Solved Virus - Internet explorer

csbowers · 2011/05/28

OTL.txt:

OTL logfile created on: 5/28/2011 11:30:27 PM - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = \\psf\Home\Desktop
Enterprise Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1023.55 Mb Total Physical Memory | 444.57 Mb Available Physical Memory | 43.43% Memory free
2.00 Gb Paging File | 1.25 Gb Available in Paging File | 62.33% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 64.00 Gb Total Space | 28.05 Gb Free Space | 43.82% Space Free | Partition Type: NTFS

Computer Name: MARIABOWERS1F49 | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/05/28 23:26:31 | 000,580,096 | ---- | M] (OldTimer Tools) -- \\psf\Home\Desktop\OTL.exe
PRC - [2011/05/10 07:10:58 | 003,459,712 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2011/05/10 07:10:57 | 000,042,184 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2011/04/05 07:26:34 | 000,045,056 | ---- | M] (Intuit) -- c:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
PRC - [2011/03/03 20:52:00 | 003,410,576 | R--- | M] (Carbonite, Inc. (www.carbonite.com)) -- C:\Program Files\Carbonite\Carbonite Backup\CarboniteService.exe
PRC - [2011/03/03 20:52:00 | 000,948,880 | R--- | M] (Carbonite, Inc.) -- C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
PRC - [2011/02/26 00:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2011/02/17 06:17:56 | 000,028,488 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) -- C:\Program Files\Parallels\Parallels Tools\Services\coherence.exe
PRC - [2011/02/17 06:16:52 | 000,186,696 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) -- C:\Program Files\Parallels\Parallels Tools\Services\prl_tools_service.exe
PRC - [2011/02/17 06:16:50 | 000,202,056 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) -- C:\Program Files\Parallels\Parallels Tools\Services\prl_tools.exe
PRC - [2010/12/08 14:11:38 | 000,136,584 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\ramaint.exe
PRC - [2010/12/08 14:11:32 | 000,374,152 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
PRC - [2010/11/08 13:04:18 | 000,390,528 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LogMeIn.exe
PRC - [2009/07/13 20:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009/06/09 09:56:00 | 000,099,632 | ---- | M] () -- C:\Program Files\Stardock\MyColors\WBVista.exe
PRC - [2009/06/09 09:55:58 | 000,230,704 | ---- | M] (Stardock Corporation) -- C:\Program Files\Stardock\MyColors\VistaSrv.exe
PRC - [2008/08/11 13:41:00 | 000,063,048 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
PRC - [2006/12/07 17:52:14 | 000,140,184 | ---- | M] (Dell Inc.) -- C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\dlsdbnt.exe
PRC - [2006/12/07 17:52:10 | 000,095,128 | ---- | M] (Dell Inc.) -- C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\dlpwdnt.exe

========== Modules (SafeList) ==========

MOD - [2011/05/28 23:26:31 | 000,580,096 | ---- | M] (OldTimer Tools) -- \\psf\Home\Desktop\OTL.exe
MOD - [2011/05/10 07:10:55 | 000,199,792 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\snxhk.dll
MOD - [2011/02/17 06:08:08 | 000,101,376 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) -- C:\Windows\System32\prl_np.dll
MOD - [2010/12/21 00:34:12 | 000,080,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\davclnt.dll
MOD - [2010/12/08 14:12:02 | 000,083,360 | ---- | M] (LogMeIn, Inc.) -- C:\Windows\System32\LMIRfsClientNP.dll
MOD - [2010/08/21 00:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll
MOD - [2009/07/13 20:16:19 | 000,156,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\winsta.dll
MOD - [2009/07/13 20:16:11 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ntlanman.dll
MOD - [2009/07/13 20:15:13 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drprov.dll
MOD - [2009/07/13 20:15:08 | 000,019,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\davhlpr.dll

========== Win32 Services (SafeList) ==========

SRV - [2011/05/10 07:10:57 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2011/04/05 07:26:34 | 000,045,056 | ---- | M] (Intuit) [Auto | Running] -- c:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe -- (QBCFMonitorService)
SRV - [2011/03/03 20:52:00 | 003,410,576 | R--- | M] (Carbonite, Inc. (www.carbonite.com)) [Auto | Running] -- C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe -- (CarboniteService)
SRV - [2011/02/17 06:17:56 | 000,028,488 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) [Auto | Running] -- C:\Program Files\Parallels\Parallels Tools\Services\coherence.exe -- (Parallels Coherence Service)
SRV - [2011/02/17 06:16:52 | 000,186,696 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) [Auto | Running] -- C:\Program Files\Parallels\Parallels Tools\Services\prl_tools_service.exe -- (Parallels Tools Service)
SRV - [2010/12/08 14:11:38 | 000,136,584 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Program Files\LogMeIn\x86\RaMaint.exe -- (LMIMaint)
SRV - [2010/12/08 14:11:32 | 000,374,152 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe -- (LMIGuardianSvc)
SRV - [2010/11/08 13:04:18 | 000,390,528 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Program Files\LogMeIn\x86\LogMeIn.exe -- (LogMeIn)
SRV - [2010/03/11 22:19:00 | 000,072,704 | ---- | M] (Intuit) [On_Demand | Stopped] -- C:\Program Files\Common Files\Intuit\Fuse\Service\Intuit Fuse Service.exe -- (Intuit Fuse Service)
SRV - [2010/02/25 01:10:22 | 001,343,400 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2009/07/23 22:10:38 | 000,061,440 | ---- | M] (Intuit Inc.) [On_Demand | Stopped] -- c:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe -- (QBFCService)
SRV - [2009/07/13 20:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009/07/13 20:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 20:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/13 20:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009/06/09 09:55:58 | 000,230,704 | ---- | M] (Stardock Corporation) [Auto | Running] -- C:\Program Files\Stardock\MyColors\VistaSrv.exe -- (WindowBlinds)
SRV - [2006/12/07 17:52:14 | 000,140,184 | ---- | M] (Dell Inc.) [Auto | Running] -- C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\dlsdbnt.exe -- (DLSDB)
SRV - [2006/12/07 17:52:10 | 000,095,128 | ---- | M] (Dell Inc.) [Auto | Running] -- C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\dlpwdnt.exe -- (DLPWD)

========== Driver Services (SafeList) ==========

DRV - [2011/05/10 07:03:54 | 000,441,176 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2011/05/10 07:03:44 | 000,307,928 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2011/05/10 07:02:37 | 000,049,240 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2011/05/10 06:59:56 | 000,025,432 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2011/05/10 06:59:44 | 000,053,592 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2011/05/10 06:59:35 | 000,019,544 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2011/03/29 21:09:43 | 000,023,880 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\prl_pv32.sys -- (prl_pv32)
DRV - [2011/02/17 06:18:04 | 000,148,808 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) [File_System | System | Running] -- C:\Windows\System32\drivers\prl_fs.sys -- (prl_fs)
DRV - [2011/02/17 06:16:50 | 000,015,816 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\prl_time.sys -- (prl_time)
DRV - [2011/02/17 06:16:48 | 000,024,008 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\prl_tg.sys -- (prl_tg)
DRV - [2011/02/17 06:16:46 | 000,029,640 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\prl_strg.sys -- (prl_strg)
DRV - [2011/02/17 06:16:44 | 000,045,896 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\prl_sound.sys -- (prl_sound)
DRV - [2011/02/17 06:16:36 | 000,016,200 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\prl_mouf.sys -- (prl_mouf)
DRV - [2011/02/17 06:16:34 | 000,015,176 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\prl_memdev.sys -- (prl_memdev)
DRV - [2011/02/17 06:16:32 | 000,117,064 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\prl_kmdd.sys -- (prl_dd) Parallels Display Adapter (WDDM)
DRV - [2011/02/17 06:16:28 | 000,018,376 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\prl_eth5.sys -- (prl_eth5)
DRV - [2011/02/17 06:16:24 | 000,038,216 | ---- | M] (Parallels Holdings, Ltd. and its affiliates.) [Kernel | System | Running] -- C:\Windows\System32\drivers\prl_boot.sys -- (prl_boot)
DRV - [2010/12/08 14:12:02 | 000,083,360 | ---- | M] (LogMeIn, Inc.) [File_System | Disabled | Stopped] -- C:\Windows\System32\LMIRfsClientNP.dll -- (LMIRfsClientNP)
DRV - [2010/04/14 02:01:48 | 000,045,736 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btusbflt.sys -- (btusbflt)
DRV - [2009/07/13 20:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vmbus.sys -- (vmbus)
DRV - [2009/07/13 20:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vmstorfl.sys -- (storflt)
DRV - [2009/07/13 20:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\storvsc.sys -- (storvsc)
DRV - [2009/07/13 18:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009/07/13 18:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vms3cap.sys -- (s3cap)
DRV - [2009/07/13 18:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\VMBusHID.sys -- (VMBusHID)
DRV - [2008/08/11 13:41:00 | 000,047,640 | ---- | M] (LogMeIn, Inc.) [File_System | Auto | Running] -- C:\Windows\System32\drivers\LMIRfsDriver.sys -- (LMIRfsDriver)
DRV - [2008/08/11 13:41:00 | 000,012,856 | ---- | M] (LogMeIn, Inc.) [Kernel | Auto | Running] -- C:\Program Files\LogMeIn\x86\rainfo.sys -- (LMIInfo)
DRV - [2008/05/06 17:06:00 | 000,011,520 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\wdcsam.sys -- (WDC_SAM)
DRV - [2007/09/06 21:53:00 | 000,014,848 | ---- | M] (Silicon Laboratories) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\DSI_SiUSBXp_3_1.sys -- (DSI_SiUSBXp_3_1)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1754874174-4154865007-600923206-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKU\S-1-5-21-1754874174-4154865007-600923206-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-1754874174-4154865007-600923206-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = D5 83 58 24 CA A3 CA 01 [binary data]
IE - HKU\S-1-5-21-1754874174-4154865007-600923206-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: ([2011/05/26 22:33:49 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - File not found
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSimpleNetIDList = 1
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSimpleNetIDList = 1
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-1754874174-4154865007-600923206-500\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-21-1754874174-4154865007-600923206-500\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-1754874174-4154865007-600923206-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1754874174-4154865007-600923206-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSimpleNetIDList = 1
O7 - HKU\S-1-5-21-1754874174-4154865007-600923206-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKLM\..Trusted Domains: .psf ([]* in Local intranet)
O15 - HKLM\..Trusted Domains: psf ([]* in Local intranet)
O15 - HKU\S-1-5-21-1754874174-4154865007-600923206-500\..Trusted Domains: localhost ([]* in Local intranet)
O16 - DPF: {556EEC63-31E2-47C3-BF29-DFF799D2FE04} https://secure.logmein.com/activex/RACtrl.cab (Remote Access ActiveX Client)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://access.ololrmc.com/dana-cached/sc/JuniperSetupClient.cab (JuniperSetupClient Control)
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logmein.com/activex/ractrl.cab?lmi=100 (Performance Viewer Activex Control)
O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.211.55.1
O18 - Protocol\Handler\intu-help-qb3 {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - C:\Program Files\Intuit\QuickBooks 2010\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 16:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKU\S-1-5-21-1754874174-4154865007-600923206-500\...exe [@ = exefile] -- Reg Error: Key error. File not found

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.tscc - C:\Windows\System32\tsccvid.dll (TechSmith Corporation)

========== Files/Folders - Created Within 30 Days ==========

[2011/05/28 23:26:31 | 000,580,096 | ---- | C] (OldTimer Tools) -- \\psf\Home\Desktop\OTL.exe
[2011/05/27 22:05:39 | 000,589,632 | ---- | C] (AVAST Software) -- \\psf\Home\Desktop\aswMBR.exe
[2011/05/26 22:37:41 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/05/26 22:23:35 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/05/26 22:23:35 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/05/26 22:23:35 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011/05/26 22:23:09 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011/05/26 22:23:03 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/05/26 22:19:14 | 004,295,606 | R--- | C] (Swearware) -- \\psf\Home\Desktop\ComboFix.exe
[2011/05/26 22:13:58 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2011/05/26 00:23:49 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2011/05/26 00:21:14 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Google
[2011/05/25 23:49:09 | 000,000,000 | ---D | C] -- \PrevxCSI
[2011/05/25 23:49:07 | 000,000,000 | ---D | C] -- C:\ProgramData\PrevxCSI
[2011/05/25 22:12:20 | 000,019,544 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys
[2011/05/25 22:12:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2011/05/25 22:12:19 | 000,307,928 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2011/05/25 22:12:18 | 000,025,432 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys
[2011/05/25 22:12:17 | 000,441,176 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2011/05/25 22:12:17 | 000,049,240 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys
[2011/05/25 22:12:15 | 000,053,592 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
[2011/05/25 22:11:47 | 000,199,304 | ---- | C] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
[2011/05/25 22:11:47 | 000,040,112 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2011/05/25 22:11:40 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2011/05/25 22:11:40 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2011/05/25 21:55:51 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2011/05/25 21:37:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos
[2011/05/25 21:37:12 | 000,000,000 | ---D | C] -- C:\Program Files\Sophos
[2011/05/25 21:13:18 | 000,000,000 | ---D | C] -- \\psf\Home\Desktop\tdsskiller
[2011/05/25 15:50:32 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\FixCleaner
[2011/05/25 15:49:48 | 000,000,000 | ---D | C] -- C:\Program Files\FixCleaner
[2011/05/25 15:40:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CleanUp!
[2011/05/25 14:22:51 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Malwarebytes
[2011/05/25 14:22:23 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/05/25 14:22:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011/05/25 14:22:19 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/05/25 06:25:31 | 000,000,000 | ---D | C] -- C:\Program Files\GridinSoft Trojan Killer
[2011/05/25 05:41:26 | 000,000,000 | ---D | C] -- C:\ProgramData\STOPzilla!
[2011/05/25 05:38:16 | 000,509,440 | ---- | C] (iS3, Inc.) -- C:\STOPzilla_Setup.exe
[2011/05/04 21:00:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Carbonite
[2011/05/03 07:33:25 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\QuickBooks

========== Files - Modified Within 30 Days ==========

[2011/05/28 23:26:46 | 000,021,508 | -H-- | M] () -- \\psf\Home\Desktop\.DS_Store
[2011/05/28 23:26:31 | 000,580,096 | ---- | M] (OldTimer Tools) -- \\psf\Home\Desktop\OTL.exe
[2011/05/28 23:26:00 | 000,000,940 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1754874174-4154865007-600923206-500UA.job
[2011/05/28 11:22:52 | 000,038,802 | ---- | M] () -- \\psf\Home\Desktop\UnhookerReport1
[2011/05/28 00:26:00 | 000,000,888 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1754874174-4154865007-600923206-500Core.job
[2011/05/27 22:34:16 | 000,015,152 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/05/27 22:34:16 | 000,015,152 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/05/27 22:31:15 | 000,635,612 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/05/27 22:31:15 | 000,111,186 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/05/27 22:26:29 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/05/27 22:26:27 | 804,954,112 | -HS- | M] () -- C:\hiberfil.sys
[2011/05/27 22:08:04 | 001,301,452 | ---- | M] () -- \\psf\Home\Desktop\tdsskiller.zip
[2011/05/27 22:07:23 | 000,000,512 | ---- | M] () -- \\psf\Home\Desktop\MBR.dat
[2011/05/27 22:05:39 | 000,589,632 | ---- | M] (AVAST Software) -- \\psf\Home\Desktop\aswMBR.exe
[2011/05/26 23:39:38 | 000,002,292 | ---- | M] () -- C:\Windows\Prowin04.ini
[2011/05/26 23:28:07 | 000,013,954 | -H-- | M] () -- \\psf\Home\Documents\maxdesk.ini
[2011/05/26 23:26:12 | 021,698,042 | -H-- | M] () -- \\psf\Home\Documents\PPThumbs.ptn
[2011/05/26 23:25:27 | 003,012,006 | ---- | M] () -- \\psf\Home\Documents\Book3 (27).pdf
[2011/05/26 23:24:06 | 000,000,000 | ---- | M] () -- \\psf\Home\Documents\Nuance Image Printer Writer Port
[2011/05/26 22:33:49 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2011/05/26 22:19:38 | 004,295,606 | R--- | M] (Swearware) -- \\psf\Home\Desktop\ComboFix.exe
[2011/05/26 22:18:36 | 000,040,736 | ---- | M] () -- \\psf\Home\Desktop\UnhookerReport
[2011/05/26 22:14:55 | 000,133,632 | ---- | M] () -- \\psf\Home\Desktop\RKUnhookerLE.EXE
[2011/05/26 22:14:37 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif
[2011/05/26 22:14:05 | 000,000,408 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2011/05/26 09:43:09 | 000,080,384 | ---- | M] () -- \\psf\Home\Desktop\MBRCheck.exe
[2011/05/26 09:34:59 | 000,302,080 | ---- | M] () -- \\psf\Home\Desktop\u55c22ow.exe
[2011/05/26 06:38:40 | 000,001,019 | ---- | M] () -- C:\Windows\CFSREG.INI
[2011/05/26 06:37:57 | 000,293,729 | ---- | M] () -- \\psf\Home\Documents\Document.pdf
[2011/05/26 06:37:53 | 000,813,068 | ---- | M] () -- \\psf\Home\Documents\Document (54).pdf
[2011/05/26 00:23:53 | 000,002,251 | ---- | M] () -- \\psf\Home\Desktop\Google Chrome.lnk
[2011/05/25 23:49:07 | 000,000,053 | ---- | M] () -- C:\Windows\wininit.ini
[2011/05/25 22:12:21 | 000,001,994 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2011/05/25 22:12:15 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2011/05/25 22:08:18 | 056,923,744 | ---- | M] () -- \\psf\Home\Desktop\setup_av_free.exe
[2011/05/25 21:36:40 | 001,376,832 | ---- | M] () -- \\psf\Home\Desktop\sar_15_sfx.exe
[2011/05/25 19:03:34 | 000,000,168 | ---- | M] () -- C:\ProgramData\~32366328r
[2011/05/25 19:03:34 | 000,000,144 | ---- | M] () -- C:\ProgramData\~32366328
[2011/05/25 17:39:10 | 000,000,336 | ---- | M] () -- C:\ProgramData\32366328
[2011/05/25 08:06:40 | 000,000,592 | ---- | M] () -- C:\Windows\System32\drivers\kgpcpy.cfg
[2011/05/25 05:37:47 | 000,509,440 | ---- | M] (iS3, Inc.) -- C:\STOPzilla_Setup.exe
[2011/05/24 00:37:13 | 005,478,865 | ---- | M] () -- \\psf\Home\Documents\Intuit (131).pdf
[2011/05/23 16:22:01 | 002,076,936 | ---- | M] () -- \\psf\Home\Documents\Book11 (6).pdf
[2011/05/23 15:08:02 | 000,619,389 | ---- | M] () -- \\psf\Home\Documents\Intuit (130).pdf
[2011/05/23 15:07:57 | 000,424,698 | ---- | M] () -- \\psf\Home\Documents\Intuit (129).pdf
[2011/05/23 14:55:01 | 001,888,567 | ---- | M] () -- \\psf\Home\Documents\Book9 (4).pdf
[2011/05/23 14:44:27 | 001,493,511 | ---- | M] () -- \\psf\Home\Documents\Book5 (14).pdf
[2011/05/23 14:42:54 | 001,394,732 | ---- | M] () -- \\psf\Home\Documents\Fermin Blank Payroll Sheet (4).pdf
[2011/05/23 14:42:41 | 001,394,732 | ---- | M] () -- \\psf\Home\Documents\Fermin Blank Payroll Sheet (3).pdf
[2011/05/23 14:23:58 | 003,201,207 | ---- | M] () -- \\psf\Home\Documents\Book7 (8).pdf
[2011/05/23 14:22:03 | 001,583,846 | ---- | M] () -- \\psf\Home\Documents\QB_Taxform_Link1.pdf
[2011/05/23 13:36:12 | 005,392,070 | ---- | M] () -- \\psf\Home\Documents\Intuit (128).pdf
[2011/05/23 10:16:52 | 000,344,562 | ---- | M] () -- \\psf\Home\Documents\Document (53).pdf
[2011/05/19 06:57:41 | 005,277,466 | ---- | M] () -- \\psf\Home\Documents\Book12 (7).pdf
[2011/05/17 06:41:33 | 001,874,797 | ---- | M] () -- \\psf\Home\Documents\Intuit (127).pdf
[2011/05/17 06:41:18 | 000,293,778 | ---- | M] () -- \\psf\Home\Documents\Book6 (6).pdf
[2011/05/17 06:40:16 | 000,607,514 | ---- | M] () -- \\psf\Home\Documents\Book4 (5).pdf
[2011/05/17 06:39:11 | 000,974,602 | ---- | M] () -- \\psf\Home\Documents\Book2 (12).pdf
[2011/05/16 15:20:40 | 004,858,888 | ---- | M] () -- \\psf\Home\Documents\Book12 (6).pdf
[2011/05/16 14:43:56 | 000,995,603 | ---- | M] () -- \\psf\Home\Documents\Intuit (126).pdf
[2011/05/16 14:06:30 | 000,533,358 | ---- | M] () -- \\psf\Home\Documents\7004.pdf
[2011/05/16 05:31:16 | 006,596,016 | ---- | M] () -- \\psf\Home\Documents\Intuit (125).pdf
[2011/05/12 22:39:01 | 004,349,413 | ---- | M] () -- \\psf\Home\Documents\Book2 (11).pdf
[2011/05/10 07:10:59 | 000,040,112 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2011/05/10 07:10:55 | 000,199,304 | ---- | M] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
[2011/05/10 07:03:54 | 000,441,176 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2011/05/10 07:03:44 | 000,307,928 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2011/05/10 07:02:37 | 000,049,240 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys
[2011/05/10 06:59:56 | 000,025,432 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys
[2011/05/10 06:59:44 | 000,053,592 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
[2011/05/10 06:59:35 | 000,019,544 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys
[2011/05/09 15:40:41 | 001,674,619 | ---- | M] () -- \\psf\Home\Documents\Intuit (124).pdf
[2011/05/09 15:28:38 | 000,412,856 | ---- | M] () -- \\psf\Home\Documents\Intuit (120) (2).pdf
[2011/05/09 15:28:35 | 006,117,533 | ---- | M] () -- \\psf\Home\Documents\Intuit (120).pdf
[2011/05/09 15:17:22 | 000,425,498 | ---- | M] () -- \\psf\Home\Documents\Intuit (123).pdf
[2011/05/09 15:11:14 | 001,783,585 | ---- | M] () -- \\psf\Home\Documents\Intuit (122).pdf
[2011/05/09 14:56:18 | 005,105,672 | ---- | M] () -- \\psf\Home\Documents\Intuit (121).pdf
[2011/05/09 13:58:36 | 004,649,622 | ---- | M] () -- \\psf\Home\Documents\Book3 (26).pdf
[2011/05/09 12:15:44 | 003,791,798 | ---- | M] () -- \\psf\Home\Documents\Book6 (5).pdf
[2011/05/09 11:58:02 | 006,587,269 | ---- | M] () -- \\psf\Home\Documents\Intuit (119).pdf
[2011/05/09 09:56:25 | 000,214,440 | ---- | M] () -- \\psf\Home\Documents\MSFaxConsoleTempPreview-#00000b1430955905.pdf
[2011/05/06 16:26:06 | 000,702,629 | ---- | M] () -- \\psf\Home\Documents\Document (52).pdf
[2011/05/03 17:58:33 | 002,802,948 | ---- | M] () -- \\psf\Home\Documents\Book10 (2).pdf
[2011/05/03 16:43:22 | 000,002,823 | ---- | M] () -- \\psf\Home\Desktop\QuickBooks Company File Diagnostic Tool.lnk
[2011/05/03 00:00:06 | 004,529,197 | ---- | M] () -- \\psf\Home\Documents\Book36.pdf
[2011/05/02 22:42:09 | 000,821,044 | ---- | M] () -- \\psf\Home\Documents\CCLA Perkins - CPU account analysis - March 2010 (7).pdf
[2011/05/02 22:22:27 | 002,423,109 | ---- | M] () -- \\psf\Home\Documents\Book22.pdf
[2011/05/02 00:29:02 | 002,066,685 | ---- | M] () -- \\psf\Home\Documents\Book37.pdf
[2011/05/01 22:27:26 | 003,085,445 | ---- | M] () -- \\psf\Home\Documents\Intuit (118).pdf
[2011/05/01 20:58:05 | 005,744,204 | ---- | M] () -- \\psf\Home\Documents\Book25.pdf
[2011/05/01 17:54:59 | 004,858,860 | ---- | M] () -- \\psf\Home\Documents\Book13 (7).pdf
[2011/05/01 16:31:17 | 005,852,313 | ---- | M] () -- \\psf\Home\Documents\Intuit (117).pdf
[2011/05/01 10:21:12 | 000,000,090 | ---- | M] () -- C:\Windows\QBChanUtil_Trigger.ini
[2011/04/30 22:28:27 | 000,001,407 | ---- | M] () -- C:\Users\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/04/30 22:27:22 | 000,340,832 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011/04/30 22:15:32 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2011/04/29 03:18:46 | 002,539,199 | ---- | M] () -- \\psf\Home\Documents\Document (51).pdf
[2011/04/29 02:57:12 | 003,091,899 | ---- | M] () -- \\psf\Home\Documents\Book5 (15).pdf
[2011/04/29 02:18:45 | 000,614,275 | ---- | M] () -- \\psf\Home\Documents\Payroll Final (2).pdf

========== Files Created - No Company Name ==========

[2011/05/28 11:22:52 | 000,038,802 | ---- | C] () -- \\psf\Home\Desktop\UnhookerReport1
[2011/05/27 22:07:52 | 001,301,452 | ---- | C] () -- \\psf\Home\Desktop\tdsskiller.zip
[2011/05/27 22:07:23 | 000,000,512 | ---- | C] () -- \\psf\Home\Desktop\MBR.dat
[2011/05/26 22:23:35 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2011/05/26 22:23:35 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/05/26 22:23:35 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe
[2011/05/26 22:23:35 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/05/26 22:23:35 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/05/26 22:18:36 | 000,040,736 | ---- | C] () -- \\psf\Home\Desktop\UnhookerReport
[2011/05/26 22:14:55 | 000,133,632 | ---- | C] () -- \\psf\Home\Desktop\RKUnhookerLE.EXE
[2011/05/26 22:05:40 | 003,012,006 | ---- | C] () -- \\psf\Home\Documents\Book3 (27).pdf
[2011/05/26 09:43:09 | 000,080,384 | ---- | C] () -- \\psf\Home\Desktop\MBRCheck.exe
[2011/05/26 09:34:59 | 000,302,080 | ---- | C] () -- \\psf\Home\Desktop\u55c22ow.exe
[2011/05/26 06:37:53 | 000,813,068 | ---- | C] () -- \\psf\Home\Documents\Document (54).pdf
[2011/05/26 00:23:53 | 000,002,251 | ---- | C] () -- \\psf\Home\Desktop\Google Chrome.lnk
[2011/05/26 00:21:18 | 000,000,940 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1754874174-4154865007-600923206-500UA.job
[2011/05/26 00:21:17 | 000,000,888 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1754874174-4154865007-600923206-500Core.job
[2011/05/25 23:49:07 | 000,000,053 | ---- | C] () -- C:\Windows\wininit.ini
[2011/05/25 22:12:21 | 000,001,994 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2011/05/25 22:02:53 | 056,923,744 | ---- | C] () -- \\psf\Home\Desktop\setup_av_free.exe
[2011/05/25 21:36:40 | 001,376,832 | ---- | C] () -- \\psf\Home\Desktop\sar_15_sfx.exe
[2011/05/25 17:39:19 | 000,000,168 | ---- | C] () -- C:\ProgramData\~32366328r
[2011/05/25 17:39:19 | 000,000,144 | ---- | C] () -- C:\ProgramData\~32366328
[2011/05/25 17:39:10 | 000,000,336 | ---- | C] () -- C:\ProgramData\32366328
[2011/05/25 08:06:40 | 000,000,592 | ---- | C] () -- C:\Windows\System32\drivers\kgpcpy.cfg
[2011/05/24 00:37:13 | 005,478,865 | ---- | C] () -- \\psf\Home\Documents\Intuit (131).pdf
[2011/05/23 16:22:01 | 002,076,936 | ---- | C] () -- \\psf\Home\Documents\Book11 (6).pdf
[2011/05/23 15:07:56 | 000,424,698 | ---- | C] () -- \\psf\Home\Documents\Intuit (129).pdf
[2011/05/23 14:51:36 | 001,888,567 | ---- | C] () -- \\psf\Home\Documents\Book9 (4).pdf
[2011/05/23 14:50:24 | 000,619,389 | ---- | C] () -- \\psf\Home\Documents\Intuit (130).pdf
[2011/05/23 14:42:54 | 001,394,732 | ---- | C] () -- \\psf\Home\Documents\Fermin Blank Payroll Sheet (4).pdf
[2011/05/23 14:42:41 | 001,394,732 | ---- | C] () -- \\psf\Home\Documents\Fermin Blank Payroll Sheet (3).pdf
[2011/05/23 14:23:58 | 003,201,207 | ---- | C] () -- \\psf\Home\Documents\Book7 (8).pdf
[2011/05/23 14:22:03 | 001,583,846 | ---- | C] () -- \\psf\Home\Documents\QB_Taxform_Link1.pdf
[2011/05/23 13:36:12 | 005,392,070 | ---- | C] () -- \\psf\Home\Documents\Intuit (128).pdf
[2011/05/23 12:52:02 | 001,493,511 | ---- | C] () -- \\psf\Home\Documents\Book5 (14).pdf
[2011/05/23 10:16:51 | 000,344,562 | ---- | C] () -- \\psf\Home\Documents\Document (53).pdf
[2011/05/19 06:56:58 | 005,277,466 | ---- | C] () -- \\psf\Home\Documents\Book12 (7).pdf
[2011/05/17 06:41:33 | 001,874,797 | ---- | C] () -- \\psf\Home\Documents\Intuit (127).pdf
[2011/05/17 06:41:17 | 000,293,778 | ---- | C] () -- \\psf\Home\Documents\Book6 (6).pdf
[2011/05/17 06:40:15 | 000,607,514 | ---- | C] () -- \\psf\Home\Documents\Book4 (5).pdf
[2011/05/17 06:39:10 | 000,974,602 | ---- | C] () -- \\psf\Home\Documents\Book2 (12).pdf
[2011/05/16 15:20:12 | 004,858,888 | ---- | C] () -- \\psf\Home\Documents\Book12 (6).pdf
[2011/05/16 14:43:56 | 000,995,603 | ---- | C] () -- \\psf\Home\Documents\Intuit (126).pdf
[2011/05/16 14:06:30 | 000,533,358 | ---- | C] () -- \\psf\Home\Documents\7004.pdf
[2011/05/16 05:31:16 | 006,596,016 | ---- | C] () -- \\psf\Home\Documents\Intuit (125).pdf
[2011/05/12 22:14:40 | 004,349,413 | ---- | C] () -- \\psf\Home\Documents\Book2 (11).pdf
[2011/05/09 15:37:24 | 001,674,619 | ---- | C] () -- \\psf\Home\Documents\Intuit (124).pdf
[2011/05/09 15:28:35 | 006,117,533 | ---- | C] () -- \\psf\Home\Documents\Intuit (120).pdf
[2011/05/09 15:28:35 | 000,412,856 | ---- | C] () -- \\psf\Home\Documents\Intuit (120) (2).pdf
[2011/05/09 15:17:22 | 000,425,498 | ---- | C] () -- \\psf\Home\Documents\Intuit (123).pdf
[2011/05/09 15:08:23 | 001,783,585 | ---- | C] () -- \\psf\Home\Documents\Intuit (122).pdf
[2011/05/09 14:56:18 | 005,105,672 | ---- | C] () -- \\psf\Home\Documents\Intuit (121).pdf
[2011/05/09 13:54:16 | 004,649,622 | ---- | C] () -- \\psf\Home\Documents\Book3 (26).pdf
[2011/05/09 12:15:43 | 003,791,798 | ---- | C] () -- \\psf\Home\Documents\Book6 (5).pdf
[2011/05/09 11:58:02 | 006,587,269 | ---- | C] () -- \\psf\Home\Documents\Intuit (119).pdf
[2011/05/09 09:56:25 | 000,214,440 | ---- | C] () -- \\psf\Home\Documents\MSFaxConsoleTempPreview-#00000b1430955905.pdf
[2011/05/06 16:26:06 | 000,702,629 | ---- | C] () -- \\psf\Home\Documents\Document (52).pdf
[2011/05/03 17:58:15 | 002,802,948 | ---- | C] () -- \\psf\Home\Documents\Book10 (2).pdf
[2011/05/03 16:43:22 | 000,002,823 | ---- | C] () -- \\psf\Home\Desktop\QuickBooks Company File Diagnostic Tool.lnk
[2011/05/02 23:59:26 | 004,529,197 | ---- | C] () -- \\psf\Home\Documents\Book36.pdf
[2011/05/02 22:42:09 | 000,821,044 | ---- | C] () -- \\psf\Home\Documents\CCLA Perkins - CPU account analysis - March 2010 (7).pdf
[2011/05/02 22:22:13 | 002,423,109 | ---- | C] () -- \\psf\Home\Documents\Book22.pdf
[2011/05/02 00:28:48 | 002,066,685 | ---- | C] () -- \\psf\Home\Documents\Book37.pdf
[2011/05/01 22:26:44 | 003,085,445 | ---- | C] () -- \\psf\Home\Documents\Intuit (118).pdf
[2011/05/01 20:57:43 | 005,744,204 | ---- | C] () -- \\psf\Home\Documents\Book25.pdf
[2011/05/01 17:54:37 | 004,858,860 | ---- | C] () -- \\psf\Home\Documents\Book13 (7).pdf
[2011/05/01 16:31:17 | 005,852,313 | ---- | C] () -- \\psf\Home\Documents\Intuit (117).pdf
[2011/04/30 22:15:32 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2011/04/29 03:18:39 | 002,539,199 | ---- | C] () -- \\psf\Home\Documents\Document (51).pdf
[2011/04/29 02:18:44 | 000,614,275 | ---- | C] () -- \\psf\Home\Documents\Payroll Final (2).pdf
[2011/03/29 21:26:03 | 000,000,452 | -H-- | C] () -- \.swfinfo
[2011/03/29 21:11:42 | 000,015,176 | ---- | C] () -- C:\Windows\System32\drivers\prl_memdev.sys
[2010/06/30 20:53:29 | 000,000,059 | ---- | C] () -- C:\Windows\sview.ini
[2010/03/24 21:28:37 | 000,000,000 | -H-- | C] () -- \.Xauthority
[2010/03/24 21:28:17 | 000,000,033 | -H-- | C] () -- \.bash_history
[2010/03/15 17:21:44 | 000,029,913 | ---- | C] () -- C:\Windows\maxlink.ini
[2010/03/11 23:07:01 | 000,000,058 | ---- | C] () -- C:\Windows\ProTSKSCH04.INI
[2010/03/11 22:18:31 | 000,002,292 | ---- | C] () -- C:\Windows\Prowin04.ini
[2010/02/07 14:06:01 | 003,715,530 | ---- | C] () -- \Seagrove Beach Chair.jpg
[2010/02/03 23:07:39 | 000,000,101 | ---- | C] () -- C:\Users\Administrator\AppData\Local\fusioncache.dat
[2010/02/03 23:04:24 | 000,002,891 | ---- | C] () -- C:\Windows\Prowin06.ini
[2010/02/03 23:03:49 | 000,000,038 | ---- | C] () -- C:\Windows\SelecPrd.INI
[2010/02/02 07:07:12 | 000,000,090 | ---- | C] () -- C:\Windows\QBChanUtil_Trigger.ini
[2010/02/02 01:17:42 | 000,000,165 | ---- | C] () -- C:\Windows\Quicken.ini
[2010/02/02 01:06:48 | 000,001,019 | ---- | C] () -- C:\Windows\CFSREG.INI
[2010/02/02 00:50:10 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2010/01/30 15:23:24 | 000,015,364 | -H-- | C] () -- \.DS_Store
[2010/01/25 11:58:06 | 000,462,848 | ---- | C] () -- C:\Windows\System32\ractrlkeyhook.dll
[2009/08/03 16:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/08/03 16:07:42 | 000,230,768 | ---- | C] () -- C:\Windows\System32\OGAEXEC.exe
[2009/07/13 23:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/13 23:33:53 | 000,340,832 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009/07/13 21:05:48 | 000,635,612 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009/07/13 21:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009/07/13 21:05:48 | 000,111,186 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009/07/13 21:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009/07/13 21:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009/07/13 21:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009/07/13 19:19:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2009/07/13 18:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/13 18:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009/06/10 16:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2009/06/09 09:55:58 | 000,057,904 | ---- | C] () -- C:\Windows\System32\wbload.dll
[2007/07/24 13:17:46 | 000,000,003 | -H-- | C] () -- \.CFUserTextEncoding
[2006/09/18 15:37:50 | 000,000,530 | ---- | C] () -- C:\Windows\System32\tx12_ic.ini
[2006/09/18 15:37:48 | 000,667,280 | ---- | C] () -- C:\Windows\System32\tx12.dll

========== LOP Check ==========

[2011/03/24 15:38:32 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\.oit
[2011/05/25 20:05:02 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\FixCleaner
[2010/11/25 11:45:44 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\GARMIN
[2010/02/10 22:39:24 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\ICAClient
[2010/04/19 14:12:48 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Juniper Networks
[2010/03/15 15:57:03 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Nuance
[2010/10/24 12:35:20 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Parallels
[2010/03/15 17:23:38 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\ScanSoft
[2010/03/15 15:57:09 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Zeon
[2011/05/25 04:57:00 | 000,032,568 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/09/07 07:09:45 | 000,006,148 | ---- | M] () -- C:\.DS_Store
[2010/02/09 22:40:12 | 000,001,024 | ---- | M] () -- C:\.rnd
[2010/12/27 16:59:34 | 000,004,096 | ---- | M] () -- C:\._.TemporaryItems
[2010/12/30 00:52:39 | 000,000,284 | ---- | M] () -- C:\ADAMSTK.TXT
[2009/06/10 16:42:20 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2009/07/13 20:38:58 | 000,383,562 | RHS- | M] () -- C:\bootmgr
[2010/02/02 01:48:06 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
[2010/03/02 08:24:23 | 000,000,619 | ---- | M] () -- C:\CarboniteNSE.log
[2011/02/28 16:00:57 | 000,004,096 | ---- | M] () -- C:\CCLA Perkins.txt
[2011/05/26 22:37:30 | 000,029,166 | ---- | M] () -- C:\ComboFix.txt
[2009/06/10 16:42:20 | 000,000,010 | ---- | M] () -- C:\config.sys
[2011/04/18 23:09:55 | 000,000,017 | ---- | M] () -- C:\EF129.LOG
[2011/05/27 22:26:27 | 804,954,112 | -HS- | M] () -- C:\hiberfil.sys
[2011/02/28 13:35:19 | 000,003,072 | ---- | M] () -- C:\Maria Bowers
[2011/05/27 22:26:27 | 1073,741,824 | -HS- | M] () -- C:\pagefile.sys
[2011/02/28 16:32:52 | 000,025,600 | ---- | M] () -- C:\SCS AL employees
[2011/05/25 05:37:47 | 000,509,440 | ---- | M] (iS3, Inc.) -- C:\STOPzilla_Setup.exe
[2011/05/27 22:26:04 | 000,070,290 | ---- | M] () -- C:\TDSSKiller.2.5.3.0_27.05.2011_22.24.52_log.txt

< %systemroot%\Fonts\*.com >
[2009/07/13 23:52:25 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/13 23:52:25 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/13 23:52:25 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/13 23:52:25 | 000,043,318 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 16:31:19 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/07/13 20:15:26 | 000,090,624 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\HPZPPWN7.DLL
[2009/07/13 20:15:35 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2010/12/08 14:11:52 | 000,053,632 | ---- | M] (LogMeIn, Inc.) -- C:\Windows\System32\spool\prtprocs\w32x86\LMIproc.dll
[2003/06/18 18:31:48 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\mdippr.dll
[2009/07/13 20:16:19 | 000,029,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011/05/10 07:10:59 | 000,040,112 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/13 23:41:57 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/04/30 22:28:27 | 000,000,221 | -HS- | M] () -- C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2009/06/10 16:20:04 | 000,000,802 | ---- | M] () -- C:\Windows\addins\FXSEXT.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >
[2010/12/31 17:47:17 | 000,008,192 | ---- | M] () -- C:\Windows\security\database\edb.chk
[2010/12/31 17:47:17 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edb.log
[2010/12/31 17:47:16 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edbres00001.jrs
[2010/12/31 17:47:17 | 001,048,576 | ---- | M] () -- C:\Windows\security\database\edbres00002.jrs
[2010/12/31 17:47:16 | 000,786,432 | ---- | M] () -- C:\Windows\security\database\edbtmp.log
[2010/12/31 17:47:17 | 001,056,768 | ---- | M] () -- C:\Windows\security\database\tmp.edb

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2010/08/21 11:57:59 | 000,000,402 | -HS- | M] () -- C:\Users\Administrator\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2011/05/25 17:39:10 | 000,000,336 | ---- | M] () -- C:\ProgramData\32366328
[2011/05/26 22:14:05 | 000,000,408 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2011/05/25 19:03:34 | 000,000,144 | ---- | M] () -- C:\ProgramData\~32366328
[2011/05/25 19:03:34 | 000,000,168 | ---- | M] () -- C:\ProgramData\~32366328r

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 191 bytes -> C:\ProgramData\TEMP:0B9FB94D
@Alternate Data Stream - 175 bytes -> C:\ProgramData\TEMP:01C66DD9

< End of report >

csbowers · 2011/05/28

Extras.txt:

OTL Extras logfile created on: 5/28/2011 11:30:27 PM - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = \\psf\Home\Desktop
Enterprise Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1023.55 Mb Total Physical Memory | 444.57 Mb Available Physical Memory | 43.43% Memory free
2.00 Gb Paging File | 1.25 Gb Available in Paging File | 62.33% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 64.00 Gb Total Space | 28.05 Gb Free Space | 43.82% Space Free | Partition Type: NTFS

Computer Name: MARIABOWERS1F49 | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-1754874174-4154865007-600923206-500\SOFTWARE\Classes\<extension>]
.exe [@ = exefile] -- Reg Error: Key error. File not found
.html [@ = htmlfile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1 ",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{06A9E630-DBA6-4D92-9DE7-A235AA6496C7}" = QuickBooks
"{0700E22B-A423-40A5-BD20-04BF618CA0F9}" = QuickBooks Premier: Accountant Edition 2010
"{105F3CE5-FE55-408E-BF30-E78F85BA0B12}" = Dell Printer Software
"{10DA4BDF-278F-4AFD-AD7A-BAE1503C61AB}" = Payroll System 2009
"{150D4E82-DED7-47B7-AF61-F42CDCBC8406}" = Payroll System 2011
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{332CC6BF-E6C7-48EE-BA3D-435E576AD67F}" = PaperPort Image Printer
"{34F93E31-E1A0-421C-8E86-BCF7C4193A91}" = LogMeIn
"{388E4B09-3E71-4649-8921-F44A3A2954A7}" = Microsoft Visual Studio 2005 Tools for Office Runtime
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{5658CE44-2822-45C9-A5C0-F93AB4682BBF}" = Document eSort Components
"{5AD36922-3022-475F-BB2F-94A864D16593}" = Payroll System 2010
"{6421F085-1FAA-DE13-D02A-CFB412C522A4}" = Acrobat.com
"{68AEC200-C650-4D8B-BD58-8656F68CB1FE}" = QuickBooks Company File Diagnostic Tool
"{6F7614CC-F33A-4877-8814-49856F441F3C}" = Stardock MyColors
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7DD9A065-2C86-4A9F-A5FF-796EC1B99DCA}" = AnswerWorks 4.0 Runtime - English
"{854FCA42-5318-47CA-95D7-7394B1A16616}" = ScanSoft PaperPort 10
"{86CEBAE9-5752-414A-86BC-170154E30E2A}" = Dell MFP Laser 3115cn Utilities Ver.1.0.2.0
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DA7286C-FBF6-48E4-A24A-FA9481EF4C0F}" = Dell MFP Laser 3115cn ScanButton Manager Ver.1.1.0.1
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_STANDARDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_STANDARDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_STANDARDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_STANDARDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_STANDARDR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_STANDARDR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_STANDARDR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_STANDARDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_STANDARDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0012-0000-0000-0000000FF1CE}" = Microsoft Office Standard 2007
"{91120000-0012-0000-0000-0000000FF1CE}_STANDARDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0012-0000-0000-0000000FF1CE}_STANDARDR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.4
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{C9052439-99E8-4A4C-9C81-49776DDFA969}" = EntlClnt
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCF6F57B-F6B4-4508-BF45-63AAC9DE416A}" = Quicken 2010
"{DBCC73BA-C69A-4BF5-B4BF-F07501EE7039}" = AnswerWorks 5.0 English Runtime
"{E5CED820-3C6A-4EC2-AE56-39D4F94CC480}" = E-Transcript Bundle Viewer
"{E684692F-B75E-4B7B-9818-4D9287F42A0A}" = Parallels Tools
"{EA2BEBD6-87B9-41E5-95AC-7E4C165A9475}" = WexTech AnswerWorks
"{EBFEEB3F-3E3B-4725-A4E0-376144CE4F76}" = Citrix XenApp Web Plugin
"{FA0092C2-C0FE-40DA-A79E-E4C0FCA129F9}" = Intuit Entitlement Client
"{FDEC0704-D15E-4DB8-A624-2256DD4C65D7}" = Dell MFP Laser 3115cn Scanner Driver
"A8A6DA209BDF7401AF8A9DFDEC2F4126440929C4" = Windows Driver Package - U.S. Robotics Corporation (usbser) Modem (03/12/2010 3.1.0.39)
"AccuWage 2009" = AccuWage 2009
"AccuWage 2010" = AccuWage 2010
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"avast" = avast! Free Antivirus
"Carbonite Backup" = Carbonite
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"IOLSignup" = IOL Signup
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Visual Studio 2005 Tools for Office Runtime" = Microsoft Visual Studio 2005 Tools for Office Runtime
"Payroll System 2004" = Payroll System 2004
"Payroll System 2006" = Payroll System 2006
"Payroll System 2007" = Payroll System 2007
"Payroll System 2008" = Payroll System 2008
"ProSeries 2004" = ProSeries 2004
"ProSeries 2006" = ProSeries 2006
"ProSeries 2007" = ProSeries 2007
"ProSeries 2008" = ProSeries 2008
"ProSeries 2009" = ProSeries 2009
"ProSeries to Drake Conversion" = ProSeries to Drake Conversion 10.1.1rsion\Uninstall\ProSeries 2009
"Sophos-AntiRootkit" = Sophos Anti-Rootkit 1.5.4
"STANDARDR" = Microsoft Office Standard 2007
"Stardock MyColors" = Stardock MyColors
"U.S. Robotics V.92 USB Modem" = U.S. Robotics V.92 USB Modem
"YTdetect" = Yahoo! Detect

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1754874174-4154865007-600923206-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"GoToMeeting" = GoToMeeting 4.5.0.457
"JuniperSetupClient" = Juniper Networks Setup Client

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 5/27/2011 7:03:04 AM | Computer Name = MARIABOWERS1F49 | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks: Premier Accountant
Edition 2010 ": Password Reset: Wrong Response Enter

Error - 5/27/2011 7:03:04 AM | Computer Name = MARIABOWERS1F49 | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks: Premier Accountant
Edition 2010 ": Error decrypting QuickBooks Administrator passwo

Error - 5/27/2011 7:03:49 AM | Computer Name = MARIABOWERS1F49 | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks: Premier Accountant
Edition 2010 ": Password Reset: Wrong Response Enter

Error - 5/27/2011 7:03:49 AM | Computer Name = MARIABOWERS1F49 | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks: Premier Accountant
Edition 2010 ": Error decrypting QuickBooks Administrator passwo

Error - 5/27/2011 7:03:57 AM | Computer Name = MARIABOWERS1F49 | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks: Premier Accountant
Edition 2010 ": Password Reset: Wrong Response Enter

Error - 5/27/2011 7:03:57 AM | Computer Name = MARIABOWERS1F49 | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks: Premier Accountant
Edition 2010 ": Error decrypting QuickBooks Administrator passwo

Error - 5/27/2011 7:04:05 AM | Computer Name = MARIABOWERS1F49 | Source = QuickBooks | ID = 4
Description = An unexpected error has occured in "QuickBooks: Premier Accountant
Edition 2010 ": InitSystem returned non success HRESULT 0x800405

Error - 5/27/2011 10:06:39 AM | Computer Name = MARIABOWERS1F49 | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 9.0.8112.16421,
time stamp: 0x4d76255d Faulting module name: ntdll.dll, version: 6.1.7600.16695,
time stamp: 0x4cc7ab44 Exception code: 0xc0000374 Fault offset: 0x000c35e3 Faulting
process id: 0xfb4 Faulting application start time: 0x01cc1c69bcf03c4a Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report
Id: 89e4380a-886a-11e0-b3bc-001c426efac5

Error - 5/27/2011 6:41:20 PM | Computer Name = MARIABOWERS1F49 | Source = Application Error | ID = 1000
Description = Faulting application name: iexplore.exe, version: 9.0.8112.16421,
time stamp: 0x4d76255d Faulting module name: ntdll.dll, version: 6.1.7600.16695,
time stamp: 0x4cc7ab44 Exception code: 0xc0000374 Fault offset: 0x000c35e3 Faulting
process id: 0x570 Faulting application start time: 0x01cc1caf73a0e1c8 Faulting application
path: C:\Program Files\Internet Explorer\iexplore.exe Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report
Id: 7062d891-88b2-11e0-b3bc-001c426efac5

Error - 5/28/2011 1:31:16 AM | Computer Name = MARIABOWERS1F49 | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\Program Files\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll ".Error in manifest or policy file "c:\Program
Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR "
of attribute "version" in element "assemblyIdentity" is invalid.

[ System Events ]
Error - 5/26/2011 7:03:32 AM | Computer Name = MARIABOWERS1F49 | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
to start because of the following error: %%1068

Error - 5/26/2011 7:10:46 AM | Computer Name = MARIABOWERS1F49 | Source = Service Control Manager | ID = 7023
Description = The Superfetch service terminated with the following error: %%2

Error - 5/26/2011 11:25:51 PM | Computer Name = MARIABOWERS1F49 | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 5/26/2011 11:29:40 PM | Computer Name = MARIABOWERS1F49 | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 5/26/2011 11:33:50 PM | Computer Name = MARIABOWERS1F49 | Source = Service Control Manager | ID = 7030
Description = The PEVSystemStart service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 5/27/2011 8:28:29 AM | Computer Name = MARIABOWERS1F49 | Source = EventLog | ID = 6008
Description = The previous system shutdown at 7:27:42 AM on ?5/?27/?2011 was unexpected.

Error - 5/27/2011 8:29:48 AM | Computer Name = MARIABOWERS1F49 | Source = Service Control Manager | ID = 7023
Description = The Superfetch service terminated with the following error: %%2

Error - 5/27/2011 11:13:49 PM | Computer Name = MARIABOWERS1F49 | Source = EventLog | ID = 6008
Description = The previous system shutdown at 10:12:37 PM on ?5/?27/?2011 was unexpected.

Error - 5/27/2011 11:15:03 PM | Computer Name = MARIABOWERS1F49 | Source = Service Control Manager | ID = 7023
Description = The Superfetch service terminated with the following error: %%2

Error - 5/27/2011 11:27:39 PM | Computer Name = MARIABOWERS1F49 | Source = Service Control Manager | ID = 7023
Description = The Superfetch service terminated with the following error: %%2

< End of report >

broni · 2011/05/28

Your computer would run much better, if you'd add another 1GB of RAM.

Run OTL
Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following
Code:
:OTL
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - File not found
O15 - HKLM\..Trusted Domains: .psf ([]* in Local intranet)
O15 - HKLM\..Trusted Domains: psf ([]* in Local intranet)
O15 - HKU\S-1-5-21-1754874174-4154865007-600923206-500\..Trusted Domains: localhost ([]* in Local intranet)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/...nAxControl.CAB (Reg Error: Key error.)
O37 - HKU\S-1-5-21-1754874174-4154865007-600923206-500\...exe [@ = exefile] -- Reg Error: Key error. File not found
[2011/05/25 05:41:26 | 000,000,000 | ---D | C] -- C:\ProgramData\STOPzilla!
[2011/05/25 05:38:16 | 000,509,440 | ---- | C] (iS3, Inc.) -- C:\STOPzilla_Setup.exe
[2011/05/25 19:03:34 | 000,000,168 | ---- | M] () -- C:\ProgramData\~32366328r
[2011/05/25 19:03:34 | 000,000,144 | ---- | M] () -- C:\ProgramData\~32366328
[2011/05/25 17:39:10 | 000,000,336 | ---- | M] () -- C:\ProgramData\32366328
@Alternate Data Stream - 191 bytes -> C:\ProgramData\TEMP:0B9FB94D
@Alternate Data Stream - 175 bytes -> C:\ProgramData\TEMP:01C66DD9

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
Then click the [color= "#FF0000"]Run Fix[/color] button at the top

Let the program run unhindered, reboot the PC when it is done

You will get a log that shows the results of the fix. Please post it.
======================================================

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe

Follow the onscreen instructions inside of the black box.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Download Temp File Cleaner (TFC)

Double click on TFC.exe to run the program.

Click on Start button to begin cleaning process.

TFC will close all running programs, and it may ask you to restart computer.

3. Please run a free online scan with the ESET Online Scanner

Disable your antivirus program

Tick the box next to YES, I accept the Terms of Use

Click Start

IMPORTANT! UN-check Remove found threats

Accept any security warnings from your browser.

Check Scan archives

Click Start

ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

When the scan completes, push List of found threats

Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

NOTE. If Eset won't find any threats, it won't produce any log.

csbowers · 2011/05/29

I ran OTL and it displayed the message (after it apparenly ran?) "Error Creating Log File" Maybe because the files OTL and Extras already existed on my desktop? Did not run again, as i am not sure if that would mess things up.

Security Check:

Results of screen317's Security Check version 0.99.7
Windows 7 (UAC is enabled)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
avast! Free Antivirus
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
Adobe Flash Player
Adobe Reader 9.4.4
Out of date Adobe Reader installed!
````````````````````````````````
Process Check:
objlist.exe by Laurent
AVAST Software Avast AvastSvc.exe
AVAST Software Avast AvastUI.exe
``````````End of Log````````````

csbowers · 2011/05/29

ESET scan:

C:\DRAKE10\TEX\TEX089.DLL probably a variant of Win32/TrojanDropper.Agent.EVDMNMU trojan

broni · 2011/05/29

I ran OTL and it displayed the message (after it apparenly ran?) "Error Creating Log File "
Click to expand...

Disable Avast and try to run the fix again.
If still no go, try safe mode.

csbowers · 2011/05/29

I disabled Avast and ran again: same message.

I ran in safe mode and same message : "Error Creating Log File!" Additionally, another popup displayed "The filename, directory name or volume label syntax is incorrect ". I double checked and made sure that the text you asked me to copy and paste did not have any extra stuff copied into it. Thanks.

broni · 2011/05/29

Delete your OTL file, download fresh one and try again.

csbowers · 2011/05/29

OK. Deleted and re-downloaded. Same message. Tried again in safe mode. Same message. The only thing I have noticed is that there were 3 updates installed from the microsoft download center (updates) one of the times when OTL asked me to reboot? I have checked and double checked and even made my wife stand next to me and re-read the directions exactly as you posted. Let me know?

broni · 2011/05/29

Please download OTM

Save it to your desktop.

Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).

Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

[code
:Files
C:\ProgramData\STOPzilla!
C:\STOPzilla_Setup.exe
C:\ProgramData\~32366328r
C:\ProgramData\~32366328
C:\ProgramData\32366328
C:\ProgramData\TEMP:0B9FB94D
C:\ProgramData\TEMP:01C66DD9

:Commands
[purity]
[emptytemp]
[Reboot]
[/code]

Return to OTM, right click in the Paste Instructions for Items to be Movedwindow (under the yellow bar) and choose Paste.

Click the red Moveit! button.

Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.

Close OTM and reboot your PC.

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

csbowers · 2011/05/29

Well, downloaded OTM and save to desktop, cut and pasted, pressed moveit button and the same error message shows up "error creating log file! ", however, after hitting "ok" (the only button you can press) it pops up another window "error creating restore file ". you can only hit "ok" again and then says it must reboot to complete. During reboot, it asks me if I want to run the unverified program "OTM" and I answer yes, it gives me the "error creating log file!" and then opens an empty notepad window. I was unable to complete the second part as it makes me reboot and I lose the information in the window. Thanks and sorry this is being so difficult!

I checked to see if there were any files or directories created on c:\ with the current date and there were none. Additionally, I searched for any .log files and did not see anything that looked like it could be relavent.

broni · 2011/05/29

Download BlitzBlank and save it to your desktop.
Double click on Blitzblank.exe

Click OK at the warning (and take note of it, this is a VERY powerful tool!).

Click the Script tab and copy/paste the following text there:
Code:
DeleteFile: 
C:\STOPzilla_Setup.exe
C:\ProgramData\TEMP:01C66DD9
C:\ProgramData\TEMP:0B9FB94D
C:\ProgramData\32366328
C:\ProgramData\~32366328
C:\ProgramData\~32366328r
DeleteFolder: 
C:\ProgramData\STOPzilla!
C:\ProgramData\TEMP:01C66DD9
C:\ProgramData\TEMP:0B9FB94D
C:\ProgramData\32366328
C:\ProgramData\~32366328
C:\ProgramData\~32366328r
Click Execute Now. Your computer will need to reboot in order to replace the files.

When done, post the report created by Blitzblank.
You can find it in the root of the drive, normally C:\

csbowers · 2011/05/29

Downloaded, copy and paste, click Execute now and a popup displays: "Syntax error in line 12, Invalid folder path ". I looked at the contents of the directories in the text and there does not appear to be any files or folders in c:\ProgramData that have "Temp*" )second and third entries in each group) in them. All of the other specified dirs and files are present. Maybe that is the hangup?

broni · 2011/05/30

Remove last 3 lines from my script:
C:\ProgramData\32366328
C:\ProgramData\~32366328
C:\ProgramData\~32366328r
and try again.

csbowers · 2011/05/30

That worked! Log file follows:

BlitzBlank 1.0.0.32

File/Registry Modification Engine native application
MoveFileOnReboot: sourceFile = "\??\c:\stopzilla_setup.exe ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\temp ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\temp ", destinationFile = "(null) ", replaceWithDummy = 0
RemoveFile: ZwDeleteFile failed: status = c0000034
MoveFileOnReboot: sourceFile = "\??\c:\programdata\32366328 ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\~32366328 ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\~32366328r ", destinationFile = "(null) ", replaceWithDummy = 0
MoveDirectoryOnReboot: sourceDirectory = "\??\c:\programdata\stopzilla! ", destinationDirectory = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\modules_scanned.db ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\modules_scanned.db.bak ", destinationFile = "(null) ", replaceWithDummy = 0
MoveDirectoryOnReboot: sourceDirectory = "\??\c:\programdata\stopzilla!\Quarantine ", destinationDirectory = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\scanner.log ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\userdata.db ", destinationFile = "(null) ", replaceWithDummy = 0
MoveDirectoryOnReboot: sourceDirectory = "\??\c:\programdata\stopzilla!\vdb ", destinationDirectory = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-000.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-001.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-002.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-003.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-004.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-005.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-006.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-007.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-008.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-009.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-010.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-011.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-012.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-013.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-014.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-015.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-016.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-017.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-018.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-019.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-020.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-021.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-022.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-023.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-024.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-025.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-026.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-027.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-028.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-029.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-030.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-031.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-032.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-033.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-034.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-035.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-036.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-037.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-038.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-039.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-040.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-041.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-042.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-043.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-044.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-045.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-046.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-047.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-048.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-049.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-050.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-051.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-052.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-053.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-054.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-055.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-056.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-057.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-058.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-059.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-060.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-061.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-062.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-063.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-064.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-065.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-066.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-067.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-068.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-069.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-070.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-071.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-072.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-073.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-074.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-075.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-076.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-077.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-078.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-079.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-080.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-081.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-082.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-083.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-084.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-085.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-086.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-087.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-088.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-089.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-090.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vb-091.vdb ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vbcorent.dll ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\vdb.xml ", destinationFile = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\vdb\xml_edk.log ", destinationFile = "(null) ", replaceWithDummy = 0
MoveDirectoryOnReboot: sourceDirectory = "\??\c:\programdata\stopzilla!\vdbupdate ", destinationDirectory = "(null) ", replaceWithDummy = 0
MoveFileOnReboot: sourceFile = "\??\c:\programdata\stopzilla!\zilla5.log ", destinationFile = "(null) ", replaceWithDummy = 0
MoveDirectoryOnReboot: sourceDirectory = "\??\c:\programdata\temp ", destinationDirectory = "(null) ", replaceWithDummy = 0
MoveDirectoryOnReboot: ZwCreateFile(sourceDirectory) failed: status = c0000034
MoveDirectoryOnReboot: sourceDirectory = "\??\c:\programdata\temp ", destinationDirectory = "(null) ", replaceWithDummy = 0
MoveDirectoryOnReboot: ZwCreateFile(sourceDirectory) failed: status = c0000034

broni · 2011/05/30

Very good

Update Adobe Reader

You can download it from http://www.adobe.com/products/acrobat/readstep2.html
After installing the latest Adobe Reader, uninstall all previous versions.
Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
It's a much smaller file to download and uses a lot less resources than Adobe Reader.
Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or any other garbage.

=====================================================

Remove manually following file:
C:\DRAKE10\TEX\TEX089.DLL

======================================================

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following:
Code:
:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]
Then click the Run Fix button at the top

Let the program run unhindered, reboot the PC when it is done

Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

Double-click OTL.exe to start the program.

Close all other programs apart from OTL as this step will require a reboot

On the OTL main screen, press the CLEANUP button

Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current.

4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC) weekly.

8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. Run defrag at your convenience.

11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

12. Please, let me know, how your computer is doing.

csbowers · 2011/05/30

Whew! Thank you very much. I did run into that same "Error Creating Log File!" issue with OTL when I did the "run fix" operation. Not really sure if the restore point was created? Looking at the system restore utility, it has created one for when I installed the update to Adobe and one for a windows update when I rebooted tonite. Other than that, everything else was performed and worked without error.

Would it be possible for you to give me a synopsis of what went on with this? We have gone thru so many steps. I am just curious as to what was happening and what we had to do to exterminate the virus.

Since we ran the TDSSKiller program, things seemed to start really running well and I have not observed any issue other than normal operation. Additionally, I did add another Gig to help with performance.

Thank you again!

broni · 2011/05/30

You're very welcome

Regarding restore points, just to make sure, reset them manually.
Turn system restore off.
Restart computer.
Turn system restore on.
How to: http://www.howtogeek.com/howto/windows-vista/disable-system-restore-in-windows-vista/

As for your problems, a rootkit was the main culprit there.

Good luck and stay safe

Log in or Sign up

Solved Virus - Internet explorer

csbowers Inactive Thread Starter

csbowers Inactive Thread Starter

broni Moderator Malware Analyst

csbowers Inactive Thread Starter

csbowers Inactive Thread Starter

broni Moderator Malware Analyst

csbowers Inactive Thread Starter

broni Moderator Malware Analyst

csbowers Inactive Thread Starter

broni Moderator Malware Analyst

csbowers Inactive Thread Starter

broni Moderator Malware Analyst

csbowers Inactive Thread Starter

broni Moderator Malware Analyst

csbowers Inactive Thread Starter

broni Moderator Malware Analyst

csbowers Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Solved Virus - Internet explorer

csbowers Inactive Thread Starter

csbowers Inactive Thread Starter

broni Moderator Malware Analyst

csbowers Inactive Thread Starter

csbowers Inactive Thread Starter

broni Moderator Malware Analyst

csbowers Inactive Thread Starter

broni Moderator Malware Analyst

csbowers Inactive Thread Starter

broni Moderator Malware Analyst

csbowers Inactive Thread Starter

broni Moderator Malware Analyst

csbowers Inactive Thread Starter

broni Moderator Malware Analyst

csbowers Inactive Thread Starter

broni Moderator Malware Analyst

csbowers Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Useful Searches