1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved someone please look at this for me

Discussion in 'Malware and Virus Removal Archive' started by jan roberts, 2010/07/17.

  1. 2010/07/19
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please, re-read my reply #15.
     
  2. 2010/07/19
    jan roberts

    jan roberts Inactive Thread Starter

    Joined:
    2005/01/08
    Messages:
    507
    Likes Received:
    2
    first time i ever did that and i hope this is it

    ComboFix 10-07-19.01 - jan 07/19/2010 15:58:27.3.2 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1342 [GMT -4:00]
    Running from: c:\documents and settings\jan\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\jan\Desktop\CFScript.txt
    AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
    FW: COMODO Firewall Pro *disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
    .

    ((((((((((((((((((((((((( Files Created from 2010-06-19 to 2010-07-19 )))))))))))))))))))))))))))))))
    .

    2010-07-16 14:46 . 2010-07-16 14:46 518 ----a-w- c:\documents and settings\jan\Application Data\iolo\Registry\Last\restore.bat
    2010-07-16 13:57 . 2010-07-16 13:57 -------- dc----w- c:\documents and settings\All Users\Application Data\Dell V310-V510 Series
    2010-07-14 11:08 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe
    2010-07-13 18:16 . 2010-07-13 18:16 1479 ----a-w- c:\documents and settings\jan\Application Data\iolo\restore.bat
    2010-07-13 18:08 . 2010-07-13 18:08 -------- d-----w- c:\documents and settings\LocalService\Application Data\iolo
    2010-07-13 18:07 . 2009-06-26 20:05 938328 ----a-w- c:\windows\system32\Incinerator.dll
    2010-07-13 18:06 . 2009-01-15 20:43 8192 ----a-w- c:\windows\system32\smrgdf.exe
    2010-07-13 18:06 . 2009-01-15 20:43 28672 ----a-w- c:\windows\system32\iolobtdfg.exe
    2010-07-13 18:06 . 2010-07-13 18:06 -------- d-----w- c:\program files\iolo
    2010-07-13 18:02 . 2010-07-13 18:02 74703 ----a-w- c:\windows\system32\mfc45.dll
    2010-07-13 18:02 . 2010-07-13 19:07 -------- dc----w- c:\documents and settings\All Users\Application Data\iolo
    2010-07-13 18:02 . 2010-07-13 18:16 -------- d-----w- c:\documents and settings\jan\Application Data\iolo
    2010-07-13 17:53 . 2008-03-05 01:55 40960 ----a-w- c:\windows\system32\dleavs.dll
    2010-07-13 17:53 . 2009-12-16 15:12 438272 ----a-w- c:\windows\system32\dleacoin.dll
    2010-07-13 17:53 . 2009-11-04 12:14 157696 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\dleadrpp.dll
    2010-07-13 17:53 . 2009-11-09 06:59 86016 ----a-w- c:\windows\system32\dleagcfg.dll
    2010-07-13 17:53 . 2009-10-21 09:06 110592 ----a-w- c:\windows\system32\dleacuir.dll
    2010-07-13 17:53 . 2009-10-21 09:06 294912 ----a-w- c:\windows\system32\dleacui.dll
    2010-07-13 17:53 . 2008-04-30 05:32 983121 ----a-w- c:\windows\system32\lxk_gf.dll
    2010-07-13 17:51 . 2010-01-07 20:09 598696 ----a-w- c:\windows\system32\dleacoms.exe
    2010-07-13 17:51 . 2009-12-09 18:36 372736 ----a-w- c:\windows\system32\dleacomm.dll
    2010-07-13 17:51 . 2009-12-09 18:35 802816 ----a-w- c:\windows\system32\dleacomc.dll
    2010-07-13 17:51 . 2010-01-07 20:09 373416 ----a-w- c:\windows\system32\dleacfg.exe
    2010-07-13 17:51 . 2009-11-26 07:49 86180 ----a-w- c:\windows\system32\DLEAcfg.dll
    2010-07-13 17:51 . 2010-07-13 17:53 -------- d-----w- c:\program files\Dell V310-V510 Series
    2010-07-13 17:23 . 2010-07-13 17:29 -------- d-----w- c:\program files\Disk Cleaner
    2010-07-13 17:11 . 2010-07-13 17:11 -------- d-----w- c:\program files\Citrix
    2010-07-08 23:41 . 2010-07-08 23:41 -------- d-----w- c:\program files\iPod
    2010-07-08 23:41 . 2010-07-08 23:42 -------- d-----w- c:\program files\iTunes
    2010-07-08 23:40 . 2010-07-13 15:39 -------- d-----w- c:\program files\QuickTime
    2010-07-08 23:39 . 2010-07-08 23:39 -------- d-----w- c:\program files\Apple Software Update
    2010-07-08 23:39 . 2010-07-08 23:39 -------- d-----w- c:\program files\Bonjour
    2010-07-08 23:38 . 2010-07-08 23:41 -------- d-----w- c:\program files\Common Files\Apple
    2010-07-08 23:24 . 2009-12-16 18:42 43008 ----a-w- c:\documents and settings\jan\Application Data\Mozilla\Firefox\Profiles\cc3tm9zy.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
    2010-07-08 23:24 . 2009-12-16 18:42 872960 ----a-w- c:\documents and settings\jan\Application Data\Mozilla\Firefox\Profiles\cc3tm9zy.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
    2010-07-08 23:24 . 2009-12-16 18:42 340480 ----a-w- c:\documents and settings\jan\Application Data\Mozilla\Firefox\Profiles\cc3tm9zy.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
    2010-07-08 23:24 . 2009-12-16 18:41 346624 ----a-w- c:\documents and settings\jan\Application Data\Mozilla\Firefox\Profiles\cc3tm9zy.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
    2010-07-06 10:37 . 2010-07-08 23:53 -------- dc----w- c:\documents and settings\All Users\Application Data\{C3243856-7746-4A05-8837-51A28C1CDD82}
    2010-07-06 10:36 . 2010-07-06 10:36 -------- d-----w- c:\documents and settings\jan\Local Settings\Application Data\Downloaded Installations
    2010-06-23 11:40 . 2010-06-23 11:40 501936 -c--a-w- c:\documents and settings\All Users\Application Data\Google\Google Toolbar\Update\gtb14.tmp.exe
    2010-06-21 12:09 . 2010-06-21 12:09 23 --sha-w- c:\windows\system32\edacded0.dat

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-07-19 17:49 . 2008-03-01 14:51 -------- dc--a-w- c:\documents and settings\All Users\Application Data\TEMP
    2010-07-16 14:46 . 2007-12-09 20:05 -------- d-----w- c:\program files\PCFriendly
    2010-07-13 18:06 . 2010-07-13 17:52 -------- d-----w- c:\program files\Dell
    2010-07-13 17:52 . 2010-07-13 17:52 -------- d-----w- c:\program files\Dell Toolbar
    2010-07-13 17:52 . 2010-07-13 17:52 -------- d-----w- c:\program files\Dell PC Fax
    2010-07-13 17:27 . 2006-02-25 06:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2010-07-13 15:41 . 2006-02-25 05:26 -------- d-----w- c:\program files\Google
    2010-07-09 13:09 . 2007-04-06 14:19 -------- d-----w- c:\program files\SpywareBlaster
    2010-06-29 17:08 . 2010-04-09 19:45 -------- d-----w- c:\program files\Microsoft Security Essentials
    2010-06-16 12:44 . 2010-06-16 12:44 -------- d-----w- c:\documents and settings\jan\Application Data\ElevatedDiagnostics
    2010-06-16 00:01 . 2010-06-16 00:01 72504 -c--a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.0.61\SetupAdmin.exe
    2010-06-14 14:31 . 2004-08-19 21:04 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
    2010-06-08 18:31 . 2006-07-23 07:09 -------- d-----w- c:\documents and settings\jan\Application Data\Apple Computer
    2010-06-04 13:00 . 2009-05-09 22:31 -------- d-----w- c:\program files\Microsoft Silverlight
    2010-06-01 17:37 . 2010-04-09 19:47 221568 ------w- c:\windows\system32\MpSigStub.exe
    2010-05-28 00:20 . 2010-05-28 00:20 503808 ----a-w- c:\documents and settings\jan\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-7477cf11-n\msvcp71.dll
    2010-05-28 00:20 . 2010-05-28 00:20 499712 ----a-w- c:\documents and settings\jan\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-7477cf11-n\jmc.dll
    2010-05-28 00:20 . 2010-05-28 00:20 348160 ----a-w- c:\documents and settings\jan\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-7477cf11-n\msvcr71.dll
    2010-05-28 00:20 . 2010-05-28 00:20 61440 ----a-w- c:\documents and settings\jan\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-25f46101-n\decora-sse.dll
    2010-05-28 00:20 . 2010-05-28 00:20 12800 ----a-w- c:\documents and settings\jan\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-25f46101-n\decora-d3d.dll
    2010-05-18 20:35 . 2010-05-18 20:35 91424 ----a-w- c:\windows\system32\dnssd.dll
    2010-05-18 20:35 . 2010-05-18 20:35 75040 ----a-w- c:\windows\system32\jdns_sd.dll
    2010-05-18 20:35 . 2010-05-18 20:35 197920 ----a-w- c:\windows\system32\dnssdX.dll
    2010-05-18 20:35 . 2010-05-18 20:35 107808 ----a-w- c:\windows\system32\dns-sd.exe
    2010-05-06 10:41 . 2004-08-19 20:49 916480 ----a-w- c:\windows\system32\wininet.dll
    2010-05-02 05:22 . 2004-08-19 20:49 1851264 ----a-w- c:\windows\system32\win32k.sys
    2008-06-20 23:43 . 2006-11-10 15:31 56 --sh--r- c:\windows\system32\D3A869E4A2.sys
    2008-06-20 23:43 . 2006-11-10 15:31 1682 --sha-w- c:\windows\system32\KGyGaAvL.sys
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ISUSPM "= "c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
    "DellSupport "= "c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
    "DellSupportCenter "= "c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
    "Google Update "= "c:\documents and settings\jan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-02-25 135664]
    "swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-16 68856]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ehTray "= "c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
    "IntelMeM "= "c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
    "CTSysVol "= "c:\program files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]
    "CTDVDDET "= "c:\program files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE" [2003-06-18 45056]
    "CTHelper "= "CTHELPER.EXE" [2007-04-09 19456]
    "UpdReg "= "c:\windows\UpdReg.EXE" [2000-05-11 90112]
    "ISUSPM Startup "= "c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-09-11 218032]
    "ISUSScheduler "= "c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-09-11 86960]
    "SigmatelSysTrayApp "= "stsystra.exe" [2005-03-23 339968]
    "googletalk "= "c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
    "HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2005-04-05 77824]
    "Persistence "= "c:\windows\system32\igfxpers.exe" [2005-04-05 114688]
    "dscactivate "= "c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
    "DellSupportCenter "= "c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
    "Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
    "MSSE "= "c:\program files\Microsoft Security Essentials\msseces.exe" [2010-06-01 1093208]
    "iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2010-06-15 141624]
    "dleamon.exe "= "c:\program files\Dell V310-V510 Series\dleamon.exe" [2010-01-18 770728]
    "EzPrint "= "c:\program files\Dell V310-V510 Series\ezprint.exe" [2010-01-18 139944]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Audible Download Manager.lnk - c:\program files\Audible\Bin\AudibleDownloadHelper.exe [2009-12-17 1795488]
    Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-5-4 24576]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @= "Service "

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "c:\\Program Files\\Google\\Google Talk\\googletalk.exe "=
    "c:\\Program Files\\Messenger\\msmsgs.exe "=
    "c:\\Program Files\\AIM\\aim.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
    "c:\\Program Files\\Audible\\Bin\\AudibleDownloadHelper.exe "=
    "c:\\Program Files\\att-nap\\McciBrowser.exe "=
    "c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\Scan\\ScanMan6.exe "=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
    "c:\\Program Files\\iTunes\\iTunes.exe "=
    "c:\\WINDOWS\\system32\\dleacoms.exe "=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3389:TCP "= 3389:TCP:mad:xpsp2res.dll,-22009

    R2 dlea_device;dlea_device;c:\windows\system32\dleacoms.exe -service --> c:\windows\system32\dleacoms.exe -service [?]
    R2 dleaCATSCustConnectService;dleaCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\dleaserv.exe [7/13/2010 1:53 PM 98984]
    R2 ioloFileInfoList;iolo FileInfoList Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [7/13/2010 2:06 PM 600944]
    R2 ioloSystemService;iolo System Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [7/13/2010 2:06 PM 600944]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\SITEAD~1\mcsacore.exe [12/8/2009 6:04 PM 93320]
    S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/2/2010 7:11 AM 135664]
    .
    Contents of the 'Scheduled Tasks' folder

    2010-07-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 11:11]

    2010-07-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 11:11]

    2010-07-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1948461421-2004685971-4226772609-1005Core.job
    - c:\documents and settings\jan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-03-17 05:16]

    2010-07-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1948461421-2004685971-4226772609-1005UA.job
    - c:\documents and settings\jan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-03-17 05:16]

    2010-07-19 c:\windows\Tasks\MP Scheduled Scan.job
    - c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2010-03-26 01:40]
    .
    .
    ------- Supplementary Scan -------
    .
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uStart Page = hxxp://att.my.yahoo.com/
    uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
    DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} - hxxp://support.dell.com/systemprofiler/DellSystemLite.CAB
    FF - ProfilePath - c:\documents and settings\jan\Application Data\Mozilla\Firefox\Profiles\cc3tm9zy.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
    FF - prefs.js: browser.search.selectedEngine - Secure Search
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
    FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p=
    FF - component: c:\documents and settings\jan\Application Data\Mozilla\Firefox\Profiles\cc3tm9zy.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
    FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
    FF - plugin: c:\documents and settings\jan\Application Data\Move Networks\plugins\npqmp071505000010.dll
    FF - plugin: c:\documents and settings\jan\Application Data\Move Networks\plugins\npqmp071505000011.dll
    FF - plugin: c:\documents and settings\jan\Local Settings\Application Data\Google\Update\1.2.183.29\npGoogleOneClick8.dll
    FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\NPWXM32.DLL
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-07-19 16:01
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @= "FlashBroker "
    "LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101 "

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe "

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @= "IFlashBroker4 "

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @= "{00020424-0000-0000-C000-000000000046} "

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
    "Version "= "1.0 "
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'explorer.exe'(860)
    c:\windows\system32\WININET.dll
    c:\progra~1\WINDOW~3\wmpband.dll
    c:\windows\system32\ieframe.dll
    c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    Completion time: 2010-07-19 16:04:05
    ComboFix-quarantined-files.txt 2010-07-19 20:04
    ComboFix2.txt 2010-07-19 19:23
    ComboFix3.txt 2010-07-19 18:12
    ComboFix4.txt 2008-12-01 01:23

    Pre-Run: 110,108,618,752 bytes free
    Post-Run: 110,100,303,872 bytes free

    - - End Of File - - 62B3B06B0A3362A4F741B02C76BCD158
     

  3. to hide this advert.

  4. 2010/07/19
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    It didn't work, but we'll do it some other way.

    [Reminder to myself - c:\windows\system32\D3A869E4A2.sys]

    Uninstall Combofix:
    Go Start > Run [Vista users, go Start> "Start search"]
    Type in:
    Combofix /Uninstall
    Note the space between the "Combofix" and the "/Uninstall "
    Click OK (Vista users - press Enter).
    Restart computer.

    ==============================================================

    Download OTL to your Desktop.

    * Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    * Under the Custom Scan box paste this in:



    netsvcs
    drivers32 /all
    %SYSTEMDRIVE%\*.*
    %systemroot%\system32\Spool\prtprocs\w32x86\*.dll
    %systemroot%\system32\*.wt
    %systemroot%\system32\*.ruy
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\system32\spool\prtprocs\w32x86\*.tmp
    %systemroot%\*. /mp /s
    /md5start
    /md5stop
    CREATERESTOREPOINT
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\System32\config\*.sav
    %systemroot%\system32\user32.dll /md5
    %systemroot%\system32\ws2_32.dll /md5
    %systemroot%\system32\ws2help.dll /md5
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs



    * Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
  5. 2010/07/19
    jan roberts

    jan roberts Inactive Thread Starter

    Joined:
    2005/01/08
    Messages:
    507
    Likes Received:
    2
    broni
    uninstalled combofix
    now how do i paste all that stuff into the custom scan box? how i thought it worked,didnt. and can i print it out somehow?
    did the otl scan got the logs but not what i was supposed to paste. sorry
     
  6. 2010/07/19
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Select all text in red with your mouse.
    Hold CTRL key and press C (to copy)
    Open OTL, click inside "custom scan" box, then hold CTRL and press V (to paste).
     
  7. 2010/07/20
    jan roberts

    jan roberts Inactive Thread Starter

    Joined:
    2005/01/08
    Messages:
    507
    Likes Received:
    2
    heres the otl log with the red type in it, i hope

    OTL logfile created on: 7/19/2010 10:15:38 PM - Run 1
    OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\jan\Desktop
    Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 70.00% Memory free
    4.00 Gb Paging File | 3.00 Gb Available in Paging File | 87.00% Paging File free
    Paging file location(s): C:\pagefile.sys 2046 2246 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 144.31 Gb Total Space | 111.56 Gb Free Space | 77.31% Space Free | Partition Type: NTFS
    D: Drive not present or media not loaded
    E: Drive not present or media not loaded
    F: Drive not present or media not loaded
    G: Drive not present or media not loaded
    H: Drive not present or media not loaded
    I: Drive not present or media not loaded

    Computer Name: D8T09M81
    Current User Name: jan
    Logged in as Administrator.

    Current Boot Mode: Normal
    Scan Mode: Current user
    Company Name Whitelist: Off
    Skip Microsoft Files: Off
    File Age = 30 Days
    Output = Standard

    ========== Processes (SafeList) ==========

    PRC - [2010/07/19 22:14:56 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\jan\Desktop\OTL.exe
    PRC - [2010/06/16 13:27:42 | 000,134,808 | ---- | M] (Google Inc.) -- C:\Documents and Settings\jan\Local Settings\Application Data\Google\Update\1.2.183.29\GoogleCrashHandler.exe
    PRC - [2010/06/10 21:03:08 | 000,144,176 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    PRC - [2010/06/01 14:53:46 | 001,093,208 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Essentials\msseces.exe
    PRC - [2010/03/26 11:16:04 | 000,093,320 | ---- | M] (McAfee, Inc.) -- c:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    PRC - [2010/03/25 21:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
    PRC - [2010/01/18 12:13:28 | 000,770,728 | ---- | M] () -- C:\Program Files\Dell V310-V510 Series\dleamon.exe
    PRC - [2010/01/07 16:09:23 | 000,598,696 | ---- | M] ( ) -- C:\WINDOWS\system32\dleacoms.exe
    PRC - [2010/01/07 16:09:17 | 000,098,984 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\dleaserv.exe
    PRC - [2009/12/17 13:54:40 | 001,795,488 | ---- | M] (Audible, Inc.) -- C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
    PRC - [2009/06/23 17:23:48 | 000,600,944 | ---- | M] () -- C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe
    PRC - [2009/05/21 10:55:32 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe
    PRC - [2008/08/13 18:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
    PRC - [2007/03/15 11:09:36 | 000,460,784 | ---- | M] (Gteko Ltd.) -- C:\Program Files\DellSupport\DSAgnt.exe
    PRC - [2007/01/01 17:22:02 | 003,739,648 | ---- | M] (Google) -- C:\Program Files\Google\Google Talk\googletalk.exe
    PRC - [2006/09/11 05:40:32 | 000,218,032 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
    PRC - [2003/10/29 02:06:00 | 000,024,576 | R--- | M] (BVRP Software) -- C:\Program Files\Digital Line Detect\DLG.exe
    PRC - [2003/09/17 11:43:36 | 000,057,344 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe


    ========== Modules (SafeList) ==========

    MOD - [2010/07/19 22:14:56 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\jan\Desktop\OTL.exe
    MOD - [2008/04/13 20:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx


    ========== Win32 Services (SafeList) ==========

    SRV - [2010/06/10 21:03:08 | 000,144,176 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
    SRV - [2010/03/26 11:16:04 | 000,093,320 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files\McAfee\SiteAdvisor\McSACore.exe -- (McAfee SiteAdvisor Service)
    SRV - [2010/03/25 21:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe -- (MsMpSvc)
    SRV - [2010/01/07 16:09:23 | 000,598,696 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\System32\dleacoms.exe -- (dlea_device)
    SRV - [2010/01/07 16:09:17 | 000,098,984 | ---- | M] () [Auto | Running] -- C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\dleaserv.exe -- (dleaCATSCustConnectService)
    SRV - [2009/06/23 17:23:48 | 000,600,944 | ---- | M] () [Auto | Running] -- C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe -- (ioloSystemService)
    SRV - [2009/06/23 17:23:48 | 000,600,944 | ---- | M] () [Auto | Running] -- C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe -- (ioloFileInfoList)
    SRV - [2008/08/13 18:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
    SRV - [2007/03/07 15:47:46 | 000,076,848 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)


    ========== Driver Services (SafeList) ==========

    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS -- (MRESP50a64)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS -- (MREMP50a64)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\jan\LOCALS~1\Temp\mbr.sys -- (mbr)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\jan\LOCALS~1\Temp\catchme.sys -- (catchme)
    DRV - [2010/03/25 21:30:22 | 000,151,216 | ---- | M] (Microsoft Corporation) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\MpFilter.sys -- (MpFilter)
    DRV - [2008/04/13 14:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
    DRV - [2008/04/13 14:36:39 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)
    DRV - [2008/04/13 14:36:39 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)
    DRV - [2008/04/13 12:36:05 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
    DRV - [2008/01/28 16:56:47 | 000,018,304 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MRESP50.sys -- (MRESP50)
    DRV - [2008/01/28 16:56:38 | 000,019,712 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50.sys -- (MREMP50)
    DRV - [2007/04/18 09:59:40 | 000,098,600 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\COMMONFX.DLL -- (COMMONFX.DLL)
    DRV - [2007/04/12 09:10:26 | 000,164,608 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\CT20XUT.DLL -- (CT20XUT.DLL)
    DRV - [2007/04/12 09:10:26 | 000,066,816 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\CTHWIUT.DLL -- (CTHWIUT.DLL)
    DRV - [2007/04/12 09:10:24 | 001,317,632 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\CTEXFIFX.DLL -- (CTEXFIFX.DLL)
    DRV - [2007/04/12 09:10:22 | 000,323,328 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\CTEDSPSY.DLL -- (CTEDSPSY.DLL)
    DRV - [2007/04/12 09:10:22 | 000,128,768 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\CTEDSPIO.DLL -- (CTEDSPIO.DLL)
    DRV - [2007/04/12 09:10:20 | 000,280,320 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\CTEDSPFX.DLL -- (CTEDSPFX.DLL)
    DRV - [2007/04/12 09:10:20 | 000,094,976 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\CTERFXFX.DLL -- (CTERFXFX.DLL)
    DRV - [2007/04/12 09:10:18 | 000,168,192 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\CTEAPSFX.DLL -- (CTEAPSFX.DLL)
    DRV - [2007/04/12 09:10:16 | 000,560,384 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\CTSBLFX.DLL -- (CTSBLFX.DLL)
    DRV - [2007/04/12 09:10:16 | 000,546,048 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\CTAUDFX.DLL -- (CTAUDFX.DLL)
    DRV - [2007/04/10 07:00:24 | 000,157,480 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctsfm2k.sys -- (ctsfm2k)
    DRV - [2007/04/10 06:59:04 | 000,126,760 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctoss2k.sys -- (ossrv)
    DRV - [2007/04/10 05:32:34 | 000,016,168 | ---- | M] (Creative Technology Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\pfmodnt.sys -- (PfModNT)
    DRV - [2007/04/10 05:32:06 | 000,189,736 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\haP17v2k.sys -- (hap17v2k)
    DRV - [2007/04/10 05:31:18 | 000,163,112 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\haP16v2k.sys -- (hap16v2k)
    DRV - [2007/04/10 05:29:10 | 000,797,992 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ha10kx2k.sys -- (ha10kx2k)
    DRV - [2007/04/10 05:28:36 | 000,092,968 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\emupia2k.sys -- (emupia)
    DRV - [2007/04/10 05:25:46 | 000,014,632 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctprxy2k.sys -- (ctprxy2k)
    DRV - [2007/04/10 05:21:06 | 000,347,128 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctdvda2k.sys -- (ctdvda2k)
    DRV - [2007/04/10 05:20:38 | 000,520,488 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctaud2k.sys -- (ctaud2k) Creative Audio Driver (WDM)
    DRV - [2007/04/10 05:19:30 | 000,511,272 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctac32k.sys -- (ctac32k)
    DRV - [2007/02/25 12:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\dsunidrv.sys -- (dsunidrv)
    DRV - [2006/10/05 16:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Running] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
    DRV - [2006/02/09 20:57:46 | 001,502,208 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
    DRV - [2005/06/14 23:40:08 | 000,180,864 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA) High Definition Audio Driver (WDM)
    DRV - [2005/04/07 17:18:34 | 000,003,840 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\BANTExt.sys -- (BANTExt)
    DRV - [2004/08/03 23:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
    DRV - [2004/06/16 04:52:40 | 000,061,157 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\IntelC53.sys -- (IntelC53)
    DRV - [2004/06/09 11:29:56 | 000,006,977 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\DDMI2.sys -- (SDDMI2)
    DRV - [2004/03/06 05:15:34 | 000,647,929 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\IntelC52.sys -- (IntelC52)
    DRV - [2004/03/06 05:14:42 | 001,233,525 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\IntelC51.sys -- (IntelC51)
    DRV - [2004/03/06 05:13:38 | 000,037,048 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mohfilt.sys -- (mohfilt)
    DRV - [2001/08/17 15:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)
    DRV - [2001/08/17 15:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)
    DRV - [2001/08/17 15:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)
    DRV - [2001/08/17 15:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)
    DRV - [2001/08/17 15:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)
    DRV - [2001/08/17 14:57:38 | 000,016,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\MODEMCSA.sys -- (MODEMCSA)
    DRV - [2001/08/17 14:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)
    DRV - [2001/08/17 14:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)
    DRV - [2001/08/17 14:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)
    DRV - [2001/08/17 14:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)
    DRV - [2001/08/17 14:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)
    DRV - [2001/08/17 14:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)
    DRV - [2001/08/17 14:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)
    DRV - [2001/08/17 14:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)
    DRV - [2001/08/17 14:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)
    DRV - [2001/08/17 14:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========


    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://att.my.yahoo.com/
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 4C 22 A8 51 B2 22 CB 01 [binary data]
    IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

    ========== FireFox ==========

    FF - prefs.js..browser.search.defaultenginename: "Secure Search "
    FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= "
    FF - prefs.js..browser.search.selectedEngine: "Secure Search "
    FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/ "
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
    FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
    FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.1
    FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.%(version)s
    FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=mcafee&p= "


    FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/07/14 09:57:04 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/06 07:09:31 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/06 07:09:31 | 000,000,000 | ---D | M]

    [2009/03/29 21:43:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\jan\Application Data\Mozilla\Extensions
    [2010/07/17 19:25:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\jan\Application Data\Mozilla\Firefox\Profiles\cc3tm9zy.default\extensions
    [2006/12/15 16:35:26 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\jan\Application Data\Mozilla\Firefox\Profiles\cc3tm9zy.default\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
    [2009/06/26 09:33:58 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\jan\Application Data\Mozilla\Firefox\Profiles\cc3tm9zy.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    [2010/07/08 19:24:46 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Documents and Settings\jan\Application Data\Mozilla\Firefox\Profiles\cc3tm9zy.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
    [2006/12/15 16:27:38 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\jan\Application Data\Mozilla\Firefox\Profiles\cc3tm9zy.default\extensions\{86b1f2a0-1790-11db-ac5d-0800200c9a66}
    [2006/12/15 16:32:15 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\jan\Application Data\Mozilla\Firefox\Profiles\cc3tm9zy.default\extensions\{dd30bf68-268a-4815-ad48-8740b774c764}
    [2006/12/15 14:41:52 | 000,002,214 | ---- | M] () -- C:\Documents and Settings\jan\Application Data\Mozilla\Firefox\Profiles\cc3tm9zy.default\searchplugins\cddball.xml
    [2008/08/02 12:12:22 | 000,000,908 | ---- | M] () -- C:\Documents and Settings\jan\Application Data\Mozilla\Firefox\Profiles\cc3tm9zy.default\searchplugins\IMDB.xml
    [2006/12/15 14:41:53 | 000,002,386 | ---- | M] () -- C:\Documents and Settings\jan\Application Data\Mozilla\Firefox\Profiles\cc3tm9zy.default\searchplugins\siteadvisor.xml
    [2010/07/08 19:24:47 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
    [2010/05/03 11:34:57 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    [2006/03/14 08:17:07 | 000,142,848 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npcpbrk7.dll
    [2010/04/12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
    [2008/09/23 18:26:21 | 000,221,184 | ---- | M] (CNN) -- C:\Program Files\Mozilla Firefox\plugins\NPTURNMED.dll
    [2006/01/11 07:54:53 | 001,605,120 | ---- | M] (Oklahoma Climatological Survey) -- C:\Program Files\Mozilla Firefox\plugins\NPWXM32.DLL
    [2010/03/18 18:06:41 | 000,002,024 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\McSiteAdvisor.xml

    O1 HOSTS File: ([2010/07/19 14:09:43 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
    O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
    O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
    O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
    O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
    O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
    O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
    O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
    O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
    O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
    O4 - HKLM..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE (Creative Technology Ltd)
    O4 - HKLM..\Run: [CTHelper] C:\WINDOWS\System32\CtHelper.exe (Creative Technology Ltd)
    O4 - HKLM..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
    O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
    O4 - HKLM..\Run: [dleamon.exe] C:\Program Files\Dell V310-V510 Series\dleamon.exe ()
    O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
    O4 - HKLM..\Run: [EzPrint] C:\Program Files\Dell V310-V510 Series\ezprint.exe ()
    O4 - HKLM..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe (Google)
    O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
    O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (Macrovision Corporation)
    O4 - HKLM..\Run: [KernelFaultCheck] File not found
    O4 - HKLM..\Run: [MSSE] c:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
    O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
    O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)
    O4 - HKCU..\Run: [DellSupport] C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.)
    O4 - HKCU..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
    O4 - HKCU..\Run: [ISUSPM] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
    O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Audible Download Manager.lnk = C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe (Audible, Inc.)
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe (BVRP Software)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O16 - DPF: {341FF14B-00CB-49F5-A427-A164DF1D5E1F} http://musicstore.connect.com/XSL/mb_us/html/activexplayer/SMALStreaming.cab (MALPlaybackCtrl Class)
    O16 - DPF: {4B48D5DF-9021-45F7-A240-60304302A215} http://download.microsoft.com/download/b/d/b/bdb4e4ee-63b2-45ff-9d84-33205bf43143/WebCleaner.cab (Malicious Software Removal Tool)
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1140842262609 (MUWebControl Class)
    O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab (MsnMessengerSetupDownloadControl Class)
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab (MSN Games - Installer)
    O16 - DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} http://support.dell.com/systemprofiler/DellSystemLite.CAB (DellSystemLite.Scanner)
    O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
    O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
    O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
    O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
    O24 - Desktop WallPaper: C:\WINDOWS\Jasc Paint Shop Photo Album 5 Wallpaper.bmp
    O24 - Desktop BackupWallPaper: C:\WINDOWS\Jasc Paint Shop Photo Album 5 Wallpaper.bmp
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2004/08/19 17:07:14 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = comfile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*
    O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found

    ========== Files/Folders - Created Within 30 Days ==========

    [2010/07/19 22:14:50 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\jan\Desktop\OTL.exe
    [2010/07/16 09:57:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Dell V310-V510 Series
    [2010/07/14 07:08:11 | 000,744,448 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\helpsvc.exe
    [2010/07/13 14:08:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\iolo
    [2010/07/13 14:06:20 | 000,000,000 | ---D | C] -- C:\Program Files\iolo
    [2010/07/13 14:02:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\jan\Application Data\iolo
    [2010/07/13 14:02:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\iolo
    [2010/07/13 13:53:24 | 000,438,272 | ---- | C] ( ) -- C:\WINDOWS\System32\dleacoin.dll
    [2010/07/13 13:53:18 | 000,983,121 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\lxk_gf.dll
    [2010/07/13 13:52:37 | 000,000,000 | ---D | C] -- C:\Program Files\Dell
    [2010/07/13 13:52:24 | 000,000,000 | ---D | C] -- C:\Program Files\Dell Toolbar
    [2010/07/13 13:52:19 | 000,000,000 | ---D | C] -- C:\Program Files\Dell PC Fax
    [2010/07/13 13:52:02 | 000,847,872 | ---- | C] ( ) -- C:\WINDOWS\System32\dleausb1.dll
    [2010/07/13 13:52:02 | 000,364,544 | ---- | C] ( ) -- C:\WINDOWS\System32\dleainpa.dll
    [2010/07/13 13:52:02 | 000,356,352 | ---- | C] ( ) -- C:\WINDOWS\System32\DLEAhcp.dll
    [2010/07/13 13:52:02 | 000,344,064 | ---- | C] ( ) -- C:\WINDOWS\System32\dleaiesc.dll
    [2010/07/13 13:52:01 | 001,048,576 | ---- | C] ( ) -- C:\WINDOWS\System32\dleaserv.dll
    [2010/07/13 13:52:01 | 000,643,072 | ---- | C] ( ) -- C:\WINDOWS\System32\dleapmui.dll
    [2010/07/13 13:52:01 | 000,577,536 | ---- | C] ( ) -- C:\WINDOWS\System32\dlealmpm.dll
    [2010/07/13 13:52:00 | 000,688,128 | ---- | C] ( ) -- C:\WINDOWS\System32\dleahbn3.dll
    [2010/07/13 13:52:00 | 000,324,264 | ---- | C] ( ) -- C:\WINDOWS\System32\dleaih.exe
    [2010/07/13 13:51:59 | 000,598,696 | ---- | C] ( ) -- C:\WINDOWS\System32\dleacoms.exe
    [2010/07/13 13:51:58 | 000,372,736 | ---- | C] ( ) -- C:\WINDOWS\System32\dleacomm.dll
    [2010/07/13 13:51:57 | 000,802,816 | ---- | C] ( ) -- C:\WINDOWS\System32\dleacomc.dll
    [2010/07/13 13:51:56 | 000,373,416 | ---- | C] ( ) -- C:\WINDOWS\System32\dleacfg.exe
    [2010/07/13 13:51:49 | 000,000,000 | ---D | C] -- C:\Program Files\Dell V310-V510 Series
    [2010/07/13 13:26:25 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\jan\Recent
    [2010/07/13 13:23:58 | 000,000,000 | ---D | C] -- C:\Program Files\Disk Cleaner
    [2010/07/13 13:11:58 | 000,000,000 | ---D | C] -- C:\Program Files\Citrix
    [2010/07/08 19:41:37 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
    [2010/07/08 19:41:23 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
    [2010/07/08 19:40:15 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
    [2010/07/08 19:39:53 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
    [2010/07/08 19:39:16 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
    [2010/07/08 19:38:49 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
    [2010/07/06 06:37:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\{C3243856-7746-4A05-8837-51A28C1CDD82}
    [2010/07/06 06:36:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\jan\Local Settings\Application Data\Downloaded Installations
    [2006/12/20 17:58:02 | 000,397,312 | ---- | C] ( ) -- C:\WINDOWS\System32\dlcciesc.dll
    [2006/12/20 17:47:32 | 000,413,696 | ---- | C] ( ) -- C:\WINDOWS\System32\dlccinpa.dll
    [2005/10/09 08:23:53 | 000,034,816 | ---- | C] ( ) -- C:\WINDOWS\System32\a3d.dll

    ========== Files - Modified Within 30 Days ==========

    [2010/07/19 23:32:04 | 000,000,970 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1948461421-2004685971-4226772609-1005UA.job
    [2010/07/19 23:26:04 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
    [2010/07/19 22:14:56 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\jan\Desktop\OTL.exe
    [2010/07/19 21:34:59 | 004,958,588 | ---- | M] () -- C:\WINDOWS\{00000003-00000000-00000002-00001102-00000004-20061102}.CDF
    [2010/07/19 21:34:59 | 004,958,588 | ---- | M] () -- C:\WINDOWS\{00000003-00000000-00000002-00001102-00000004-20061102}.BAK
    [2010/07/19 19:08:29 | 000,000,408 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
    [2010/07/19 19:02:23 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2010/07/19 19:01:05 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
    [2010/07/19 19:01:03 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
    [2010/07/19 19:01:00 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2010/07/19 19:00:59 | 2137,149,440 | -HS- | M] () -- C:\hiberfil.sys
    [2010/07/19 17:06:25 | 000,031,056 | ---- | M] () -- C:\WINDOWS\System32\BMXStateBkp-{00000003-00000000-00000002-00001102-00000004-20061102}.rfx
    [2010/07/19 17:06:25 | 000,031,056 | ---- | M] () -- C:\WINDOWS\System32\BMXState-{00000003-00000000-00000002-00001102-00000004-20061102}.rfx
    [2010/07/19 17:06:25 | 000,030,528 | ---- | M] () -- C:\WINDOWS\System32\BMXCtrlState-{00000003-00000000-00000002-00001102-00000004-20061102}.rfx
    [2010/07/19 17:06:25 | 000,030,528 | ---- | M] () -- C:\WINDOWS\System32\BMXBkpCtrlState-{00000003-00000000-00000002-00001102-00000004-20061102}.rfx
    [2010/07/19 17:06:25 | 000,011,564 | ---- | M] () -- C:\WINDOWS\System32\DVCState-{00000003-00000000-00000002-00001102-00000004-20061102}.rfx
    [2010/07/19 17:06:18 | 006,815,744 | ---- | M] () -- C:\Documents and Settings\jan\ntuser.dat
    [2010/07/19 17:06:18 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\jan\ntuser.ini
    [2010/07/19 16:57:51 | 000,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
    [2010/07/19 16:20:02 | 000,000,415 | ---- | M] () -- C:\Documents and Settings\jan\My Documents\Shortcut to ComboFix.lnk
    [2010/07/19 16:02:02 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
    [2010/07/19 15:00:25 | 000,000,386 | ---- | M] () -- C:\Documents and Settings\jan\Desktop\Google.url
    [2010/07/19 14:21:43 | 000,000,294 | ---- | M] () -- C:\Documents and Settings\jan\Desktop\OFFICAL TIME.url
    [2010/07/19 14:09:43 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
    [2010/07/19 13:32:03 | 000,000,918 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1948461421-2004685971-4226772609-1005Core.job
    [2010/07/18 23:25:24 | 2137,178,112 | ---- | M] () -- C:\WINDOWS\MEMORY.DMP
    [2010/07/18 20:01:49 | 000,013,357 | ---- | M] () -- C:\Documents and Settings\jan\Desktop\larry.url
    [2010/07/18 11:36:35 | 000,082,145 | ---- | M] () -- C:\Documents and Settings\jan\Desktop\RR.url
    [2010/07/18 11:35:58 | 000,000,254 | ---- | M] () -- C:\Documents and Settings\jan\Desktop\IRIS Seismic Monitor.url
    [2010/07/17 22:16:22 | 000,000,245 | ---- | M] () -- C:\Documents and Settings\jan\Desktop\Wikipedia.url
    [2010/07/17 21:53:34 | 000,000,399 | ---- | M] () -- C:\Documents and Settings\jan\Desktop\TIFTON WEATHER.url
    [2010/07/17 13:21:42 | 000,006,612 | ---- | M] () -- C:\Documents and Settings\jan\Desktop\Woot.url
    [2010/07/15 10:10:49 | 000,000,217 | ---- | M] () -- C:\Documents and Settings\jan\Desktop\Hurricane Center.url
    [2010/07/13 14:08:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\System32\ioloBootDefrag.cfg
    [2010/07/13 14:07:13 | 000,000,766 | ---- | M] () -- C:\Documents and Settings\jan\Desktop\Dell PC TuneUp.lnk
    [2010/07/13 14:02:28 | 000,074,703 | ---- | M] () -- C:\WINDOWS\System32\mfc45.dll
    [2010/07/13 13:54:08 | 000,184,326 | ---- | M] () -- C:\WINDOWS\System32\LexFiles.ulf
    [2010/07/13 13:52:39 | 000,000,791 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Launch Dell Printer Home.LNK
    [2010/07/13 13:29:21 | 000,000,507 | ---- | M] () -- C:\WINDOWS\win.ini
    [2010/07/13 13:29:21 | 000,000,279 | RHS- | M] () -- C:\boot.ini
    [2010/07/13 13:24:46 | 000,003,023 | ---- | M] () -- C:\Documents and Settings\jan\Desktop\Yahoo!.url
    [2010/07/13 13:24:00 | 000,001,604 | ---- | M] () -- C:\Documents and Settings\jan\Application Data\Microsoft\Internet Explorer\Quick Launch\Disk Cleaner.lnk
    [2010/07/10 21:19:32 | 000,000,558 | ---- | M] () -- C:\Documents and Settings\jan\Desktop\Audible.url
    [2010/07/08 19:40:41 | 000,001,604 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
    [2010/07/08 18:45:57 | 000,000,245 | ---- | M] () -- C:\Documents and Settings\jan\Desktop\National Mosaic.url
    [2010/07/06 05:04:47 | 000,001,142 | ---- | M] () -- C:\Documents and Settings\jan\Desktop\Facebook.url
    [2010/07/02 06:33:52 | 000,002,268 | ---- | M] () -- C:\Documents and Settings\jan\Desktop\Google Chrome.lnk
    [2010/07/02 06:33:52 | 000,002,246 | ---- | M] () -- C:\Documents and Settings\jan\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
    [2010/06/29 13:07:25 | 000,000,820 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Microsoft Security Essentials.lnk
    [2010/06/28 09:50:25 | 000,000,205 | ---- | M] () -- C:\Documents and Settings\jan\Desktop\whocalled.us.url
    [2010/06/28 07:43:38 | 000,001,762 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Audible Download Manager.lnk
    [2010/06/23 07:26:48 | 000,503,304 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
    [2010/06/23 07:26:48 | 000,442,466 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
    [2010/06/23 07:26:48 | 000,071,732 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
    [2010/06/21 08:09:40 | 000,000,023 | -HS- | M] () -- C:\WINDOWS\System32\edacded0.dat
    [2010/06/21 08:09:40 | 000,000,023 | ---- | M] () -- C:\WINDOWS\System32\bcdadac7.xml

    ========== Files Created - No Company Name ==========

    [2010/07/19 16:20:02 | 000,000,415 | ---- | C] () -- C:\Documents and Settings\jan\My Documents\Shortcut to ComboFix.lnk
    [2010/07/16 10:47:07 | 004,958,588 | ---- | C] () -- C:\WINDOWS\{00000003-00000000-00000002-00001102-00000004-20061102}.BAK
    [2010/07/16 09:57:12 | 000,000,309 | ---- | C] () -- C:\Documents and Settings\All Users\dleaDiagnostics.log
    [2010/07/13 14:08:48 | 000,000,406 | ---- | C] () -- C:\WINDOWS\System32\ioloBootDefrag.cfg
    [2010/07/13 14:07:13 | 000,000,766 | ---- | C] () -- C:\Documents and Settings\jan\Desktop\Dell PC TuneUp.lnk
    [2010/07/13 14:07:02 | 000,938,328 | ---- | C] () -- C:\WINDOWS\System32\Incinerator.dll
    [2010/07/13 14:06:30 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\iolobtdfg.exe
    [2010/07/13 14:06:30 | 000,008,192 | ---- | C] () -- C:\WINDOWS\System32\smrgdf.exe
    [2010/07/13 14:02:28 | 000,074,703 | ---- | C] () -- C:\WINDOWS\System32\mfc45.dll
    [2010/07/13 13:53:29 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\dleavs.dll
    [2010/07/13 13:53:19 | 000,065,106 | ---- | C] () -- C:\WINDOWS\System32\dleaprpr.chm
    [2010/07/13 13:53:18 | 000,294,912 | ---- | C] () -- C:\WINDOWS\System32\dleacui.dll
    [2010/07/13 13:53:18 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\dleacuir.dll
    [2010/07/13 13:53:18 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\dleagcfg.dll
    [2010/07/13 13:53:17 | 000,008,696 | ---- | C] () -- C:\WINDOWS\System32\dleacommuilogo_rtl.bmp
    [2010/07/13 13:53:17 | 000,008,696 | ---- | C] () -- C:\WINDOWS\System32\dleacommuilogo.bmp
    [2010/07/13 13:52:56 | 000,372,736 | ---- | C] () -- C:\WINDOWS\System32\DLEAwupd.dll
    [2010/07/13 13:52:56 | 000,213,672 | ---- | C] () -- C:\WINDOWS\System32\DLEAwupd.exe
    [2010/07/13 13:52:39 | 000,000,791 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Launch Dell Printer Home.LNK
    [2010/07/13 13:52:02 | 000,331,776 | ---- | C] () -- C:\WINDOWS\System32\DLEAinst.dll
    [2010/07/13 13:52:01 | 000,262,144 | ---- | C] () -- C:\WINDOWS\System32\dleainsb.dll
    [2010/07/13 13:52:01 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\dleainsr.dll
    [2010/07/13 13:52:01 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\dleajswr.dll
    [2010/07/13 13:52:00 | 000,323,584 | ---- | C] () -- C:\WINDOWS\System32\dleains.dll
    [2010/07/13 13:52:00 | 000,253,952 | ---- | C] () -- C:\WINDOWS\System32\dleacu.dll
    [2010/07/13 13:52:00 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\dleagrd.dll
    [2010/07/13 13:52:00 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\dleacub.dll
    [2010/07/13 13:52:00 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\dleacur.dll
    [2010/07/13 13:51:56 | 000,086,180 | ---- | C] () -- C:\WINDOWS\System32\DLEAcfg.dll
    [2010/07/13 13:51:56 | 000,002,064 | ---- | C] () -- C:\WINDOWS\System32\dlea.loc
    [2010/07/13 13:24:00 | 000,001,604 | ---- | C] () -- C:\Documents and Settings\jan\Application Data\Microsoft\Internet Explorer\Quick Launch\Disk Cleaner.lnk
    [2010/07/08 19:42:44 | 000,002,137 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
    [2010/07/08 19:40:41 | 000,001,604 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
    [2010/07/04 01:27:38 | 000,001,142 | ---- | C] () -- C:\Documents and Settings\jan\Desktop\Facebook.url
    [2010/06/29 13:13:39 | 000,000,408 | -H-- | C] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
    [2010/06/28 07:43:38 | 000,001,762 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Audible Download Manager.lnk
    [2010/06/21 08:09:40 | 000,000,023 | -HS- | C] () -- C:\WINDOWS\System32\edacded0.dat
    [2010/06/21 08:09:40 | 000,000,023 | ---- | C] () -- C:\WINDOWS\System32\bcdadac7.xml
    [2010/01/22 18:12:16 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\DLEAsmr.dll
    [2010/01/22 18:12:15 | 000,299,008 | ---- | C] () -- C:\WINDOWS\System32\DLEAsm.dll
    [2008/12/05 11:43:49 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
    [2008/11/10 10:37:19 | 000,000,250 | ---- | C] () -- C:\WINDOWS\gmer.ini
    [2008/11/10 10:37:18 | 000,884,736 | ---- | C] () -- C:\WINDOWS\gmer.dll
    [2007/12/08 22:15:43 | 000,000,000 | ---- | C] () -- C:\WINDOWS\pcfriend.INI
    [2007/09/14 14:31:29 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
    [2007/04/12 09:10:28 | 000,105,728 | ---- | C] () -- C:\WINDOWS\System32\APOMgrH.dll
    [2007/04/09 13:55:14 | 000,097,785 | ---- | C] () -- C:\WINDOWS\System32\instwdm.ini
    [2007/04/09 13:33:50 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CTBurst.dll
    [2007/02/07 13:57:16 | 000,344,064 | ---- | C] () -- C:\WINDOWS\System32\dlcccoin.dll
    [2006/11/10 11:31:30 | 000,001,682 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
    [2006/11/10 11:31:30 | 000,000,056 | RHS- | C] () -- C:\WINDOWS\System32\D3A869E4A2.sys
    [2006/03/14 11:48:01 | 000,000,004 | -H-- | C] () -- C:\WINDOWS\uccspecb.sys
    [2006/03/01 20:54:42 | 000,000,029 | ---- | C] () -- C:\WINDOWS\atid.ini
    [2006/02/25 06:19:52 | 000,003,840 | ---- | C] () -- C:\WINDOWS\System32\drivers\BANTExt.sys
    [2006/02/25 04:25:15 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
    [2005/10/09 08:41:55 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
    [2005/10/09 08:32:29 | 000,000,875 | ---- | C] () -- C:\WINDOWS\wininit.ini
    [2005/10/09 08:24:22 | 000,000,231 | ---- | C] () -- C:\WINDOWS\AC3API.INI
    [2005/10/09 08:23:55 | 000,014,424 | ---- | C] () -- C:\WINDOWS\System32\Aud2_Del.ini
    [2005/10/09 08:23:55 | 000,000,054 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini
    [2005/10/09 08:23:54 | 000,000,307 | ---- | C] () -- C:\WINDOWS\System32\kill.ini
    [2005/10/09 08:23:28 | 000,000,136 | ---- | C] () -- C:\WINDOWS\SBWIN.INI
    [2005/10/09 07:57:28 | 000,000,392 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
    [2005/08/05 14:01:54 | 000,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
    [2005/06/16 11:17:16 | 000,071,680 | ---- | C] () -- C:\WINDOWS\System32\ctmmactl.dll
    [2005/04/01 12:44:16 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\dlcccnv4.dll
    [2004/09/22 14:47:00 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
    [2004/08/19 17:20:39 | 000,000,882 | ---- | C] () -- C:\WINDOWS\orun32.ini
    [2004/08/19 17:01:43 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
    [1998/10/11 00:07:38 | 000,088,576 | ---- | C] () -- C:\WINDOWS\System32\Iticheck.dll
    [1998/07/15 22:44:30 | 000,134,656 | ---- | C] () -- C:\WINDOWS\System32\itijpg2.dll

    ========== Alternate Data Streams ==========

    @Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
    < End of report >
     
  8. 2010/07/20
    jan roberts

    jan roberts Inactive Thread Starter

    Joined:
    2005/01/08
    Messages:
    507
    Likes Received:
    2
    and the extras

    OTL Extras logfile created on: 7/19/2010 11:55:12 PM - Run 1
    OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\jan\Desktop
    Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 68.00% Memory free
    4.00 Gb Paging File | 3.00 Gb Available in Paging File | 85.00% Paging File free
    Paging file location(s): C:\pagefile.sys 2046 2246 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 144.31 Gb Total Space | 111.56 Gb Free Space | 77.31% Space Free | Partition Type: NTFS
    D: Drive not present or media not loaded
    E: Drive not present or media not loaded
    F: Drive not present or media not loaded
    G: Drive not present or media not loaded
    H: Drive not present or media not loaded
    I: Drive not present or media not loaded

    Computer Name: D8T09M81
    Current User Name: jan
    Logged in as Administrator.

    Current Boot Mode: Normal
    Scan Mode: Current user
    Company Name Whitelist: On
    Skip Microsoft Files: On
    File Age = 90 Days
    Output = Standard
    Quick Scan

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

    [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
    .exe [@ = exefile] -- Reg Error: Key error. File not found
    .hta [@ = htafile] -- Reg Error: Key error. File not found
    .html [@ = htmlfile] -- Reg Error: Key error. File not found

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    exefile [open] -- "%1" %*
    htmlfile [edit] -- Reg Error: Key error.
    InternetShortcut [print] -- Reg Error: Key error.
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1 "
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "FirstRunDisabled" = 1
    "AntiVirusDisableNotify" = 0
    "FirewallDisableNotify" = 0
    "UpdatesDisableNotify" = 0
    "AntiVirusOverride" = 0
    "FirewallOverride" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
    "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
    "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22008
    "10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 1
    "DisableNotifications" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
    "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22008
    "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
    "10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "139:TCP" = 139:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22004
    "445:TCP" = 445:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22005
    "137:UDP" = 137:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22001
    "138:UDP" = 138:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22002
    "3389:TCP" = 3389:TCP:*:Enabled:mad:xpsp2res.dll,-22009

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL -- File not found
    "C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL -- File not found
    "C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL -- File not found
    "C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger -- (America Online, Inc.)
    "C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) -- File not found

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\Program Files\Google\Google Talk\googletalk.exe" = C:\Program Files\Google\Google Talk\googletalk.exe:*:Enabled:Google Talk -- (Google)
    "C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger -- (America Online, Inc.)
    "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)
    "C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe" = C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe:*:Enabled:Audible Download Manager -- (Audible, Inc.)
    "C:\Program Files\att-nap\McciBrowser.exe" = C:\Program Files\att-nap\McciBrowser.exe:*:Enabled:motivebrowser.exe -- (Motive Communications, Inc.)
    "C:\Program Files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe" = C:\Program Files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe:*:Enabled:ABBYY FineReader -- (ABBYY (BIT Software))
    "C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
    "C:\WINDOWS\system32\dleacoms.exe" = C:\WINDOWS\system32\dleacoms.exe:*:Enabled:V310-V510 Series Server -- ( )


    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{0456ebd7-5f67-4ab6-852e-63781e3f389c}" = Macromedia Flash Player
    "{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = Sonic Update Manager
    "{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
    "{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE
    "{13515135-48BB-4184-8C1F-2FAE0138E200}" = TBS WMP Plug-in
    "{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
    "{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only)
    "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
    "{25E81740-CA17-489E-A8B6-54319A1C4D41}}_is1" = Dell PC TuneUp
    "{26A24AE4-039D-4CA4-87B4-2F83216019FF}" = Java(TM) 6 Update 20
    "{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java(TM) SE Runtime Environment 6 Update 1
    "{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
    "{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
    "{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
    "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
    "{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
    "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
    "{35BDEFF1-A610-4956-A00D-15453C116395}" = Internet Explorer Default Page
    "{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}" = McAfee SiteAdvisor
    "{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
    "{3D9892BB-A751-4E48-ADC8-E4289956CE1D}" = QuickTime
    "{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = Modem On Hold
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
    "{56F3E1FF-54FE-4384-A153-6CCABA097814}" = Creative MediaSource
    "{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
    "{62BD0AE0-4EB1-4BBB-8F43-B6400C8FEB2C}" = AOLIcon
    "{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
    "{659314FA-F336-482D-B094-C3FCA68BB60B}" = GEAR driver installer for x86 and x64
    "{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD 5.5
    "{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer
    "{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
    "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
    "{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
    "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    "{7A0EFAFB-AC4B-4B88-8C6B-6731BE88DB68}" = Modem Event Monitor
    "{7AB3A249-FB81-416B-917A-A2A10E74C503}" = iTunes
    "{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
    "{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
    "{83F793B5-8BBF-42FD-A8A6-868CB3E2AAEA}" = Intel(R) PROSet for Wired Connections
    "{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Graphics Media Accelerator Driver
    "{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
    "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!
    "{9941F0AA-B903-4AF4-A055-83A9815CC011}" = Sonic Encoders
    "{9E2514D9-DC24-4634-B348-61F3EF0F1628}" = Sound Blaster Audigy 2 ZS
    "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
    "{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
    "{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C}" = Windows Defender Signatures
    "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
    "{AC76BA86-7AD7-1033-7B44-A82000000003}" = Adobe Reader 8.2.3
    "{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
    "{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support
    "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
    "{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
    "{C544F99D-39EF-4E6D-95BE-4E41C1D8C4CB}" = Dr Watson for Microsoft Windows OneCare Live v0.9.0929.18
    "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser
    "{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
    "{E62A1F01-07B7-4541-A835-EE5B0BF064C2}" = Microsoft Antimalware
    "{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
    "{EF98A02A-1748-4762-9B7D-5ED1600520D5}" = Microsoft Security Essentials
    "Adobe Acrobat 5.0" = Adobe Acrobat 5.0
    "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
    "Adobe Shockwave Player" = Adobe Shockwave Player
    "Adobe SVG Viewer" = Adobe SVG Viewer 3.0
    "All ATI Software" = ATI - Software Uninstall Utility
    "ATI Display Driver" = ATI Display Driver
    "AudibleDownloadManager" = Audible Download Manager
    "Belarc Advisor 2.0" = Belarc Advisor 7.2
    "Dell V310-V510 Series" = Dell V310-V510 Series
    "DiskCleaner" = Disk Cleaner (remove only)
    "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
    "ie7" = Windows Internet Explorer 7
    "ie8" = Windows Internet Explorer 8
    "InstallShield_{13515135-48BB-4184-8C1F-2FAE0138E200}" = TBS WMP Plug-in
    "Intel(R) 537EP V9x DF PCI Modem" = Intel(R) 537EP V9x DF PCI Modem
    "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "Microsoft Security Essentials" = Microsoft Security Essentials
    "Mozilla Firefox (3.0.11)" = Mozilla Firefox (3.0.11)
    "MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
    "MSNINST" = MSN
    "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
    "PROSet" = Intel(R) PRO Network Connections Drivers
    "SpywareBlaster_is1" = SpywareBlaster 4.3
    "ViewpointMediaPlayer" = Viewpoint Media Player
    "Windows Media Format Runtime" = Windows Media Format 11 runtime
    "Windows Media Player" = Windows Media Player 11
    "Windows XP Service Pack" = Windows XP Service Pack 3
    "WMCSetup" = Windows Media Connect
    "WMFDist11" = Windows Media Format 11 runtime
    "wmp11" = Windows Media Player 11
    "Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
    "Yahoo! Messenger" = Yahoo! Messenger

    ========== HKEY_CURRENT_USER Uninstall List ==========

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "f031ef6ac137efc5" = Dell Driver Download Manager
    "Google Chrome" = Google Chrome
    "Move Media Player" = Move Media Player

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 7/19/2010 5:19:53 AM | Computer Name = D8T09M81 | Source = ESENT | ID = 489
    Description = wuauclt (2600) An attempt to open the file "C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log "
    for read only access failed with system error 32 (0x00000020): "The process cannot
    access the file because it is being used by another process. ". The open file
    operation will fail with error -1032 (0xfffffbf8).

    Error - 7/19/2010 5:19:53 AM | Computer Name = D8T09M81 | Source = ESENT | ID = 455
    Description = wuaueng.dll (2600) SUS20ClientDataStore: Error -1032 (0xfffffbf8)
    occurred while opening logfile C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log.

    Error - 7/19/2010 5:24:35 AM | Computer Name = D8T09M81 | Source = ESENT | ID = 489
    Description = wuauclt (2036) An attempt to open the file "C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log "
    for read only access failed with system error 32 (0x00000020): "The process cannot
    access the file because it is being used by another process. ". The open file
    operation will fail with error -1032 (0xfffffbf8).

    Error - 7/19/2010 5:24:35 AM | Computer Name = D8T09M81 | Source = ESENT | ID = 455
    Description = wuaueng.dll (2036) SUS20ClientDataStore: Error -1032 (0xfffffbf8)
    occurred while opening logfile C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log.

    Error - 7/19/2010 5:24:46 AM | Computer Name = D8T09M81 | Source = ESENT | ID = 489
    Description = wuauclt (2036) An attempt to open the file "C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log "
    for read only access failed with system error 32 (0x00000020): "The process cannot
    access the file because it is being used by another process. ". The open file
    operation will fail with error -1032 (0xfffffbf8).

    Error - 7/19/2010 5:24:46 AM | Computer Name = D8T09M81 | Source = ESENT | ID = 455
    Description = wuaueng.dll (2036) SUS20ClientDataStore: Error -1032 (0xfffffbf8)
    occurred while opening logfile C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log.

    Error - 7/19/2010 5:32:24 AM | Computer Name = D8T09M81 | Source = ESENT | ID = 489
    Description = wuauclt (1284) An attempt to open the file "C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log "
    for read only access failed with system error 32 (0x00000020): "The process cannot
    access the file because it is being used by another process. ". The open file
    operation will fail with error -1032 (0xfffffbf8).

    Error - 7/19/2010 5:32:24 AM | Computer Name = D8T09M81 | Source = ESENT | ID = 455
    Description = wuaueng.dll (1284) SUS20ClientDataStore: Error -1032 (0xfffffbf8)
    occurred while opening logfile C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log.

    Error - 7/19/2010 5:32:35 AM | Computer Name = D8T09M81 | Source = ESENT | ID = 489
    Description = wuauclt (1284) An attempt to open the file "C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log "
    for read only access failed with system error 32 (0x00000020): "The process cannot
    access the file because it is being used by another process. ". The open file
    operation will fail with error -1032 (0xfffffbf8).

    Error - 7/19/2010 5:32:36 AM | Computer Name = D8T09M81 | Source = ESENT | ID = 455
    Description = wuaueng.dll (1284) SUS20ClientDataStore: Error -1032 (0xfffffbf8)
    occurred while opening logfile C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log.

    [ System Events ]
    Error - 7/19/2010 7:03:41 AM | Computer Name = D8T09M81 | Source = Service Control Manager | ID = 7031
    Description = The Microsoft Antimalware Service service terminated unexpectedly.
    It has done this 1 time(s). The following corrective action will be taken in
    15000 milliseconds: Restart the service.

    Error - 7/19/2010 2:03:39 PM | Computer Name = D8T09M81 | Source = Service Control Manager | ID = 7031
    Description = The Windows Media Player Network Sharing Service service terminated
    unexpectedly. It has done this 1 time(s). The following corrective action will
    be taken in 30000 milliseconds: Restart the service.

    Error - 7/19/2010 2:07:06 PM | Computer Name = D8T09M81 | Source = Service Control Manager | ID = 7031
    Description = The Windows Media Player Network Sharing Service service terminated
    unexpectedly. It has done this 1 time(s). The following corrective action will
    be taken in 30000 milliseconds: Restart the service.

    Error - 7/19/2010 2:09:47 PM | Computer Name = D8T09M81 | Source = PlugPlayManager | ID = 11
    Description = The device Root\LEGACY_GMER\0000 disappeared from the system without
    first being prepared for removal.

    Error - 7/19/2010 3:16:50 PM | Computer Name = D8T09M81 | Source = Service Control Manager | ID = 7031
    Description = The Windows Media Player Network Sharing Service service terminated
    unexpectedly. It has done this 1 time(s). The following corrective action will
    be taken in 30000 milliseconds: Restart the service.

    Error - 7/19/2010 3:18:49 PM | Computer Name = D8T09M81 | Source = Service Control Manager | ID = 7031
    Description = The Windows Media Player Network Sharing Service service terminated
    unexpectedly. It has done this 1 time(s). The following corrective action will
    be taken in 30000 milliseconds: Restart the service.

    Error - 7/19/2010 3:58:02 PM | Computer Name = D8T09M81 | Source = Service Control Manager | ID = 7031
    Description = The Windows Media Player Network Sharing Service service terminated
    unexpectedly. It has done this 1 time(s). The following corrective action will
    be taken in 30000 milliseconds: Restart the service.

    Error - 7/19/2010 3:59:41 PM | Computer Name = D8T09M81 | Source = Service Control Manager | ID = 7031
    Description = The Windows Media Player Network Sharing Service service terminated
    unexpectedly. It has done this 1 time(s). The following corrective action will
    be taken in 30000 milliseconds: Restart the service.

    Error - 7/19/2010 4:14:14 PM | Computer Name = D8T09M81 | Source = Service Control Manager | ID = 7023
    Description = The HID Input Service service terminated with the following error:
    %%126

    Error - 7/19/2010 7:02:22 PM | Computer Name = D8T09M81 | Source = Service Control Manager | ID = 7023
    Description = The HID Input Service service terminated with the following error:
    %%126


    < End of report >
     
  9. 2010/07/20
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Update your Java version here: http://www.java.com/en/download/installed.jsp
    During installation, make sure to UN-check any pre-checked extra "garbage" installation, like Yahoo toolbar, or others.
    Uninstall all previous Java versions, through Add\Remove (Programs & Features in Vista/7).

    ================================================================

    Run OTL
    • Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following

      Code:
      :OTL
      DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\jan\LOCALS~1\Temp\catchme.sys -- (catchme)
      O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
      O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
      O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
      O4 - HKLM..\Run: [KernelFaultCheck] File not found
      O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
      O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab  (Reg Error: Key error.)
      O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab  (Reg Error: Key error.)
      O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)
      O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)
      O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)
      O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)
      [2006/11/10 11:31:30 | 000,000,056 | RHS- | C] () -- C:\WINDOWS\System32\D3A869E4A2.sys
      @Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
      
      
      :Services
      
      :Reg
      
      :Files
      
      :Commands
      [purity]
      [emptytemp]
      [emptyflash]
      [resethosts]
      [Reboot]
      
    • Then click the [color= "#FF0000"]Run Fix[/color] button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.
    • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
     
  10. 2010/07/20
    jan roberts

    jan roberts Inactive Thread Starter

    Joined:
    2005/01/08
    Messages:
    507
    Likes Received:
    2
    on the java,uninstall first?
     
  11. 2010/07/20
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    It doesn't matter. The latest is Java 6 Update 21, so you install and keep this one.
     
  12. 2010/07/20
    jan roberts

    jan roberts Inactive Thread Starter

    Joined:
    2005/01/08
    Messages:
    507
    Likes Received:
    2
    what about java runtime enviroment? remove too?
     
  13. 2010/07/20
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    All these go:
    Java(TM) 6 Update 2
    Java(TM) 6 Update 20
    Java(TM) 6 Update 3
    Java(TM) 6 Update 5
    Java(TM) 6 Update 7
    Java(TM) SE Runtime Environment 6 Update 1

    I'm getting ready for bed, so I'll check on you tomorrow :)
     
  14. 2010/07/20
    jan roberts

    jan roberts Inactive Thread Starter

    Joined:
    2005/01/08
    Messages:
    507
    Likes Received:
    2
    the run fix log
    Error: Unable to interpret <OTL Extras logfile created on: 7/19/2010 11:55:12 PM - Run 1> in the current context!
    Error: Unable to interpret <OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\jan\Desktop> in the current context!
    Error: Unable to interpret <Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation> in the current context!
    Error: Unable to interpret <Internet Explorer (Version = 8.0.6001.18702)> in the current context!
    Error: Unable to interpret <Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 68.00% Memory free> in the current context!
    Error: Unable to interpret <4.00 Gb Paging File | 3.00 Gb Available in Paging File | 85.00% Paging File free> in the current context!
    Error: Unable to interpret <Paging file location(s): C:\pagefile.sys 2046 2246 [binary data]> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files> in the current context!
    Error: Unable to interpret <Drive C: | 144.31 Gb Total Space | 111.56 Gb Free Space | 77.31% Space Free | Partition Type: NTFS> in the current context!
    Error: Unable to interpret <D: Drive not present or media not loaded> in the current context!
    Error: Unable to interpret <E: Drive not present or media not loaded> in the current context!
    Error: Unable to interpret <F: Drive not present or media not loaded> in the current context!
    Error: Unable to interpret <G: Drive not present or media not loaded> in the current context!
    Error: Unable to interpret <H: Drive not present or media not loaded> in the current context!
    Error: Unable to interpret <I: Drive not present or media not loaded> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <Computer Name: D8T09M81> in the current context!
    Error: Unable to interpret <Current User Name: jan> in the current context!
    Error: Unable to interpret <Logged in as Administrator.> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <Current Boot Mode: Normal> in the current context!
    Error: Unable to interpret <Scan Mode: Current user> in the current context!
    Error: Unable to interpret <Company Name Whitelist: On> in the current context!
    Error: Unable to interpret <Skip Microsoft Files: On> in the current context!
    Error: Unable to interpret <File Age = 90 Days> in the current context!
    Error: Unable to interpret <Output = Standard> in the current context!
    Error: Unable to interpret <Quick Scan> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <========== Extra Registry (SafeList) ==========> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <========== File Associations ==========> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]> in the current context!
    Error: Unable to interpret <.exe [@ = exefile] -- Reg Error: Key error. File not found> in the current context!
    Error: Unable to interpret <.hta [@ = htafile] -- Reg Error: Key error. File not found> in the current context!
    Error: Unable to interpret <.html [@ = htmlfile] -- Reg Error: Key error. File not found> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <========== Shell Spawning ==========> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]> in the current context!
    Error: Unable to interpret <batfile [open] -- "%1" %*> in the current context!
    Error: Unable to interpret <cmdfile [open] -- "%1" %*> in the current context!
    Error: Unable to interpret <comfile [open] -- "%1" %*> in the current context!
    Error: Unable to interpret <exefile [open] -- "%1" %*> in the current context!
    Error: Unable to interpret <htmlfile [edit] -- Reg Error: Key error.> in the current context!
    Error: Unable to interpret <InternetShortcut [print] -- Reg Error: Key error.> in the current context!
    Error: Unable to interpret <piffile [open] -- "%1" %*> in the current context!
    Error: Unable to interpret <regfile [merge] -- Reg Error: Key error.> in the current context!
    Error: Unable to interpret <scrfile [config] -- "%1 "> in the current context!
    Error: Unable to interpret <scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)> in the current context!
    Error: Unable to interpret <scrfile [open] -- "%1" /S> in the current context!
    Error: Unable to interpret <txtfile [edit] -- Reg Error: Key error.> in the current context!
    Error: Unable to interpret <Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1> in the current context!
    Error: Unable to interpret <Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)> in the current context!
    Error: Unable to interpret <Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)> in the current context!
    Error: Unable to interpret <Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)> in the current context!
    Error: Unable to interpret <Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <========== Security Center Settings ==========> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]> in the current context!
    Error: Unable to interpret < "FirstRunDisabled" = 1> in the current context!
    Error: Unable to interpret < "AntiVirusDisableNotify" = 0> in the current context!
    Error: Unable to interpret < "FirewallDisableNotify" = 0> in the current context!
    Error: Unable to interpret < "UpdatesDisableNotify" = 0> in the current context!
    Error: Unable to interpret < "AntiVirusOverride" = 0> in the current context!
    Error: Unable to interpret < "FirewallOverride" = 0> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]> in the current context!
    Error: Unable to interpret < "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22007> in the current context!
    Error: Unable to interpret < "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22008> in the current context!
    Error: Unable to interpret < "10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service> in the current context!
    Error: Unable to interpret < "10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service> in the current context!
    Error: Unable to interpret < "10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service> in the current context!
    Error: Unable to interpret < "10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service> in the current context!
    Error: Unable to interpret < "10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service> in the current context!
    Error: Unable to interpret < "10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]> in the current context!
    Error: Unable to interpret < "EnableFirewall" = 1> in the current context!
    Error: Unable to interpret < "DisableNotifications" = 0> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]> in the current context!
    Error: Unable to interpret < "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22008> in the current context!
    Error: Unable to interpret < "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22007> in the current context!
    Error: Unable to interpret < "10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service> in the current context!
    Error: Unable to interpret < "10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service> in the current context!
    Error: Unable to interpret < "10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service> in the current context!
    Error: Unable to interpret < "10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service> in the current context!
    Error: Unable to interpret < "10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service> in the current context!
    Error: Unable to interpret < "10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service> in the current context!
    Error: Unable to interpret < "139:TCP" = 139:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22004> in the current context!
    Error: Unable to interpret < "445:TCP" = 445:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22005> in the current context!
    Error: Unable to interpret < "137:UDP" = 137:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22001> in the current context!
    Error: Unable to interpret < "138:UDP" = 138:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22002> in the current context!
    Error: Unable to interpret < "3389:TCP" = 3389:TCP:*:Enabled:mad:xpsp2res.dll,-22009> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <========== Authorized Applications List ==========> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]> in the current context!
    Error: Unable to interpret < "C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL -- File not found> in the current context!
    Error: Unable to interpret < "C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL -- File not found> in the current context!
    Error: Unable to interpret < "C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL -- File not found> in the current context!
    Error: Unable to interpret < "C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger -- (America Online, Inc.)> in the current context!
    Error: Unable to interpret < "C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) -- File not found> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]> in the current context!
    Error: Unable to interpret < "C:\Program Files\Google\Google Talk\googletalk.exe" = C:\Program Files\Google\Google Talk\googletalk.exe:*:Enabled:Google Talk -- (Google)> in the current context!
    Error: Unable to interpret < "C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger -- (America Online, Inc.)> in the current context!
    Error: Unable to interpret < "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)> in the current context!
    Error: Unable to interpret < "C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe" = C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe:*:Enabled:Audible Download Manager -- (Audible, Inc.)> in the current context!
    Error: Unable to interpret < "C:\Program Files\att-nap\McciBrowser.exe" = C:\Program Files\att-nap\McciBrowser.exe:*:Enabled:motivebrowser.exe -- (Motive Communications, Inc.)> in the current context!
    Error: Unable to interpret < "C:\Program Files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe" = C:\Program Files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe:*:Enabled:ABBYY FineReader -- (ABBYY (BIT Software))> in the current context!
    Error: Unable to interpret < "C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)> in the current context!
    Error: Unable to interpret < "C:\WINDOWS\system32\dleacoms.exe" = C:\WINDOWS\system32\dleacoms.exe:*:Enabled:V310-V510 Series Server -- ( )> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <========== HKEY_LOCAL_MACHINE Uninstall List ==========> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]> in the current context!
    Error: Unable to interpret < "{0456ebd7-5f67-4ab6-852e-63781e3f389c}" = Macromedia Flash Player> in the current context!
    Error: Unable to interpret < "{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = Sonic Update Manager> in the current context!
    Error: Unable to interpret < "{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour> in the current context!
    Error: Unable to interpret < "{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE> in the current context!
    Error: Unable to interpret < "{13515135-48BB-4184-8C1F-2FAE0138E200}" = TBS WMP Plug-in> in the current context!
    Error: Unable to interpret < "{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer> in the current context!
    Error: Unable to interpret < "{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only)> in the current context!
    Error: Unable to interpret < "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer> in the current context!
    Error: Unable to interpret < "{25E81740-CA17-489E-A8B6-54319A1C4D41}}_is1" = Dell PC TuneUp> in the current context!
    Error: Unable to interpret < "{26A24AE4-039D-4CA4-87B4-2F83216019FF}" = Java(TM) 6 Update 20> in the current context!
    Error: Unable to interpret < "{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java(TM) SE Runtime Environment 6 Update 1> in the current context!
    Error: Unable to interpret < "{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2> in the current context!
    Error: Unable to interpret < "{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3> in the current context!
    Error: Unable to interpret < "{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5> in the current context!
    Error: Unable to interpret < "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7> in the current context!
    Error: Unable to interpret < "{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10> in the current context!
    Error: Unable to interpret < "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP> in the current context!
    Error: Unable to interpret < "{35BDEFF1-A610-4956-A00D-15453C116395}" = Internet Explorer Default Page> in the current context!
    Error: Unable to interpret < "{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}" = McAfee SiteAdvisor> in the current context!
    Error: Unable to interpret < "{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup> in the current context!
    Error: Unable to interpret < "{3D9892BB-A751-4E48-ADC8-E4289956CE1D}" = QuickTime> in the current context!
    Error: Unable to interpret < "{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = Modem On Hold> in the current context!
    Error: Unable to interpret < "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater> in the current context!
    Error: Unable to interpret < "{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml> in the current context!
    Error: Unable to interpret < "{56F3E1FF-54FE-4384-A153-6CCABA097814}" = Creative MediaSource> in the current context!
    Error: Unable to interpret < "{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool> in the current context!
    Error: Unable to interpret < "{62BD0AE0-4EB1-4BBB-8F43-B6400C8FEB2C}" = AOLIcon> in the current context!
    Error: Unable to interpret < "{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0> in the current context!
    Error: Unable to interpret < "{659314FA-F336-482D-B094-C3FCA68BB60B}" = GEAR driver installer for x86 and x64> in the current context!
    Error: Unable to interpret < "{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD 5.5> in the current context!
    Error: Unable to interpret < "{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer> in the current context!
    Error: Unable to interpret < "{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK> in the current context!
    Error: Unable to interpret < "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable> in the current context!
    Error: Unable to interpret < "{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore> in the current context!
    Error: Unable to interpret < "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053> in the current context!
    Error: Unable to interpret < "{7A0EFAFB-AC4B-4B88-8C6B-6731BE88DB68}" = Modem Event Monitor> in the current context!
    Error: Unable to interpret < "{7AB3A249-FB81-416B-917A-A2A10E74C503}" = iTunes> in the current context!
    Error: Unable to interpret < "{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport> in the current context!
    Error: Unable to interpret < "{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper> in the current context!
    Error: Unable to interpret < "{83F793B5-8BBF-42FD-A8A6-868CB3E2AAEA}" = Intel(R) PROSet for Wired Connections> in the current context!
    Error: Unable to interpret < "{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support> in the current context!
    Error: Unable to interpret < "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight> in the current context!
    Error: Unable to interpret < "{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Graphics Media Accelerator Driver> in the current context!
    Error: Unable to interpret < "{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant> in the current context!
    Error: Unable to interpret < "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting> in the current context!
    Error: Unable to interpret < "{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!> in the current context!
    Error: Unable to interpret < "{9941F0AA-B903-4AF4-A055-83A9815CC011}" = Sonic Encoders> in the current context!
    Error: Unable to interpret < "{9E2514D9-DC24-4634-B348-61F3EF0F1628}" = Sound Blaster Audigy 2 ZS> in the current context!
    Error: Unable to interpret < "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2> in the current context!
    Error: Unable to interpret < "{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio> in the current context!
    Error: Unable to interpret < "{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C}" = Windows Defender Signatures> in the current context!
    Error: Unable to interpret < "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper> in the current context!
    Error: Unable to interpret < "{AC76BA86-7AD7-1033-7B44-A82000000003}" = Adobe Reader 8.2.3> in the current context!
    Error: Unable to interpret < "{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint> in the current context!
    Error: Unable to interpret < "{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support> in the current context!
    Error: Unable to interpret < "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2> in the current context!
    Error: Unable to interpret < "{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update> in the current context!
    Error: Unable to interpret < "{C544F99D-39EF-4E6D-95BE-4E41C1D8C4CB}" = Dr Watson for Microsoft Windows OneCare Live v0.9.0929.18> in the current context!
    Error: Unable to interpret < "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1> in the current context!
    Error: Unable to interpret < "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1> in the current context!
    Error: Unable to interpret < "{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser> in the current context!
    Error: Unable to interpret < "{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)> in the current context!
    Error: Unable to interpret < "{E62A1F01-07B7-4541-A835-EE5B0BF064C2}" = Microsoft Antimalware> in the current context!
    Error: Unable to interpret < "{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect> in the current context!
    Error: Unable to interpret < "{EF98A02A-1748-4762-9B7D-5ED1600520D5}" = Microsoft Security Essentials> in the current context!
    Error: Unable to interpret < "Adobe Acrobat 5.0" = Adobe Acrobat 5.0> in the current context!
    Error: Unable to interpret < "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX> in the current context!
    Error: Unable to interpret < "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin> in the current context!
    Error: Unable to interpret < "Adobe Shockwave Player" = Adobe Shockwave Player> in the current context!
    Error: Unable to interpret < "Adobe SVG Viewer" = Adobe SVG Viewer 3.0> in the current context!
    Error: Unable to interpret < "All ATI Software" = ATI - Software Uninstall Utility> in the current context!
    Error: Unable to interpret < "ATI Display Driver" = ATI Display Driver> in the current context!
    Error: Unable to interpret < "AudibleDownloadManager" = Audible Download Manager> in the current context!
    Error: Unable to interpret < "Belarc Advisor 2.0" = Belarc Advisor 7.2> in the current context!
    Error: Unable to interpret < "Dell V310-V510 Series" = Dell V310-V510 Series> in the current context!
    Error: Unable to interpret < "DiskCleaner" = Disk Cleaner (remove only)> in the current context!
    Error: Unable to interpret < "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs> in the current context!
    Error: Unable to interpret < "ie7" = Windows Internet Explorer 7> in the current context!
    Error: Unable to interpret < "ie8" = Windows Internet Explorer 8> in the current context!
    Error: Unable to interpret < "InstallShield_{13515135-48BB-4184-8C1F-2FAE0138E200}" = TBS WMP Plug-in> in the current context!
    Error: Unable to interpret < "Intel(R) 537EP V9x DF PCI Modem" = Intel(R) 537EP V9x DF PCI Modem> in the current context!
    Error: Unable to interpret < "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1> in the current context!
    Error: Unable to interpret < "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1> in the current context!
    Error: Unable to interpret < "Microsoft Security Essentials" = Microsoft Security Essentials> in the current context!
    Error: Unable to interpret < "Mozilla Firefox (3.0.11)" = Mozilla Firefox (3.0.11)> in the current context!
    Error: Unable to interpret < "MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP> in the current context!
    Error: Unable to interpret < "MSNINST" = MSN> in the current context!
    Error: Unable to interpret < "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs> in the current context!
    Error: Unable to interpret < "PROSet" = Intel(R) PRO Network Connections Drivers> in the current context!
    Error: Unable to interpret < "SpywareBlaster_is1" = SpywareBlaster 4.3> in the current context!
    Error: Unable to interpret < "ViewpointMediaPlayer" = Viewpoint Media Player> in the current context!
    Error: Unable to interpret < "Windows Media Format Runtime" = Windows Media Format 11 runtime> in the current context!
    Error: Unable to interpret < "Windows Media Player" = Windows Media Player 11> in the current context!
    Error: Unable to interpret < "Windows XP Service Pack" = Windows XP Service Pack 3> in the current context!
    Error: Unable to interpret < "WMCSetup" = Windows Media Connect> in the current context!
    Error: Unable to interpret < "WMFDist11" = Windows Media Format 11 runtime> in the current context!
    Error: Unable to interpret < "wmp11" = Windows Media Player 11> in the current context!
    Error: Unable to interpret < "Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0> in the current context!
    Error: Unable to interpret < "Yahoo! Messenger" = Yahoo! Messenger> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <========== HKEY_CURRENT_USER Uninstall List ==========> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]> in the current context!
    Error: Unable to interpret < "f031ef6ac137efc5" = Dell Driver Download Manager> in the current context!
    Error: Unable to interpret < "Google Chrome" = Google Chrome> in the current context!
    Error: Unable to interpret < "Move Media Player" = Move Media Player> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <========== Last 10 Event Log Errors ==========> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[ Application Events ]> in the current context!
    Error: Unable to interpret <Error - 7/19/2010 5:19:53 AM | Computer Name = D8T09M81 | Source = ESENT | ID = 489> in the current context!
    Error: Unable to interpret <Description = wuauclt (2600) An attempt to open the file "C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log "> in the current context!
    Error: Unable to interpret < for read only access failed with system error 32 (0x00000020): "The process cannot> in the current context!
    Error: Unable to interpret < access the file because it is being used by another process. ". The open file > in the current context!
    Error: Unable to interpret <operation will fail with error -1032 (0xfffffbf8).> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <Error - 7/19/2010 5:19:53 AM | Computer Name = D8T09M81 | Source = ESENT | ID = 455> in the current context!
    Error: Unable to interpret <Description = wuaueng.dll (2600) SUS20ClientDataStore: Error -1032 (0xfffffbf8) > in the current context!
    Error: Unable to interpret <occurred while opening logfile C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log.> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <Error - 7/19/2010 5:24:35 AM | Computer Name = D8T09M81 | Source = ESENT | ID = 489> in the current context!
    Error: Unable to interpret <Description = wuauclt (2036) An attempt to open the file "C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log "> in the current context!
    Error: Unable to interpret < for read only access failed with system error 32 (0x00000020): "The process cannot> in the current context!
    Error: Unable to interpret < access the file because it is being used by another process. ". The open file > in the current context!
    Error: Unable to interpret <operation will fail with error -1032 (0xfffffbf8).> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <Error - 7/19/2010 5:24:35 AM | Computer Name = D8T09M81 | Source = ESENT | ID = 455> in the current context!
    Error: Unable to interpret <Description = wuaueng.dll (2036) SUS20ClientDataStore: Error -1032 (0xfffffbf8) > in the current context!
    Error: Unable to interpret <occurred while opening logfile C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log.> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <Error - 7/19/2010 5:24:46 AM | Computer Name = D8T09M81 | Source = ESENT | ID = 489> in the current context!
    Error: Unable to interpret <Description = wuauclt (2036) An attempt to open the file "C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log "> in the current context!
    Error: Unable to interpret < for read only access failed with system error 32 (0x00000020): "The process cannot> in the current context!
    Error: Unable to interpret < access the file because it is being used by another process. ". The open file > in the current context!
    Error: Unable to interpret <operation will fail with error -1032 (0xfffffbf8).> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <Error - 7/19/2010 5:24:46 AM | Computer Name = D8T09M81 | Source = ESENT | ID = 455> in the current context!
    Error: Unable to interpret <Description = wuaueng.dll (2036) SUS20ClientDataStore: Error -1032 (0xfffffbf8) > in the current context!
    Error: Unable to interpret <occurred while opening logfile C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log.> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <Error - 7/19/2010 5:32:24 AM | Computer Name = D8T09M81 | Source = ESENT | ID = 489> in the current context!
    Error: Unable to interpret <Description = wuauclt (1284) An attempt to open the file "C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log "> in the current context!
    Error: Unable to interpret < for read only access failed with system error 32 (0x00000020): "The process cannot> in the current context!
    Error: Unable to interpret < access the file because it is being used by another process. ". The open file > in the current context!
    Error: Unable to interpret <operation will fail with error -1032 (0xfffffbf8).> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <Error - 7/19/2010 5:32:24 AM | Computer Name = D8T09M81 | Source = ESENT | ID = 455> in the current context!
    Error: Unable to interpret <Description = wuaueng.dll (1284) SUS20ClientDataStore: Error -1032 (0xfffffbf8) > in the current context!
    Error: Unable to interpret <occurred while opening logfile C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log.> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <Error - 7/19/2010 5:32:35 AM | Computer Name = D8T09M81 | Source = ESENT | ID = 489> in the current context!
    Error: Unable to interpret <Description = wuauclt (1284) An attempt to open the file "C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log "> in the current context!
    Error: Unable to interpret < for read only access failed with system error 32 (0x00000020): "The process cannot> in the current context!
    Error: Unable to interpret < access the file because it is being used by another process. ". The open file > in the current context!
    Error: Unable to interpret <operation will fail with error -1032 (0xfffffbf8).> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <Error - 7/19/2010 5:32:36 AM | Computer Name = D8T09M81 | Source = ESENT | ID = 455> in the current context!
    Error: Unable to interpret <Description = wuaueng.dll (1284) SUS20ClientDataStore: Error -1032 (0xfffffbf8) > in the current context!
    Error: Unable to interpret <occurred while opening logfile C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log.> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <[ System Events ]> in the current context!
    Error: Unable to interpret <Error - 7/19/2010 7:03:41 AM | Computer Name = D8T09M81 | Source = Service Control Manager | ID = 7031> in the current context!
    Error: Unable to interpret <Description = The Microsoft Antimalware Service service terminated unexpectedly.> in the current context!
    Error: Unable to interpret < It has done this 1 time(s). The following corrective action will be taken in > in the current context!
    Error: Unable to interpret <15000 milliseconds: Restart the service.> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <Error - 7/19/2010 2:03:39 PM | Computer Name = D8T09M81 | Source = Service Control Manager | ID = 7031> in the current context!
    Error: Unable to interpret <Description = The Windows Media Player Network Sharing Service service terminated> in the current context!
    Error: Unable to interpret < unexpectedly. It has done this 1 time(s). The following corrective action will> in the current context!
    Error: Unable to interpret < be taken in 30000 milliseconds: Restart the service.> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <Error - 7/19/2010 2:07:06 PM | Computer Name = D8T09M81 | Source = Service Control Manager | ID = 7031> in the current context!
    Error: Unable to interpret <Description = The Windows Media Player Network Sharing Service service terminated> in the current context!
    Error: Unable to interpret < unexpectedly. It has done this 1 time(s). The following corrective action will> in the current context!
    Error: Unable to interpret < be taken in 30000 milliseconds: Restart the service.> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <Error - 7/19/2010 2:09:47 PM | Computer Name = D8T09M81 | Source = PlugPlayManager | ID = 11> in the current context!
    Error: Unable to interpret <Description = The device Root\LEGACY_GMER\0000 disappeared from the system without> in the current context!
    Error: Unable to interpret < first being prepared for removal.> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <Error - 7/19/2010 3:16:50 PM | Computer Name = D8T09M81 | Source = Service Control Manager | ID = 7031> in the current context!
    Error: Unable to interpret <Description = The Windows Media Player Network Sharing Service service terminated> in the current context!
    Error: Unable to interpret < unexpectedly. It has done this 1 time(s). The following corrective action will> in the current context!
    Error: Unable to interpret < be taken in 30000 milliseconds: Restart the service.> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <Error - 7/19/2010 3:18:49 PM | Computer Name = D8T09M81 | Source = Service Control Manager | ID = 7031> in the current context!
    Error: Unable to interpret <Description = The Windows Media Player Network Sharing Service service terminated> in the current context!
    Error: Unable to interpret < unexpectedly. It has done this 1 time(s). The following corrective action will> in the current context!
    Error: Unable to interpret < be taken in 30000 milliseconds: Restart the service.> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <Error - 7/19/2010 3:58:02 PM | Computer Name = D8T09M81 | Source = Service Control Manager | ID = 7031> in the current context!
    Error: Unable to interpret <Description = The Windows Media Player Network Sharing Service service terminated> in the current context!
    Error: Unable to interpret < unexpectedly. It has done this 1 time(s). The following corrective action will> in the current context!
    Error: Unable to interpret < be taken in 30000 milliseconds: Restart the service.> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <Error - 7/19/2010 3:59:41 PM | Computer Name = D8T09M81 | Source = Service Control Manager | ID = 7031> in the current context!
    Error: Unable to interpret <Description = The Windows Media Player Network Sharing Service service terminated> in the current context!
    Error: Unable to interpret < unexpectedly. It has done this 1 time(s). The following corrective action will> in the current context!
    Error: Unable to interpret < be taken in 30000 milliseconds: Restart the service.> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <Error - 7/19/2010 4:14:14 PM | Computer Name = D8T09M81 | Source = Service Control Manager | ID = 7023> in the current context!
    Error: Unable to interpret <Description = The HID Input Service service terminated with the following error:> in the current context!
    Error: Unable to interpret < %%126> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret <Error - 7/19/2010 7:02:22 PM | Computer Name = D8T09M81 | Source = Service Control Manager | ID = 7023> in the current context!
    Error: Unable to interpret <Description = The HID Input Service service terminated with the following error:> in the current context!
    Error: Unable to interpret < %%126> in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret < > in the current context!
    Error: Unable to interpret << End of report >> in the current context!

    OTL by OldTimer - Version 3.2.9.1 log created on 07202010_015046
     
  15. 2010/07/20
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    My script didn't work, because you either copied it from your email notification, or you didn't copy everything, like a "colon" in front of "OTL" (1st line of my script).
    Please, redo.
     
  16. 2010/07/20
    jan roberts

    jan roberts Inactive Thread Starter

    Joined:
    2005/01/08
    Messages:
    507
    Likes Received:
    2
    will do broni
     
  17. 2010/07/20
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Ok :)
     
  18. 2010/07/20
    jan roberts

    jan roberts Inactive Thread Starter

    Joined:
    2005/01/08
    Messages:
    507
    Likes Received:
    2
    broni here is the run fix log

    All processes killed
    ========== OTL ==========
    Service catchme stopped successfully!
    Service catchme deleted successfully!
    File C:\DOCUME~1\jan\LOCALS~1\Temp\catchme.sys not found.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}\ not found.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\KernelFaultCheck deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
    Starting removal of ActiveX control {7530BFB8-7293-4D34-9923-61A11451AFC5}
    C:\WINDOWS\Downloaded Program Files\OnlineScanner.inf moved successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{7530BFB8-7293-4D34-9923-61A11451AFC5}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7530BFB8-7293-4D34-9923-61A11451AFC5}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7530BFB8-7293-4D34-9923-61A11451AFC5}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7530BFB8-7293-4D34-9923-61A11451AFC5}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
    C:\WINDOWS\system32\D3A869E4A2.sys moved successfully.
    ADS C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34 deleted successfully.
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    ========== FILES ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrator
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes
    ->Java cache emptied: 62871 bytes
    ->FireFox cache emptied: 2516490 bytes

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: jan
    ->Temp folder emptied: 9510098 bytes
    ->Temporary Internet Files folder emptied: 49660351 bytes
    ->Java cache emptied: 14630 bytes
    ->FireFox cache emptied: 23057064 bytes
    ->Google Chrome cache emptied: 856432 bytes
    ->Flash cache emptied: 17271 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 82054 bytes

    User: NetworkService
    ->Temp folder emptied: 18456 bytes
    ->Temporary Internet Files folder emptied: 32902 bytes

    User: ReleaseEngineer.MACROVISION
    ->Flash cache emptied: 53 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 38155 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 34318 bytes
    RecycleBin emptied: 144272 bytes

    Total Files Cleaned = 82.00 mb


    [EMPTYFLASH]

    User: Administrator

    User: All Users

    User: Default User

    User: jan
    ->Flash cache emptied: 0 bytes

    User: LocalService

    User: NetworkService

    User: ReleaseEngineer.MACROVISION
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb

    C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
    HOSTS file reset successfully

    OTL by OldTimer - Version 3.2.9.1 log created on 07202010_223937

    Files\Folders moved on Reboot...
    C:\Documents and Settings\jan\Local Settings\Temp\Google Toolbar\GoogleToolbarWelcome.log moved successfully.
    File\Folder C:\Documents and Settings\jan\Local Settings\Temp\~DF9C4E.tmp not found!
    File\Folder C:\Documents and Settings\jan\Local Settings\Temp\~DF9C66.tmp not found!
    File\Folder C:\Documents and Settings\jan\Local Settings\Temp\~DF9D51.tmp not found!
    File\Folder C:\Documents and Settings\jan\Local Settings\Temp\~DF9D62.tmp not found!
    File\Folder C:\Documents and Settings\jan\Local Settings\Temp\~DF9F12.tmp not found!
    File\Folder C:\Documents and Settings\jan\Local Settings\Temp\~DF9F40.tmp not found!
    C:\Documents and Settings\jan\Local Settings\Temp\~DFE14D.tmp moved successfully.
    C:\Documents and Settings\jan\Local Settings\Temporary Internet Files\Content.IE5\PID9B5JC\113ce987-2b1b-469e-b639-39b1d3dac068_3rd_party_BBS[1].htm moved successfully.
    C:\Documents and Settings\jan\Local Settings\Temporary Internet Files\Content.IE5\PID9B5JC\94104-active-someone-please-look-me-2[1].html moved successfully.
    C:\Documents and Settings\jan\Local Settings\Temporary Internet Files\Content.IE5\PID9B5JC\audmeasure[1].gif moved successfully.
    C:\Documents and Settings\jan\Local Settings\Temporary Internet Files\Content.IE5\PID9B5JC\pixel[2].gif moved successfully.
    C:\Documents and Settings\jan\Local Settings\Temporary Internet Files\Content.IE5\GBJXUIZ1\ads[1].htm moved successfully.

    Registry entries deleted on Reboot...
     
  19. 2010/07/20
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Very nice :)

    Last scan....

    1. Download Temp File Cleaner (TFC)
    Double click on TFC.exe to run the program.
    Click on Start button to begin cleaning process.
    TFC will close all running programs, and it may ask you to restart computer.


    2. Go to Kaspersky website and perform an online antivirus scan.

    1. Disable your active antivirus program.
    2. Read through the requirements and privacy statement and click on Accept button.
    3. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
    4. When the downloads have finished, click on Settings.
    5. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:

    • Spyware, Adware, Dialers, and other potentially dangerous programs
      [*] Archives
      [*] Mail databases
    6. Click on My Computer under Scan.
    7. Once the scan is complete, it will display the results. Click on View Scan Report.
    8. You will see a list of infected items there. Click on Save Report As....
    9. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.
     
  20. 2010/07/20
    jan roberts

    jan roberts Inactive Thread Starter

    Joined:
    2005/01/08
    Messages:
    507
    Likes Received:
    2
    broni i suddenly got 2 albumart,a folder.jpg and desktop.ini on my desktop after the first restart and they came up after the second restart. i havent open them,afraid to they suddenly just appeared.
    and microsoft said the computer suffered major whatever and would i like to send a report? yeah i did. and on the following scan the internet light suddenly went red on the modem and then went out. so im not sure how this scan went. i think that i had better close her down.
     
    Last edited: 2010/07/20
  21. 2010/07/20
    jan roberts

    jan roberts Inactive Thread Starter

    Joined:
    2005/01/08
    Messages:
    507
    Likes Received:
    2
    i dont know how to shorten the log its 471 too long
     
    Last edited: 2010/07/20

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.