Inactive corrupted laptop

ntavolario · 2010/06/10

[Inactive] corrupted laptop

I am currently using my parents laptop right now because my Mitzubishi laptop is totally corrupt. Since I have had the machine I have used program files such as Limewire to fileshare and I use the internet a lot to download things as well as your basic surfing. I had to recently download a new driver for my sound because that was not working. It does not but I think it came along with some stuff that is hurting my machine.
I am currently unable to connect to firefox or internet explorer from my pc and I keep getting things popping up on my screen telling me its corrupted.
I had someone download a virus cleaner on my computer and worked great a few months back and it worked great but it was a subscription and I cant pay for it. If there is anything you guys can do to help it would be much appreciated.

//////////////////////////////////////

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 9/3/2005 3:11:43 PM
System Uptime: 6/10/2010 12:00:50 PM (0 hours ago)

Motherboard: TOSHIBA | | EDW10
Processor: Mobile Intel(R) Pentium(R) 4 CPU 3.20GHz | NWD | 3200/mhz

==== Disk Partitions =========================
C: is FIXED (NTFS) - 37 GiB total, 1.432 GiB free.
D: is CDROM ()
E: is Removable

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP773: 3/15/2010 10:42:47 PM - Installed Realtek AC'97 Audio
RP774: 3/18/2010 3:02:30 PM - Installed Realtek AC'97 Audio
RP775: 3/20/2010 3:36:09 AM - Installed Realtek AC'97 Audio
RP776: 3/26/2010 4:37:46 AM - System Checkpoint
RP777: 3/27/2010 6:59:07 AM - System Checkpoint
RP778: 3/27/2010 9:30:41 AM - Installed Realtek AC'97 Audio
RP779: 3/27/2010 9:59:45 PM - Installed Realtek AC'97 Audio
RP780: 4/3/2010 7:19:52 AM - System Checkpoint
RP781: 4/18/2010 4:17:47 AM - Installed Realtek AC'97 Audio
RP782: 4/21/2010 10:58:08 PM - avast! Free Antivirus Setup
RP783: 5/2/2010 12:29:54 AM - Installed Realtek AC'97 Audio
RP784: 5/2/2010 3:36:59 AM - Installed Realtek AC'97 Audio
RP785: 5/8/2010 8:45:57 AM - Installed Realtek AC'97 Audio
RP786: 5/10/2010 5:49:14 AM - Installed Realtek AC'97 Audio
RP787: 5/12/2010 1:56:58 PM - System Checkpoint
RP788: 5/14/2010 5:05:37 PM - System Checkpoint
RP789: 5/20/2010 11:29:08 AM - System Checkpoint

==== Hosts File Hijack ======================

Hosts: 217.20.175.74 www.review.2009softwarereviews.com
Hosts: 217.20.175.74 review.2009softwarereviews.com
Hosts: 217.20.175.74 a1.review.zdnet.com
Hosts: 217.20.175.74 www.d1.reviews.cnet.com
Hosts: 217.20.175.74 www.reviews.toptenreviews.com
Hosts: 217.20.175.74 reviews.toptenreviews.com
Hosts: 217.20.175.74 www.reviews.download.com
Hosts: 217.20.175.74 reviews.download.com
Hosts: 217.20.175.74 www.reviews.pcadvisor.c.uk
Hosts: 217.20.175.74 reviews.pcadvisor.co.uk
Hosts: 217.20.175.74 www.reviews.pcmag.com
Hosts: 217.20.175.74 reviews.pcmag.com
Hosts: 217.20.175.74 www.reviews.pcpro.co.uk
Hosts: 217.20.175.74 reviews.pcpro.co.uk
Hosts: 217.20.175.74 www.reviews.reevoo.com
Hosts: 217.20.175.74 reviews.reevoo.com
Hosts: 217.20.175.74 www.reviews.riverstreams.co.uk
Hosts: 217.20.175.74 reviews.riverstreams.co.uk
Hosts: 217.20.175.74 www.reviews.techradar.com
Hosts: 217.20.175.74 reviews.techradar.com

==== Installed Programs ======================

2Wire Wireless Client
Acrobat.com
Adobe Acrobat 5.0
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9
ALPS Touch Pad Driver
Apple Software Update
Ask Toolbar
Atheros Wireless LAN MiniPCI card Driver
ATI - Software Uninstall Utility
ATI Display Driver
CD/DVD Drive Acoustic Silencer
Critical Update for Windows Media Player 11 (KB959772)
DivX Web Player
Driver Detective
DVD-RAM Driver
Easy-WebPrint
Graboid Video 1.71
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
InterVideo WinDVD Creator 2
InterVideo WinDVD for TOSHIBA
iPod for Windows 2005-09-23
iTunes
Java(TM) 6 Update 15
Learn2 Player (Uninstall Only)
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 2.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Standard Edition 2003
Microsoft Office XP Professional
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Mozilla Firefox (3.5.9)
MSN Music Assistant
Notebook Maximizer
pdfFactory
Power Scan
Pure Networks Port Magic
RealPlayer Basic
Realtek AC'97 Audio
Realtek Fast Ethernet Adapter Driver
Roxio Burn Engine
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978706)
SMSC IrCC V5.1.3600.3 SP1
SRS WOW XT Plug-In for Windows Media Player for Toshiba version 1.0.2
Symantec KB-DocID:2003093015493306
TOSHIBA Access
TOSHIBA ConfigFree
TOSHIBA Console
TOSHIBA Fax Extension
TOSHIBA Hotkey Utility
TOSHIBA Power Management Utility
TOSHIBA Software Modem
TOSHIBA Software Upgrades
TOSHIBA Speech System Applications
TOSHIBA Speech System SR Engine(U.S.) Version1.0
TOSHIBA Speech System TTS Engine(U.S.) Version1.0
Toshiba Tbiosdrv Driver
Touch and Launch
TouchPad On/Off Utility
Update for Windows Internet Explorer 8 (KB973874)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VC80CRTRedist - 8.0.50727.762
VexcastPlayer2.0
Viewpoint Media Player
Visual FoxPro 7.0 Baseline - English
VLC media player 1.0.1
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
Yahoo! Install Manager
Yahoo! Software Update

==== Event Viewer Messages From Past Week ========

6/3/2010 1:15:16 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Themes service to connect.
6/3/2010 1:15:16 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the DHCP Client service to connect.
6/3/2010 1:15:16 PM, error: Service Control Manager [7000] - The Themes service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/3/2010 1:15:16 PM, error: Service Control Manager [7000] - The DHCP Client service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/10/2010 12:06:03 PM, error: Service Control Manager [7016] - The Adobe Update Service service has reported an invalid current state 0.
6/10/2010 12:06:02 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Workstation service to connect.
6/10/2010 12:06:02 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Wireless Zero Configuration service to connect.
6/10/2010 12:06:02 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Windows Time service to connect.
6/10/2010 12:06:02 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Windows Management Instrumentation service to connect.
6/10/2010 12:06:02 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Windows Audio service to connect.
6/10/2010 12:06:02 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Telephony service to connect.
6/10/2010 12:06:02 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Task Scheduler service to connect.
6/10/2010 12:06:02 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the System Restore Service service to connect.
6/10/2010 12:06:02 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Shell Hardware Detection service to connect.
6/10/2010 12:06:02 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Server service to connect.
6/10/2010 12:06:02 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Secondary Logon service to connect.
6/10/2010 12:06:02 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Network Connections service to connect.
6/10/2010 12:06:02 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Infrared Monitor service to connect.
6/10/2010 12:06:02 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the HID Input Service service to connect.
6/10/2010 12:06:02 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Help and Support service to connect.
6/10/2010 12:06:02 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Fast User Switching Compatibility service to connect.
6/10/2010 12:06:02 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Error Reporting Service service to connect.
6/10/2010 12:06:02 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Distributed Link Tracking Client service to connect.
6/10/2010 12:06:02 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Cryptographic Services service to connect.
6/10/2010 12:06:02 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the COM+ Event System service to connect.
6/10/2010 12:06:02 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Background Intelligent Transfer Service service to connect.
6/10/2010 12:06:02 PM, error: Service Control Manager [7001] - The Windows Firewall/Internet Connection Sharing (ICS) service depends on the Network Connections service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
6/10/2010 12:06:02 PM, error: Service Control Manager [7001] - The System Event Notification service depends on the COM+ Event System service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
6/10/2010 12:06:02 PM, error: Service Control Manager [7001] - The Fax service depends on the Telephony service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
6/10/2010 12:06:02 PM, error: Service Control Manager [7001] - The Computer Browser service depends on the Workstation service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
6/10/2010 12:06:02 PM, error: Service Control Manager [7000] - The Workstation service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/10/2010 12:06:02 PM, error: Service Control Manager [7000] - The Wireless Zero Configuration service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/10/2010 12:06:02 PM, error: Service Control Manager [7000] - The Windows Time service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/10/2010 12:06:02 PM, error: Service Control Manager [7000] - The Windows Audio service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/10/2010 12:06:02 PM, error: Service Control Manager [7000] - The Telephony service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/10/2010 12:06:02 PM, error: Service Control Manager [7000] - The Task Scheduler service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/10/2010 12:06:02 PM, error: Service Control Manager [7000] - The System Restore Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/10/2010 12:06:02 PM, error: Service Control Manager [7000] - The Server service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/10/2010 12:06:02 PM, error: Service Control Manager [7000] - The Network Connections service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/10/2010 12:06:02 PM, error: Service Control Manager [7000] - The Infrared Monitor service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/10/2010 12:06:02 PM, error: Service Control Manager [7000] - The HID Input Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/10/2010 12:06:02 PM, error: Service Control Manager [7000] - The Help and Support service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/10/2010 12:06:02 PM, error: Service Control Manager [7000] - The Fast User Switching Compatibility service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/10/2010 12:06:02 PM, error: Service Control Manager [7000] - The Distributed Link Tracking Client service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/10/2010 12:06:02 PM, error: Service Control Manager [7000] - The Cryptographic Services service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/10/2010 12:06:02 PM, error: Service Control Manager [7000] - The COM+ Event System service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/10/2010 12:06:02 PM, error: Service Control Manager [7000] - The Background Intelligent Transfer Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/10/2010 12:01:48 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service netman with arguments " " in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
6/10/2010 12:01:46 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
6/10/2010 12:01:45 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service winmgmt with arguments " " in order to run the server: {8BC3F05E-D86B-11D0-A075-00C04FB68820}

==== End Of File ===========================

DDS (Ver_10-03-17.01) - NTFSx86
Run by Nick at 12:05:59.51 on Thu 06/10/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.447.211 [GMT -7:00]

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
"C:\Program Files\svchost.exe "
C:\Program Files\Toshiba\Power Management\CeEPwrSvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Documents and Settings\Nick\Application Data\Microsoft\Internet Explorer\novavappu.exe
C:\Documents and Settings\Nick\Application Data\Microsoft\Internet Explorer\novavappk.exe
C:\WINDOWS\system32\ctfmon.exe
E:\dds.scr

============== Pseudo HJT Report ===============

uStart Page = about:blank
uLocal Page = \blank.htm
uWindow Title = Windows Internet Explorer provided by Yahoo!
uDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie8
mURLSearchHooks: H - No File
BHO: Poly HTML Filter BHO: {0140df95-9128-4053-ae72-f43f0cfca062} - c:\windows\system32\SiKernel.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: ShoppingReport: {100eb1fd-d03e-47fd-81f3-ee91287f9465} - c:\program files\shoppingreport\bin\2.5.0\ShoppingReport.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll
BHO: UrlHelper Class: {74322bf9-df26-493f-b0da-6d2fc5e6429e} - c:\program files\bearshare applications\bearshare mediabar\BearShareIEHelper.dll
BHO: ADC PlugIn: {77dc0baa-3235-4ba9-8be8-aa9eb678fa02} - c:\program files\adc32.dll
BHO: del.icio.us Toolbar Helper: {7aa07ae6-01ef-44ec-93ca-9d7cd41ccdb6} - c:\program files\del.icio.us\internet explorer buttons\dlcsIE.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll
TB: del.icio.us: {981fe6a8-260c-4930-960f-c3bc82746cb0} - c:\program files\del.icio.us\internet explorer buttons\dlcsIE.dll
TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll
TB: {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - No File
TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File
TB: {75CD0BC5-E317-449C-9FF6-4986B3D48F64} - No File
TB: {A8415B7A-F661-4D31-92D7-4398E50483DF} - No File
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
EB: {2AA2FBF8-9C76-4E97-A226-25C5F4AB6358} - No File
EB: ShopperReports: {a7cddcdc-beeb-4685-a062-978f5e07ceee} - c:\program files\shoppingreport\bin\2.5.0\ShoppingReport.dll
uRun: [TOSCDSPD] c:\program files\toshiba\toscdspd\toscdspd.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [DW6] "c:\program files\the weather channel fw\desktop\DesktopWeather.exe "
uRun: [WeatherDPA] "c:\program files\zango\bin\10.3.85.0\Weather.exe" -auto
mRun: [CeEKEY] c:\program files\toshiba\e-key\CeEKey.exe
mRun: [<NO NAME>]
mRun: [CeEPOWER] c:\program files\toshiba\power management\CePMTray.exe
mRun: [TPNF] c:\program files\toshiba\touchpad\TPTray.exe
mRun: [LtMoh] c:\program files\ltmoh\Ltmoh.exe
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun: [PadTouch] c:\program files\toshiba\touch and launch\PadExe.exe
mRun: [NDSTray.exe] NDSTray.exe
mRun: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [pdfFactory Dispatcher v3] "c:\windows\system32\spool\drivers\w32x86\3\fppdis3a.exe" /source=HKLM
mRun: [CFSServ.exe] CFSServ.exe -NoClient
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
mRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler
mRun: [Notebook Maximizer] c:\program files\notebook maximizer\maximizer_startup.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
mRun: [baduvivaf] Rundll32.exe "c:\windows\system32\sazukojo.dll ",a
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ramasst.lnk - c:\windows\system32\RAMASST.exe
IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML
IE: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZLfox000
IE: Add banner url(s) to AdsCleaner - c:\program files\softinform\adscleaner trial\system\scripts\off_banner.htm
IE: Add selected links to Link Container - c:\program files\softinform\adscleaner trial\system\scripts\off_collector_sel.htm
IE: Bookmark all links in AdsCleaner - c:\program files\softinform\adscleaner trial\system\scripts\off_all.htm
IE: Bookmark selected link(s) in AdsCleaner - c:\program files\softinform\adscleaner trial\system\scripts\off_sel.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\canon\easy-webprint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\canon\easy-webprint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\canon\easy-webprint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\canon\easy-webprint\Resource.dll/RC_Print.html
IE: Open all links in new windows - c:\program files\softinform\adscleaner trial\system\scripts\off_open_all.htm
IE: Open selected link(s) in new windows - c:\program files\softinform\adscleaner trial\system\scripts\off_open_sel.htm
IE: Say to AdsCleaner Team about banner - c:\program files\softinform\adscleaner trial\system\scripts\off_report_ad.htm
IE: Show domain links - c:\program files\softinform\adscleaner trial\system\scripts\off_domain_links.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {C5428486-50A0-4a02-9D20-520B59A9F9B2} - {C9CCBB35-D123-4a31-AFFC-9B2933132116} - c:\program files\shoppingreport\bin\2.5.0\ShoppingReport.dll
IE: {C5428486-50A0-4a02-9D20-520B59A9F9B3} - {A16AD1E9-F69A-45af-9462-B1C286708842} - c:\program files\shoppingreport\bin\2.5.0\ShoppingReport.dll
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
DPF: {00000075-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/voxacm.CAB
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll
DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - hxxp://mediaplayer.walmart.com/installer/install.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
TCP: {97EEEBEB-489F-4FE7-AE7F-1580B71EC910} = 8.8.8.8
TCP: {C901AA1B-A5EA-4B64-BAD9-2C35EC6DCEC0} = 8.8.8.8
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Notify: 6c40871f649 - c:\windows\system32\dpwsock32.dll
Notify: novavappk - c:\documents and settings\nick\application data\microsoft\internet explorer\novavappk.dll
Notify: novavappu - c:\documents and settings\nick\application data\microsoft\internet explorer\novavappu.dll
Notify: __c002664A - c:\windows\system32\__c002664A.dat
Notify: __c0038010 - c:\windows\system32\__c0038010.dat
Notify: __c005E7D6 - c:\windows\system32\__c005E7D6.dat
Notify: __c00B29EE - c:\windows\system32\__c00B29EE.dat
AppInit_DLLs: c:\windows\system32\ramobugu.dll c:\windows\system32\suwuwuha.dll c:\windows\system32\lanabiya.dll c:\windows\system32\daholose.dll c:\windows\system32\rifedava.dll c:\windows\system32\gulobimu.dll dapatudi.dll c:\windows\system32\sazukojo.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SSODL: lesavipap - {22269870-a56d-4003-8773-4259afdedff5} - c:\windows\system32\mamotapi.dll
SSODL: votekisan - {1edd9a42-dcba-49ca-ac6f-ce05fbac4cb5} - c:\windows\system32\lanabiya.dll
SSODL: zujuhoruy - {9d5b16b1-cf84-4274-ad4e-ed9243559854} - c:\windows\system32\suwuwuha.dll
SSODL: jorepeped - {5e06ccca-0e44-4b85-9227-52198b5db9d2} - c:\windows\system32\judinoyo.dll
SSODL: tigadogud - {a402461d-bd01-40c5-8beb-2f9e9d1651f4} - c:\windows\system32\judinoyo.dll
SSODL: sakunokef - {f1688076-11e3-4f18-b908-eb3f5e805521} - c:\windows\system32\buzelimi.dll
SSODL: fajopurej - {16728af3-85a8-4c74-bb52-8e97793ef2d2} - c:\windows\system32\lanabiya.dll
SSODL: muramorin - {0fdfc073-d332-4b56-9de4-a6170175c9c3} - c:\windows\system32\pojezija.dll
SSODL: jeyenavar - {b32d96db-ec83-475a-98e8-2e5889174e90} - c:\windows\system32\gulobimu.dll
SSODL: wofupukut - {9c43db43-0cf8-4f7b-abcc-494baca52211} - c:\windows\system32\koriluvo.dll
SSODL: pugumuhaz - {411402a3-1483-4a29-a24c-8dbaaba58d9a} - c:\windows\system32\koriluvo.dll
SSODL: yejazobaj - {52eb6509-017d-4164-bbb2-046eec9424d7} - c:\windows\system32\ramobugu.dll
SSODL: fusagefem - {6fc4d1e8-3f69-4c1c-a841-00a3cbf2c45c} - c:\windows\system32\buzelimi.dll
SSODL: rozizatut - {5e01bc8e-aab3-4ba4-a43c-8ab0d5ce998c} - c:\windows\system32\daholose.dll
SSODL: nowuposip - {37f413cf-fa02-4a63-92a3-4e6587a1fb74} - c:\windows\system32\higewomu.dll
SSODL: hutegeyad - {324b0031-d2e8-4016-8491-d59829ac3423} - c:\windows\system32\rifedava.dll
SSODL: guwasetaz - {c2865c9f-e88e-4880-bc1a-56bca1e85beb} - c:\windows\system32\gulobimu.dll
SSODL: yojugemoy - {9c0119b8-7a3b-4dc5-abfc-c3a137df689e} - c:\windows\system32\gulobimu.dll
SSODL: kadakubij - {d36ea1a8-eed0-4bcc-8a03-9b2b3f1652fd} - c:\windows\system32\higewomu.dll
SSODL: lanotunej - {3fed28dd-de09-4b50-a2ea-1673c1a0753f} - c:\windows\system32\sazukojo.dll
STS: mujuzedij: {22269870-a56d-4003-8773-4259afdedff5} - c:\windows\system32\mamotapi.dll
STS: jugezatag: {1edd9a42-dcba-49ca-ac6f-ce05fbac4cb5} - c:\windows\system32\lanabiya.dll
STS: kupuhivus: {9d5b16b1-cf84-4274-ad4e-ed9243559854} - c:\windows\system32\suwuwuha.dll
STS: jugezatag: {5e06ccca-0e44-4b85-9227-52198b5db9d2} - c:\windows\system32\judinoyo.dll
STS: gahurihor: {a402461d-bd01-40c5-8beb-2f9e9d1651f4} - c:\windows\system32\judinoyo.dll
STS: tokatiluy: {f1688076-11e3-4f18-b908-eb3f5e805521} - c:\windows\system32\buzelimi.dll
STS: tokatiluy: {16728af3-85a8-4c74-bb52-8e97793ef2d2} - c:\windows\system32\lanabiya.dll
STS: kupuhivus: {0fdfc073-d332-4b56-9de4-a6170175c9c3} - c:\windows\system32\pojezija.dll
STS: mujuzedij: {b32d96db-ec83-475a-98e8-2e5889174e90} - c:\windows\system32\gulobimu.dll
STS: jugezatag: {9c43db43-0cf8-4f7b-abcc-494baca52211} - c:\windows\system32\koriluvo.dll
STS: kupuhivus: {411402a3-1483-4a29-a24c-8dbaaba58d9a} - c:\windows\system32\koriluvo.dll
STS: mujuzedij: {52eb6509-017d-4164-bbb2-046eec9424d7} - c:\windows\system32\ramobugu.dll
STS: kupuhivus: {6fc4d1e8-3f69-4c1c-a841-00a3cbf2c45c} - c:\windows\system32\buzelimi.dll
STS: jugezatag: {5e01bc8e-aab3-4ba4-a43c-8ab0d5ce998c} - c:\windows\system32\daholose.dll
STS: jugezatag: {37f413cf-fa02-4a63-92a3-4e6587a1fb74} - c:\windows\system32\higewomu.dll
STS: kupuhivus: {324b0031-d2e8-4016-8491-d59829ac3423} - c:\windows\system32\rifedava.dll
STS: kupuhivus: {c2865c9f-e88e-4880-bc1a-56bca1e85beb} - c:\windows\system32\gulobimu.dll
STS: jugezatag: {9c0119b8-7a3b-4dc5-abfc-c3a137df689e} - c:\windows\system32\gulobimu.dll
STS: tokatiluy: {d36ea1a8-eed0-4bcc-8a03-9b2b3f1652fd} - c:\windows\system32\higewomu.dll
STS: tokatiluy: {3fed28dd-de09-4b50-a2ea-1673c1a0753f} - c:\windows\system32\sazukojo.dll
LSA: Notification Packages = scecli rigiwoti.dll
mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,launchinfsectionex c:\program files\internet explorer\clrtour.inf,DefaultInstall.ResetTour,,12
Hosts: 217.20.175.74 www.review.2009softwarereviews.com
Hosts: 217.20.175.74 review.2009softwarereviews.com
Hosts: 217.20.175.74 a1.review.zdnet.com
Hosts: 217.20.175.74 www.d1.reviews.cnet.com
Hosts: 217.20.175.74 www.reviews.toptenreviews.com
Note: multiple HOSTS entries found. Please refer to Attach.txt

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\nick\applic~1\mozilla\firefox\profiles\4qfn82oz.default\
FF - prefs.js: browser.search.selectedEngine - Answers.com
FF - prefs.js: browser.startup.homepage - hxxp://www.espn.com|http://www.maxpreps.com/league/rlxdEcNC1km9yZzAsWEurA/standings-delta-river.htm
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

pref(dom.disable_open_during_load, true);FF - user.js: yahoo.homepage.dontask - truec:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl3.rsa_seed_sha ", true);

============= SERVICES / DRIVERS ===============

R2 AdbUpd;Adobe Update Service;c:\program files\svchost.exe [2010-4-21 27648]
R2 Symantec Core LC;Symantec Core LC;c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe [2006-10-2 1174152]
S1 eniinqnv;eniinqnv;\??\c:\windows\system32\drivers\eniinqnv.sys --> c:\windows\system32\drivers\eniinqnv.sys [?]
S1 qfanhigm;qfanhigm;\??\c:\windows\system32\drivers\qfanhigm.sys --> c:\windows\system32\drivers\qfanhigm.sys [?]
S4 Ras4322;Ras4322;\??\c:\windows\system32\drivers\brinkfwd.sys --> c:\windows\system32\drivers\brinkfwd.sys [?]

============== File Associations ===============

exefile=c:\program files\alggui.exe "%1" %*

=============== Created Last 30 ================

2010-06-10 18:48:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-06-10 18:48:37 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-06-10 18:48:37 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-06-10 18:48:37 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

==================== Find3M ====================

2010-05-01 16:14:47 41984 ----a-w- c:\windows\system32\nevorefa.dll
2010-04-22 06:03:40 56 ----a-w- c:\program files\wp4.dat
2010-04-22 06:03:40 1 ----a-w- c:\program files\wp3.dat
2010-04-22 06:03:34 970752 ----a-w- c:\program files\adc32.dll
2010-04-22 06:03:34 34304 ----a-w- c:\program files\alggui.exe
2010-04-21 19:11:25 9 ----a-w- c:\program files\nuar.old
2010-04-21 19:11:25 36 ----a-w- c:\program files\skynet.dat
2010-04-21 19:11:17 27648 ----a-w- c:\program files\svchost.exe
2010-04-21 19:10:58 1038856 ----a-w- c:\program files\wpp.exe
2009-01-28 06:15:45 2386985 -c--a-w- c:\program files\tg74pluginsetup.exe
2010-02-13 03:22:30 0 --sh--w- c:\windows\system32\babopeni.dll
1601-01-01 00:03:28 47616 --sha-w- c:\windows\system32\bibepuru.dll
2010-02-03 12:17:39 42496 --sha-w- c:\windows\system32\bikosobu.dll
2010-02-12 02:17:38 57344 --sha-w- c:\windows\system32\dapatudi.dll
2010-02-12 14:36:24 43008 --sha-w- c:\windows\system32\dazuyelu.dll
2010-02-12 02:17:02 57344 --sha-w- c:\windows\system32\deyagehu.dll
1601-01-01 00:03:28 92160 --sha-w- c:\windows\system32\dijipire.dll
2010-01-20 04:56:42 41984 --sha-w- c:\windows\system32\dipakule.dll
1601-01-01 00:03:28 47616 --sha-w- c:\windows\system32\domemaha.dll
1601-01-01 00:03:28 47616 --sha-w- c:\windows\system32\dotewawa.dll
2010-01-09 23:17:26 41984 --sha-w- c:\windows\system32\fajejasi.dll
1601-01-01 00:03:28 47616 --sha-w- c:\windows\system32\fevojeti.dll
2010-01-19 07:27:32 42496 --sha-w- c:\windows\system32\fiyulake.dll
2010-01-21 19:10:16 41984 --sha-w- c:\windows\system32\fopihofu.dll
1601-01-01 00:03:28 48128 --sha-w- c:\windows\system32\fosepoyo.dll
2010-02-12 22:06:58 43008 --sha-w- c:\windows\system32\fosutozi.dll
1601-01-01 00:03:28 101376 --sha-w- c:\windows\system32\gamosiwo.dll
1601-01-01 00:03:28 60928 --sha-w- c:\windows\system32\gelarijo.dll
1601-01-01 00:03:28 101376 --sha-w- c:\windows\system32\gemomume.dll
1601-01-01 00:03:28 39424 --sha-w- c:\windows\system32\godidusa.dll
2009-09-23 19:56:17 1435 --sha-w- c:\windows\system32\GroupPolicy000.dat
1601-01-01 00:03:28 100864 --sha-w- c:\windows\system32\gupabufo.dll
2010-01-18 06:11:04 94720 --sha-w- c:\windows\system32\guromome.dll
2010-02-12 02:16:59 95232 --sha-w- c:\windows\system32\guzapamu.dll
2010-01-07 04:16:08 92160 --sha-w- c:\windows\system32\hebotoje.dll
1601-01-01 00:03:28 100864 --sha-w- c:\windows\system32\hidekeli.dll
2010-01-07 04:16:08 39424 --sha-w- c:\windows\system32\hodujifa.dll
1601-01-01 00:03:28 47616 --sha-w- c:\windows\system32\holuyibi.dll
1601-01-01 00:03:28 101376 --sha-w- c:\windows\system32\hosezora.dll
2010-01-03 00:27:11 39424 --sha-w- c:\windows\system32\jaduzumi.dll
2010-02-17 21:15:04 43008 --sha-w- c:\windows\system32\jeyiniyo.dll
2010-01-19 07:26:53 95232 --sha-w- c:\windows\system32\jimofiji.dll
2010-01-04 22:54:14 39424 --sha-w- c:\windows\system32\jipilere.dll
1601-01-01 00:03:28 47616 --sha-w- c:\windows\system32\jogopamo.dll
1601-01-01 00:03:28 47616 --sha-w- c:\windows\system32\juserolu.dll
2010-02-01 07:53:42 42496 --sha-w- c:\windows\system32\kewowupa.dll
1601-01-01 00:03:28 4096 --sha-w- c:\windows\system32\kihinuga.dll
2010-01-24 09:16:40 95232 --sha-w- c:\windows\system32\kihipapo.dll
2010-02-12 02:17:38 57344 --sha-w- c:\windows\system32\kirenalo.dll
2010-02-02 22:27:22 94720 --sha-w- c:\windows\system32\kiseluzo.dll
2010-01-24 09:16:40 41984 --sha-w- c:\windows\system32\kopurege.dll
2010-02-12 02:17:02 42496 --sha-w- c:\windows\system32\kozezupo.dll
2010-01-06 13:20:06 39424 --sha-w- c:\windows\system32\kozodobe.dll
1601-01-01 00:03:28 512 --sha-w- c:\windows\system32\kufoluru.dll
2010-01-10 11:17:58 41984 --sha-w- c:\windows\system32\kumenelo.dll
2010-01-21 19:10:16 94720 --sha-w- c:\windows\system32\lasobemo.dll
1601-01-01 00:03:28 101376 --sha-w- c:\windows\system32\lawalasi.dll
1601-01-01 00:03:28 100864 --sha-w- c:\windows\system32\lepakifo.dll
2010-01-02 08:08:35 39424 --sha-w- c:\windows\system32\lifigote.dll
1601-01-01 00:03:28 38912 --sha-w- c:\windows\system32\loyayono.dll
1601-01-01 00:03:28 47616 --sha-w- c:\windows\system32\lukumeyo.dll
1601-01-01 00:03:28 101376 --sha-w- c:\windows\system32\luravufa.dll
1601-01-01 00:03:28 70656 --sha-w- c:\windows\system32\memezori.dll
1601-01-01 00:03:28 47616 --sha-w- c:\windows\system32\merunime.dll
2010-02-09 07:57:20 41984 --sha-w- c:\windows\system32\mesekewi.dll
2010-01-18 06:11:05 42496 --sha-w- c:\windows\system32\mibevilo.dll
1601-01-01 00:03:28 47616 --sha-w- c:\windows\system32\mipawefa.dll
1601-01-01 00:03:28 0 --sha-w- c:\windows\system32\miziwiva.dll
2010-01-16 18:32:55 41984 --sha-w- c:\windows\system32\mokehohi.dll
2010-01-04 22:54:14 92160 --sha-w- c:\windows\system32\mutupapo.dll
1601-01-01 00:03:28 47616 --sha-w- c:\windows\system32\nifisito.dll
2010-01-26 02:43:42 42496 --sha-w- c:\windows\system32\nojemete.dll
1601-01-01 00:03:28 101376 --sha-w- c:\windows\system32\nokanoza.dll
1601-01-01 00:03:28 4096 --sha-w- c:\windows\system32\nuyakete.dll
2010-01-03 12:26:55 39424 --sha-w- c:\windows\system32\pavojeha.dll
2010-02-18 23:38:02 43008 --sha-w- c:\windows\system32\pepurudo.dll
1601-01-01 00:03:28 53248 --sha-w- c:\windows\system32\pihenedo.dll
1601-01-01 00:03:28 47616 --sha-w- c:\windows\system32\pofegohu.dll
1601-01-01 00:03:28 38912 --sha-w- c:\windows\system32\rafomife.dll
1601-01-01 00:03:28 47616 --sha-w- c:\windows\system32\rehejizi.dll
2010-02-12 02:17:38 57344 --sha-w- c:\windows\system32\rigiwoti.dll
1601-01-01 00:03:28 47616 --sha-w- c:\windows\system32\riligize.dll
2010-01-06 13:20:06 92160 --sha-w- c:\windows\system32\rimuwuka.dll
1601-01-01 00:03:28 47616 --sha-w- c:\windows\system32\rofogehe.dll
2010-02-14 23:44:36 43008 --sha-w- c:\windows\system32\ruyutave.dll
2010-03-10 18:29:31 97280 --sha-w- c:\windows\system32\sazukojo.dll
2010-02-06 07:55:13 42496 --sha-w- c:\windows\system32\seyijaya.dll
2010-02-10 17:34:19 42496 --sha-w- c:\windows\system32\siruboma.dll
1601-01-01 00:03:28 47616 --sha-w- c:\windows\system32\soziredo.dll
1601-01-01 00:03:28 47104 --sha-w- c:\windows\system32\sulafeta.dll
1601-01-01 00:03:28 48128 --sha-w- c:\windows\system32\telemize.dll
2010-02-01 21:49:49 41984 --sha-w- c:\windows\system32\tesavohi.dll
2010-01-16 18:32:55 95232 --sha-w- c:\windows\system32\timinebe.dll
2010-01-18 18:11:17 41984 --sha-w- c:\windows\system32\tumaveko.dll
2010-01-22 16:28:38 42496 --sha-w- c:\windows\system32\valopawi.dll
2010-02-10 05:06:48 41984 --sha-w- c:\windows\system32\varapaji.dll
1601-01-01 00:03:28 47616 --sha-w- c:\windows\system32\vidajadu.dll
2010-01-11 01:10:25 41984 --sha-w- c:\windows\system32\vopereso.dll
1601-01-01 00:03:28 48128 --sha-w- c:\windows\system32\wefovuzi.dll
1601-01-01 00:03:28 39424 --sha-w- c:\windows\system32\wejeduwa.dll
2010-02-02 10:26:51 94720 --sha-w- c:\windows\system32\wepejapu.dll
2010-01-27 20:04:10 42496 --sha-w- c:\windows\system32\wiwijadu.dll
2010-01-09 23:17:26 94720 --sha-w- c:\windows\system32\wiwunonu.dll
1601-01-01 00:03:28 47616 --sha-w- c:\windows\system32\wojohilu.dll
2010-02-10 17:34:19 94720 --sha-w- c:\windows\system32\wosarako.dll
2010-02-02 22:27:20 41984 --sha-w- c:\windows\system32\wufasugu.dll
2010-02-08 11:19:45 41984 --sha-w- c:\windows\system32\wujeluhe.dll
1601-01-01 00:03:28 47616 --sha-w- c:\windows\system32\yabohoyu.dll
1601-01-01 00:03:28 101376 --sha-w- c:\windows\system32\yaguwune.dll
1601-01-01 00:03:28 93184 --sha-w- c:\windows\system32\yobijowu.dll
2010-01-19 07:26:53 42496 --sha-w- c:\windows\system32\yolefode.dll
1601-01-01 00:03:28 100864 --sha-w- c:\windows\system32\yozuyosa.dll
2010-02-08 11:19:45 94720 --sha-w- c:\windows\system32\yujukumi.dll
2010-02-01 21:49:49 95232 --sha-w- c:\windows\system32\yusawafa.dll
2010-01-01 18:15:39 39424 --sha-w- c:\windows\system32\zarebeba.dll
1601-01-01 00:03:28 47616 --sha-w- c:\windows\system32\zetawose.dll
2010-03-10 18:29:31 64512 --sha-w- c:\windows\system32\zubadira.dll
2010-02-13 03:22:57 0 --sh--w- c:\windows\system32\zuvetowe.dll
2010-03-11 23:00:22 16384 --sha-w- c:\windows\system32\config\systemprofile\ietldcache\index.dat

============= FINISH: 12:08:18.01 ===============

broni · 2010/06/10

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

* Rkill.com
* Rkill.scr
* Rkill.pif
* Rkill.exe

* Double-click on the Rkill desktop icon to run the tool.
* If using Vista or Windows 7 right-click on it and choose Run As Administrator.
* A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
* If not, delete the file, then download and use the one provided in Link 2.
* If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
* Do not reboot until instructed.
* If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run then try to immediately run the following.

Now download and run exeHelper.

* Please download exeHelper from Raktor to your desktop.
* Double-click on exeHelper.com to run the fix.
* A black window should pop up, press any key to close once the fix is completed.
* A log file named log.txt will be created in the directory where you ran exeHelper.com
* Attach the log.txt file to your next message.

Note: If the window shows a message that says "Error deleting file ", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

==============================================================

Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

Close any open browsers.

WARNING: Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt"

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

ntavolario · 2010/06/10

Now searching...

Checking for numerical processes...

Checking for sysguard processes...

Checking for bad processes...

Checking for bad files...

Checking for bad registry entries...

Resetting filetype association for .exe

Resetting filetype association for .com

Resetting userinit and shell values...

Resetting policies...

--Finished--

ntavolario · 2010/06/10

ComboFix 10-06-10.03 - Nick 06/10/2010 14:42:03.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.447.228 [GMT -7:00]
Running from: c:\documents and settings\Nick\My Documents\Downloads\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\All Users\Application Data\N1
c:\documents and settings\All Users\Application Data\ZangoSA
c:\documents and settings\All Users\Application Data\ZangoSA\ZangoSA.dat
c:\documents and settings\All Users\Application Data\ZangoSA\ZangoSA_hpk.dat
c:\documents and settings\All Users\Application Data\ZangoSA\ZangoSA_kyf.dat
c:\documents and settings\All Users\Application Data\ZangoSA\ZangoSAAbout.mht
c:\documents and settings\All Users\Application Data\ZangoSA\ZangoSAau.dat
c:\documents and settings\All Users\Application Data\ZangoSA\ZangoSAEULA.mht
c:\documents and settings\All Users\Start Menu\Programs\Zango
c:\documents and settings\All Users\Start Menu\Programs\Zango\Reset Cursor.lnk
c:\documents and settings\All Users\Start Menu\Programs\Zango\Zango Customer Support Center.lnk
c:\documents and settings\All Users\Start Menu\Programs\Zango\Zango Games!.lnk
c:\documents and settings\All Users\Start Menu\Programs\Zango\Zango Library.lnk
c:\documents and settings\All Users\Start Menu\Programs\Zango\Zango Screensavers!.lnk
c:\documents and settings\All Users\Start Menu\Programs\Zango\Zango Videos!.lnk
c:\documents and settings\LocalService\Desktop\Your PC Protector.lnk
c:\documents and settings\Nick\Application Data\020000008dee5cd4649C.manifest
c:\documents and settings\Nick\Application Data\020000008dee5cd4649O.manifest
c:\documents and settings\Nick\Application Data\020000008dee5cd4649P.manifest
c:\documents and settings\Nick\Application Data\020000008dee5cd4649S.manifest
c:\documents and settings\Nick\Application Data\Microsoft\Internet Explorer\novavappk.exe
c:\documents and settings\Nick\Application Data\Microsoft\Internet Explorer\novavappu.exe
c:\documents and settings\Nick\Application Data\ShoppingReport
c:\documents and settings\Nick\Application Data\ShoppingReport\cs\Config.xml
c:\documents and settings\Nick\Application Data\ShoppingReport\cs\db\Aliases.dbs
c:\documents and settings\Nick\Application Data\ShoppingReport\cs\db\Sites.dbs
c:\documents and settings\Nick\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
c:\documents and settings\Nick\Application Data\ShoppingReport\cs\report\aggr_storage.xml
c:\documents and settings\Nick\Application Data\ShoppingReport\cs\report\send_storage.xml
c:\documents and settings\Nick\Application Data\ShoppingReport\cs\res1\WhiteList.dbs
c:\documents and settings\Nick\Application Data\WeatherDPA
c:\documents and settings\Nick\Application Data\WeatherDPA\Weather\WeatherStartup.xml
c:\documents and settings\Nick\Application Data\Zango
c:\documents and settings\Nick\Desktop\Your PC Protector.lnk
c:\documents and settings\Nick\Start Menu\Programs\Your PC Protector
c:\documents and settings\Nick\Start Menu\Programs\Your PC Protector\Your PC Protector.lnk
C:\Install.exe
c:\program files\adC32.dll
c:\program files\alggui.exe
c:\program files\Anti-Virus Professional
c:\program files\Anti-Virus Professional\noadware4_092509.na
c:\program files\Mozilla Firefox\components\npclntax.xpt
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\History\search3
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\program files\nuar.old
c:\program files\skynet.dat
c:\program files\svchost.exe
c:\program files\wp3.dat
c:\program files\wp4.dat
c:\program files\wpp.exe
c:\windows\GnuHashes.ini
c:\windows\system32\__c0024D89.dat
c:\windows\system32\__c00268C4.dat
c:\windows\system32\__c002C10.dat
c:\windows\system32\__c003588.dat
c:\windows\system32\__c0035E15.dat
c:\windows\system32\__c00372F4.dat
c:\windows\system32\__c0044432.dat
c:\windows\system32\__c0046461.dat
c:\windows\system32\__c0051DFB.dat
c:\windows\system32\__c0068361.dat
c:\windows\system32\__c006EE3F.dat
c:\windows\system32\__c006FC01.dat
c:\windows\system32\__c0071FDA.dat
c:\windows\system32\__c0087016.dat
c:\windows\system32\__c0088574.dat
c:\windows\system32\__c0097E6C.dat
c:\windows\system32\__c0097E8E.dat
c:\windows\system32\__c00BEBC9.dat
c:\windows\system32\__c00C1B19.dat
c:\windows\system32\__c00CAA7.dat
c:\windows\system32\__c00E8359.dat
c:\windows\system32\__c00ED828.dat
c:\windows\system32\__c00EEA41.dat
c:\windows\system32\__c00F2012.dat
c:\windows\system32\__c00FC3E8.dat
c:\windows\system32\__c00FD37E.dat
c:\windows\system32\02TWY68W8IHNZQH.vbs
c:\windows\system32\1.tmp
c:\windows\system32\9AtDv.vbs
c:\windows\system32\bibepuru.dll
c:\windows\system32\bikosobu.dll
c:\windows\system32\dapatudi.dll
c:\windows\system32\dipakule.dll
c:\windows\system32\domemaha.dll
c:\windows\system32\dotewawa.dll
c:\windows\system32\fajejasi.dll
c:\windows\system32\fevojeti.dll
c:\windows\system32\fiyulake.dll
c:\windows\system32\fopihofu.dll
c:\windows\system32\fosepoyo.dll
c:\windows\system32\gelarijo.dll
c:\windows\system32\GroupPolicy000.dat
c:\windows\system32\guromome.dll
c:\windows\system32\guzapamu.dll
c:\windows\system32\hebotoje.dll
c:\windows\system32\hodujifa.dll
c:\windows\system32\holuyibi.dll
c:\windows\system32\jaduzumi.dll
c:\windows\system32\jimofiji.dll
c:\windows\system32\jipilere.dll
c:\windows\system32\jogopamo.dll
c:\windows\system32\juserolu.dll
c:\windows\system32\kewowupa.dll
c:\windows\system32\kihipapo.dll
c:\windows\system32\kiseluzo.dll
c:\windows\system32\kopurege.dll
c:\windows\system32\kozezupo.dll
c:\windows\system32\kozodobe.dll
c:\windows\system32\kufoluru.dll
c:\windows\system32\kumenelo.dll
c:\windows\system32\lasobemo.dll
c:\windows\system32\lifigote.dll
c:\windows\system32\LocalService\305.crack.zip
c:\windows\system32\LocalService\305.crack.zip.kwd
c:\windows\system32\LocalService\306.keygen.zip
c:\windows\system32\LocalService\306.keygen.zip.kwd
c:\windows\system32\LocalService\307.serial.zip
c:\windows\system32\LocalService\307.serial.zip.kwd
c:\windows\system32\LocalService\308.setup.zip
c:\windows\system32\LocalService\308.setup.zip.kwd
c:\windows\system32\LocalService\309.music.au
c:\windows\system32\LocalService\309.music.au.kwd
c:\windows\system32\LocalService\310.music2.au
c:\windows\system32\LocalService\310.music2.au.kwd
c:\windows\system32\LocalService\311.music3.au
c:\windows\system32\LocalService\311.music3.au.kwd
c:\windows\system32\LocalService\312.music4.au
c:\windows\system32\LocalService\312.music4.au.kwd
c:\windows\system32\loyayono.dll
c:\windows\system32\lukumeyo.dll
c:\windows\system32\merunime.dll
c:\windows\system32\mesekewi.dll
c:\windows\system32\mibevilo.dll
c:\windows\system32\mipawefa.dll
c:\windows\system32\mokehohi.dll
c:\windows\system32\mutupapo.dll
c:\windows\system32\nevorefa.dll
c:\windows\system32\nifisito.dll
c:\windows\system32\nojemete.dll
c:\windows\system32\nokanoza.dll
c:\windows\system32\pavojeha.dll
c:\windows\system32\pofegohu.dll
c:\windows\system32\rafomife.dll
c:\windows\system32\rehejizi.dll
c:\windows\system32\rigiwoti.dll
c:\windows\system32\riligize.dll
c:\windows\system32\rimuwuka.dll
c:\windows\system32\rofogehe.dll
c:\windows\system32\sazukojo.dll
c:\windows\system32\seyijaya.dll
c:\windows\system32\siruboma.dll
c:\windows\system32\soziredo.dll
c:\windows\system32\sulafeta.dll
c:\windows\system32\telemize.dll
c:\windows\system32\tesavohi.dll
c:\windows\system32\timinebe.dll
c:\windows\system32\tumaveko.dll
c:\windows\system32\valopawi.dll
c:\windows\system32\varapaji.dll
c:\windows\system32\vidajadu.dll
c:\windows\system32\vopereso.dll
c:\windows\system32\wefovuzi.dll
c:\windows\system32\wejeduwa.dll
c:\windows\system32\wepejapu.dll
c:\windows\system32\wiwijadu.dll
c:\windows\system32\wiwunonu.dll
c:\windows\system32\wojohilu.dll
c:\windows\system32\wosarako.dll
c:\windows\system32\wufasugu.dll
c:\windows\system32\wujeluhe.dll
c:\windows\system32\xVLEpp1Wt0LmNpf.vbs
c:\windows\system32\yabohoyu.dll
c:\windows\system32\yolefode.dll
c:\windows\system32\yujukumi.dll
c:\windows\system32\yusawafa.dll
c:\windows\system32\zarebeba.dll
c:\windows\system32\zetawose.dll
c:\windows\system32\zubadira.dll
c:\windows\Tasks\jagfgekn.job
c:\windows\Tasks\omyddiqo.job

----- BITS: Possible infected sites -----

hxxp://77.74.48.111
Infected copy of c:\windows\system32\drivers\afd.sys was found and disinfected
Restored copy from - Kitty had a snack
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ADBUPD
-------\Service_AdbUpd

((((((((((((((((((((((((( Files Created from 2010-05-10 to 2010-06-10 )))))))))))))))))))))))))))))))
.

2010-06-10 21:53 . 2010-06-10 21:53 88916 ----a-w- c:\documents and settings\Nick\Application Data\Microsoft\Internet Explorer\novavappk.exe
2010-06-10 18:48 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-06-10 18:48 . 2010-06-10 18:51 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-06-10 18:48 . 2010-06-10 18:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-06-10 18:48 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-10 21:53 . 2010-06-10 21:53 81547 ----a-w- c:\documents and settings\Nick\Application Data\Microsoft\Internet Explorer\novavappu.exe
2010-06-03 20:22 . 2010-03-07 14:24 -------- d-----w- c:\documents and settings\Nick\Application Data\vlc
2010-05-10 12:49 . 2010-05-10 12:49 -------- d-----w- c:\program files\Realtek AC97
2010-05-01 13:46 . 2010-05-01 13:46 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-22 06:03 . 2010-04-22 06:03 398514 ----a-w- c:\documents and settings\Nick\Application Data\Microsoft\Internet Explorer\sfx.exe
2010-04-22 05:58 . 2010-04-22 05:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-04-22 05:58 . 2009-09-25 23:57 -------- d-----w- c:\program files\Alwil Software
2010-04-21 19:12 . 2010-04-21 19:12 118784 ----a-w- c:\documents and settings\Nick\Application Data\Microsoft\Internet Explorer\novavappk.dll
2010-04-21 19:12 . 2010-04-21 19:12 110592 ----a-w- c:\documents and settings\Nick\Application Data\Microsoft\Internet Explorer\novavappu.dll
2010-04-14 16:47 . 2010-04-22 05:58 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-04-14 16:47 . 2010-04-22 05:58 153184 ----a-w- c:\windows\system32\aswBoot.exe
2009-01-28 06:15 . 2009-01-28 06:15 2386985 -c--a-w- c:\program files\tg74pluginsetup.exe
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2009-08-16 03:00 . 2009-08-16 03:00 518144 --sha-w- c:\windows\system32\17F.tmp
2009-08-23 02:17 . 2009-08-23 02:17 518144 --sha-w- c:\windows\system32\1D5.tmp
2009-08-27 11:17 . 2009-08-27 11:17 518144 --sha-w- c:\windows\system32\2.tmp
2009-08-05 11:34 . 2009-08-05 11:33 518144 --sha-w- c:\windows\system32\317.tmp
2009-09-07 08:41 . 2009-09-07 08:41 523264 --sha-w- c:\windows\system32\32F.tmp
2009-09-07 08:41 . 2009-09-07 08:41 523264 --sha-w- c:\windows\system32\330.tmp
2009-08-06 07:34 . 2009-08-06 07:34 518144 --sha-w- c:\windows\system32\37E.tmp
2009-08-12 00:35 . 2009-08-11 04:34 518144 --sha-w- c:\windows\system32\52.tmp
2009-08-27 04:45 . 2009-08-27 04:45 518144 --sha-w- c:\windows\system32\925.tmp
2010-02-13 03:22 . 2010-02-13 03:22 0 --sh--w- c:\windows\system32\babopeni.dll
2010-02-12 14:36 . 2010-02-12 14:36 43008 --sha-w- c:\windows\system32\dazuyelu.dll
2010-02-12 02:17 . 2010-02-12 02:17 57344 --sha-w- c:\windows\system32\deyagehu.dll
1601-01-01 00:03 . 1601-01-01 00:03 92160 --sha-w- c:\windows\system32\dijipire.dll
2010-02-12 22:06 . 2010-02-12 22:06 43008 --sha-w- c:\windows\system32\fosutozi.dll
1601-01-01 00:03 . 1601-01-01 00:03 101376 --sha-w- c:\windows\system32\gamosiwo.dll
1601-01-01 00:03 . 1601-01-01 00:03 101376 --sha-w- c:\windows\system32\gemomume.dll
1601-01-01 00:03 . 1601-01-01 00:03 39424 --sha-w- c:\windows\system32\godidusa.dll
1601-01-01 00:03 . 1601-01-01 00:03 100864 --sha-w- c:\windows\system32\gupabufo.dll
1601-01-01 00:03 . 1601-01-01 00:03 100864 --sha-w- c:\windows\system32\hidekeli.dll
1601-01-01 00:03 . 1601-01-01 00:03 101376 --sha-w- c:\windows\system32\hosezora.dll
2010-02-17 21:15 . 2010-02-17 21:15 43008 --sha-w- c:\windows\system32\jeyiniyo.dll
1601-01-01 00:03 . 1601-01-01 00:03 4096 --sha-w- c:\windows\system32\kihinuga.dll
2010-02-12 02:17 . 2010-02-12 02:17 57344 --sha-w- c:\windows\system32\kirenalo.dll
1601-01-01 00:03 . 1601-01-01 00:03 101376 --sha-w- c:\windows\system32\lawalasi.dll
1601-01-01 00:03 . 1601-01-01 00:03 100864 --sha-w- c:\windows\system32\lepakifo.dll
1601-01-01 00:03 . 1601-01-01 00:03 101376 --sha-w- c:\windows\system32\luravufa.dll
1601-01-01 00:03 . 1601-01-01 00:03 60928 --sha-w- c:\windows\system32\majiriho.dll.tmp
1601-01-01 00:03 . 1601-01-01 00:03 70656 --sha-w- c:\windows\system32\memezori.dll
1601-01-01 00:03 . 1601-01-01 00:03 0 --sha-w- c:\windows\system32\miziwiva.dll
1601-01-01 00:03 . 1601-01-01 00:03 4096 --sha-w- c:\windows\system32\nuyakete.dll
2010-02-18 23:38 . 2010-02-18 23:38 43008 --sha-w- c:\windows\system32\pepurudo.dll
1601-01-01 00:03 . 1601-01-01 00:03 53248 --sha-w- c:\windows\system32\pihenedo.dll
2010-02-14 23:44 . 2010-02-14 23:44 43008 --sha-w- c:\windows\system32\ruyutave.dll
1601-01-01 00:03 . 1601-01-01 00:03 60928 --sha-w- c:\windows\system32\tikiyabu.dll.tmp
1601-01-01 00:03 . 1601-01-01 00:03 60928 --sha-w- c:\windows\system32\tubakile.dll.tmp
1601-01-01 00:03 . 1601-01-01 00:03 101376 --sha-w- c:\windows\system32\yaguwune.dll
1601-01-01 00:03 . 1601-01-01 00:03 93184 --sha-w- c:\windows\system32\yobijowu.dll
1601-01-01 00:03 . 1601-01-01 00:03 100864 --sha-w- c:\windows\system32\yozuyosa.dll
2010-02-13 03:22 . 2010-02-13 03:22 0 --sh--w- c:\windows\system32\zuvetowe.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ab384bc0-cf74-49ab-862b-f18c32bca651}]
2010-02-12 02:17 57344 --sha-w- c:\windows\system32\kirenalo.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD "= "c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2003-09-05 65536]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CFSServ.exe "= "CFSServ.exe -NoClient" [X]
"CeEKEY "= "c:\program files\TOSHIBA\E-KEY\CeEKey.exe" [2004-06-14 638976]
"CeEPOWER "= "c:\program files\TOSHIBA\Power Management\CePMTray.exe" [2004-08-20 135168]
"TPNF "= "c:\program files\TOSHIBA\TouchPad\TPTray.exe" [2004-03-15 53248]
"LtMoh "= "c:\program files\ltmoh\Ltmoh.exe" [2003-09-26 184320]
"AGRSMMSG "= "AGRSMMSG.exe" [2004-02-20 88363]
"Apoint "= "c:\program files\Apoint2K\Apoint.exe" [2003-10-30 192512]
"PadTouch "= "c:\program files\TOSHIBA\Touch and Launch\PadExe.exe" [2004-02-03 1089589]
"NDSTray.exe "= "NDSTray.exe" [BU]
"Pinger "= "c:\toshiba\ivp\ism\pinger.exe" [2003-10-20 159744]
"pdfFactory Dispatcher v3 "= "c:\windows\System32\spool\DRIVERS\W32X86\3\fppdis3a.exe" [2007-03-28 503808]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Notebook Maximizer "= "c:\program files\Notebook Maximizer\maximizer_startup.exe" [2004-05-25 28672]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting "= "c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
RAMASST.lnk - c:\windows\system32\RAMASST.exe [2004-8-10 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\novavappk]
2010-04-21 19:12 118784 ----a-w- c:\documents and settings\Nick\Application Data\Microsoft\Internet Explorer\novavappk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\novavappu]
2010-04-21 19:12 110592 ----a-w- c:\documents and settings\Nick\Application Data\Microsoft\Internet Explorer\novavappu.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\WINDOWS\\system32\\java.exe "=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe "=
"c:\\Program Files\\Toshiba\\Power Management\\CeEPwrSvc.exe "=
"c:\\Program Files\\Common Files\\Microsoft Shared\\VS7Debug\\mdm.exe "=
"c:\\Program Files\\Toshiba\\ConfigFree\\CFSServ.exe "=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe "=
"c:\\Program Files\\Yahoo!\\SoftwareUpdate\\YahooAUService.exe "=

S1 eniinqnv;eniinqnv;\??\c:\windows\system32\drivers\eniinqnv.sys --> c:\windows\system32\drivers\eniinqnv.sys [?]
S1 qfanhigm;qfanhigm;\??\c:\windows\system32\drivers\qfanhigm.sys --> c:\windows\system32\drivers\qfanhigm.sys [?]
S4 Ras4322;Ras4322;\??\c:\windows\system32\drivers\brinkfwd.sys --> c:\windows\system32\drivers\brinkfwd.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
vvdsvc REG_MULTI_SZ vvdsvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 11:32 128512 ----a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uLocal Page = \blank.htm
IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
IE: Add banner url(s) to AdsCleaner - c:\program files\SoftInform\AdsCleaner Trial\System\Scripts\off_banner.htm
IE: Add selected links to Link Container - c:\program files\SoftInform\AdsCleaner Trial\System\Scripts\off_collector_sel.htm
IE: Bookmark all links in AdsCleaner - c:\program files\SoftInform\AdsCleaner Trial\System\Scripts\off_all.htm
IE: Bookmark selected link(s) in AdsCleaner - c:\program files\SoftInform\AdsCleaner Trial\System\Scripts\off_sel.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Open all links in new windows - c:\program files\SoftInform\AdsCleaner Trial\System\Scripts\off_open_all.htm
IE: Open selected link(s) in new windows - c:\program files\SoftInform\AdsCleaner Trial\System\Scripts\off_open_sel.htm
IE: Say to AdsCleaner Team about banner - c:\program files\SoftInform\AdsCleaner Trial\System\Scripts\off_report_ad.htm
IE: Show domain links - c:\program files\SoftInform\AdsCleaner Trial\System\Scripts\off_domain_links.htm
TCP: {97EEEBEB-489F-4FE7-AE7F-1580B71EC910} = 8.8.8.8
TCP: {C901AA1B-A5EA-4B64-BAD9-2C35EC6DCEC0} = 8.8.8.8
FF - ProfilePath - c:\documents and settings\Nick\Application Data\Mozilla\Firefox\Profiles\4qfn82oz.default\
FF - prefs.js: browser.search.selectedEngine - Answers.com
FF - prefs.js: browser.startup.homepage - hxxp://www.espn.com|http://www.maxpreps.com/league/rlxdEcNC1km9yZzAsWEurA/standings-delta-river.htm
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

---- FIREFOX POLICIES ----
pref(dom.disable_open_during_load, true);FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
.
- - - - ORPHANS REMOVED - - - -

BHO-{201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\AskBarDis\bar\bin\askBar.dll
BHO-{74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - c:\program files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll
Toolbar-{3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\AskBarDis\bar\bin\askBar.dll
Toolbar-{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - (no file)
WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - c:\program files\AskBarDis\bar\bin\askBar.dll
HKCU-Run-DW6 - c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe
HKLM-Run-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe
HKLM-Run-ISUSPM - c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe
HKLM-Run-baduvivaf - c:\windows\system32\sazukojo.dll
HKLM-Run-jagahuyopu - rigiwoti.dll
SharedTaskScheduler-{22269870-a56d-4003-8773-4259afdedff5} - c:\windows\system32\mamotapi.dll
SharedTaskScheduler-{1edd9a42-dcba-49ca-ac6f-ce05fbac4cb5} - c:\windows\system32\lanabiya.dll
SharedTaskScheduler-{9d5b16b1-cf84-4274-ad4e-ed9243559854} - c:\windows\system32\suwuwuha.dll
SharedTaskScheduler-{5e06ccca-0e44-4b85-9227-52198b5db9d2} - c:\windows\system32\judinoyo.dll
SharedTaskScheduler-{a402461d-bd01-40c5-8beb-2f9e9d1651f4} - c:\windows\system32\judinoyo.dll
SharedTaskScheduler-{f1688076-11e3-4f18-b908-eb3f5e805521} - c:\windows\system32\buzelimi.dll
SharedTaskScheduler-{16728af3-85a8-4c74-bb52-8e97793ef2d2} - c:\windows\system32\lanabiya.dll
SharedTaskScheduler-{0fdfc073-d332-4b56-9de4-a6170175c9c3} - c:\windows\system32\pojezija.dll
SharedTaskScheduler-{b32d96db-ec83-475a-98e8-2e5889174e90} - c:\windows\system32\gulobimu.dll
SharedTaskScheduler-{9c43db43-0cf8-4f7b-abcc-494baca52211} - c:\windows\system32\koriluvo.dll
SharedTaskScheduler-{411402a3-1483-4a29-a24c-8dbaaba58d9a} - c:\windows\system32\koriluvo.dll
SharedTaskScheduler-{52eb6509-017d-4164-bbb2-046eec9424d7} - c:\windows\system32\ramobugu.dll
SharedTaskScheduler-{6fc4d1e8-3f69-4c1c-a841-00a3cbf2c45c} - c:\windows\system32\buzelimi.dll
SharedTaskScheduler-{5e01bc8e-aab3-4ba4-a43c-8ab0d5ce998c} - c:\windows\system32\daholose.dll
SharedTaskScheduler-{37f413cf-fa02-4a63-92a3-4e6587a1fb74} - c:\windows\system32\higewomu.dll
SharedTaskScheduler-{324b0031-d2e8-4016-8491-d59829ac3423} - c:\windows\system32\rifedava.dll
SharedTaskScheduler-{c2865c9f-e88e-4880-bc1a-56bca1e85beb} - c:\windows\system32\gulobimu.dll
SharedTaskScheduler-{9c0119b8-7a3b-4dc5-abfc-c3a137df689e} - c:\windows\system32\gulobimu.dll
SharedTaskScheduler-{d36ea1a8-eed0-4bcc-8a03-9b2b3f1652fd} - c:\windows\system32\higewomu.dll
SharedTaskScheduler-{3fed28dd-de09-4b50-a2ea-1673c1a0753f} - c:\windows\system32\sazukojo.dll
SSODL-lesavipap-{22269870-a56d-4003-8773-4259afdedff5} - c:\windows\system32\mamotapi.dll
SSODL-votekisan-{1edd9a42-dcba-49ca-ac6f-ce05fbac4cb5} - c:\windows\system32\lanabiya.dll
SSODL-zujuhoruy-{9d5b16b1-cf84-4274-ad4e-ed9243559854} - c:\windows\system32\suwuwuha.dll
SSODL-jorepeped-{5e06ccca-0e44-4b85-9227-52198b5db9d2} - c:\windows\system32\judinoyo.dll
SSODL-tigadogud-{a402461d-bd01-40c5-8beb-2f9e9d1651f4} - c:\windows\system32\judinoyo.dll
SSODL-sakunokef-{f1688076-11e3-4f18-b908-eb3f5e805521} - c:\windows\system32\buzelimi.dll
SSODL-fajopurej-{16728af3-85a8-4c74-bb52-8e97793ef2d2} - c:\windows\system32\lanabiya.dll
SSODL-muramorin-{0fdfc073-d332-4b56-9de4-a6170175c9c3} - c:\windows\system32\pojezija.dll
SSODL-jeyenavar-{b32d96db-ec83-475a-98e8-2e5889174e90} - c:\windows\system32\gulobimu.dll
SSODL-wofupukut-{9c43db43-0cf8-4f7b-abcc-494baca52211} - c:\windows\system32\koriluvo.dll
SSODL-pugumuhaz-{411402a3-1483-4a29-a24c-8dbaaba58d9a} - c:\windows\system32\koriluvo.dll
SSODL-yejazobaj-{52eb6509-017d-4164-bbb2-046eec9424d7} - c:\windows\system32\ramobugu.dll
SSODL-fusagefem-{6fc4d1e8-3f69-4c1c-a841-00a3cbf2c45c} - c:\windows\system32\buzelimi.dll
SSODL-rozizatut-{5e01bc8e-aab3-4ba4-a43c-8ab0d5ce998c} - c:\windows\system32\daholose.dll
SSODL-nowuposip-{37f413cf-fa02-4a63-92a3-4e6587a1fb74} - c:\windows\system32\higewomu.dll
SSODL-hutegeyad-{324b0031-d2e8-4016-8491-d59829ac3423} - c:\windows\system32\rifedava.dll
SSODL-guwasetaz-{c2865c9f-e88e-4880-bc1a-56bca1e85beb} - c:\windows\system32\gulobimu.dll
SSODL-yojugemoy-{9c0119b8-7a3b-4dc5-abfc-c3a137df689e} - c:\windows\system32\gulobimu.dll
SSODL-kadakubij-{d36ea1a8-eed0-4bcc-8a03-9b2b3f1652fd} - c:\windows\system32\higewomu.dll
SSODL-lanotunej-{3fed28dd-de09-4b50-a2ea-1673c1a0753f} - c:\windows\system32\sazukojo.dll
Notify-6c40871f649 - c:\windows\System32\dpwsock32.dll
Notify-__c002664A - c:\windows\system32\__c002664A.dat
Notify-__c0038010 - c:\windows\system32\__c0038010.dat
Notify-__c005E7D6 - c:\windows\system32\__c005E7D6.dat
Notify-__c00B29EE - c:\windows\system32\__c00B29EE.dat
AddRemove-Ask Toolbar_is1 - c:\program files\AskBarDis\unins000.exe
AddRemove-Power Scan - c:\program files\Power Scan\uninstall.exe
AddRemove-{B7050CBDB2504B34BC2A9CA0A692CC29} - c:\program files\DivX\DivXWebPlayerUninstall.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-10 14:52
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(596)
c:\documents and settings\Nick\Application Data\Microsoft\Internet Explorer\novavappk.dll
c:\documents and settings\Nick\Application Data\Microsoft\Internet Explorer\novavappu.dll

- - - - - - - > 'explorer.exe'(212)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Toshiba\Power Management\CeEPwrSvc.exe
c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe
c:\windows\system32\DVDRAMSV.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\windows\system32\wscntfy.exe
c:\windows\AGRSMMSG.exe
c:\program files\TOSHIBA\ConfigFree\NDSTray.exe
c:\program files\TOSHIBA\ConfigFree\CFSServ.exe
c:\documents and settings\Nick\Application Data\Microsoft\Internet Explorer\novavappk.exe
c:\documents and settings\Nick\Application Data\Microsoft\Internet Explorer\novavappu.exe
c:\program files\Apoint2K\Apntex.exe
c:\program files\Java\jre6\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2010-06-10 15:01:16 - machine was rebooted
ComboFix-quarantined-files.txt 2010-06-10 22:01

Pre-Run: 3,530,014,720 bytes free
Post-Run: 4,276,572,160 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 731BD33A55886B1E8727C0680832AA03

broni · 2010/06/10

One of the reasons, you have such a heavy infection is a lack of antivirus program.
We'll install one, as soon, as we're done with Combofix.
Make sure, your Windows firewall is on.
Another reason are all P2P programs, you use.
I'm not here to be your judge and what you do with your computer, but using P2P programs without any AV program running is like a suicide.
Do NOT use any of those programs while we're in cleaning process.
If I discover, you do, I'll close this topic.

============================================================

1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code:

File::
c:\documents and settings\Nick\Application Data\Microsoft\Internet Explorer\novavappk.exe
c:\documents and settings\Nick\Application Data\Microsoft\Internet Explorer\novavappu.exe
c:\documents and settings\Nick\Application Data\Microsoft\Internet Explorer\sfx.exe
c:\documents and settings\Nick\Application Data\Microsoft\Internet Explorer\novavappk.dll
c:\documents and settings\Nick\Application Data\Microsoft\Internet Explorer\novavappu.dll
c:\program files\tg74pluginsetup.exe
c:\windows\system32\zuvetowe.dll
c:\windows\system32\yozuyosa.dll
c:\windows\system32\yobijowu.dll
c:\windows\system32\yaguwune.dll
c:\windows\system32\tubakile.dll.tmp
c:\windows\system32\tikiyabu.dll.tmp
c:\windows\system32\ruyutave.dll
c:\windows\system32\pihenedo.dll
c:\windows\system32\pepurudo.dll
c:\windows\system32\nuyakete.dll
c:\windows\system32\miziwiva.dll
c:\windows\system32\memezori.dll
c:\windows\system32\majiriho.dll.tmp
c:\windows\system32\luravufa.dll
c:\windows\system32\lepakifo.dll
c:\windows\system32\lawalasi.dll
c:\windows\system32\kirenalo.dll
c:\windows\system32\kihinuga.dll
c:\windows\system32\jeyiniyo.dll
c:\windows\system32\hosezora.dll
c:\windows\system32\hidekeli.dll
c:\windows\system32\gupabufo.dll
c:\windows\system32\godidusa.dll
c:\windows\system32\gemomume.dll
c:\windows\system32\gamosiwo.dll
c:\windows\system32\fosutozi.dll
c:\windows\system32\dijipire.dll
c:\windows\system32\deyagehu.dll
c:\windows\system32\dazuyelu.dll
c:\windows\system32\babopeni.dll
c:\windows\system32\925.tmp
c:\windows\system32\52.tmp
c:\windows\system32\37E.tmp
c:\windows\system32\330.tmp
c:\windows\system32\32F.tmp
c:\windows\system32\317.tmp
c:\windows\system32\2.tmp
c:\windows\system32\1D5.tmp
c:\windows\system32\17F.tmp
c:\windows\system32\kirenalo.dll
c:\windows\system32\drivers\eniinqnv.sys
c:\windows\system32\drivers\qfanhigm.sys
c:\windows\system32\drivers\brinkfwd.sys


DDS::
TCP: {97EEEBEB-489F-4FE7-AE7F-1580B71EC910} = 8.8.8.8
TCP: {C901AA1B-A5EA-4B64-BAD9-2C35EC6DCEC0} = 8.8.8.8


Driver::
eniinqnv
qfanhigm
Ras4322


Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ab384bc0-cf74-49ab-862b-f18c32bca651}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\novavappk]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\novavappu]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
 "EnableFirewall "=dword:00000001

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[IMG]

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

Log in or Sign up

Inactive corrupted laptop

ntavolario Inactive Thread Starter

broni Moderator Malware Analyst

ntavolario Inactive Thread Starter

ntavolario Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Inactive corrupted laptop

ntavolario Inactive Thread Starter

broni Moderator Malware Analyst

ntavolario Inactive Thread Starter

ntavolario Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Useful Searches