed
========== PROCESSES ==========
========== OTL ==========
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\Documents and Settings\Karthik\Application Data\95E948E7C31F11AE1C3A0FF44693CFCA folder moved successfully.
C:\Program Files\Search Toolbar folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 976318 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Karthik
->Temp folder emptied: 4760036 bytes
->Temporary Internet Files folder emptied: 8183274 bytes
->Java cache emptied: 10255 bytes
->FireFox cache emptied: 77604857 bytes
->Flash cache emptied: 238619 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 213394 bytes
->Flash cache emptied: 584 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 622994 bytes
->Flash cache emptied: 3871 bytes

User: Sangeetha
->Temp folder emptied: 18126 bytes
->Temporary Internet Files folder emptied: 2478148 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 55386277 bytes
->Flash cache emptied: 1703 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2252769 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 4653714 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 71456 bytes
RecycleBin emptied: 46990787 bytes

Total Files Cleaned = 195.00 mb

OTL by OldTimer - Version 3.2.22.3 log created on 05132011_135519

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

--------------------------
Here is the OTL log file after running the scan.

OTL logfile created on: 5/13/2011 2:03:28 PM - Run 2
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Karthik\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.00 Mb Total Physical Memory | 90.00 Mb Available Physical Memory | 18.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 63.00% Paging File free
Paging file location(s): c:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 71.46 Gb Total Space | 27.35 Gb Free Space | 38.27% Space Free | Partition Type: NTFS

Computer Name: KARTHIK-NHG37VT | User Name: Karthik | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Karthik\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Karthik\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (RemoteAccess) -- File not found
SRV - (itlperf) -- File not found
SRV - (helpsvc) -- File not found
SRV - (FastUserSwitchingCompatibility) -- File not found
SRV - (AVGIDSAgent) -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) -- C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (sftvsa) -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (Avgldx86) -- C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgtdix) -- C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Aldebaran) -- C:\WINDOWS\system32\drivers\Aldebaran.sys (An Chen Computer Co., Ltd.)
DRV - (Achernar) -- C:\WINDOWS\system32\Drivers\Achernar.sys (An Chen Computer Co., Ltd.)
DRV - (AVGIDSEH) -- C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgmfx86) -- C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) -- C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSFilter) -- C:\WINDOWS\system32\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSDriver) -- C:\WINDOWS\system32\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSShim) -- C:\WINDOWS\system32\drivers\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (Sftredir) -- C:\WINDOWS\system32\drivers\Sftredirxp.sys (Microsoft Corporation)
DRV - (Sftvol) -- C:\WINDOWS\system32\drivers\Sftvolxp.sys (Microsoft Corporation)
DRV - (Sftplay) -- C:\WINDOWS\system32\drivers\Sftplayxp.sys (Microsoft Corporation)
DRV - (Sftfs) -- C:\WINDOWS\system32\drivers\Sftfsxp.sys (Microsoft Corporation)
DRV - (senfilt) -- C:\WINDOWS\system32\drivers\senfilt.sys (Creative Technology Ltd.)
DRV - (bcm4sbxp) -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (OMCI) -- C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS (Dell Computer Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1417001333-602162358-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/?pc=ZUGO&form=ZGAPHP
IE - HKU\S-1-5-21-1417001333-602162358-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Bing"
FF - prefs.js..browser.startup.homepage: "http://www.bing.com/?pc=ZUGO&form=ZGAPHP"
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1209
FF - prefs.js..keyword.URL: "http://www.bing.com/search?pc=ZUGO&form=ZGAADF&q="

FF - HKLM\software\mozilla\Firefox\extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/03/30 08:11:30 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/05/05 17:42:10 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/05 17:42:08 | 000,000,000 | ---D | M]

[2010/06/04 17:34:59 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Karthik\Application Data\Mozilla\Extensions
[2011/05/05 17:39:53 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Karthik\Application Data\Mozilla\Firefox\Profiles\mrvxhml8.default\extensions
[2011/03/18 20:06:40 | 000,001,919 | ---- | M] () -- C:\Documents and Settings\Karthik\Application Data\Mozilla\Firefox\Profiles\mrvxhml8.default\searchplugins\bing-zugo.xml
[2011/05/05 17:42:10 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) --
[2011/03/30 08:11:30 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG10\FIREFOX4
[2011/04/14 11:26:02 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010/06/06 16:30:49 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/01/01 03:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml

Hosts file not found
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - File not found
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - File not found
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKU\S-1-5-21-1417001333-602162358-682003330-1003\..\Toolbar\WebBrowser: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - File not found
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKU\S-1-5-21-1417001333-602162358-682003330-1003..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - Startup: C:\Documents and Settings\Karthik\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1417001333-602162358-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1275683035745 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 68.238.96.12
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Karthik\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Karthik\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/06/04 13:56:33 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/05/13 13:55:19 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/05/13 07:31:08 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2011/05/12 19:36:57 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Karthik\Desktop\OTL.exe
[2011/05/10 21:40:03 | 000,589,632 | ---- | C] (AVAST Software) -- C:\Documents and Settings\Karthik\Desktop\aswMBR.exe
[2011/05/06 22:49:20 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/05/06 22:48:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\ERUNT
[2011/05/06 22:48:41 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2011/05/06 22:47:59 | 000,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\Karthik\Desktop\erunt-setup.exe
[2011/05/05 21:19:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karthik\Application Data\Malwarebytes
[2011/05/05 21:18:47 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/05 21:18:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/05/05 21:18:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/05/05 21:18:19 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/05/05 21:18:12 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/05/05 21:14:26 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2011/05/05 21:14:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2011/05/05 21:06:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2011/05/05 21:06:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2011/05/05 20:48:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2011/05/05 20:48:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2011/05/05 20:25:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\aJ31000LbHnJ31000
[2011/04/26 20:01:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karthik\Desktop\Collages
[2011/04/26 13:32:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karthik\Desktop\2011-04-11 Mrs. Brisko's Class
[2011/04/25 11:07:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karthik\Desktop\from jump drive
[2011/04/22 10:22:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2011/04/19 21:01:56 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Karthik\Desktop\.picasaoriginals
[2011/04/14 06:00:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karthik\Desktop\Annual dance program
[2011/04/13 17:40:10 | 004,284,416 | ---- | C] (Google Inc.) -- C:\WINDOWS\System32\GPhotos.scr

========== Files - Modified Within 30 Days ==========

[2011/05/13 13:59:31 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/05/13 13:58:23 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/05/12 19:45:46 | 114,895,907 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/05/12 19:37:01 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Karthik\Desktop\OTL.exe
[2011/05/11 20:07:55 | 534,872,064 | ---- | M] () -- C:\WINDOWS\MEMORY.DMP
[2011/05/10 21:40:16 | 000,589,632 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Karthik\Desktop\aswMBR.exe
[2011/05/07 07:16:21 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/05/07 06:44:32 | 000,003,335 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\Attach.zip
[2011/05/07 06:15:45 | 000,001,016 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\magicJack.lnk
[2011/05/06 22:49:57 | 000,625,664 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\dds.scr
[2011/05/06 22:48:49 | 000,000,592 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\ERUNT.lnk
[2011/05/06 22:48:00 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\Karthik\Desktop\erunt-setup.exe
[2011/05/06 06:13:33 | 000,137,395 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\cn_macys-coupons__259880p.pdf
[2011/05/05 21:19:00 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/05 17:42:15 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\Karthik\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/05/05 17:42:15 | 000,000,724 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/05/05 16:47:49 | 003,273,551 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\110421_000.mp3
[2011/05/05 16:47:19 | 002,355,165 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\Memo(3).m4a
[2011/05/05 16:46:34 | 000,442,557 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\Memo(2).m4a
[2011/05/05 16:46:02 | 002,351,533 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\Ramachandraya version original.mp3
[2011/05/05 07:18:53 | 000,377,615 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\HUD.pdf
[2011/05/05 07:18:51 | 000,009,328 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\ServiceProviderList.pdf
[2011/05/05 07:18:46 | 000,482,796 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\Combined-UpfrontDocument.pdf
[2011/05/03 20:01:22 | 000,193,581 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\kl3.jpg
[2011/05/03 19:50:42 | 000,126,636 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\kl2.jpg
[2011/05/03 19:49:18 | 000,082,911 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\kl1.jpg
[2011/04/27 09:43:05 | 000,002,265 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2011/04/21 19:36:47 | 000,077,132 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\IMG_3040.jpg
[2011/04/21 19:36:43 | 000,078,516 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\IMG_3039.jpg
[2011/04/21 19:36:40 | 000,084,921 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\IMG_3037.jpg
[2011/04/21 19:36:35 | 000,093,293 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\IMG_3029.jpg
[2011/04/21 09:35:03 | 000,425,363 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\CustomerAgreementBrokerage.pdf
[2011/04/19 21:01:57 | 000,373,345 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\Anika.jpg
[2011/04/15 13:38:34 | 000,048,728 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\ETKT_VRAMESH.pdf
[2011/04/15 06:06:42 | 000,116,560 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/04/14 22:30:02 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/04/14 10:05:47 | 000,087,590 | ---- | M] () -- C:\Documents and Settings\Karthik\Desktop\macys coupon.pdf
[2011/04/13 17:40:10 | 004,284,416 | ---- | M] (Google Inc.) -- C:\WINDOWS\System32\GPhotos.scr

========== Files Created - No Company Name ==========

[2011/05/07 06:44:32 | 000,003,335 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\Attach.zip
[2011/05/06 22:49:57 | 000,625,664 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\dds.scr
[2011/05/06 22:48:49 | 000,000,592 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\ERUNT.lnk
[2011/05/06 06:13:33 | 000,137,395 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\cn_macys-coupons__259880p.pdf
[2011/05/05 22:16:01 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/05/05 21:19:00 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/05 17:42:15 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2011/05/05 16:47:48 | 003,273,551 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\110421_000.mp3
[2011/05/05 16:47:19 | 002,355,165 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\Memo(3).m4a
[2011/05/05 16:46:33 | 000,442,557 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\Memo(2).m4a
[2011/05/05 16:46:00 | 002,351,533 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\Ramachandraya version original.mp3
[2011/05/05 07:18:53 | 000,377,615 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\HUD.pdf
[2011/05/05 07:18:50 | 000,009,328 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\ServiceProviderList.pdf
[2011/05/05 07:18:45 | 000,482,796 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\Combined-UpfrontDocument.pdf
[2011/05/03 20:01:21 | 000,193,581 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\kl3.jpg
[2011/05/03 19:50:42 | 000,126,636 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\kl2.jpg
[2011/05/03 19:49:14 | 000,082,911 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\kl1.jpg
[2011/04/21 19:36:46 | 000,077,132 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\IMG_3040.jpg
[2011/04/21 19:36:43 | 000,078,516 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\IMG_3039.jpg
[2011/04/21 19:36:39 | 000,084,921 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\IMG_3037.jpg
[2011/04/21 19:36:34 | 000,093,293 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\IMG_3029.jpg
[2011/04/21 09:35:03 | 000,425,363 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\CustomerAgreementBrokerage.pdf
[2011/04/19 21:01:57 | 000,373,345 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\Anika.jpg
[2011/04/15 13:38:33 | 000,048,728 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\ETKT_VRAMESH.pdf
[2011/04/14 10:05:47 | 000,087,590 | ---- | C] () -- C:\Documents and Settings\Karthik\Desktop\macys coupon.pdf
[2010/11/04 21:02:16 | 000,005,632 | ---- | C] () -- C:\Documents and Settings\Karthik\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/16 19:01:39 | 000,122,771 | ---- | C] () -- C:\WINDOWS\hpoins14.dat
[2010/06/16 19:01:39 | 000,001,996 | ---- | C] () -- C:\WINDOWS\hpomdl14.dat
[2010/06/16 08:21:24 | 000,000,048 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010/06/04 17:34:54 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/06/04 15:38:55 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2010/06/04 14:02:06 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010/06/04 13:53:01 | 000,022,720 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/06/04 08:47:14 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010/06/04 08:45:50 | 000,116,560 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2003/07/16 11:48:28 | 000,004,594 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2003/07/16 11:48:27 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2003/07/16 11:35:07 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2003/07/16 11:35:06 | 000,312,048 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2003/07/16 11:35:05 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2003/07/16 11:35:03 | 000,040,178 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2003/07/16 11:33:18 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2003/07/16 11:28:25 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2003/07/16 11:28:14 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2003/07/16 11:21:49 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2003/07/16 11:20:48 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin

< End of report >

ken545 · May 13, 2011

Great, what I would like you to do since this infection was so serious is to run Combofix, but it will not run with AVG installed, so what you need to do is uninstall AVG via Add Remove Programs in the Control Panel, run Combofix and then we will reinstall it when where done

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See this Link for programs that need to be disabled and instruction on how to disable them.
Remember to re-enable them when we're done.
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

sangsy · May 14, 2011

Issue removing AVG

Hello Ken545. I am unable to uninstall AVG. It first complained about not being able to stop some services. When I manually stopped them and uninstalled, the uninstaller crashes in the middle of the process.

As a result, I am not able to run ComboFix.

ken545 · May 14, 2011

You can use of there removal tools

http://www.avg.com/us-en/download-tools
http://download.avg.com/filedir/util/support/avg_remover_stf_x86_2011_1322.exe

sangsy · May 15, 2011

ComboFix log

Thanks for the link! I was able to remove AVG and run ComboFix. Here is the log file.

ComboFix 11-05-14.03 - Karthik 05/15/2011 12:56:24.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.262 [GMT -5:00]
Running from: c:\documents and settings\Karthik\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Karthik\Application Data\Adobe\plugs
c:\documents and settings\Karthik\Application Data\Adobe\shed
c:\windows\system32\AutoRun.inf
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_ITLPERF
-------\Service_itlperf
.
.
((((((((((((((((((((((((( Files Created from 2011-04-15 to 2011-05-15 )))))))))))))))))))))))))))))))
.
.
2011-05-13 18:55 . 2011-05-13 18:55 -------- d-----w- C:\_OTL
2011-05-13 12:31 . 2011-05-13 12:31 -------- d-----w- c:\program files\ESET
2011-05-07 03:48 . 2011-05-07 03:48 -------- d-----w- c:\program files\ERUNT
2011-05-06 02:19 . 2011-05-06 02:19 -------- d-----w- c:\documents and settings\Karthik\Application Data\Malwarebytes
2011-05-06 02:18 . 2010-12-20 23:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-06 02:18 . 2011-05-06 02:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-05-06 02:18 . 2010-12-20 23:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-06 02:18 . 2011-05-13 00:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-05-06 02:14 . 2011-05-07 01:04 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-05-06 02:14 . 2011-05-07 01:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2011-05-06 01:25 . 2011-05-07 01:05 -------- d-----w- c:\documents and settings\All Users\Application Data\aJ31000LbHnJ31000
2011-05-05 22:42 . 2011-04-14 16:26 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-05-05 22:42 . 2011-04-14 16:25 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-05-05 22:42 . 2011-04-14 16:25 1874904 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-05-05 22:42 . 2011-04-14 16:25 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-05-05 22:42 . 2011-04-14 16:25 465880 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-05-05 22:42 . 2011-04-14 16:25 89048 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-05-05 22:42 . 2010-01-01 08:00 1974616 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-05-05 22:42 . 2010-01-01 08:00 1892184 ----a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-04-28 07:02 . 2011-04-28 07:02 -------- d-----w- c:\documents and settings\Sangeetha\Application Data\AVG10
2011-04-22 15:22 . 2011-04-22 15:22 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-13 22:40 . 2011-04-13 22:40 4284416 ----a-w- c:\windows\system32\GPhotos.scr
2011-03-07 05:33 . 2010-06-04 18:53 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:45 . 2003-07-16 16:43 434176 ----a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2003-07-16 16:45 1857920 ----a-w- c:\windows\system32\win32k.sys
2011-02-17 19:00 . 2003-07-16 16:45 832512 ----a-w- c:\windows\system32\wininet.dll
2011-02-17 19:00 . 2004-08-04 07:56 78336 ------w- c:\windows\system32\ieencode.dll
2011-02-17 19:00 . 2003-07-16 16:24 1830912 ------w- c:\windows\system32\inetcpl.cpl
2011-02-17 19:00 . 2003-07-16 16:20 17408 ----a-w- c:\windows\system32\corpol.dll
2011-02-17 13:18 . 2003-07-16 16:29 455936 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-02-17 13:18 . 2003-07-16 16:40 357888 ----a-w- c:\windows\system32\drivers\srv.sys
2011-02-17 12:32 . 2010-06-04 20:56 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2011-02-17 11:44 . 2004-08-04 05:59 389120 ------w- c:\windows\system32\html.iec
2011-02-15 12:56 . 2003-07-16 16:18 290432 ----a-w- c:\windows\system32\atmfd.dll
2011-04-14 16:26 . 2011-05-05 22:42 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cdloader"="c:\documents and settings\Karthik\Application Data\mjusbsp\cdloader2.exe" [2010-12-03 50592]
"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe" [2010-06-01 5252408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-06-22 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-06-22 126976]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
.
c:\documents and settings\Karthik\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Documents and Settings\\Karthik\\Application Data\\mjusbsp\\magicJack.exe"=
.
R0 Achernar;Achernar - Storage Filter Drivers;c:\windows\system32\drivers\Achernar.sys [2/11/2004 3:34 PM 16855]
R2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2/28/2010 2:33 AM 821664]
R2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [12/2/2009 10:23 PM 483688]
R3 Aldebaran;Aldebaran - Storage Filter Drivers;c:\windows\system32\drivers\Aldebaran.sys [2/11/2004 3:34 PM 21808]
R3 Sftfs;Sftfs;c:\windows\system32\drivers\Sftfsxp.sys [12/2/2009 10:23 PM 554344]
R3 Sftplay;Sftplay;c:\windows\system32\drivers\Sftplayxp.sys [12/2/2009 10:23 PM 211304]
R3 Sftredir;Sftredir;c:\windows\system32\drivers\Sftredirxp.sys [12/2/2009 10:23 PM 20584]
R3 Sftvol;Sftvol;c:\windows\system32\drivers\Sftvolxp.sys [12/2/2009 10:23 PM 18280]
R3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [12/2/2009 10:23 PM 209768]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [1/9/2010 9:37 PM 4640000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08
itlsvc REG_MULTI_SZ itlperf
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.bing.com/?pc=ZUGO&form=ZGAPHP
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
FF - ProfilePath - c:\documents and settings\Karthik\Application Data\Mozilla\Firefox\Profiles\mrvxhml8.default\
FF - prefs.js: browser.search.selectedEngine - Bing
FF - prefs.js: browser.startup.homepage - hxxp://www.bing.com/
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=ZUGO&form=ZGAADF&q=
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-15 13:03
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(596)
c:\windows\system32\WININET.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\mshtml.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wscntfy.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\progra~1\Yahoo!\Messenger\ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 2011-05-15 13:08:19 - machine was rebooted
ComboFix-quarantined-files.txt 2011-05-15 18:08
.
Pre-Run: 28,947,927,040 bytes free
Post-Run: 28,860,637,184 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
.
- - End Of File - - 064A3BAB2C8784F7E14589B67E5911B8

ken545 · May 15, 2011

Looks good, how are things running now ? Go ahead and redownload and install AVG

sangsy · May 16, 2011

Back to normal

Hello Ken545, Thanks for helping me with this issue. The computer seems to be back to normal - not slow anymore and no popups. I have re-installed AVG.

Is my computer clean now? Is there something else that I can install to prevent this from happening?

ken545 · May 16, 2011

Good Morning,

I would say your good to go. Cant really say how you got infected, you may have wandered into a bad site, opened an attachment in an email. Stay away from any form of file sharing , very dangerous.

Malwarebyes is the free version and yours to keep, you can upgrade to Pro and it will activate a protection moduale that will block access to known bad sites with a PAGE NOT FOUND and a warning . The cost is minamal , but this is up to you.

Click START then RUN
Now type Combofix /uninstall in the runbox and click OK. Note the space between the X and the /, it needs to be there.

Open OTL and click on Clean Up and it will remove programs we used to clean your system along with there backups

How did I get infected in the first place ?
Read these links and find out how to prevent getting infected again.
Tutorial for System Restore <-- Do this first to prevent yourself from being reinfected.
WhattheTech
Grinler BleepingComputer
GeeksTo Go
Dslreports

Safe Surfn
Ken

ken545 · May 21, 2011

Since this issue appears to be resolved ... this Topic has been closed. Glad I could help.

Malware on my computer - lots of popups

New member

Emeritus-Security Expert

New member

Emeritus-Security Expert

New member

Emeritus-Security Expert

New member

New member

Emeritus-Security Expert

New member

Emeritus-Security Expert

New member

Emeritus-Security Expert

New member

Emeritus-Security Expert

New member

Emeritus-Security Expert

New member

Emeritus-Security Expert

Emeritus-Security Expert