Gmer and Malwarebytes won't run

Forum Guidelines

Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help

Posted Image

Unfortunately, with the amount of logs we receive per day, the average response time is 5 days. I want to assure you, though, that your topic will be looked at and responded to. So please be patient.

Posted Image

DO NOT RUN ComboFix unless requested to.

Posted Image

Only members of the Malware Response Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.

Posted Image

When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.

Posted Image

Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.

2 Pages
1
2
→

You cannot start a new topic
This topic is locked

Gmer and Malwarebytes won't run Don't know what the virus is

#1 Catseye2001

New Member

Group: Members
Posts: 7
Joined: 10-August 11

Posted 10 August 2011 - 03:40 PM

I do know that it's one of the viruses (virii?) that claim to be an antivirus program. I'm in safe mode with networking--when it popped up I shut the computer down and switched in the hopes that I could get back and get rid of it quickly.
When I try to run Malwarebytes Anti-Malware or Gmer, they shut down after a few seconds. I didn't catch what they were scanning when it happened, and now I'm told windows can't access them.
Any help would be appreciated.

This is my dds.txt file:

.
DDS (Ver_2011-06-23.01) - NTFSx86 NETWORK
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_23
Run by Cat at 15:27:32 on 2011-08-10
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.619 [GMT -5:00]
.
AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\1651672650:3044642205.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\Program Files\Mozilla Firefox\plugin-container.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2786678
uURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
BHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [DAEMON Tools] "c:\program files\daemon tools\daemon.exe" -lang 1033
uRun: [Orb] "c:\program files\winamp remote\bin\OrbTray.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Security Protection] c:\documents and settings\all users\application data\defender.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [SkyTel] SkyTel.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [Lexmark 5200 series] "c:\program files\lexmark 5200 series\lxbtbmgr.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [WinampAgent] "c:\program files\winamp\winampa.exe"
mRun: [QuickTime Task] "c:\progra~1\quickt~1\qttask.exe" -atboottime
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [LXBTCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\LXBTtime.dll,_RunDLLEntry@16
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\acroba~1.lnk - c:\program files\adobe\acrobat 5.0\distillr\AcroTray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\shortc~1.lnk - c:\documents and settings\cat\my documents\my pictures\wallpapers\RandomWall.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
LSP: mswsock.dll
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 24.217.0.5 24.217.201.67 68.113.206.10
TCP: Interfaces\{D37132DF-6445-43B1-A4F5-E727A2ABB16B} : DhcpNameServer = 24.217.0.5 24.217.201.67 68.113.206.10
TCP: Interfaces\{FACA95D7-81BB-45E2-9836-E663CFFD2730} : DhcpNameServer = 24.217.0.5 24.217.201.67 68.113.206.10
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\cat\application data\mozilla\firefox\profiles\66i81rov.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?t=1
FF - prefs.js: keyword.URL - hxxp://search.avg.com/?d=4dc973ae&i=23&tp=ab&nt=1&q=
FF - component: c:\documents and settings\cat\application data\mozilla\firefox\profiles\66i81rov.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\components\RadioWMPCoreGecko19.dll
FF - component: c:\documents and settings\cat\application data\mozilla\firefox\profiles\66i81rov.default\extensions\engine@conduit.com\components\RadioWMPCoreGecko19.dll
FF - component: c:\program files\avg\avg10\firefox4\components\avgssff4.dll
FF - component: c:\program files\avg\avg10\firefox4\components\avgssff5.dll
FF - plugin: c:\documents and settings\cat\local settings\application data\robloxversions\version-18c3ec3fed324b69\NPRobloxProxy.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.65\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: e:\program files\mozilla firefox\plugins\NPMGWRAP.DLL
FF - plugin: e:\program files\mozilla firefox\plugins\npwachk.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - e:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - e:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - e:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
FF - Ext: AVG Safe Search: {1E73965B-8B48-48be-9C8D-68B920ABC1C4} - c:\program files\avg\avg10\Firefox4
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Personas: personas@christopher.beard - %profile%\extensions\personas@christopher.beard
FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF - Ext: Rikaichan: {0AA9101C-D3C1-4129-A9B7-D778C6A17F82} - %profile%\extensions\{0AA9101C-D3C1-4129-A9B7-D778C6A17F82}
FF - Ext: Rikaichan Japanese-English Dictionary File: rikaichan-jpen@polarcloud.com - %profile%\extensions\rikaichan-jpen@polarcloud.com
FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com
FF - Ext: uTorrentBar Community Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - %profile%\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
.
---- FIREFOX POLICIES ----
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-2-22 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-3-16 32592]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-4-5 297168]
S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-1-7 248656]
S1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-3-1 34896]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2011-4-18 7398752]
S2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2011-2-8 269520]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-6-27 136176]
S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-4-14 134480]
S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-2-10 24144]
S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-2-10 27216]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2009-12-26 13192]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2009-12-26 8456]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-6-27 136176]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?]
.
=============== Created Last 30 ================
.
2011-08-10 19:48:25 936960 ----a-w- c:\documents and settings\all users\application data\defender.exe
2011-08-09 22:34:28 -------- d-----w- c:\documents and settings\cat\local settings\application data\RobloxVersions
2011-08-09 22:34:28 -------- d-----w- c:\documents and settings\cat\local settings\application data\RobloxDownloads
2011-08-09 22:34:27 -------- d-----w- c:\documents and settings\cat\local settings\application data\Roblox
.
==================== Find3M ====================
.
2011-07-07 00:52:42 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-07 00:52:42 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-24 23:47:18 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
============= FINISH: 15:27:59.78 ===============

Attached File(s)

attach.txt (15.41K)
Number of downloads: 1

#2 Shannon2012

Forum Addict

Group: Malware Response Team
Posts: 3,642
Joined: 31-July 06
Gender:Male
Location:North Carolina, USA

Posted 14 August 2011 - 03:42 PM

Hi,

Welcome to Bleeping Computer.

My name is Shannon and I will be working with you to remove the malware that is on your machine.

I apologize for the delay in replying to your post, but this forum is extremely busy.

Please Track this topic - On the top right on this tread, click on the Watch Topic button, click on 'Immediate Email Notification', and then click on the Proceed button at the bottom.

Do Not make any changes on your own to the infected computer.

Please set your system to show all files.
Click Start, open My Computer, select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.

Now, let's look more thoroughly at the infected computer -

We need to see some information about what is happening in your machine. Please perform the following scan:

OTL Report

Please download OTL from here:
Main Mirror
Save it to your desktop.
Double click on the icon on your desktop.
Click the "Scan All Users" checkbox.
Change the "Extra Registry" option to "Use SafeList"
Push the button.
Two reports will open, copy and paste them into your reply:

OTL.txt <-- Will be opened
Extra.txt <-- Will be minimized

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

Next, please download Rootkit Unhooker from one of the following links and save it to your desktop.

Link 1 (.exe file)

Link 2 (zipped file)

Link 3 (.rar file)

In order to use this tool if you downloaded from either of the second two links, you will need to extract the RKUnhookerLE.exe file using a program capable of extracing ZIP and RAR compressed files. If you don't have an extraction program, you can downlaod, install and use the free 7-zip utility.

Double-click on RKUnhookerLE.exe to start the program.
Click the Report tab, then click Scan.
Check Drivers, Stealth, and uncheck the rest.
Click OK.
Wait until it's finished and then go to File > Save Report.
Save the report to your Desktop.
Copy and paste the contents of the report into your next reply.

-- Note: You may get this warning...just ignore it, click OK and continue: "Rootkit Unhooker has detected a parasite inside itself! It is recommended to remove parasite, okay?".

Once you have the above logs, click on the Add Reply button below, copy in the contents of the two OTL logs and the RKU log. Also include any comments that you might have concerning the infection(s) and the infected computer.

Shannon

#3 Catseye2001

New Member

Group: Members
Posts: 7
Joined: 10-August 11

Posted 15 August 2011 - 11:04 AM

Here are the OTL logs. Rootkit Unhooker says it isn't configured to work in safe mode, but safe mode is the only way I can access the internet without getting blocked by the virus. I can get Rkill to run in safe mode, but not outside of it. Here is the Rkill log, if that helps. I know it wasn't requested, but I hadn't mentioned it before. Once I post these, I'll try to get the Rootkit Unhooker log and post that.
And thanks for your time and your help. I wish it was faster, but I'm not going to complain about waiting--I can't do this on my own and you're a volunteer. Any help you can give in your own time is great.

Edit: Added Rootkit unhooker report.

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 08/15/2011 at 10:41:11.
Operating System: Microsoft Windows XP

Processes terminated by Rkill or while it was running:

C:\Documents and Settings\Cat\Local Settings\Application Data\fwg.exe
C:\Documents and Settings\Cat\Local Settings\Application Data\fwg.exe

--- ATTENTION ---

Windows was configured to use a proxy! Proxy settings have been removed.

The Proxy Server that was configured is:

If this was a valid setting, please double-click on the rk-proxy.reg file on your desktop and allow the data to be merged to restore your proxy settings.

Rkill completed on 08/15/2011 at 10:41:15.

OTL log:

OTL logfile created on: 8/15/2011 10:45:51 AM - Run 1
OTL by OldTimer - Version 3.2.26.4 Folder = C:\Documents and Settings\Cat\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1023.17 Mb Total Physical Memory | 667.52 Mb Available Physical Memory | 65.24% Memory free
2.90 Gb Paging File | 2.63 Gb Available in Paging File | 90.45% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 698.64 Gb Total Space | 558.32 Gb Free Space | 79.92% Space Free | Partition Type: NTFS
Drive E: | 465.76 Gb Total Space | 66.03 Gb Free Space | 14.18% Space Free | Partition Type: NTFS

Computer Name: CAT-D26C684031A | User Name: Cat | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - File not found -- C:\WINDOWS\1651672650:3044642205.exe
PRC - [2011/08/15 10:44:58 | 000,579,584 | ---- | M] () -- C:\Documents and Settings\Cat\My Documents\Downloads\OTL.exe
PRC - [2011/08/15 10:42:52 | 000,709,968 | ---- | M] () -- C:\Documents and Settings\Cat\Local Settings\Temp\is-VCVQ6.tmp\mbam-setup.tmp
PRC - [2011/08/15 10:42:49 | 009,466,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
PRC - [2011/08/15 10:41:57 | 002,424,560 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\f3b568d3-e0d6-40ec-b6c6-495475cef399.com
PRC - [2011/06/24 13:54:47 | 000,912,344 | ---- | M] (Mozilla Corporation) -- E:\Program Files\Mozilla Firefox\firefox.exe

========== Modules (No Company Name) ==========

MOD - [2011/08/15 10:44:58 | 000,579,584 | ---- | M] () -- C:\Documents and Settings\Cat\My Documents\Downloads\OTL.exe
MOD - [2011/08/15 10:42:52 | 000,709,968 | ---- | M] () -- C:\Documents and Settings\Cat\Local Settings\Temp\is-VCVQ6.tmp\mbam-setup.tmp
MOD - [2011/08/12 17:07:54 | 000,063,488 | ---- | M] () -- C:\Documents and Settings\Cat\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
MOD - [2011/08/12 17:07:52 | 000,117,760 | ---- | M] () -- C:\Documents and Settings\Cat\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
MOD - [2011/08/11 09:20:45 | 000,052,224 | ---- | M] () -- C:\Documents and Settings\Cat\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
MOD - [2011/06/24 18:47:18 | 006,271,136 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
MOD - [2011/06/24 13:54:47 | 001,014,744 | ---- | M] () -- E:\Program Files\Mozilla Firefox\js3250.dll
MOD - [2008/06/20 11:02:47 | 000,245,248 | ---- | M] () -- \\?\globalroot\systemroot\system32\mswsock.dll
MOD - [2007/05/05 12:40:34 | 000,128,512 | ---- | M] () -- C:\Program Files\WinRar\RarExt.dll

========== Win32 Services (SafeList) ==========

SRV - [2011/04/19 01:44:40 | 000,993,848 | ---- | M] (Secunia) [Auto | Stopped] -- C:\Program Files\Secunia\PSI\PSIA.exe -- (Secunia PSI Agent)
SRV - [2011/04/18 17:39:42 | 007,398,752 | ---- | M] () [Auto | Stopped] -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2011/02/08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Stopped] -- C:\Program Files\AVG\AVG10\avgwdsvc.exe -- (avgwd)
SRV - [2010/01/15 07:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2004/02/20 16:10:08 | 000,421,888 | ---- | M] (Lexmark International, Inc.) [On_Demand | Stopped] -- C:\WINDOWS\System32\lxbtcoms.exe -- (lxbt_device)

========== Driver Services (SafeList) ==========

DRV - [2011/04/14 21:28:42 | 000,134,480 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV - [2011/04/05 00:59:56 | 000,297,168 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2011/03/16 16:03:20 | 000,032,592 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\avgrkx86.sys -- (Avgrkx86)
DRV - [2011/03/01 14:25:18 | 000,034,896 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Stopped] -- C:\WINDOWS\system32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2011/02/22 08:13:02 | 000,022,992 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys -- (AVGIDSEH)
DRV - [2011/02/10 07:53:54 | 000,027,216 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\AVGIDSShim.sys -- (AVGIDSShim)
DRV - [2011/02/10 07:53:52 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV - [2011/01/07 06:41:46 | 000,248,656 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2010/09/01 03:30:58 | 000,015,544 | ---- | M] (Secunia) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\psi_mf.sys -- (PSI)
DRV - [2010/07/22 06:37:29 | 000,108,480 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AnyDVD.sys -- (AnyDVD)
DRV - [2010/05/10 13:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Stopped] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/03/22 03:30:22 | 000,222,672 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2010/02/17 13:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Stopped] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2009/12/27 12:56:21 | 000,685,816 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Stopped] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2009/09/16 17:55:00 | 000,008,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\EuGdiDrv.sys -- (EuGdiDrv)
DRV - [2009/08/26 13:45:10 | 000,013,192 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\epmntdrv.sys -- (epmntdrv)
DRV - [2006/11/02 20:32:00 | 004,394,496 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006/10/13 03:16:36 | 000,081,664 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Rtnicxp.sys -- (RTL8023xp)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 3C 53 B9 03 1F 6F 2D 43 A9 C3 D3 CF 91 6D 48 98 [binary data]
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 3C 53 B9 03 1F 6F 2D 43 A9 C3 D3 CF 91 6D 48 98 [binary data]
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 3C 53 B9 03 1F 6F 2D 43 A9 C3 D3 CF 91 6D 48 98 [binary data]

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 3C 53 B9 03 1F 6F 2D 43 A9 C3 D3 CF 91 6D 48 98 [binary data]

IE - HKU\S-1-5-21-1960408961-1770027372-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2786678
IE - HKU\S-1-5-21-1960408961-1770027372-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 3C 53 B9 03 1F 6F 2D 43 A9 C3 D3 CF 91 6D 48 98 [binary data]
IE - HKU\S-1-5-21-1960408961-1770027372-839522115-1003\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-1960408961-1770027372-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.defaultthis.engineName: " "
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.google.com/ig?t=1"
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.1
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.6.2
FF - prefs.js..extensions.enabledItems: rikaichan-jpen@polarcloud.com:2.01.110527
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..extensions.enabledItems: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1390
FF - prefs.js..keyword.URL: "http://search.avg.com/?d=4dc973ae&i=23&tp=ab&nt=1&q="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/07/12 09:57:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.18\extensions\\Components: E:\Program Files\Mozilla Firefox\components [2011/07/13 09:20:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.18\extensions\\Plugins: E:\Program Files\Mozilla Firefox\plugins [2011/06/24 13:54:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 2.0.14\extensions\\Components: C:\Program Files\SeaMonkey\components [2011/04/30 14:34:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 2.0.14\extensions\\Plugins: C:\Program Files\SeaMonkey\plugins [2011/05/10 13:10:21 | 000,000,000 | ---D | M]

[2009/11/03 11:04:09 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Cat\Application Data\Mozilla\Extensions
[2009/11/03 11:04:09 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Cat\Application Data\Mozilla\Extensions\{92650c4d-4b8e-4d2a-b7eb-24ecf4f6b63a}
[2011/08/13 18:41:14 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Cat\Application Data\Mozilla\Firefox\Profiles\66i81rov.default\extensions
[2011/06/22 07:29:07 | 000,000,000 | ---D | M] (Rikaichan) -- C:\Documents and Settings\Cat\Application Data\Mozilla\Firefox\Profiles\66i81rov.default\extensions\{0AA9101C-D3C1-4129-A9B7-D778C6A17F82}
[2010/08/25 07:22:14 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Cat\Application Data\Mozilla\Firefox\Profiles\66i81rov.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/06/18 15:16:41 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Documents and Settings\Cat\Application Data\Mozilla\Firefox\Profiles\66i81rov.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011/05/29 18:18:31 | 000,000,000 | ---D | M] (uTorrentBar Community Toolbar) -- C:\Documents and Settings\Cat\Application Data\Mozilla\Firefox\Profiles\66i81rov.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
[2011/05/29 18:18:33 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Documents and Settings\Cat\Application Data\Mozilla\Firefox\Profiles\66i81rov.default\extensions\engine@conduit.com
[2011/05/29 18:18:39 | 000,000,000 | ---D | M] (Personas) -- C:\Documents and Settings\Cat\Application Data\Mozilla\Firefox\Profiles\66i81rov.default\extensions\personas@christopher.beard
[2011/05/29 18:18:34 | 000,000,000 | ---D | M] (Rikaichan Japanese-English Dictionary File) -- C:\Documents and Settings\Cat\Application Data\Mozilla\Firefox\Profiles\66i81rov.default\extensions\rikaichan-jpen@polarcloud.com
[2011/08/13 16:31:02 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Cat\Application Data\Mozilla\SeaMonkey\Profiles\oai95rce.default\extensions
[2010/11/05 07:18:07 | 000,000,000 | ---D | M] (ChatZilla) -- C:\Documents and Settings\Cat\Application Data\Mozilla\SeaMonkey\Profiles\oai95rce.default\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2}
[2010/11/05 07:18:08 | 000,000,000 | ---D | M] (JavaScript Debugger) -- C:\Documents and Settings\Cat\Application Data\Mozilla\SeaMonkey\Profiles\oai95rce.default\extensions\{f13b157f-b174-47e7-a34d-4815ddfdfeb8}
[2010/11/05 07:18:07 | 000,000,000 | ---D | M] (DOM Inspector) -- C:\Documents and Settings\Cat\Application Data\Mozilla\SeaMonkey\Profiles\oai95rce.default\extensions\inspector@mozilla.org
[2010/12/11 21:01:44 | 000,000,863 | ---- | M] () -- C:\Documents and Settings\Cat\Application Data\Mozilla\Firefox\Profiles\66i81rov.default\searchplugins\conduit.xml
[2011/07/12 09:57:37 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG10\FIREFOX4
[2009/11/01 19:39:17 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2009/12/19 18:26:29 | 000,000,000 | ---D | M] (Java Console) -- E:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
[2011/02/11 13:24:39 | 000,000,000 | ---D | M] (Java Console) -- E:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

O1 HOSTS File: ([2003/03/31 07:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-1960408961-1770027372-839522115-1003\..\Toolbar\WebBrowser: (uTorrentBar Toolbar) - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [Lexmark 5200 series] C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe (Lexmark International, Inc.)
O4 - HKLM..\Run: [LXBTCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.DLL (Lexmark International, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKU\S-1-5-21-1960408961-1770027372-839522115-1003..\Run: [4044691556] C:\Documents and Settings\Cat\Local Settings\Application Data\fwg.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1960408961-1770027372-839522115-1003..\Run: [DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe (DT Soft Ltd.)
O4 - HKU\S-1-5-21-1960408961-1770027372-839522115-1003..\Run: [Orb] C:\Program Files\Winamp Remote\bin\OrbTray.exe (Orb Networks)
O4 - HKU\S-1-5-21-1960408961-1770027372-839522115-1003..\Run: [SUPERAntiSpyware] File not found
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe (Adobe Systems Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Secunia PSI Tray.lnk = C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Shortcut to RandomWall.exe.lnk = C:\Documents and Settings\Cat\My Documents\My Pictures\Wallpapers\RandomWall.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1960408961-1770027372-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - File not found
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 24.217.0.5 24.217.201.67 68.113.206.10
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Documents and Settings\Cat\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Cat\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/10/30 13:56:56 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2003/08/17 20:37:16 | 000,000,000 | ---- | M] () - E:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O36 - AppCertDlls: asr_sa64 - (C:\WINDOWS\system32\comsepad.dll) - File not found
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/08/13 20:06:25 | 000,322,048 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\Cat\Local Settings\Application Data\fwg.exe
[2011/08/11 17:08:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cat\Local Settings\Application Data\Secunia PSI
[2011/08/11 17:08:22 | 000,000,000 | ---D | C] -- C:\Program Files\Secunia
[2011/08/11 09:20:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2011/08/11 09:20:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\SUPERAntiSpyware
[2011/08/11 09:07:07 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2011/08/11 08:59:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cat\Application Data\SUPERAntiSpyware.com
[2011/08/11 08:59:43 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2011/08/09 17:34:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cat\Local Settings\Application Data\RobloxVersions
[2011/08/09 17:34:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cat\Local Settings\Application Data\RobloxDownloads
[2011/08/09 17:34:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cat\Local Settings\Application Data\Roblox
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[10 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/08/15 10:41:15 | 000,000,139 | ---- | M] () -- C:\Documents and Settings\Cat\Desktop\rk-proxy.reg
[2011/08/15 10:38:21 | 000,018,222 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\661tg7aypv01gkaaa1g6t566258i8d726alr
[2011/08/15 10:38:20 | 000,018,222 | -HS- | M] () -- C:\Documents and Settings\Cat\Local Settings\Application Data\661tg7aypv01gkaaa1g6t566258i8d726alr
[2011/08/15 10:37:29 | 000,012,598 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/08/15 10:37:18 | 000,000,000 | ---- | M] () -- C:\WINDOWS\1651672650
[2011/08/15 10:37:16 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/08/15 10:35:30 | 000,000,876 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/08/14 21:48:13 | 000,000,880 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/08/14 21:09:53 | 003,932,214 | ---- | M] () -- C:\WINDOWS\System32\Cat_RandomWall.bmp
[2011/08/14 21:09:40 | 000,200,712 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2011/08/13 20:06:25 | 000,322,048 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Cat\Local Settings\Application Data\fwg.exe
[2011/08/11 17:08:25 | 000,000,753 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2011/08/11 09:20:24 | 000,001,678 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/08/11 09:14:28 | 127,668,256 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/08/11 08:52:41 | 000,010,498 | ---- | M] () -- C:\WINDOWS\is-8EGDE.msg
[2011/08/11 08:52:41 | 000,000,419 | ---- | M] () -- C:\WINDOWS\is-8EGDE.lst
[2011/08/10 17:33:45 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/08/09 17:17:22 | 000,052,351 | ---- | M] () -- C:\Documents and Settings\Cat\Desktop\firefoxInstall_preview_v2.jpg
[2011/08/05 08:43:33 | 000,015,434 | ---- | M] () -- C:\Documents and Settings\Cat\Desktop\658194500_2353465625_642053058_1312549395798.jpeg
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[10 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/08/13 20:06:25 | 000,018,222 | -HS- | C] () -- C:\Documents and Settings\Cat\Local Settings\Application Data\661tg7aypv01gkaaa1g6t566258i8d726alr
[2011/08/13 20:06:25 | 000,018,222 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\661tg7aypv01gkaaa1g6t566258i8d726alr
[2011/08/11 17:08:25 | 000,000,753 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2011/08/11 17:08:25 | 000,000,716 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Secunia PSI.lnk
[2011/08/11 16:43:47 | 000,000,139 | ---- | C] () -- C:\Documents and Settings\Cat\Desktop\rk-proxy.reg
[2011/08/11 09:20:24 | 000,001,678 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/08/11 08:52:41 | 000,010,498 | ---- | C] () -- C:\WINDOWS\is-8EGDE.msg
[2011/08/11 08:52:41 | 000,000,419 | ---- | C] () -- C:\WINDOWS\is-8EGDE.lst
[2011/08/10 15:25:52 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/08/10 14:48:11 | 000,000,000 | ---- | C] () -- C:\WINDOWS\1651672650
[2011/08/09 17:17:22 | 000,052,351 | ---- | C] () -- C:\Documents and Settings\Cat\Desktop\firefoxInstall_preview_v2.jpg
[2011/08/05 08:43:32 | 000,015,434 | ---- | C] () -- C:\Documents and Settings\Cat\Desktop\658194500_2353465625_642053058_1312549395798.jpeg
[2011/07/03 14:07:08 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\Cat\Application Data\221E.C56
[2011/05/09 22:59:12 | 000,013,734 | -HS- | C] () -- C:\Documents and Settings\Cat\Local Settings\Application Data\6tr461au6me6ikn4k875r
[2011/05/09 22:59:12 | 000,013,734 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\6tr461au6me6ikn4k875r
[2011/04/01 17:35:33 | 000,015,258 | -HS- | C] () -- C:\Documents and Settings\Cat\Local Settings\Application Data\71nn1fboiyf7847
[2011/04/01 17:35:33 | 000,015,258 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\71nn1fboiyf7847
[2011/01/12 04:06:42 | 000,000,127 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2010/12/20 14:15:43 | 000,012,496 | ---- | C] () -- C:\WINDOWS\System32\SpoonUninstall-dBpoweramp DSP Effects.dat
[2010/12/20 14:15:08 | 000,005,888 | ---- | C] () -- C:\WINDOWS\System32\SpoonUninstall-dBpoweramp CD Writer.dat
[2010/12/20 14:14:33 | 000,002,444 | ---- | C] () -- C:\WINDOWS\System32\SpoonUninstall-dBpoweramp Batch Ripper.dat
[2010/11/03 07:40:32 | 000,080,416 | R--- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll
[2010/10/11 10:26:12 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\Msvcrt10.dll
[2010/10/11 10:26:01 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\adistres.dll
[2010/08/09 20:24:12 | 000,000,085 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\.zreglib
[2010/08/03 07:42:46 | 003,835,624 | ---- | C] () -- C:\WINDOWS\System32\SpoonUninstall.exe
[2010/08/03 07:42:46 | 000,015,607 | ---- | C] () -- C:\WINDOWS\System32\SpoonUninstall-dBpoweramp Music Converter.dat
[2010/01/16 01:22:13 | 000,000,023 | ---- | C] () -- C:\WINDOWS\BlendSettings.ini
[2010/01/01 21:02:19 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009/12/26 20:24:48 | 001,673,216 | ---- | C] () -- C:\WINDOWS\System32\BootMan.exe
[2009/12/26 20:24:48 | 000,086,408 | ---- | C] () -- C:\WINDOWS\System32\setupempdrv03.exe
[2009/12/26 20:24:48 | 000,014,848 | ---- | C] () -- C:\WINDOWS\System32\EuEpmGdi.dll
[2009/12/26 20:24:48 | 000,008,456 | ---- | C] () -- C:\WINDOWS\System32\EuGdiDrv.sys
[2009/12/26 20:24:47 | 000,013,192 | ---- | C] () -- C:\WINDOWS\System32\epmntdrv.sys
[2009/11/23 22:45:38 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\Cat\Local Settings\Application Data\housecall.guid.cache
[2009/11/03 09:38:33 | 000,001,125 | ---- | C] () -- C:\WINDOWS\winamp.ini
[2009/11/01 09:29:35 | 000,057,344 | ---- | C] () -- C:\Documents and Settings\Cat\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/11/01 09:24:53 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxbtvs.dll
[2009/11/01 09:24:52 | 000,294,912 | ---- | C] () -- C:\WINDOWS\System32\lxbtih.exe
[2009/11/01 09:24:52 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\lxbthwdf.dll
[2009/11/01 09:24:52 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\lxbtcoin.dll
[2009/11/01 09:24:52 | 000,126,976 | ---- | C] () -- C:\WINDOWS\System32\lxbtsnls.dll
[2009/11/01 09:24:52 | 000,001,832 | ---- | C] () -- C:\WINDOWS\System32\lxbtprod.ini
[2009/11/01 01:01:40 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2009/10/30 14:41:01 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2009/10/30 13:58:35 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2009/10/30 13:54:32 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2008/09/18 00:55:00 | 001,724,416 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2008/09/18 00:55:00 | 001,657,376 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2008/09/18 00:55:00 | 001,503,232 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2008/09/18 00:55:00 | 001,346,080 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2008/09/18 00:55:00 | 001,101,824 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2008/09/18 00:55:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2008/09/18 00:55:00 | 000,449,056 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2008/09/18 00:55:00 | 000,436,768 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2008/09/18 00:55:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2004/08/04 01:07:22 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/02 14:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2003/03/31 07:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2003/03/31 07:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2003/03/31 07:00:00 | 000,432,686 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2003/03/31 07:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2003/03/31 07:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2003/03/31 07:00:00 | 000,067,516 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2003/03/31 07:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2003/03/31 07:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2003/03/31 07:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2003/03/31 07:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2001/12/31 19:12:34 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2001/12/31 19:11:40 | 000,141,240 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

========== Files - Unicode (All) ==========
[2010/09/24 20:05:38 | 000,040,448 | ---- | M] ()(C:\Documents and Settings\Cat\My Documents\??????? Crisis Core.doc) -- C:\Documents and Settings\Cat\My Documents\クライシスコア Crisis Core.doc
[2010/09/19 02:14:02 | 000,040,448 | ---- | C] ()(C:\Documents and Settings\Cat\My Documents\??????? Crisis Core.doc) -- C:\Documents and Settings\Cat\My Documents\クライシスコア Crisis Core.doc

========== Alternate Data Streams ==========

@Alternate Data Stream - 816 bytes -> C:\WINDOWS\1651672650:3044642205.exe

< End of report >

Extras:

OTL Extras logfile created on: 8/15/2011 10:45:51 AM - Run 1
OTL by OldTimer - Version 3.2.26.4 Folder = C:\Documents and Settings\Cat\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1023.17 Mb Total Physical Memory | 667.52 Mb Available Physical Memory | 65.24% Memory free
2.90 Gb Paging File | 2.63 Gb Available in Paging File | 90.45% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 698.64 Gb Total Space | 558.32 Gb Free Space | 79.92% Space Free | Partition Type: NTFS
Drive E: | 465.76 Gb Total Space | 66.03 Gb Free Space | 14.18% Space Free | Partition Type: NTFS

Computer Name: CAT-D26C684031A | User Name: Cat | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_USERS\S-1-5-21-1960408961-1770027372-839522115-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- E:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\Winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\Winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\Winamp.exe" "%1" (Nullsoft, Inc.)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 1
"FirewallOverride" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Avira\AntiVir Desktop\avcenter.exe" = C:\Program Files\Avira\AntiVir Desktop\avcenter.exe:*:Enabled:Start AntiVir
"C:\Program Files\Avira\AntiVir Desktop\update.exe" = C:\Program Files\Avira\AntiVir Desktop\update.exe:*:Enabled:update
"C:\WINDOWS\system32\usmt\migwiz.exe" = C:\WINDOWS\system32\usmt\migwiz.exe:*:Enabled:Files and Settings Transfer Wizard -- (Microsoft Corporation)
"E:\Program Files\uTorrent\uTorrent.exe" = E:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Program Files\Winamp Remote\bin\Orb.exe" = C:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb -- (Orb Networks, Inc.)
"C:\Program Files\Winamp Remote\bin\OrbTray.exe" = C:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray -- (Orb Networks)
"C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe" = C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client -- (Orb Networks)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{16D919E6-F019-4E15-BFBE-4A85EF19DA57}" = Oblivion - Spell Tomes
"{1E99F5D7-4262-4C7C-9135-F066E7485811}" = System Requirements Lab
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java™ 6 Update 23
"{2BC21CD2-8053-406A-80F6-9AB61717B49D}" = ODF Add-in for Microsoft Office
"{2F2E3D62-8B8C-448F-8900-451325E50948}" = Oblivion - Wizard's Tower
"{332B1B33-D0EE-4A0A-AB2F-12BF56BCE1C3}" = FaceGen Modeller 3.1
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35CB6715-41F8-4F99-8881-6FC75BF054B0}" = Oblivion
"{3ABEBD00-299D-4DCA-967F-B912163AB5EA}" = Oblivion - Horse Armor Pack
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{520F4B09-3A51-47A2-82B0-9FF1DC2D20FA}" = Oblivion - Vile Lair
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{695B13B2-7919-4EC5-8601-092F0D2DE069}" = AVG 2011
"{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com
"{7C4196CA-CA41-4F34-9C08-7724E7705D52}" = Jasc Animation Shop 3
"{80490945-CE48-45CF-9CCA-CA0EF44D9FE4}" = AVG 2011
"{81A34902-9D0B-4920-A25C-4CDC5D14B328}" = Jasc Paint Shop Pro 8
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver
"{8B7917E0-AF55-4E8A-9473-017F0AA03AC8}" = QuickTime
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9F6CFB0-806D-11E0-8EA1-B8AC6F97B88E}" = Google Earth Plug-in
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.4
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{EC425CFC-EE78-4A91-AA25-3BFA65B75364}" = Oblivion - Orrery
"{EF295F5C-7B57-47AA-8889-6B3E8E214E89}" = Oblivion - Mehrunes Razor
"{F004C3DF-05BA-48AA-98E4-22A7F686AD1F}" = ™é‹ç‚ÌŒŒ
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F843C6A3-224D-4615-94F8-3C461BD9AEA0}" = Jasc Paint Shop Pro 9
"{FFFFFD17-B460-41EB-93F1-C48ABAD63828}" = Oblivion - Thieves Den
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AnyDVD" = AnyDVD
"AVG" = AVG 2011
"CloneDVD2" = CloneDVD2
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"conduitEngine" = Conduit Engine
"dBpoweramp Batch Ripper" = dBpoweramp Batch Ripper
"dBpoweramp CD Writer" = dBpoweramp CD Writer
"dBpoweramp DSP Effects" = dBpoweramp DSP Effects
"dBpoweramp Music Converter" = dBpoweramp Music Converter
"EASEUS Partition Master Home Edition_is1" = EASEUS Partition Master 4.1.1 Home Edition
"Free WMA to MP3 Converter_is1" = Free WMA to MP3 Converter 1.16
"Hard Disk Low Level Format Tool_is1" = Hard Disk Low Level Format Tool 2.36 build 1181
"ie8" = Windows Internet Explorer 8
"JAIELangPack" = Japanese Language Support
"Lexmark 5200 Series" = Lexmark 5200 Series
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.18)" = Mozilla Firefox (3.6.18)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NVIDIA Drivers" = NVIDIA Drivers
"Orb" = Winamp Remote
"PSP Grader" = PSP Grader v006 - Lite
"SeaMonkey (2.0.14)" = SeaMonkey (2.0.14)
"uTorrentBar Toolbar" = uTorrentBar Toolbar
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1960408961-1770027372-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Winamp Detect" = Winamp Detector Plug-in

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 4/27/2011 10:52:39 AM | Computer Name = CAT-D26C684031A | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 5.1.2600.5512, faulting
module wiaservc.dll, version 5.1.2600.5512, fault address 0x000223dd.

Error - 5/19/2011 12:54:19 AM | Computer Name = CAT-D26C684031A | Source = Application Hang | ID = 1002
Description = Hanging application AcroRd32.exe, version 9.4.2.220, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 5/19/2011 12:54:19 AM | Computer Name = CAT-D26C684031A | Source = Application Hang | ID = 1002
Description = Hanging application AcroRd32.exe, version 9.4.2.220, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 5/19/2011 9:08:22 AM | Computer Name = CAT-D26C684031A | Source = Application Hang | ID = 1001
Description = Fault bucket -1992304100.

Error - 6/12/2011 2:02:50 PM | Computer Name = CAT-D26C684031A | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.2.4127, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 8/11/2011 6:29:27 PM | Computer Name = CAT-D26C684031A | Source = MsiInstaller | ID = 1008
Description = The installation of C:\Documents and Settings\Cat\My Documents\Downloads\HiJackThis.msi
is not permitted due to an error in software restriction policy processing. The
object cannot be trusted.

Error - 8/13/2011 9:06:29 PM | Computer Name = CAT-D26C684031A | Source = Application Error | ID = 1000
Description = Faulting application plugin-container.exe, version 1.9.2.4182, faulting
module ntdll.dll, version 5.1.2600.6055, fault address 0x0000100b.

[ Application Events ]
Error - 4/27/2011 10:52:39 AM | Computer Name = CAT-D26C684031A | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 5.1.2600.5512, faulting
module wiaservc.dll, version 5.1.2600.5512, fault address 0x000223dd.

Error - 5/19/2011 12:54:19 AM | Computer Name = CAT-D26C684031A | Source = Application Hang | ID = 1002
Description = Hanging application AcroRd32.exe, version 9.4.2.220, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 5/19/2011 12:54:19 AM | Computer Name = CAT-D26C684031A | Source = Application Hang | ID = 1002
Description = Hanging application AcroRd32.exe, version 9.4.2.220, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 5/19/2011 9:08:22 AM | Computer Name = CAT-D26C684031A | Source = Application Hang | ID = 1001
Description = Fault bucket -1992304100.

Error - 6/12/2011 2:02:50 PM | Computer Name = CAT-D26C684031A | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.2.4127, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 8/11/2011 6:29:27 PM | Computer Name = CAT-D26C684031A | Source = MsiInstaller | ID = 1008
Description = The installation of C:\Documents and Settings\Cat\My Documents\Downloads\HiJackThis.msi
is not permitted due to an error in software restriction policy processing. The
object cannot be trusted.

Error - 8/13/2011 9:06:29 PM | Computer Name = CAT-D26C684031A | Source = Application Error | ID = 1000
Description = Faulting application plugin-container.exe, version 1.9.2.4182, faulting
module ntdll.dll, version 5.1.2600.6055, fault address 0x0000100b.

[ System Events ]
Error - 8/14/2011 10:09:27 PM | Computer Name = CAT-D26C684031A | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 8/14/2011 10:09:48 PM | Computer Name = CAT-D26C684031A | Source = Service Control Manager | ID = 7031
Description = The Print Spooler service terminated unexpectedly. It has done this
1 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 8/14/2011 10:12:40 PM | Computer Name = CAT-D26C684031A | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 8/14/2011 10:12:52 PM | Computer Name = CAT-D26C684031A | Source = Service Control Manager | ID = 7031
Description = The Print Spooler service terminated unexpectedly. It has done this
2 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 8/14/2011 10:15:55 PM | Computer Name = CAT-D26C684031A | Source = Service Control Manager | ID = 7034
Description = The Print Spooler service terminated unexpectedly. It has done this
3 time(s).

Error - 8/14/2011 10:16:38 PM | Computer Name = CAT-D26C684031A | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 8/14/2011 10:17:58 PM | Computer Name = CAT-D26C684031A | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 8/15/2011 11:37:33 AM | Computer Name = CAT-D26C684031A | Source = sptd | ID = 262148
Description = Driver detected an internal error in its data structures for .

Error - 8/15/2011 11:37:47 AM | Computer Name = CAT-D26C684031A | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 8/15/2011 11:38:59 AM | Computer Name = CAT-D26C684031A | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Avgldx86 Avgmfx86 ElbyCDIO Fips intelppm SASDIFSV SASKUTIL sptd

< End of report >

Rootkit Unhooker Report:

RkU Version: 3.8.389.593, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Service Pack 3)
Number of processors #2
==============================================
>Drivers
==============================================
0xF6E76000 C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 6135808 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Miniport Driver, Version 178.13 )
0xBF012000 C:\WINDOWS\System32\nv4_disp.dll 6057984 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Display driver, Version 178.13 )
0xF464C000 C:\WINDOWS\system32\drivers\RtkHDAud.sys 4554752 bytes (Realtek Semiconductor Corp., Realtek® High Definition Audio Function Driver)
0x804D7000 C:\WINDOWS\system32\ntoskrnl.exe 2265088 bytes (Microsoft Corporation, NT Kernel & System)
0x804D7000 PnpManager 2265088 bytes
0x804D7000 RAW 2265088 bytes
0x804D7000 WMIxWDM 2265088 bytes
0xBF800000 Win32k 1859584 bytes
0xBF800000 C:\WINDOWS\System32\win32k.sys 1859584 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0xF76A4000 PCI_NTPNP8728 958464 bytes
0xF76A4000 sptd.sys 958464 bytes
0xF7507000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
0xF4336000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0xF6D2A000 C:\WINDOWS\System32\Drivers\avyq20ub.SYS 421888 bytes
0xF6C4C000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
0xF44AC000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
0xBA31B000 C:\WINDOWS\system32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)
0xBF5D9000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
0xF443D000 C:\WINDOWS\system32\DRIVERS\avgtdix.sys 290816 bytes
0xB9CB5000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
0xF4232000 C:\WINDOWS\system32\DRIVERS\avgldx86.sys 245760 bytes (AVG Technologies CZ, s.r.o., AVG AVI Loader Driver)
0xF6E05000 C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys 217088 bytes (Realtek Semiconductor Corporation , Realtek 10/100/1000 NDIS 5.1 Driver )
0xF6CAA000 C:\WINDOWS\system32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector)
0xF765E000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
0xBA463000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0xF74DA000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
0xF43A6000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0xF6E3A000 C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 163840 bytes (Windows ® Server 2003 DDK provider, High Definition Audio Bus Driver v1.0a)
0xF4415000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
0xF7608000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, NT Disk Manager I/O Driver)
0xF4628000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0xF6DE1000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0xF6D91000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
0xF43F3000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0xF43D1000 C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS 139264 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASKUTIL.SYS)
0x80700000 ACPI_HAL 134400 bytes
0x80700000 C:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0xBA283000 C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys 131072 bytes (AVG Technologies CZ, s.r.o. , IDS Application Activity Monitor Driver.)
0xF75D0000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0xF762E000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
0xF74C0000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0xF6DB4000 C:\WINDOWS\System32\Drivers\AnyDVD.sys 102400 bytes (SlySoft, Inc., AnyDVD Filter Driver)
0xF75F0000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
0xF41CA000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes
0xF768C000 C:\WINDOWS\System32\Drivers\SCSIPORT.SYS 98304 bytes (Microsoft Corporation, SCSI Port Driver)
0xF75A7000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xF6CEB000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xBA26E000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
0xF6DCD000 C:\WINDOWS\system32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)
0xF6E62000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
0xF4505000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
0xF7594000 WudfPf.sys 77824 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver)
0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
0xF75BE000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
0xF764D000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0xF6CDA000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
0xF45C8000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
0xF786F000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0xF783F000 C:\WINDOWS\system32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)
0xF78EF000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0xF787F000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)
0xBA3B3000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
0xF78FF000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
0xF77EF000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
0xF784F000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)
0xF788F000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0xF77CF000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0xF790F000 C:\WINDOWS\system32\DRIVERS\avgmfx86.sys 49152 bytes (AVG Technologies CZ, s.r.o., AVG Resident Shield Minifilter Driver)
0xF78AF000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0xF45F8000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)
0xF785F000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)
0xF77BF000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
0xF789F000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0xF77AF000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)
0xF78DF000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
0xF77FF000 PxHelp20.sys 40960 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)
0xF78CF000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
!!!!!!!!!!!Hidden driver: 0xF7A0F000 4156334376 36864 bytes
0xB9FD6000 C:\WINDOWS\System32\Drivers\BlackBox.SYS 36864 bytes (RKU Driver)
0xF77DF000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
0xF4618000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)
0xF782F000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)
0xF78BF000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
0xF4608000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
0xF792F000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0xF7A7F000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
0xF7AEF000 C:\WINDOWS\system32\DRIVERS\usbccgp.sys 32768 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)
0xF7A97000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0xF7A3F000 avgrkx86.sys 28672 bytes (AVG Technologies CZ, s.r.o., AVG Anti-Rootkit Driver)
0xF7B9F000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0xF7A2F000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0xF7B47000 C:\WINDOWS\system32\DRIVERS\usbprint.sys 28672 bytes (Microsoft Corporation, USB Printer driver)
0xF7AA7000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
0xF7AAF000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
0xF7B57000 C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS 24576 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASDIFSV.SYS)
0xF7A8F000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0xF7BA7000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0xF7AC7000 C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys 20480 bytes (AVG Technologies CZ, s.r.o. , IDS Application Activity Monitor Filter Driver.)
0xF7B5F000 C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys 20480 bytes (AVG Technologies CZ, s.r.o. , IDS Application Activity Monitor Loader Driver.)
0xF7B7F000 C:\WINDOWS\System32\Drivers\ElbyCDIO.sys 20480 bytes (Elaborate Bytes AG, ElbyCD Windows NT/2000/XP I/O driver)
0xF7BB7000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
0xF7A37000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
0xF7B3F000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
0xF7B4F000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver)
0xF7B2F000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
0xF7ABF000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
0xF7BC3000 AVGIDSEH.Sys 16384 bytes (AVG Technologies CZ, s.r.o. , IDS Application Activity Monitor Helper Driver.)
0xF7450000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
0xBA6EC000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
0xF7C87000 C:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)
0xF4578000 C:\WINDOWS\system32\DRIVERS\usbscan.sys 16384 bytes (Microsoft Corporation, USB Scanner Driver)
0xF7BBF000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
0xF4276000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
0xF4570000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
0xF7474000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0xF6C38000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xF7CD1000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
0xF7CB3000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver)
0xF7CE5000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes
0xF7CCD000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
0xF7CAF000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0xF7CD5000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
0xF7D31000 C:\WINDOWS\System32\Drivers\ParVdm.SYS 8192 bytes (Microsoft Corporation, VDM Parallel Driver)
0xF7CD9000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
0xF7CC3000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0xF7CC9000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0xF7CB1000 C:\WINDOWS\System32\Drivers\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0xF7DB2000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
0xF7D90000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
0xF7E90000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
0xF7D77000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
0x873D01E8 unknown_irp_handler 3608 bytes
0x872D11E8 unknown_irp_handler 3608 bytes
0x873601E8 unknown_irp_handler 3608 bytes
0x873D21E8 unknown_irp_handler 3608 bytes
0x872B7460 unknown_irp_handler 2976 bytes
0x87315790 unknown_irp_handler 2160 bytes
0x872D0790 unknown_irp_handler 2160 bytes
0x869AF790 unknown_irp_handler 2160 bytes
0x869A0790 unknown_irp_handler 2160 bytes
0x86910790 unknown_irp_handler 2160 bytes
!!!!!!!!!!!Hidden driver: 0xF79259D0 00000581 1584 bytes
0xF79259D0 unknown_irp_handler 1584 bytes
==============================================
>Stealth
==============================================
WARNING: File locked for read access [C:\WINDOWS\system32\drivers\avgtdix.sys]
0xF7A13D20 Unknown thread object [ ETHREAD 0x8699D388 ] TID: 672, 600 bytes
0xF7A13D20 Unknown thread object [ ETHREAD 0x8699C020 ] TID: 676, 600 bytes
0xF7927105 Unknown thread object [ ETHREAD 0x8699CDA8 ] TID: 680, 600 bytes
0xF7927105 Unknown thread object [ ETHREAD 0x8699CB30 ] TID: 684, 600 bytes
WARNING: File locked for read access [C:\WINDOWS\system32\drivers\sptd.sys]

This post has been edited by Catseye2001: 15 August 2011 - 11:25 AM

#4 Shannon2012

Forum Addict

Group: Malware Response Team
Posts: 3,642
Joined: 31-July 06
Gender:Male
Location:North Carolina, USA

Posted 15 August 2011 - 01:40 PM

Hi-

Thanks for the logs. Need another look at what I think is the main problem.

Please download aswMBR ( 511KB ) to your desktop.

Double click the aswMBR.exe icon to run it
If the AV Scan window appears, select (none).
Click Scan (if asked to update the Avast anti-virus definitions, click on No).
When you get the "Scan finished successfully" message, click the save log button, save it to your desktop (MBR.txt) and post it in your next reply.
It will also copy the MBR (Master Boot Record) into a file on your desktop as MBR.dat.

Shannon

#5 Catseye2001

New Member

Group: Members
Posts: 7
Joined: 10-August 11

Posted 17 August 2011 - 08:02 AM

Shannon, I tried to run this, but like Gmer and Malwarebytes, it ran for a few seconds, then shut off. No report was generated, so I have nothing to post.
I had run rkill prior to going online, as I cannot get online without doing so. Here is the rkill report this time, in case it helps.

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 08/17/2011 at 7:35:24.
Operating System: Microsoft Windows XP

Processes terminated by Rkill or while it was running:

C:\Documents and Settings\Cat\Local Settings\Application Data\fwg.exe
C:\Documents and Settings\Cat\Local Settings\Application Data\fwg.exe
C:\Documents and Settings\Cat\Local Settings\Application Data\fwg.exe

Rkill completed on 08/17/2011 at 7:35:31.

#6 Shannon2012

Forum Addict

Group: Malware Response Team
Posts: 3,642
Joined: 31-July 06
Gender:Male
Location:North Carolina, USA

Posted 17 August 2011 - 11:43 AM

Did you run rkill prior to running Malwarebytes and aswMBR?

Did you try them in safe mode?

This post has been edited by Shannon2012: 17 August 2011 - 12:10 PM

Shannon

#7 Catseye2001

New Member

Group: Members
Posts: 7
Joined: 10-August 11

Posted 18 August 2011 - 08:32 PM

Yes to both of those. I ran rkill first thing when I logged into windows, then again just before starting any of the virus scans. I have tried everything in regular mode and safe mode. Also, when loading into safe mode, an option pops up at the bottom telling me to press Esc to stop loading sptd.sys, and I have hit Esc at that point, then run Rkill and tried the virus scans. None of these efforts will let a virus scan run.

Once I run Rkill, the only signs that I have a virus are constant search redirects online and the inability to run a virus program. Before I run rkill, I get constant faux virus scan popups and I can't run executables without having them shut down because they supposedly have a worm (blaster, I think).

#8 Shannon2012

Forum Addict

Group: Malware Response Team
Posts: 3,642
Joined: 31-July 06
Gender:Male
Location:North Carolina, USA

Posted 19 August 2011 - 02:32 PM

Hi-

Let's see if we can help the situation a bit.

We need to run an OTL Fix.

Please reopen on your desktop.
Copy and Paste the following code into the textbox.

:Files
c:\documents and settings\all users\application data\defender.exe
:OTL
PRC - File not found -- C:\WINDOWS\1651672650:3044642205.exe
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 3C 53 B9 03 1F 6F 2D 43 A9 C3 D3 CF 91 6D 48 98 [binary data]
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 3C 53 B9 03 1F 6F 2D 43 A9 C3 D3 CF 91 6D 48 98 [binary data]
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 3C 53 B9 03 1F 6F 2D 43 A9 C3 D3 CF 91 6D 48 98 [binary data]
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 3C 53 B9 03 1F 6F 2D 43 A9 C3 D3 CF 91 6D 48 98 [binary data]
IE - HKU\S-1-5-21-1960408961-1770027372-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 3C 53 B9 03 1F 6F 2D 43 A9 C3 D3 CF 91 6D 48 98 [binary data] 
O4 - HKU\S-1-5-21-1960408961-1770027372-839522115-1003..\Run: [SUPERAntiSpyware] File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - File not found
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O36 - AppCertDlls: asr_sa64 - (C:\WINDOWS\system32\comsepad.dll) - File not found
O32 - AutoRun File - [2009/10/30 13:56:56 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2003/08/17 20:37:16 | 000,000,000 | ---- | M] () - E:\AUTOEXEC.BAT -- [ NTFS ]
O4 - HKU\S-1-5-21-1960408961-1770027372-839522115-1003..\Run: [4044691556] C:\Documents and Settings\Cat\Local Settings\Application Data\fwg.exe (Microsoft Corporation)
[2011/08/13 20:06:25 | 000,322,048 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\Cat\Local Settings\Application Data\fwg.exe

Push
OTL may ask to reboot the machine. Please do so if asked.
Click .
A report will open. Copy and Paste that report in your next reply.
If you have to reboot, once back up, open the C:\_OTL\MovedFiles folder and copy the newest log into your next reply.

Rerun Rkill.

Now, let's see if aswMBR will run.

Re-Run aswMBR

In the AV Scan window, select (none).
Click Scan (if asked to update the Avast anti-virus definitions, click on No.)
When you get the "Scan finished successfully" message, click the FIX or the FixMBR button, whichever is lit.
There is a slight pause after clicking either the 'Fix' or 'FixMBR' button.
Wait for the tool to report 'Infection fixed successfully', now reboot the machine.
Rebooting the machine prematurely, before seeing above message will result in an incomplete fix.

Note:After the 'Infection fixed successfully' message appears, the machine may became unresponsive. You may have to do a hard boot of your machine. That may be a side effect from the fix. All will be well after the reboot.
Save the log and post in your next reply.

In your reply, copy in the RKill, the OTL Fix, and the aswMBR reports.

Shannon

#9 Shannon2012

Forum Addict

Group: Malware Response Team
Posts: 3,642
Joined: 31-July 06
Gender:Male
Location:North Carolina, USA

Posted 24 August 2011 - 11:08 AM

Hi-

Are you still in need of help?

Shannon

#10 Catseye2001

New Member

Group: Members
Posts: 7
Joined: 10-August 11

Posted 26 August 2011 - 07:40 AM

I am still in need of help. First thing I had to do, though, was get my kids off the computer and move it--they downloaded something called Halo.exe--I don't know what it is, but they've been told not to download anything.
The OTL fix you posted didn't run--it said it was running "PRC - File not found -- C:\WINDOWS\1651672650:3044642205.exe" at the bottom, but after a minute or so, it stopped responding. Should I run new reports in case anything my kids did changed something?
Thanks for all of your help with this. It's very frustrating to me--I had a policy of not letting my kids on the computer, but the school sends them home with homework that says "look this up on the internet," "type this in the Wingdings font," "print out a picture of that." I can't afford another computer for them, and I kind of resent that the school gets to decide who uses mine.

Cat

#11 Shannon2012

Forum Addict

Group: Malware Response Team
Posts: 3,642
Joined: 31-July 06
Gender:Male
Location:North Carolina, USA

Posted 26 August 2011 - 09:22 AM

Hi-

Let's get a fresh report from OTL. Run Rkill if you need to.

Double click on the icon on your desktop.
In the Extra Registry Box, check None
Click the "Scan All Users" checkbox.
Push the button.
A report will open, copy and paste it into your reply:
OTL.txt <-- Will be the opened report

Try this - Please download MBRCheck by clicking here and save it to your desktop.

Be sure to disable your security programs.
Double click on the file to run it.
A window will open on your desktop.
If an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
If nothing unusual is found just press Enter.
A .txt file named MBRCheck_mm.dd.yy_hh.mm.txt should appear on your desktop.
Please post the contents of that file in your next reply.

In your reply, please copy in the two reports from above.

Shannon

#12 Catseye2001

New Member

Group: Members
Posts: 7
Joined: 10-August 11

Posted 26 August 2011 - 05:49 PM

I don't know whether it matters or not--files I download save automatically in my "downloaded" folder, and I've been running them from there, not moving them to the desktop.

Okay, here are the new reports:

OTL logfile created on: 8/26/2011 2:57:15 PM - Run 1
OTL by OldTimer - Version 3.2.26.4 Folder = C:\Documents and Settings\Cat\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1023.17 Mb Total Physical Memory | 389.82 Mb Available Physical Memory | 38.10% Memory free
2.90 Gb Paging File | 2.27 Gb Available in Paging File | 78.18% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 698.64 Gb Total Space | 558.11 Gb Free Space | 79.89% Space Free | Partition Type: NTFS
Drive E: | 465.76 Gb Total Space | 65.92 Gb Free Space | 14.15% Space Free | Partition Type: NTFS

Computer Name: CAT-D26C684031A | User Name: Cat | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - File not found -- C:\WINDOWS\1651672650:3044642205.exe
PRC - [2011/08/18 07:29:20 | 000,912,344 | ---- | M] (Mozilla Corporation) -- E:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011/08/15 10:44:58 | 000,579,584 | ---- | M] () -- C:\Documents and Settings\Cat\My Documents\Downloads\OTL.exe
PRC - [2011/06/30 13:30:10 | 001,595,520 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\Winamp\winamp.exe
PRC - [2011/06/30 13:29:06 | 000,074,752 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\Winamp\winampa.exe
PRC - [2011/04/19 01:44:40 | 000,291,896 | ---- | M] (Secunia) -- C:\Program Files\Secunia\PSI\psi_tray.exe
PRC - [2011/04/18 17:40:08 | 002,334,560 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgtray.exe
PRC - [2011/03/16 16:05:14 | 000,656,736 | ---- | M] () -- C:\Program Files\AVG\AVG10\avgchsvx.exe
PRC - [2011/02/10 07:55:18 | 001,148,256 | ---- | M] () -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
PRC - [2011/02/08 05:33:20 | 000,658,784 | ---- | M] () -- C:\Program Files\AVG\AVG10\avgrsx.exe
PRC - [2010/01/15 07:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2008/03/31 20:54:06 | 000,507,904 | ---- | M] (Orb Networks) -- C:\Program Files\Winamp Remote\bin\OrbTray.exe
PRC - [2008/01/29 21:19:32 | 000,073,728 | ---- | M] (Orb Networks, Inc.) -- C:\Program Files\Winamp Remote\bin\Orb.exe
PRC - [2007/08/16 06:24:39 | 000,167,368 | ---- | M] (DT Soft Ltd.) -- C:\Program Files\DAEMON Tools\daemon.exe
PRC - [2004/06/04 07:14:40 | 000,094,208 | ---- | M] (Lexmark International, Inc.) -- C:\Program Files\Lexmark 5200 Series\lxbtbmon.exe
PRC - [2004/06/04 06:58:22 | 000,057,344 | ---- | M] (Lexmark International, Inc.) -- C:\Program Files\Lexmark 5200 Series\lxbtbmgr.exe
PRC - [2001/03/15 05:18:18 | 000,049,254 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe

========== Modules (No Company Name) ==========

MOD - [2011/08/18 07:29:21 | 001,000,920 | ---- | M] () -- E:\Program Files\Mozilla Firefox\js3250.dll
MOD - [2011/08/15 10:44:58 | 000,579,584 | ---- | M] () -- C:\Documents and Settings\Cat\My Documents\Downloads\OTL.exe
MOD - [2011/07/08 11:23:40 | 000,623,616 | ---- | M] () -- C:\Program Files\Winamp\System\jnetlib.w5s
MOD - [2011/07/08 11:23:40 | 000,174,080 | ---- | M] () -- C:\Program Files\Winamp\System\auth.w5s
MOD - [2011/07/08 11:23:40 | 000,154,624 | ---- | M] () -- C:\Program Files\Winamp\System\jpeg.w5s
MOD - [2011/07/08 11:23:40 | 000,103,936 | ---- | M] () -- C:\Program Files\Winamp\System\png.w5s
MOD - [2011/07/08 11:23:40 | 000,090,112 | ---- | M] () -- C:\Program Files\Winamp\System\xml.w5s
MOD - [2011/07/08 11:23:40 | 000,084,480 | ---- | M] () -- C:\Program Files\Winamp\System\playlist.w5s
MOD - [2011/07/08 11:23:40 | 000,083,968 | ---- | M] () -- C:\Program Files\Winamp\tataki.dll
MOD - [2011/07/08 11:23:40 | 000,047,616 | ---- | M] () -- C:\Program Files\Winamp\zlib.dll
MOD - [2011/07/08 11:23:40 | 000,044,544 | ---- | M] () -- C:\Program Files\Winamp\System\devices.w5s
MOD - [2011/07/08 11:23:40 | 000,035,328 | ---- | M] () -- C:\Program Files\Winamp\System\timer.w5s
MOD - [2011/07/08 11:23:40 | 000,023,040 | ---- | M] () -- C:\Program Files\Winamp\System\albumart.w5s
MOD - [2011/07/08 11:23:40 | 000,021,504 | ---- | M] () -- C:\Program Files\Winamp\System\tagz.w5s
MOD - [2011/07/08 11:23:40 | 000,019,456 | ---- | M] () -- C:\Program Files\Winamp\System\gif.w5s
MOD - [2011/07/08 11:23:40 | 000,019,456 | ---- | M] () -- C:\Program Files\Winamp\System\bmp.w5s
MOD - [2011/07/08 11:23:40 | 000,016,896 | ---- | M] () -- C:\Program Files\Winamp\System\dlmgr.w5s
MOD - [2011/07/08 11:23:40 | 000,016,384 | ---- | M] () -- C:\Program Files\Winamp\System\gracenote.w5s
MOD - [2011/07/08 11:23:40 | 000,014,336 | ---- | M] () -- C:\Program Files\Winamp\System\filereader.w5s
MOD - [2011/07/08 11:23:40 | 000,013,824 | ---- | M] () -- C:\Program Files\Winamp\System\primo.w5s
MOD - [2011/07/08 11:23:38 | 000,170,496 | ---- | M] () -- C:\Program Files\Winamp\Plugins\pmp_ipod.dll
MOD - [2011/07/08 11:23:38 | 000,118,272 | ---- | M] () -- C:\Program Files\Winamp\Plugins\pmp_p4s.dll
MOD - [2011/07/08 11:23:38 | 000,113,152 | ---- | M] () -- C:\Program Files\Winamp\Plugins\pmp_wifi.dll
MOD - [2011/07/08 11:23:38 | 000,060,928 | ---- | M] () -- C:\Program Files\Winamp\Plugins\pmp_android.dll
MOD - [2011/07/08 11:23:38 | 000,053,760 | ---- | M] () -- C:\Program Files\Winamp\Plugins\pmp_usb.dll
MOD - [2011/07/08 11:23:38 | 000,020,480 | ---- | M] () -- C:\Program Files\Winamp\Plugins\pmp_njb.dll
MOD - [2011/07/08 11:23:37 | 000,052,224 | ---- | M] () -- C:\Program Files\Winamp\Plugins\out_ds.dll
MOD - [2011/07/08 11:23:37 | 000,022,528 | ---- | M] () -- C:\Program Files\Winamp\Plugins\out_disk.dll
MOD - [2011/07/08 11:23:37 | 000,018,432 | ---- | M] () -- C:\Program Files\Winamp\Plugins\out_wave.dll
MOD - [2011/07/08 11:23:36 | 000,241,152 | ---- | M] () -- C:\Program Files\Winamp\Plugins\ml_pmp.dll
MOD - [2011/07/08 11:23:36 | 000,125,440 | ---- | M] () -- C:\Program Files\Winamp\Plugins\ml_online.dll
MOD - [2011/07/08 11:23:36 | 000,083,456 | ---- | M] () -- C:\Program Files\Winamp\Plugins\ml_plg.dll
MOD - [2011/07/08 11:23:36 | 000,082,944 | ---- | M] () -- C:\Program Files\Winamp\Plugins\ml_playlists.dll
MOD - [2011/07/08 11:23:36 | 000,033,792 | ---- | M] () -- C:\Program Files\Winamp\Plugins\ml_rg.dll
MOD - [2011/07/08 11:23:36 | 000,031,744 | ---- | M] () -- C:\Program Files\Winamp\Plugins\ml_transcode.dll
MOD - [2011/07/08 11:23:35 | 000,293,376 | ---- | M] () -- C:\Program Files\Winamp\Plugins\ml_local.dll
MOD - [2011/07/08 11:23:35 | 000,250,368 | ---- | M] () -- C:\Program Files\Winamp\Plugins\ml_devices.dll
MOD - [2011/07/08 11:23:35 | 000,200,704 | ---- | M] () -- C:\Program Files\Winamp\Plugins\ml_disc.dll
MOD - [2011/07/08 11:23:35 | 000,057,344 | ---- | M] () -- C:\Program Files\Winamp\Plugins\ml_impex.dll
MOD - [2011/07/08 11:23:35 | 000,052,224 | ---- | M] () -- C:\Program Files\Winamp\Plugins\ml_history.dll
MOD - [2011/07/08 11:23:34 | 000,028,672 | ---- | M] () -- C:\Program Files\Winamp\Plugins\ml_autotag.dll
MOD - [2011/07/08 11:23:34 | 000,027,648 | ---- | M] () -- C:\Program Files\Winamp\Plugins\ml_bookmarks.dll
MOD - [2011/07/08 11:23:33 | 000,313,344 | ---- | M] () -- C:\Program Files\Winamp\Plugins\in_wm.dll
MOD - [2011/07/08 11:23:33 | 000,285,696 | ---- | M] () -- C:\Program Files\Winamp\Plugins\in_mp3.dll
MOD - [2011/07/08 11:23:33 | 000,252,416 | ---- | M] () -- C:\Program Files\Winamp\Plugins\in_vorbis.dll
MOD - [2011/07/08 11:23:33 | 000,074,752 | ---- | M] () -- C:\Program Files\Winamp\Plugins\in_nsv.dll
MOD - [2011/07/08 11:23:33 | 000,050,688 | ---- | M] () -- C:\Program Files\Winamp\Plugins\in_mp4.dll
MOD - [2011/07/08 11:23:33 | 000,023,552 | ---- | M] () -- C:\Program Files\Winamp\Plugins\in_swf.dll
MOD - [2011/07/08 11:23:33 | 000,016,896 | ---- | M] () -- C:\Program Files\Winamp\Plugins\in_wave.dll
MOD - [2011/07/08 11:23:32 | 000,165,376 | ---- | M] () -- C:\Program Files\Winamp\Plugins\in_mod.dll
MOD - [2011/07/08 11:23:32 | 000,109,568 | ---- | M] () -- C:\Program Files\Winamp\Plugins\in_midi.dll
MOD - [2011/07/08 11:23:32 | 000,102,400 | ---- | M] () -- C:\Program Files\Winamp\Plugins\in_cdda.dll
MOD - [2011/07/08 11:23:32 | 000,072,192 | ---- | M] () -- C:\Program Files\Winamp\Plugins\in_dshow.dll
MOD - [2011/07/08 11:23:32 | 000,068,608 | ---- | M] () -- C:\Program Files\Winamp\Plugins\in_avi.dll
MOD - [2011/07/08 11:23:32 | 000,060,928 | ---- | M] () -- C:\Program Files\Winamp\Plugins\in_flac.dll
MOD - [2011/07/08 11:23:32 | 000,049,152 | ---- | M] () -- C:\Program Files\Winamp\Plugins\in_mkv.dll
MOD - [2011/07/08 11:23:32 | 000,043,008 | ---- | M] () -- C:\Program Files\Winamp\Plugins\in_flv.dll
MOD - [2011/07/08 11:23:32 | 000,007,168 | ---- | M] () -- C:\Program Files\Winamp\Plugins\in_linein.dll
MOD - [2011/07/08 11:23:29 | 000,025,600 | ---- | M] () -- C:\Program Files\Winamp\Plugins\gen_tray.dll
MOD - [2011/07/08 11:23:28 | 001,737,728 | ---- | M] () -- C:\Program Files\Winamp\Plugins\gen_ff.dll
MOD - [2011/07/08 11:23:28 | 000,340,992 | ---- | M] () -- C:\Program Files\Winamp\Plugins\freeform\wacs\freetype\freetype.wac
MOD - [2011/07/08 11:23:28 | 000,312,832 | ---- | M] () -- C:\Program Files\Winamp\Plugins\gen_ml.dll
MOD - [2011/07/08 11:23:28 | 000,183,808 | ---- | M] () -- C:\Program Files\Winamp\Plugins\gen_jumpex.dll
MOD - [2011/07/08 11:23:28 | 000,057,344 | ---- | M] () -- C:\Program Files\Winamp\Plugins\gen_orgler.dll
MOD - [2011/07/08 11:23:28 | 000,027,648 | ---- | M] () -- C:\Program Files\Winamp\Plugins\gen_hotkeys.dll
MOD - [2011/07/08 11:23:26 | 000,410,624 | ---- | M] () -- C:\Program Files\Winamp\nsutil.dll
MOD - [2011/07/08 11:23:26 | 000,253,440 | ---- | M] () -- C:\Program Files\Winamp\libsndfile.dll
MOD - [2011/07/08 11:23:26 | 000,078,848 | ---- | M] () -- C:\Program Files\Winamp\nde.dll
MOD - [2011/06/24 18:47:18 | 006,271,136 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
MOD - [2011/03/16 16:05:14 | 000,656,736 | ---- | M] () -- C:\Program Files\AVG\AVG10\avgchsvx.exe
MOD - [2011/02/10 07:55:18 | 001,148,256 | ---- | M] () -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
MOD - [2011/02/08 05:33:20 | 000,658,784 | ---- | M] () -- C:\Program Files\AVG\AVG10\avgrsx.exe
MOD - [2010/02/05 13:27:45 | 001,291,776 | ---- | M] () -- C:\WINDOWS\system32\quartz.dll
MOD - [2008/06/20 11:02:47 | 000,245,248 | ---- | M] () -- \\?\globalroot\systemroot\system32\mswsock.dll
MOD - [2008/05/01 15:59:12 | 002,158,592 | ---- | M] () -- C:\Program Files\Winamp Remote\bin\OrbMedia.dll
MOD - [2008/04/13 19:11:59 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll
MOD - [2008/04/13 19:11:51 | 000,059,904 | ---- | M] () -- C:\WINDOWS\system32\devenum.dll
MOD - [2008/03/26 19:41:08 | 000,487,424 | ---- | M] () -- C:\Program Files\Winamp Remote\bin\OrbWebServer.dll
MOD - [2008/03/26 19:40:50 | 000,618,496 | ---- | M] () -- C:\Program Files\Winamp Remote\bin\OrbPVR.dll
MOD - [2008/03/26 19:40:34 | 000,118,784 | ---- | M] () -- C:\Program Files\Winamp Remote\bin\Cab.dll
MOD - [2007/07/31 20:11:54 | 000,360,448 | ---- | M] () -- C:\Program Files\Winamp Remote\bin\sqlite3.dll
MOD - [2007/07/16 02:59:32 | 000,007,680 | ---- | M] () -- C:\Program Files\DAEMON Tools\Plugins\Images\bw5mount.dll
MOD - [2007/03/16 16:53:24 | 000,057,344 | ---- | M] () -- C:\Program Files\Winamp Remote\bin\ogg.dll
MOD - [2005/11/28 19:25:44 | 000,057,344 | ---- | M] () -- C:\Program Files\Winamp Remote\bin\TVGrabber.dll
MOD - [2005/07/20 13:48:10 | 000,059,904 | ---- | M] () -- C:\Program Files\Winamp Remote\bin\zlib1.dll
MOD - [2004/03/10 06:36:24 | 000,061,440 | ---- | M] () -- C:\Program Files\Lexmark 5200 Series\ConvDIB.dll
MOD - [2003/01/28 04:09:20 | 000,143,360 | ---- | M] () -- C:\Program Files\Winamp Remote\bin\libexpat.dll

========== Win32 Services (SafeList) ==========

SRV - [2011/04/19 01:44:40 | 000,993,848 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Secunia\PSI\PSIA.exe -- (Secunia PSI Agent)
SRV - [2011/04/18 17:39:42 | 007,398,752 | ---- | M] () [Auto | Stopped] -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2011/02/08 05:33:42 | 000,269,520 | ---- | M] () [Auto | Stopped] -- C:\Program Files\AVG\AVG10\avgwdsvc.exe -- (avgwd)
SRV - [2010/01/15 07:49:20 | 000,227,232 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2004/02/20 16:10:08 | 000,421,888 | ---- | M] (Lexmark International, Inc.) [On_Demand | Stopped] -- C:\WINDOWS\System32\lxbtcoms.exe -- (lxbt_device)

========== Driver Services (SafeList) ==========

DRV - [2011/04/14 21:28:42 | 000,134,480 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV - [2011/04/05 00:59:56 | 000,297,168 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2011/03/16 16:03:20 | 000,032,592 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\avgrkx86.sys -- (Avgrkx86)
DRV - [2011/03/01 14:25:18 | 000,034,896 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2011/02/22 08:13:02 | 000,022,992 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys -- (AVGIDSEH)
DRV - [2011/02/10 07:53:54 | 000,027,216 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AVGIDSShim.sys -- (AVGIDSShim)
DRV - [2011/02/10 07:53:52 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV - [2011/01/07 06:41:46 | 000,248,656 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2010/12/20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2010/09/01 03:30:58 | 000,015,544 | ---- | M] (Secunia) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\psi_mf.sys -- (PSI)
DRV - [2010/07/22 06:37:29 | 000,108,480 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AnyDVD.sys -- (AnyDVD)
DRV - [2010/05/10 13:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/03/22 03:30:22 | 000,222,672 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2010/02/17 13:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2009/12/27 12:56:21 | 000,685,816 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2009/09/16 17:55:00 | 000,008,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\EuGdiDrv.sys -- (EuGdiDrv)
DRV - [2009/08/26 13:45:10 | 000,013,192 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\epmntdrv.sys -- (epmntdrv)
DRV - [2006/11/02 20:32:00 | 004,394,496 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006/10/18 21:47:10 | 000,542,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\blackbox.dll -- (BlackBox)
DRV - [2006/10/13 03:16:36 | 000,081,664 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Rtnicxp.sys -- (RTL8023xp)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 3C 53 B9 03 1F 6F 2D 43 A9 C3 D3 CF 91 6D 48 98 [binary data]
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 3C 53 B9 03 1F 6F 2D 43 A9 C3 D3 CF 91 6D 48 98 [binary data]
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 3C 53 B9 03 1F 6F 2D 43 A9 C3 D3 CF 91 6D 48 98 [binary data]

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 3C 53 B9 03 1F 6F 2D 43 A9 C3 D3 CF 91 6D 48 98 [binary data]

IE - HKU\S-1-5-21-1960408961-1770027372-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2786678
IE - HKU\S-1-5-21-1960408961-1770027372-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 3C 53 B9 03 1F 6F 2D 43 A9 C3 D3 CF 91 6D 48 98 [binary data]
IE - HKU\S-1-5-21-1960408961-1770027372-839522115-1003\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-1960408961-1770027372-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.defaultthis.engineName: " "
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.google.com/ig?t=1"
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.1
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.6.2
FF - prefs.js..extensions.enabledItems: rikaichan-jpen@polarcloud.com:2.01.110527
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..extensions.enabledItems: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1390
FF - prefs.js..keyword.URL: "http://search.avg.com/?d=4dc973ae&i=23&tp=ab&nt=1&q="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/07/12 09:57:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.20\extensions\\Components: E:\Program Files\Mozilla Firefox\components [2011/08/18 07:29:24 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.20\extensions\\Plugins: E:\Program Files\Mozilla Firefox\plugins [2011/08/18 07:29:24 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 2.0.14\extensions\\Components: C:\Program Files\SeaMonkey\components [2011/04/30 14:34:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\SeaMonkey 2.0.14\extensions\\Plugins: C:\Program Files\SeaMonkey\plugins [2011/05/10 13:10:21 | 000,000,000 | ---D | M]

[2009/11/03 11:04:09 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Cat\Application Data\Mozilla\Extensions
[2009/11/03 11:04:09 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Cat\Application Data\Mozilla\Extensions\{92650c4d-4b8e-4d2a-b7eb-24ecf4f6b63a}
[2011/08/25 16:14:13 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Cat\Application Data\Mozilla\Firefox\Profiles\66i81rov.default\extensions
[2011/06/22 07:29:07 | 000,000,000 | ---D | M] (Rikaichan) -- C:\Documents and Settings\Cat\Application Data\Mozilla\Firefox\Profiles\66i81rov.default\extensions\{0AA9101C-D3C1-4129-A9B7-D778C6A17F82}
[2010/08/25 07:22:14 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Cat\Application Data\Mozilla\Firefox\Profiles\66i81rov.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/06/18 15:16:41 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Documents and Settings\Cat\Application Data\Mozilla\Firefox\Profiles\66i81rov.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011/05/29 18:18:31 | 000,000,000 | ---D | M] (uTorrentBar Community Toolbar) -- C:\Documents and Settings\Cat\Application Data\Mozilla\Firefox\Profiles\66i81rov.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
[2011/05/29 18:18:33 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Documents and Settings\Cat\Application Data\Mozilla\Firefox\Profiles\66i81rov.default\extensions\engine@conduit.com
[2011/05/29 18:18:39 | 000,000,000 | ---D | M] (Personas) -- C:\Documents and Settings\Cat\Application Data\Mozilla\Firefox\Profiles\66i81rov.default\extensions\personas@christopher.beard
[2011/08/19 08:01:29 | 000,000,000 | ---D | M] (Rikaichan Japanese-English Dictionary File) -- C:\Documents and Settings\Cat\Application Data\Mozilla\Firefox\Profiles\66i81rov.default\extensions\rikaichan-jpen@polarcloud.com
[2011/08/25 16:14:25 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Cat\Application Data\Mozilla\SeaMonkey\Profiles\oai95rce.default\extensions
[2010/11/05 07:18:07 | 000,000,000 | ---D | M] (ChatZilla) -- C:\Documents and Settings\Cat\Application Data\Mozilla\SeaMonkey\Profiles\oai95rce.default\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2}
[2010/11/05 07:18:08 | 000,000,000 | ---D | M] (JavaScript Debugger) -- C:\Documents and Settings\Cat\Application Data\Mozilla\SeaMonkey\Profiles\oai95rce.default\extensions\{f13b157f-b174-47e7-a34d-4815ddfdfeb8}
[2010/11/05 07:18:07 | 000,000,000 | ---D | M] (DOM Inspector) -- C:\Documents and Settings\Cat\Application Data\Mozilla\SeaMonkey\Profiles\oai95rce.default\extensions\inspector@mozilla.org
[2010/12/11 21:01:44 | 000,000,863 | ---- | M] () -- C:\Documents and Settings\Cat\Application Data\Mozilla\Firefox\Profiles\66i81rov.default\searchplugins\conduit.xml
[2011/07/12 09:57:37 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG10\FIREFOX4
[2009/11/01 19:39:17 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2009/12/19 18:26:29 | 000,000,000 | ---D | M] (Java Console) -- E:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
[2011/02/11 13:24:39 | 000,000,000 | ---D | M] (Java Console) -- E:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

O1 HOSTS File: ([2003/03/31 07:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-1960408961-1770027372-839522115-1003\..\Toolbar\WebBrowser: (uTorrentBar Toolbar) - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [Lexmark 5200 series] C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe (Lexmark International, Inc.)
O4 - HKLM..\Run: [LXBTCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.DLL (Lexmark International, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKU\S-1-5-21-1960408961-1770027372-839522115-1003..\Run: [DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe (DT Soft Ltd.)
O4 - HKU\S-1-5-21-1960408961-1770027372-839522115-1003..\Run: [Orb] C:\Program Files\Winamp Remote\bin\OrbTray.exe (Orb Networks)
O4 - HKU\S-1-5-21-1960408961-1770027372-839522115-1003..\Run: [SUPERAntiSpyware] File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe (Adobe Systems Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Secunia PSI Tray.lnk = C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Shortcut to RandomWall.exe.lnk = C:\Documents and Settings\Cat\My Documents\My Pictures\Wallpapers\RandomWall.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1960408961-1770027372-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - File not found
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 24.217.0.5 24.217.201.67 68.113.206.10
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Documents and Settings\Cat\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Cat\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/10/30 13:56:56 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2003/08/17 20:37:16 | 000,000,000 | ---- | M] () - E:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe ()
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O36 - AppCertDlls: asr_sa64 - (C:\WINDOWS\system32\comsepad.dll) - File not found
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/08/19 20:01:24 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/08/11 17:08:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cat\Local Settings\Application Data\Secunia PSI
[2011/08/11 17:08:22 | 000,000,000 | ---D | C] -- C:\Program Files\Secunia
[2011/08/11 09:20:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2011/08/11 09:20:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\SUPERAntiSpyware
[2011/08/11 09:07:07 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2011/08/11 08:59:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cat\Application Data\SUPERAntiSpyware.com
[2011/08/11 08:59:43 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2011/08/09 17:34:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cat\Local Settings\Application Data\RobloxVersions
[2011/08/09 17:34:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cat\Local Settings\Application Data\RobloxDownloads
[2011/08/09 17:34:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Cat\Local Settings\Application Data\Roblox
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[10 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/08/26 14:48:00 | 000,000,880 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/08/26 13:48:00 | 000,000,876 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/08/24 07:48:59 | 002,471,062 | ---- | M] () -- C:\Documents and Settings\Cat\Desktop\lemur.gif
[2011/08/22 07:28:28 | 003,932,214 | ---- | M] () -- C:\WINDOWS\System32\Cat_RandomWall.bmp
[2011/08/22 07:28:17 | 000,200,712 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2011/08/22 07:28:02 | 000,012,598 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/08/22 07:27:41 | 000,000,000 | ---- | M] () -- C:\WINDOWS\1651672650
[2011/08/22 07:27:39 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/08/21 15:15:24 | 000,018,092 | -HS- | M] () -- C:\Documents and Settings\Cat\Local Settings\Application Data\661tg7aypv01gkaaa1g6t566258i8d726alr
[2011/08/21 15:15:24 | 000,018,092 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\661tg7aypv01gkaaa1g6t566258i8d726alr
[2011/08/15 10:41:15 | 000,000,139 | ---- | M] () -- C:\Documents and Settings\Cat\Desktop\rk-proxy.reg
[2011/08/11 17:08:25 | 000,000,753 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2011/08/11 09:20:24 | 000,001,678 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/08/11 09:14:28 | 127,668,256 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/08/11 08:52:41 | 000,010,498 | ---- | M] () -- C:\WINDOWS\is-8EGDE.msg
[2011/08/11 08:52:41 | 000,000,419 | ---- | M] () -- C:\WINDOWS\is-8EGDE.lst
[2011/08/10 17:33:45 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/08/09 17:17:22 | 000,052,351 | ---- | M] () -- C:\Documents and Settings\Cat\Desktop\firefoxInstall_preview_v2.jpg
[2011/08/05 08:43:33 | 000,015,434 | ---- | M] () -- C:\Documents and Settings\Cat\Desktop\658194500_2353465625_642053058_1312549395798.jpeg
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[10 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/08/24 07:48:57 | 002,471,062 | ---- | C] () -- C:\Documents and Settings\Cat\Desktop\lemur.gif
[2011/08/13 20:06:25 | 000,018,092 | -HS- | C] () -- C:\Documents and Settings\Cat\Local Settings\Application Data\661tg7aypv01gkaaa1g6t566258i8d726alr
[2011/08/13 20:06:25 | 000,018,092 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\661tg7aypv01gkaaa1g6t566258i8d726alr
[2011/08/11 17:08:25 | 000,000,753 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2011/08/11 17:08:25 | 000,000,716 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Secunia PSI.lnk
[2011/08/11 16:43:47 | 000,000,139 | ---- | C] () -- C:\Documents and Settings\Cat\Desktop\rk-proxy.reg
[2011/08/11 09:20:24 | 000,001,678 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/08/11 08:52:41 | 000,010,498 | ---- | C] () -- C:\WINDOWS\is-8EGDE.msg
[2011/08/11 08:52:41 | 000,000,419 | ---- | C] () -- C:\WINDOWS\is-8EGDE.lst
[2011/08/10 15:25:52 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/08/10 14:48:11 | 000,000,000 | ---- | C] () -- C:\WINDOWS\1651672650
[2011/08/09 17:17:22 | 000,052,351 | ---- | C] () -- C:\Documents and Settings\Cat\Desktop\firefoxInstall_preview_v2.jpg
[2011/08/05 08:43:32 | 000,015,434 | ---- | C] () -- C:\Documents and Settings\Cat\Desktop\658194500_2353465625_642053058_1312549395798.jpeg
[2011/07/03 14:07:08 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\Cat\Application Data\221E.C56
[2011/05/09 22:59:12 | 000,013,734 | -HS- | C] () -- C:\Documents and Settings\Cat\Local Settings\Application Data\6tr461au6me6ikn4k875r
[2011/05/09 22:59:12 | 000,013,734 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\6tr461au6me6ikn4k875r
[2011/04/05 00:59:56 | 000,297,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\avgtdix.sys
[2011/04/01 17:35:33 | 000,015,258 | -HS- | C] () -- C:\Documents and Settings\Cat\Local Settings\Application Data\71nn1fboiyf7847
[2011/04/01 17:35:33 | 000,015,258 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\71nn1fboiyf7847
[2011/01/12 04:06:42 | 000,000,127 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2010/12/20 14:15:43 | 000,012,496 | ---- | C] () -- C:\WINDOWS\System32\SpoonUninstall-dBpoweramp DSP Effects.dat
[2010/12/20 14:15:08 | 000,005,888 | ---- | C] () -- C:\WINDOWS\System32\SpoonUninstall-dBpoweramp CD Writer.dat
[2010/12/20 14:14:33 | 000,002,444 | ---- | C] () -- C:\WINDOWS\System32\SpoonUninstall-dBpoweramp Batch Ripper.dat
[2010/11/03 07:40:32 | 000,080,416 | R--- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll
[2010/10/11 10:26:12 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\Msvcrt10.dll
[2010/10/11 10:26:01 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\adistres.dll
[2010/08/09 20:24:12 | 000,000,085 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\.zreglib
[2010/08/03 07:42:46 | 003,835,624 | ---- | C] () -- C:\WINDOWS\System32\SpoonUninstall.exe
[2010/08/03 07:42:46 | 000,015,607 | ---- | C] () -- C:\WINDOWS\System32\SpoonUninstall-dBpoweramp Music Converter.dat
[2010/01/16 01:22:13 | 000,000,023 | ---- | C] () -- C:\WINDOWS\BlendSettings.ini
[2010/01/01 21:02:19 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009/12/26 20:24:48 | 001,673,216 | ---- | C] () -- C:\WINDOWS\System32\BootMan.exe
[2009/12/26 20:24:48 | 000,086,408 | ---- | C] () -- C:\WINDOWS\System32\setupempdrv03.exe
[2009/12/26 20:24:48 | 000,014,848 | ---- | C] () -- C:\WINDOWS\System32\EuEpmGdi.dll
[2009/12/26 20:24:48 | 000,008,456 | ---- | C] () -- C:\WINDOWS\System32\EuGdiDrv.sys
[2009/12/26 20:24:47 | 000,013,192 | ---- | C] () -- C:\WINDOWS\System32\epmntdrv.sys
[2009/11/23 22:45:38 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\Cat\Local Settings\Application Data\housecall.guid.cache
[2009/11/03 09:38:33 | 000,001,125 | ---- | C] () -- C:\WINDOWS\winamp.ini
[2009/11/01 09:29:35 | 000,057,344 | ---- | C] () -- C:\Documents and Settings\Cat\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/11/01 09:24:53 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxbtvs.dll
[2009/11/01 09:24:52 | 000,294,912 | ---- | C] () -- C:\WINDOWS\System32\lxbtih.exe
[2009/11/01 09:24:52 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\lxbthwdf.dll
[2009/11/01 09:24:52 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\lxbtcoin.dll
[2009/11/01 09:24:52 | 000,126,976 | ---- | C] () -- C:\WINDOWS\System32\lxbtsnls.dll
[2009/11/01 09:24:52 | 000,001,832 | ---- | C] () -- C:\WINDOWS\System32\lxbtprod.ini
[2009/11/01 01:01:40 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2009/10/30 14:41:01 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2009/10/30 13:58:35 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2009/10/30 13:54:32 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2008/09/18 00:55:00 | 001,724,416 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2008/09/18 00:55:00 | 001,657,376 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2008/09/18 00:55:00 | 001,503,232 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2008/09/18 00:55:00 | 001,346,080 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2008/09/18 00:55:00 | 001,101,824 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2008/09/18 00:55:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2008/09/18 00:55:00 | 000,449,056 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2008/09/18 00:55:00 | 000,436,768 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2008/09/18 00:55:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2008/09/18 00:55:00 | 000,163,908 | ---- | C] () -- C:\WINDOWS\System32\nvsvc32.exe
[2004/08/04 01:07:22 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/02 14:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2003/03/31 07:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2003/03/31 07:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2003/03/31 07:00:00 | 000,432,686 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2003/03/31 07:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2003/03/31 07:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2003/03/31 07:00:00 | 000,067,516 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2003/03/31 07:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2003/03/31 07:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2003/03/31 07:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2003/03/31 07:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2001/12/31 19:12:34 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2001/12/31 19:11:40 | 000,141,240 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

========== Files - Unicode (All) ==========
[2010/09/24 20:05:38 | 000,040,448 | ---- | M] ()(C:\Documents and Settings\Cat\My Documents\??????? Crisis Core.doc) -- C:\Documents and Settings\Cat\My Documents\クライシスコア Crisis Core.doc
[2010/09/19 02:14:02 | 000,040,448 | ---- | C] ()(C:\Documents and Settings\Cat\My Documents\??????? Crisis Core.doc) -- C:\Documents and Settings\Cat\My Documents\クライシスコア Crisis Core.doc

========== Alternate Data Streams ==========

@Alternate Data Stream - 816 bytes -> C:\WINDOWS\1651672650:3044642205.exe

< End of report >

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000007c

Kernel Drivers (total 125):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x80700000 \WINDOWS\system32\hal.dll
0xF7C6F000 \WINDOWS\system32\KDCOM.DLL
0xF7B7F000 \WINDOWS\system32\BOOTVID.dll
0xF7664000 sptd.sys
0xF7C71000 \WINDOWS\System32\Drivers\WMILIB.SYS
0xF764C000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
0xF761E000 ACPI.sys
0xF760D000 pci.sys
0xF776F000 isapnp.sys
0xF7D37000 pciide.sys
0xF79EF000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF777F000 MountMgr.sys
0xF75EE000 ftdisk.sys
0xF7C73000 dmload.sys
0xF75C8000 dmio.sys
0xF79F7000 PartMgr.sys
0xF778F000 VolSnap.sys
0xF75B0000 atapi.sys
0xF779F000 disk.sys
0xF77AF000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF7590000 fltmgr.sys
0xF757E000 sr.sys
0xF77BF000 PxHelp20.sys
0xF7567000 KSecDD.sys
0xF7554000 WudfPf.sys
0xF74C7000 Ntfs.sys
0xF749A000 NDIS.sys
0xF7480000 Mup.sys
0xF79FF000 avgrkx86.sys
0xF7B83000 AVGIDSEH.Sys
0xF77EF000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xF6E36000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xF6E22000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF6DFA000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xF6DC5000 \SystemRoot\system32\DRIVERS\Rtenicxp.sys
0xF7A4F000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF6DA1000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF7A57000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF77FF000 \SystemRoot\system32\DRIVERS\serial.sys
0xF7C43000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF6D8D000 \SystemRoot\system32\DRIVERS\parport.sys
0xF780F000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF7A67000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF7A6F000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF781F000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF6D74000 \SystemRoot\System32\Drivers\AnyDVD.sys
0xF782F000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF783F000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF6D51000 \SystemRoot\system32\DRIVERS\ks.sys
0xF6CEA000 \SystemRoot\System32\Drivers\aw7nbc5y.SYS
0xF7E7B000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF784F000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF7438000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF6CAB000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF785F000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF786F000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF7AEF000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF6C9A000 \SystemRoot\system32\DRIVERS\psched.sys
0xF787F000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF7AFF000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF7B0F000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF6C6A000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xF788F000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF7C81000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF6C0C000 \SystemRoot\system32\DRIVERS\update.sys
0xF7414000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF789F000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF456C000 \SystemRoot\system32\drivers\RtkHDAud.sys
0xF4548000 \SystemRoot\system32\drivers\portcls.sys
0xF78BF000 \SystemRoot\system32\drivers\drmk.sys
0xF78CF000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7C89000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF78DF000 \SystemRoot\system32\DRIVERS\avgmfx86.sys
0xF7C91000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7DE7000 \SystemRoot\System32\Drivers\Null.SYS
0xF7C95000 \SystemRoot\System32\Drivers\Beep.SYS
0xF7B5F000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF7B67000 \SystemRoot\System32\drivers\vga.sys
0xF7C99000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7C9D000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF7B77000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF7A3F000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF6BFC000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xF44C5000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF446C000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xF43FD000 \SystemRoot\system32\DRIVERS\avgtdix.sys
0xF78FF000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF7AAF000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xF43D5000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF43B3000 \SystemRoot\System32\drivers\afd.sys
0xF4A44000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF4391000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
0xF453C000 \SystemRoot\system32\DRIVERS\usbscan.sys
0xF7B07000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
0xF7B1F000 \SystemRoot\system32\DRIVERS\usbprint.sys
0xF4366000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xF452C000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF4A34000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF42F6000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF4A24000 \SystemRoot\System32\Drivers\Fips.SYS
0xF7B47000 \SystemRoot\System32\Drivers\ElbyCDIO.sys
0xF41F2000 \SystemRoot\system32\DRIVERS\avgldx86.sys
0xF49E4000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xF418A000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF7CAF000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF422E000 \SystemRoot\System32\drivers\Dxapi.sys
0xF7A97000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7E98000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xBF5D9000 \SystemRoot\System32\ATMFD.DLL
0xBA6DC000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xBA463000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF7CFD000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xF7A77000 \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys
0xBA2F3000 \SystemRoot\system32\DRIVERS\srv.sys
0xF7ACF000 \SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys
0xBA2AB000 \SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys
0xBA246000 \SystemRoot\system32\drivers\wdmaud.sys
0xBA3C3000 \SystemRoot\system32\drivers\sysaudio.sys
0xB9CB5000 \SystemRoot\System32\Drivers\HTTP.sys
0x7C900000 \WINDOWS\system32\ntdll.dll
0x10000000 \Program Files\DAEMON Tools\daemon.dll

Processes (total 43):
0 System Idle Process
4 System
748 C:\WINDOWS\system32\smss.exe
780 C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
824 C:\PROGRA~1\AVG\AVG10\avgrsx.exe
940 csrss.exe
968 C:\WINDOWS\system32\winlogon.exe
1024 C:\WINDOWS\system32\services.exe
1040 C:\WINDOWS\system32\lsass.exe
1216 C:\WINDOWS\system32\svchost.exe
1236 C:\WINDOWS\1651672650:3044642205.exe
1308 svchost.exe
1400 C:\WINDOWS\system32\svchost.exe
1444 C:\WINDOWS\system32\svchost.exe
1528 svchost.exe
1612 svchost.exe
1872 svchost.exe
624 C:\WINDOWS\system32\svchost.exe
2572 C:\Program Files\Lexmark 5200 Series\lxbtbmgr.exe
2592 C:\Program Files\Common Files\Java\Java Update\jusched.exe
2600 C:\Program Files\Lexmark 5200 Series\lxbtbmon.exe
2624 C:\Program Files\Winamp\winampa.exe
2648 C:\WINDOWS\RTHDCPL.exe
2684 C:\WINDOWS\system32\rundll32.exe
2692 C:\Program Files\AVG\AVG10\avgtray.exe
2788 C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
2812 C:\Program Files\Messenger\msmsgs.exe
2820 C:\Program Files\DAEMON Tools\daemon.exe
2828 C:\Program Files\Winamp Remote\bin\OrbTray.exe
2852 C:\WINDOWS\system32\ctfmon.exe
3116 C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
3124 C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
3152 C:\Program Files\Secunia\PSI\psi_tray.exe
3440 C:\Program Files\Winamp Remote\bin\Orb.exe
540 C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
3560 C:\Program Files\Winamp\winamp.exe
2392 E:\Program Files\Mozilla Firefox\firefox.exe
3732 E:\Program Files\Mozilla Firefox\plugin-container.exe
3860 C:\WINDOWS\explorer.exe
2676 C:\WINDOWS\system32\notepad.exe
2912 C:\Documents and Settings\Cat\My Documents\Downloads\OTL.exe
332 C:\WINDOWS\notepad.exe
3828 C:\Documents and Settings\Cat\My Documents\Downloads\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive1 Model Number: WDCWD7501AYPS-01G5B0, Rev: 02.01B01
PhysicalDrive0 Model Number: ST3500630A, Rev: 3.AAE

Size Device Name MBR Status
--------------------------------------------
698 GB \\.\PhysicalDrive1 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A
465 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: 6BC52EFF0B4294A010F0D81DC7CD30387256635F

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!

#13 Shannon2012

Forum Addict

Group: Malware Response Team
Posts: 3,642
Joined: 31-July 06
Gender:Male
Location:North Carolina, USA

Posted 26 August 2011 - 07:35 PM

Hi-

Thanks for the logs. Let's see if we can break things loose a bit.

Download Combofix from either of the links below, and save it to your desktop. This one save to your desktop. For information regarding this download, please visit this webpage: how-to-use-combofix

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

How to Temporarily Disable your Anti-virusl

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.
Please copy the "C:\ComboFix.txt" into your reply.

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

In your reply, copy in the ComboFix report and let me know if things have improved or not.

Shannon

#14 Shannon2012

Forum Addict

Group: Malware Response Team
Posts: 3,642
Joined: 31-July 06
Gender:Male
Location:North Carolina, USA

Posted 31 August 2011 - 08:59 AM

Are you still in need of help?

Shannon

#15 Catseye2001

New Member

Group: Members
Posts: 7
Joined: 10-August 11

Posted 31 August 2011 - 01:35 PM

When I try to disable AVG 2011, I get the message "An error occurred when saving the configuration. Connection is off-line." Combofix tells me it will run anyway, but at my own risk. Should I go ahead and run it?

(I work nights, and now that school has started and I have to get the kids ready and off, then help with homework in the afternoon, my time is a little limited, so I haven't been able to sit down here to look at this as often. Sorry about the slow replies.)

This post has been edited by Catseye2001: 31 August 2011 - 01:37 PM