• Announcements

    • LS.Andy

      Support for other products than adaware, ad block, web protection and Web Companion   05/05/2017

      Support for the following products is handled by the Lavasoft support team: Lavasoft Tuneup Kit Lavasoft PC Optimizer Lavasoft Driver Updater Lavasoft Registry Tuner Lavasoft Privacy Toolbox Lavasoft File Shredder Lavasoft Digital Lock

      For help with these products, contact the support team here: http://www.lavasoft.com/support/supportcenter/
       
Sign in to follow this  
Followers 0
acpheifer

Please help - Adaware failed to connect to service(Reopened)

18 posts in this topic

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 8:04:05 PM, on 11/5/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Google\Update\GoogleUpdate.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\PROGRA~1\MOVIEL~1\MOVIEL~1\MOVIEL~2.EXE

C:\WINDOWS\System32\nvsvc32.exe

C:\Program Files\Softex\OmniPass\Omniserv.exe

C:\WINDOWS\System32\HPZipm12.exe

C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe

C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe

C:\Program Files\Softex\OmniPass\OPXPApp.exe

C:\WINDOWS\Explorer.exe

C:\windows\system\hpsysdrv.exe

C:\WINDOWS\System32\hphmon05.exe

C:\PROGRA~1\PESTPA~1\PPMemCheck.exe

C:\WINDOWS\ALCXMNTR.EXE

C:\WINDOWS\SYSTEM32\USRmlnkA.exe

C:\Program Files\Google\Gmail Notifier\gnotify.exe

C:\HP\KBD\KBD.EXE

C:\Program Files\Movielink\MovielinkManager\Movielink User.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\SYSTEM32\USRshutA.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\SYSTEM32\USRmlnkA.exe

C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Java\jre6\bin\jucheck.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

 

http://us9.hpwis.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

 

http://srch-us9.hpwis.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

 

http://www.proverbs31radio.blogspot.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

 

http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

 

http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =

 

http://srch-us9.hpwis.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

 

http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

 

http://go.microsoft.com/fwlink/?LinkId=69157

F2 - REG:system.ini: Shell=Explorer.exe logon.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -

 

C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer -

 

{3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program

 

Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program

 

Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -

 

C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E}

 

- C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll

O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program

 

Files\MSN\Toolbar\3.0.0311.0\msneshellx.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} -

 

C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} -

 

C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: (no name) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - (no file)

O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program

 

Files\MSN\Toolbar\3.0.0311.0\msneshellx.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program

 

Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe

O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe

O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe

O4 - HKLM\..\Run: [AutoTKit] C:\hp\bin\AUTOTKIT.EXE

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

O4 - HKLM\..\Run: [uSRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices

 

\Device\3cpipe-USRpdA

O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program

 

Files\Google\Gmail Notifier\gnotify.exe

O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE

O4 - HKLM\..\Run: [LoadMSvcmm] "C:\Program Files\Movielink\MovielinkManager\Movielink

 

User.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"

 

-atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common

 

Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common

 

Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [nesurukeb] Rundll32.exe "c:\windows\system32\gejanojo.dll",a

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [swg] "C:\Program

 

Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Nero PhotoShow Media Manager]

 

C:\PROGRA~1\Nero\NEROPH~1\data\Xtras\mssysmgr.exe

O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel

 

FW\Desktop\DesktopWeather.exe"

O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat

 

7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1

O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common

 

Files\LightScribe\LightScribeControlPanel.exe -hidden

O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')

O4 - S-1-5-18 Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'SYSTEM')

O4 - .DEFAULT Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')

O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat

 

7.0\Reader\reader_sl.exe

O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program

 

Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe

O4 - Global Startup: hpoddt01.exe.lnk = ?

O8 - Extra context menu item: &Search the Web - C:\WINDOWS\Web\Ers_src.htm

O8 - Extra context menu item: E&xport to Microsoft Excel -

 

res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

 

C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program

 

Files\Microsoft Money\System\mnyside.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} -

 

C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -

 

{e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

 

Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger -

 

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (MSN Games – Matchmaking) -

 

http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control)

 

- http://upload.facebook.com/controls/2008.1...toUploader5.cab

O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) -

 

http://www.musicnotes.com/download/mnviewer.cab

O16 - DPF: {20CE7BA6-1131-433A-8751-4BC7A1A41845} (MyPhotoAlbum Upload Tool Combo

 

Control) - http://happyinmontana.myphotoalbum.com/MyP...asyUploader.cab

O16 - DPF: {26B2A5DA-BFD6-422F-A89A-28A54C74B12B} (Photo Upload Plugin Class) -

 

http://images3.pnimedia.com/ProductAssets/...otoCenter_Activ

 

eX_Control.cab

O16 - DPF: {33E54F7F-561C-49E6-929B-D7E76D3AFEB1} (Pool Control) -

 

http://mirror.worldwinner.com/games/v45/pool/pool.cab

O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) -

 

http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab

O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) -

 

http://www.costcophotocenter.com/CostcoActivia.cab

O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (MSN Games – Game Chat) -

 

http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab

O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -

 

http://us.games2.yimg.com/download.games.y...xentctl_0_0_0_1

 

.ocx

O16 - DPF: {6A4F3A11-99B7-4BD1-AF88-B7354D1DAECD} (SoleroMusicControl Class) -

 

http://www.freehandmusic.com/Update/SoleroMusicControl.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -

 

http://update.microsoft.com/microsoftupdat...t/muweb_site.ca

 

b?1153263991984

O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) -

 

https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab

O16 - DPF: {8A0DCBDB-6E20-489C-9041-C1E8A0352E75} (Mirar_Dummy_ATS1 Class) -

 

http://awbeta.net-nucleus.com/FIX/WinATS.cab

O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) -

 

http://mirror.worldwinner.com/games/shared/wwlaunch.cab

O16 - DPF: {95B5D20C-BD31-4489-8ABF-F8C8BE748463} (MSN Games – Hearts) -

 

http://zone.msn.com/bingame/zpagames/zpa_hrtz.cab99160.cab

O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) -

 

http://zone.msn.com/bingame/zpagames/zpa_shvl.cab55579.cab

O16 - DPF: {A82C3A33-5C0E-466C-B020-71585433A7E4} (PhxStudent.OeSetup15) -

 

https://mycampus.phoenix.edu/secure/PhxStudent15.CAB

O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} (DDRevision Class) -

 

http://h20264.www2.hp.com/ediags/dd/instal...nosticsxp2k.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) -

 

http://cdn2.zone.msn.com/binFramework/v10/...k.cab102118.cab

O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) -

 

http://www.live365.com/players/play365.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

 

https://fpdownload.macromedia.com/pub/shock...ash/swflash.cab

O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) -

 

http://zone.msn.com/binframework/v10/StProxy.cab55579.cab

O16 - DPF: {DC11F230-5717-4C25-BAD7-37B879C19655} (MyPhotoAlbum Easy Upload Tool

 

Combo Control) - http://www.happyinmontana.myphotoalbum.com...geUploader4.cab

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) -

 

http://zone.msn.com/bingame/popcaploader_v10.cab

O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} -

 

http://fdl.msn.com/zone/datafiles/heartbeat.cab

O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) -

 

http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab

O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) -

 

http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?323

O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) -

 

http://cvs.pnimedia.com/upload/activex/v2_...tupv2.0.0.9.cab?

O17 - HKLM\System\CCS\Services\Tcpip\..\{47B321EB-53CB-4299-B6F1-7FE4FA306704}:

 

NameServer = 12.32.34.32,12.32.34.33

O20 - AppInit_DLLs: kuhodeha.dll c:\windows\system32\gejanojo.dll

O21 - SSODL: lasigayef - {9717ee4e-1f89-43a9-b7d0-f632029231fb} -

 

c:\windows\system32\gejanojo.dll

O22 - SharedTaskScheduler: tokatiluy - {9717ee4e-1f89-43a9-b7d0-f632029231fb} -

 

c:\windows\system32\gejanojo.dll

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH -

 

C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program

 

Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program

 

Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program

 

Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc.

 

- C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Movielink Core Service - Movielink LLC -

 

C:\PROGRA~1\MOVIEL~1\MOVIEL~1\MOVIEL~2.EXE

O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero

 

BackItUp\NBService.exe (file missing)

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation -

 

C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program

 

Files\Softex\OmniPass\Omniserv.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

O23 - Service: SupportSoft Listener Service (sprtlisten) - SupportSoft, Inc. -

 

C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe

O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common

 

Files\supportsoft\bin\ssrc.exe

O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI

 

Wireless Network Monitor\WLService.exe

 

--

End of file - 14715 bytes

Share this post


Link to post
Share on other sites

hi

 

Download ComboFix from one of these locations:

 

Link 1

Link 2

 

 

* IMPORTANT !!! Save ComboFix.exe to your Desktop

 

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you don't know how to disable them then just continue on.
     
     
  • Double click on ComboFix.exe & follow the prompts.
     
     
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
     
     
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

 

 

RcAuto1.gif

 

 

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

 

whatnext.png

 

 

Click on Yes, to continue scanning for malware.

 

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.

Share this post


Link to post
Share on other sites

Due to lack of feedback, this topic has been closed.

 

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

 

Everyone else please begin a New Topic.

 

Thank You !

Share this post


Link to post
Share on other sites
post the logs

Here is the combofix log. Thanks for your help. Log.txt is also attached.

 

ComboFix 09-11-05.05 - Owner 11/06/2009 8:49.1.2 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.169 [GMT -7:00]

Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning disabled* (Updated) {81993054-FFA4-00CC-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning disabled* (Updated) {81FCCDDC-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning disabled* (Updated) {82101C2C-FFA4-0100-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {00000000-0000-0000-0000-000000000000}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {00000202-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {00000246-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8198E8F4-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {819A2DDC-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {819AC3D4-FFA4-00CC-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81B13054-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81BDF054-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81BF2054-FFA4-00CC-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81BF37FC-FFA4-00CC-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C27554-FFA4-00CC-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C2BDDC-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C36DDC-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C3F854-FFA4-00CC-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C41254-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C474AC-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C57764-FFA4-00CC-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C58DDC-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C59A3C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C6FDDC-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C72CC4-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C77DDC-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C7CA44-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C8164C-FFA4-0100-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C8EB04-FFA4-00CC-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C96BFC-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C9A45C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C9CDDC-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81CA17AC-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81CA45A4-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81CAB45C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81CB2A3C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81CB662C-FFA4-0100-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81CB74AC-FFA4-00CC-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81CBF874-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81CC8DDC-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81CCF84C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81CD76B4-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81CEDA14-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81CF0BFC-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81D1231C-FFA4-00CC-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81D1498C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81D217AC-FFA4-00CC-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81D33DDC-FFA4-00CC-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81D3CA54-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81D65BFC-FFA4-00CC-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81D80DDC-FFA4-00CC-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81D836EC-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81D93DDC-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81D96DDC-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81D9F20C-FFA4-00CC-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DA167C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DA61E4-FFA4-00CC-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DB05A4-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DB1DB4-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DB3A84-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DBDC1C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DCA33C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DDDC1C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DDE5A4-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DE5714-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DED974-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DF05A4-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DF1DDC-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DF2DDC-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DFBCA4-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81E0EA6C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81E1085C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81E3B554-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81E6A79C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81E7767C-FFA4-0100-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81F7A60C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81F85DDC-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81F8B63C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81F8D77C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81F9291C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81F965A4-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81F9E054-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81FA75A4-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81FAF33C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81FB7054-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81FBE9C4-FFA4-0100-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81FD033C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81FD6DDC-FFA4-00CC-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81FDB76C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81FDC054-FFA4-00CC-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81FE0DDC-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81FE5254-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81FFFA9C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8200043C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8200251C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {82011324-FFA4-00CC-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {82040A84-FFA4-00CC-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {820674BC-FFA4-00CC-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8206C9B4-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {82080054-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {820B0054-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {820D4C9C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {820F6314-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {820FCA94-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {820FFAD4-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {82106A2C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8213FDDC-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8219E37C-FFA4-00EF-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {821A218C-FFA4-00CC-0D24-347CA8A3377C}

.

 

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\windows\Downloaded Program Files\popcaploader.dll

c:\windows\Downloaded Program Files\popcaploader.inf

c:\windows\system32\gejanojo.dll

c:\windows\system32\gitegime.dll

c:\windows\system32\gotasura.dll

c:\windows\system32\gurujize.dll

c:\windows\system32\iAlmcoin.dll

c:\windows\system32\jupirope.dll

c:\windows\system32\kuhodeha.dll

c:\windows\system32\lisuzise.dll

c:\windows\system32\malurimi.dll

c:\windows\system32\Memman.vxd

c:\windows\system32\risijiru.dll

c:\windows\system32\runivito.dll

c:\windows\system32\savuyodu.dll

c:\windows\system32\skinboxer43.dll

c:\windows\system32\tenanadu.dll

c:\windows\system32\tihuhata.dll

c:\windows\system32\tiyaviwo.dll

c:\windows\system32\tugabave.dll

c:\windows\system32\vivipehu.dll

c:\windows\system32\vohevubo.dll

c:\windows\system32\vusiluya.dll

c:\windows\system32\vuyepuka.dll

c:\windows\system32\vuzejofu.dll

c:\windows\system32\yanupele.dll

c:\windows\system32\yumuyofu.dll

c:\windows\Tasks\cuytywer.job

D:\Autorun.inf

K:\Autorun.inf

k:\my documents\july27.reg

 

.

((((((((((((((((((((((((( Files Created from 2009-10-06 to 2009-11-06 )))))))))))))))))))))))))))))))

.

 

2009-11-06 03:03 . 2009-11-06 03:03 -------- d-----w- c:\program files\Trend Micro

2009-11-06 03:02 . 2009-11-06 03:02 -------- d-----w- c:\temp\ERDNT

2009-11-06 03:00 . 2009-11-06 03:01 -------- d-----w- c:\temp\ERUNT

2009-11-06 02:54 . 2008-06-22 04:14 21504 ----a-w- c:\temp\SysRestorePoint.exe

2009-11-06 02:29 . 2009-11-06 02:29 933120 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll

2009-11-06 02:29 . 2009-11-06 02:29 640608 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe

2009-11-06 02:29 . 2009-11-06 02:29 815760 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe

2009-11-06 02:29 . 2009-11-06 02:29 822904 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe

2009-11-06 02:29 . 2009-11-06 02:29 1638104 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe

2009-11-06 02:29 . 2009-11-06 02:29 788368 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe

2009-11-06 02:29 . 2009-11-06 02:29 1179232 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe

2009-11-06 02:27 . 2009-10-03 08:15 2924848 -c--a-w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}\Ad-AwareInstallation.exe

2009-11-06 02:27 . 2009-11-06 02:27 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}

2009-11-06 02:26 . 2009-11-06 02:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft

2009-10-27 15:24 . 2009-10-27 15:24 152576 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_15\lzma.dll

2009-10-27 14:41 . 2009-07-28 22:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2009-10-27 14:41 . 2009-03-30 16:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys

2009-10-27 14:41 . 2009-02-13 18:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys

2009-10-27 14:41 . 2009-02-13 18:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys

2009-10-27 14:41 . 2009-10-27 14:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira

2009-10-27 14:41 . 2009-10-27 14:41 -------- d-----w- c:\program files\Avira

2009-10-19 00:25 . 2009-10-19 00:25 -------- d-----w- c:\documents and settings\All Users\Application Data\LightScribe

2009-10-19 00:04 . 2009-10-19 00:04 -------- d-----w- c:\program files\Nero

2009-10-18 23:00 . 2009-10-18 23:00 -------- d-----w- c:\windows\system32\wbem\Repository

2009-10-18 22:59 . 2009-10-18 23:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero

2009-10-18 22:54 . 2009-10-27 14:58 -------- d-----w- c:\program files\Common Files\LightScribe

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-11-06 02:26 . 2004-03-07 23:40 -------- d-----w- c:\program files\Lavasoft

2009-11-03 20:55 . 2007-08-13 17:08 -------- d-----w- c:\documents and settings\Owner\Application Data\Ahead

2009-10-27 15:25 . 2003-11-12 22:08 -------- d-----w- c:\program files\Java

2009-10-19 00:04 . 2007-08-10 21:47 -------- d-----w- c:\program files\Common Files\Ahead

2009-09-29 05:12 . 2009-09-29 05:04 19558 ----a-w- c:\windows\hpoins01.dat

2009-09-29 04:37 . 2009-09-29 04:37 10134 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{4CCC7F68-A437-4559-A840-F5E010934951}\ARPPRODUCTICON.exe

2009-09-29 04:37 . 2003-08-23 13:54 -------- d-----w- c:\program files\HP

2009-09-29 03:41 . 2009-09-29 03:41 -------- d-----w- c:\documents and settings\Owner\Application Data\Hewlett-Packard

2009-09-29 03:37 . 2003-08-23 13:51 -------- d-----w- c:\program files\Hewlett-Packard

2009-09-23 12:55 . 2009-11-06 02:30 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys

2009-09-20 13:44 . 2004-12-13 01:24 -------- d-----w- c:\program files\Egg Timer

2009-09-19 19:08 . 2009-09-19 02:59 -------- d-----w- c:\documents and settings\Owner\Application Data\EuroTalk

2009-09-19 03:21 . 2009-09-19 03:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Ten Thumbs Typing Tutor

2009-09-19 03:19 . 2009-09-19 03:19 -------- d-----w- c:\program files\Ten Thumbs Typing Tutor 4.7

2009-09-19 02:59 . 2009-09-19 02:59 -------- d-----w- c:\program files\EuroTalk

2009-09-19 02:51 . 2009-06-21 21:07 -------- d-----w- c:\documents and settings\Owner\Application Data\TopicsLearning

2009-09-14 00:17 . 2007-11-23 23:16 1924440 ----a-w- c:\documents and settings\Owner\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe

2009-09-11 14:18 . 2003-08-25 20:32 136192 ----a-w- c:\windows\system32\msv1_0.dll

2009-09-09 09:13 . 2008-06-22 00:42 -------- d-----w- c:\program files\Microsoft Silverlight

2009-09-04 21:03 . 2003-08-25 21:30 58880 ----a-w- c:\windows\system32\msasn1.dll

2009-08-29 08:08 . 2004-02-07 02:05 916480 ----a-w- c:\windows\system32\wininet.dll

2009-08-26 08:00 . 2003-08-25 20:33 247326 ----a-w- c:\windows\system32\strmdll.dll

2004-09-18 19:23 . 2004-09-18 19:23 0 --sha-w- c:\windows\SMINST\HPCD.sys

2009-08-05 13:53 . 2009-08-05 13:53 90112 --sha-w- c:\windows\system32\nimariwu.dll

.

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2005-06-14 6856704]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-25 68856]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"DW6"="c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2009-02-11 801904]

"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]

"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688]

"HPHmon05"="c:\windows\System32\hphmon05.exe" [2003-05-23 483328]

"PPMemCheck"="c:\progra~1\PESTPA~1\PPMemCheck.exe" [2003-04-19 148480]

"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]

"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-05-03 4640768]

"USRpdA"="c:\windows\SYSTEM32\USRmlnkA.exe" [2002-08-29 77891]

"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]

"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]

"LoadMSvcmm"="c:\program files\Movielink\MovielinkManager\Movielink User.exe" [2007-09-10 124248]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-10-20 286720]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-11-03 267048]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-13 185896]

"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]

"combofix"="c:\combofix\CF3464.exe" [2009-11-06 389120]

"AlcxMonitor"="ALCXMNTR.EXE" - c:\windows\ALCXMNTR.EXE [2004-09-07 57344]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2008-04-14 53760]

 

c:\documents and settings\Default User\Start Menu\Programs\Startup\

mod_sm.lnk - c:\hp\bin\cloaker.exe [1999-11-7 27136]

 

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-4-9 323646]

hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-9 28672]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"Shell"="Explorer.exe logon.exe"

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]

2003-02-21 10:50 40960 ----a-w- c:\program files\Softex\OmniPass\OPXPGina.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UpdatesDisableNotify"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\mshta.exe"=

"c:\\WINDOWS\\system32\\fxsclnt.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\WINDOWS\\system32\\dplaysvr.exe"=

"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Internet Explorer\\iexplore.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\WINDOWS\\explorer.exe"=

"c:\\Program Files\\The Weather Channel FW\\Desktop\\DesktopWeather.exe"=

"c:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe"=

"c:\\Program Files\\Google\\Update\\GoogleUpdate.exe"=

"c:\\WINDOWS\\system32\\winlogon.exe"=

 

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [11/5/2009 7:30 PM 64288]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [10/27/2009 7:41 AM 108289]

R2 sprtlisten;SupportSoft Listener Service;c:\program files\Common Files\supportsoft\bin\sprtlisten.exe [1/8/2008 12:02 PM 1213728]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [7/3/2009 12:17 PM 133104]

S2 mrtRate;mrtRate; [x]

S3 wind502u;802.11g 54Mbps USB2.0 Adapter;c:\windows\system32\DRIVERS\wind502u.sys --> c:\windows\system32\DRIVERS\wind502u.sys [?]

 

--- Other Services/Drivers In Memory ---

 

*NewlyCreated* - GTNDIS5

*NewlyCreated* - MBR

*Deregistered* - mbr

.

Contents of the 'Scheduled Tasks' folder

 

2009-09-29 c:\windows\Tasks\FRU Task 2003-04-10 00:56ewlett-Packard2003-04-10 00:56p psc 2170 series272A572217594EBCF1CEE215E352B92AD073FDE4254201165.job

- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-09 23:56]

 

2009-11-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore1ca5a84d758f156.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-03 19:17]

 

2004-01-07 c:\windows\Tasks\Symantec NetDetect.job

- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2003-08-29 23:20]

 

2009-09-29 c:\windows\Tasks\WebReg 20090929095231.job

- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqwrg.exe [2003-04-10 00:06]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.proverbs31radio.blogspot.com/

uSearch Page = hxxp://www.google.com

uDefault_Page_URL = hxxp://us9.hpwis.com/

uDefault_Search_URL = hxxp://srch-us9.hpwis.com/

uSearch Bar = hxxp://www.google.com/ie

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

mSearch Bar = hxxp://srch-us9.hpwis.com/

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = 127.0.0.1;localhost

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

mSearchAssistant = hxxp://www.google.com/ie

IE: &Search the Web - c:\windows\Web\Ers_src.htm

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

TCP: {47B321EB-53CB-4299-B6F1-7FE4FA306704} = 12.32.34.32,12.32.34.33

DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

DPF: {20CE7BA6-1131-433A-8751-4BC7A1A41845} - hxxp://happyinmontana.myphotoalbum.com/MyPhotoAlbumEasyUploader.cab

DPF: {26B2A5DA-BFD6-422F-A89A-28A54C74B12B} - hxxp://images3.pnimedia.com/ProductAssets/costcous/activex/v3_0_0_4/PhotoCenter_ActiveX_Control.cab

DPF: {6A4F3A11-99B7-4BD1-AF88-B7354D1DAECD} - hxxp://www.freehandmusic.com/Update/SoleroMusicControl.cab

DPF: {8A0DCBDB-6E20-489C-9041-C1E8A0352E75} - hxxp://awbeta.net-nucleus.com/FIX/WinATS.cab

DPF: {A82C3A33-5C0E-466C-B020-71585433A7E4} - hxxps://mycampus.phoenix.edu/secure/PhxStudent15.CAB

DPF: {DC11F230-5717-4C25-BAD7-37B879C19655} - hxxp://www.happyinmontana.myphotoalbum.com/ImageUploader4.cab

.

- - - - ORPHANS REMOVED - - - -

 

BHO-{aaf1df92-548e-4c19-af86-4f732cd9f78d} - tenanadu.dll

WebBrowser-{5464CEEB-E41D-045A-9330-ADA910B65E0A} - (no file)

WebBrowser-{71ED4FBA-4024-4BBE-91DC-9704C93F453E} - (no file)

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)

WebBrowser-{F6387320-2466-42C3-9E7C-6A7BD7BD1F61} - (no file)

HKCU-Run-Nero PhotoShow Media Manager - c:\progra~1\Nero\NEROPH~1\data\Xtras\mssysmgr.exe

HKCU-Run-LightScribe Control Panel - c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe

HKLM-Run-AutoTKit - c:\hp\bin\AUTOTKIT.EXE

HKLM-Run-nesurukeb - c:\windows\system32\gotasura.dll

HKLM-Run-NWEReboot - (no file)

HKLM-Run-derirowaki - tihuhata.dll

SharedTaskScheduler-{cf2385f2-ea4c-4dba-b268-52d08af7885a} - c:\windows\system32\gotasura.dll

SSODL-lekapesud-{cf2385f2-ea4c-4dba-b268-52d08af7885a} - c:\windows\system32\gotasura.dll

SafeBoot-Lavasoft Ad-Aware Service

AddRemove-Convert Doc_is1 - c:\program files\Softinterface

AddRemove-{45B6180B-DCAB-4093-8EE8-6164457517F0} - c:\program files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\setup\hpzscr01.exe

 

 

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-11-06 09:11

Windows 5.1.2600 Service Pack 3 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

 

- - - - - - - > 'winlogon.exe'(624)

c:\program files\Softex\OmniPass\opxpgina.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\progra~1\MOVIEL~1\MOVIEL~1\MOVIEL~2.EXE

c:\windows\System32\nvsvc32.exe

c:\program files\Softex\OmniPass\Omniserv.exe

c:\windows\System32\HPZipm12.exe

c:\program files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe

c:\program files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe

c:\program files\Softex\OmniPass\OPXPApp.exe

c:\windows\SYSTEM32\USRshutA.exe

c:\program files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe

c:\program files\iPod\bin\iPodService.exe

c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe

c:\program files\Java\jre6\bin\jucheck.exe

.

**************************************************************************

.

Completion time: 2009-11-06 9:31 - machine was rebooted

ComboFix-quarantined-files.txt 2009-11-06 16:31

 

Pre-Run: 17,682,567,168 bytes free

Post-Run: 18,404,306,944 bytes free

 

- - End Of File - - 1117EBD0C1EB5F9C766ECA7AA36D8C72

log.txt

Share this post


Link to post
Share on other sites

hi

 

 

1. Close any open browsers.

 

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

 

3. Open notepad and copy/paste the text in the quotebox below into it:

 

File::

c:\windows\system32\nimariwu.dll

 

Registry::

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\WINDOWS\\system32\\winlogon.exe"=-

 

 

Driver::

 

Save this as CFScript.txt, in the same location as ComboFix.exe

 

 

CFScriptB-4.gif

 

Refering to the picture above, drag CFScript into ComboFix.exe

 

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

 

 

 

Download TFC to your desktop

  • Open the file and close any other windows.
  • It will close all programs itself when run, make sure to let it run uninterrupted.
  • Click the Start button to begin the process. The program should not take long to finish its job
  • Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

 

 

 

Please download Malwarebytes' Anti-Malware from Here

 

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

 

 

 

 

 

 

Go to Kaspersky website and perform an online antivirus scan.

  1. Read through the requirements and privacy statement and click on Accept button.
  2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  3. When the downloads have finished, click on Settings.
  4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
      Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases

[*]Click on My Computer under Scan.

[*]Once the scan is complete, it will display the results. Click on View Scan Report.

[*]You will see a list of infected items there. Click on Save Report As....

[*]Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

Share this post


Link to post
Share on other sites
Thanks for the instructions. The three log files are attached, Combofix, Malwarebytes, and Kaspersky. Please advise...I appreciate it. Edited by acpheifer

Share this post


Link to post
Share on other sites
Sure. Here you go.

Combofix:


ComboFix 09-11-11.02 - Owner 11/11/2009 17:45.2.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.282 [GMT -7:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning disabled* (Updated) {81993054-FFA4-00CC-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning disabled* (Updated) {81FCCDDC-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning disabled* (Updated) {82101C2C-FFA4-0100-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {00000000-0000-0000-0000-000000000000}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {00000202-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {00000246-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8198E8F4-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {819A2DDC-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {819AC3D4-FFA4-00CC-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81B13054-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81BDF054-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81BF2054-FFA4-00CC-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81BF37FC-FFA4-00CC-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C27554-FFA4-00CC-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C2BDDC-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C36DDC-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C3F854-FFA4-00CC-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C41254-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C474AC-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C57764-FFA4-00CC-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C58DDC-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C59A3C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C6FDDC-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C72CC4-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C77DDC-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C7CA44-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C8164C-FFA4-0100-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C8EB04-FFA4-00CC-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C96BFC-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C9A45C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81C9CDDC-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81CA17AC-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81CA45A4-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81CAB45C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81CB2A3C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81CB662C-FFA4-0100-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81CB74AC-FFA4-00CC-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81CBF874-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81CC8DDC-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81CCF84C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81CD76B4-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81CEDA14-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81CF0BFC-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81D1231C-FFA4-00CC-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81D1498C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81D217AC-FFA4-00CC-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81D33DDC-FFA4-00CC-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81D3CA54-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81D65BFC-FFA4-00CC-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81D80DDC-FFA4-00CC-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81D836EC-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81D93DDC-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81D96DDC-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81D9F20C-FFA4-00CC-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DA167C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DA61E4-FFA4-00CC-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DB05A4-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DB1DB4-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DB3A84-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DBDC1C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DCA33C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DDDC1C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DDE5A4-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DE5714-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DED974-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DF05A4-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DF1DDC-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DF2DDC-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81DFBCA4-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81E0EA6C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81E1085C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81E3B554-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81E6A79C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81E7767C-FFA4-0100-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81F7A60C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81F85DDC-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81F8B63C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81F8D77C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81F9291C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81F965A4-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81F9E054-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81FA75A4-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81FAF33C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81FB7054-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81FBE9C4-FFA4-0100-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81FD033C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81FD6DDC-FFA4-00CC-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81FDB76C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81FDC054-FFA4-00CC-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81FE0DDC-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81FE5254-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {81FFFA9C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8200043C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8200251C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {82011324-FFA4-00CC-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {82040A84-FFA4-00CC-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {820674BC-FFA4-00CC-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8206C9B4-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {82080054-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {820B0054-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {820D4C9C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {820F6314-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {820FCA94-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {820FFAD4-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {82106A2C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8213FDDC-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {8219E37C-FFA4-00EF-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virus Protection *On-access scanning enabled* (Updated) {821A218C-FFA4-00CC-0D24-347CA8A3377C}

FILE ::
"c:\windows\system32\nimariwu.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\nimariwu.dll

.
((((((((((((((((((((((((( Files Created from 2009-10-12 to 2009-11-12 )))))))))))))))))))))))))))))))
.

2009-11-11 23:58 . 2009-11-11 23:58 -------- d-----w- c:\windows\LastGood
2009-11-06 03:03 . 2009-11-06 03:03 -------- d-----w- c:\program files\Trend Micro
2009-11-06 03:02 . 2009-11-06 03:02 -------- d-----w- c:\temp\ERDNT
2009-11-06 03:00 . 2009-11-06 03:01 -------- d-----w- c:\temp\ERUNT
2009-11-06 02:54 . 2008-06-22 04:14 21504 ----a-w- c:\temp\SysRestorePoint.exe
2009-11-06 02:29 . 2009-11-06 02:29 933120 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2009-11-06 02:29 . 2009-11-06 02:29 640608 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2009-11-06 02:29 . 2009-11-06 02:29 815760 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2009-11-06 02:29 . 2009-11-06 02:29 822904 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2009-11-06 02:29 . 2009-11-06 02:29 1638104 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2009-11-06 02:29 . 2009-11-06 02:29 788368 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2009-11-06 02:29 . 2009-11-06 02:29 1179232 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2009-11-06 02:27 . 2009-10-03 08:15 2924848 -c--a-w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}\Ad-AwareInstallation.exe
2009-11-06 02:27 . 2009-11-06 02:27 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
2009-11-06 02:26 . 2009-11-06 02:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-10-27 15:24 . 2009-10-27 15:24 152576 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-10-27 14:41 . 2009-07-28 22:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-10-27 14:41 . 2009-03-30 16:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-10-27 14:41 . 2009-02-13 18:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-10-27 14:41 . 2009-02-13 18:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-10-27 14:41 . 2009-10-27 14:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-10-27 14:41 . 2009-10-27 14:41 -------- d-----w- c:\program files\Avira
2009-10-19 00:25 . 2009-10-19 00:25 -------- d-----w- c:\documents and settings\All Users\Application Data\LightScribe
2009-10-19 00:04 . 2009-10-19 00:04 -------- d-----w- c:\program files\Nero
2009-10-18 23:00 . 2009-10-18 23:00 -------- d-----w- c:\windows\system32\wbem\Repository
2009-10-18 22:59 . 2009-10-18 23:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2009-10-18 22:54 . 2009-10-27 14:58 -------- d-----w- c:\program files\Common Files\LightScribe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-06 02:26 . 2004-03-07 23:40 -------- d-----w- c:\program files\Lavasoft
2009-11-03 20:55 . 2007-08-13 17:08 -------- d-----w- c:\documents and settings\Owner\Application Data\Ahead
2009-10-27 15:25 . 2003-11-12 22:08 -------- d-----w- c:\program files\Java
2009-10-19 00:04 . 2007-08-10 21:47 -------- d-----w- c:\program files\Common Files\Ahead
2009-09-29 05:12 . 2009-09-29 05:04 19558 ----a-w- c:\windows\hpoins01.dat
2009-09-29 04:37 . 2009-09-29 04:37 10134 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{4CCC7F68-A437-4559-A840-F5E010934951}\ARPPRODUCTICON.exe
2009-09-29 04:37 . 2003-08-23 13:54 -------- d-----w- c:\program files\HP
2009-09-29 03:41 . 2009-09-29 03:41 -------- d-----w- c:\documents and settings\Owner\Application Data\Hewlett-Packard
2009-09-29 03:37 . 2003-08-23 13:51 -------- d-----w- c:\program files\Hewlett-Packard
2009-09-23 12:55 . 2009-11-06 02:30 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-09-20 13:44 . 2004-12-13 01:24 -------- d-----w- c:\program files\Egg Timer
2009-09-19 19:08 . 2009-09-19 02:59 -------- d-----w- c:\documents and settings\Owner\Application Data\EuroTalk
2009-09-19 03:21 . 2009-09-19 03:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Ten Thumbs Typing Tutor
2009-09-19 03:19 . 2009-09-19 03:19 -------- d-----w- c:\program files\Ten Thumbs Typing Tutor 4.7
2009-09-19 02:59 . 2009-09-19 02:59 -------- d-----w- c:\program files\EuroTalk
2009-09-19 02:51 . 2009-06-21 21:07 -------- d-----w- c:\documents and settings\Owner\Application Data\TopicsLearning
2009-09-14 00:17 . 2007-11-23 23:16 1924440 ----a-w- c:\documents and settings\Owner\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
2009-09-11 14:18 . 2003-08-25 20:32 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:03 . 2003-08-25 21:30 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 08:08 . 2004-02-07 02:05 916480 ------w- c:\windows\system32\wininet.dll
2009-08-26 08:00 . 2003-08-25 20:33 247326 ----a-w- c:\windows\system32\strmdll.dll
2004-09-18 19:23 . 2004-09-18 19:23 0 --sha-w- c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((( [email protected]_16.12.25 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-11-11 20:56 . 2009-11-11 20:56 16384 c:\windows\Temp\Perflib_Perfdata_5cc.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2005-06-14 6856704]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-25 68856]
"DW6"="c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2009-02-11 801904]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688]
"HPHmon05"="c:\windows\System32\hphmon05.exe" [2003-05-23 483328]
"PPMemCheck"="c:\progra~1\PESTPA~1\PPMemCheck.exe" [2003-04-19 148480]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-05-03 4640768]
"USRpdA"="c:\windows\SYSTEM32\USRmlnkA.exe" [2002-08-29 77891]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"LoadMSvcmm"="c:\program files\Movielink\MovielinkManager\Movielink User.exe" [2007-09-10 124248]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-10-20 286720]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-11-03 267048]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-13 185896]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"AlcxMonitor"="ALCXMNTR.EXE" - c:\windows\ALCXMNTR.EXE [2004-09-07 57344]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2008-04-14 53760]

c:\documents and settings\Default User\Start Menu\Programs\Startup\
mod_sm.lnk - c:\hp\bin\cloaker.exe [1999-11-7 27136]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-4-9 323646]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-9 28672]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
2003-02-21 10:50 40960 ----a-w- c:\program files\Softex\OmniPass\OPXPGina.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mshta.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\The Weather Channel FW\\Desktop\\DesktopWeather.exe"=
"c:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe"=
"c:\\Program Files\\Google\\Update\\GoogleUpdate.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [11/5/2009 7:30 PM 64288]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [10/27/2009 7:41 AM 108289]
R2 sprtlisten;SupportSoft Listener Service;c:\program files\Common Files\supportsoft\bin\sprtlisten.exe [1/8/2008 12:02 PM 1213728]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [7/3/2009 12:17 PM 133104]
S2 mrtRate;mrtRate; [x]
S3 wind502u;802.11g 54Mbps USB2.0 Adapter;c:\windows\system32\DRIVERS\wind502u.sys --> c:\windows\system32\DRIVERS\wind502u.sys [?]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - GTNDIS5
*Deregistered* - mbr
*Deregistered* - PROCEXP113
.
Contents of the 'Scheduled Tasks' folder

2009-09-29 c:\windows\Tasks\FRU Task 2003-04-10 00:56ewlett-Packard2003-04-10 00:56p psc 2170 series272A572217594EBCF1CEE215E352B92AD073FDE4254201165.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-09 23:56]

2009-11-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore1ca5a84d758f156.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-03 19:17]

2004-01-07 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2003-08-29 23:20]

2009-09-29 c:\windows\Tasks\WebReg 20090929095231.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqwrg.exe [2003-04-10 00:06]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.proverbs31radio.blogspot.com/
uDefault_Search_URL = hxxp://srch-us9.hpwis.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://srch-us9.hpwis.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1;localhost
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Search the Web - c:\windows\Web\Ers_src.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {47B321EB-53CB-4299-B6F1-7FE4FA306704} = 12.32.34.32,12.32.34.33
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {20CE7BA6-1131-433A-8751-4BC7A1A41845} - hxxp://happyinmontana.myphotoalbum.com/MyPhotoAlbumEasyUploader.cab
DPF: {26B2A5DA-BFD6-422F-A89A-28A54C74B12B} - hxxp://images3.pnimedia.com/ProductAssets/costcous/activex/v3_0_0_4/PhotoCenter_ActiveX_Control.cab
DPF: {6A4F3A11-99B7-4BD1-AF88-B7354D1DAECD} - hxxp://www.freehandmusic.com/Update/SoleroMusicControl.cab
DPF: {A82C3A33-5C0E-466C-B020-71585433A7E4} - hxxps://mycampus.phoenix.edu/secure/PhxStudent15.CAB
DPF: {DC11F230-5717-4C25-BAD7-37B879C19655} - hxxp://www.happyinmontana.myphotoalbum.com/ImageUploader4.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [url="http://www.gmer.net"]http://www.gmer.net[/url]
Rootkit scan 2009-11-11 17:59
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(620)
c:\program files\Softex\OmniPass\opxpgina.dll
.
Completion time: 2009-11-12 18:04
ComboFix-quarantined-files.txt 2009-11-12 01:04
ComboFix2.txt 2009-11-06 16:31

Pre-Run: 18,241,617,920 bytes free
Post-Run: 18,205,343,744 bytes free

- - End Of File - - 0806A995F45ADF1A77530422DDB95E98


Malwarebytes:


Malwarebytes' Anti-Malware 1.41
Database version: 3151
Windows 5.1.2600 Service Pack 3

11/11/2009 6:24:27 PM
mbam-log-2009-11-11 (18-24-27).txt

Scan type: Quick Scan
Objects scanned: 112094
Time elapsed: 4 minute(s), 55 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} (Adware.Minibug) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Owner\Application Data\Winsock2.reg (Rogue.AntiVirusPro) -> Quarantined and deleted successfully.



Kaspersky:


--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Thursday, November 12, 2009
Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Thursday, November 12, 2009 12:43:46
Records in database: 3194950
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\

Scan statistics:
Objects scanned: 159412
Threats found: 14
Infected objects found: 22
Suspicious objects found: 0
Scan duration: 05:30:26


File name / Threat / Threats count
C:\Documents and Settings\Owner\.jpi_cache\jar\1.0\jvmsecman.jar-69ee0e0e-27d52531.zip Infected: Trojan-Downloader.Java.Agent.f 1
C:\Program Files\LIVEUPDATE\Bin\Openwares LiveUpdate.exe Infected: not-a-virus:AdWare.Win32.StickyPops.a 1
C:\Program Files\LIVEUPDATE\Bin\Openwares LiveUpdate.exe Infected: Trojan-Downloader.Win32.Lookme.g 1
C:\Program Files\LIVEUPDATE\Bin\Openwares LiveUpdate.exe Infected: Trojan-Dropper.Win32.Agent.og 1
C:\Program Files\LIVEUPDATE\Bin\Openwares LiveUpdate.exe Infected: not-a-virus:AdWare.Win32.Sidesearch.c 1
C:\Program Files\LIVEUPDATE\Bin\Openwares LiveUpdate.exe Infected: not-a-virus:AdWare.Win32.ClearSearch.f 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\lisuzise.dll.vir Infected: Trojan.Win32.Monderb.bgoj 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\vivipehu.dll.vir Infected: Trojan.Win32.Monder.cutb 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\vuzejofu.dll.vir Infected: Trojan.Win32.Monderb.bgos 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\yumuyofu.dll.vir Infected: Trojan.Win32.Monder.cuul 1
C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP1955\A0155196.dll Infected: Packed.Win32.Katusha.g 1
C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP1955\A0155197.dll Infected: Packed.Win32.Katusha.g 1
C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP1955\A0155198.dll Infected: Packed.Win32.Katusha.g 1
C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP1955\A0155199.dll Infected: Packed.Win32.Katusha.g 1
C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP1955\A0155200.dll Infected: Trojan.Win32.Monder.cust 1
C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP1955\A0155201.dll Infected: Packed.Win32.Katusha.g 1
C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP1955\A0155202.dll Infected: not-a-virus:AdWare.Win32.Mirar.e 1
C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP1956\A0155238.dll Infected: Trojan.Win32.Migotrup.lxh 1
C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP1957\A0156305.dll Infected: Trojan.Win32.Monderb.bgoj 1
C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP1957\A0156316.dll Infected: Trojan.Win32.Monder.cutb 1
C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP1957\A0156319.dll Infected: Trojan.Win32.Monderb.bgos 1
C:\System Volume Information\_restore{F2681A7D-91E5-401A-AC8B-015335799DC0}\RP1957\A0156321.dll Infected: Trojan.Win32.Monder.cuul 1

Selected area has been scanned.

Share this post


Link to post
Share on other sites
hi
[list]
[*]Make sure to use Internet Explorer for this
[*]Please go to [url="http://virscan.org/"][color="red"] VirSCAN.org FREE on-line scan service[/color][/url]
[*]Copy and paste the following file path into the [b]"Suspicious files to scan"[/b] box on the top of the page:
[list]
[*][b]C:\Program Files\LIVEUPDATE\Bin\Openwares LiveUpdate.exe[/b]
[/list]
[*]Click on the [b]Upload[/b] button
[*]If a pop-up appears saying the file has been scanned already, please select the [b]ReScan[/b] button.
[*]Once the Scan is completed, click on the "[b]Copy to Clipboard[/b]" button. This will copy the link of the report into the Clipboard.
[*]Paste the contents of the Clipboard in your next reply.
[/list]

also post a new HJT log

Share this post


Link to post
Share on other sites
VirSCAN.org Scanned Report :
Scanned time : 2009/11/22 08:40:19 (CST)
Scanner results: 24% Scanner(s) (9/37) found malware!
File Name : Openwares LiveUpdate.exe
File Size : 556334 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : 5305a63d9159150ab85a0a18b2acfd39
SHA1 : b261cdfcbe302d3d26a4a5af04b03d1aee42e2d9
Online report : [url="http://virscan.org/report/538df6ef1928d7265bbc1791ca78b91c.html"]http://virscan.org/report/538df6ef1928d726...91ca78b91c.html[/url]

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.8 20091121040123 2009-11-21 4.30 -
AhnLab V3 2009.11.21.00 2009.11.21 2009-11-21 0.98 -
AntiVir 8.2.1.72 7.10.1.43 2009-11-20 0.40 -
Antiy 2.0.18 20091120.3284132 2009-11-20 0.12 -
Arcavir 2009 200911201251 2009-11-20 0.12 Adware.Stickypops.A
Authentium 5.1.1 200911211439 2009-11-21 1.77 -
AVAST! 4.7.4 091121-1 2009-11-21 0.02 Win32:Agent-KYP [Trj]
AVG 8.5.288 270.14.76/2518 2009-11-22 1.78 Generic3.JMK
BitDefender 7.81008.4570836 7.29064 2009-11-22 4.84 Adware.Dnsproxy.A
CA (VET) 35.1.0 7132 2009-11-19 5.53 -
ClamAV 0.95.2 10053 2009-11-21 0.31 Trojan.Downloader.Small-115
Comodo 3.12 2990 2009-11-21 0.75 -
CP Secure 1.3.0.5 2009.11.22 2009-11-22 0.10 -
Dr.Web 4.44.0.9170 2009.11.21 2009-11-21 7.17 -
F-Prot 4.4.4.56 20091121 2009-11-21 1.67 -
F-Secure 7.02.73807 2009.11.21.09 2009-11-21 5.53 Trojan-Downloader.Win32.Lookme.g [AVP]
Fortinet 2.81-3.120 11.79 2009-11-21 0.23 -
GData 19.8934/19.576 20091122 2009-11-22 6.30 Trojan-Downloader.Win32.Lookme.g [Engine:A]
ViRobot 20091120 2009.11.20 2009-11-20 0.41 -
Ikarus T3.1.01.74 2009.11.21.74569 2009-11-21 4.73 -
JiangMin 11.0.800 2009.11.21 2009-11-21 6.04 -
Kaspersky 5.5.10 2009.11.21 2009-11-21 0.98 not-a-virus:AdWare.Win32.StickyPops.a
KingSoft 2009.2.5.15 2009.11.21.23 2009-11-21 0.53 -
McAfee 5.3.00 5809 2009-11-21 3.42 -
Microsoft 1.5302 2009.11.22 2009-11-22 6.81 -
Norman 6.01.09 6.01.00 2009-11-21 6.01 -
Panda 9.05.01 2009.11.21 2009-11-21 2.89 -
Trend Micro 9.000-1003 6.642.07 2009-11-21 0.00 -
Quick Heal 10.00 2009.11.21 2009-11-21 1.42 -
Rising 20.0 22.22.05.04 2009-11-21 0.98 -
Sophos 3.01.0 4.47 2009-11-22 2.93 -
Sunbelt 5518 5518 2009-11-18 3.30 -
Symantec 1.3.0.24 20091121.004 2009-11-21 0.08 -
nProtect 20091121.01 6274767 2009-11-21 5.34 -
The Hacker 6.5.0.2 v00011 2009-09-18 0.72 -
VBA32 3.12.12.0 20091119.2150 2009-11-19 2.66 Trojan-Downloader.Win32.Lookme.g
VirusBuster 4.5.11.10 10.113.25/2000688 2009-11-21 2.54 -











Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:06:53 PM, on 11/21/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\PROGRA~1\MOVIEL~1\MOVIEL~1\MOVIEL~2.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\SYSTEM32\USRmlnkA.exe
C:\WINDOWS\SYSTEM32\USRshutA.exe
C:\WINDOWS\SYSTEM32\USRmlnkA.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Movielink\MovielinkManager\Movielink User.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\Egg Timer\EggTimerPlus.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [url="http://srch-us9.hpwis.com/"]http://srch-us9.hpwis.com/[/url]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url="http://www.proverbs31radio.blogspot.com/"]http://www.proverbs31radio.blogspot.com/[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [url="http://go.microsoft.com/fwlink/?LinkId=69157"]http://go.microsoft.com/fwlink/?LinkId=69157[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [url="http://go.microsoft.com/fwlink/?LinkId=54896"]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = [url="http://srch-us9.hpwis.com/"]http://srch-us9.hpwis.com/[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [url="http://go.microsoft.com/fwlink/?LinkId=54896"]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [url="http://go.microsoft.com/fwlink/?LinkId=69157"]http://go.microsoft.com/fwlink/?LinkId=69157[/url]
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0311.0\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - (no file)
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0311.0\msneshellx.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices \Device\3cpipe-USRpdA
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [LoadMSvcmm] "C:\Program Files\Movielink\MovielinkManager\Movielink User.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - S-1-5-18 Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: &Search the Web - C:\WINDOWS\Web\Ers_src.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (MSN Games – Matchmaking) - [url="http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab"]http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab[/url]
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - [url="http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab"]http://upload.facebook.com/controls/2008.1...toUploader5.cab[/url]
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - [url="http://www.musicnotes.com/download/mnviewer.cab"]http://www.musicnotes.com/download/mnviewer.cab[/url]
O16 - DPF: {20CE7BA6-1131-433A-8751-4BC7A1A41845} (MyPhotoAlbum Upload Tool Combo Control) - [url="http://happyinmontana.myphotoalbum.com/MyPhotoAlbumEasyUploader.cab"]http://happyinmontana.myphotoalbum.com/MyP...asyUploader.cab[/url]
O16 - DPF: {26B2A5DA-BFD6-422F-A89A-28A54C74B12B} (Photo Upload Plugin Class) - [url="http://images3.pnimedia.com/ProductAssets/costcous/activex/v3_0_0_4/PhotoCenter_ActiveX_Control.cab"]http://images3.pnimedia.com/ProductAssets/...veX_Control.cab[/url]
O16 - DPF: {33E54F7F-561C-49E6-929B-D7E76D3AFEB1} (Pool Control) - [url="http://mirror.worldwinner.com/games/v45/pool/pool.cab"]http://mirror.worldwinner.com/games/v45/pool/pool.cab[/url]
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - [url="http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab"]http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab[/url]
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - [url="http://www.costcophotocenter.com/CostcoActivia.cab"]http://www.costcophotocenter.com/CostcoActivia.cab[/url]
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (MSN Games – Game Chat) - [url="http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab"]http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab[/url]
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - [url="http://us.games2.yimg.com/download.games.yahoo.com/games/play/client/exentctl_0_0_0_1.ocx"]http://us.games2.yimg.com/download.games.y...ctl_0_0_0_1.ocx[/url]
O16 - DPF: {6A4F3A11-99B7-4BD1-AF88-B7354D1DAECD} (SoleroMusicControl Class) - [url="http://www.freehandmusic.com/Update/SoleroMusicControl.cab"]http://www.freehandmusic.com/Update/SoleroMusicControl.cab[/url]
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - [url="http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1153263991984"]http://update.microsoft.com/microsoftupdat...b?1153263991984[/url]
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - [url="https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab"]https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab[/url]
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - [url="http://mirror.worldwinner.com/games/shared/wwlaunch.cab"]http://mirror.worldwinner.com/games/shared/wwlaunch.cab[/url]
O16 - DPF: {95B5D20C-BD31-4489-8ABF-F8C8BE748463} (MSN Games – Hearts) - [url="http://zone.msn.com/bingame/zpagames/zpa_hrtz.cab99160.cab"]http://zone.msn.com/bingame/zpagames/zpa_hrtz.cab99160.cab[/url]
O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) - [url="http://zone.msn.com/bingame/zpagames/zpa_shvl.cab55579.cab"]http://zone.msn.com/bingame/zpagames/zpa_shvl.cab55579.cab[/url]
O16 - DPF: {A82C3A33-5C0E-466C-B020-71585433A7E4} (PhxStudent.OeSetup15) - [url="https://mycampus.phoenix.edu/secure/PhxStudent15.CAB"]https://mycampus.phoenix.edu/secure/PhxStudent15.CAB[/url]
O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} (DDRevision Class) - [url="http://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab"]http://h20264.www2.hp.com/ediags/dd/instal...nosticsxp2k.cab[/url]
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - [url="http://cdn2.zone.msn.com/binFramework/v10/ZPAFramework.cab102118.cab"]http://cdn2.zone.msn.com/binFramework/v10/...k.cab102118.cab[/url]
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - [url="http://www.live365.com/players/play365.cab"]http://www.live365.com/players/play365.cab[/url]
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - [url="https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab"]https://fpdownload.macromedia.com/pub/shock...ash/swflash.cab[/url]
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - [url="http://zone.msn.com/binframework/v10/StProxy.cab55579.cab"]http://zone.msn.com/binframework/v10/StProxy.cab55579.cab[/url]
O16 - DPF: {DC11F230-5717-4C25-BAD7-37B879C19655} (MyPhotoAlbum Easy Upload Tool Combo Control) - [url="http://www.happyinmontana.myphotoalbum.com/ImageUploader4.cab"]http://www.happyinmontana.myphotoalbum.com...geUploader4.cab[/url]
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - [url="http://fdl.msn.com/zone/datafiles/heartbeat.cab"]http://fdl.msn.com/zone/datafiles/heartbeat.cab[/url]
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - [url="http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab"]http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab[/url]
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - [url="http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?323"]http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?323[/url]
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) - [url="http://cvs.pnimedia.com/upload/activex/v2_0_0_9/PCAXSetupv2.0.0.9.cab"]http://cvs.pnimedia.com/upload/activex/v2_...tupv2.0.0.9.cab[/url]?
O17 - HKLM\System\CCS\Services\Tcpip\..\{47B321EB-53CB-4299-B6F1-7FE4FA306704}: NameServer = 12.32.34.32,12.32.34.33
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Movielink Core Service - Movielink LLC - C:\PROGRA~1\MOVIEL~1\MOVIEL~1\MOVIEL~2.EXE
O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SupportSoft Listener Service (sprtlisten) - SupportSoft, Inc. - C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe
O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\supportsoft\bin\ssrc.exe
O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe

--
End of file - 13858 bytes

Share this post


Link to post
Share on other sites
hi

Please [b]download[/b] [url="http://oldtimer.geekstogo.com/OTM.exe"][b][color="red"]OTM[/color][/b][/url] [list]
[*] [b]Save[/b] it to your [b]desktop[/b].
[*] Please double-click [b]OTM[/b] to run it. ([b]Note:[/b] If you are running on Vista, right-click on the file and choose [b]Run As Administrator[/b]).
[*][b]Copy the lines in the codebox below to the clipboard[/b] by highlighting [b]ALL[/b] of them and [b]pressing CTRL + C[/b] (or, after highlighting, right-click and choose [b]Copy[/b]):

[code]:Processes

:Services

:Reg

:Files
C:\Program Files\LIVEUPDATE
:Commands
[purity]
[emptytemp]
[Reboot][/code]

[*]Return to OTM, right click in the [b]"Paste Instructions for Items to be Moved"[/b] window (under the yellow bar) and choose [b]Paste[/b].

[*]Click the red [b]Moveit![/b] button.
[*][b]Copy everything in the Results window (under the green bar) to the clipboard[/b] by highlighting [b]ALL[/b] of them and [b]pressing CTRL + C[/b] (or, after highlighting, right-click and choose copy), and paste it in your next reply.
[*]Close [b]OTM[/b] and reboot your PC.
[/list][b]Note:[/b] If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose [b]Yes.[/b] In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter [b]*.log[/b] and press the Enter key, navigate to the [b]C:\_OTMoveIt\MovedFiles[/b] folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Share this post


Link to post
Share on other sites
OTM log:


All processes killed
========== PROCESSES ==========
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\Program Files\LIVEUPDATE\IMG folder moved successfully.
C:\Program Files\LIVEUPDATE\Bin folder moved successfully.
C:\Program Files\LIVEUPDATE folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Owner
->Temp folder emptied: 94746696 bytes
->Temporary Internet Files folder emptied: 46295392 bytes
->Java cache emptied: 13817559 bytes
->Google Chrome cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 1066020 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 51285 bytes

Total Files Cleaned = 148.88 mb


OTM by OldTimer - Version 3.1.2.0 log created on 11242009_192420

Files moved on Reboot...

Registry entries deleted on Reboot...

Share this post


Link to post
Share on other sites
Your logs are clean


[b]Follow these steps to uninstall Combofix and tools used in the removal of malware[/b]

[color="darkblue"][b][u]Uninstall ComboFix[/u][/b][/color]

Remove Combofix now that we're done with it.[list]
[*]Please press the [b]Windows Key[/b] and [b]R[/b] on your keyboard. This will bring up the Run... command.
[*]Now type in [color="blue"][b]Combofix /Uninstall[/b][/color] in the runbox and click [b]OK[/b]. [color="green"](Notice the space between the "x" and "/")[/color]
[img]http://i517.photobucket.com/albums/u338/Eextremeboy/CF_Uninstall-1.jpg[/img]
[*]Please follow the prompts to uninstall Combofix.
[*]You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.
[/list]

[list]
[*]Download [url="http://oldtimer.geekstogo.com/OTC.exe"][color="#0000FF"][b]OTC[/b][/color][/url] to your desktop and run it
[*]Click Yes to beginning the Cleanup process and remove these components, including this application.
[*]You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.
[/list]



Your using an old version of Adobe Acrobat Reader, this can leave your pc open to vulnerabilities, you can update it here :
[url="http://www.adobe.com/products/acrobat/readstep2.html"]http://www.adobe.com/products/acrobat/readstep2.html[/url]



Please download [url="http://raproducts.org/"][color="#FF8C00"][b]JavaRa[/b][/color][/url] to your desktop and unzip it to its own folder[list]
[*]Run JavaRa.exe, pick the language of your choice and click Select. Then click [u]Remove Older Versions[/u].
[*]Accept any prompts.
[*]Open JavaRa.exe again and select [b]Search For Updates[/b].
[*]Select [b]Update Using Sun Java's Website[/b] then click Search and click on the [b]Open Webpage[/b] button. Download and install the latest Java Runtime Environment (JRE) version for your computer.
[/list]


Below I have included a number of recommendations for how to protect your computer against malware infections.[list]
[*]Keep Windows updated by regularly checking their website at :
[url="http://windowsupdate.microsoft.com/"]http://windowsupdate.microsoft.com/[/url]
This will ensure your computer has always the latest security updates available installed on your computer.


[*][url="http://www.javacoolsoftware.com/sbdownload.html"][b][color="red"]SpywareBlaster[/color][/b][/url] protects against bad ActiveX, it immunizes your PC against them.


[*][url="http://www.javacoolsoftware.com/sgdownload.html"][b][color="red"]SpywareGuard[/color][/b][/url] offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.


[*][b][u]Make Internet Explorer more secure[/u][/b][list]
[*]Click [b]Start[/b] > [b]Run[/b]
[*]Type [b]Inetcpl.cpl[/b] & click [b]OK[/b]
[*]Click on the [b]Security[/b] tab
[*]Click [b]Reset all zones to default level[/b]
[*]Make sure the [b]Internet Zone[/b] is selected & Click [b]Custom level[/b]
[*]In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
[*]Next Click [b]OK[/b], then [b]Apply[/b] button and then [b]OK[/b] to exit the Internet Properties page.
[/list]
[*][url="http://oldtimer.geekstogo.com/TFC.exe"][color="#0000FF"][b]TFC[/b][/color][/url] - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.


[*][url="http://mvps.org/winhelp2002/hosts.htm"][b][color="red"]MVPS Hosts file[/color][/b][/url] replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.


[*]Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
[url="http://www.mozilla.org/products/firefox/"][b][color="red"]Here[/color][/b][/url]


If you choose to use Firefox, I highly recommend these add-ons to keep your PC even more secure.[list]
[*][url="https://addons.mozilla.org/en-US/firefox/addon/722"][color="#0000FF"][b]NoScript[/b][/color][/url] - for blocking ads and other potential website attacks
[*][url="http://www.siteadvisor.com/download/ff_preinstall.html"][color="#FF0000"][b]McAfee SiteAdvisor[/b][/color][/url] - this tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling
[/list]

[*][url="http://www.geekstogo.com/2008/06/19/options-for-home-computer-data-backup-part-1/"][b]Keep a backup of your important files[/b][/url] - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.


[*][url="http://www.snapfiles.com/get/erunt.html"][b][color="Blue"]ERUNT[/color][/b][/url] (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.


[*][url="http://www.filehippo.com/updatechecker/FHsetup.exe"][color="#8B0000"][b]FileHippo Update Checker[/b][/color][/url] is an extremely helpful program that will tell you which of your programs need to be updated. Its important to [color="#FF0000"][u][b]keep programs up to date[/b][/u][/color] so that malware doesn't exploit any old security flaws.


[*][b][color="Blue"] [u]Recovery Console[/u][/color][/b] - Recent trends appear to indicate that future infections will include attacks to the boot sector of the computer. The installation of the [b]Recovery Console[/b] in the computer will be our only defense against this threat. For more information and steps to install the Recovery Console see [url="http://support.microsoft.com/kb/307654"][color="#0000FF"][b]This Article[/b][/color][/url]. Should you need assistance in installing the Recovery Console, please do not hesitate to ask.


[*]Please read my guide on how to [b]prevent malware[/b] and about [b]safe computing[/b] [url="http://www.geekstogo.com/forum/Preventing-Malware-Safe-Computing-t225044.html"][color="#FF0000"][b]here[/b][/color][/url]
[/list]Thank you for your patience, and performing all of the procedures requested.

Share this post


Link to post
Share on other sites
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact the staff member who was helping you with your issue.

Everyone else please begin a New Topic.

Thank you !

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.
Sign in to follow this  
Followers 0