Solved Mouse clicking Sound virus

broni · 2010/07/29

Delete your Combofix file, download fresh one and post new log.

efilflah · 2010/07/29

New Combofix log:

ComboFix 10-07-29.01 - Lebictch 30/07/2010 1:05.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.1023.729 [GMT 1:00]
Running from: c:\documents and settings\Lebictch\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((( Files Created from 2010-06-28 to 2010-07-30 )))))))))))))))))))))))))))))))
.

2010-07-28 01:07 . 2010-07-28 01:07 -------- d-----w- c:\documents and settings\Administrator\Application Data\Avira
2010-07-27 17:19 . 2010-07-28 16:33 -------- d-----w- c:\windows\system32\NtmsData
2010-07-27 17:17 . 2010-07-27 17:17 -------- d-----w- c:\documents and settings\Lebictch\Application Data\Avira
2010-07-27 17:13 . 2010-07-27 17:13 -------- d-----w- c:\program files\Avira
2010-07-27 17:13 . 2010-07-27 17:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-07-27 17:13 . 2010-03-01 09:05 124784 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-07-27 17:13 . 2010-02-16 13:24 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-07-27 17:13 . 2009-05-11 11:49 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-07-27 17:13 . 2009-05-11 11:49 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-07-26 22:48 . 2010-07-26 22:48 12872 ----a-w- c:\windows\system32\bootdelete.exe
2010-07-06 23:41 . 2010-07-06 23:41 -------- d-----w- c:\program files\Tracker Software

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-29 22:14 . 2010-03-04 16:35 -------- d-----w- c:\documents and settings\Lebictch\Application Data\Orca Profiles
2010-07-28 00:51 . 2010-07-28 00:51 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-07-28 00:45 . 2010-03-04 17:13 -------- d-----w- c:\program files\PeerGuardian2
2010-07-27 23:43 . 2010-05-24 15:57 -------- d-----w- c:\documents and settings\Lebictch\Application Data\uTorrent
2010-07-27 17:09 . 2010-04-07 17:00 -------- d-----w- c:\program files\CCleaner
2010-07-26 22:48 . 2010-06-25 20:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Hitman Pro
2010-07-26 22:46 . 2010-06-25 20:53 16968 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2010-07-26 14:07 . 2010-03-04 16:35 -------- d-----w- c:\program files\Orca Browser
2010-07-24 17:17 . 2010-03-05 20:29 -------- d-----w- c:\program files\JDownloader
2010-06-26 15:07 . 2010-06-26 15:07 271360 ----a-w- c:\windows\system32\drivers\atksgt.sys
2010-06-26 15:07 . 2010-06-26 15:07 18048 ----a-w- c:\windows\system32\drivers\lirsgt.sys
2010-06-26 11:16 . 2010-06-26 11:16 -------- d-----w- c:\program files\Deep Silver
2010-06-26 11:16 . 2010-03-04 22:06 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-25 20:49 . 2010-06-25 20:49 -------- d-----w- c:\program files\Hitman Pro 3.5
2010-06-25 20:17 . 2010-06-25 20:17 -------- d-----w- c:\documents and settings\Lebictch\Application Data\Malwarebytes
2010-06-25 20:17 . 2010-06-25 20:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-06-25 20:17 . 2010-06-25 20:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-06-25 18:41 . 2010-03-29 14:37 -------- d-----w- c:\documents and settings\Lebictch\Application Data\VSO
2010-06-25 16:21 . 2010-06-25 16:21 -------- d-----w- c:\documents and settings\Lebictch\Application Data\Notepad++
2010-06-25 16:21 . 2010-06-25 16:21 -------- d-----w- c:\program files\Notepad++
2010-06-19 17:19 . 2010-06-19 17:19 -------- d-----w- c:\program files\Microids
2010-06-14 13:47 . 2010-03-04 17:25 -------- d-----w- c:\program files\Microsoft Silverlight
2010-06-12 18:49 . 2010-06-12 18:49 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-06-06 11:22 . 2010-06-06 11:22 -------- d-----w- c:\program files\Cablenut
2010-06-05 13:18 . 2010-06-05 13:18 0 ----a-w- c:\windows\nsreg.dat
2010-06-05 12:57 . 2010-06-05 12:52 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-05-24 09:31 . 2010-05-24 09:41 4042 ----a-w- c:\documents and settings\Lebictch\Application Data\settings.dat
.

------- Sigcheck -------

[-] 2010-03-04 . 68F06FE0021B01E670AF37B8C5964FDF . 361344 . . [5.1.2600.5512] . . c:\windows\system32\drivers\tcpip.sys
[7] 2008-04-14 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tcpip.sys
[7] 2008-04-14 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\tcpip.sys
[7] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
.
((((((((((((((((((((((((((((( SnapShot@2010-07-29_22.04.20 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-04 21:09 . 2010-07-29 22:11 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2010-03-04 21:09 . 2010-07-29 22:01 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2010-03-04 21:09 . 2010-07-29 22:11 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2010-03-04 21:09 . 2010-07-29 22:01 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2010-03-04 21:09 . 2010-07-29 22:11 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2010-03-04 21:09 . 2010-07-29 22:01 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVMixerTray "= "c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-06-04 131072]
"ETDUSBWare "= "c:\program files\Elan\USB\ETDUSBCtrl.exe" [2009-02-20 364544]
"StartCCC "= "c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-30 61440]
"SoundMan "= "SOUNDMAN.EXE" [2007-04-16 577536]
"avgnt "= "c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Applications\\utorrent.exe "=
"c:\\Applications\\utorrent2.exe "=
"c:\\Program Files\\uTorrent185\\uTorrent.exe "=

R0 si3112r;Silicon Image SiI 3112 SATARaid Controller;c:\windows\system32\drivers\si3112r.sys [10/21/2004 3:42 PM 97920]
R0 SiWinAcc;SiWinAcc;c:\windows\system32\drivers\SiWinAcc.sys [10/21/2004 3:42 PM 10240]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [7/27/2010 6:13 PM 135336]
R3 hidflt;Elan HID/USB Mouse Driver;c:\windows\system32\drivers\ETDUSB.sys [3/4/2010 4:27 PM 25088]
.
Contents of the 'Scheduled Tasks' folder

2010-06-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-362288127-682003330-1003Core.job
- c:\documents and settings\Lebictch\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-09 16:06]

2010-06-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-362288127-682003330-1003UA.job
- c:\documents and settings\Lebictch\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-09 16:06]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://uk.search.yahoo.com/?fr=avantsearch
FF - ProfilePath - c:\documents and settings\Lebictch\Application Data\Mozilla\Firefox\Profiles\w3btot4w.default\
FF - plugin: c:\documents and settings\Lebictch\Local Settings\Application Data\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPDFXCviewNPPlugin.dll
FF - plugin: c:\program files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-30 01:08
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(672)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-07-30 01:09:50
ComboFix-quarantined-files.txt 2010-07-30 00:09
ComboFix2.txt 2010-07-29 22:05

Pre-Run: 67,654,463,488 bytes free
Post-Run: 67,643,342,848 bytes free

- - End Of File - - 3FB9ED0D9BB7FD235C8D276A91DDBA59

broni · 2010/07/29

Looks good
How is clicking sound issue?

1. Please open Notepad

Click Start , then Run

Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:
Code:
FCopy::
c:\windows\system32\dllcache\tcpip.sys | c:\windows\system32\drivers\tcpip.sys

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
 "EnableFirewall "=dword:00000001
3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

efilflah · 2010/07/29

The clicking sound issue is gone and so are the two svchosts that were running it

I will post back now with the script results

broni · 2010/07/29

Cool

efilflah · 2010/07/29

New ComboFix from CFScript:

ComboFix 10-07-29.01 - Lebictch 30/07/2010 1:25.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.1023.688 [GMT 1:00]
Running from: c:\documents and settings\Lebictch\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Lebictch\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
--------------- FCopy ---------------

c:\windows\system32\dllcache\tcpip.sys --> c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((( Files Created from 2010-06-28 to 2010-07-30 )))))))))))))))))))))))))))))))
.

2010-07-28 01:07 . 2010-07-28 01:07 -------- d-----w- c:\documents and settings\Administrator\Application Data\Avira
2010-07-27 17:19 . 2010-07-28 16:33 -------- d-----w- c:\windows\system32\NtmsData
2010-07-27 17:17 . 2010-07-27 17:17 -------- d-----w- c:\documents and settings\Lebictch\Application Data\Avira
2010-07-27 17:13 . 2010-07-27 17:13 -------- d-----w- c:\program files\Avira
2010-07-27 17:13 . 2010-07-27 17:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-07-27 17:13 . 2010-03-01 09:05 124784 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-07-27 17:13 . 2010-02-16 13:24 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-07-27 17:13 . 2009-05-11 11:49 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-07-27 17:13 . 2009-05-11 11:49 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-07-26 22:48 . 2010-07-26 22:48 12872 ----a-w- c:\windows\system32\bootdelete.exe
2010-07-06 23:41 . 2010-07-06 23:41 -------- d-----w- c:\program files\Tracker Software

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-29 22:14 . 2010-03-04 16:35 -------- d-----w- c:\documents and settings\Lebictch\Application Data\Orca Profiles
2010-07-28 00:51 . 2010-07-28 00:51 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-07-28 00:45 . 2010-03-04 17:13 -------- d-----w- c:\program files\PeerGuardian2
2010-07-27 23:43 . 2010-05-24 15:57 -------- d-----w- c:\documents and settings\Lebictch\Application Data\uTorrent
2010-07-27 17:09 . 2010-04-07 17:00 -------- d-----w- c:\program files\CCleaner
2010-07-26 22:48 . 2010-06-25 20:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Hitman Pro
2010-07-26 22:46 . 2010-06-25 20:53 16968 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2010-07-26 14:07 . 2010-03-04 16:35 -------- d-----w- c:\program files\Orca Browser
2010-07-24 17:17 . 2010-03-05 20:29 -------- d-----w- c:\program files\JDownloader
2010-06-26 15:07 . 2010-06-26 15:07 271360 ----a-w- c:\windows\system32\drivers\atksgt.sys
2010-06-26 15:07 . 2010-06-26 15:07 18048 ----a-w- c:\windows\system32\drivers\lirsgt.sys
2010-06-26 11:16 . 2010-06-26 11:16 -------- d-----w- c:\program files\Deep Silver
2010-06-26 11:16 . 2010-03-04 22:06 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-25 20:49 . 2010-06-25 20:49 -------- d-----w- c:\program files\Hitman Pro 3.5
2010-06-25 20:17 . 2010-06-25 20:17 -------- d-----w- c:\documents and settings\Lebictch\Application Data\Malwarebytes
2010-06-25 20:17 . 2010-06-25 20:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-06-25 20:17 . 2010-06-25 20:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-06-25 18:41 . 2010-03-29 14:37 -------- d-----w- c:\documents and settings\Lebictch\Application Data\VSO
2010-06-25 16:21 . 2010-06-25 16:21 -------- d-----w- c:\documents and settings\Lebictch\Application Data\Notepad++
2010-06-25 16:21 . 2010-06-25 16:21 -------- d-----w- c:\program files\Notepad++
2010-06-19 17:19 . 2010-06-19 17:19 -------- d-----w- c:\program files\Microids
2010-06-14 13:47 . 2010-03-04 17:25 -------- d-----w- c:\program files\Microsoft Silverlight
2010-06-12 18:49 . 2010-06-12 18:49 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-06-06 11:22 . 2010-06-06 11:22 -------- d-----w- c:\program files\Cablenut
2010-06-05 13:18 . 2010-06-05 13:18 0 ----a-w- c:\windows\nsreg.dat
2010-06-05 12:57 . 2010-06-05 12:52 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-05-24 09:31 . 2010-05-24 09:41 4042 ----a-w- c:\documents and settings\Lebictch\Application Data\settings.dat
.

((((((((((((((((((((((((((((( SnapShot@2010-07-29_22.04.20 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-04 21:09 . 2010-07-29 22:11 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2010-03-04 21:09 . 2010-07-29 22:01 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2010-03-04 21:09 . 2010-07-29 22:11 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2010-03-04 21:09 . 2010-07-29 22:01 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVMixerTray "= "c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-06-04 131072]
"ETDUSBWare "= "c:\program files\Elan\USB\ETDUSBCtrl.exe" [2009-02-20 364544]
"StartCCC "= "c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-30 61440]
"SoundMan "= "SOUNDMAN.EXE" [2007-04-16 577536]
"avgnt "= "c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Applications\\utorrent.exe "=
"c:\\Applications\\utorrent2.exe "=
"c:\\Program Files\\uTorrent185\\uTorrent.exe "=

R0 si3112r;Silicon Image SiI 3112 SATARaid Controller;c:\windows\system32\drivers\si3112r.sys [10/21/2004 3:42 PM 97920]
R0 SiWinAcc;SiWinAcc;c:\windows\system32\drivers\SiWinAcc.sys [10/21/2004 3:42 PM 10240]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [7/27/2010 6:13 PM 135336]
R3 hidflt;Elan HID/USB Mouse Driver;c:\windows\system32\drivers\ETDUSB.sys [3/4/2010 4:27 PM 25088]
.
Contents of the 'Scheduled Tasks' folder

2010-06-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-362288127-682003330-1003Core.job
- c:\documents and settings\Lebictch\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-09 16:06]

2010-06-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-362288127-682003330-1003UA.job
- c:\documents and settings\Lebictch\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-09 16:06]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://uk.search.yahoo.com/?fr=avantsearch
FF - ProfilePath - c:\documents and settings\Lebictch\Application Data\Mozilla\Firefox\Profiles\w3btot4w.default\
FF - plugin: c:\documents and settings\Lebictch\Local Settings\Application Data\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPDFXCviewNPPlugin.dll
FF - plugin: c:\program files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-30 01:28
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(672)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-07-30 01:29:29
ComboFix-quarantined-files.txt 2010-07-30 00:29
ComboFix2.txt 2010-07-30 00:09
ComboFix3.txt 2010-07-29 22:05

Pre-Run: 67,651,768,320 bytes free
Post-Run: 67,636,654,080 bytes free

- - End Of File - - 79DB679EDB46DEA57DD0E956771CDD2F

broni · 2010/07/29

Excellent

Uninstall Combofix:
Go Start > Run [Vista users, go Start> "Start search"]
Type in:
Combofix /Uninstall
Note the space between the "Combofix" and the "/Uninstall "
Click OK (Vista users - press Enter).
Restart computer.

================================================================

Please, delete your GMER file, download fresh one and post new log.

Additionally...

Download OTL to your Desktop.

* Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
* Under the Custom Scan box paste this in:

netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\system32\spool\prtprocs\w32x86\*.tmp
%systemroot%\*. /mp /s
/md5start
/md5stop
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

* Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

efilflah · 2010/07/29

Results of fresh GMER:

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-07-30 02:05:17
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Lebictch\LOCALS~1\Temp\kwrcapod.sys

---- System - GMER 1.0.15 ----

SSDT EED280E6 ZwCreateKey
SSDT EED280DC ZwCreateThread
SSDT EED280EB ZwDeleteKey
SSDT EED280F5 ZwDeleteValueKey
SSDT EED280FA ZwLoadKey
SSDT EED280C8 ZwOpenProcess
SSDT EED280CD ZwOpenThread
SSDT EED28104 ZwReplaceKey
SSDT EED280FF ZwRestoreKey
SSDT EED280F0 ZwSetValueKey

---- Kernel code sections - GMER 1.0.15 ----

init C:\WINDOWS\system32\drivers\nvax.sys entry point in "init" section [0xF77A7B8D]
.text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xF6AE2000, 0x1B85E6, 0xE8000020]
.text C:\WINDOWS\system32\DRIVERS\atksgt.sys section is writeable [0xB0138300, 0x3ACC8, 0xE8000020]
.text C:\WINDOWS\system32\DRIVERS\lirsgt.sys section is writeable [0xEF4C0300, 0x1B7E, 0xE8000020]

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs SiWinAcc.sys (Windows Accelerator Driver/Silicon Image, Inc.)

---- EOF - GMER 1.0.15 ----

Will run OLT now as instructed.

efilflah · 2010/07/29

OLT.txt

OTL logfile created on: 30/07/2010 02:08:52 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Lebictch\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,023.00 Mb Total Physical Memory | 701.00 Mb Available Physical Memory | 69.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 87.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.78 Gb Total Space | 63.05 Gb Free Space | 56.41% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 2.24 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: EFILFLAH
Current User Name: Lebictch
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/07/30 01:44:16 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Lebictch\Desktop\OTL.exe
PRC - [2010/04/01 13:33:19 | 000,267,432 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2010/03/02 11:28:31 | 000,282,792 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010/02/24 10:28:09 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2010/01/14 22:11:00 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009/02/21 00:11:30 | 000,364,544 | ---- | M] (ELAN Microelectronics Corp.) -- C:\Program Files\ELAN\USB\ETDUSBCtrl.exe
PRC - [2008/04/14 14:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/04/16 16:28:22 | 000,577,536 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\soundman.exe

========== Modules (SafeList) ==========

MOD - [2010/07/30 01:44:16 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Lebictch\Desktop\OTL.exe
MOD - [2008/12/31 21:52:48 | 000,245,760 | ---- | M] (ELAN Microelectronics Corp.) -- C:\Program Files\ELAN\USB\ETDUSBApix.dll
MOD - [2008/04/14 14:40:22 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - [2010/04/01 13:33:19 | 000,267,432 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010/02/24 10:28:09 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\Lebictch\LOCALS~1\Temp\catchme.sys -- (catchme)
DRV - [2010/06/26 16:07:09 | 000,271,360 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt)
DRV - [2010/06/26 16:07:08 | 000,018,048 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2010/03/01 10:05:24 | 000,124,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2010/02/16 14:24:01 | 000,060,936 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009/05/11 12:49:19 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2009/05/11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/02/07 00:46:50 | 000,025,088 | ---- | M] (ELAN Microelectronics Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ETDUSB.sys -- (hidflt)
DRV - [2009/01/14 08:14:01 | 003,455,488 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2008/09/24 11:40:22 | 004,122,368 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\alcxwdm.sys -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2008/05/15 02:24:32 | 000,171,520 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\atinavt2.sys -- (ATIAVAIW)
DRV - [2008/04/14 09:16:24 | 000,015,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mpe.sys -- (MPE)
DRV - [2004/08/27 17:18:50 | 000,097,920 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\si3112r.sys -- (si3112r)
DRV - [2004/06/03 10:40:46 | 000,079,360 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\nvatabus.sys -- (nvatabus)
DRV - [2004/05/25 15:58:04 | 000,396,032 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nvapu.sys -- (nvnforce) Service for NVIDIA(R) nForce(TM)
DRV - [2004/05/25 15:58:02 | 000,048,640 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvax.sys -- (nvax) Service for NVIDIA(R) nForce(TM)
DRV - [2004/05/20 18:35:16 | 000,010,240 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\SiWinAcc.sys -- (SiWinAcc)
DRV - [2004/05/20 18:35:16 | 000,010,240 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\SiWinAcc.sys -- (SiFilter)
DRV - [2004/04/02 15:40:00 | 000,021,760 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\nv_agp.sys -- (nv_agp)
DRV - [2004/01/29 01:45:50 | 000,093,764 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENET.sys -- (NVENET)
DRV - [2001/08/17 15:00:04 | 000,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://uk.search.yahoo.com/?fr=avantsearch
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7.3

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/06/05 14:17:22 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/07 00:41:15 | 000,000,000 | ---D | M]

[2010/06/05 14:17:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lebictch\Application Data\Mozilla\Extensions
[2010/06/25 21:12:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lebictch\Application Data\Mozilla\Firefox\Profiles\w3btot4w.default\extensions
[2010/06/05 14:19:36 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Documents and Settings\Lebictch\Application Data\Mozilla\Firefox\Profiles\w3btot4w.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010/06/05 14:17:16 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[1999/12/31 17:00:00 | 000,165,656 | ---- | M] (Tracker Software Products Ltd.) -- C:\Program Files\Mozilla Firefox\plugins\npPDFXCviewNPPlugin.dll

O1 HOSTS File: ([2010/07/29 23:19:35 | 000,609,487 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 fr.a2dfp.net
O1 - Hosts: 127.0.0.1 m.fr.a2dfp.net
O1 - Hosts: 127.0.0.1 ad.a8.net
O1 - Hosts: 127.0.0.1 asy.a8ww.net
O1 - Hosts: 127.0.0.1 abcstats.com
O1 - Hosts: 127.0.0.1 a.abv.bg
O1 - Hosts: 127.0.0.1 adserver.abv.bg
O1 - Hosts: 127.0.0.1 adv.abv.bg
O1 - Hosts: 127.0.0.1 bimg.abv.bg
O1 - Hosts: 127.0.0.1 ca.abv.bg
O1 - Hosts: 127.0.0.1 www2.a-counter.kiev.ua
O1 - Hosts: 127.0.0.1 track.acclaimnetwork.com
O1 - Hosts: 127.0.0.1 accuserveadsystem.com
O1 - Hosts: 127.0.0.1 www.accuserveadsystem.com
O1 - Hosts: 127.0.0.1 achmedia.com
O1 - Hosts: 127.0.0.1 aconti.net
O1 - Hosts: 127.0.0.1 secure.aconti.net
O1 - Hosts: 127.0.0.1 www.aconti.net #[Dialer.Aconti]
O1 - Hosts: 127.0.0.1 ads.active.com
O1 - Hosts: 127.0.0.1 am1.activemeter.com
O1 - Hosts: 127.0.0.1 www.activemeter.com #[Tracking.Cookie]
O1 - Hosts: 127.0.0.1 ads.activepower.net
O1 - Hosts: 127.0.0.1 stat.active24stats.nl #[Tracking.Cookie]
O1 - Hosts: 127.0.0.1 ad2games.com
O1 - Hosts: 16077 more lines...
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [ETDUSBWare] C:\Program Files\ELAN\USB\ETDUSBCtrl.exe (ELAN Microelectronics Corp.)
O4 - HKLM..\Run: [NVMixerTray] C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.23.3.1 64.129.67.102
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Lebictch\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Lebictch\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/03/04 22:06:52 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/04/24 10:57:26 | 000,000,050 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2006/07/06 10:07:02 | 000,578,654 | R--- | M] () - E:\autostart.bmp -- [ CDFS ]
O32 - AutoRun File - [2006/08/16 08:37:16 | 000,001,412 | R--- | M] () - E:\autostart.dat -- [ CDFS ]
O32 - AutoRun File - [2006/06/14 07:26:50 | 000,001,132 | R--- | M] () - E:\autostart.ini -- [ CDFS ]
O32 - AutoRun File - [2006/06/15 17:36:42 | 000,196,608 | R--- | M] () - E:\AutoStarter.exe -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.IYUV - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation)
Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: VIDC.UYVY - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YUY2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVU9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 90 Days ==========

[2010/07/30 01:44:25 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/07/30 01:44:19 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Lebictch\Desktop\OTL.exe
[2010/07/30 01:29:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2010/07/29 23:01:37 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/07/29 23:00:29 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/07/28 18:26:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2010/07/28 18:17:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/07/27 18:19:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData
[2010/07/27 18:17:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lebictch\Application Data\Avira
[2010/07/27 18:13:37 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2010/07/27 18:13:36 | 000,124,784 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2010/07/27 18:13:36 | 000,060,936 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2010/07/27 18:13:36 | 000,045,416 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntdd.sys
[2010/07/27 18:13:36 | 000,022,360 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntmgr.sys
[2010/07/27 18:13:36 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2010/07/27 18:13:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Avira
[2010/07/27 18:10:19 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Lebictch\Recent
[2010/07/26 23:48:50 | 000,012,872 | ---- | C] (SurfRight B.V.) -- C:\WINDOWS\System32\bootdelete.exe
[2010/07/26 23:00:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/07/26 22:58:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/07/07 00:41:10 | 000,000,000 | ---D | C] -- C:\Program Files\Tracker Software
[2010/06/26 12:16:17 | 000,000,000 | ---D | C] -- C:\Program Files\Deep Silver
[2010/06/25 21:49:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Hitman Pro
[2010/06/25 21:49:11 | 000,000,000 | ---D | C] -- C:\Program Files\Hitman Pro 3.5
[2010/06/25 21:17:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lebictch\Application Data\Malwarebytes
[2010/06/25 21:17:47 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/06/25 21:17:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/06/25 21:17:45 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/06/25 21:17:45 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/06/25 19:52:26 | 000,000,000 | ---D | C] -- C:\WINDOWS\Downloaded Installations
[2010/06/25 18:46:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lebictch\Local Settings\Application Data\VSO
[2010/06/25 17:21:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lebictch\Application Data\Notepad++
[2010/06/25 17:21:16 | 000,000,000 | ---D | C] -- C:\Program Files\Notepad++
[2010/06/25 17:20:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lebictch\My Documents\Still Life 2 Saves
[2010/06/19 18:19:54 | 000,000,000 | ---D | C] -- C:\Program Files\Microids
[2010/06/06 12:24:06 | 000,000,000 | ---D | C] -- C:\Reg Tweaks
[2010/06/06 12:22:00 | 000,000,000 | ---D | C] -- C:\Program Files\Cablenut
[2010/06/05 14:19:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lebictch\dwhelper
[2010/06/05 14:17:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lebictch\Local Settings\Application Data\Mozilla
[2010/06/05 14:17:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lebictch\Application Data\Mozilla
[2010/06/05 14:17:16 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2010/06/05 13:52:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NOS
[2010/05/24 16:57:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lebictch\Application Data\uTorrent
[2010/05/08 19:28:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lebictch\Local Settings\Application Data\Apple Computer
[2010/05/08 19:24:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Apple Computer
[2010/05/08 19:24:30 | 000,000,000 | ---D | C] -- C:\Program Files\QT Lite
[2010/05/01 15:20:58 | 000,000,000 | ---D | C] -- C:\Program Files\uTorrent185
[2010/05/01 15:00:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lebictch\Application Data\UT Backup
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/07/30 01:44:16 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Lebictch\Desktop\OTL.exe
[2010/07/30 01:43:01 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/07/30 01:42:59 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/07/30 01:41:52 | 003,145,728 | -H-- | M] () -- C:\Documents and Settings\Lebictch\NTUSER.DAT
[2010/07/30 01:41:52 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Lebictch\ntuser.ini
[2010/07/30 01:41:47 | 007,087,824 | -H-- | M] () -- C:\Documents and Settings\Lebictch\Local Settings\Application Data\IconCache.db
[2010/07/30 01:28:30 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/07/30 00:39:36 | 000,000,282 | RHS- | M] () -- C:\boot.ini
[2010/07/29 23:19:35 | 000,609,487 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/07/27 18:10:46 | 000,069,612 | ---- | M] () -- C:\Documents and Settings\Lebictch\My Documents\cc_20100727_181035.reg
[2010/07/27 18:06:06 | 000,000,403 | ---- | M] () -- C:\Documents and Settings\Lebictch\Desktop\Applications.lnk
[2010/07/27 17:56:34 | 000,000,578 | ---- | M] () -- C:\Documents and Settings\Lebictch\Application Data\Microsoft\Internet Explorer\Quick Launch\Shortcut to HijackThis.exe.lnk
[2010/07/26 23:55:52 | 000,000,051 | ---- | M] () -- C:\WINDOWS\WININIT.INI
[2010/07/26 23:49:07 | 000,019,992 | ---- | M] () -- C:\Documents and Settings\Lebictch\My Documents\log.xml
[2010/07/26 23:48:50 | 000,012,872 | ---- | M] (SurfRight B.V.) -- C:\WINDOWS\System32\bootdelete.exe
[2010/07/26 23:46:18 | 000,016,968 | ---- | M] () -- C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2010/07/24 18:04:42 | 000,607,040 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\HOSTS.MVP
[2010/07/15 18:23:47 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/07/05 15:02:13 | 000,000,804 | ---- | M] () -- C:\Documents and Settings\Lebictch\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2010/06/26 16:07:09 | 000,271,360 | ---- | M] () -- C:\WINDOWS\System32\drivers\atksgt.sys
[2010/06/26 16:07:08 | 000,018,048 | ---- | M] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
[2010/06/25 21:52:15 | 000,001,663 | ---- | M] () -- C:\Documents and Settings\Lebictch\Application Data\Microsoft\Internet Explorer\Quick Launch\Hitman Pro 3.5.lnk
[2010/06/25 21:17:49 | 000,000,714 | ---- | M] () -- C:\Documents and Settings\Lebictch\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2010/06/25 12:10:34 | 000,103,424 | ---- | M] () -- C:\Documents and Settings\Lebictch\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/24 00:09:01 | 056,655,300 | ---- | M] () -- C:\Documents and Settings\Lebictch\My Documents\Reg Backup.reg
[2010/06/16 00:13:56 | 000,000,990 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-362288127-682003330-1003UA.job
[2010/06/16 00:13:55 | 000,000,938 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-362288127-682003330-1003Core.job
[2010/06/12 19:49:57 | 000,004,096 | ---- | M] () -- C:\WINDOWS\System32\crash
[2010/06/12 19:49:55 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/06/05 14:18:04 | 000,000,000 | ---- | M] () -- C:\WINDOWS\nsreg.dat
[2010/06/05 14:17:18 | 000,001,620 | ---- | M] () -- C:\Documents and Settings\Lebictch\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/05/24 10:31:16 | 000,004,042 | ---- | M] () -- C:\Documents and Settings\Lebictch\Application Data\settings.dat
[2010/05/22 17:32:13 | 000,000,038 | ---- | M] () -- C:\WINDOWS\AviSplitter.INI
[2010/05/02 01:54:32 | 000,000,721 | ---- | M] () -- C:\Documents and Settings\Lebictch\Application Data\Microsoft\Internet Explorer\Quick Launch\Shortcut to utorrent_1.8.5.exe.lnk
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/07/30 01:45:46 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\Lebictch\Desktop\gmer.exe
[2010/07/29 23:01:41 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/07/29 23:01:39 | 000,260,272 | ---- | C] () -- C:\cmldr
[2010/07/27 18:10:38 | 000,069,612 | ---- | C] () -- C:\Documents and Settings\Lebictch\My Documents\cc_20100727_181035.reg
[2010/07/27 18:05:17 | 000,000,403 | ---- | C] () -- C:\Documents and Settings\Lebictch\Desktop\Applications.lnk
[2010/07/27 17:56:34 | 000,000,578 | ---- | C] () -- C:\Documents and Settings\Lebictch\Application Data\Microsoft\Internet Explorer\Quick Launch\Shortcut to HijackThis.exe.lnk
[2010/07/26 23:49:07 | 000,019,992 | ---- | C] () -- C:\Documents and Settings\Lebictch\My Documents\log.xml
[2010/07/05 15:02:13 | 000,000,804 | ---- | C] () -- C:\Documents and Settings\Lebictch\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2010/06/26 16:07:08 | 000,271,360 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys
[2010/06/26 16:07:08 | 000,018,048 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
[2010/06/25 21:53:19 | 000,016,968 | ---- | C] () -- C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2010/06/25 21:52:15 | 000,001,663 | ---- | C] () -- C:\Documents and Settings\Lebictch\Application Data\Microsoft\Internet Explorer\Quick Launch\Hitman Pro 3.5.lnk
[2010/06/25 21:17:49 | 000,000,714 | ---- | C] () -- C:\Documents and Settings\Lebictch\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2010/06/24 00:08:58 | 056,655,300 | ---- | C] () -- C:\Documents and Settings\Lebictch\My Documents\Reg Backup.reg
[2010/06/12 19:49:57 | 000,004,096 | ---- | C] () -- C:\WINDOWS\System32\crash
[2010/06/12 19:49:55 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/06/05 14:18:04 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/06/05 14:17:18 | 000,001,620 | ---- | C] () -- C:\Documents and Settings\Lebictch\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/05/24 10:41:07 | 000,004,042 | ---- | C] () -- C:\Documents and Settings\Lebictch\Application Data\settings.dat
[2010/05/14 12:25:36 | 000,000,038 | ---- | C] () -- C:\WINDOWS\AviSplitter.INI
[2010/05/02 01:53:57 | 000,000,721 | ---- | C] () -- C:\Documents and Settings\Lebictch\Application Data\Microsoft\Internet Explorer\Quick Launch\Shortcut to utorrent_1.8.5.exe.lnk
[2010/03/06 11:29:35 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2010/03/04 23:01:12 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2010/03/04 16:54:05 | 000,000,051 | ---- | C] () -- C:\WINDOWS\WININIT.INI

========== LOP Check ==========

[2010/07/26 23:48:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Hitman Pro
[2010/06/25 17:21:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lebictch\Application Data\Notepad++
[2010/07/29 23:14:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lebictch\Application Data\Orca Profiles
[2010/05/01 15:01:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lebictch\Application Data\UT Backup
[2010/07/28 00:43:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lebictch\Application Data\uTorrent
[2010/06/25 19:41:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lebictch\Application Data\VSO

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/03/04 22:06:52 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2010/03/04 15:42:59 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010/07/30 00:39:36 | 000,000,282 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | ---- | M] () -- C:\cmldr
[2010/07/30 01:29:30 | 000,010,188 | ---- | M] () -- C:\ComboFix.txt
[2010/03/04 22:06:52 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2010/03/04 22:06:52 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/03/04 22:06:52 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2010/03/04 15:36:01 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2010/03/04 16:03:31 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2010/07/30 01:42:54 | 1610,612,736 | -HS- | M] () -- C:\pagefile.sys

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2007/03/23 05:24:58 | 000,028,160 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2007/02/10 00:33:58 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont
[2007/02/10 00:33:58 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2007/02/10 00:33:58 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2007/02/10 00:33:58 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2009/01/14 05:49:05 | 000,425,984 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\WINDOWS\system32\ATIDEMGX.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2010/03/04 13:56:32 | 000,090,112 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2010/03/04 13:56:32 | 000,630,784 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2010/03/04 13:56:32 | 000,417,792 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\user32.dll /md5 >
[2008/04/14 14:42:10 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B -- C:\WINDOWS\system32\user32.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/04/14 14:42:12 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A -- C:\WINDOWS\system32\ws2_32.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\ws2help.dll /md5 >
[2008/04/14 14:42:12 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=9789E95E1D88EEB4B922BF3EA7779C28 -- C:\WINDOWS\system32\ws2help.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >
< End of report >

Extras.txt
OTL Extras logfile created on: 30/07/2010 02:08:52 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Lebictch\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,023.00 Mb Total Physical Memory | 701.00 Mb Available Physical Memory | 69.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 87.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.78 Gb Total Space | 63.05 Gb Free Space | 56.41% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 2.24 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: EFILFLAH
Current User Name: Lebictch
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- C:\Program Files\Orca Browser\orca.exe (Avant Force)
.url [@ = InternetShortcut] -- C:\Program Files\Orca Browser\orca.exe (Avant Force)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Orca Browser\orca.exe" %1 (Avant Force)
htmlfile [opennew] -- "C:\Program Files\Orca Browser\orca.exe" %1 (Avant Force)
http [open] -- "C:\Program Files\Orca Browser\orca.exe" %1 (Avant Force)
https [open] -- "C:\Program Files\Orca Browser\orca.exe" %1 (Avant Force)
InternetShortcut [open] -- "C:\Program Files\Orca Browser\orca.exe" %1 (Avant Force)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
"C:\Applications\utorrent.exe" = C:\Applications\utorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Applications\utorrent2.exe" = C:\Applications\utorrent2.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Program Files\uTorrent185\uTorrent.exe" = C:\Program Files\uTorrent185\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{1CB92574-96F2-467B-B793-5CEB35C40C29}" = Image Resizer Powertoy for Windows XP
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java(TM) 6 Update 15
"{2A947CBB-4F5E-38D8-F49E-6C2C0D9D848E}" = Catalyst Control Center Graphics Previews Common
"{2BA00471-0328-3743-93BD-FA813353A783}" = Microsoft .NET Framework 3.0 Service Pack 1
"{2FC099BD-AC9B-33EB-809C-D332E1B27C40}" = Microsoft .NET Framework 3.5
"{30DE45EC-48B3-7617-193A-7B4CDCE18D22}" = Skins
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3EE51BAD-9916-49C7-90BA-3D500B031E0C}_is1" = VSO Image Resizer 3.0.1.76
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{4A163531-5D37-4FEE-9491-BBC1BC73E212}" = SmartPad Software 1.0
"{5C08205C-C9E0-A607-9EB1-EB0D7C5659B3}" = Catalyst Control Center Core Implementation
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D273DE5-ABFA-4BD0-A9D7-EE9C971438C4}_is1" = PDF-Viewer
"{90A2EB5A-8446-1554-235A-D174E39AF4E5}" = Catalyst Control Center Graphics Full Existing
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{B48442EE-FF84-3A89-CA50-EA2D1C64733E}" = ccc-utility
"{B508B3F1-A24A-32C0-B310-85786919EF28}" = Microsoft .NET Framework 2.0 Service Pack 1
"{C9E4932C-8417-4E4C-A0E3-EE534810AB4D}" = ClearType Tuning Control Panel Applet
"{CC1086AD-1635-01EF-3137-04AB16B46F9F}" = ccc-core-preinstall
"{D01B4212-C867-9074-217D-B40BB5A578FE}" = Catalyst Control Center Graphics Full New
"{D3B1C799-CB73-42DE-BA0F-2344793A095C}" = Catalyst Control Center - Branding
"{D7A6C517-11F2-419F-B5BB-27772B939698}" = NvMixer
"{DCFF3DB2-0E96-6DF5-DF22-AB1C18CF5E86}" = Catalyst Control Center Graphics Light
"{DE9D0AF5-08ED-70A5-66FA-4C3B3E2A85E8}" = Catalyst Control Center HydraVision Full
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F104E135-A5EF-9551-4924-2A7B94DDDADF}" = ccc-core-static
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FBB6D1D6-BD35-50E0-37B7-375BAB8E199B}" = CCC Help English
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"All ATI Software" = ATI - Software Uninstall Utility
"ATI Display Driver" = ATI Display Driver
"AvantBrowser" = Avant Browser (remove only)
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Cablenut" = Cablenut 4.08
"CCleaner" = CCleaner
"CoreAVC Professional Edition" = CoreAVC Professional Edition (remove only)
"HaaliMkx" = Haali Media Splitter
"HitmanPro35" = Hitman Pro 3.5
"InstallShield_{4A163531-5D37-4FEE-9491-BBC1BC73E212}" = SmartPad Software 1.0
"JDownloader" = JDownloader
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5" = Microsoft .NET Framework 3.5
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"Notepad++" = Notepad++
"NVIDIA Drivers" = NVIDIA Drivers
"OrcaBrowser" = Orca Browser
"PeerGuardian_is1" = PeerGuardian 2.0
"qt7lite_is1" = QT Lite 3.1.1
"uTorrent" = µTorrent
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 24/04/2010 04:46:36 | Computer Name = EFILFLAH | Source = Application Error | ID = 1000
Description = Faulting application pg2.exe, version 1.0.6.5, faulting module pg2.exe,
version 1.0.6.5, fault address 0x0002ee56.

Error - 24/04/2010 05:03:03 | Computer Name = EFILFLAH | Source = Application Error | ID = 1000
Description = Faulting application pg2.exe, version 1.0.6.5, faulting module pg2.exe,
version 1.0.6.5, fault address 0x0002ee56.

Error - 24/04/2010 05:21:25 | Computer Name = EFILFLAH | Source = Application Error | ID = 1000
Description = Faulting application pg2.exe, version 1.0.6.5, faulting module pg2.exe,
version 1.0.6.5, fault address 0x0002ee56.

Error - 23/04/2010 06:32:37 | Computer Name = EFILFLAH | Source = Application Error | ID = 1000
Description = Faulting application pg2.exe, version 1.0.6.5, faulting module pg2.exe,
version 1.0.6.5, fault address 0x0002ee56.

Error - 24/04/2010 00:56:18 | Computer Name = EFILFLAH | Source = Application Error | ID = 1000
Description = Faulting application pg2.exe, version 1.0.6.5, faulting module pg2.exe,
version 1.0.6.5, fault address 0x0002ee56.

Error - 27/04/2010 18:38:59 | Computer Name = EFILFLAH | Source = Application Error | ID = 1000
Description = Faulting application pg2.exe, version 1.0.6.5, faulting module pg2.exe,
version 1.0.6.5, fault address 0x0002ee56.

Error - 30/04/2010 21:18:35 | Computer Name = EFILFLAH | Source = Application Error | ID = 1000
Description = Faulting application xl.exe, version 5.2.3790.3959, faulting module
xl.exe, version 5.2.3790.3959, fault address 0x00001662.

Error - 16/05/2010 21:34:46 | Computer Name = EFILFLAH | Source = Application Error | ID = 1000
Description = Faulting application orca.exe, version 1.2.0.6, faulting module ,
version 0.0.0.0, fault address 0x00000000.

Error - 19/05/2010 12:26:06 | Computer Name = EFILFLAH | Source = Application Error | ID = 1000
Description = Faulting application pg2.exe, version 1.0.6.5, faulting module pg2.exe,
version 1.0.6.5, fault address 0x000608a5.

Error - 23/05/2010 12:44:31 | Computer Name = EFILFLAH | Source = Application Error | ID = 1000
Description = Faulting application avant.exe, version 11.7.0.46, faulting module
flash10e.ocx, version 10.0.45.2, fault address 0x00244362.

[ System Events ]
Error - 27/07/2010 20:51:23 | Computer Name = EFILFLAH | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 27/07/2010 20:52:37 | Computer Name = EFILFLAH | Source = Service Control Manager | ID = 7001
Description = The DHCP Client service depends on the NetBios over Tcpip service
which failed to start because of the following error: %%31

Error - 27/07/2010 20:52:37 | Computer Name = EFILFLAH | Source = Service Control Manager | ID = 7001
Description = The IPSEC Services service depends on the IPSEC driver service which
failed to start because of the following error: %%31

Error - 27/07/2010 20:52:37 | Computer Name = EFILFLAH | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
AFD AmdK7 avgio avipbb Fips IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss ssmdrv Tcpip

Error - 28/07/2010 00:11:18 | Computer Name = EFILFLAH | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 28/07/2010 12:26:30 | Computer Name = EFILFLAH | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
atapi PCIIde

Error - 29/07/2010 18:11:42 | Computer Name = EFILFLAH | Source = Service Control Manager | ID = 7023
Description = The HID Input Service service terminated with the following error:
%%126

Error - 29/07/2010 19:44:59 | Computer Name = EFILFLAH | Source = Service Control Manager | ID = 7023
Description = The HID Input Service service terminated with the following error:
%%126

Error - 29/07/2010 20:19:41 | Computer Name = EFILFLAH | Source = Service Control Manager | ID = 7023
Description = The HID Input Service service terminated with the following error:
%%126

Error - 29/07/2010 20:43:18 | Computer Name = EFILFLAH | Source = Service Control Manager | ID = 7023
Description = The HID Input Service service terminated with the following error:
%%126

< End of report >

broni · 2010/07/29

GMER log looks clean

Update your Java version here: http://www.java.com/en/download/installed.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

Now, we need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.

Accept any prompts.

==============================================================

Run OTL
Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following
Code:
:OTL
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]


:Services

:Reg

:Files

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
Then click the [color= "#FF0000"]Run Fix[/color] button at the top

Let the program run unhindered, reboot the PC when it is done

You will get a log that shows the results of the fix. Please post it.

Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

efilflah · 2010/07/29

Used JavaRa to remove old versions.

Here is the fix log from OLT

All processes killed
========== OTL ==========
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\WINDOWS\Downloaded Program Files\gp.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
C:\WINDOWS\002361_.tmp deleted successfully.
C:\WINDOWS\005428_.tmp deleted successfully.
C:\WINDOWS\DUMP55a1.tmp deleted successfully.
C:\WINDOWS\SET3.tmp deleted successfully.
C:\WINDOWS\SET7.tmp deleted successfully.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Lebictch
->Temp folder emptied: 9262335 bytes
->Temporary Internet Files folder emptied: 107928 bytes
->Java cache emptied: 2027 bytes
->FireFox cache emptied: 17864903 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 11383 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 593 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 593 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 1094203 bytes

Total Files Cleaned = 27.00 mb

[EMPTYFLASH]

User: Administrator

User: All Users

User: Default User

User: Lebictch
->Flash cache emptied: 0 bytes

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.9.1 log created on 07302010_023705

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Running the quick scan now...

efilflah · 2010/07/29

OLT Quick Scan:

OTL logfile created on: 30/07/2010 02:40:59 - Run 2
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Lebictch\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,023.00 Mb Total Physical Memory | 692.00 Mb Available Physical Memory | 68.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 87.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.78 Gb Total Space | 62.99 Gb Free Space | 56.35% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 2.24 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: EFILFLAH
Current User Name: Lebictch
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/07/30 01:44:16 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Lebictch\Desktop\OTL.exe
PRC - [2010/04/01 13:33:19 | 000,267,432 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2010/03/02 11:28:31 | 000,282,792 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010/02/24 10:28:09 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2010/01/14 22:11:00 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009/02/21 00:11:30 | 000,364,544 | ---- | M] (ELAN Microelectronics Corp.) -- C:\Program Files\ELAN\USB\ETDUSBCtrl.exe
PRC - [2008/04/14 14:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/04/16 16:28:22 | 000,577,536 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\soundman.exe

========== Modules (SafeList) ==========

MOD - [2010/07/30 01:44:16 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Lebictch\Desktop\OTL.exe
MOD - [2008/04/14 14:40:22 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - [2010/04/01 13:33:19 | 000,267,432 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010/02/24 10:28:09 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\Lebictch\LOCALS~1\Temp\catchme.sys -- (catchme)
DRV - [2010/06/26 16:07:09 | 000,271,360 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt)
DRV - [2010/06/26 16:07:08 | 000,018,048 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2010/03/01 10:05:24 | 000,124,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2010/02/16 14:24:01 | 000,060,936 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009/05/11 12:49:19 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2009/05/11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/02/07 00:46:50 | 000,025,088 | ---- | M] (ELAN Microelectronics Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ETDUSB.sys -- (hidflt)
DRV - [2009/01/14 08:14:01 | 003,455,488 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2008/09/24 11:40:22 | 004,122,368 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\alcxwdm.sys -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2008/05/15 02:24:32 | 000,171,520 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\atinavt2.sys -- (ATIAVAIW)
DRV - [2008/04/14 09:16:24 | 000,015,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mpe.sys -- (MPE)
DRV - [2004/08/27 17:18:50 | 000,097,920 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\si3112r.sys -- (si3112r)
DRV - [2004/06/03 10:40:46 | 000,079,360 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\nvatabus.sys -- (nvatabus)
DRV - [2004/05/25 15:58:04 | 000,396,032 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nvapu.sys -- (nvnforce) Service for NVIDIA(R) nForce(TM)
DRV - [2004/05/25 15:58:02 | 000,048,640 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvax.sys -- (nvax) Service for NVIDIA(R) nForce(TM)
DRV - [2004/05/20 18:35:16 | 000,010,240 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\SiWinAcc.sys -- (SiWinAcc)
DRV - [2004/05/20 18:35:16 | 000,010,240 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\SiWinAcc.sys -- (SiFilter)
DRV - [2004/04/02 15:40:00 | 000,021,760 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\nv_agp.sys -- (nv_agp)
DRV - [2004/01/29 01:45:50 | 000,093,764 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENET.sys -- (NVENET)
DRV - [2001/08/17 15:00:04 | 000,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://uk.search.yahoo.com/?fr=avantsearch
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7.3

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/06/05 14:17:22 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/30 02:32:23 | 000,000,000 | ---D | M]

[2010/06/05 14:17:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lebictch\Application Data\Mozilla\Extensions
[2010/06/25 21:12:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lebictch\Application Data\Mozilla\Firefox\Profiles\w3btot4w.default\extensions
[2010/06/05 14:19:36 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Documents and Settings\Lebictch\Application Data\Mozilla\Firefox\Profiles\w3btot4w.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010/07/30 02:32:23 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/07/30 02:32:23 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/07/17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[1999/12/31 17:00:00 | 000,165,656 | ---- | M] (Tracker Software Products Ltd.) -- C:\Program Files\Mozilla Firefox\plugins\npPDFXCviewNPPlugin.dll

O1 HOSTS File: ([2010/07/29 23:19:35 | 000,609,487 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 fr.a2dfp.net
O1 - Hosts: 127.0.0.1 m.fr.a2dfp.net
O1 - Hosts: 127.0.0.1 ad.a8.net
O1 - Hosts: 127.0.0.1 asy.a8ww.net
O1 - Hosts: 127.0.0.1 abcstats.com
O1 - Hosts: 127.0.0.1 a.abv.bg
O1 - Hosts: 127.0.0.1 adserver.abv.bg
O1 - Hosts: 127.0.0.1 adv.abv.bg
O1 - Hosts: 127.0.0.1 bimg.abv.bg
O1 - Hosts: 127.0.0.1 ca.abv.bg
O1 - Hosts: 127.0.0.1 www2.a-counter.kiev.ua
O1 - Hosts: 127.0.0.1 track.acclaimnetwork.com
O1 - Hosts: 127.0.0.1 accuserveadsystem.com
O1 - Hosts: 127.0.0.1 www.accuserveadsystem.com
O1 - Hosts: 127.0.0.1 achmedia.com
O1 - Hosts: 127.0.0.1 aconti.net
O1 - Hosts: 127.0.0.1 secure.aconti.net
O1 - Hosts: 127.0.0.1 www.aconti.net #[Dialer.Aconti]
O1 - Hosts: 127.0.0.1 ads.active.com
O1 - Hosts: 127.0.0.1 am1.activemeter.com
O1 - Hosts: 127.0.0.1 www.activemeter.com #[Tracking.Cookie]
O1 - Hosts: 127.0.0.1 ads.activepower.net
O1 - Hosts: 127.0.0.1 stat.active24stats.nl #[Tracking.Cookie]
O1 - Hosts: 127.0.0.1 ad2games.com
O1 - Hosts: 16077 more lines...
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [ETDUSBWare] C:\Program Files\ELAN\USB\ETDUSBCtrl.exe (ELAN Microelectronics Corp.)
O4 - HKLM..\Run: [NVMixerTray] C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.23.3.1 64.129.67.102
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Lebictch\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Lebictch\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/03/04 22:06:52 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/04/24 10:57:26 | 000,000,050 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2006/07/06 10:07:02 | 000,578,654 | R--- | M] () - E:\autostart.bmp -- [ CDFS ]
O32 - AutoRun File - [2006/08/16 08:37:16 | 000,001,412 | R--- | M] () - E:\autostart.dat -- [ CDFS ]
O32 - AutoRun File - [2006/06/14 07:26:50 | 000,001,132 | R--- | M] () - E:\autostart.ini -- [ CDFS ]
O32 - AutoRun File - [2006/06/15 17:36:42 | 000,196,608 | R--- | M] () - E:\AutoStarter.exe -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 90 Days ==========

[2010/07/30 02:37:05 | 000,000,000 | ---D | C] -- C:\_OTL
[2010/07/30 02:34:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lebictch\Desktop\JavaRa
[2010/07/30 02:32:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun
[2010/07/30 02:32:39 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010/07/30 01:44:25 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/07/30 01:44:19 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Lebictch\Desktop\OTL.exe
[2010/07/30 01:29:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2010/07/29 23:01:37 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/07/29 23:00:29 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/07/28 18:26:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2010/07/28 18:17:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/07/27 18:19:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData
[2010/07/27 18:17:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lebictch\Application Data\Avira
[2010/07/27 18:13:37 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2010/07/27 18:13:36 | 000,124,784 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2010/07/27 18:13:36 | 000,060,936 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2010/07/27 18:13:36 | 000,045,416 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntdd.sys
[2010/07/27 18:13:36 | 000,022,360 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntmgr.sys
[2010/07/27 18:13:36 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2010/07/27 18:13:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Avira
[2010/07/27 18:10:19 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Lebictch\Recent
[2010/07/26 23:48:50 | 000,012,872 | ---- | C] (SurfRight B.V.) -- C:\WINDOWS\System32\bootdelete.exe
[2010/07/26 23:00:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/07/26 22:58:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/07/07 00:41:10 | 000,000,000 | ---D | C] -- C:\Program Files\Tracker Software
[2010/06/26 12:16:17 | 000,000,000 | ---D | C] -- C:\Program Files\Deep Silver
[2010/06/25 21:49:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Hitman Pro
[2010/06/25 21:49:11 | 000,000,000 | ---D | C] -- C:\Program Files\Hitman Pro 3.5
[2010/06/25 21:17:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lebictch\Application Data\Malwarebytes
[2010/06/25 21:17:47 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/06/25 21:17:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/06/25 21:17:45 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/06/25 21:17:45 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/06/25 19:52:26 | 000,000,000 | ---D | C] -- C:\WINDOWS\Downloaded Installations
[2010/06/25 18:46:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lebictch\Local Settings\Application Data\VSO
[2010/06/25 17:21:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lebictch\Application Data\Notepad++
[2010/06/25 17:21:16 | 000,000,000 | ---D | C] -- C:\Program Files\Notepad++
[2010/06/25 17:20:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lebictch\My Documents\Still Life 2 Saves
[2010/06/19 18:19:54 | 000,000,000 | ---D | C] -- C:\Program Files\Microids
[2010/06/06 12:24:06 | 000,000,000 | ---D | C] -- C:\Reg Tweaks
[2010/06/06 12:22:00 | 000,000,000 | ---D | C] -- C:\Program Files\Cablenut
[2010/06/05 14:19:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lebictch\dwhelper
[2010/06/05 14:17:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lebictch\Local Settings\Application Data\Mozilla
[2010/06/05 14:17:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lebictch\Application Data\Mozilla
[2010/06/05 14:17:16 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2010/06/05 13:52:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NOS
[2010/05/24 16:57:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lebictch\Application Data\uTorrent
[2010/05/08 19:28:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lebictch\Local Settings\Application Data\Apple Computer
[2010/05/08 19:24:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Apple Computer
[2010/05/08 19:24:30 | 000,000,000 | ---D | C] -- C:\Program Files\QT Lite
[2010/05/01 15:20:58 | 000,000,000 | ---D | C] -- C:\Program Files\uTorrent185
[2010/05/01 15:00:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Lebictch\Application Data\UT Backup

========== Files - Modified Within 90 Days ==========

[2010/07/30 02:38:06 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/07/30 02:38:04 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/07/30 02:37:12 | 003,145,728 | -H-- | M] () -- C:\Documents and Settings\Lebictch\NTUSER.DAT
[2010/07/30 02:37:12 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Lebictch\ntuser.ini
[2010/07/30 02:34:10 | 000,071,798 | ---- | M] () -- C:\Documents and Settings\Lebictch\Desktop\JavaRa.zip
[2010/07/30 02:24:32 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2010/07/30 01:44:16 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Lebictch\Desktop\OTL.exe
[2010/07/30 01:41:47 | 007,087,824 | -H-- | M] () -- C:\Documents and Settings\Lebictch\Local Settings\Application Data\IconCache.db
[2010/07/30 01:28:30 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/07/29 23:19:35 | 000,609,487 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/07/27 18:10:46 | 000,069,612 | ---- | M] () -- C:\Documents and Settings\Lebictch\My Documents\cc_20100727_181035.reg
[2010/07/27 18:06:06 | 000,000,403 | ---- | M] () -- C:\Documents and Settings\Lebictch\Desktop\Applications.lnk
[2010/07/27 17:56:34 | 000,000,578 | ---- | M] () -- C:\Documents and Settings\Lebictch\Application Data\Microsoft\Internet Explorer\Quick Launch\Shortcut to HijackThis.exe.lnk
[2010/07/26 23:55:52 | 000,000,051 | ---- | M] () -- C:\WINDOWS\WININIT.INI
[2010/07/26 23:49:07 | 000,019,992 | ---- | M] () -- C:\Documents and Settings\Lebictch\My Documents\log.xml
[2010/07/26 23:48:50 | 000,012,872 | ---- | M] (SurfRight B.V.) -- C:\WINDOWS\System32\bootdelete.exe
[2010/07/26 23:46:18 | 000,016,968 | ---- | M] () -- C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2010/07/24 18:04:42 | 000,607,040 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\HOSTS.MVP
[2010/07/15 18:23:47 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/07/05 15:02:13 | 000,000,804 | ---- | M] () -- C:\Documents and Settings\Lebictch\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2010/06/26 16:07:09 | 000,271,360 | ---- | M] () -- C:\WINDOWS\System32\drivers\atksgt.sys
[2010/06/26 16:07:08 | 000,018,048 | ---- | M] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
[2010/06/25 21:52:15 | 000,001,663 | ---- | M] () -- C:\Documents and Settings\Lebictch\Application Data\Microsoft\Internet Explorer\Quick Launch\Hitman Pro 3.5.lnk
[2010/06/25 21:17:49 | 000,000,714 | ---- | M] () -- C:\Documents and Settings\Lebictch\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2010/06/25 12:10:34 | 000,103,424 | ---- | M] () -- C:\Documents and Settings\Lebictch\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/24 00:09:01 | 056,655,300 | ---- | M] () -- C:\Documents and Settings\Lebictch\My Documents\Reg Backup.reg
[2010/06/16 00:13:56 | 000,000,990 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-362288127-682003330-1003UA.job
[2010/06/16 00:13:55 | 000,000,938 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-362288127-682003330-1003Core.job
[2010/06/12 19:49:57 | 000,004,096 | ---- | M] () -- C:\WINDOWS\System32\crash
[2010/06/12 19:49:55 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/06/05 14:18:04 | 000,000,000 | ---- | M] () -- C:\WINDOWS\nsreg.dat
[2010/06/05 14:17:18 | 000,001,620 | ---- | M] () -- C:\Documents and Settings\Lebictch\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/05/24 10:31:16 | 000,004,042 | ---- | M] () -- C:\Documents and Settings\Lebictch\Application Data\settings.dat
[2010/05/22 17:32:13 | 000,000,038 | ---- | M] () -- C:\WINDOWS\AviSplitter.INI
[2010/05/02 01:54:32 | 000,000,721 | ---- | M] () -- C:\Documents and Settings\Lebictch\Application Data\Microsoft\Internet Explorer\Quick Launch\Shortcut to utorrent_1.8.5.exe.lnk

========== Files Created - No Company Name ==========

[2010/07/30 02:34:15 | 000,071,798 | ---- | C] () -- C:\Documents and Settings\Lebictch\Desktop\JavaRa.zip
[2010/07/30 01:45:46 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\Lebictch\Desktop\gmer.exe
[2010/07/29 23:01:41 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/07/29 23:01:39 | 000,260,272 | ---- | C] () -- C:\cmldr
[2010/07/27 18:10:38 | 000,069,612 | ---- | C] () -- C:\Documents and Settings\Lebictch\My Documents\cc_20100727_181035.reg
[2010/07/27 18:05:17 | 000,000,403 | ---- | C] () -- C:\Documents and Settings\Lebictch\Desktop\Applications.lnk
[2010/07/27 17:56:34 | 000,000,578 | ---- | C] () -- C:\Documents and Settings\Lebictch\Application Data\Microsoft\Internet Explorer\Quick Launch\Shortcut to HijackThis.exe.lnk
[2010/07/26 23:49:07 | 000,019,992 | ---- | C] () -- C:\Documents and Settings\Lebictch\My Documents\log.xml
[2010/07/05 15:02:13 | 000,000,804 | ---- | C] () -- C:\Documents and Settings\Lebictch\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2010/06/26 16:07:08 | 000,271,360 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys
[2010/06/26 16:07:08 | 000,018,048 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
[2010/06/25 21:53:19 | 000,016,968 | ---- | C] () -- C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2010/06/25 21:52:15 | 000,001,663 | ---- | C] () -- C:\Documents and Settings\Lebictch\Application Data\Microsoft\Internet Explorer\Quick Launch\Hitman Pro 3.5.lnk
[2010/06/25 21:17:49 | 000,000,714 | ---- | C] () -- C:\Documents and Settings\Lebictch\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2010/06/24 00:08:58 | 056,655,300 | ---- | C] () -- C:\Documents and Settings\Lebictch\My Documents\Reg Backup.reg
[2010/06/12 19:49:57 | 000,004,096 | ---- | C] () -- C:\WINDOWS\System32\crash
[2010/06/12 19:49:55 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/06/05 14:18:04 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/06/05 14:17:18 | 000,001,620 | ---- | C] () -- C:\Documents and Settings\Lebictch\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/05/24 10:41:07 | 000,004,042 | ---- | C] () -- C:\Documents and Settings\Lebictch\Application Data\settings.dat
[2010/05/14 12:25:36 | 000,000,038 | ---- | C] () -- C:\WINDOWS\AviSplitter.INI
[2010/05/02 01:53:57 | 000,000,721 | ---- | C] () -- C:\Documents and Settings\Lebictch\Application Data\Microsoft\Internet Explorer\Quick Launch\Shortcut to utorrent_1.8.5.exe.lnk
[2010/03/06 11:29:35 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2010/03/04 23:01:12 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2010/03/04 16:54:05 | 000,000,051 | ---- | C] () -- C:\WINDOWS\WININIT.INI

========== LOP Check ==========

[2010/07/26 23:48:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Hitman Pro
[2010/06/25 17:21:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lebictch\Application Data\Notepad++
[2010/07/29 23:14:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lebictch\Application Data\Orca Profiles
[2010/05/01 15:01:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lebictch\Application Data\UT Backup
[2010/07/28 00:43:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lebictch\Application Data\uTorrent
[2010/06/25 19:41:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lebictch\Application Data\VSO

========== Purity Check ==========

< End of report >

broni · 2010/07/29

Nice

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe

Follow the onscreen instructions inside of the black box.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

2. Download Temp File Cleaner (TFC)
Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

3. Go to Kaspersky website and perform an online antivirus scan.

1. Disable your active antivirus program.
2. Read through the requirements and privacy statement and click on Accept button.
3. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
4. When the downloads have finished, click on Settings.
5. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:

Spyware, Adware, Dialers, and other potentially dangerous programs
[*] Archives
[*] Mail databases

6. Click on My Computer under Scan.
7. Once the scan is complete, it will display the results. Click on View Scan Report.
8. You will see a list of infected items there. Click on Save Report As....
9. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

efilflah · 2010/07/29

Results of screen317's Security Check version 0.99.4
Windows XP Service Pack 3
Internet Explorer 6 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Avira AntiVir Personal - Free Antivirus
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
MVPS Hosts File
Malwarebytes' Anti-Malware
CCleaner
Java(TM) 6 Update 21
Out of date Java installed!
Adobe Flash Player 10.1.53.64
Mozilla Firefox (3.6.3)
````````````````````````````````
Process Check:
objlist.exe by Laurent
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
````````````````````````````````
DNS Vulnerability Check:

``````````End of Log````````````

Since updating java i don't think i've rebooted, maybe thats why its flagged as Out of Date?

efilflah · 2010/07/29

Here is TFC result:

Getting user folders.

Stopping running processes.

Emptying Temp folders.

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Lebictch
->Temp folder emptied: 2771 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes

Emptying RecycleBin. Do not interrupt.

RecycleBin emptied: 123668 bytes
Process complete!

Total Files Cleaned = 0.00 mb

I'll run kaspersky online check now, but my old cpu might make it take a while.

broni · 2010/07/29

Kaspersky DOES take a while, so be patient

efilflah · 2010/07/30

I fell asleep waiting for Kaspersky to finish. It took 3.5 hours and came back giving the all clear, no malicious objects found at all.

When viewing the report, the page timed out and I couldnt save it, do you want me to run it again? (please say no)

broni · 2010/07/30

I say "no "...LOL

OTL Clean-Up
Clean up with OTL:

* Double-click OTL.exe to start the program.
* Close all other programs apart from OTL as this step will require a reboot
* On the OTL main screen, press the CLEANUP button
* Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

===============================================================

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point.

Turn off System Restore:

- Windows XP:
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore ".
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
- Windows Vista and 7:
1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C: ")
7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
8. Click OK

2. Restart computer.

3. Turn System Restore on.

4. Make sure, Windows Updates are current.

[SIZE= "4"]5. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately![/SIZE]

6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

7. Run defrag at your convenience.

8. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

9. Please, let me know, how is your computer doing.

efilflah · 2010/07/30

I have done as instructed.

My computer is running fine, asides from the media function buttons on my keyboard not working anymore, but I'm sure I just need to reinstall the drivers to solve that.

I appreciate the time you've spent helping me out, it was a very kind thing to do and quite educational.

broni · 2010/07/30

You're very welcome

I'm sure I just need to reinstall the drivers to solve that.
Click to expand...

That's, most likely, the case.

Good luck and stay safe

Log in or Sign up

Solved Mouse clicking Sound virus

broni Moderator Malware Analyst

efilflah Inactive Thread Starter

broni Moderator Malware Analyst

efilflah Inactive Thread Starter

broni Moderator Malware Analyst

efilflah Inactive Thread Starter

broni Moderator Malware Analyst

efilflah Inactive Thread Starter

efilflah Inactive Thread Starter

broni Moderator Malware Analyst

efilflah Inactive Thread Starter

efilflah Inactive Thread Starter

broni Moderator Malware Analyst

efilflah Inactive Thread Starter

efilflah Inactive Thread Starter

broni Moderator Malware Analyst

efilflah Inactive Thread Starter

broni Moderator Malware Analyst

efilflah Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Solved Mouse clicking Sound virus

broni Moderator Malware Analyst

efilflah Inactive Thread Starter

broni Moderator Malware Analyst

efilflah Inactive Thread Starter

broni Moderator Malware Analyst

efilflah Inactive Thread Starter

broni Moderator Malware Analyst

efilflah Inactive Thread Starter

efilflah Inactive Thread Starter

broni Moderator Malware Analyst

efilflah Inactive Thread Starter

efilflah Inactive Thread Starter

broni Moderator Malware Analyst

efilflah Inactive Thread Starter

efilflah Inactive Thread Starter

broni Moderator Malware Analyst

efilflah Inactive Thread Starter

broni Moderator Malware Analyst

efilflah Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Useful Searches