1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved IE random pages

Discussion in 'Malware and Virus Removal Archive' started by KRB, 2010/07/27.

Page 2 of 3
  1. 2010/07/31
    KRB

    KRB Inactive Thread Starter

    Joined:
    2010/07/27
    Messages:
    98
    Likes Received:
    0
    otl log

    OTL logfile created on: 31/07/2010 1:20:10 PM - Run 1
    OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Bahuaud\My Documents\KYLES STUFF\vremove
    Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

    958.00 Mb Total Physical Memory | 431.00 Mb Available Physical Memory | 45.00% Memory free
    2.00 Gb Paging File | 2.00 Gb Available in Paging File | 75.00% Paging File free
    Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 116.45 Gb Total Space | 69.16 Gb Free Space | 59.40% Space Free | Partition Type: NTFS
    Drive D: | 116.44 Gb Total Space | 97.25 Gb Free Space | 83.52% Space Free | Partition Type: NTFS
    E: Drive not present or media not loaded
    F: Drive not present or media not loaded
    G: Drive not present or media not loaded
    H: Drive not present or media not loaded
    I: Drive not present or media not loaded

    Computer Name: BIOCOMPUTER
    Current User Name: Bahuaud
    Logged in as Administrator.

    Current Boot Mode: Normal
    Scan Mode: Current user
    Company Name Whitelist: On
    Skip Microsoft Files: On
    File Age = 90 Days
    Output = Standard
    Quick Scan

    ========== Processes (SafeList) ==========

    PRC - [2010/07/31 13:18:55 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bahuaud\My Documents\KYLES STUFF\vremove\OTL.exe
    PRC - [2010/07/21 08:14:21 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgemc.exe
    PRC - [2010/07/15 08:20:22 | 002,065,760 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exe
    PRC - [2010/07/15 08:20:17 | 000,620,896 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe
    PRC - [2010/07/15 08:20:17 | 000,515,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe
    PRC - [2010/07/15 08:20:14 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe
    PRC - [2010/07/15 08:19:36 | 000,723,296 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe
    PRC - [2010/07/15 08:19:34 | 001,101,152 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe
    PRC - [2010/07/09 14:04:34 | 003,493,776 | ---- | M] (Xfire Inc.) -- C:\Program Files\Xfire\Xfire.exe
    PRC - [2010/06/28 10:20:32 | 001,103,360 | ---- | M] (PrinterAnywhere) -- C:\Program Files\PrinterShare\paConsole.exe
    PRC - [2010/06/17 13:42:17 | 000,353,736 | ---- | M] (IncrediMail, Ltd.) -- C:\Program Files\IncrediMail\Bin\IncMail.exe
    PRC - [2010/06/17 13:42:17 | 000,255,432 | ---- | M] (IncrediMail, Ltd.) -- C:\Program Files\IncrediMail\Bin\ImApp.exe
    PRC - [2010/06/10 21:03:08 | 000,144,176 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    PRC - [2009/10/11 05:17:45 | 000,386,872 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jucheck.exe
    PRC - [2009/08/19 11:23:24 | 007,418,368 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.bin
    PRC - [2009/08/19 11:23:22 | 007,424,000 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.exe
    PRC - [2009/05/19 12:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    PRC - [2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
    PRC - [2007/02/12 17:43:44 | 000,065,536 | ---- | M] (O2Micro International) -- C:\Program Files\O2Micro Oz128 Driver\o2flash.exe
    PRC - [2005/03/14 13:05:02 | 000,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe


    ========== Modules (SafeList) ==========

    MOD - [2010/07/31 13:18:55 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bahuaud\My Documents\KYLES STUFF\vremove\OTL.exe
    MOD - [2010/07/09 14:04:44 | 000,970,640 | ---- | M] (Xfire Inc.) -- C:\Program Files\Xfire\xfire_toucan_43094.dll
    MOD - [2008/04/13 19:12:10 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wsock32.dll
    MOD - [2008/04/13 19:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx
    MOD - [2003/02/21 05:42:22 | 000,348,160 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msvcr71.dll


    ========== Win32 Services (SafeList) ==========

    SRV - [2010/07/21 08:14:21 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgemc.exe -- (avg9emc)
    SRV - [2010/07/15 08:20:14 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
    SRV - [2010/06/10 21:03:08 | 000,144,176 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
    SRV - [2010/05/06 18:28:00 | 003,596,528 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\WINDOWS\System32\GameMon.des -- (npggsvc)
    SRV - [2009/05/19 12:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
    SRV - [2007/02/12 17:43:44 | 000,065,536 | ---- | M] (O2Micro International) [Auto | Running] -- C:\Program Files\O2Micro Oz128 Driver\o2flash.exe -- (o2flash)
    SRV - [2005/03/14 13:05:02 | 000,069,632 | ---- | M] (HP) [Auto | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)


    ========== Driver Services (SafeList) ==========

    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
    DRV - [2010/07/15 08:20:20 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX)
    DRV - [2010/07/15 08:19:36 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86)
    DRV - [2010/06/02 08:11:56 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86)
    DRV - [2008/04/13 11:36:05 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
    DRV - [2007/04/16 22:46:00 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdPPM.sys -- (AmdPPM)
    DRV - [2006/07/24 17:15:04 | 004,353,024 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
    DRV - [2006/05/09 16:50:00 | 003,535,680 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
    DRV - [2006/03/03 16:31:04 | 000,013,056 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
    DRV - [2006/03/03 16:31:02 | 000,034,176 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
    DRV - [2005/12/06 12:20:50 | 000,241,664 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
    DRV - [2005/12/06 12:20:42 | 000,670,208 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSX_CNXT.sys -- (winachsx)
    DRV - [2005/12/06 12:20:40 | 000,936,448 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSX_DP.sys -- (HSX_DP)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========


    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.ca/
    IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

    ========== FireFox ==========

    FF - prefs.js..browser.search.defaultenginename: "MyStart Search "
    FF - prefs.js..browser.search.defaultthis.engineName: "XfireXO Customized Web Search "
    FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2304157&SearchSource=3&q={searchTerms} "
    FF - prefs.js..browser.search.selectedEngine: "Google "
    FF - prefs.js..browser.search.useDBForOrder: true
    FF - prefs.js..browser.startup.homepage: "http://www.google.ca/firefox?client=firefox-a&rls=org.mozilla:en-US:eek:fficial "
    FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.2
    FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.845
    FF - prefs.js..extensions.enabledItems: avg@igeared:4.504.019.002
    FF - prefs.js..extensions.enabledItems: ietab@ip.cn:1.63.20091024
    FF - prefs.js..extensions.enabledItems: downintab@max.max:0.0.9
    FF - prefs.js..extensions.enabledItems: {1018e4d6-728f-4b20-ad56-37578a4de76b}:3.3.19
    FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
    FF - prefs.js..extensions.enabledItems: {66E978CD-981F-47DF-AC42-E3CF417C1467}:0.4.1
    FF - prefs.js..extensions.enabledItems: imagetab@next.gen.nz:1.1
    FF - prefs.js..extensions.enabledItems: savesession@noasobi.net:1.3.1.6
    FF - prefs.js..extensions.enabledItems: {7A074BE0-2326-436d-B473-029FAEBEB5C6}:1.1.3
    FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20091028
    FF - prefs.js..keyword.URL: "http://mystart.incredimail.com/?loc=ff_address_bar_im2_test_v2&search= "

    FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/07/21 08:16:10 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared [2010/05/27 17:33:03 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/27 04:03:56 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/27 04:03:56 | 000,000,000 | ---D | M]

    [2010/04/22 13:17:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Extensions
    [2010/04/22 13:17:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Extensions\mozswing@mozswing.org
    [2010/07/30 02:08:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\extensions
    [2010/01/04 01:41:03 | 000,000,000 | ---D | M] (Flagfox) -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
    [2010/01/03 00:45:31 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    [2010/01/04 01:49:16 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}-trash
    [2010/01/04 01:41:03 | 000,000,000 | ---D | M] (New Tab Homepage) -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\extensions\{66E978CD-981F-47DF-AC42-E3CF417C1467}
    [2010/01/04 01:41:01 | 000,000,000 | ---D | M] (Tab Saver!) -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\extensions\{7A074BE0-2326-436d-B473-029FAEBEB5C6}
    [2010/01/03 15:33:23 | 000,000,000 | ---D | M] (WOT) -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
    [2010/01/03 15:33:23 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
    [2010/01/04 01:41:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\extensions\downintab@max.max
    [2010/01/04 01:41:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\extensions\ietab@ip.cn
    [2010/01/04 01:41:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\extensions\imagetab@next.gen.nz
    [2010/01/04 01:41:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\extensions\savesession@noasobi.net
    [2010/06/17 13:41:57 | 000,002,149 | ---- | M] () -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\searchplugins\MyStart Search.xml
    [2010/01/02 23:33:58 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

    O1 HOSTS File: ([2010/07/30 06:21:16 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
    O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
    O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
    O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
    O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
    O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
    O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
    O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
    O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
    O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
    O4 - HKLM..\Run: [KernelFaultCheck] File not found
    O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
    O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
    O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
    O4 - HKCU..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe (IncrediMail, Ltd.)
    O4 - HKCU..\Run: [PrinterShare] C:\Program Files\PrinterShare\paConsole.exe (PrinterAnywhere)
    O4 - HKCU..\Run: [SmileboxTray] C:\Documents and Settings\Bahuaud\Application Data\Smilebox\SmileboxTray.exe (Smilebox, Inc.)
    O4 - Startup: C:\Documents and Settings\Bahuaud\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
    O4 - Startup: C:\Documents and Settings\Bahuaud\Start Menu\Programs\Startup\Xfire.lnk = C:\Program Files\Xfire\Xfire.exe (Xfire Inc.)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-48D9-9B0E-1719D1177202/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1262282538093 (WUWebControl Class)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
    O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} http://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab (DDRevision Class)
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
    O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab (Minesweeper Flags Class)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
    O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
    O24 - Desktop WallPaper: C:\Documents and Settings\Bahuaud\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O24 - Desktop BackupWallPaper: C:\Documents and Settings\Bahuaud\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2009/12/31 01:38:43 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = comfile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: 6to4 - File not found
    NetSvcs: Ias - File not found
    NetSvcs: Iprip - File not found
    NetSvcs: Irmon - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: WmdmPmSp - File not found

    Drivers32: aux - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
    Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
    Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)
    Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
    Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
    Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)
    Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)
    Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)
    Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)
    Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation)
    Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)
    Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)
    Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
    Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
    Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
    Drivers32: vidc.I420 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
    Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
    Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
    Drivers32: vidc.iyuv - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)
    Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation)
    Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
    Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)
    Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)
    Drivers32: vidc.uyvy - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
    Drivers32: VIDC.XFR1 - C:\WINDOWS\System32\xfcodec.dll ()
    Drivers32: vidc.yuy2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
    Drivers32: vidc.yvu9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)
    Drivers32: vidc.yvyu - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
    Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
    Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)

    CREATERESTOREPOINT
    Error starting restore point: System Restore is disabled.
    Error closing restore point: System Restore is disabled.

    ========== Files/Folders - Created Within 90 Days ==========

    [2010/07/31 13:07:24 | 000,000,000 | --SD | C] -- C:\ComboFix
    [2010/07/31 01:26:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\CSC
    [2010/07/30 23:36:47 | 000,000,000 | -HSD | C] -- C:\RECYCLER
    [2010/07/29 14:24:30 | 000,000,000 | RHSD | C] -- C:\cmdcons
    [2010/07/29 14:05:44 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
    [2010/07/29 14:02:28 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
    [2010/07/27 19:37:50 | 000,000,000 | ---D | C] -- C:\Program Files\PrinterShare
    [2010/07/27 05:02:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bahuaud\Application Data\Malwarebytes
    [2010/07/27 05:02:41 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
    [2010/07/27 05:02:40 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2010/07/27 05:02:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    [2010/07/27 05:02:39 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2010/07/27 04:13:28 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
    [2010/07/27 04:13:00 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
    [2010/07/27 04:13:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
    [2010/07/27 04:02:38 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
    [2010/07/27 03:56:35 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
    [2010/07/23 12:52:18 | 003,596,528 | ---- | C] (INCA Internet Co., Ltd.) -- C:\WINDOWS\System32\GameMon.des
    [2010/07/23 12:51:39 | 000,004,682 | ---- | C] (INCA Internet Co., Ltd.) -- C:\WINDOWS\System32\npptNT2.sys
    [2010/07/23 12:50:33 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\INCA Shared
    [2010/07/22 23:13:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
    [2010/07/22 23:13:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
    [2010/07/22 23:01:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bahuaud\Application Data\6C9FE140494AFBD8666C1E543F54F786
    [2010/07/15 08:20:17 | 000,012,536 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
    [2010/06/28 15:01:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Blizzard Entertainment
    [2010/06/20 01:18:32 | 000,000,000 | ---D | C] -- C:\Strip Kittens Demo
    [2010/06/20 00:25:53 | 000,000,000 | ---D | C] -- C:\WINDOWS\Logs
    [2010/06/08 10:11:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bahuaud\Local Settings\Application Data\Smilebox
    [2010/06/08 10:10:59 | 000,000,000 | ---D | C] -- C:\Program Files\Smilebox
    [2010/06/08 10:10:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bahuaud\Application Data\Smilebox
    [2010/05/31 22:48:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bahuaud\Desktop\sturgeon creek
    [2010/05/24 16:20:32 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
    [2010/05/07 02:46:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PhotoMail
    [2010/05/07 02:46:43 | 000,000,000 | ---D | C] -- C:\Program Files\PhotoMail Maker
    [2010/05/05 12:26:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bahuaud\Application Data\Webroot
    [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
    [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

    ========== Files - Modified Within 90 Days ==========

    [2010/07/31 13:10:19 | 000,043,531 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
    [2010/07/31 13:10:06 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
    [2010/07/31 13:10:05 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2010/07/31 13:09:11 | 003,932,160 | -H-- | M] () -- C:\Documents and Settings\Bahuaud\NTUSER.DAT
    [2010/07/31 13:09:11 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Bahuaud\ntuser.ini
    [2010/07/31 13:08:57 | 003,770,056 | -H-- | M] () -- C:\Documents and Settings\Bahuaud\Local Settings\Application Data\IconCache.db
    [2010/07/31 09:02:55 | 062,797,073 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
    [2010/07/31 02:51:29 | 000,000,426 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{92D47641-43EB-461A-B2A8-17FB1147D5B3}.job
    [2010/07/31 01:37:51 | 000,000,552 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat
    [2010/07/30 06:21:26 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
    [2010/07/30 06:21:16 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
    [2010/07/30 01:23:41 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2010/07/29 14:24:38 | 000,000,279 | RHS- | M] () -- C:\boot.ini
    [2010/07/27 04:14:34 | 000,001,804 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
    [2010/07/26 20:42:03 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    [2010/07/25 19:08:29 | 000,056,320 | ---- | M] () -- C:\Documents and Settings\Bahuaud\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2010/07/25 17:24:44 | 000,000,104 | ---- | M] () -- C:\Documents and Settings\Bahuaud\Desktop\settings.ini
    [2010/07/22 23:02:28 | 000,000,150 | ---- | M] () -- C:\zrpt.xml
    [2010/07/18 00:28:40 | 000,000,751 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\World of Warcraft.lnk
    [2010/07/15 08:20:20 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys
    [2010/07/15 08:20:17 | 000,012,536 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
    [2010/07/15 08:19:36 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys
    [2010/07/09 14:04:40 | 000,041,872 | ---- | M] () -- C:\WINDOWS\System32\xfcodec.dll
    [2010/07/04 03:04:05 | 000,503,480 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
    [2010/07/04 03:04:05 | 000,442,466 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
    [2010/07/04 03:04:05 | 000,071,732 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
    [2010/06/17 13:43:03 | 000,001,750 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\IncrediMail.lnk
    [2010/06/17 13:43:03 | 000,001,736 | ---- | M] () -- C:\Documents and Settings\Bahuaud\Application Data\Microsoft\Internet Explorer\Quick Launch\IncrediMail 2.0.lnk
    [2010/06/15 23:22:58 | 000,000,656 | ---- | M] () -- C:\Documents and Settings\Bahuaud\Application Data\Microsoft\Internet Explorer\Quick Launch\Xfire.lnk
    [2010/06/15 23:22:58 | 000,000,650 | ---- | M] () -- C:\Documents and Settings\Bahuaud\Start Menu\Programs\Startup\Xfire.lnk
    [2010/06/15 05:27:53 | 000,000,268 | ---- | M] () -- C:\Documents and Settings\Bahuaud\Application Data\Microsoft\Internet Explorer\Quick Launch\Coca-Cola Ltd. - Coca-Cola in Canada.url
    [2010/06/13 05:27:57 | 000,118,952 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2010/06/13 03:44:49 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
    [2010/06/08 10:10:32 | 000,001,931 | ---- | M] () -- C:\Documents and Settings\Bahuaud\Desktop\Smilebox.lnk
    [2010/06/08 10:10:32 | 000,001,909 | ---- | M] () -- C:\Documents and Settings\Bahuaud\Application Data\Microsoft\Internet Explorer\Quick Launch\Smilebox.lnk
    [2010/06/02 08:11:56 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys
    [2010/05/06 18:28:00 | 003,596,528 | ---- | M] (INCA Internet Co., Ltd.) -- C:\WINDOWS\System32\GameMon.des
    [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
    [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2010/07/31 01:37:51 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
    [2010/07/29 14:24:37 | 000,000,209 | ---- | C] () -- C:\Boot.bak
    [2010/07/29 14:24:33 | 000,260,272 | ---- | C] () -- C:\cmldr
    [2010/07/27 04:14:34 | 000,001,804 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
    [2010/07/23 12:51:39 | 000,005,174 | ---- | C] () -- C:\WINDOWS\System32\nppt9x.vxd
    [2010/07/22 23:02:27 | 000,000,150 | ---- | C] () -- C:\zrpt.xml
    [2010/07/09 14:04:40 | 000,041,872 | ---- | C] () -- C:\WINDOWS\System32\xfcodec.dll
    [2010/06/15 23:22:58 | 000,000,656 | ---- | C] () -- C:\Documents and Settings\Bahuaud\Application Data\Microsoft\Internet Explorer\Quick Launch\Xfire.lnk
    [2010/06/15 05:27:53 | 000,000,268 | ---- | C] () -- C:\Documents and Settings\Bahuaud\Application Data\Microsoft\Internet Explorer\Quick Launch\Coca-Cola Ltd. - Coca-Cola in Canada.url
    [2010/06/08 10:10:32 | 000,001,931 | ---- | C] () -- C:\Documents and Settings\Bahuaud\Desktop\Smilebox.lnk
    [2010/06/08 10:10:32 | 000,001,909 | ---- | C] () -- C:\Documents and Settings\Bahuaud\Application Data\Microsoft\Internet Explorer\Quick Launch\Smilebox.lnk
    [2010/01/03 00:59:32 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\hpzids01.dll
    [2009/12/31 02:31:25 | 000,000,537 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
    [2009/12/31 02:17:53 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
    [2009/12/31 02:04:20 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
    [2006/05/09 16:50:00 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
    [2006/05/09 16:50:00 | 001,466,368 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
    [2006/05/09 16:50:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
    [2006/05/09 16:50:00 | 000,573,440 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
    [2006/05/09 16:50:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
    [2006/05/09 16:50:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
    [2006/05/09 16:50:00 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
    [2005/08/05 15:01:54 | 000,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
    [2001/07/06 17:30:00 | 000,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini

    ========== LOP Check ==========

    [2010/07/25 19:07:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
    [2010/07/24 10:02:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
    [2010/01/02 22:34:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IM
    [2010/01/02 22:33:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IncrediMail
    [2010/01/28 17:47:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
    [2010/05/07 02:46:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PhotoMail
    [2010/07/27 19:37:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PrinterShare
    [2010/07/27 04:14:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
    [2010/01/03 14:10:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
    [2010/07/23 03:04:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\6C9FE140494AFBD8666C1E543F54F786
    [2010/01/03 13:17:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\AVG9
    [2010/01/16 00:30:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\BarGenie
    [2010/03/03 22:37:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\Facebook
    [2010/01/05 03:49:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\Notepad++
    [2009/12/31 19:22:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\OpenOffice.org
    [2010/07/01 02:30:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\Smilebox
    [2010/01/16 03:24:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\TapiRex
    [2009/12/31 02:21:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\WinBatch
    [2010/07/31 02:51:29 | 000,000,426 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{92D47641-43EB-461A-B2A8-17FB1147D5B3}.job

    ========== Purity Check ==========



    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.* >
    [2009/12/31 01:38:43 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
    [2009/12/31 01:21:59 | 000,000,209 | ---- | M] () -- C:\Boot.bak
    [2010/07/29 14:24:38 | 000,000,279 | RHS- | M] () -- C:\boot.ini
    [2004/08/03 23:00:00 | 000,260,272 | ---- | M] () -- C:\cmldr
    [2010/07/30 06:25:51 | 000,019,744 | ---- | M] () -- C:\ComboFix.txt
    [2009/12/31 01:38:43 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
    [2009/12/31 01:38:43 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
    [2009/12/31 01:38:43 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
    [2004/08/10 07:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
    [2009/12/31 13:45:04 | 000,250,048 | RHS- | M] () -- C:\ntldr
    [2010/07/31 13:10:03 | 1509,949,440 | -HS- | M] () -- C:\pagefile.sys
    [2010/07/22 23:02:28 | 000,000,150 | ---- | M] () -- C:\zrpt.xml

    < %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
    [2008/07/06 07:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
    [2005/10/14 23:41:46 | 000,072,192 | ---- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp43a.dll

    < %systemroot%\system32\*.wt >

    < %systemroot%\system32\*.ruy >

    < %systemroot%\Fonts\*.com >
    [2006/04/18 16:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
    [2006/06/29 15:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
    [2006/04/18 16:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
    [2006/06/29 15:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

    < %systemroot%\*. /mp /s >


    < %systemroot%\system32\*.dll /lockedfiles >
    [2008/04/13 19:11:51 | 001,267,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\comsvcs.dll
    [2009/03/08 05:31:44 | 000,348,160 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtmsft.dll
    [2009/03/08 05:31:38 | 000,216,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtrans.dll
    [2010/05/06 05:41:50 | 000,184,320 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\iepeers.dll
    [1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

    < %systemroot%\Tasks\*.job /lockedfiles >

    < %systemroot%\System32\config\*.sav >
    [2009/12/30 18:03:52 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
    [2009/12/30 18:03:52 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
    [2009/12/30 18:03:52 | 000,913,408 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

    < %systemroot%\system32\user32.dll /md5 >
    [2008/04/13 19:12:08 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B -- C:\WINDOWS\system32\user32.dll
    [1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

    < %systemroot%\system32\ws2_32.dll /md5 >
    [2008/04/13 19:12:10 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A -- C:\WINDOWS\system32\ws2_32.dll
    [1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

    < %systemroot%\system32\ws2help.dll /md5 >
    [2008/04/13 19:12:10 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=9789E95E1D88EEB4B922BF3EA7779C28 -- C:\WINDOWS\system32\ws2help.dll
    [1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

    ========== Alternate Data Streams ==========

    @Alternate Data Stream - 88 bytes -> C:\Documents and Settings\Bahuaud\Desktop\falling sand.exe:SummaryInformation
    < End of report >
     
    KRB,
    #21
  2. 2010/07/31
    KRB

    KRB Inactive Thread Starter

    Joined:
    2010/07/27
    Messages:
    98
    Likes Received:
    0
    extras.txt



    OTL Extras logfile created on: 31/07/2010 1:20:10 PM - Run 1
    OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Bahuaud\My Documents\KYLES STUFF\vremove
    Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

    958.00 Mb Total Physical Memory | 431.00 Mb Available Physical Memory | 45.00% Memory free
    2.00 Gb Paging File | 2.00 Gb Available in Paging File | 75.00% Paging File free
    Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 116.45 Gb Total Space | 69.16 Gb Free Space | 59.40% Space Free | Partition Type: NTFS
    Drive D: | 116.44 Gb Total Space | 97.25 Gb Free Space | 83.52% Space Free | Partition Type: NTFS
    E: Drive not present or media not loaded
    F: Drive not present or media not loaded
    G: Drive not present or media not loaded
    H: Drive not present or media not loaded
    I: Drive not present or media not loaded

    Computer Name: BIOCOMPUTER
    Current User Name: Bahuaud
    Logged in as Administrator.

    Current Boot Mode: Normal
    Scan Mode: Current user
    Company Name Whitelist: On
    Skip Microsoft Files: On
    File Age = 90 Days
    Output = Standard
    Quick Scan

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

    [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
    .html [@ = htmlfile] -- Reg Error: Key error. File not found

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    exefile [open] -- "%1" %*
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1 "
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "FirstRunDisabled" = 1
    "AntiVirusDisableNotify" = 0
    "FirewallDisableNotify" = 0
    "UpdatesDisableNotify" = 0
    "AntiVirusOverride" = 0
    "FirewallOverride" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "EnableFirewall" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
    "139:TCP" = 139:TCP:*:Enabled:mad:xpsp2res.dll,-22004
    "445:TCP" = 445:TCP:*:Enabled:mad:xpsp2res.dll,-22005
    "137:UDP" = 137:UDP:*:Enabled:mad:xpsp2res.dll,-22001
    "138:UDP" = 138:UDP:*:Enabled:mad:xpsp2res.dll,-22002
    "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
    "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22008
    "10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 1
    "DoNotAllowExceptions" = 0
    "DisableNotifications" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
    "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
    "139:TCP" = 139:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22004
    "445:TCP" = 445:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22005
    "137:UDP" = 137:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22001
    "138:UDP" = 138:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22002
    "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22008
    "10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "3776:UDP" = 3776:UDP:*:Enabled:Media Center Extender Service
    "3390:TCP" = 3390:TCP:*:Enabled:Remote Media Center Experience

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
    "C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\Program Files\IncrediMail\Bin\IncMail.exe" = C:\Program Files\IncrediMail\Bin\IncMail.exe:*:Enabled:IncrediMail -- (IncrediMail, Ltd.)
    "C:\Program Files\IncrediMail\Bin\ImApp.exe" = C:\Program Files\IncrediMail\Bin\ImApp.exe:*:Enabled:IncrediMail -- (IncrediMail, Ltd.)
    "C:\Program Files\IncrediMail\Bin\ImpCnt.exe" = C:\Program Files\IncrediMail\Bin\ImpCnt.exe:*:Enabled:IncrediMail -- (IncrediMail, Ltd.)
    "C:\Program Files\Hp\Digital Imaging\bin\hpofxm08.exe" = C:\Program Files\Hp\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe -- (Hewlett-Packard Co.)
    "C:\Program Files\Hp\Digital Imaging\bin\hposfx08.exe" = C:\Program Files\Hp\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe -- (Hewlett-Packard Co.)
    "C:\Program Files\Hp\Digital Imaging\bin\hposid01.exe" = C:\Program Files\Hp\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)
    "C:\Program Files\Hp\Digital Imaging\bin\hpqCopy.exe" = C:\Program Files\Hp\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe -- (Hewlett-Packard Co.)
    "C:\Program Files\Hp\Digital Imaging\bin\hpfccopy.exe" = C:\Program Files\Hp\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe -- (Hewlett-Packard)
    "C:\Program Files\Hp\Digital Imaging\bin\hpzwiz01.exe" = C:\Program Files\Hp\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe -- (Hewlett-Packard Co.)
    "C:\Program Files\Hp\Digital Imaging\Unload\HpqPhUnl.exe" = C:\Program Files\Hp\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe -- ()
    "C:\Program Files\Hp\Digital Imaging\Unload\HpqDIA.exe" = C:\Program Files\Hp\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe -- ( )
    "C:\Program Files\Hp\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\Hp\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.)
    "C:\Program Files\AVG\AVG9\avgemc.exe" = C:\Program Files\AVG\AVG9\avgemc.exe:*:Enabled:avgemc.exe -- (AVG Technologies CZ, s.r.o.)
    "C:\Program Files\AVG\AVG9\avgupd.exe" = C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe -- (AVG Technologies CZ, s.r.o.)
    "C:\Program Files\AVG\AVG9\avgnsx.exe" = C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe -- (AVG Technologies CZ, s.r.o.)
    "C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
    "C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)
    "C:\WINDOWS\ehome\ehshell.exe" = C:\WINDOWS\ehome\ehshell.exe:LocalSubNet:Enabled:Media Center -- (Microsoft Corporation)
    "C:\Program Files\Xfire\Xfire.exe" = C:\Program Files\Xfire\Xfire.exe:*:Enabled:Xfire -- (Xfire Inc.)
    "C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
    "C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
    "C:\Program Files\PrinterShare\paConsole.exe" = C:\Program Files\PrinterShare\paConsole.exe:*:Enabled:printerAnywhere Console -- (PrinterAnywhere)
    "C:\Program Files\World of Warcraft\Launcher.exe" = C:\Program Files\World of Warcraft\Launcher.exe:*:Enabled:Launcher.exe -- (Blizzard Entertainment)
    "C:\Program Files\World of Warcraft\WoW-3.1.3.9947-to-3.2.0.10192-enUS-downloader.exe" = C:\Program Files\World of Warcraft\WoW-3.1.3.9947-to-3.2.0.10192-enUS-downloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment)
    "C:\Program Files\PrinterShare\paProgress.exe" = C:\Program Files\PrinterShare\paProgress.exe:*:Enabled:paProgress -- ()


    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{05C56753-F144-44BC-BA67-83CC5DBF395C}" = F300
    "{0BF5FBE7-3907-4A1F-9E48-8B66E52850D6}" = TrayApp
    "{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
    "{15382D89-6EF6-4D21-9484-B500F2B10E46}" = PhotoMail Maker
    "{18DB3375-0649-4EA3-959A-44F1ACD278BA}" = IncrediMail
    "{1E1F1E70-14D8-4380-8652-BD1A895A7D65}" = Status
    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
    "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
    "{23B35809-5E4A-4F14-8332-1CDEDDFAC089}" = CP_Package_Variety2
    "{23FE964A-853B-4176-86D7-9E18B5CA1FC0}" = Media Center Extender
    "{24BEBF2E-73F3-4599-840B-EDC612CCDD0D}" = Destinations
    "{25D7AAE3-280A-4F3B-B72E-E1AEFCFFBFE5}_is1" = TapiRex Reverse Lookup Plugin for WhitePages.ca® 1.7.2
    "{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 17
    "{31263605-FC84-4787-B847-BA445B147E24}" = ScannerCopy
    "{34F3FCF1-817B-4D61-B6AF-19D9486AFEA0}" = Unload
    "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
    "{3AC54383-31D1-4907-961B-B12CBB1D0AE8}" = MobileMe Control Panel
    "{3D9892BB-A751-4E48-ADC8-E4289956CE1D}" = QuickTime
    "{4041C245-7099-4C96-9738-5EBC23827B3C}" = BufferChm
    "{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
    "{4BE53DB2-C1F2-44D1-A9AB-1630BA7F2AF1}" = SolutionCenter
    "{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack
    "{4CCC7F68-A437-4559-A840-F5E010934951}" = HP Driver Diagnostics
    "{522D1D79-9C0A-4361-91F8-2AFF8EC6C2E1}" = CP_Package_Variety1
    "{534BC2A7-2E38-4860-AE7E-1147BCAF34E5}" = PrinterShare 2.3.03
    "{6421F085-1FAA-DE13-D02A-CFB412C522A4}" = Acrobat.com
    "{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
    "{68763C27-235D-4165-A961-FDEA228CE504}" = AiOSoftwareNPI
    "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
    "{71D9B000-CD43-4DE9-9729-49434415B8F7}" = F300Trb
    "{736C803C-DD3B-4015-BC51-AFB9E67B9076}" = Readme
    "{78764173-3805-4916-B3CE-B433702B8870}" = O2Micro Flash Memory Card Reader Driver Installer(x86)
    "{79F41FC6-07F9-47C2-BBAC-37C7C70EE703}" = MCEBrowser
    "{7E7B7865-6C80-4373-8BC1-C2EB9431F9DE}" = ProductContextNPI
    "{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
    "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
    "{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
    "{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
    "{91F7F3F3-CE80-48C3-8327-7D24A0A5716A}" = iTunes
    "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{995F1E2E-F542-4310-8E1D-9926F5A279B3}" = Windows Live Toolbar
    "{9BB4B566-590C-4A07-9302-61E374BD48C1}" = BarGenie
    "{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
    "{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
    "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
    "{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
    "{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
    "{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.1
    "{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support
    "{B57F2FF0-5A25-4332-B503-4592B370C02F}" = CP_Package_Variety3
    "{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
    "{BF4E9ED0-EF26-4A4C-A123-6A6A1ABEE411}" = DocProc
    "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
    "{C6812939-B117-48E6-A3BA-1709C14A3C8C}" = Scan
    "{C8753E28-2680-49BF-BD48-DD38FD086EFE}" = AiO_Scan_CDA
    "{C98E8D9D-21DE-4F87-A9B7-142BB89840FC}" = Toolbox
    "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
    "{D7CAE58E-26DE-49B7-A75D-EAEDF76726BE}" = HP Photosmart Essential
    "{DEBB2986-15B0-4D28-95FA-5C966A396589}" = HPProductAssistant
    "{E5966E4C-0A93-4F59-A981-BD3173D4799F}" = F300_Help
    "{E5A8DDAB-AE80-48C6-A75B-D0FAB83B299D}" = HP PSC & OfficeJet 6.1.A
    "{E6B87DC4-2B3D-4483-ADFF-E483BF718991}" = OpenOffice.org 3.1
    "{EC2715CE-C182-483C-84CC-81D7D914CF14}" = WebReg
    "{ECFDD6BD-E0C0-41CC-A171-E6D6AF4C0E93}" = HP Software Update
    "{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
    "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
    "{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
    "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
    "{F6076EF9-08E1-442F-B6A2-BFB61B295A14}" = Fax_CDA
    "{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
    "{FBB980B0-63F8-4B48-8D65-90F1D9F81D9F}" = NewCopy_CDA
    "Adobe AIR" = Adobe AIR
    "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
    "AVG9Uninstall" = AVG Free 9.0
    "CCleaner" = CCleaner
    "CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1" = Data Fax SoftModem with SmartCP
    "com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
    "EHome Devices" = Media Center Extender
    "HP Imaging Device Functions" = HP Imaging Device Functions 6.1
    "HP Solution Center & Imaging Support Tools" = HP Solution Center and Imaging Support Tools 6.1
    "ie8" = Windows Internet Explorer 8
    "IncrediMail" = IncrediMail 2.0
    "IrfanView" = IrfanView (remove only)
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
    "Messenger Plus! Live" = Messenger Plus! Live
    "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "Mozilla Firefox (3.5.7)" = Mozilla Firefox (3.5.7)
    "MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
    "Notepad++" = Notepad++
    "NVIDIA Drivers" = NVIDIA Drivers
    "PhotoMail" = PhotoMail Maker
    "Tweak UI 2.10" = Tweak UI
    "Windows Media Format Runtime" = Windows Media Format 11 runtime
    "Windows Media Player" = Windows Media Player 11
    "Windows XP Service Pack" = Windows XP Service Pack 3
    "WinGimp-2.0_is1" = GIMP 2.6.4
    "WinLiveSuite_Wave3" = Windows Live Essentials
    "WinRAR archiver" = WinRAR archiver
    "WMFDist11" = Windows Media Format 11 runtime
    "wmp11" = Windows Media Player 11
    "World of Warcraft" = World of Warcraft
    "Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
    "Xfire" = Xfire (remove only)

    ========== HKEY_CURRENT_USER Uninstall List ==========

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "Facebook Plug-In" = Facebook Plug-In
    "Smilebox" = Smilebox

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 24/03/2010 10:33:28 PM | Computer Name = BIOCOMPUTER | Source = Application Hang | ID = 1002
    Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
    hungapp, version 0.0.0.0, hang address 0x00000000.

    Error - 24/03/2010 10:33:28 PM | Computer Name = BIOCOMPUTER | Source = Application Hang | ID = 1002
    Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
    hungapp, version 0.0.0.0, hang address 0x00000000.

    Error - 26/03/2010 5:39:48 PM | Computer Name = BIOCOMPUTER | Source = Application Error | ID = 1000
    Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting
    module flash10d.ocx, version 10.0.42.34, fault address 0x00076afa.

    Error - 26/03/2010 5:51:54 PM | Computer Name = BIOCOMPUTER | Source = Application Hang | ID = 1002
    Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
    hungapp, version 0.0.0.0, hang address 0x00000000.

    Error - 10/04/2010 9:15:14 PM | Computer Name = BIOCOMPUTER | Source = Application Hang | ID = 1002
    Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
    hungapp, version 0.0.0.0, hang address 0x00000000.

    Error - 31/05/2010 5:47:06 PM | Computer Name = BIOCOMPUTER | Source = WindowsLiveMessenger | ID = 15728647
    Description =

    Error - 01/06/2010 12:08:23 AM | Computer Name = BIOCOMPUTER | Source = Application Error | ID = 1000
    Description = Faulting application wmpnetwk.exe, version 11.0.5721.5145, faulting
    module kernel32.dll, version 5.1.2600.5781, fault address 0x00012afb.

    Error - 01/06/2010 12:32:14 AM | Computer Name = BIOCOMPUTER | Source = Application Hang | ID = 1002
    Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
    hungapp, version 0.0.0.0, hang address 0x00000000.

    Error - 01/06/2010 1:09:58 AM | Computer Name = BIOCOMPUTER | Source = Application Hang | ID = 1002
    Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
    hungapp, version 0.0.0.0, hang address 0x00000000.

    Error - 01/06/2010 1:17:31 AM | Computer Name = BIOCOMPUTER | Source = Application Hang | ID = 1002
    Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
    hungapp, version 0.0.0.0, hang address 0x00000000.

    [ System Events ]
    Error - 02/02/2010 11:54:58 PM | Computer Name = BIOCOMPUTER | Source = Service Control Manager | ID = 7009
    Description = Timeout (30000 milliseconds) waiting for the AVG9IDSAgent service
    to connect.

    Error - 02/02/2010 11:54:58 PM | Computer Name = BIOCOMPUTER | Source = Service Control Manager | ID = 7000
    Description = The AVG9IDSAgent service failed to start due to the following error:
    %%1053

    Error - 02/02/2010 11:54:58 PM | Computer Name = BIOCOMPUTER | Source = Service Control Manager | ID = 7000
    Description = The AVG Firewall service failed to start due to the following error:
    %%2

    Error - 06/02/2010 12:58:50 AM | Computer Name = BIOCOMPUTER | Source = Dhcp | ID = 1002
    Description = The IP address lease 192.168.0.100 for the Network Card with network
    address 0018F3A67D91 has been denied by the DHCP server 192.168.0.1 (The DHCP Server
    sent a DHCPNACK message).

    Error - 07/02/2010 2:23:04 AM | Computer Name = BIOCOMPUTER | Source = Dhcp | ID = 1002
    Description = The IP address lease 192.168.0.100 for the Network Card with network
    address 0018F3A67D91 has been denied by the DHCP server 192.168.0.1 (The DHCP Server
    sent a DHCPNACK message).

    Error - 08/02/2010 4:34:51 AM | Computer Name = BIOCOMPUTER | Source = Dhcp | ID = 1002
    Description = The IP address lease 192.168.0.100 for the Network Card with network
    address 0018F3A67D91 has been denied by the DHCP server 192.168.0.1 (The DHCP Server
    sent a DHCPNACK message).

    Error - 09/02/2010 6:48:27 AM | Computer Name = BIOCOMPUTER | Source = Dhcp | ID = 1002
    Description = The IP address lease 192.168.0.100 for the Network Card with network
    address 0018F3A67D91 has been denied by the DHCP server 192.168.0.1 (The DHCP Server
    sent a DHCPNACK message).

    Error - 10/02/2010 10:26:39 PM | Computer Name = BIOCOMPUTER | Source = Dhcp | ID = 1002
    Description = The IP address lease 192.168.0.100 for the Network Card with network
    address 0018F3A67D91 has been denied by the DHCP server 192.168.0.1 (The DHCP Server
    sent a DHCPNACK message).

    Error - 14/02/2010 2:11:00 AM | Computer Name = BIOCOMPUTER | Source = Dhcp | ID = 1002
    Description = The IP address lease 192.168.0.100 for the Network Card with network
    address 0018F3A67D91 has been denied by the DHCP server 192.168.0.1 (The DHCP Server
    sent a DHCPNACK message).

    Error - 16/02/2010 11:40:04 PM | Computer Name = BIOCOMPUTER | Source = Dhcp | ID = 1002
    Description = The IP address lease 192.168.0.100 for the Network Card with network
    address 0018F3A67D91 has been denied by the DHCP server 192.168.0.1 (The DHCP Server
    sent a DHCPNACK message).


    < End of report >
     
    KRB,
    #22


  3. to hide this advert.

  4. 2010/07/31
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Update your Java version: http://java.com/en/download/index.jsp

    Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

    Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

    Now, we'll remove old Java installations...

    Please download JavaRa to your desktop and unzip it to its own folder
    • Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
    • Accept any prompts.

    =============================================================

    Run OTL
    • Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following

      Code:
      :OTL
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\Bahuaud\Desktop\falling sand.exe:SummaryInformation

:Services

:Reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 "EnableFirewall" =dword:00000001


:Files

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
    • Then click the [color= "#FF0000"]Run Fix[/color] button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.
    • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
     
    broni,
    #23
  5. 2010/07/31
    KRB

    KRB Inactive Thread Starter

    Joined:
    2010/07/27
    Messages:
    98
    Likes Received:
    0
    I will run OTL Runfix after i post this

    what are we doing to falling sand?
    @Alternate Data Stream - 88 bytes -> C:\Documents and Settings\Bahuaud\Desktop\falling sand.exe:SummaryInformation

    after I run otl runfix for the quick scan one do i just open it and click quick scan? or is the a custom fix to add to it aswell?

    running otl runfix now
     
    KRB,
    #24
  6. 2010/08/01
    KRB

    KRB Inactive Thread Starter

    Joined:
    2010/07/27
    Messages:
    98
    Likes Received:
    0
    otl runfix log

    All processes killed
    ========== OTL ==========
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\AppleSyncNotifier deleted successfully.
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe moved successfully.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\KernelFaultCheck deleted successfully.
    Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
    C:\WINDOWS\Downloaded Program Files\gp.inf not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    C:\WINDOWS\002963_.tmp deleted successfully.
    C:\WINDOWS\SET3.tmp deleted successfully.
    C:\WINDOWS\SET4.tmp deleted successfully.
    C:\WINDOWS\SET8.tmp deleted successfully.
    C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
    ADS C:\Documents and Settings\Bahuaud\Desktop\falling sand.exe:SummaryInformation deleted successfully.
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\\ "EnableFirewall" |dword:00000001 /E : value set successfully!
    ========== FILES ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Antivir Nov 2009

    User: Bahuaud
    ->Temp folder emptied: 19466801 bytes
    ->Temporary Internet Files folder emptied: 35343399 bytes
    ->Java cache emptied: 37616044 bytes
    ->FireFox cache emptied: 55701599 bytes
    ->Flash cache emptied: 374316 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes
    ->Flash cache emptied: 41620 bytes

    User: LocalService
    ->Temp folder emptied: 65748 bytes
    ->Temporary Internet Files folder emptied: 32902 bytes

    User: MCX1
    ->Temp folder emptied: 1480512 bytes
    ->Temporary Internet Files folder emptied: 641959 bytes
    ->Flash cache emptied: 42054 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 884870 bytes
    ->Flash cache emptied: 4537 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 81920 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 34318 bytes
    RecycleBin emptied: 293376 bytes

    Total Files Cleaned = 145.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Antivir Nov 2009

    User: Bahuaud
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: LocalService

    User: MCX1
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.9.1 log created on 07312010_235524

    Files\Folders moved on Reboot...
    File\Folder C:\WINDOWS\temp\Perflib_Perfdata_5c8.dat not found!

    Registry entries deleted on Reboot...
     
    KRB,
    #25
  7. 2010/08/01
    KRB

    KRB Inactive Thread Starter

    Joined:
    2010/07/27
    Messages:
    98
    Likes Received:
    0
    otl quick scan log is below the dotted line (just reopened otl and clicked quick scan)
    i noticed in the log below combofix is still mentioned is that susposed to be there?

    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)


    -----------

    OTL logfile created on: 01/08/2010 12:03:53 AM - Run 2
    OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Bahuaud\My Documents\KYLES STUFF\vremove
    Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

    958.00 Mb Total Physical Memory | 401.00 Mb Available Physical Memory | 42.00% Memory free
    2.00 Gb Paging File | 2.00 Gb Available in Paging File | 74.00% Paging File free
    Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 116.45 Gb Total Space | 69.29 Gb Free Space | 59.50% Space Free | Partition Type: NTFS
    Drive D: | 116.44 Gb Total Space | 97.25 Gb Free Space | 83.52% Space Free | Partition Type: NTFS
    E: Drive not present or media not loaded
    F: Drive not present or media not loaded
    G: Drive not present or media not loaded
    H: Drive not present or media not loaded
    I: Drive not present or media not loaded

    Computer Name: BIOCOMPUTER
    Current User Name: Bahuaud
    Logged in as Administrator.

    Current Boot Mode: Normal
    Scan Mode: Current user
    Company Name Whitelist: On
    Skip Microsoft Files: On
    File Age = 90 Days
    Output = Standard
    Quick Scan

    ========== Processes (SafeList) ==========

    PRC - [2010/07/31 13:18:55 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bahuaud\My Documents\KYLES STUFF\vremove\OTL.exe
    PRC - [2010/07/21 08:14:21 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgemc.exe
    PRC - [2010/07/15 08:20:22 | 002,065,760 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exe
    PRC - [2010/07/15 08:20:17 | 000,620,896 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe
    PRC - [2010/07/15 08:20:17 | 000,515,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe
    PRC - [2010/07/15 08:20:14 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe
    PRC - [2010/07/15 08:19:36 | 000,723,296 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe
    PRC - [2010/07/15 08:19:34 | 001,101,152 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe
    PRC - [2010/07/09 14:04:34 | 003,493,776 | ---- | M] (Xfire Inc.) -- C:\Program Files\Xfire\Xfire.exe
    PRC - [2010/06/28 10:20:32 | 001,103,360 | ---- | M] (PrinterAnywhere) -- C:\Program Files\PrinterShare\paConsole.exe
    PRC - [2010/06/17 13:42:17 | 000,353,736 | ---- | M] (IncrediMail, Ltd.) -- C:\Program Files\IncrediMail\Bin\IncMail.exe
    PRC - [2010/06/17 13:42:17 | 000,255,432 | ---- | M] (IncrediMail, Ltd.) -- C:\Program Files\IncrediMail\Bin\ImApp.exe
    PRC - [2010/06/10 21:03:08 | 000,144,176 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    PRC - [2010/05/20 04:11:04 | 000,304,448 | ---- | M] (Smilebox, Inc.) -- C:\Documents and Settings\Bahuaud\Application Data\Smilebox\SmileboxTray.exe
    PRC - [2009/08/19 11:23:24 | 007,418,368 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.bin
    PRC - [2009/08/19 11:23:22 | 007,424,000 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.exe
    PRC - [2009/05/19 12:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    PRC - [2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
    PRC - [2007/02/12 17:43:44 | 000,065,536 | ---- | M] (O2Micro International) -- C:\Program Files\O2Micro Oz128 Driver\o2flash.exe
    PRC - [2005/03/14 13:05:02 | 000,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe


    ========== Modules (SafeList) ==========

    MOD - [2010/07/31 13:18:55 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bahuaud\My Documents\KYLES STUFF\vremove\OTL.exe
    MOD - [2010/07/09 14:04:44 | 000,970,640 | ---- | M] (Xfire Inc.) -- C:\Program Files\Xfire\xfire_toucan_43094.dll
    MOD - [2008/04/13 19:12:10 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wsock32.dll
    MOD - [2008/04/13 19:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx
    MOD - [2003/02/21 05:42:22 | 000,348,160 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msvcr71.dll


    ========== Win32 Services (SafeList) ==========

    SRV - [2010/07/21 08:14:21 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgemc.exe -- (avg9emc)
    SRV - [2010/07/15 08:20:14 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
    SRV - [2010/06/10 21:03:08 | 000,144,176 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
    SRV - [2010/05/06 18:28:00 | 003,596,528 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\WINDOWS\System32\GameMon.des -- (npggsvc)
    SRV - [2009/05/19 12:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
    SRV - [2007/02/12 17:43:44 | 000,065,536 | ---- | M] (O2Micro International) [Auto | Running] -- C:\Program Files\O2Micro Oz128 Driver\o2flash.exe -- (o2flash)
    SRV - [2005/03/14 13:05:02 | 000,069,632 | ---- | M] (HP) [Auto | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)


    ========== Driver Services (SafeList) ==========

    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
    DRV - [2010/07/15 08:20:20 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX)
    DRV - [2010/07/15 08:19:36 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86)
    DRV - [2010/06/02 08:11:56 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86)
    DRV - [2008/04/13 11:36:05 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
    DRV - [2007/04/16 22:46:00 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdPPM.sys -- (AmdPPM)
    DRV - [2006/07/24 17:15:04 | 004,353,024 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
    DRV - [2006/05/09 16:50:00 | 003,535,680 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
    DRV - [2006/03/03 16:31:04 | 000,013,056 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
    DRV - [2006/03/03 16:31:02 | 000,034,176 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
    DRV - [2005/12/06 12:20:50 | 000,241,664 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
    DRV - [2005/12/06 12:20:42 | 000,670,208 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSX_CNXT.sys -- (winachsx)
    DRV - [2005/12/06 12:20:40 | 000,936,448 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSX_DP.sys -- (HSX_DP)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========


    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.ca/
    IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

    ========== FireFox ==========

    FF - prefs.js..browser.search.defaultenginename: "MyStart Search "
    FF - prefs.js..browser.search.defaultthis.engineName: "XfireXO Customized Web Search "
    FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2304157&SearchSource=3&q={searchTerms} "
    FF - prefs.js..browser.search.selectedEngine: "Google "
    FF - prefs.js..browser.search.useDBForOrder: true
    FF - prefs.js..browser.startup.homepage: "http://www.google.ca/firefox?client=firefox-a&rls=org.mozilla:en-US:eek:fficial "
    FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.2
    FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.845
    FF - prefs.js..extensions.enabledItems: avg@igeared:4.504.019.002
    FF - prefs.js..extensions.enabledItems: ietab@ip.cn:1.63.20091024
    FF - prefs.js..extensions.enabledItems: downintab@max.max:0.0.9
    FF - prefs.js..extensions.enabledItems: {1018e4d6-728f-4b20-ad56-37578a4de76b}:3.3.19
    FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
    FF - prefs.js..extensions.enabledItems: {66E978CD-981F-47DF-AC42-E3CF417C1467}:0.4.1
    FF - prefs.js..extensions.enabledItems: imagetab@next.gen.nz:1.1
    FF - prefs.js..extensions.enabledItems: savesession@noasobi.net:1.3.1.6
    FF - prefs.js..extensions.enabledItems: {7A074BE0-2326-436d-B473-029FAEBEB5C6}:1.1.3
    FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20091028
    FF - prefs.js..keyword.URL: "http://mystart.incredimail.com/?loc=ff_address_bar_im2_test_v2&search= "

    FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/07/21 08:16:10 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared [2010/05/27 17:33:03 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/27 04:03:56 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/31 23:48:26 | 000,000,000 | ---D | M]

    [2010/04/22 13:17:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Extensions
    [2010/04/22 13:17:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Extensions\mozswing@mozswing.org
    [2010/07/30 02:08:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\extensions
    [2010/01/04 01:41:03 | 000,000,000 | ---D | M] (Flagfox) -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
    [2010/01/03 00:45:31 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    [2010/01/04 01:49:16 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}-trash
    [2010/01/04 01:41:03 | 000,000,000 | ---D | M] (New Tab Homepage) -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\extensions\{66E978CD-981F-47DF-AC42-E3CF417C1467}
    [2010/01/04 01:41:01 | 000,000,000 | ---D | M] (Tab Saver!) -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\extensions\{7A074BE0-2326-436d-B473-029FAEBEB5C6}
    [2010/01/03 15:33:23 | 000,000,000 | ---D | M] (WOT) -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
    [2010/01/03 15:33:23 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
    [2010/01/04 01:41:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\extensions\downintab@max.max
    [2010/01/04 01:41:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\extensions\ietab@ip.cn
    [2010/01/04 01:41:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\extensions\imagetab@next.gen.nz
    [2010/01/04 01:41:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\extensions\savesession@noasobi.net
    [2010/06/17 13:41:57 | 000,002,149 | ---- | M] () -- C:\Documents and Settings\Bahuaud\Application Data\Mozilla\Firefox\Profiles\gmxg6yvr.default\searchplugins\MyStart Search.xml
    [2010/07/31 23:48:27 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
    [2010/07/31 23:48:27 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
    [2010/07/17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

    O1 HOSTS File: ([2010/07/30 06:21:16 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
    O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
    O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
    O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
    O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
    O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
    O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
    O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
    O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
    O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
    O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
    O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
    O4 - HKCU..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe (IncrediMail, Ltd.)
    O4 - HKCU..\Run: [PrinterShare] C:\Program Files\PrinterShare\paConsole.exe (PrinterAnywhere)
    O4 - HKCU..\Run: [SmileboxTray] C:\Documents and Settings\Bahuaud\Application Data\Smilebox\SmileboxTray.exe (Smilebox, Inc.)
    O4 - Startup: C:\Documents and Settings\Bahuaud\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
    O4 - Startup: C:\Documents and Settings\Bahuaud\Start Menu\Programs\Startup\Xfire.lnk = C:\Program Files\Xfire\Xfire.exe (Xfire Inc.)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-48D9-9B0E-1719D1177202/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1262282538093 (WUWebControl Class)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
    O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} http://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab (DDRevision Class)
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
    O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab (Minesweeper Flags Class)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
    O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
    O24 - Desktop WallPaper: C:\Documents and Settings\Bahuaud\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O24 - Desktop BackupWallPaper: C:\Documents and Settings\Bahuaud\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2009/12/31 01:38:43 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = comfile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    ========== Files/Folders - Created Within 90 Days ==========

    [2010/07/31 23:55:24 | 000,000,000 | ---D | C] -- C:\_OTL
    [2010/07/31 23:48:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun
    [2010/07/31 23:48:46 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
    [2010/07/31 13:07:24 | 000,000,000 | --SD | C] -- C:\ComboFix
    [2010/07/31 01:26:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\CSC
    [2010/07/30 23:36:47 | 000,000,000 | -HSD | C] -- C:\RECYCLER
    [2010/07/29 14:24:30 | 000,000,000 | RHSD | C] -- C:\cmdcons
    [2010/07/29 14:05:44 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
    [2010/07/29 14:02:28 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
    [2010/07/27 19:37:50 | 000,000,000 | ---D | C] -- C:\Program Files\PrinterShare
    [2010/07/27 05:02:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bahuaud\Application Data\Malwarebytes
    [2010/07/27 05:02:41 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
    [2010/07/27 05:02:40 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2010/07/27 05:02:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    [2010/07/27 05:02:39 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2010/07/27 04:13:28 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
    [2010/07/27 04:13:00 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
    [2010/07/27 04:13:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
    [2010/07/27 04:02:38 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
    [2010/07/27 03:56:35 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
    [2010/07/23 12:52:18 | 003,596,528 | ---- | C] (INCA Internet Co., Ltd.) -- C:\WINDOWS\System32\GameMon.des
    [2010/07/23 12:51:39 | 000,004,682 | ---- | C] (INCA Internet Co., Ltd.) -- C:\WINDOWS\System32\npptNT2.sys
    [2010/07/23 12:50:33 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\INCA Shared
    [2010/07/22 23:13:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
    [2010/07/22 23:13:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
    [2010/07/22 23:01:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bahuaud\Application Data\6C9FE140494AFBD8666C1E543F54F786
    [2010/07/15 08:20:17 | 000,012,536 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
    [2010/06/28 15:01:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Blizzard Entertainment
    [2010/06/20 01:18:32 | 000,000,000 | ---D | C] -- C:\Strip Kittens Demo
    [2010/06/20 00:25:53 | 000,000,000 | ---D | C] -- C:\WINDOWS\Logs
    [2010/06/08 10:11:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bahuaud\Local Settings\Application Data\Smilebox
    [2010/06/08 10:10:59 | 000,000,000 | ---D | C] -- C:\Program Files\Smilebox
    [2010/06/08 10:10:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bahuaud\Application Data\Smilebox
    [2010/05/31 22:48:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bahuaud\Desktop\sturgeon creek
    [2010/05/24 16:20:32 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
    [2010/05/07 02:46:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PhotoMail
    [2010/05/07 02:46:43 | 000,000,000 | ---D | C] -- C:\Program Files\PhotoMail Maker
    [2010/05/05 12:26:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bahuaud\Application Data\Webroot

    ========== Files - Modified Within 90 Days ==========

    [2010/07/31 23:58:14 | 000,043,531 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
    [2010/07/31 23:57:04 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
    [2010/07/31 23:57:02 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2010/07/31 23:56:15 | 003,932,160 | -H-- | M] () -- C:\Documents and Settings\Bahuaud\NTUSER.DAT
    [2010/07/31 23:56:15 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Bahuaud\ntuser.ini
    [2010/07/31 18:51:55 | 062,815,507 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
    [2010/07/31 13:08:57 | 003,770,056 | -H-- | M] () -- C:\Documents and Settings\Bahuaud\Local Settings\Application Data\IconCache.db
    [2010/07/31 02:51:29 | 000,000,426 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{92D47641-43EB-461A-B2A8-17FB1147D5B3}.job
    [2010/07/31 01:37:51 | 000,000,552 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat
    [2010/07/30 06:21:26 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
    [2010/07/30 06:21:16 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
    [2010/07/30 01:23:41 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2010/07/29 14:24:38 | 000,000,279 | RHS- | M] () -- C:\boot.ini
    [2010/07/27 04:14:34 | 000,001,804 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
    [2010/07/26 20:42:03 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    [2010/07/25 19:08:29 | 000,056,320 | ---- | M] () -- C:\Documents and Settings\Bahuaud\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2010/07/25 17:24:44 | 000,000,104 | ---- | M] () -- C:\Documents and Settings\Bahuaud\Desktop\settings.ini
    [2010/07/22 23:02:28 | 000,000,150 | ---- | M] () -- C:\zrpt.xml
    [2010/07/18 00:28:40 | 000,000,751 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\World of Warcraft.lnk
    [2010/07/15 08:20:20 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys
    [2010/07/15 08:20:17 | 000,012,536 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
    [2010/07/15 08:19:36 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys
    [2010/07/09 14:04:40 | 000,041,872 | ---- | M] () -- C:\WINDOWS\System32\xfcodec.dll
    [2010/07/04 03:04:05 | 000,503,480 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
    [2010/07/04 03:04:05 | 000,442,466 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
    [2010/07/04 03:04:05 | 000,071,732 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
    [2010/06/17 13:43:03 | 000,001,750 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\IncrediMail.lnk
    [2010/06/17 13:43:03 | 000,001,736 | ---- | M] () -- C:\Documents and Settings\Bahuaud\Application Data\Microsoft\Internet Explorer\Quick Launch\IncrediMail 2.0.lnk
    [2010/06/15 23:22:58 | 000,000,656 | ---- | M] () -- C:\Documents and Settings\Bahuaud\Application Data\Microsoft\Internet Explorer\Quick Launch\Xfire.lnk
    [2010/06/15 23:22:58 | 000,000,650 | ---- | M] () -- C:\Documents and Settings\Bahuaud\Start Menu\Programs\Startup\Xfire.lnk
    [2010/06/15 05:27:53 | 000,000,268 | ---- | M] () -- C:\Documents and Settings\Bahuaud\Application Data\Microsoft\Internet Explorer\Quick Launch\Coca-Cola Ltd. - Coca-Cola in Canada.url
    [2010/06/13 05:27:57 | 000,118,952 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2010/06/13 03:44:49 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
    [2010/06/08 10:10:32 | 000,001,931 | ---- | M] () -- C:\Documents and Settings\Bahuaud\Desktop\Smilebox.lnk
    [2010/06/08 10:10:32 | 000,001,909 | ---- | M] () -- C:\Documents and Settings\Bahuaud\Application Data\Microsoft\Internet Explorer\Quick Launch\Smilebox.lnk
    [2010/06/02 08:11:56 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys
    [2010/05/06 18:28:00 | 003,596,528 | ---- | M] (INCA Internet Co., Ltd.) -- C:\WINDOWS\System32\GameMon.des

    ========== Files Created - No Company Name ==========

    [2010/07/31 01:37:51 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
    [2010/07/29 14:24:37 | 000,000,209 | ---- | C] () -- C:\Boot.bak
    [2010/07/29 14:24:33 | 000,260,272 | ---- | C] () -- C:\cmldr
    [2010/07/27 04:14:34 | 000,001,804 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
    [2010/07/23 12:51:39 | 000,005,174 | ---- | C] () -- C:\WINDOWS\System32\nppt9x.vxd
    [2010/07/22 23:02:27 | 000,000,150 | ---- | C] () -- C:\zrpt.xml
    [2010/07/09 14:04:40 | 000,041,872 | ---- | C] () -- C:\WINDOWS\System32\xfcodec.dll
    [2010/06/15 23:22:58 | 000,000,656 | ---- | C] () -- C:\Documents and Settings\Bahuaud\Application Data\Microsoft\Internet Explorer\Quick Launch\Xfire.lnk
    [2010/06/15 05:27:53 | 000,000,268 | ---- | C] () -- C:\Documents and Settings\Bahuaud\Application Data\Microsoft\Internet Explorer\Quick Launch\Coca-Cola Ltd. - Coca-Cola in Canada.url
    [2010/06/08 10:10:32 | 000,001,931 | ---- | C] () -- C:\Documents and Settings\Bahuaud\Desktop\Smilebox.lnk
    [2010/06/08 10:10:32 | 000,001,909 | ---- | C] () -- C:\Documents and Settings\Bahuaud\Application Data\Microsoft\Internet Explorer\Quick Launch\Smilebox.lnk
    [2010/01/03 00:59:32 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\hpzids01.dll
    [2009/12/31 02:31:25 | 000,000,537 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
    [2009/12/31 02:17:53 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
    [2009/12/31 02:04:20 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
    [2006/05/09 16:50:00 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
    [2006/05/09 16:50:00 | 001,466,368 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
    [2006/05/09 16:50:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
    [2006/05/09 16:50:00 | 000,573,440 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
    [2006/05/09 16:50:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
    [2006/05/09 16:50:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
    [2006/05/09 16:50:00 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
    [2005/08/05 15:01:54 | 000,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
    [2001/07/06 17:30:00 | 000,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini

    ========== LOP Check ==========

    [2010/07/25 19:07:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
    [2010/07/24 10:02:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
    [2010/01/02 22:34:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IM
    [2010/01/02 22:33:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IncrediMail
    [2010/01/28 17:47:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
    [2010/05/07 02:46:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PhotoMail
    [2010/07/27 19:37:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PrinterShare
    [2010/07/27 04:14:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
    [2010/01/03 14:10:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
    [2010/07/23 03:04:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\6C9FE140494AFBD8666C1E543F54F786
    [2010/01/03 13:17:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\AVG9
    [2010/01/16 00:30:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\BarGenie
    [2010/03/03 22:37:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\Facebook
    [2010/01/05 03:49:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\Notepad++
    [2009/12/31 19:22:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\OpenOffice.org
    [2010/07/01 02:30:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\Smilebox
    [2010/01/16 03:24:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\TapiRex
    [2009/12/31 02:21:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bahuaud\Application Data\WinBatch
    [2010/07/31 02:51:29 | 000,000,426 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{92D47641-43EB-461A-B2A8-17FB1147D5B3}.job

    ========== Purity Check ==========


    < End of report >
     
    Last edited: 2010/08/01
    KRB,
    #26
  8. 2010/08/01
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Nothing. That was just temp file...

    You did good by running just quick scan (no code).

    No worries. This is a part of Combofix. It'll be removed in the very last step of our process.


    Last scans...

    Download Security Check from HERE, and save it to your Desktop.

    * Double-click SecurityCheck.exe
    * Follow the onscreen instructions inside of the black box.
    * A Notepad document should open automatically called checkup.txt; please post the contents of that document.

    =======================================================

    Download Temp File Cleaner (TFC)
    Double click on TFC.exe to run the program.
    Click on Start button to begin cleaning process.
    TFC will close all running programs, and it may ask you to restart computer.

    ========================================================

    Disable your antivirus program.
    Go to Kaspersky website and perform an online antivirus scan.

    1. Read through the requirements and privacy statement and click on Accept button.
    2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
    3. When the downloads have finished, click on Settings.
    4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:

    • Spyware, Adware, Dialers, and other potentially dangerous programs
      [*] Archives
      [*] Mail databases
    5. Click on My Computer under Scan.
    6. Once the scan is complete, it will display the results. Click on View Scan Report.
    7. You will see a list of infected items there. Click on Save Report As....
    8. Save this report to a convenient place. Change the Files of type to Text file (.txt before clicking on the Save button. Then post it here.
     
    broni,
    #27
  9. 2010/08/01
    KRB

    KRB Inactive Thread Starter

    Joined:
    2010/07/27
    Messages:
    98
    Likes Received:
    0
    I missed the part about JavaRa so I ran that first, I have the log from that if needed

    heres security checks log (not sure if stuff like this should be posted on the internet but here it is)

    {REMOVED SECURITY CHECK LOG IF NEEDED STILL JUST ASK AND ILL REPOST}
     
    Last edited: 2010/08/02
    KRB,
    #28
  10. 2010/08/01
    KRB

    KRB Inactive Thread Starter

    Joined:
    2010/07/27
    Messages:
    98
    Likes Received:
    0
    KRB,
    #29
  11. 2010/08/01
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Yes, sorry for that.
    I'm on my laptop and I didn't update the link here...
     
    broni,
    #30
  12. 2010/08/01
    KRB

    KRB Inactive Thread Starter

    Joined:
    2010/07/27
    Messages:
    98
    Likes Received:
    0
    ok i just didnt want to run the wrong one, tfc has been run and Kaspersky is dowloading and updating

    EDIT: Kaspersky is scanning slowly atm it may take a bit
     
    Last edited: 2010/08/01
    KRB,
    #31
  13. 2010/08/01
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Cool :)
    It's always better to ask....
     
    broni,
    #32
  14. 2010/08/01
    KRB

    KRB Inactive Thread Starter

    Joined:
    2010/07/27
    Messages:
    98
    Likes Received:
    0
    looks like it found more but i think i can just delete those, but ill wait for you to respond. sorry for taking so long but it was still going when i went to bed last night at 4am

    --------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER 7.0: scan report
    Sunday, August 1, 2010
    Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
    Kaspersky Online Scanner version: 7.0.26.13
    Last database update: Sunday, August 01, 2010 00:31:19
    Records in database: 4178720
    --------------------------------------------------------------------------------

    Scan settings:
    scan using the following database: extended
    Scan archives: yes
    Scan e-mail databases: yes

    Scan area - My Computer:
    C:\
    D:\
    E:\
    F:\
    G:\
    H:\
    I:\

    Scan statistics:
    Objects scanned: 97192
    Threats found: 1
    Infected objects found: 4
    Suspicious objects found: 0
    Scan duration: 02:33:12


    File name / Threat / Threats count
    C:\Documents and Settings\All Users\Documents\laptop stuff\kyles stuff\aug27\Best_Vista_Theme_For_XP_by_1ruby1.rar Infected: Trojan-Dropper.Win32.Agent.bmns 1
    C:\Documents and Settings\All Users\Documents\laptop stuff\kyles stuff 2\aug27\Best_Vista_Theme_For_XP_by_1ruby1.rar Infected: Trojan-Dropper.Win32.Agent.bmns 1
    D:\Saved\Shared Docs\kyles stuff\aug27\Best_Vista_Theme_For_XP_by_1ruby1.rar Infected: Trojan-Dropper.Win32.Agent.bmns 1
    D:\Saved\Shared Docs\laptop stuff\kyles stuff\aug27\Best_Vista_Theme_For_XP_by_1ruby1.rar Infected: Trojan-Dropper.Win32.Agent.bmns 1

    Selected area has been scanned.
     
    Last edited: 2010/08/01
    KRB,
    #33
  15. 2010/08/01
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please do, so we don't have to re-run OTL.
    Make sure to empty recycle bin afterward.

    Now....

    OTL Clean-Up
    Clean up with OTL:

    * Double-click OTL.exe to start the program.
    * Close all other programs apart from OTL as this step will require a reboot
    * On the OTL main screen, press the CLEANUP button
    * Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    =============================================================

    Your computer is clean :)

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point.

    Turn off System Restore:

    - Windows XP:
    1. Click Start.
    2. Right-click the My Computer icon, and then click Properties.
    3. Click the System Restore tab.
    4. Check "Turn off System Restore ".
    5. Click Apply.
    6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
    7. Click OK.
    - Windows Vista and 7:
    1. Click Start.
    2. Right-click the Computer icon, and then click Properties.
    3. Click on System Protection under the Tasks column on the left side
    4. Click on Continue on the "User Account Control" window that pops up
    5. Under the System Protection tab, find Available Disks
    6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C: ")
    7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
    8. Click OK

    2. Restart computer.

    3. Turn System Restore on.

    4. Make sure, Windows Updates are current.

    [SIZE= "4"]5. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately![/SIZE]

    6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    7. Run defrag at your convenience.

    8. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    9. Please, let me know, how is your computer doing.
     
    broni,
    #34
  16. 2010/08/01
    KRB

    KRB Inactive Thread Starter

    Joined:
    2010/07/27
    Messages:
    98
    Likes Received:
    0
    ok ill run those when i get home from work as i was susposed to have left 10 mins ago
     
    KRB,
    #35
  17. 2010/08/01
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Cool :)
     
    broni,
    #36
  18. 2010/08/01
    KRB

    KRB Inactive Thread Starter

    Joined:
    2010/07/27
    Messages:
    98
    Likes Received:
    0
    sorry for the long wait, work s u ck s....

    i have done all the steps listed and the computers doing good you even fixed the xbox 360 media center conection

    thanks now i just wish i could find some where that will fix my laptop screen but thats another problem all together

    thank you
     
    KRB,
    #37
  19. 2010/08/01
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    You're very welcome :)
    Good luck and stay safe :)
     
    broni,
    #38
  20. 2010/08/02
    KRB

    KRB Inactive Thread Starter

    Joined:
    2010/07/27
    Messages:
    98
    Likes Received:
    0
    Thanks

    oh and as I mentioned its a family computer, but i belive i found the program that caused us the problem, it was a digimon battle game my younger brother downloaded with out permision, the game has now been unistalled
     
    KRB,
    #39
  21. 2010/08/02
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    ...and 10 lashes.....LOL
     
    broni,
    #40
Page 2 of 3

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...