Solved HP laptop infected with redirects

Cristobalarce · 2011/03/03

[Resolved] HP laptop infected with redirects

I just got a used HP HDX X18-1180US laptop, everything looked just fine until I started getting redirected from Internet Explorer 8 to old search sites like Qbyrd, Ask.com, etc. I already updated to beta version IE9 hoping that it would fix the problem, but the infection is still there. It seems that Firefox and Chrome do not have the same problem, but I can't be sure. I would greatly appreciate help with getting my computer cleaned out. Here are the log files:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5947

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8080.16413

03/03/2011 03:49:45 p.m.
mbam-log-2011-03-03 (15-49-45).txt

Scan type: Quick scan
Objects scanned: 178855
Time elapsed: 4 minute(s), 33 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 64-bit
Base Board Manufacturer: Quanta
BIOS Manufacturer: Hewlett-Packard
System Manufacturer: Hewlett-Packard
System Product Name: HP HDX 18 Notebook PC
Logical Drives Mask: 0x0000009c

Kernel Drivers (total 212):
0x0320B000 \SystemRoot\system32\ntoskrnl.exe
0x03723000 \SystemRoot\system32\hal.dll
0x0060C000 \SystemRoot\system32\kdcom.dll
0x00616000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x00651000 \SystemRoot\system32\PSHED.dll
0x00665000 \SystemRoot\system32\CLFS.SYS
0x006C2000 \SystemRoot\system32\CI.dll
0x0080D000 \SystemRoot\system32\drivers\Wdf01000.sys
0x008B1000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x008C0000 \SystemRoot\system32\drivers\acpi.sys
0x00916000 \SystemRoot\system32\drivers\WMILIB.SYS
0x0091F000 \SystemRoot\system32\drivers\msisadrv.sys
0x00929000 \SystemRoot\system32\drivers\pci.sys
0x00959000 \SystemRoot\system32\drivers\isapnp.sys
0x00962000 \SystemRoot\system32\drivers\mpio.sys
0x00984000 \SystemRoot\System32\drivers\partmgr.sys
0x00999000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x0099D000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x009A9000 \SystemRoot\system32\drivers\volmgr.sys
0x00774000 \SystemRoot\System32\drivers\volmgrx.sys
0x009BD000 \SystemRoot\system32\drivers\intelide.sys
0x009C5000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x009D5000 \SystemRoot\system32\drivers\aliide.sys
0x009DC000 \SystemRoot\system32\drivers\amdide.sys
0x009E3000 \SystemRoot\system32\drivers\cmdide.sys
0x009EB000 \SystemRoot\System32\drivers\mountmgr.sys
0x007DA000 \SystemRoot\system32\drivers\msdsm.sys
0x00A07000 \SystemRoot\system32\drivers\nvraid.sys
0x00A2A000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x00A56000 \SystemRoot\system32\drivers\pciide.sys
0x00A5D000 \SystemRoot\system32\drivers\viaide.sys
0x00A65000 \SystemRoot\system32\drivers\iastorv.sys
0x00B2C000 \SystemRoot\system32\drivers\atapi.sys
0x00B34000 \SystemRoot\system32\drivers\ataport.SYS
0x00B58000 \SystemRoot\system32\drivers\lsi_scsi.sys
0x00B76000 \SystemRoot\system32\drivers\storport.sys
0x00BD3000 \SystemRoot\system32\drivers\msahci.sys
0x00BDD000 \SystemRoot\system32\drivers\hpcisss.sys
0x00C0A000 \SystemRoot\system32\drivers\adp94xx.sys
0x00C83000 \SystemRoot\system32\drivers\adpahci.sys
0x00CD9000 \SystemRoot\system32\drivers\adpu160m.sys
0x00CFA000 \SystemRoot\system32\drivers\SCSIPORT.SYS
0x00D28000 \SystemRoot\system32\drivers\adpu320.sys
0x00D57000 \SystemRoot\system32\drivers\djsvs.sys
0x00D6F000 \SystemRoot\system32\drivers\arc.sys
0x00D88000 \SystemRoot\system32\drivers\arcsas.sys
0x00E05000 \SystemRoot\system32\drivers\elxstor.sys
0x00EA8000 \SystemRoot\system32\drivers\i2omp.sys
0x00EB3000 \SystemRoot\system32\drivers\iirsp.sys
0x00EC4000 \SystemRoot\system32\drivers\iteatapi.sys
0x00ED1000 \SystemRoot\system32\drivers\iteraid.sys
0x00EDE000 \SystemRoot\system32\drivers\lsi_fc.sys
0x00EFC000 \SystemRoot\system32\drivers\lsi_sas.sys
0x00F18000 \SystemRoot\system32\drivers\megasas.sys
0x00F24000 \SystemRoot\system32\drivers\megasr.sys
0x00FEB000 \SystemRoot\system32\drivers\mraid35x.sys
0x00DA1000 \SystemRoot\system32\drivers\nfrd960.sys
0x00DB1000 \SystemRoot\system32\drivers\nvstor.sys
0x01002000 \SystemRoot\system32\drivers\ql2300.sys
0x01154000 \SystemRoot\system32\drivers\ql40xx.sys
0x011B2000 \SystemRoot\system32\drivers\sisraid2.sys
0x011C0000 \SystemRoot\system32\drivers\sisraid4.sys
0x011D6000 \SystemRoot\system32\drivers\symc8xx.sys
0x011E4000 \SystemRoot\system32\drivers\sym_hi.sys
0x011F1000 \SystemRoot\system32\drivers\sym_u3.sys
0x01201000 \SystemRoot\system32\drivers\uliahci.sys
0x0124A000 \SystemRoot\system32\drivers\ulsata.sys
0x01279000 \SystemRoot\system32\drivers\ulsata2.sys
0x012BB000 \SystemRoot\system32\drivers\vsmraid.sys
0x012E2000 \SystemRoot\system32\drivers\fltmgr.sys
0x01329000 \SystemRoot\system32\drivers\fileinfo.sys
0x0133D000 \SystemRoot\System32\Drivers\ksecdd.sys
0x01400000 \SystemRoot\system32\drivers\ndis.sys
0x0160E000 \SystemRoot\system32\drivers\msrpc.sys
0x0165E000 \SystemRoot\system32\drivers\NETIO.SYS
0x01801000 \SystemRoot\System32\drivers\tcpip.sys
0x01977000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x01A0F000 \SystemRoot\System32\Drivers\Ntfs.sys
0x01B8F000 \SystemRoot\system32\drivers\wd.sys
0x01B97000 \SystemRoot\system32\drivers\volsnap.sys
0x01BDB000 \SystemRoot\System32\Drivers\spldr.sys
0x01BE3000 \SystemRoot\system32\drivers\sbp2port.sys
0x019A3000 \SystemRoot\System32\Drivers\mup.sys
0x019B5000 \SystemRoot\System32\drivers\ecache.sys
0x01A00000 \SystemRoot\system32\DRIVERS\hpdskflt.sys
0x019E1000 \SystemRoot\system32\drivers\disk.sys
0x019F5000 \SystemRoot\system32\drivers\crcdisk.sys
0x016C5000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x016D2000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x016DB000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x01A0A000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x03004000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x03C5F000 \SystemRoot\System32\Drivers\nvBridge.kmd
0x03C61000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x03D44000 \SystemRoot\System32\drivers\watchdog.sys
0x03D54000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x03D60000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x03DA6000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x016EE000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x03E06000 \SystemRoot\system32\DRIVERS\NETwNv64.sys
0x0455F000 \SystemRoot\system32\DRIVERS\Rtlh64.sys
0x045B0000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x045C2000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x045D2000 \SystemRoot\system32\DRIVERS\jmcr.sys
0x03DB7000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x03DCD000 \SystemRoot\system32\DRIVERS\HpqKbFiltr.sys
0x03DD9000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x0460C000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x0465F000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x04661000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x0466D000 \SystemRoot\system32\DRIVERS\enecir.sys
0x04689000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x046A5000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x046B2000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x046BB000 \SystemRoot\system32\DRIVERS\Accelerometer.sys
0x046C8000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x04701000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x0470E000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x04731000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x0473D000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x0476E000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x0477E000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x0479C000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x047B4000 \SystemRoot\system32\DRIVERS\taphss.sys
0x047C1000 \SystemRoot\system32\DRIVERS\termdd.sys
0x047D4000 \SystemRoot\system32\DRIVERS\swenum.sys
0x015C3000 \SystemRoot\system32\DRIVERS\ks.sys
0x047D6000 \SystemRoot\system32\DRIVERS\circlass.sys
0x047E7000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x03DE7000 \SystemRoot\system32\DRIVERS\umbus.sys
0x0480D000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x04855000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x04869000 \SystemRoot\system32\DRIVERS\stwrt64.sys
0x048DD000 \SystemRoot\system32\DRIVERS\portcls.sys
0x04918000 \SystemRoot\system32\DRIVERS\drmk.sys
0x0493B000 \SystemRoot\system32\drivers\ksthunk.sys
0x04941000 \SystemRoot\system32\drivers\nvhda64v.sys
0x0496A000 \SystemRoot\system32\DRIVERS\hidir.sys
0x04975000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x04987000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x0498F000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x0499A000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x049A5000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x07400000 \SystemRoot\System32\Drivers\aswSnx.SYS
0x07480000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x0748A000 \SystemRoot\System32\Drivers\Null.SYS
0x07493000 \SystemRoot\System32\drivers\vga.sys
0x074A1000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x074C6000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x074CF000 \SystemRoot\system32\drivers\rdpencdd.sys
0x074D8000 \SystemRoot\System32\Drivers\Msfs.SYS
0x074E3000 \SystemRoot\System32\Drivers\Npfs.SYS
0x074F4000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x074FD000 \SystemRoot\system32\DRIVERS\tdx.sys
0x0751A000 \SystemRoot\System32\Drivers\aswTdi.SYS
0x0752A000 \SystemRoot\system32\DRIVERS\smb.sys
0x07545000 \SystemRoot\system32\drivers\afd.sys
0x075B0000 \SystemRoot\System32\Drivers\aswRdr.SYS
0x075BA000 \SystemRoot\System32\DRIVERS\netbt.sys

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2011-03-03 22:21:36
Windows 6.0.6002 Service Pack 2
Running: 2c52prdrl.exe

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\ControlSet001\Services\BTHPORT\Parameters\Keys\00247e568750 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\BTHPORT\Parameters\Keys\00247e568750@f81edf3ff14b 0x91 0x15 0xC6 0x08 ...
Reg HKLM\SYSTEM\ControlSet005\Services\BTHPORT\Parameters\Keys\00247e568750 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\BTHPORT\Parameters\Keys\00247e568750@f81edf3ff14b 0x91 0x15 0xC6 0x08 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00247e568750
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00247e568750@f81edf3ff14b 0x91 0x15 0xC6 0x08 ...

---- EOF - GMER 1.0.15 ----

DDS (Ver_10-12-12.02)

Microsoft® Windows Vistaâ„¢ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 11/04/2009 05:29:46 a.m.
System Uptime: 03/03/2011 03:32:10 p.m. (2 hours ago)

Motherboard: Quanta | | 3610
Processor: Intel(R) Core(TM)2 Quad CPU Q9000 @ 2.00GHz | CPU | 2000/1066mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 453 GiB total, 200.409 GiB free.
D: is FIXED (NTFS) - 12 GiB total, 1.972 GiB free.
E: is CDROM ()
H: is FIXED (NTFS) - 699 GiB total, 157.745 GiB free.

==== Disabled Device Manager Items =============

Class GUID:
Description: Bluetooth Peripheral Device
Device ID: BTHENUM\{00000000-DECA-FADE-DECA-DEAFDECACAFE}_VID&000205AC_PID&1294\7&261ACD6&0&F81EDF3FF14B_C00000000
Manufacturer:
Name: Bluetooth Peripheral Device
PNP Device ID: BTHENUM\{00000000-DECA-FADE-DECA-DEAFDECACAFE}_VID&000205AC_PID&1294\7&261ACD6&0&F81EDF3FF14B_C00000000
Service:

==== System Restore Points ===================

RP839: 02/03/2011 01:41:45 p.m. - Installed Java(TM) 6 Update 24
RP840: 02/03/2011 01:49:12 p.m. - Windows Update
RP841: 02/03/2011 08:23:01 p.m. - Device Driver Package Install: Apple, Inc. Universal Serial Bus controllers
RP843: 03/03/2011 10:34:34 a.m. - Revo Uninstaller Pro's restore point - k-lite
RP845: 03/03/2011 10:55:59 a.m. - Revo Uninstaller Pro's restore point - k-lite
RP846: 03/03/2011 11:26:29 a.m. - Installed DirectX
RP848: 03/03/2011 12:42:46 p.m. - Revo Uninstaller Pro's restore point - haali
RP850: 03/03/2011 01:34:10 p.m. - Revo Uninstaller Pro's restore point - ac3

==== Installed Programs ======================

AC3Filter 1.63b
Advanced SystemCare 3
Apple Application Support
avast! Free Antivirus
D3DX10
DVD-Cloner Platinum V8.00 Build 1003
Google Chrome
Google Toolbar for Internet Explorer
Haali Media Splitter
iPod-Cloner V1.80 Build 850
Java Auto Updater
Java(TM) 6 Update 24
Microsoft Silverlight
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
MSVCRT
Segoe UI
Skypeâ„¢ 5.0
Tagging System Clickbuster.
VLC media player 1.1.7
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Photo Common
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack

==== Event Viewer Messages From Past Week ========

26/02/2011 01:42:23 p.m., Error: EventLog [6008] - The previous system shutdown at 01:30:16 p.m. on 26/02/2011 was unexpected.
25/02/2011 12:46:09 p.m., Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Media Player Network Sharing Service service to connect.
25/02/2011 12:46:09 p.m., Error: Service Control Manager [7000] - The Windows Media Player Network Sharing Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
03/03/2011 03:33:24 p.m., Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: StarOpen
03/03/2011 03:33:24 p.m., Error: Service Control Manager [7000] - The ISA Monitor Service service failed to start due to the following error: The system cannot find the path specified.
03/03/2011 03:32:31 p.m., Error: volmgr [46] - Crash dump initialization failed!
03/03/2011 03:32:24 p.m., Error: Application Popup [1060] - \SystemRoot\SysWow64\Drivers\StarOpen.SYS has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
02/03/2011 08:24:28 p.m., Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Apple Mobile Device service, but this action failed with the following error: An instance of the service is already running.
02/03/2011 08:23:28 p.m., Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
02/03/2011 08:22:44 p.m., Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
02/03/2011 01:19:13 a.m., Error: EventLog [6008] - The previous system shutdown at 01:09:51 a.m. on 02/03/2011 was unexpected.

==== End Of File ===========================

PeteC · 2011/03/04

And the contents of Attach.txt please.

Cristobalarce · 2011/03/04

Hello Pete, Here´s the Attach log:

DDS (Ver_10-12-12.02)

Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 11/04/2009 05:29:46 a.m.
System Uptime: 03/03/2011 03:32:10 p.m. (2 hours ago)

Motherboard: Quanta | | 3610
Processor: Intel(R) Core(TM)2 Quad CPU Q9000 @ 2.00GHz | CPU | 2000/1066mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 453 GiB total, 200.409 GiB free.
D: is FIXED (NTFS) - 12 GiB total, 1.972 GiB free.
E: is CDROM ()
H: is FIXED (NTFS) - 699 GiB total, 157.745 GiB free.

==== Disabled Device Manager Items =============

Class GUID:
Description: Bluetooth Peripheral Device
Device ID: BTHENUM\{00000000-DECA-FADE-DECA-DEAFDECACAFE}_VID&000205AC_PID&1294\7&261ACD6&0&F81EDF3FF14B_C00000000
Manufacturer:
Name: Bluetooth Peripheral Device
PNP Device ID: BTHENUM\{00000000-DECA-FADE-DECA-DEAFDECACAFE}_VID&000205AC_PID&1294\7&261ACD6&0&F81EDF3FF14B_C00000000
Service:

==== System Restore Points ===================

RP839: 02/03/2011 01:41:45 p.m. - Installed Java(TM) 6 Update 24
RP840: 02/03/2011 01:49:12 p.m. - Windows Update
RP841: 02/03/2011 08:23:01 p.m. - Device Driver Package Install: Apple, Inc. Universal Serial Bus controllers
RP843: 03/03/2011 10:34:34 a.m. - Revo Uninstaller Pro's restore point - k-lite
RP845: 03/03/2011 10:55:59 a.m. - Revo Uninstaller Pro's restore point - k-lite
RP846: 03/03/2011 11:26:29 a.m. - Installed DirectX
RP848: 03/03/2011 12:42:46 p.m. - Revo Uninstaller Pro's restore point - haali
RP850: 03/03/2011 01:34:10 p.m. - Revo Uninstaller Pro's restore point - ac3

==== Installed Programs ======================

AC3Filter 1.63b
Advanced SystemCare 3
Apple Application Support
avast! Free Antivirus
D3DX10
DVD-Cloner Platinum V8.00 Build 1003
Google Chrome
Google Toolbar for Internet Explorer
Haali Media Splitter
iPod-Cloner V1.80 Build 850
Java Auto Updater
Java(TM) 6 Update 24
Microsoft Silverlight
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
MSVCRT
Segoe UI
Skype™ 5.0
Tagging System Clickbuster.
VLC media player 1.1.7
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Photo Common
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack

==== Event Viewer Messages From Past Week ========

26/02/2011 01:42:23 p.m., Error: EventLog [6008] - The previous system shutdown at 01:30:16 p.m. on 26/02/2011 was unexpected.
25/02/2011 12:46:09 p.m., Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Media Player Network Sharing Service service to connect.
25/02/2011 12:46:09 p.m., Error: Service Control Manager [7000] - The Windows Media Player Network Sharing Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
03/03/2011 03:33:24 p.m., Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: StarOpen
03/03/2011 03:33:24 p.m., Error: Service Control Manager [7000] - The ISA Monitor Service service failed to start due to the following error: The system cannot find the path specified.
03/03/2011 03:32:31 p.m., Error: volmgr [46] - Crash dump initialization failed!
03/03/2011 03:32:24 p.m., Error: Application Popup [1060] - \SystemRoot\SysWow64\Drivers\StarOpen.SYS has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
02/03/2011 08:24:28 p.m., Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Apple Mobile Device service, but this action failed with the following error: An instance of the service is already running.
02/03/2011 08:23:28 p.m., Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
02/03/2011 08:22:44 p.m., Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
02/03/2011 01:19:13 a.m., Error: EventLog [6008] - The previous system shutdown at 01:09:51 a.m. on 02/03/2011 was unexpected.

==== End Of File ===========================

PeteC · 2011/03/04

Thanks

One of our trained malware analysts will take a look at your logs ASAP, but it may be a day or so before you get a response as they are always very busy. All logs are dealt with in the order received.

Thank you for your patience.

broni · 2011/03/04

Welcome aboard

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.

If you're stuck, or you're not sure about certain step, always ask before doing anything else.

Please refrain from running tools or applying updates other than those I suggest.

Never run more than one scan at a time.

Keep updating me regarding your computer behavior, good, or bad.

The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.

If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.

I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

================================================================

Actually, you posted Attach.txt twice.
I still need DDS.txt log.

Also MBRCheck log is incomplete.

Cristobalarce · 2011/03/04

Hi Broni, sorry, here's the DDS log:

DDS (Ver_10-12-12.02) - NTFS_AMD64
Run by cristobalarce at 17:00:54.99 on 03/03/2011
Internet Explorer: 9.0.8080.16413 BrowserJavaVersion: 1.6.0_24
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.52.1033.18.4062.2128 [GMT -6:00]

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\WINDOWS\SYSTEM32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_86727c20\STacSV64.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\Hpservice.exe
C:\Windows\system32\vfsFPService.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files (x86)\DigitalPersona\Bin\DpHostW.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_86727c20\AESTSr64.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\SMINST\BLService.exe
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe
C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\WINDOWS\SYSTEM32\taskeng.exe
C:\Program Files (x86)\IObit\Advanced SystemCare 3\AWC.exe
C:\WINDOWS\SYSTEM32\taskeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehtray.exe
C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\ehome\ehsched.exe
C:\Program Files (x86)\Air Mouse\Air Mouse\Air Mouse.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
C:\Program Files (x86)\Hewlett-Packard\Media\TV\TVAgent.exe
C:\Program Files (x86)\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\CyberLink\Shared files\brs.exe
C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
C:\Program Files (x86)\DigitalPersona\Bin\DpAgent.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
C:\Program Files\DigitalPersona\Bin\DPAgent.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\ehome\ehRecvr.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe
C:\Windows\system32\conime.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Users\cristobalarce\Desktop\MW Removal 2011\4dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = prodigy.msn.com
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: DigitalPersona Personal Extension: {395610ae-c624-4f58-b89e-23733ea00f9a} - C:\Program Files (x86)\DigitalPersona\Bin\DpOtsPluginIe8.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: MSN Toolbar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0334.0\npwinext.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: Hotspot Shield Class: {f9e4a054-e9b1-4bc3-83a3-76a1ae736170} - C:\Program Files (x86)\Hotspot Shield\hssie\HssIE.dll
TB: MSN Toolbar: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0334.0\npwinext.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
TB: {DB131C55-60C8-4ADC-84DC-9E76AB06E2DC} - No File
uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe "
uRun: [ehTray.exe] C:\Windows\ehome\ehTray.exe
uRun: [ISUSPM] "C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler
mRun: [UCam_Menu] "C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Hewlett-Packard\Media\Webcam" update "Software\Hewlett-Packard\Media\Webcam "
mRun: [QlbCtrl.exe] "C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" /Start
mRun: [TVAgent] "C:\Program Files (x86)\Hewlett-Packard\Media\TV\TVAgent.exe "
mRun: [Google Quick Search Box] "C:\Program Files (x86)\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun
mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe "
mRun: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
mRun: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
mRun: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
mRun: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe "
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [BDRegion] "C:\Program Files (x86)\Cyberlink\Shared files\brs.exe "
mRun: [RemoteControl10] "C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe "
mRun: [DpAgent] C:\Program Files (x86)\DigitalPersona\Bin\dpagent.exe
mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe "
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe "
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\Air Mouse.lnk - C:\Program Files (x86)\Air Mouse\Air Mouse\Air Mouse.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
IE: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} - hxxps://h50203.www5.hp.com/HPISWeb/Customer/cabs/HPISDataManager.CAB
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {49232000-16E4-426C-A231-62846947304B} - hxxps://wimpro2.cce.hp.com/ChatEntry/downloads/sysinfo.cab
DPF: {72376E32-8AF2-473F-BE32-E5D0F39C865D} - hxxp://www.cyberlink.com/prog/aacs/UpdateAdvisor.cab
DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.3.13.0.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\Skype4COM.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
LSA: Notification Packages = scecli DPPWDFLT
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe "
BHO-X64: DigitalPersona Personal Extension: {395610AE-C624-4f58-B89E-23733EA00F9A} - C:\Program Files\DigitalPersona\Bin\DpOtsPluginIe8.dll
BHO-X64: DigitalPersona Personal Extension - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
BHO-X64: Hotspot Shield Class: {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\hssie\HssIE_64.dll
TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
TB-X64: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
TB-X64: {DB131C55-60C8-4ADC-84DC-9E76AB06E2DC} - No File
mRun-x64: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
mRun-x64: [SmartMenu] %ProgramFiles%\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
mRun-x64: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun-x64: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray64.exe
IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

================= FIREFOX ===================

FF - ProfilePath - C:\Users\CRISTO~1\AppData\Roaming\Mozilla\Firefox\Profiles\j56u2rxx.default\
FF - prefs.js: browser.startup.homepage - hxxp://t1msn.com
FF - component: C:\Program Files (x86)\DigitalPersona\Bin\firefoxext\components\dpffcli.dll
FF - component: C:\Users\cristobalarce\AppData\Roaming\Mozilla\Firefox\Profiles\j56u2rxx.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: C:\Users\cristobalarce\AppData\Roaming\Mozilla\Firefox\Profiles\j56u2rxx.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar-ff3.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll
FF - plugin: C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0334.0\npwinext.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: z: {a22b91ee-2b99-7f6a-8f34-9783ebf1a377} - C:\Program Files (x86)\Mozilla Firefox\extensions\{a22b91ee-2b99-7f6a-8f34-9783ebf1a377}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: DigitalPersona Extension: otis@digitalpersona.com - C:\Program Files (x86)\DigitalPersona\Bin\FirefoxExt
FF - Ext: DigitalPersona Extension: otis@digitalpersona.com - C:\Program Files (x86)\DigitalPersona\Bin\firefoxext

---- FIREFOX POLICIES ----
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0

============= SERVICES / DRIVERS ===============

R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2011-3-2 505176]
R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2011-3-2 280408]
R2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC};Power Control [2011/01/28 18:32:24];C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\000.fcl [2010-11-17 146928]
R2 AESTFilters;Andrea ST Filters Service;C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_86727c20\AESTSr64.exe [2009-4-11 89088]
R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2011-3-2 22360]
R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2011-3-2 64344]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-3-2 42184]
R2 FontCache;Windows Font Cache Service;C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 27648]
R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2010-10-14 92216]
R2 hpsrv;HP Service;C:\Windows\System32\hpservice.exe [2008-3-18 30520]
R2 HssWd;Hotspot Shield Monitoring Service;C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe [2010-1-8 285744]
R2 Recovery Service for Windows;Recovery Service for Windows;C:\Program Files (x86)\SMINST\BLService.exe [2008-10-27 365952]
R2 TVCapSvc;TV Background Capture Service (TVBCS);C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe [2009-4-22 296320]
R2 TVSched;TV Task Scheduler (TVTS);C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe [2009-4-22 116104]
R2 vfsFPService;Validity Fingerprint Service;C:\Windows\System32\vfsFPService.exe [2008-9-16 719152]
R3 Com4QLBEx;Com4QLBEx;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-10-27 227896]
R3 enecir;ENE CIR Receiver;C:\Windows\System32\drivers\enecir.sys [2008-9-4 64000]
R3 JMCR;JMCR;C:\Windows\System32\drivers\jmcr.sys [2008-8-7 143360]
R3 NETwNv64;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\System32\drivers\NETwNv64.sys [2010-8-29 7653888]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\System32\drivers\nvhda64v.sys [2011-1-29 155752]
R3 vfs101a;vfs101a;C:\Windows\System32\drivers\vfs101a.sys [2008-9-16 49968]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate1ca516eed51bd90;Servicio de actualizaciÃ³n de Google (gupdate1ca516eed51bd90);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2009-10-20 133104]
S2 IsaMonitor;ISA Monitor Service; [x]
S2 vcsFPService;Validity VCS Fingerprint Service;C:\Windows\System32\vcsFPService.exe [2010-2-18 2045232]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;C:\Program Files (x86)\Dragon Age\bin_ship\daupdatersvc.service.exe [2009-11-24 25832]
S3 ggflt;SEMC USB Flash Driver Filter;C:\Windows\System32\drivers\ggflt.sys [2009-8-27 13352]
S3 NETw3v64;Intel(R) PRO/Wireless 3945ABG Adapter Driver for Windows Vista 64 Bit;C:\Windows\System32\drivers\NETw3v64.sys [2008-1-20 3154432]
S3 NETw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\System32\drivers\NETw5v64.sys [2009-10-2 6816256]
S3 PerfHost;Performance Counter DLL Host;C:\Windows\SysWOW64\perfhost.exe [2008-1-20 19968]
S3 Revoflt;Revoflt;C:\Windows\System32\drivers\revoflt.sys [2011-2-17 31800]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2010-9-28 51712]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-3-18 1020768]
S3 yukonx64;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk60x64.sys [2006-11-2 273408]
S4 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2009-6-28 89920]

=============== File Associations ===============

JSEFile=C:\Windows\SysWOW64\WScript.exe "%1" %*

=============== Created Last 30 ================

2011-03-03 19:40:36 580096 ----a-w- C:\Windows\System32\ac3filter64.acm
2011-03-03 19:40:36 -------- d-----w- C:\Program Files (x86)\AC3Filter
2011-03-03 18:52:25 -------- d-----w- C:\Program Files (x86)\Haali
2011-03-03 18:09:51 -------- d-----w- C:\Program Files (x86)\Media Player Classic - Home Cinema
2011-03-03 17:27:59 72200 ----a-w- C:\Windows\System32\XAPOFX1_1.dll
2011-03-03 02:26:07 -------- d-----w- C:\Program Files\iPod
2011-03-03 02:26:05 -------- d-----w- C:\Program Files\iTunes
2011-03-03 02:26:05 -------- d-----w- C:\Program Files (x86)\iTunes
2011-03-03 02:22:31 -------- d-----w- C:\Program Files\Bonjour
2011-03-03 02:22:31 -------- d-----w- C:\Program Files (x86)\Bonjour
2011-03-02 22:04:23 58 ----a-w- C:\Windows\SysWow64\msadio.dll
2011-03-02 22:04:19 -------- d-----w- C:\Users\CRISTO~1\AppData\Roaming\DVD-Cloner
2011-03-02 22:04:07 -------- d-----w- C:\Program Files (x86)\DVD-Cloner Platinum
2011-03-02 18:59:29 505176 ----a-w- C:\Windows\System32\drivers\aswSnx.sys
2011-03-02 18:59:27 64344 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
2011-03-02 18:58:40 40648 ----a-w- C:\Windows\avastSS.scr
2011-03-02 18:58:29 -------- d-----w- C:\Program Files\AVAST Software
2011-03-02 18:58:29 -------- d-----w- C:\PROGRA~3\AVAST Software
2011-03-01 16:28:46 7947600 ----a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{C798956E-3CB6-4A6C-BC78-E20B1C975EAD}\mpengine.dll
2011-02-28 01:33:54 -------- d-----w- C:\fixwareout
2011-02-24 04:46:58 -------- d-----w- C:\Users\CRISTO~1\AppData\Local\{39A9E1FF-E146-4087-970E-8391DCFE4107}
2011-02-23 16:46:28 -------- d-----w- C:\Users\CRISTO~1\AppData\Local\{D99F46C0-D730-464E-A2DA-C5D2DCA73667}
2011-02-23 00:24:24 -------- d-----w- C:\Users\CRISTO~1\AppData\Local\{60EECF69-0579-4085-A700-C61420BCD804}
2011-02-22 19:41:34 -------- d-----w- C:\PROGRA~3\IObit
2011-02-22 18:11:08 -------- d-----w- C:\Users\CRISTO~1\AppData\Roaming\IObit
2011-02-22 18:11:07 -------- d-----w- C:\Program Files (x86)\IObit
2011-02-22 14:21:21 -------- d-----w- C:\Program Files\Unlocker
2011-02-22 14:08:58 -------- d-----w- C:\Program Files (x86)\Unlocker
2011-02-22 12:23:58 -------- d-----w- C:\Users\CRISTO~1\AppData\Local\{CE0A791E-E8C4-4C6E-A3CC-751532ACEFD2}
2011-02-22 04:03:07 -------- d-----w- C:\Rbackup
2011-02-22 01:15:43 77312 ----a-w- C:\Windows\SysWow64\ztvunace26.dll
2011-02-22 01:15:43 75264 ----a-w- C:\Windows\SysWow64\unacev2.dll
2011-02-22 01:15:43 69632 ----a-w- C:\Windows\SysWow64\ztvcabinet.dll
2011-02-22 01:15:43 162304 ----a-w- C:\Windows\SysWow64\ztvunrar36.dll
2011-02-22 01:15:43 153088 ----a-w- C:\Windows\SysWow64\UNRAR3.dll
2011-02-21 12:07:22 -------- d-----w- C:\Users\CRISTO~1\AppData\Local\{6619564C-5624-4B2D-B2C2-487D3C2DC4EC}
2011-02-21 00:07:11 -------- d-----w- C:\Users\CRISTO~1\AppData\Local\{FF1745BC-2042-4AAE-9B3F-5DCF43374D05}
2011-02-20 12:07:00 -------- d-----w- C:\Users\CRISTO~1\AppData\Local\{08E986F3-A2BD-42B2-ABEC-45453C4C8DE3}
2011-02-20 00:24:33 -------- d-----w- C:\Program Files\Validity Sensors
2011-02-20 00:06:38 -------- d-----w- C:\Users\CRISTO~1\AppData\Local\{95C56A88-DA2A-4B99-9D20-D83B2F895168}
2011-02-19 23:35:43 15712 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\b954fc6f1cbd08d01\MeshBetaRemover.exe
2011-02-19 04:26:57 -------- d-----w- C:\Program Files (x86)\DigitalPersona
2011-02-19 04:16:41 -------- d-----w- C:\Users\CRISTO~1\AppData\Roaming\DigitalPersona
2011-02-18 16:44:56 -------- d-----w- C:\Program Files\Perfect Uninstaller
2011-02-18 03:28:40 -------- d-----w- C:\Users\CRISTO~1\AppData\Local\VS Revo Group
2011-02-18 03:28:35 31800 ----a-w- C:\Windows\System32\drivers\revoflt.sys
2011-02-18 03:28:33 -------- d-----w- C:\Program Files\VS Revo Group
2011-02-17 19:44:25 -------- d-----w- C:\Program Files (x86)\Juno
2011-02-17 19:44:22 -------- d-----w- C:\PROGRA~3\Juno
2011-02-17 19:44:16 -------- d-----w- C:\Program Files\JunoInstaller
2011-02-08 18:58:23 4699024 ----a-w- C:\Windows\System32\ntoskrnl.exe
2011-02-08 18:58:22 1585168 ----a-w- C:\Windows\System32\ntdll.dll
2011-02-08 18:58:22 1168512 ----a-w- C:\Windows\SysWow64\ntdll.dll
2011-02-08 18:55:28 48128 ----a-w- C:\Windows\System32\atmlib.dll
2011-02-08 18:55:28 367104 ----a-w- C:\Windows\System32\atmfd.dll
2011-02-08 18:55:28 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll
2011-02-08 18:55:28 292352 ----a-w- C:\Windows\SysWow64\atmfd.dll

==================== Find3M ====================

2011-03-02 19:42:12 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2011-02-02 23:11:20 270720 ------w- C:\Windows\System32\MpSigStub.exe
2011-01-29 00:27:24 29480 ----a-w- C:\Windows\SysWow64\msxml3a.dll
2011-01-27 17:48:51 63438 ----a-w- C:\Windows\SysWow64\.exe
2011-01-20 16:46:10 900480 ----a-w- C:\Windows\System32\drivers\dxgkrnl.sys
2011-01-20 16:17:15 366592 ----a-w- C:\Windows\System32\winspool.drv
2011-01-20 16:17:03 625152 ----a-w- C:\Windows\System32\dxgi.dll
2011-01-20 16:16:53 287232 ----a-w- C:\Windows\System32\d3d10core.dll
2011-01-20 16:16:52 327680 ----a-w- C:\Windows\System32\d3d10_1core.dll
2011-01-20 16:16:52 196096 ----a-w- C:\Windows\System32\d3d10_1.dll
2011-01-20 16:16:52 1268224 ----a-w- C:\Windows\System32\d3d10.dll
2011-01-20 16:16:47 748544 ----a-w- C:\Windows\System32\stobject.dll
2011-01-20 16:16:40 47104 ----a-w- C:\Windows\System32\cdd.dll
2011-01-20 16:16:10 3548672 ----a-w- C:\Windows\System32\mf.dll
2011-01-20 16:16:08 35840 ----a-w- C:\Windows\System32\printfilterpipelineprxy.dll
2011-01-20 16:14:49 278528 ----a-w- C:\Windows\System32\mfplat.dll
2011-01-20 16:14:49 195072 ----a-w- C:\Windows\System32\mfps.dll
2011-01-20 16:08:16 478720 ----a-w- C:\Windows\SysWow64\dxgi.dll
2011-01-20 16:08:06 219648 ----a-w- C:\Windows\SysWow64\d3d10_1core.dll
2011-01-20 16:08:06 189952 ----a-w- C:\Windows\SysWow64\d3d10core.dll
2011-01-20 16:08:06 160768 ----a-w- C:\Windows\SysWow64\d3d10_1.dll
2011-01-20 16:08:06 1029120 ----a-w- C:\Windows\SysWow64\d3d10.dll
2011-01-20 16:07:42 258048 ----a-w- C:\Windows\SysWow64\winspool.drv
2011-01-20 16:07:16 586240 ----a-w- C:\Windows\SysWow64\stobject.dll
2011-01-20 16:06:38 2873344 ----a-w- C:\Windows\SysWow64\mf.dll
2011-01-20 16:04:54 98816 ----a-w- C:\Windows\SysWow64\mfps.dll
2011-01-20 16:04:54 209920 ----a-w- C:\Windows\SysWow64\mfplat.dll
2011-01-20 15:01:50 3068416 ----a-w- C:\Windows\System32\xpsservices.dll
2011-01-20 15:01:09 1653760 ----a-w- C:\Windows\System32\XpsPrint.dll
2011-01-20 14:59:59 1032192 ----a-w- C:\Windows\System32\printfilterpipelinesvc.exe
2011-01-20 14:58:38 1461760 ----a-w- C:\Windows\System32\OpcServices.dll
2011-01-20 14:57:44 479744 ----a-w- C:\Windows\System32\XpsGdiConverter.dll
2011-01-20 14:57:28 231936 ----a-w- C:\Windows\System32\XpsRasterService.dll
2011-01-20 14:42:00 1257984 ----a-w- C:\Windows\System32\MFH264Dec.dll
2011-01-20 14:41:29 428544 ----a-w- C:\Windows\System32\MFHEAACdec.dll
2011-01-20 14:40:17 345088 ----a-w- C:\Windows\System32\mfreadwrite.dll
2011-01-20 14:40:14 34304 ----a-w- C:\Windows\System32\mfpmp.exe
2011-01-20 14:40:11 377344 ----a-w- C:\Windows\System32\mfmp4src.dll
2011-01-20 14:37:06 2002944 ----a-w- C:\Windows\System32\d3d10warp.dll
2011-01-20 14:35:30 566272 ----a-w- C:\Windows\System32\d3d10level9.dll
2011-01-20 14:28:38 1554432 ----a-w- C:\Windows\SysWow64\xpsservices.dll
2011-01-20 14:27:50 876032 ----a-w- C:\Windows\SysWow64\XpsPrint.dll
2011-01-20 14:25:25 847360 ----a-w- C:\Windows\SysWow64\OpcServices.dll
2011-01-20 14:24:32 288768 ----a-w- C:\Windows\SysWow64\XpsGdiConverter.dll
2011-01-20 14:24:26 135680 ----a-w- C:\Windows\SysWow64\XpsRasterService.dll
2011-01-20 14:15:10 979456 ----a-w- C:\Windows\SysWow64\MFH264Dec.dll
2011-01-20 14:14:39 357376 ----a-w- C:\Windows\SysWow64\MFHEAACdec.dll
2011-01-20 14:14:03 302592 ----a-w- C:\Windows\SysWow64\mfmp4src.dll
2011-01-20 14:14:03 261632 ----a-w- C:\Windows\SysWow64\mfreadwrite.dll
2011-01-20 14:12:46 1172480 ----a-w- C:\Windows\SysWow64\d3d10warp.dll
2011-01-20 14:11:34 486400 ----a-w- C:\Windows\SysWow64\d3d10level9.dll
2011-01-20 14:06:15 834048 ----a-w- C:\Windows\System32\d2d1.dll
2011-01-20 14:02:46 1555968 ----a-w- C:\Windows\System32\DWrite.dll
2011-01-20 14:02:44 1147904 ----a-w- C:\Windows\System32\FntCache.dll
2011-01-20 13:47:51 683008 ----a-w- C:\Windows\SysWow64\d2d1.dll
2011-01-20 13:44:05 1068544 ----a-w- C:\Windows\SysWow64\DWrite.dll
2011-01-08 02:50:14 795752 ----a-w- C:\Windows\System32\easyUpdatusAPIU64.dll
2011-01-08 02:50:08 6143080 ----a-w- C:\Windows\System32\nvcpl.dll
2011-01-08 02:49:50 3156072 ----a-w- C:\Windows\System32\nvsvc64.dll
2011-01-08 02:49:28 117864 ----a-w- C:\Windows\System32\nvmctray.dll
2011-01-08 02:49:26 313448 ----a-w- C:\Windows\System32\nvhotkey.dll
2011-01-08 02:49:26 2558568 ----a-w- C:\Windows\System32\nvsvcr.dll
2011-01-08 02:49:26 1005160 ----a-w- C:\Windows\System32\nvvsvc.exe
2010-12-31 14:16:41 2757632 ----a-w- C:\Windows\System32\win32k.sys
2010-12-28 16:08:18 466944 ----a-w- C:\Windows\System32\odbc32.dll
2010-12-28 15:55:03 413696 ----a-w- C:\Windows\SysWow64\odbc32.dll
2010-12-21 00:08:40 24152 ----a-w- C:\Windows\System32\drivers\mbam.sys
2010-12-14 16:15:49 1251840 ----a-w- C:\Windows\System32\sdclt.exe

============= FINISH: 17:01:17.25 ===============

Cristobalarce · 2011/03/04

...And here's the MBRCheck, complete this time :

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 64-bit
Base Board Manufacturer: Quanta
BIOS Manufacturer: Hewlett-Packard
System Manufacturer: Hewlett-Packard
System Product Name: HP HDX 18 Notebook PC
Logical Drives Mask: 0x0000009c

Kernel Drivers (total 213):
0x03263000 \SystemRoot\system32\ntoskrnl.exe
0x0321D000 \SystemRoot\system32\hal.dll
0x0060C000 \SystemRoot\system32\kdcom.dll
0x00616000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x00651000 \SystemRoot\system32\PSHED.dll
0x00665000 \SystemRoot\system32\CLFS.SYS
0x006C2000 \SystemRoot\system32\CI.dll
0x0080A000 \SystemRoot\system32\drivers\Wdf01000.sys
0x008AE000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x008BD000 \SystemRoot\system32\drivers\acpi.sys
0x00913000 \SystemRoot\system32\drivers\WMILIB.SYS
0x0091C000 \SystemRoot\system32\drivers\msisadrv.sys
0x00926000 \SystemRoot\system32\drivers\pci.sys
0x00956000 \SystemRoot\system32\drivers\isapnp.sys
0x0095F000 \SystemRoot\system32\drivers\mpio.sys
0x00981000 \SystemRoot\System32\drivers\partmgr.sys
0x00996000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x0099A000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x009A6000 \SystemRoot\system32\drivers\volmgr.sys
0x00774000 \SystemRoot\System32\drivers\volmgrx.sys
0x009BA000 \SystemRoot\system32\drivers\intelide.sys
0x009C2000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x009D2000 \SystemRoot\system32\drivers\aliide.sys
0x009D9000 \SystemRoot\system32\drivers\amdide.sys
0x009E0000 \SystemRoot\system32\drivers\cmdide.sys
0x009E8000 \SystemRoot\System32\drivers\mountmgr.sys
0x007DA000 \SystemRoot\system32\drivers\msdsm.sys
0x00A0F000 \SystemRoot\system32\drivers\nvraid.sys
0x00A32000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x00A5E000 \SystemRoot\system32\drivers\pciide.sys
0x00A65000 \SystemRoot\system32\drivers\viaide.sys
0x00A6D000 \SystemRoot\system32\drivers\iastorv.sys
0x00B34000 \SystemRoot\system32\drivers\atapi.sys
0x00B3C000 \SystemRoot\system32\drivers\ataport.SYS
0x00B60000 \SystemRoot\system32\drivers\lsi_scsi.sys
0x00B7E000 \SystemRoot\system32\drivers\storport.sys
0x00BDB000 \SystemRoot\system32\drivers\msahci.sys
0x00BE5000 \SystemRoot\system32\drivers\hpcisss.sys
0x00C04000 \SystemRoot\system32\drivers\adp94xx.sys
0x00C7D000 \SystemRoot\system32\drivers\adpahci.sys
0x00CD3000 \SystemRoot\system32\drivers\adpu160m.sys
0x00CF4000 \SystemRoot\system32\drivers\SCSIPORT.SYS
0x00D22000 \SystemRoot\system32\drivers\adpu320.sys
0x00D51000 \SystemRoot\system32\drivers\djsvs.sys
0x00D69000 \SystemRoot\system32\drivers\arc.sys
0x00D82000 \SystemRoot\system32\drivers\arcsas.sys
0x00E02000 \SystemRoot\system32\drivers\elxstor.sys
0x00EA5000 \SystemRoot\system32\drivers\i2omp.sys
0x00EB0000 \SystemRoot\system32\drivers\iirsp.sys
0x00EC1000 \SystemRoot\system32\drivers\iteatapi.sys
0x00ECE000 \SystemRoot\system32\drivers\iteraid.sys
0x00EDB000 \SystemRoot\system32\drivers\lsi_fc.sys
0x00EF9000 \SystemRoot\system32\drivers\lsi_sas.sys
0x00F15000 \SystemRoot\system32\drivers\megasas.sys
0x00F21000 \SystemRoot\system32\drivers\megasr.sys
0x00FE8000 \SystemRoot\system32\drivers\mraid35x.sys
0x00D9B000 \SystemRoot\system32\drivers\nfrd960.sys
0x00DAB000 \SystemRoot\system32\drivers\nvstor.sys
0x01001000 \SystemRoot\system32\drivers\ql2300.sys
0x01153000 \SystemRoot\system32\drivers\ql40xx.sys
0x011B1000 \SystemRoot\system32\drivers\sisraid2.sys
0x011BF000 \SystemRoot\system32\drivers\sisraid4.sys
0x011D5000 \SystemRoot\system32\drivers\symc8xx.sys
0x011E3000 \SystemRoot\system32\drivers\sym_hi.sys
0x011F0000 \SystemRoot\system32\drivers\sym_u3.sys
0x01201000 \SystemRoot\system32\drivers\uliahci.sys
0x0124A000 \SystemRoot\system32\drivers\ulsata.sys
0x01279000 \SystemRoot\system32\drivers\ulsata2.sys
0x012BB000 \SystemRoot\system32\drivers\vsmraid.sys
0x012E2000 \SystemRoot\system32\drivers\fltmgr.sys
0x01329000 \SystemRoot\system32\drivers\fileinfo.sys
0x0133D000 \SystemRoot\System32\Drivers\ksecdd.sys
0x0140D000 \SystemRoot\system32\drivers\ndis.sys
0x0160D000 \SystemRoot\system32\drivers\msrpc.sys
0x0165D000 \SystemRoot\system32\drivers\NETIO.SYS
0x01804000 \SystemRoot\System32\drivers\tcpip.sys
0x0197A000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x01A05000 \SystemRoot\System32\Drivers\Ntfs.sys
0x01B85000 \SystemRoot\system32\drivers\wd.sys
0x01B8D000 \SystemRoot\system32\drivers\volsnap.sys
0x01BD1000 \SystemRoot\System32\Drivers\spldr.sys
0x01BD9000 \SystemRoot\system32\drivers\sbp2port.sys
0x019A6000 \SystemRoot\System32\Drivers\mup.sys
0x019B8000 \SystemRoot\System32\drivers\ecache.sys
0x01BF2000 \SystemRoot\system32\DRIVERS\hpdskflt.sys
0x019E4000 \SystemRoot\system32\drivers\disk.sys
0x016B6000 \SystemRoot\system32\drivers\crcdisk.sys
0x016CE000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x016DB000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x016E4000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x01A00000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x02E01000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x03A5C000 \SystemRoot\System32\Drivers\nvBridge.kmd
0x03A5E000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x03B41000 \SystemRoot\System32\drivers\watchdog.sys
0x03B51000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x03B5D000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x03BA3000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x016F7000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x03C09000 \SystemRoot\system32\DRIVERS\NETwNv64.sys
0x04362000 \SystemRoot\system32\DRIVERS\Rtlh64.sys
0x043B3000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x043C5000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x043D5000 \SystemRoot\system32\DRIVERS\jmcr.sys
0x03BB4000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x03BCA000 \SystemRoot\system32\DRIVERS\HpqKbFiltr.sys
0x03BD6000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x04408000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x0445B000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x0445D000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x04469000 \SystemRoot\system32\DRIVERS\enecir.sys
0x04485000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x044A1000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x044AE000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x044B7000 \SystemRoot\system32\DRIVERS\Accelerometer.sys
0x044C4000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x044FD000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x0450A000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x0452D000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x04539000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x0456A000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x0457A000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x04598000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x045B0000 \SystemRoot\system32\DRIVERS\taphss.sys
0x045BD000 \SystemRoot\system32\DRIVERS\termdd.sys
0x045D0000 \SystemRoot\system32\DRIVERS\swenum.sys
0x013C4000 \SystemRoot\system32\DRIVERS\ks.sys
0x045D2000 \SystemRoot\system32\DRIVERS\circlass.sys
0x045E3000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x045EE000 \SystemRoot\system32\DRIVERS\umbus.sys
0x0480D000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x04855000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x04869000 \SystemRoot\system32\DRIVERS\stwrt64.sys
0x048DD000 \SystemRoot\system32\DRIVERS\portcls.sys
0x04918000 \SystemRoot\system32\DRIVERS\drmk.sys
0x0493B000 \SystemRoot\system32\drivers\ksthunk.sys
0x04941000 \SystemRoot\system32\drivers\nvhda64v.sys
0x0496A000 \SystemRoot\system32\DRIVERS\hidir.sys
0x04975000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x04987000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x0498F000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x0499A000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x07201000 \SystemRoot\System32\Drivers\aswSnx.SYS
0x07281000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x0728B000 \SystemRoot\System32\Drivers\Null.SYS
0x07294000 \SystemRoot\System32\drivers\vga.sys
0x072A2000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x072C7000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x072D0000 \SystemRoot\system32\drivers\rdpencdd.sys
0x072D9000 \SystemRoot\System32\Drivers\Msfs.SYS
0x072E4000 \SystemRoot\System32\Drivers\Npfs.SYS
0x072F5000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x072FE000 \SystemRoot\system32\DRIVERS\tdx.sys
0x0731B000 \SystemRoot\System32\Drivers\aswTdi.SYS
0x0732B000 \SystemRoot\system32\DRIVERS\smb.sys
0x07346000 \SystemRoot\system32\drivers\afd.sys
0x073B1000 \SystemRoot\System32\Drivers\aswRdr.SYS
0x073BB000 \SystemRoot\System32\DRIVERS\netbt.sys
0x049AE000 \SystemRoot\system32\DRIVERS\pacer.sys
0x049CC000 \SystemRoot\system32\DRIVERS\netbios.sys
0x049DB000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x0740D000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x0745A000 \SystemRoot\system32\drivers\nsiproxy.sys
0x07466000 \SystemRoot\System32\Drivers\dfsc.sys
0x07483000 \SystemRoot\System32\Drivers\aswSP.SYS
0x074CE000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x074E6000 \SystemRoot\system32\drivers\vfs101a.sys
0x074F6000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x07512000 \SystemRoot\System32\Drivers\usbvideo.sys
0x0753C000 \SystemRoot\System32\Drivers\BTHUSB.sys
0x0754A000 \SystemRoot\System32\Drivers\bthport.sys
0x00DBB000 \SystemRoot\system32\DRIVERS\rfcomm.sys
0x07400000 \SystemRoot\system32\DRIVERS\BthEnum.sys
0x015D0000 \SystemRoot\system32\DRIVERS\bthpan.sys
0x07800000 \SystemRoot\system32\drivers\btwavdt.sys
0x07870000 \SystemRoot\system32\drivers\btwaudio.sys
0x078F4000 \SystemRoot\system32\DRIVERS\btwrchid.sys
0x00020000 \SystemRoot\System32\win32k.sys
0x07906000 \SystemRoot\System32\drivers\Dxapi.sys
0x07912000 \SystemRoot\system32\DRIVERS\monitor.sys
0x00450000 \SystemRoot\System32\TSDDD.dll
0x00800000 \SystemRoot\System32\ATMFD.DLL
0x00650000 \SystemRoot\System32\cdd.dll
0x07925000 \SystemRoot\system32\drivers\luafv.sys
0x07947000 \??\C:\Windows\system32\drivers\aswMonFlt.sys
0x07981000 \SystemRoot\System32\Drivers\aswFsBlk.SYS
0x0BE0C000 \SystemRoot\system32\drivers\spsys.sys
0x0BEA6000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x0BEBA000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x0BEEE000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x0BEF9000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x0BF11000 \SystemRoot\system32\drivers\HTTP.sys
0x0BFB4000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x0BFDD000 \SystemRoot\system32\DRIVERS\bowser.sys
0x0798A000 \SystemRoot\System32\drivers\mpsdrv.sys
0x079A4000 \SystemRoot\system32\drivers\mrxdav.sys
0x079CB000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x0CA0F000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x0CA58000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x0CA77000 \SystemRoot\System32\DRIVERS\srv2.sys
0x0CAA9000 \SystemRoot\System32\DRIVERS\srv.sys
0x0CB3D000 \SystemRoot\system32\drivers\peauth.sys
0x0CBF3000 \SystemRoot\System32\Drivers\secdrv.SYS
0x03BE4000 \SystemRoot\System32\drivers\tcpipreg.sys
0x0D801000 \??\C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\000.fcl
0x0D82C000 \SystemRoot\system32\drivers\tdtcp.sys
0x0D839000 \SystemRoot\System32\DRIVERS\tssecsrv.sys
0x0D847000 \SystemRoot\System32\Drivers\RDPWD.SYS
0x0D883000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x0D8A3000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x0D8AC000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x0D8B7000 \SystemRoot\system32\DRIVERS\udfs.sys
0x77800000 \Windows\System32\ntdll.dll

Processes (total 94):
0 System Idle Process
4 System
476 C:\Windows\System32\smss.exe
560 csrss.exe
612 C:\Windows\System32\wininit.exe
632 csrss.exe
668 C:\Windows\System32\services.exe
680 C:\Windows\System32\lsass.exe
688 C:\Windows\System32\lsm.exe
844 C:\Windows\System32\svchost.exe
904 C:\Windows\System32\nvvsvc.exe
936 C:\Windows\System32\svchost.exe
996 C:\Windows\System32\svchost.exe
212 C:\Windows\System32\svchost.exe
308 C:\Windows\System32\svchost.exe
336 C:\Windows\System32\svchost.exe
356 C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_86727c20\stacsv64.exe
552 C:\Windows\System32\winlogon.exe
332 C:\Windows\System32\audiodg.exe
1060 C:\Windows\System32\svchost.exe
1076 C:\Windows\System32\SLsvc.exe
1120 C:\Windows\System32\svchost.exe
1204 C:\Windows\System32\hpservice.exe
1264 C:\Windows\System32\vfsFPService.exe
1360 C:\Windows\System32\svchost.exe
1488 C:\Program Files\AVAST Software\Avast\AvastSvc.exe
1628 C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
1640 C:\Windows\System32\nvvsvc.exe
1848 C:\Windows\System32\spoolsv.exe
2056 C:\Program Files (x86)\DigitalPersona\Bin\DpHostW.exe
2144 C:\Windows\System32\svchost.exe
2564 C:\Windows\System32\dwm.exe
2620 C:\Windows\System32\taskeng.exe
2672 C:\Windows\System32\taskeng.exe
2688 C:\Program Files (x86)\IObit\Advanced SystemCare 3\AWC.exe
2732 C:\Windows\System32\taskeng.exe
3028 C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_86727c20\AESTSr64.exe
3048 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
3064 C:\Program Files (x86)\Bonjour\mDNSResponder.exe
2096 C:\Windows\System32\svchost.exe
2208 C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe
2776 C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
2728 C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe
2804 C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
3000 C:\Windows\System32\svchost.exe
736 C:\Program Files (x86)\SMINST\BLService.exe
3100 C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
3152 C:\Windows\System32\svchost.exe
3184 C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe
3232 C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe
3260 C:\Windows\System32\svchost.exe
3296 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
3420 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
3572 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
3752 C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
3760 C:\Program Files\Windows Defender\MSASCui.exe
3972 C:\Program Files\IDT\WDM\sttray64.exe
4000 C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
4008 C:\Windows\ehome\ehtray.exe
4016 C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe
4032 C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
4052 C:\Windows\ehome\ehmsas.exe
3288 C:\Program Files (x86)\Air Mouse\Air Mouse\Air Mouse.exe
4164 C:\Windows\ehome\ehsched.exe
4328 C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
4352 C:\Program Files (x86)\Hewlett-Packard\Media\TV\TVAgent.exe
4720 C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
4760 C:\Program Files (x86)\CyberLink\Shared files\brs.exe
4772 C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
4780 C:\Program Files (x86)\DigitalPersona\Bin\DpAgent.exe
4800 C:\Program Files\AVAST Software\Avast\AvastUI.exe
4812 C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
4828 C:\Program Files\DigitalPersona\Bin\DpAgent.exe
4852 C:\Program Files (x86)\iTunes\iTunesHelper.exe
4948 C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
5064 WmiPrvSE.exe
3908 C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
3080 C:\Program Files\iPod\bin\iPodService.exe
4508 C:\Windows\ehome\ehrecvr.exe
4136 C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe
2316 C:\Program Files\Windows Media Player\wmpnscfg.exe
4440 C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe
5416 C:\Windows\System32\conime.exe
5468 C:\Windows\System32\svchost.exe
5760 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
5832 C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
5968 C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
3940 C:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Service.exe
6444 C:\Program Files\Windows Media Player\wmpnetwk.exe
6580 C:\Program Files (x86)\Google\Quick Search Box\GoogleQuickSearchBox.exe
2820 C:\Windows\explorer.exe
6224 C:\Users\cristobalarce\Desktop\3MBRCheck.exe
2652 C:\Windows\System32\notepad.exe
6288 <unknown>

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000071`54f00000 (NTFS)
\\.\H: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: WDCWD5000BEVT-60ZAT0, Rev: 01.01A01
PhysicalDrive1 Model Number: MaxtorOneTouch, Rev: 0125

Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: E6CCDBFD8F5B3DAA80CE1AA64C67955A606A347D
698 GB \\.\PhysicalDrive1 RE: Unknown MBR code
SHA1: CEECB0630DEB98A912C967BD5561D0F2BFE7D8C6

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!

broni · 2011/03/04

Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

[color= "Blue"]**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**[/color]

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on [color= "Red"]this link[/color] to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

Close any open browsers.

[color= "Red"]WARNING:[/color] Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: http://www.appremover.com/
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion ", restart computer to fix the issue.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.exe

Double-click on the Rkill desktop icon to run the tool.

If using Vista or Windows 7 right-click on it and choose Run As Administrator.

A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.

If not, delete the file, then download and use the one provided in Link 2.

If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.

Do not reboot until instructed.

If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

Cristobalarce · 2011/03/04

Hello again, here is the Combofix log:

ComboFix 11-03-04.04 - cristobalarce 04/03/2011 18:52:47.1.4 - x64
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.52.1033.18.4062.1773 [GMT -6:00]
Running from: c:\users\cristobalarce\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
ADS - Windows: deleted 48 bytes in 1 streams.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\cristobalarce\AppData\Roaming\Desktopicon
c:\users\cristobalarce\AppData\Roaming\Desktopicon\mc.ico
c:\windows\system32\.exe
c:\windows\SysWow64\.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-02-05 to 2011-03-05 )))))))))))))))))))))))))))))))
.
.
2011-03-05 01:01 . 2011-03-05 01:01 -------- d-----w- c:\users\Mcx1\AppData\Local\temp
2011-03-05 01:01 . 2011-03-05 01:01 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-03-04 17:39 . 2011-03-04 17:39 -------- d-----w- c:\users\cristobalarce\AppData\Local\{A5910F37-3B57-4B25-B6EF-5AB823010ECB}
2011-03-04 16:21 . 2011-03-04 16:21 -------- d-----w- C:\temp_dvd
2011-03-04 16:13 . 2011-02-11 07:30 7947600 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{CC92C6E7-0D20-431B-A2D1-7CF00075A29A}\mpengine.dll
2011-03-03 19:40 . 2011-03-03 19:40 -------- d-----w- c:\program files (x86)\AC3Filter
2011-03-03 19:40 . 2009-08-12 03:22 580096 ----a-w- c:\windows\system32\ac3filter64.acm
2011-03-03 18:52 . 2011-03-03 18:52 -------- d-----w- c:\program files (x86)\Haali
2011-03-03 18:10 . 2011-03-03 18:10 -------- d-----w- c:\users\cristobalarce\AppData\Roaming\Media Player Classic
2011-03-03 18:09 . 2011-03-03 18:09 -------- d-----w- c:\program files (x86)\Media Player Classic - Home Cinema
2011-03-03 17:27 . 2008-07-31 16:41 72200 ----a-w- c:\windows\system32\XAPOFX1_1.dll
2011-03-03 02:26 . 2011-03-03 02:26 -------- d-----w- c:\program files\iPod
2011-03-03 02:26 . 2011-03-03 02:26 -------- d-----w- c:\program files\iTunes
2011-03-03 02:26 . 2011-03-03 02:26 -------- d-----w- c:\program files (x86)\iTunes
2011-03-03 02:22 . 2011-03-03 02:22 -------- d-----w- c:\program files\Bonjour
2011-03-03 02:22 . 2011-03-03 02:22 -------- d-----w- c:\program files (x86)\Bonjour
2011-03-02 22:04 . 2007-08-27 23:08 58 ----a-w- c:\windows\SysWow64\msadio.dll
2011-03-02 22:04 . 2011-03-02 22:07 -------- d-----w- c:\users\cristobalarce\AppData\Roaming\DVD-Cloner
2011-03-02 22:04 . 2011-03-02 22:04 -------- d-----w- c:\program files (x86)\DVD-Cloner Platinum
2011-03-02 19:42 . 2011-03-02 19:42 -------- d-----w- c:\program files (x86)\Common Files\Java
2011-03-02 18:59 . 2011-02-23 14:57 280408 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-03-02 18:59 . 2011-02-23 14:54 22360 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-03-02 18:59 . 2011-02-23 14:55 31064 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-03-02 18:59 . 2011-02-23 14:57 505176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-03-02 18:59 . 2011-02-23 14:55 53592 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-03-02 18:59 . 2011-02-23 15:04 238968 ----a-w- c:\windows\system32\aswBoot.exe
2011-03-02 18:59 . 2011-02-23 14:55 64344 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-03-02 18:58 . 2011-02-23 15:04 40648 ----a-w- c:\windows\avastSS.scr
2011-03-02 18:58 . 2011-02-23 15:04 190016 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-03-02 18:58 . 2011-03-02 18:58 -------- d-----w- c:\programdata\AVAST Software
2011-03-02 18:58 . 2011-03-02 18:58 -------- d-----w- c:\program files\AVAST Software
2011-03-02 07:01 . 2011-03-02 07:07 -------- d-----w- c:\users\cristobalarce\AppData\Roaming\vlc
2011-02-28 01:33 . 2011-02-28 01:34 -------- d-----w- C:\fixwareout
2011-02-24 04:46 . 2011-02-24 04:47 -------- d-----w- c:\users\cristobalarce\AppData\Local\{39A9E1FF-E146-4087-970E-8391DCFE4107}
2011-02-23 16:46 . 2011-02-23 16:46 -------- d-----w- c:\users\cristobalarce\AppData\Local\{D99F46C0-D730-464E-A2DA-C5D2DCA73667}
2011-02-23 00:24 . 2011-02-23 00:24 -------- d-----w- c:\users\cristobalarce\AppData\Local\{60EECF69-0579-4085-A700-C61420BCD804}
2011-02-22 19:41 . 2011-02-22 19:41 -------- d-----w- c:\programdata\IObit
2011-02-22 18:11 . 2011-02-25 17:26 -------- d-----w- c:\users\cristobalarce\AppData\Roaming\IObit
2011-02-22 18:11 . 2011-02-22 18:11 -------- d-----w- c:\program files (x86)\IObit
2011-02-22 14:21 . 2011-03-04 19:44 -------- d-----w- c:\program files\Unlocker
2011-02-22 14:08 . 2011-02-22 14:15 -------- d-----w- c:\program files (x86)\Unlocker
2011-02-22 12:23 . 2011-02-22 12:24 -------- d-----w- c:\users\cristobalarce\AppData\Local\{CE0A791E-E8C4-4C6E-A3CC-751532ACEFD2}
2011-02-22 04:03 . 2011-02-22 04:03 -------- d-----w- C:\Rbackup
2011-02-22 01:15 . 2006-06-19 18:01 69632 ----a-w- c:\windows\SysWow64\ztvcabinet.dll
2011-02-22 01:15 . 2006-05-25 20:52 162304 ----a-w- c:\windows\SysWow64\ztvunrar36.dll
2011-02-22 01:15 . 2005-08-26 06:50 77312 ----a-w- c:\windows\SysWow64\ztvunace26.dll
2011-02-22 01:15 . 2003-02-03 01:06 153088 ----a-w- c:\windows\SysWow64\UNRAR3.dll
2011-02-22 01:15 . 2002-03-06 06:00 75264 ----a-w- c:\windows\SysWow64\unacev2.dll
2011-02-21 12:07 . 2011-02-21 12:07 -------- d-----w- c:\users\cristobalarce\AppData\Local\{6619564C-5624-4B2D-B2C2-487D3C2DC4EC}
2011-02-21 00:07 . 2011-02-21 00:07 -------- d-----w- c:\users\cristobalarce\AppData\Local\{FF1745BC-2042-4AAE-9B3F-5DCF43374D05}
2011-02-20 12:07 . 2011-02-20 12:07 -------- d-----w- c:\users\cristobalarce\AppData\Local\{08E986F3-A2BD-42B2-ABEC-45453C4C8DE3}
2011-02-20 00:24 . 2011-02-20 00:24 -------- d-----w- c:\program files\Validity Sensors
2011-02-20 00:06 . 2011-02-20 00:06 -------- d-----w- c:\users\cristobalarce\AppData\Local\{95C56A88-DA2A-4B99-9D20-D83B2F895168}
2011-02-19 23:35 . 2011-02-19 23:35 15712 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\b954fc6f1cbd08d01\MeshBetaRemover.exe
2011-02-19 04:16 . 2011-02-19 04:16 -------- d-----w- c:\users\cristobalarce\AppData\Roaming\DigitalPersona
2011-02-18 16:44 . 2011-02-22 04:04 -------- d-----w- c:\program files\Perfect Uninstaller
2011-02-18 03:28 . 2011-02-18 03:28 -------- d-----w- c:\users\cristobalarce\AppData\Local\VS Revo Group
2011-02-18 03:28 . 2009-12-30 17:21 31800 ----a-w- c:\windows\system32\drivers\revoflt.sys
2011-02-18 03:28 . 2011-02-18 03:28 -------- d-----w- c:\program files\VS Revo Group
2011-02-17 19:44 . 2011-02-17 19:44 -------- d-----w- c:\program files (x86)\Juno
2011-02-17 19:44 . 2011-02-17 19:44 -------- d-----w- c:\programdata\Juno
2011-02-17 19:44 . 2011-02-17 19:53 -------- d-----w- c:\program files\JunoInstaller
2011-02-14 04:02 . 2011-02-14 04:02 -------- d-----w- c:\programdata\McAfee
2011-02-08 18:58 . 2010-10-15 14:02 4699024 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-02-08 18:58 . 2010-10-15 13:43 1168512 ----a-w- c:\windows\SysWow64\ntdll.dll
2011-02-08 18:58 . 2010-10-15 13:43 1585168 ----a-w- c:\windows\system32\ntdll.dll
2011-02-08 18:55 . 2011-01-08 09:03 48128 ----a-w- c:\windows\system32\atmlib.dll
2011-02-08 18:55 . 2011-01-08 08:47 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2011-02-08 18:55 . 2011-01-08 06:45 367104 ----a-w- c:\windows\system32\atmfd.dll
2011-02-08 18:55 . 2011-01-08 06:28 292352 ----a-w- c:\windows\SysWow64\atmfd.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-02 19:42 . 2010-05-19 04:42 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2011-02-02 23:11 . 2009-10-03 06:32 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-01-29 00:27 . 2010-02-13 06:48 29480 ----a-w- c:\windows\SysWow64\msxml3a.dll
2011-01-14 03:20 . 2011-01-14 03:20 536328 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-01-08 03:27 . 2011-01-30 04:54 7729256 ----a-w- c:\windows\system32\nvwgf2umx.dll
2011-01-08 03:27 . 2011-01-30 04:54 5653096 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2011-01-08 03:27 . 2011-01-30 04:54 20471912 ----a-w- c:\windows\system32\nvoglv64.dll
2011-01-08 03:27 . 2011-01-30 04:54 15047272 ----a-w- c:\windows\SysWow64\nvoglv32.dll
2011-01-08 03:27 . 2011-01-30 04:54 12961640 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2011-01-08 03:27 . 2011-01-30 04:54 67176 ----a-w- c:\windows\system32\OpenCL.dll
2011-01-08 03:27 . 2011-01-30 04:54 6604904 ----a-w- c:\windows\system32\nvcuda.dll
2011-01-08 03:27 . 2011-01-30 04:54 57960 ----a-w- c:\windows\SysWow64\OpenCL.dll
2011-01-08 03:27 . 2011-01-30 04:54 4941928 ----a-w- c:\windows\SysWow64\nvcuda.dll
2011-01-08 03:27 . 2011-01-30 04:54 3112040 ----a-w- c:\windows\system32\nvcuvid.dll
2011-01-08 03:27 . 2011-01-30 04:54 2895976 ----a-w- c:\windows\SysWow64\nvcuvid.dll
2011-01-08 03:27 . 2011-01-30 04:54 2479720 ----a-w- c:\windows\system32\nvcuvenc.dll
2011-01-08 03:27 . 2011-01-30 04:54 2251368 ----a-w- c:\windows\SysWow64\nvcuvenc.dll
2011-01-08 03:27 . 2011-01-30 04:54 1965672 ----a-w- c:\windows\SysWow64\nvapi.dll
2011-01-08 03:27 . 2011-01-30 04:54 18580072 ----a-w- c:\windows\system32\nvcompiler.dll
2011-01-08 03:27 . 2011-01-30 04:54 1614440 ----a-w- c:\windows\system32\nvdispco642090.dll
2011-01-08 03:27 . 2011-01-30 04:54 1359976 ----a-w- c:\windows\system32\nvgenco642040.dll
2011-01-08 03:27 . 2011-01-30 04:54 13011560 ----a-w- c:\windows\SysWow64\nvcompiler.dll
2011-01-08 03:27 . 2011-01-30 04:54 10078312 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2011-01-08 03:27 . 2009-08-19 18:35 2200680 ----a-w- c:\windows\system32\nvapi64.dll
2011-01-08 03:27 . 2009-08-19 18:35 12859496 ----a-w- c:\windows\system32\nvd3dumx.dll
2011-01-08 02:50 . 2011-01-08 02:50 795752 ----a-w- c:\windows\system32\easyUpdatusAPIU64.dll
2011-01-08 02:50 . 2011-01-08 02:50 6143080 ----a-w- c:\windows\system32\nvcpl.dll
2011-01-08 02:49 . 2011-01-08 02:49 3156072 ----a-w- c:\windows\system32\nvsvc64.dll
2011-01-08 02:49 . 2011-01-08 02:49 117864 ----a-w- c:\windows\system32\nvmctray.dll
2011-01-08 02:49 . 2011-01-08 02:49 313448 ----a-w- c:\windows\system32\nvhotkey.dll
2011-01-08 02:49 . 2011-01-08 02:49 2558568 ----a-w- c:\windows\system32\nvsvcr.dll
2011-01-08 02:49 . 2011-01-08 02:49 1005160 ----a-w- c:\windows\system32\nvvsvc.exe
2010-12-28 16:08 . 2011-01-12 20:52 466944 ----a-w- c:\windows\system32\odbc32.dll
2010-12-28 15:55 . 2011-01-12 20:52 413696 ----a-w- c:\windows\SysWow64\odbc32.dll
2010-12-21 00:09 . 2010-06-29 01:29 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2010-12-21 00:08 . 2010-06-29 01:29 24152 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-14 16:15 . 2011-01-12 20:52 1251840 ----a-w- c:\windows\system32\sdclt.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg "= "c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-16 39408]
"ehTray.exe "= "c:\windows\ehome\ehTray.exe" [2008-01-21 138240]
"ISUSPM "= "c:\programdata\Macrovision\FLEXnet Connect\6\ISUSPM.exe" [2007-07-12 226904]
"msnmsgr "= "c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2010-11-10 4240760]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"UCam_Menu "= "c:\program files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"QlbCtrl.exe "= "c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-11-24 323640]
"TVAgent "= "c:\program files (x86)\Hewlett-Packard\Media\TV\TVAgent.exe" [2009-04-23 206120]
"Google Quick Search Box "= "c:\program files (x86)\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-06-16 68592]
"GrooveMonitor "= "c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"AppleSyncNotifier "= "c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-22 47904]
"Microsoft Default Manager "= "c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-07-17 288080]
"HP Software Update "= "c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"WirelessAssistant "= "c:\program files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744]
"Adobe Reader Speed Launcher "= "c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM "= "c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"QuickTime Task "= "c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
"BDRegion "= "c:\program files (x86)\Cyberlink\Shared files\brs.exe" [2010-11-18 75048]
"RemoteControl10 "= "c:\program files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe" [2010-02-03 87336]
"DpAgent "= "c:\program files (x86)\DigitalPersona\Bin\dpagent.exe" [2009-12-01 842816]
"avast "= "c:\program files\AVAST Software\Avast\avastUI.exe" [2011-02-23 3451496]
"SunJavaUpdateSched "= "c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"iTunesHelper "= "c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-03-02 421160]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Air Mouse.lnk - c:\program files (x86)\Air Mouse\Air Mouse\Air Mouse.exe [2010-12-27 1044648]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer "=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@= "Driver "
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate1ca516eed51bd90;Servicio de actualizaciÃ³n de Google (gupdate1ca516eed51bd90);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-10-20 133104]
R2 IsaMonitor;ISA Monitor Service; [x]
R2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [2010-02-18 2045232]
R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files (x86)\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-07-26 25832]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2009-08-27 13352]
R3 NETw3v64;Intel(R) PRO/Wireless 3945ABG Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\NETw3v64.sys [2008-01-21 3154432]
R3 NETw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\NETw5v64.sys [2009-10-03 6816256]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 31800]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2010-09-28 51712]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 1020768]
R3 yukonx64;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk60x64.sys [2006-10-04 273408]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC};Power Control [2011/01/28 18:32];c:\program files (x86)\CyberLink\PowerDVD10\NavFilter\000.fcl [2010-11-18 03:29 146928]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_86727c20\AESTSr64.exe [2008-06-27 89088]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-02-23 64344]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2010-10-14 92216]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2010-07-16 30520]
S2 HssWd;Hotspot Shield Monitoring Service;c:\program files (x86)\Hotspot Shield\bin\hsswd.exe [2010-01-08 285744]
S2 Recovery Service for Windows;Recovery Service for Windows;c:\program files (x86)\SMINST\BLService.exe [2008-10-06 365952]
S2 TVCapSvc;TV Background Capture Service (TVBCS);c:\program files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe [2009-04-23 296320]
S2 TVSched;TV Task Scheduler (TVTS);c:\program files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe [2009-04-23 116104]
S2 vfsFPService;Validity Fingerprint Service;c:\windows\system32\vfsFPService.exe [2008-09-16 719152]
S3 Com4QLBEx;Com4QLBEx;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2010-01-12 227896]
S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [2008-09-04 64000]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2008-08-07 143360]
S3 NETwNv64;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\NETwNv64.sys [2010-07-14 7653888]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2010-11-11 155752]
S3 vfs101a;vfs101a;c:\windows\system32\drivers\vfs101a.sys [2008-09-16 49968]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-11-20 20:28 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
2011-03-05 c:\windows\Tasks\AWC AutoSweep.job
- c:\program files (x86)\IObit\Advanced SystemCare 3\AutoSweep.exe [2011-02-22 20:11]
.
2011-03-05 c:\windows\Tasks\AWC Startup.job
- c:\program files (x86)\IObit\Advanced SystemCare 3\AWC.exe [2011-02-22 22:19]
.
2011-03-04 c:\windows\Tasks\AWC Update.job
- c:\program files (x86)\IObit\Advanced SystemCare 3\IObitUpdate.exe [2011-02-22 21:24]
.
2011-03-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-10-20 10:20]
.
2011-03-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-10-20 10:20]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
2010-06-13 20:48 269872 ----a-w- c:\program files (x86)\Hotspot Shield\hssie\HssIE_64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@= "{472083B0-C522-11CF-8763-00608CC02F24} "
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-02-23 15:04 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender "= "%ProgramFiles%\Windows Defender\MSASCui.exe -hide" [X]
"combofix "= "c:\combofix\CF23075.cfxxe" [X]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs "=0x0
.
------- Supplementary Scan -------
.
uStart Page = prodigy.msn.com
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
DPF: {72376E32-8AF2-473F-BE32-E5D0F39C865D} - hxxp://www.cyberlink.com/prog/aacs/UpdateAdvisor.cab
FF - ProfilePath - c:\users\cristobalarce\AppData\Roaming\Mozilla\Firefox\Profiles\j56u2rxx.default\
FF - prefs.js: browser.startup.homepage - hxxp://t1msn.com
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: z: {a22b91ee-2b99-7f6a-8f34-9783ebf1a377} - c:\program files (x86)\Mozilla Firefox\extensions\{a22b91ee-2b99-7f6a-8f34-9783ebf1a377}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: DigitalPersona Extension: otis@digitalpersona.com - c:\program files (x86)\DigitalPersona\Bin\FirefoxExt
FF - Ext: DigitalPersona Extension: otis@digitalpersona.com - c:\program files (x86)\DigitalPersona\Bin\firefoxext
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
WebBrowser-{DB131C55-60C8-4ADC-84DC-9E76AB06E2DC} - (no file)
HKLM-Run-SynTPEnh - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-SmartMenu - %ProgramFiles%\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
HKLM-Run-SysTrayApp - %ProgramFiles%\IDT\WDM\sttray64.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet012\Services\{1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}]
"ImagePath "= "\??\c:\program files (x86)\CyberLink\PowerDVD10\NavFilter\000.fcl "
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Shockwave Flash Object "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@= "0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@= "ShockwaveFlash.ShockwaveFlash.10 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "ShockwaveFlash.ShockwaveFlash "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Macromedia Flash Factory Object "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@= "FlashFactory.FlashFactory.1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "FlashFactory.FlashFactory "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@= "Shockwave Flash "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=" "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@= "FlashBroker "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
"SymbolicLinkValue "=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet012\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet012\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet012\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet012\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\DigitalPersona\Bin\DpHostW.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\Hotspot Shield\bin\openvpnas.exe
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
.
**************************************************************************
.
Completion time: 2011-03-04 19:15:32 - machine was rebooted
ComboFix-quarantined-files.txt 2011-03-05 01:15
.
Pre-Run: 229,381,435,392 bytes free
Post-Run: 228,741,967,872 bytes free
.
- - End Of File - - F1279177F1E3A19D21FC50CE8ED4A360

broni · 2011/03/04

How is redirection?

Open Windows Explorer. Go Tools>Folder Options>View tab, put a checkmark next to Show hidden files, and folders.
Upload following files to http://www.virustotal.com/ for security check:
- c:\windows\SysWow64\msadio.dll
If the file is listed as already analyzed, click on Reanalyse file now button.
Post scan results.

Cristobalarce · 2011/03/04

Here are the results:

Antivirus

Version

Last Update

Result

AhnLab-V3

2011.03.05.01

2011.03.05

-

AntiVir

7.11.4.71

2011.03.04

-

Antiy-AVL

2.0.3.7

2011.03.04

-

Avast

4.8.1351.0

2011.02.23

-

Avast5

5.0.677.0

2011.03.04

-

AVG

10.0.0.1190

2011.03.04

-

BitDefender

7.2

2011.03.05

-

CAT-QuickHeal

11.00

2011.03.04

-

ClamAV

0.96.4.0

2011.03.04

-

Commtouch

5.2.11.5

2011.03.05

-

Comodo

7874

2011.03.04

-

DrWeb

5.0.2.03300

2011.03.05

-

Emsisoft

5.1.0.2

2011.03.04

-

eSafe

7.0.17.0

2011.03.03

-

eTrust-Vet

36.1.8198

2011.03.04

-

F-Prot

4.6.2.117

2011.03.04

-

F-Secure

9.0.16440.0

2011.03.05

-

Fortinet

4.2.254.0

2011.03.05

-

GData

21

2011.03.05

-

Ikarus

T3.1.1.97.0

2011.03.04

-

Jiangmin

13.0.900

2011.03.04

-

K7AntiVirus

9.91.4026

2011.03.04

-

Kaspersky

7.0.0.125

2011.03.05

-

McAfee

5.400.0.1158

2011.03.05

-

McAfee-GW-Edition

2010.1C

2011.03.04

-

Microsoft

1.6603

2011.03.04

-

NOD32

5927

2011.03.05

-

Norman

6.07.03

2011.03.04

-

nProtect

2011-02-10.01

2011.02.15

-

Panda

10.0.3.5

2011.03.04

-

PCTools

7.0.3.5

2011.03.05

-

Prevx

3.0

2011.03.05

-

Rising

23.47.04.05

2011.03.04

-

Sophos

4.63.0

2011.03.05

-

SUPERAntiSpyware

4.40.0.1006

2011.03.05

-

Symantec

20101.3.0.103

2011.03.05

-

TheHacker

6.7.0.1.144

2011.03.04

-

TrendMicro

9.200.0.1012

2011.03.04

-

TrendMicro-HouseCall

9.200.0.1012

2011.03.05

-

VBA32

3.12.14.3

2011.03.04

-

VIPRE

8600

2011.03.04

-

ViRobot

2011.3.5.4341

2011.03.05

-

VirusBuster

13.6.235.0

2011.03.04

-

Additional information

Show all

MD5 : 572109747f199a1a40f832680f458194

SHA1 : 9088b84b587d27372ac193bb2c2c8319eced5992

SHA256: 36be6f11796433618088fba6d853b78f2a39050628b32d9787e2ac7e57b97b16

ssdeep: 3:x1tCoXSf5+4XGWDBhvKf5+g:x1tCyO+49do+g

File size : 58 bytes

First seen: 2011-03-05 03:26:14

Last seen : 2011-03-05 03:26:14

TrID:
Unknown!

sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

ExifTool:
file metadata
Error: File format error
FileSize: 58 bytes

About the redirects, they appear so randomly that it's hard to say.

broni · 2011/03/04

OK, keep me updated on redirection issue.

Download OTL to your Desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

Click the Scan All Users checkbox.

Under the Custom Scan box paste this in:

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

Cristobalarce · 2011/03/04

After OTL completed the scan, it only opened OTL.txt, no EXTRAS file.

Here's what I got:

OTL logfile created on: 04/03/2011 10:32:25 p.m. - Run 4
OTL by OldTimer - Version 3.2.22.2 Folder = C:\Users\cristobalarce\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8080.16413)
Locale: 0000080A | Country: Mexico | Language: ESM | Date Format: dd/MM/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 43.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 453.33 Gb Total Space | 210.46 Gb Free Space | 46.42% Space Free | Partition Type: NTFS
Drive D: | 12.43 Gb Total Space | 1.97 Gb Free Space | 15.86% Space Free | Partition Type: NTFS
Drive H: | 698.64 Gb Total Space | 178.53 Gb Free Space | 25.55% Space Free | Partition Type: NTFS

Computer Name: LARAMBONA | User Name: cristobalarce | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/03/04 22:08:15 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Users\cristobalarce\Desktop\OTL.exe
PRC - [2011/02/23 09:04:20 | 003,451,496 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2011/02/23 09:04:19 | 000,042,184 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2010/12/27 15:04:22 | 001,044,648 | ---- | M] () -- C:\Program Files (x86)\Air Mouse\Air Mouse\Air Mouse.exe
PRC - [2010/12/16 16:19:34 | 002,402,512 | ---- | M] (IObit) -- C:\Program Files (x86)\IObit\Advanced SystemCare 3\AWC.exe
PRC - [2010/11/17 21:29:22 | 000,075,048 | ---- | M] (cyberlink) -- C:\Program Files (x86)\CyberLink\Shared files\brs.exe
PRC - [2010/10/14 17:27:38 | 000,092,216 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
PRC - [2010/02/03 00:08:56 | 000,087,336 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
PRC - [2010/01/08 18:30:28 | 000,234,032 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe
PRC - [2010/01/08 17:42:42 | 000,285,744 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe
PRC - [2009/12/01 13:37:48 | 000,322,624 | ---- | M] (DigitalPersona, Inc.) -- C:\Program Files (x86)\DigitalPersona\Bin\DpHostW.exe
PRC - [2009/12/01 13:37:46 | 000,842,816 | ---- | M] (DigitalPersona, Inc.) -- C:\Program Files (x86)\DigitalPersona\Bin\DpAgent.exe
PRC - [2009/06/16 00:41:20 | 000,068,592 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Quick Search Box\GoogleQuickSearchBox.exe
PRC - [2009/04/22 22:06:52 | 000,206,120 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\Hewlett-Packard\Media\TV\TVAgent.exe
PRC - [2009/04/22 21:53:22 | 000,296,320 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe
PRC - [2009/04/22 21:53:22 | 000,116,104 | ---- | M] () -- C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe
PRC - [2008/10/06 10:54:52 | 000,365,952 | ---- | M] () -- C:\Program Files (x86)\SMINST\BLService.exe
PRC - [2007/07/12 13:43:50 | 000,226,904 | ---- | M] (Macrovision Corporation) -- C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe

========== Modules (SafeList) ==========

MOD - [2011/03/04 22:08:15 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Users\cristobalarce\Desktop\OTL.exe
MOD - [2011/02/23 09:04:17 | 000,197,208 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\snxhk.dll
MOD - [2010/08/31 09:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011/02/23 09:04:19 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV:64bit: - [2010/07/16 14:03:58 | 000,030,520 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Windows\SysNative\Hpservice.exe -- (hpsrv)
SRV:64bit: - [2010/02/18 14:52:30 | 002,045,232 | ---- | M] (Validity Sensors, Inc.) [Auto | Stopped] -- C:\Windows\SysNative\vcsFPService.exe -- (vcsFPService)
SRV:64bit: - [2008/09/16 11:33:26 | 000,719,152 | ---- | M] (Validity Sensors, Inc.) [Auto | Running] -- C:\Windows\SysNative\vfsFPService.exe -- (vfsFPService)
SRV:64bit: - [2008/08/05 11:12:22 | 000,251,904 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_86727c20\STacSV64.exe -- (STacSV)
SRV:64bit: - [2008/06/27 09:53:06 | 000,089,088 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_86727c20\AESTSr64.exe -- (AESTFilters)
SRV:64bit: - [2008/01/20 20:47:32 | 000,383,544 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2010/10/14 17:27:38 | 000,092,216 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe -- (HPDrvMntSvc.exe)
SRV - [2010/03/18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/02/18 14:26:46 | 001,664,304 | ---- | M] (Validity Sensors, Inc.) [Auto | Stopped] -- C:\Windows\SysWOW64\vcsFPService.exe -- (vcsFPService)
SRV - [2010/01/08 18:31:04 | 000,057,640 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.exe -- (HssTrayService)
SRV - [2010/01/08 18:30:28 | 000,234,032 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe -- (HotspotShieldService)
SRV - [2010/01/08 17:42:42 | 000,285,744 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe -- (HssWd)
SRV - [2009/12/01 13:37:48 | 000,322,624 | ---- | M] (DigitalPersona, Inc.) [Auto | Running] -- C:\Program Files (x86)\DigitalPersona\Bin\DpHostW.exe -- (DpHost)
SRV - [2009/07/26 06:43:14 | 000,025,832 | ---- | M] (BioWare) [On_Demand | Stopped] -- C:\Program Files (x86)\Dragon Age\bin_ship\daupdatersvc.service.exe -- (DAUpdaterSvc)
SRV - [2009/04/22 21:53:22 | 000,296,320 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe -- (TVCapSvc) TV Background Capture Service (TVBCS)
SRV - [2009/04/22 21:53:22 | 000,116,104 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe -- (TVSched) TV Task Scheduler (TVTS)
SRV - [2009/03/29 22:42:14 | 000,066,368 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/10/06 10:54:52 | 000,365,952 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\SMINST\BLService.exe -- (Recovery Service for Windows)
SRV - [2008/09/16 11:33:18 | 000,599,344 | ---- | M] (Validity Sensors, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vfsFPService.exe -- (vfsFPService)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2011/02/23 08:55:05 | 000,064,344 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2010/11/11 17:10:49 | 000,155,752 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2010/09/28 15:44:52 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2010/08/25 15:41:36 | 000,323,176 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys -- (RTL8169)
DRV:64bit: - [2010/07/16 14:04:04 | 000,030,008 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\hpdskflt.sys -- (hpdskflt)
DRV:64bit: - [2010/07/16 14:03:48 | 000,043,320 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\Accelerometer.sys -- (Accelerometer)
DRV:64bit: - [2010/07/14 05:34:28 | 007,653,888 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\NETwNv64.sys -- (NETwNv64) ___ Intel(R)
DRV:64bit: - [2010/05/27 21:32:56 | 000,320,560 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\SynTP.sys -- (SynTP)
DRV:64bit: - [2010/01/08 17:42:40 | 000,037,888 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\taphss.sys -- (taphss)
DRV:64bit: - [2009/12/30 11:21:24 | 000,031,800 | ---- | M] (VS Revo Group) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\revoflt.sys -- (Revoflt)
DRV:64bit: - [2009/10/02 20:23:14 | 006,816,256 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\NETw5v64.sys -- (NETw5v64) Intel(R)
DRV:64bit: - [2009/09/30 18:51:42 | 000,046,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb)
DRV:64bit: - [2009/08/27 01:14:01 | 000,027,176 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ggsemc.sys -- (ggsemc)
DRV:64bit: - [2009/08/27 01:14:01 | 000,013,352 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ggflt.sys -- (ggflt)
DRV:64bit: - [2009/05/18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009/04/29 07:48:32 | 000,018,432 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV:64bit: - [2009/04/10 23:43:06 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\usb8023x.sys -- (usb_rndisx)
DRV:64bit: - [2009/04/08 13:28:46 | 000,068,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\xusb21.sys -- (xusb21)
DRV:64bit: - [2008/09/16 11:33:38 | 000,049,968 | ---- | M] (Validity Sensors, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vfs101a.sys -- (vfs101a)
DRV:64bit: - [2008/09/04 11:48:00 | 000,064,000 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\enecir.sys -- (enecir)
DRV:64bit: - [2008/08/07 11:01:36 | 000,143,360 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\jmcr.sys -- (JMCR)
DRV:64bit: - [2008/08/05 11:13:52 | 000,459,264 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\stwrt64.sys -- (STHDA)
DRV:64bit: - [2008/06/23 05:54:02 | 000,099,368 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
DRV:64bit: - [2008/06/23 05:54:02 | 000,091,176 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
DRV:64bit: - [2008/06/23 05:54:02 | 000,019,752 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\btwrchid.sys -- (btwrchid)
DRV:64bit: - [2008/01/20 20:47:27 | 000,903,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\xnacc.sys -- (xnacc)
DRV:64bit: - [2008/01/20 20:46:57 | 003,154,432 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\NETw3v64.sys -- (NETw3v64) Intel(R)
DRV:64bit: - [2008/01/20 20:46:55 | 000,111,104 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\sdbus.sys -- (sdbus)
DRV:64bit: - [2007/04/24 08:33:30 | 000,123,656 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\s125obex.sys -- (s125obex)
DRV:64bit: - [2007/04/24 08:33:28 | 000,126,216 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\s125mgmt.sys -- (s125mgmt) Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM)
DRV:64bit: - [2007/04/24 08:33:26 | 000,144,648 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\s125mdm.sys -- (s125mdm)
DRV:64bit: - [2007/04/24 08:33:24 | 000,019,720 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\s125mdfl.sys -- (s125mdfl)
DRV:64bit: - [2007/04/24 08:33:14 | 000,108,296 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\s125bus.sys -- (s125bus) Sony Ericsson Device 125 driver (WDM)
DRV:64bit: - [2006/10/03 19:45:36 | 000,273,408 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\yk60x64.sys -- (yukonx64)
DRV:64bit: - [2006/09/18 15:36:24 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)
DRV - [2010/11/17 21:29:20 | 000,146,928 | ---- | M] (CyberLink Corp.) [2011/01/28 18:32:24] [Kernel | Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\000.fcl -- ({1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC})
DRV - [2009/08/27 00:36:40 | 000,005,632 | ---- | M] () [File_System | System | Stopped] -- C:\Windows\SysWow64\drivers\StarOpen.sys -- (StarOpen)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3779111478-2882620495-629939005-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = prodigy.msn.com
IE - HKU\S-1-5-21-3779111478-2882620495-629939005-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = es-mx
IE - HKU\S-1-5-21-3779111478-2882620495-629939005-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = D8 0A A5 15 D7 85 CB 01 [binary data]
IE - HKU\S-1-5-21-3779111478-2882620495-629939005-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKU\S-1-5-21-3779111478-2882620495-629939005-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3779111478-2882620495-629939005-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://t1msn.com "
FF - prefs.js..extensions.enabledItems: otis@digitalpersona.com:5.0.0.3790
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {a22b91ee-2b99-7f6a-8f34-9783ebf1a377}:4.6.7.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - HKLM\software\mozilla\Firefox\Extensions\\msntoolbar@msn.com: C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0334.0\Firefox [2009/10/26 22:30:38 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010/06/10 02:14:18 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\otis@digitalpersona.com: C:\Program Files (x86)\DigitalPersona\Bin\FirefoxExt\ [2011/02/18 22:27:02 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/12/23 08:18:32 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/02/15 08:03:25 | 000,000,000 | ---D | M]

[2010/01/11 20:14:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\cristobalarce\AppData\Roaming\Mozilla\Extensions
[2011/03/03 10:41:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\cristobalarce\AppData\Roaming\Mozilla\Firefox\Profiles\j56u2rxx.default\extensions
[2010/04/27 21:02:41 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\cristobalarce\AppData\Roaming\Mozilla\Firefox\Profiles\j56u2rxx.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/01/20 11:49:52 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Users\cristobalarce\AppData\Roaming\Mozilla\Firefox\Profiles\j56u2rxx.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2011/03/03 10:41:55 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2011/01/27 11:49:10 | 000,000,000 | ---D | M] (z) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{a22b91ee-2b99-7f6a-8f34-9783ebf1a377}
[2010/05/18 22:42:37 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/17 22:39:03 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/10/14 16:04:04 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/01/14 19:03:04 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/03/02 13:42:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/02/18 22:27:02 | 000,000,000 | ---D | M] (DigitalPersona Extension) -- C:\PROGRAM FILES (X86)\DIGITALPERSONA\BIN\FIREFOXEXT
[2011/03/02 13:42:16 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/12/23 08:18:29 | 000,003,996 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\drae.xml
[2010/12/23 08:18:29 | 000,000,751 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\eBay-es.xml
[2010/12/23 08:18:29 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\wikipedia-es.xml
[2010/12/23 08:18:29 | 000,001,102 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo-es.xml

O1 HOSTS File: ([2006/09/18 15:37:24 | 000,000,761 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (DigitalPersona Personal Extension) - {395610AE-C624-4f58-B89E-23733EA00F9A} - C:\Program Files\DigitalPersona\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (DigitalPersona Personal Extension) - {395610AE-C624-4f58-B89E-23733EA00F9A} - C:\Program Files (x86)\DigitalPersona\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
O2 - BHO: (MSN Toolbar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0334.0\npwinext.dll (Microsoft Corporation)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0334.0\npwinext.dll (Microsoft Corporation)
O3 - HKU\S-1-5-21-3779111478-2882620495-629939005-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3:64bit: - HKU\S-1-5-21-3779111478-2882620495-629939005-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (Hewlett-Packard)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [BDRegion] C:\Program Files (x86)\Cyberlink\Shared files\brs.exe (cyberlink)
O4 - HKLM..\Run: [DpAgent] C:\Program Files (x86)\DigitalPersona\Bin\DpAgent.exe (DigitalPersona, Inc.)
O4 - HKLM..\Run: [Google Quick Search Box] C:\Program Files (x86)\Google\Quick Search Box\GoogleQuickSearchBox.exe (Google Inc.)
O4 - HKLM..\Run: [RemoteControl10] C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [TVAgent] C:\Program Files (x86)\Hewlett-Packard\Media\TV\TVAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UCam_Menu] C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKU\S-1-5-21-3779111478-2882620495-629939005-1000..\Run: [ISUSPM] C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe (Macrovision Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3779111478-2882620495-629939005-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3779111478-2882620495-629939005-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = FF FF FF FF [binary data]
O7 - HKU\S-1-5-21-3779111478-2882620495-629939005-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 36
O7 - HKU\S-1-5-21-3779111478-2882620495-629939005-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll (Google Inc.)
O8:64bit: - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8:64bit: - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll (Google Inc.)
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} https://h50203.www5.hp.com/HPISWeb/Customer/cabs/HPISDataManager.CAB (Hewlett-Packard Online Support Services)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} https://wimpro2.cce.hp.com/ChatEntry/downloads/sysinfo.cab (SysData Class)
O16 - DPF: {72376E32-8AF2-473F-BE32-E5D0F39C865D} http://www.cyberlink.com/prog/aacs/UpdateAdvisor.cab (CUpdateAdvisorCtrl Object)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab (GMNRev Class)
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab (NVIDIA Smart Scan)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.3.13.0.cab (SysInfo Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Value error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\Titanium3.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\Titanium3.jpg
O28:64bit: - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/08/14 00:09:56 | 000,000,000 | ---- | M] () - C:\Autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2010/06/28 20:25:13 | 000,000,000 | R--D | M] - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010/06/28 20:25:13 | 000,000,000 | R--D | M] - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010/06/28 20:25:14 | 000,000,000 | R--D | M] - H:\autorun.inf -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

Drivers32:64bit: msacm.ac3filter - ac3filter64.acm ()
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\Windows\SysWow64\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/03/04 19:15:35 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2011/03/04 19:05:58 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/03/04 18:50:30 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/03/04 18:50:30 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/03/04 18:50:30 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011/03/04 18:50:27 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011/03/04 18:49:50 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/03/04 18:49:33 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2011/03/04 18:49:30 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW
[2011/03/04 11:48:57 | 000,000,000 | ---D | C] -- C:\Users\cristobalarce\Desktop\DVD
[2011/03/04 11:39:26 | 000,000,000 | ---D | C] -- C:\Users\cristobalarce\AppData\Local\{A5910F37-3B57-4B25-B6EF-5AB823010ECB}
[2011/03/04 10:21:01 | 000,000,000 | ---D | C] -- C:\temp_dvd
[2011/03/03 13:40:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AC3Filter
[2011/03/03 13:40:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AC3Filter
[2011/03/03 12:52:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Haali
[2011/03/03 12:30:39 | 000,000,000 | ---D | C] -- C:\Users\cristobalarce\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Media Player Classic - Home Cinema x64
[2011/03/03 12:10:10 | 000,000,000 | ---D | C] -- C:\Users\cristobalarce\AppData\Roaming\Media Player Classic
[2011/03/03 12:09:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Player Classic - Home Cinema x64
[2011/03/03 12:09:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Media Player Classic - Home Cinema
[2011/03/02 20:26:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/03/02 20:26:07 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2011/03/02 20:26:05 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2011/03/02 20:26:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2011/03/02 20:22:31 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2011/03/02 20:22:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bonjour
[2011/03/02 16:04:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iPod-Cloner
[2011/03/02 16:04:19 | 000,000,000 | ---D | C] -- C:\Users\cristobalarce\AppData\Roaming\DVD-Cloner
[2011/03/02 16:04:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVD-Cloner
[2011/03/02 16:04:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVD-Cloner Platinum
[2011/03/02 14:08:15 | 000,000,000 | ---D | C] -- C:\Users\cristobalarce\Desktop\MW Removal 2011
[2011/03/02 13:42:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2011/03/02 12:59:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2011/03/02 12:59:33 | 000,280,408 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2011/03/02 12:59:33 | 000,022,360 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFsBlk.sys
[2011/03/02 12:59:30 | 000,031,064 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr.sys
[2011/03/02 12:59:29 | 000,505,176 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
[2011/03/02 12:59:29 | 000,053,592 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswTdi.sys
[2011/03/02 12:59:27 | 000,238,968 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2011/03/02 12:59:27 | 000,064,344 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2011/03/02 12:58:40 | 000,190,016 | ---- | C] (AVAST Software) -- C:\Windows\SysWow64\aswBoot.exe
[2011/03/02 12:58:40 | 000,040,648 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2011/03/02 12:58:29 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2011/03/02 12:58:29 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2011/03/02 12:15:05 | 000,000,000 | --SD | C] -- C:\Users\cristobalarce\Documents\Passwords Database
[2011/03/02 01:01:50 | 000,000,000 | ---D | C] -- C:\Users\cristobalarce\AppData\Roaming\vlc
[2011/03/01 14:05:49 | 000,581,120 | ---- | C] (OldTimer Tools) -- C:\Users\cristobalarce\Desktop\OTL.exe
[2011/02/27 19:33:54 | 000,000,000 | ---D | C] -- C:\fixwareout
[2011/02/23 22:46:58 | 000,000,000 | ---D | C] -- C:\Users\cristobalarce\AppData\Local\{39A9E1FF-E146-4087-970E-8391DCFE4107}
[2011/02/23 10:46:28 | 000,000,000 | ---D | C] -- C:\Users\cristobalarce\AppData\Local\{D99F46C0-D730-464E-A2DA-C5D2DCA73667}
[2011/02/22 18:24:24 | 000,000,000 | ---D | C] -- C:\Users\cristobalarce\AppData\Local\{60EECF69-0579-4085-A700-C61420BCD804}
[2011/02/22 13:41:34 | 000,000,000 | ---D | C] -- C:\ProgramData\IObit
[2011/02/22 12:11:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced SystemCare 3
[2011/02/22 12:11:08 | 000,000,000 | ---D | C] -- C:\Users\cristobalarce\AppData\Roaming\IObit
[2011/02/22 12:11:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\IObit
[2011/02/22 08:21:22 | 000,000,000 | ---D | C] -- C:\Users\cristobalarce\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker
[2011/02/22 08:21:21 | 000,000,000 | ---D | C] -- C:\Program Files\Unlocker
[2011/02/22 08:08:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Unlocker
[2011/02/22 06:23:58 | 000,000,000 | ---D | C] -- C:\Users\cristobalarce\AppData\Local\{CE0A791E-E8C4-4C6E-A3CC-751532ACEFD2}
[2011/02/21 22:03:07 | 000,000,000 | ---D | C] -- C:\Rbackup
[2011/02/21 12:34:29 | 000,000,000 | ---D | C] -- C:\Users\cristobalarce\Documents\Simply Super Software
[2011/02/21 06:07:22 | 000,000,000 | ---D | C] -- C:\Users\cristobalarce\AppData\Local\{6619564C-5624-4B2D-B2C2-487D3C2DC4EC}
[2011/02/20 18:07:11 | 000,000,000 | ---D | C] -- C:\Users\cristobalarce\AppData\Local\{FF1745BC-2042-4AAE-9B3F-5DCF43374D05}
[2011/02/20 06:07:00 | 000,000,000 | ---D | C] -- C:\Users\cristobalarce\AppData\Local\{08E986F3-A2BD-42B2-ABEC-45453C4C8DE3}
[2011/02/19 18:24:33 | 000,000,000 | ---D | C] -- C:\Program Files\Validity Sensors
[2011/02/19 18:06:38 | 000,000,000 | ---D | C] -- C:\Users\cristobalarce\AppData\Local\{95C56A88-DA2A-4B99-9D20-D83B2F895168}
[2011/02/18 22:27:08 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\tr
[2011/02/18 22:27:08 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\sv
[2011/02/18 22:27:08 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\ru
[2011/02/18 22:27:08 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\no
[2011/02/18 22:27:08 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\da
[2011/02/18 22:27:05 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\ko
[2011/02/18 22:27:05 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\ja
[2011/02/18 22:27:05 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\it
[2011/02/18 22:27:05 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\fr
[2011/02/18 22:27:05 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\es
[2011/02/18 22:27:05 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\de
[2011/02/18 22:27:04 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\tr
[2011/02/18 22:27:04 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\sv
[2011/02/18 22:27:04 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\ru
[2011/02/18 22:27:04 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\no
[2011/02/18 22:27:04 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\da
[2011/02/18 22:27:03 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\ko
[2011/02/18 22:27:03 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\ja
[2011/02/18 22:27:03 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\it
[2011/02/18 22:27:03 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\fr
[2011/02/18 22:27:03 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\es
[2011/02/18 22:27:03 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\de
[2011/02/18 22:27:01 | 000,000,000 | ---D | C] -- C:\Windows\DPDrv
[2011/02/18 22:26:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DigitalPersona
[2011/02/18 22:16:41 | 000,000,000 | ---D | C] -- C:\Users\cristobalarce\AppData\Roaming\DigitalPersona
[2011/02/18 10:44:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Perfect Uninstaller
[2011/02/18 10:44:56 | 000,000,000 | ---D | C] -- C:\Program Files\Perfect Uninstaller
[2011/02/17 21:28:40 | 000,000,000 | ---D | C] -- C:\Users\cristobalarce\AppData\Local\VS Revo Group
[2011/02/17 21:28:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro
[2011/02/17 21:28:35 | 000,031,800 | ---- | C] (VS Revo Group) -- C:\Windows\SysNative\drivers\revoflt.sys
[2011/02/17 21:28:33 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group
[2011/02/17 15:54:54 | 000,000,000 | ---D | C] -- C:\Users\cristobalarce\Desktop\Fuentes
[2011/02/17 14:21:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011/02/17 13:44:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Juno
[2011/02/17 13:44:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Juno
[2011/02/17 13:44:16 | 000,000,000 | ---D | C] -- C:\Program Files\JunoInstaller
[2011/02/13 22:02:51 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/03/04 22:08:15 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Users\cristobalarce\Desktop\OTL.exe
[2011/03/04 21:46:00 | 000,001,036 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/03/04 21:04:11 | 000,003,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/03/04 21:04:11 | 000,003,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/03/04 19:04:28 | 000,000,416 | ---- | M] () -- C:\Windows\tasks\AWC AutoSweep.job
[2011/03/04 19:04:21 | 000,001,032 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/03/04 19:04:21 | 000,000,410 | ---- | M] () -- C:\Windows\tasks\AWC Startup.job
[2011/03/04 19:04:07 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/03/04 19:04:04 | 4260,569,088 | -HS- | M] () -- C:\hiberfil.sys
[2011/03/04 19:02:39 | 000,002,341 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2011/03/04 18:01:53 | 000,111,616 | ---- | M] () -- C:\Users\cristobalarce\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/03/04 10:12:48 | 000,000,680 | ---- | M] () -- C:\Users\cristobalarce\AppData\Local\d3d9caps.dat
[2011/03/03 12:09:53 | 000,002,086 | ---- | M] () -- C:\Users\Public\Desktop\Media Player Classic - Home Cinema x64.lnk
[2011/03/02 20:26:56 | 000,001,694 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011/03/02 16:04:24 | 000,000,990 | ---- | M] () -- C:\Users\cristobalarce\Desktop\iPod-Cloner.lnk
[2011/03/02 16:04:19 | 000,000,980 | ---- | M] () -- C:\Users\cristobalarce\Desktop\DVD-Cloner8.lnk
[2011/03/02 13:20:05 | 000,022,202 | ---- | M] () -- C:\Users\cristobalarce\Desktop\Reg020311.reg
[2011/03/02 12:59:34 | 000,001,791 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2011/03/02 12:59:27 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2011/03/02 10:56:58 | 000,000,125 | -HS- | M] () -- C:\ProgramData\.zreglib
[2011/03/02 02:12:51 | 000,002,025 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2011/03/02 01:01:25 | 000,000,901 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2011/03/01 19:47:48 | 000,396,328 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011/02/28 10:51:10 | 000,000,858 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011/02/23 09:04:21 | 000,040,648 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2011/02/23 09:04:17 | 000,190,016 | ---- | M] (AVAST Software) -- C:\Windows\SysWow64\aswBoot.exe
[2011/02/23 09:04:07 | 000,238,968 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2011/02/23 08:57:04 | 000,280,408 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2011/02/23 08:57:01 | 000,505,176 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
[2011/02/23 08:55:53 | 000,053,592 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswTdi.sys
[2011/02/23 08:55:13 | 000,031,064 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr.sys
[2011/02/23 08:55:05 | 000,064,344 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2011/02/23 08:54:58 | 000,022,360 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFsBlk.sys
[2011/02/22 12:11:21 | 000,001,068 | ---- | M] () -- C:\Users\Public\Desktop\Advanced SystemCare.lnk
[2011/02/19 19:35:56 | 000,008,798 | ---- | M] () -- C:\Windows\SysWow64\icrav03.rat
[2011/02/19 19:35:55 | 000,008,798 | ---- | M] () -- C:\Windows\SysNative\icrav03.rat
[2011/02/19 19:35:55 | 000,001,988 | ---- | M] () -- C:\Windows\SysWow64\ticrf.rat
[2011/02/19 19:35:55 | 000,001,988 | ---- | M] () -- C:\Windows\SysNative\ticrf.rat
[2011/02/19 19:35:34 | 000,072,822 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2011/02/19 19:35:18 | 000,072,822 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
[2011/02/18 11:15:40 | 000,002,529 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2011/02/18 10:45:04 | 000,000,042 | ---- | M] () -- C:\Windows\SysWow64\AK083E209605E394C.lie
[2011/02/18 10:44:57 | 000,000,737 | ---- | M] () -- C:\Users\cristobalarce\Desktop\Perfect Uninstaller.lnk
[2011/02/16 12:03:34 | 000,707,392 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011/02/16 12:03:34 | 000,598,900 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011/02/16 12:03:34 | 000,104,914 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011/02/14 00:48:25 | 000,000,732 | ---- | M] () -- C:\Users\cristobalarce\AppData\Local\d3d9caps64.dat
[2011/02/13 11:06:28 | 000,001,917 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2011/02/09 13:17:09 | 000,001,854 | ---- | M] () -- C:\Users\cristobalarce\AppData\Roaming\GhostObjGAFix.xml
[2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/03/04 18:50:30 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2011/03/04 18:50:30 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/03/04 18:50:30 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe
[2011/03/04 18:50:30 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/03/04 18:50:30 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/03/04 10:12:48 | 000,000,680 | ---- | C] () -- C:\Users\cristobalarce\AppData\Local\d3d9caps.dat
[2011/03/03 13:40:36 | 000,580,096 | ---- | C] () -- C:\Windows\SysNative\ac3filter64.acm
[2011/03/03 12:09:53 | 000,002,086 | ---- | C] () -- C:\Users\Public\Desktop\Media Player Classic - Home Cinema x64.lnk
[2011/03/02 20:26:56 | 000,001,694 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011/03/02 16:04:24 | 000,000,990 | ---- | C] () -- C:\Users\cristobalarce\Desktop\iPod-Cloner.lnk
[2011/03/02 16:04:23 | 000,000,058 | ---- | C] () -- C:\Windows\SysWow64\msadio.dll
[2011/03/02 16:04:19 | 000,000,980 | ---- | C] () -- C:\Users\cristobalarce\Desktop\DVD-Cloner8.lnk
[2011/03/02 13:56:06 | 000,002,083 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
[2011/03/02 13:20:02 | 000,022,202 | ---- | C] () -- C:\Users\cristobalarce\Desktop\Reg020311.reg
[2011/03/02 12:59:34 | 000,001,791 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2011/03/02 12:59:27 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\config.nt
[2011/03/02 01:01:25 | 000,000,901 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2011/02/28 10:51:10 | 000,000,858 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011/02/22 12:34:14 | 000,000,416 | ---- | C] () -- C:\Windows\tasks\AWC AutoSweep.job
[2011/02/22 12:11:45 | 000,000,410 | ---- | C] () -- C:\Windows\tasks\AWC Startup.job
[2011/02/22 12:11:21 | 000,001,068 | ---- | C] () -- C:\Users\Public\Desktop\Advanced SystemCare.lnk
[2011/02/22 06:20:27 | 4260,569,088 | -HS- | C] () -- C:\hiberfil.sys
[2011/02/21 19:15:43 | 000,162,304 | ---- | C] () -- C:\Windows\SysWow64\ztvunrar36.dll
[2011/02/21 19:15:43 | 000,153,088 | ---- | C] () -- C:\Windows\SysWow64\UNRAR3.dll
[2011/02/21 19:15:43 | 000,077,312 | ---- | C] () -- C:\Windows\SysWow64\ztvunace26.dll
[2011/02/21 19:15:43 | 000,075,264 | ---- | C] () -- C:\Windows\SysWow64\unacev2.dll
[2011/02/19 19:35:34 | 000,072,822 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2011/02/19 19:35:18 | 000,072,822 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2011/02/18 22:27:11 | 000,001,053 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NewShortcut1.lnk
[2011/02/18 10:45:04 | 000,000,042 | ---- | C] () -- C:\Windows\SysWow64\AK083E209605E394C.lie
[2011/02/18 10:44:57 | 000,000,737 | ---- | C] () -- C:\Users\cristobalarce\Desktop\Perfect Uninstaller.lnk
[2011/02/17 05:42:07 | 275,263,856 | ---- | C] () -- C:\Users\cristobalarce\Desktop\Yorch fest 2 ( jagger ) 2010-09-19_4h11m00.mp3
[2011/01/27 11:50:51 | 000,000,000 | ---- | C] () -- C:\ProgramData\CLDShowX.ini
[2011/01/12 22:43:30 | 000,001,854 | ---- | C] () -- C:\Users\cristobalarce\AppData\Roaming\GhostObjGAFix.xml
[2010/04/30 12:20:40 | 000,000,732 | ---- | C] () -- C:\Users\cristobalarce\AppData\Local\d3d9caps64.dat
[2010/02/19 09:43:00 | 000,000,256 | ---- | C] () -- C:\Windows\SysWow64\vcsAPIShared.dll.hpsign
[2010/02/15 00:15:50 | 000,000,173 | ---- | C] () -- C:\Users\cristobalarce\AppData\Roaming\default.rss
[2009/10/20 04:25:27 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009/10/14 08:02:56 | 000,026,939 | ---- | C] () -- C:\Users\cristobalarce\AppData\Roaming\Comma Separated Values (Windows).ADR
[2009/08/27 00:48:14 | 000,700,730 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2009/08/27 00:37:38 | 000,000,000 | ---- | C] () -- C:\ProgramData\LauncherAccess.dt
[2009/08/27 00:17:55 | 000,005,632 | ---- | C] () -- C:\Windows\SysWow64\drivers\StarOpen.sys
[2009/06/28 16:36:01 | 000,000,125 | -HS- | C] () -- C:\ProgramData\.zreglib
[2009/06/28 13:06:35 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll
[2009/06/28 13:05:56 | 000,107,612 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchema.bin
[2009/06/28 13:05:04 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/15 16:02:10 | 000,111,616 | ---- | C] () -- C:\Users\cristobalarce\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/04/11 04:29:23 | 000,002,341 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2008/10/27 11:53:19 | 000,018,904 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchemaTrivial.bin
[2008/01/20 20:50:05 | 000,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini
[2008/01/14 17:47:06 | 000,099,712 | ---- | C] () -- C:\Windows\HPBroker.dll
[2007/11/14 17:17:34 | 000,204,800 | ---- | C] () -- C:\Windows\SysWow64\CogentBioSDK.dll
[2006/11/02 09:37:05 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 06:37:14 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2006/11/02 06:24:17 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2006/11/02 06:18:17 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2006/11/02 03:47:54 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2005/08/26 15:28:34 | 000,143,360 | ---- | C] () -- C:\Windows\unzip.exe
[2005/08/26 15:28:20 | 000,024,576 | ---- | C] () -- C:\Windows\shortcut.exe
[2005/08/26 15:27:58 | 000,045,056 | ---- | C] () -- C:\Windows\devenum.exe

========== LOP Check ==========

[2009/06/28 15:58:01 | 000,000,000 | ---D | M] -- C:\Users\cristobalarce\AppData\Roaming\Babylon
[2009/12/01 01:55:05 | 000,000,000 | ---D | M] -- C:\Users\cristobalarce\AppData\Roaming\CopyTransPhoto
[2011/02/18 22:16:41 | 000,000,000 | ---D | M] -- C:\Users\cristobalarce\AppData\Roaming\DigitalPersona
[2011/03/02 16:07:25 | 000,000,000 | ---D | M] -- C:\Users\cristobalarce\AppData\Roaming\DVD-Cloner
[2011/02/25 11:26:28 | 000,000,000 | ---D | M] -- C:\Users\cristobalarce\AppData\Roaming\IObit
[2010/01/06 12:27:30 | 000,000,000 | ---D | M] -- C:\Users\cristobalarce\AppData\Roaming\Panda Security
[2009/08/30 03:06:49 | 000,000,000 | ---D | M] -- C:\Users\cristobalarce\AppData\Roaming\Samsung
[2010/02/14 10:02:26 | 000,000,000 | ---D | M] -- C:\Users\cristobalarce\AppData\Roaming\SystemRequirementsLab
[2009/09/06 18:26:11 | 000,000,000 | ---D | M] -- C:\Users\cristobalarce\AppData\Roaming\Teleca
[2009/08/10 22:13:22 | 000,000,000 | ---D | M] -- C:\Users\cristobalarce\AppData\Roaming\WildTangent
[2010/03/02 18:57:37 | 000,000,000 | ---D | M] -- C:\Users\cristobalarce\AppData\Roaming\WinBatch
[2009/12/01 01:29:40 | 000,000,000 | ---D | M] -- C:\Users\cristobalarce\AppData\Roaming\WindSolutions
[2011/03/04 19:04:28 | 000,000,416 | ---- | M] () -- C:\Windows\Tasks\AWC AutoSweep.job
[2011/03/04 19:04:21 | 000,000,410 | ---- | M] () -- C:\Windows\Tasks\AWC Startup.job
[2011/03/04 19:02:36 | 000,032,566 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/08/14 00:09:56 | 000,000,000 | ---- | M] () -- C:\Autoexec.bat
[2009/04/11 00:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr
[2009/08/27 00:48:43 | 000,000,074 | ---- | M] () -- C:\CMLoader.log
[2011/03/04 19:15:33 | 000,030,560 | ---- | M] () -- C:\ComboFix.txt
[2011/03/04 19:04:04 | 4260,569,088 | -HS- | M] () -- C:\hiberfil.sys
[2006/12/02 00:37:14 | 000,904,704 | ---- | M] (Microsoft Corporation) -- C:\msdia80.dll
[2011/03/04 19:04:01 | 279,187,455 | -HS- | M] () -- C:\pagefile.sys
[2010/03/19 22:36:17 | 000,000,927 | ---- | M] () -- C:\updatedatfix.log

< %systemroot%\Fonts\*.com >
[2006/11/02 09:06:41 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 09:06:41 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 09:06:41 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/06/28 14:24:27 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

(continue on next post)

Cristobalarce · 2011/03/04

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 15:35:48 | 000,000,065 | -H-- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011/02/23 09:04:21 | 000,040,648 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/01/20 21:21:59 | 000,000,174 | -HS- | M] () -- C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/02/19 19:53:20 | 000,000,574 | -HS- | M] () -- C:\Users\cristobalarce\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/03/04 22:08:15 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Users\cristobalarce\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2011/02/18 22:28:13 | 000,000,402 | -HS- | M] () -- C:\Users\cristobalarce\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2011/03/02 10:56:58 | 000,000,125 | -HS- | M] () -- C:\ProgramData\.zreglib
[2011/01/28 17:58:18 | 000,000,000 | ---- | M] () -- C:\ProgramData\CLDShowX.ini
[2011/03/01 11:04:41 | 000,000,194 | ---- | M] () -- C:\ProgramData\HPWALog.txt
[2009/08/27 00:37:38 | 000,000,000 | ---- | M] () -- C:\ProgramData\LauncherAccess.dt
[2010/02/12 17:09:21 | 000,000,033 | ---- | M] () -- C:\ProgramData\{051B9612-4D82-42AC-8C63-CD2DCEDC1CB3}.log
[2010/02/12 17:03:58 | 000,000,109 | ---- | M] () -- C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
[2010/02/12 17:08:38 | 000,000,033 | ---- | M] () -- C:\ProgramData\{23F3DA62-2D9E-4A69-B8D5-BE8E9E148092}.log
[2010/02/12 16:51:21 | 000,000,105 | ---- | M] () -- C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
[2010/02/12 17:07:50 | 000,000,032 | ---- | M] () -- C:\ProgramData\{4FC670EB-5F02-4B07-90DB-022B86BFEFD0}.log
[2010/02/12 17:09:02 | 000,000,033 | ---- | M] () -- C:\ProgramData\{9867824A-C86D-4A83-8F3C-E7A86BE0AFD3}.log
[2010/02/12 16:47:02 | 000,000,107 | ---- | M] () -- C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
[2010/02/12 17:02:28 | 000,000,110 | ---- | M] () -- C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log
[2010/02/12 17:10:09 | 000,000,106 | ---- | M] () -- C:\ProgramData\{d36dd326-7280-11d8-97c8-000129760cbe}.log

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 2560 bytes -> C:\ProgramData\CLDShowX.ini:Update.CL
@Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:CB0AACC9

< End of report >

broni · 2011/03/04

Run OTL
Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following
Code:
:OTL
O3 - HKU\S-1-5-21-3779111478-2882620495-629939005-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Value error.)
O28:64bit: - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
[2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
@Alternate Data Stream - 2560 bytes -> C:\ProgramData\CLDShowX.ini:Update.CL
@Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:CB0AACC9

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
Then click the [color= "#FF0000"]Run Fix[/color] button at the top

Let the program run unhindered, reboot the PC when it is done

You will get a log that shows the results of the fix. Please post it.
=============================================================

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe

Follow the onscreen instructions inside of the black box.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Download Temp File Cleaner (TFC)

Double click on TFC.exe to run the program.

Click on Start button to begin cleaning process.

TFC will close all running programs, and it may ask you to restart computer.

3. Please run a free online scan with the ESET Online Scanner

Disable your antivirus program

Tick the box next to YES, I accept the Terms of Use

Click Start

IMPORTANT! UN-check Remove found threats

Accept any security warnings from your browser.

Check Scan archives

Click Start

ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

When the scan completes, push List of found threats

Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

NOTE. If Eset won't find any threats, it won't produce any log.

Cristobalarce · 2011/03/05

OTL Fix log:

All processes killed
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-3779111478-2882620495-629939005-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\Windows\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
File delete failed. C:\Windows\SysNative\SETCBD4.tmp scheduled to be deleted on reboot.
File delete failed. C:\Windows\SysNative\SETCDF9.tmp scheduled to be deleted on reboot.
ADS C:\ProgramData\CLDShowX.ini:Update.CL deleted successfully.
ADS C:\ProgramData\Temp:CB0AACC9 deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: AppData
->Temp folder emptied: 0 bytes

User: cristobalarce
->Temp folder emptied: 7721412 bytes
->Temporary Internet Files folder emptied: 3672105 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 28674807 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 456 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Mcx1
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 49776 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 38.00 mb

[EMPTYFLASH]

User: All Users

User: AppData

User: cristobalarce
->Flash cache emptied: 0 bytes

User: Default

User: Default User

User: Mcx1

User: Public

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.22.2 log created on 03052011_003141

Files\Folders moved on Reboot...
File move failed. C:\Windows\SysNative\SETCBD4.tmp scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\SETCDF9.tmp scheduled to be moved on reboot.
C:\Users\cristobalarce\AppData\Local\Temp\ehmsas.txt moved successfully.
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

I'm running the other 3 scans...

Cristobalarce · 2011/03/05

checkup.txt:

Results of screen317's Security Check version 0.99.7
Windows Vista (UAC is enabled)
Out of date service pack!!
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
avast! Free Antivirus
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Java(TM) 6 Update 24
Out of date Java installed!
````````````````````````````````
Process Check:
objlist.exe by Laurent
AVAST Software Avast AvastSvc.exe
AVAST Software Avast AvastUI.exe
``````````End of Log````````````

Cristobalarce · 2011/03/05

Good morning Broni, I fell asleep waiting for the scan to finish. Here it is:

C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe a variant of Win32/HotSpotShield application
C:\Users\cristobalarce\Downloads\Uts\flash_desinfector.rar probably a variant of Win32/Agent.BWFKHA trojan
C:\Users\cristobalarce\Downloads\Uts\HSS-1.37-install-anchorfree-76-conduit.exe a variant of Win32/HotSpotShield application
C:\Users\cristobalarce\Downloads\Uts\unlocker1.8.7.exe a variant of Win32/Adware.ADON application
H:\Recovery\Documents\Uts\HSS-1.14-install-anchorfree-76-conduit.exe a variant of Win32/HotSpotShield application
H:\Recovery\Documents\Uts\unlocker1.8.7.exe Win32/Adware.ADON application

As for my computer, so far, so good. It's a lot faster on start up. Apps run faster. And web pages browse faster. No redirects since yesterday. A very good sign from my point of view...

broni · 2011/03/05

Good news indeed

Run OTL
Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following
Code:
:OTL

:Services

:Reg

:Files
C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe 
C:\Users\cristobalarce\Downloads\Uts\HSS-1.37-install-anchorfree-76-conduit.exe 
H:\Recovery\Documents\Uts\HSS-1.14-install-anchorfree-76-conduit.exe

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
Then click the [color= "#FF0000"]Run Fix[/color] button at the top

Let the program run unhindered, reboot the PC when it is done

You will get a log that shows the results of the fix. Please post it.
================================================================

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following:
Code:
:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]
Then click the Run Fix button at the top

Let the program run unhindered, reboot the PC when it is done

Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

Double-click OTL.exe to start the program.

Close all other programs apart from OTL as this step will require a reboot

On the OTL main screen, press the CLEANUP button

Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current (including Service Pack 2 installation!)

4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC) weekly.

8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. Run defrag at your convenience.

11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

12. Please, let me know, how your computer is doing.

Cristobalarce · 2011/03/05

Last OTL txt:

All processes killed
========== OTL ==========
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe moved successfully.
C:\Users\cristobalarce\Downloads\Uts\HSS-1.37-install-anchorfree-76-conduit.exe moved successfully.
File\Folder H:\Recovery\Documents\Uts\HSS-1.14-install-anchorfree-76-conduit.exe not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: AppData
->Temp folder emptied: 0 bytes

User: cristobalarce
->Temp folder emptied: 15410634 bytes
->Temporary Internet Files folder emptied: 7488417 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 456 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Mcx1
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 49776 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1344 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 22.00 mb

[EMPTYFLASH]

User: All Users

User: AppData

User: cristobalarce
->Flash cache emptied: 0 bytes

User: Default

User: Default User

User: Mcx1

User: Public

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.22.2 log created on 03052011_102755

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

OTL created a folder in C:\_OTL\MovedFiles with the .txt file and 2 more folders: C_Program Files (x86), and C_Users. They contain openvpnas and HSS-1.37-install-anchorfree-76-conduit. What should I do with these?

Log in or Sign up

Solved HP laptop infected with redirects

Cristobalarce Inactive Thread Starter

PeteC SuperGeek Staff

Cristobalarce Inactive Thread Starter

PeteC SuperGeek Staff

broni Moderator Malware Analyst

Cristobalarce Inactive Thread Starter

Cristobalarce Inactive Thread Starter

broni Moderator Malware Analyst

Cristobalarce Inactive Thread Starter

broni Moderator Malware Analyst

Cristobalarce Inactive Thread Starter

broni Moderator Malware Analyst

Cristobalarce Inactive Thread Starter

Cristobalarce Inactive Thread Starter

broni Moderator Malware Analyst

Cristobalarce Inactive Thread Starter

Cristobalarce Inactive Thread Starter

Cristobalarce Inactive Thread Starter

broni Moderator Malware Analyst

Cristobalarce Inactive Thread Starter

Share This Page

Log in or Sign up

Solved HP laptop infected with redirects

Cristobalarce Inactive Thread Starter

PeteC SuperGeek Staff

Cristobalarce Inactive Thread Starter

PeteC SuperGeek Staff

broni Moderator Malware Analyst

Cristobalarce Inactive Thread Starter

Cristobalarce Inactive Thread Starter

broni Moderator Malware Analyst

Cristobalarce Inactive Thread Starter

broni Moderator Malware Analyst

Cristobalarce Inactive Thread Starter

broni Moderator Malware Analyst

Cristobalarce Inactive Thread Starter

Cristobalarce Inactive Thread Starter

broni Moderator Malware Analyst

Cristobalarce Inactive Thread Starter

Cristobalarce Inactive Thread Starter

Cristobalarce Inactive Thread Starter

broni Moderator Malware Analyst

Cristobalarce Inactive Thread Starter

Share This Page

Useful Searches