Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Latest News: Android Clickfraud Op Impersonates iPhones to Bump Ad Premiums

Featured Deal: Get 99% off The The 2019 Ethical Hacker Master Class Bundle

Windows XP taken over by Virtumonde (I think)

Started by ag24 , Oct 01 2009 10:42 PM

This topic is locked

17 replies to this topic

#1 ag24

Members
10 posts
OFFLINE

Local time:01:24 PM

Posted 01 October 2009 - 10:42 PM

I have the symptoms of Virtumonde - hijacked browser, lots of browser pop-ups, background changed to scary "you have a virus" image, when not in safe mode, basically all functionality in Windows is disabled (can't ctr-alt-del for example). I followed the instructions and I'm attaching the files here. Thank you so much for your help. I look forward to hearing from you!

DDS:

DDS (Ver_09-09-29.01) - NTFSx86 NETWORK
Run by Amy & Greg at 22:34:44.35 on Thu 10/01/2009
Internet Explorer: 7.0.5730.11
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.510.286 [GMT -4:00]

AV: Cox security software Antivirus *On-access scanning enabled* (Updated) {A4E803B3-4E6E-4271-B1CD-56FBC0992D36}

============== Running Processes ===============

C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Amy & Greg\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\windows\system32\drivers\smss.exe
BHO: {40989f49-577e-406a-af72-fe14fa06f123} - nugedoka.dll
BHO: {4a967869-1ef3-41ff-b8b8-c8d3e51d2e94} - nugedoka.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {75279743-0cf9-4572-b99b-a3f5403ac425} - nugedoka.dll
BHO: {a8042716-16ed-4089-8579-c63a9b8d8948} - nugedoka.dll
TB: Ask.com Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
TB: {DE9C389F-3316-41A7-809B-AA305ED9D922} - No File
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [AuthConsoleStart]
mRun: [filit] "c:\bak\foobar.exe"
mRun: [workflo] d:\install\workflow.exe
mRun: [CanonSolutionMenu] "c:\program files\canon\solutionmenu\CNSLMAIN.exe" /logon
mRun: [CanonMyPrinter] "c:\program files\canon\myprinter\BJMyPrt.exe" /logon
mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot
mRun: [OpwareSE4] "c:\program files\scansoft\omnipagese4\OpwareSE4.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [AppleSyncNotifier] "c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [KernelFaultCheck] "%systemroot%\system32\dumprep" 0 -k
mRun: [winupdate.exe] "c:\windows\system32\winupdate.exe"
mRun: [11172344] c:\documents and settings\all users\application data\11172344\11172344.exe
mRun: [SpySweeper] "c:\program files\webroot\spy sweeper\SpySweeperUI.exe" /startintray
mRun: [9513039450] c:\documents and settings\amy & greg\application data\9513039450\9513039450.exe
mRun: [jehohahek] Rundll32.exe "c:\windows\system32\tomavita.dll",a
dRun: [Install] c:\documents and settings\amy & greg\application data\9513039450\9513039450.bat
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
uPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
mPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
dPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - c:\program files\hello\PicasaCapture.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxp://support.dell.com/systemprofiler/SysPro.CAB
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {1B9935E4-8A50-4DD8-BD09-A7518723BF97} - hxxps://quicken.ehosts.net/netagent/objects/custappx3.cab
DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc2.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {A30FBBDC-FA29-4606-8565-14AADCCA6708} - hxxps://photos.riteaid.com/control/RiteAidOneHourPhotoOnline.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} - hxxp://cvs.pnimedia.com/upload/activex/v2_0_0_10/PCAXSetupv2.0.0.10.cab?
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: __c005163 - c:\windows\system32\__c005163.dat
AppInit_DLLs: \system32\siriluje.dll c:\windows\system32\nugebini.dll c:\windows\system32\ c:\windows\system32\tomavita.dll,vajapaso.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SSODL: dijebudih - {22f72728-9d58-465a-b50c-9a66aa4518c3} - c:\windows\system32\siriluje.dll
SSODL: jezajadik - {a687e524-5b8b-4757-864f-6c7d50fac87d} - c:\windows\system32\nugebini.dll
SSODL: nesitiwun - {ff742604-c228-402a-ae90-8117c7525f7a} - c:\windows\system32\gubebusi.dll
SSODL: tejinezav - {220982da-8068-4a25-a324-cc1673fedb2b} - c:\windows\system32\tomavita.dll
STS: gahurihor: {22f72728-9d58-465a-b50c-9a66aa4518c3} - c:\windows\system32\siriluje.dll
STS: mujuzedij: {a687e524-5b8b-4757-864f-6c7d50fac87d} - c:\windows\system32\nugebini.dll
STS: mujuzedij: {ff742604-c228-402a-ae90-8117c7525f7a} - c:\windows\system32\gubebusi.dll
STS: mujuzedij: {220982da-8068-4a25-a324-cc1673fedb2b} - c:\windows\system32\tomavita.dll
LSA: Notification Packages = botapepe.dll

============= SERVICES / DRIVERS ===============

R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2009-2-25 29808]
R2 WebrootSpySweeperService;Webroot Spy Sweeper Engine;c:\program files\webroot\spy sweeper\SpySweeper.exe [2009-4-21 4048240]
R2 WRConsumerService;Webroot Client Service;c:\program files\webroot\spy sweeper\WRConsumerService.exe [2009-3-31 1205760]
S2 GRTdiMon;GR TDI Mon;c:\windows\system32\drivers\GRTdiMon.sys [2004-11-10 32256]
S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-1-10 24652]

=============== Created Last 30 ================

2009-10-01 16:30 2,713 ---sh--- c:\windows\system32\pidizowi.exe
2009-09-30 23:23 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Western Digital
2009-09-30 22:28 <DIR> --d----- c:\docume~1\amy&gr~1\applic~1\9513039450
2009-09-30 22:27 <DIR> --d----- c:\program files\Trend Micro
2009-09-30 04:27 2,713 ---sh--- c:\windows\system32\zilebobi.exe
2009-09-30 01:36 552 a------- c:\windows\system32\d3d8caps.dat
2009-09-30 01:26 113 a------- C:\xcrashdump.dat
2009-09-29 22:43 267 a------- c:\windows\wininit.ini
2009-09-29 21:24 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-09-29 21:24 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-09-28 21:22 262,146 a------- C:\registrybackup.reg
2009-09-28 16:43 0 a------- c:\windows\system32\41.exe
2009-09-28 16:43 <DIR> --d----- c:\docume~1\alluse~1\applic~1\11172344
2009-09-28 10:12 28,672 a------- c:\windows\system32\__c005163.dat
2009-09-28 10:12 85 a------- c:\windows\system32\gasfkyawutirdw.dat
2009-09-28 10:11 48,640 a------- c:\windows\system32\drivers\smss.exe
2009-09-28 10:11 44,032 a------- c:\windows\system32\gasfkysveaypwv.dll
2009-09-28 10:11 70,144 a------- c:\windows\system32\drivers\gasfkyoqdwowst.sys
2009-09-28 10:11 77,056 a------- c:\windows\system32\drivers\kcczkcwrvopk.sys
2009-09-28 10:11 28,672 a------- C:\rmeprraf.exe.dat
2009-09-28 10:10 70,144 a------- c:\windows\system32\drivers\iqdstsirfuyfqjxo.sys
2009-09-28 10:10 19,456 a------- C:\xrwy.exe
2009-09-28 10:10 46,080 a------- C:\nqxbk.exe
2009-09-28 10:10 104,448 a------- C:\mqhimp.exe
2009-09-28 10:10 5,632 a------- C:\rlswn.exe
2009-09-28 10:10 48,640 a------- C:\imat.exe
2009-09-28 10:10 51,712 a------- C:\yonm.exe
2009-09-28 10:10 40,448 a------- C:\rmeprraf.exe
2009-09-28 10:10 155,648 a------- C:\vfulg.exe

==================== Find3M ====================

2009-09-30 22:28 50,688 a--sh--- c:\windows\system32\jayoriji.dll
2009-09-30 22:28 1,047,076 a--sh--- c:\windows\system32\potibubi.exe
2009-09-30 22:28 91,136 a--sh--- c:\windows\system32\tomavita.dll
2009-09-30 22:28 39,424 a--sh--- c:\windows\system32\firowazo.dll
2009-09-30 06:58 1,082,404 a--sh--- c:\windows\system32\semasema.exe
2009-09-30 06:58 39,424 a--sh--- c:\windows\system32\lodivime.dll
2009-09-29 23:50 1,082,404 a--sh--- c:\windows\system32\vinabino.exe
2009-09-29 22:52 1,081,892 a--sh--- c:\windows\system32\rurisugo.exe
2009-09-29 22:52 39,424 a--sh--- c:\windows\system32\getovojo.dll
2009-09-29 21:58 52,736 a--sh--- c:\windows\system32\kenamezi.dll
2009-09-29 21:58 1,081,892 a--sh--- c:\windows\system32\tigefeki.exe
2009-09-29 21:58 39,424 a--sh--- c:\windows\system32\bedamifu.dll
2009-09-28 16:43 1,081,892 a--sh--- c:\windows\system32\bowikiku.exe
2009-09-28 16:42 90,624 a--sh--- c:\windows\system32\fagesefa.dll
2009-09-28 16:42 52,736 a--sh--- c:\windows\system32\dolemiju.exe
2009-09-28 16:42 39,424 a--sh--- c:\windows\system32\zolekare.dll
2009-08-28 22:08 18,644 a------- c:\windows\jurel.scr
2009-08-28 22:08 18,009 a------- c:\program files\common files\syqaf.pif
2009-08-28 22:08 17,600 a------- c:\windows\bokyfy.vbs
2009-08-28 22:08 17,219 a------- c:\windows\onokukesy.sys
2009-08-28 22:08 15,966 a------- c:\program files\common files\ezepagudyn.exe
2009-08-28 22:08 15,939 a------- c:\windows\system32\geho.exe
2009-08-28 22:08 15,445 a------- c:\docume~1\alluse~1\applic~1\melolobow.reg
2009-08-28 22:08 13,823 a------- c:\program files\common files\ocynyroq.sys
2009-08-28 22:08 11,974 a------- c:\program files\common files\ugad.bat
2009-08-28 22:08 11,195 a------- c:\docume~1\amy&gr~1\applic~1\exin.bin
2009-08-28 22:08 10,997 a------- c:\program files\common files\ujumylalu.dat
2009-08-05 05:11 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-07-17 14:55 58,880 a------- c:\windows\system32\atl.dll
2009-07-13 23:43 286,208 a------- c:\windows\system32\wmpdxm.dll
2008-02-13 20:26 4 ---shr-- c:\docume~1\alluse~1\applic~1\sysqcl1129139270.dat
2005-10-22 23:28 186,368 a------- c:\documents and settings\amy & greg\foobar.exe
2009-06-30 22:29 50,688 a--sh--- c:\windows\system32\botapepe.dll
2009-06-30 22:29 50,688 a--sh--- c:\windows\system32\kihugali.dll
2009-06-29 21:58 52,736 a--sh--- c:\windows\system32\nuzomoyu.dll
2009-06-30 22:29 50,688 a--sh--- c:\windows\system32\vajapaso.dll

============= FINISH: 22:35:23.92 ===============

Attached Files

Attach.txt 28.71KB 5 downloads
ark.txt 21.78KB 1 downloads

BC AdBot (Login to Remove)

BleepingComputer.com
Register to remove ads

#2 Buckeye_Sam

Malware Expert

Members
17,382 posts
OFFLINE

Gender:Male
Location:Pickerington, Ohio
Local time:12:24 PM

Posted 02 October 2009 - 04:38 PM

Hello!

My name is Sam and I will be helping you.

In order to see what's going on with your computer I will ask for you to post various logs from the tools that we will use to resolve your issue. Please also share with me any information about how your computer is reacting and behaving each step of the way as we work through this process.

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

Make sure you are connected to the Internet.
Double-click on Download_mbam-setup.exe to install the application.
When the installation begins, follow the prompts and do not make any changes to default settings.
When installation has finished, make sure you leave both of these checked:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware
Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
- Make sure the "Perform Quick Scan" option is selected.
- Then click on the Scan button.
If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
Make sure that everything is checked, and click Remove Selected.
When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

We need to create an OTL Report

Please download OTL from here
Save it to your desktop.
Double click on the icon on your desktop.
Click the "Scan All Users" checkbox.
Push the "Run Scan" button.
The scan should take just a few minutes.
Copy the log that opens up and paste it back here in your next reply.

If I have helped you in any way, please consider a donation to help me continue the fight against malware.

Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!

========================================================

#3 ag24

Topic Starter

Members
10 posts
OFFLINE

Local time:01:24 PM

Posted 02 October 2009 - 06:13 PM

Hi Sam.

Thanks so much for helping me out on this!

I did the steps you asked - I ran everything from safe mode. At the end of the mbam process, about 5 items did not remove so I rebooted. I haven't logged in to regular mode yet to see what it looks like there. I'll wait until you give me the OK

!

Here are the logs:

MBAM:

Malwarebytes' Anti-Malware 1.41
Database version: 2896
Windows 5.1.2600 Service Pack 2 (Safe Mode)

10/2/2009 6:59:08 PM
mbam-log-2009-10-02 (18-59-08).txt

Scan type: Quick Scan
Objects scanned: 182993
Time elapsed: 38 minute(s), 31 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 2
Registry Keys Infected: 5
Registry Values Infected: 9
Registry Data Items Infected: 15
Folders Infected: 3
Files Infected: 62

Memory Processes Infected:
C:\WINDOWS\system32\drivers\smss.exe (Trojan.Agent) -> Unloaded process successfully.

Memory Modules Infected:
c:\WINDOWS\system32\tomavita.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\__c005163.dat (Trojan.Vundo) -> Delete on reboot.

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{220982da-8068-4a25-a324-cc1673fedb2b} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c005163 (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\Interface\{986a8ac1-ab4d-4f41-9068-4b01c0197867} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a249bc15-23f2-42ad-f4e4-00aac39c0004} (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{afd4ad01-58c1-47db-a404-fbe00a6c5486} (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jehohahek (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\11172344 (Rogue.Multiple.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{220982da-8068-4a25-a324-cc1673fedb2b} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\tejinezav (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9513039450 (Rogue.SecurityTool) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\inixs (Rogue.Installer) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\install (Rogue.SecurityTool) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\AUserinit.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdate.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\tomavita.dll -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\tomavita.dll -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\drivers\smss.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\drivers\smss.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\drivers\smss.exe) Good: (Userinit.exe) -> Quarantined and deleted successfully.

Folders Infected:
C:\Documents and Settings\All Users\Application Data\11172344 (Rogue.Multiple.H) -> Quarantined and deleted successfully.
C:\Program Files\Windows Police Pro (Rogue.WindowsPolicePro) -> Quarantined and deleted successfully.
C:\Documents and Settings\Amy & Greg\Application Data\9513039450 (Rogue.SecurityTool) -> Quarantined and deleted successfully.

Files Infected:
c:\WINDOWS\system32\tomavita.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Documents and Settings\All Users\Application Data\11172344\11172344 (Rogue.Multiple.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\11172344\11172344.exe (Rogue.Multiple.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\11172344\pc11172344ins (Rogue.Multiple.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\__c005163.dat (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\drivers\smss.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Amy & Greg\Application Data\9513039450\9513039450.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\minix32.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\imat.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\mqhimp.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\nqxbk.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\rlswn.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\rmeprraf.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\rmeprraf.exe.dat (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\vfulg.exe (Rootkit.Rustock) -> Quarantined and deleted successfully.
C:\xrwy.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\yonm.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-1390067357-2111687655-839522115-1003\Dc517\htmlayout.dll (Rogue.AntiVirusPro) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-1390067357-2111687655-839522115-1003\Dc517\Uninstall.exe (Rogue.PC_AntiSpyware2010) -> Quarantined and deleted successfully.
C:\Documents and Settings\Janie\Start Menu\Programs\Startup\mhbupd32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bedamifu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bowikiku.exe (Rogue.SystemSecurity) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dolemiju.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fagesefa.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\firowazo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\getovojo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gojobeju.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hisekeke.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kenamezi.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lodivime.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nadejafi.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nuzomoyu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\potibubi.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rurisugo.exe (Rogue.SystemSecurity) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\semasema.exe (Rogue.SystemSecurity) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tigefeki.exe (Rogue.SystemSecurity) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vinabino.exe (Rogue.SystemSecurity) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\zolekare.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\gasfkyoqdwowst.sys (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\iqdstsirfuyfqjxo.sys (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\kcczkcwrvopk.sys (Rootkit.Rustock) -> Quarantined and deleted successfully.
C:\Documents and Settings\Janie\Local Settings\Temporary Internet Files\Content.IE5\0OJZ5E0V\rkhueef[1].htm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Janie\Local Settings\Temporary Internet Files\Content.IE5\2RW0MXKI\xdqrefw[1].htm (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Janie\Local Settings\Temporary Internet Files\Content.IE5\2RW0MXKI\yroxlyviw[1].htm (Rootkit.Rustock) -> Quarantined and deleted successfully.
C:\Documents and Settings\Janie\Local Settings\Temporary Internet Files\Content.IE5\3NVRAECY\atuuiima[1].htm (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Janie\Local Settings\Temporary Internet Files\Content.IE5\74VUJJOE\elyii[1].txt (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Janie\Local Settings\Temporary Internet Files\Content.IE5\74VUJJOE\gispcpqd[1].htm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Janie\Local Settings\Temporary Internet Files\Content.IE5\BA1WXP8I\lbblzmzax[1].htm (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Janie\Local Settings\Temporary Internet Files\Content.IE5\GC1HW8VG\load[1].exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Janie\Local Settings\Temporary Internet Files\Content.IE5\GC1HW8VG\qajkhhk[1].htm (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\KPGRS1SF\dfghfghgfj[1].dll (Trojan.Fakeinit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Amy & Greg\Application Data\9513039450\9513039450.bat (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Amy & Greg\Application Data\9513039450\9513039450.cfg (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Janie\Application Data\seres.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Janie\Application Data\wiaserva.log (Malware.Trace) -> Quarantined and deleted successfully.
C:\Program Files\Common\helper.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Program Files\Shared\lib.sig (Adware.Deepdive) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\AUserinit.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dukotova.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mst123.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gasfkysveaypwv.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gasfkyawutirdw.dat (Rootkit.TDSS) -> Quarantined and deleted successfully.

OTL:

OTL logfile created on: 10/2/2009 7:04:03 PM - Run 1
OTL by OldTimer - Version 3.0.18.0 Folder = C:\Documents and Settings\Amy & Greg\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.07 Mb Total Physical Memory | 332.21 Mb Available Physical Memory | 65.13% Memory free
1.35 Gb Paging File | 1.23 Gb Available in Paging File | 91.23% Paging File free
Paging file location(s): C:\pagefile.sys 900 1800 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.82 Gb Total Space | 68.55 Gb Free Space | 29.44% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 991.22 Mb Total Space | 905.48 Mb Free Space | 91.35% Space Free | Partition Type: FAT
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HOME
Current User Name: Amy & Greg
Logged in as Administrator.

Current Boot Mode: SafeMode with Networking
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2009/06/20 22:54:44 | 01,205,760 | ---- | M] (Webroot Software, Inc. ) -- C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
PRC - [2009/04/21 18:26:52 | 04,048,240 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
PRC - [2007/06/13 06:23:07 | 01,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2009/02/06 12:39:29 | 00,227,840 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wbem\wmiprvse.exe
PRC - [2009/06/29 04:35:10 | 00,634,632 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe
PRC - [2009/10/02 19:03:37 | 00,519,168 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Amy & Greg\Desktop\OTL.exe

========== Win32 Services (SafeList) ==========

SRV - [2008/09/10 16:50:26 | 00,116,040 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device [Auto | Stopped])
SRV - [2004/07/15 01:49:26 | 00,032,768 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
SRV - [2004/08/25 13:26:56 | 00,389,120 | ---- | M] () -- C:\WINDOWS\System32\Ati2evxx.exe -- (Ati HotKey Poller [Auto | Stopped])
SRV - [2004/08/25 12:52:00 | 00,516,096 | ---- | M] () -- C:\WINDOWS\System32\ati2sgag.exe -- (ATI Smart [Auto | Stopped])
SRV - [2008/08/29 10:18:44 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service [Auto | Stopped])
SRV - [2003/02/20 10:21:16 | 00,046,080 | ---- | M] (C-Dilla Ltd) -- C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE -- (C-DillaSrv [Auto | Stopped])
SRV - [2005/09/30 20:22:50 | 00,096,341 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8 [Auto | Stopped])
SRV - File not found -- -- (CurtainsSysSvc [Auto | Stopped])
SRV - [2004/12/10 10:46:36 | 00,134,224 | ---- | M] (Command Software Systems, Inc.) -- C:\Program Files\Common Files\Command Software\dvpapi.exe -- (dvpapi [Auto | Stopped])
SRV - [2004/08/12 09:25:59 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2005/04/04 00:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped])
SRV - [2008/09/10 17:39:48 | 00,536,872 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service [On_Demand | Stopped])
SRV - [2005/11/24 17:03:22 | 00,053,337 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe -- (MSCSPTISRV [On_Demand | Stopped])
SRV - [2006/10/26 14:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped])
SRV - [2005/11/24 16:57:44 | 00,053,337 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe -- (PACSPTISVR [On_Demand | Stopped])
SRV - [2005/11/24 16:47:30 | 00,069,718 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -- (SPTISRV [On_Demand | Stopped])
SRV - [2006/01/06 22:25:12 | 00,069,632 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe -- (SSScsiSV [On_Demand | Stopped])
SRV - [2007/01/04 17:38:08 | 00,024,652 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe -- (Viewpoint Manager Service [Auto | Stopped])
SRV - [2009/04/21 18:26:52 | 04,048,240 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- (WebrootSpySweeperService [Auto | Running])
SRV - [2006/10/18 20:05:24 | 00,913,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped])
SRV - [2009/06/20 22:54:44 | 01,205,760 | ---- | M] (Webroot Software, Inc. ) -- C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe -- (WRConsumerService [Auto | Running])

========== Driver Services (SafeList) ==========

DRV - [2004/08/25 13:28:46 | 00,787,456 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\DRIVERS\ati2mtag.sys -- (ati2mtag [On_Demand | Stopped])
DRV - [2003/02/20 10:22:48 | 00,058,288 | ---- | M] (Macrovision) -- C:\WINDOWS\System32\drivers\CDANT.SYS -- (C-Dilla [On_Demand | Stopped])
DRV - [2004/12/10 10:30:48 | 00,707,176 | R--- | M] (Command Software Systems, Inc.) -- C:\WINDOWS\System32\DRIVERS\css-dvp.sys -- (CSS DVP [Auto | Stopped])
DRV - [2004/02/10 15:49:14 | 00,154,112 | ---- | M] (Intel Corporation) -- C:\WINDOWS\System32\DRIVERS\e100b325.sys -- (E100B [On_Demand | Running])
DRV - [2008/04/17 13:12:54 | 00,015,464 | ---- | M] (GEAR Software Inc.) -- C:\WINDOWS\System32\DRIVERS\GEARAspiWDM.sys -- (GEARAspiWDM [On_Demand | Running])
DRV - [2007/04/06 09:24:55 | 00,029,184 | ---- | M] (Gteko Ltd.) -- C:\WINDOWS\System32\DRIVERS\goprot51.sys -- (GoProto [On_Demand | Stopped])
DRV - [2004/11/10 08:50:52 | 00,032,256 | ---- | M] (Global RISC) -- C:\WINDOWS\System32\Drivers\GRTdiMon.sys -- (GRTdiMon [Auto | Stopped])
DRV - [2004/08/12 09:26:42 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2005/04/25 05:03:00 | 00,020,640 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running])
DRV - [2004/06/09 09:29:56 | 00,006,977 | ---- | M] (Gteko Ltd.) -- C:\WINDOWS\System32\DDMI2.sys -- (SDDMI2 [On_Demand | Stopped])
DRV - [2007/11/13 06:25:53 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [Auto | Stopped])
DRV - [2004/09/17 09:02:54 | 00,732,928 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\System32\drivers\senfilt.sys -- (senfilt [On_Demand | Stopped])
DRV - [2005/01/27 15:31:06 | 00,260,352 | ---- | M] (Analog Devices, Inc.) -- C:\WINDOWS\System32\drivers\smwdm.sys -- (smwdm [On_Demand | Stopped])
DRV - [2009/04/21 18:27:02 | 00,029,808 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\WINDOWS\system32\DRIVERS\ssfs0bbc.sys -- (ssfs0bbc [Boot | Running])
DRV - [2009/04/21 18:27:04 | 00,023,152 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\WINDOWS\SYSTEM32\Drivers\SSHRMD.SYS -- (SSHRMD [Boot | Running])
DRV - [2009/04/21 18:27:04 | 00,176,752 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\WINDOWS\SYSTEM32\Drivers\SSIDRV.SYS -- (SSIDRV [Boot | Running])
DRV - [2008/01/04 21:34:36 | 00,023,920 | ---- | M] (Webroot Software Inc (www.webroot.com)) -- C:\WINDOWS\System32\Drivers\sskbfd.sys -- (SSKBFD [On_Demand | Stopped])
DRV - [2007/10/31 15:09:14 | 00,030,464 | ---- | M] (Apple, Inc.) -- C:\WINDOWS\System32\Drivers\usbaapl.sys -- (USBAAPL [On_Demand | Stopped])

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch
IE - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\S-1-5-21-1390067357-2111687655-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\S-1-5-21-1390067357-2111687655-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

O1 HOSTS File: (813 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {40989f49-577e-406a-af72-fe14fa06f123} - File not found
O2 - BHO: (no name) - {4a967869-1ef3-41ff-b8b8-c8d3e51d2e94} - File not found
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {75279743-0cf9-4572-b99b-a3f5403ac425} - File not found
O2 - BHO: (no name) - {a8042716-16ed-4089-8579-c63a9b8d8948} - File not found
O3 - HKLM\..\Toolbar: (Ask.com Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - No CLSID value found.
O3 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\..\Toolbar\WebBrowser: (Ask.com Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [AuthConsoleStart] File not found
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [filit] C:\bak\foobar.exe ()
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [jehohahek] C:\WINDOWS\System32\tomavita.DLL File not found
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
O4 - HKLM..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe (Webroot Software, Inc.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [workflo] D:\install\workflow.exe File not found
O4 - HKU\S-1-5-19..\Run: [fetuyobegu] File not found
O4 - HKU\S-1-5-20..\Run: [fetuyobegu] File not found
O4 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 0
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disableregistrytools = 0
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disabletaskmgr = 0
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (America Online, Inc.)
O9 - Extra Button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll (Picasa, Inc.)
O9 - Extra 'Tools' menuitem : Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll (Picasa, Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} http://support.dell.com/systemprofiler/SysPro.CAB (SysProWmi Class)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/8/b...heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1B9935E4-8A50-4DD8-BD09-A7518723BF97} https://quicken.ehosts.net/netagent/objects/custappx3.cab (Talisma NetAgent Customer ActiveX Control version 3)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc2.cab (Office Update Installation Engine)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A30FBBDC-FA29-4606-8565-14AADCCA6708} https://photos.riteaid.com/control/RiteAidO...PhotoOnline.cab (Rite Aid One Hour Photo Online Control)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/pub/shock...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} http://cvs.pnimedia.com/upload/activex/v2_...upv2.0.0.10.cab? (Photo Upload Plugin Class)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (\system32\siriluje.dll) - File not found
O20 - AppInit_DLLs: (c:\windows\system32\nugebini.dll) - C:\WINDOWS\System32\nugebini.dll File not found
O20 - AppInit_DLLs: (c:\windows\system32\) - C:\WINDOWS\System32 [2009/10/02 19:01:45 | 00,000,000 | ---D | M]
O20 - AppInit_DLLs: (vajapaso.dll) - C:\WINDOWS\System32\vajapaso.dll ()
O20 - AppInit_DLLs: (c:\windows\system32\tomavita.dll) - C:\WINDOWS\System32\tomavita.dll File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\__c005163: DllName - C:\WINDOWS\system32\__c005163.dat - C:\WINDOWS\System32\__c005163.dat File not found
O21 - SSODL: dijebudih - {22f72728-9d58-465a-b50c-9a66aa4518c3} - C:\WINDOWS\System32\siriluje.dll File not found
O21 - SSODL: jezajadik - {a687e524-5b8b-4757-864f-6c7d50fac87d} - C:\WINDOWS\System32\nugebini.dll File not found
O21 - SSODL: nesitiwun - {ff742604-c228-402a-ae90-8117c7525f7a} - C:\WINDOWS\System32\gubebusi.dll File not found
O21 - SSODL: tejinezav - {220982da-8068-4a25-a324-cc1673fedb2b} - C:\WINDOWS\System32\tomavita.dll File not found
O22 - SharedTaskScheduler: {220982da-8068-4a25-a324-cc1673fedb2b} - mujuzedij - C:\WINDOWS\System32\tomavita.dll File not found
O22 - SharedTaskScheduler: {22f72728-9d58-465a-b50c-9a66aa4518c3} - gahurihor - C:\WINDOWS\System32\siriluje.dll File not found
O22 - SharedTaskScheduler: {a687e524-5b8b-4757-864f-6c7d50fac87d} - mujuzedij - C:\WINDOWS\System32\nugebini.dll File not found
O22 - SharedTaskScheduler: {ff742604-c228-402a-ae90-8117c7525f7a} - mujuzedij - C:\WINDOWS\System32\gubebusi.dll File not found
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O30 - LSA: Authentication Packages - (OWS\S) - File not found
O30 - LSA: Security Packages - (\ATI) - File not found
O30 - LSA: Security Packages - (CONTROL) - C:\WINDOWS\System32\CONTROL.exe (Microsoft Corporation)
O30 - LSA: Security Packages - (PANEL) - File not found
O30 - LSA: Security Packages - (soft) - File not found
O30 - LSA: Security Packages - (corpora) - File not found
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/06/21 00:21:09 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\WD SmartWare.exe -- File not found
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
O35 - comfile [open] -- "%1" %* File not found
O35 - exefile [open] -- "%1" %* File not found

========== Files/Folders - Created Within 30 Days ==========

[3 C:\WINDOWS\*.tmp files]
[2009/10/02 18:14:53 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/09/29 21:24:35 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2009/09/30 23:23:16 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Western Digital
[2009/10/02 18:14:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Amy & Greg\Application Data\Malwarebytes
[2009/09/30 23:22:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\Western Digital
[2009/10/02 18:14:53 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/09/29 21:24:35 | 00,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2009/09/30 22:27:20 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2009/10/02 19:03:36 | 00,519,168 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Amy & Greg\Desktop\OTL.exe
[2009/10/02 18:14:54 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/10/02 18:14:53 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/10/02 18:13:24 | 04,045,544 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Amy & Greg\Desktop\mbam-setup.exe
[2009/10/01 22:37:03 | 00,472,064 | ---- | C] ( ) -- C:\Documents and Settings\Amy & Greg\Desktop\RootRepeal.exe
[2009/09/30 23:43:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Amy & Greg\My Documents\Copy of BCBSRI
[2009/09/30 23:43:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Amy & Greg\My Documents\Copy of Addresses
[2009/09/28 23:22:56 | 00,000,000 | -HSD | C] -- C:\WINDOWS\CSC
[2005/06/23 23:58:28 | 00,151,552 | ---- | C] ( ) -- C:\WINDOWS\System32\ATIDEMGR.dll

========== Files - Modified Within 30 Days ==========

[1 C:\*.tmp files]
[1 C:\WINDOWS\System32\*.tmp files]
[3 C:\WINDOWS\*.tmp files]
[2009/10/02 19:03:37 | 00,519,168 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Amy & Greg\Desktop\OTL.exe
[2009/10/02 19:02:28 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/10/02 19:02:22 | 00,011,168 | -H-- | M] () -- C:\WINDOWS\System32\seyebajo
[2009/10/02 19:01:56 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/10/02 18:14:57 | 00,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/10/02 18:13:29 | 04,045,544 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Amy & Greg\Desktop\mbam-setup.exe
[2009/10/02 17:31:03 | 00,001,689 | ---- | M] () -- C:\WINDOWS\System32\gojobeju.cfg
[2009/10/02 17:31:03 | 00,000,234 | ---- | M] () -- C:\WINDOWS\System32\gojobeju.bat
[2009/10/02 17:30:53 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/10/02 17:30:52 | 00,038,400 | -HS- | M] () -- C:\WINDOWS\System32\borababu.dll
[2009/10/02 17:30:52 | 00,027,136 | -HS- | M] () -- C:\WINDOWS\System32\tepusiga.dll
[2009/10/01 23:26:10 | 00,000,218 | ---- | M] () -- C:\xcrashdump.dat
[2009/10/01 22:37:10 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\settings.dat
[2009/10/01 22:37:03 | 00,472,064 | ---- | M] ( ) -- C:\Documents and Settings\Amy & Greg\Desktop\RootRepeal.exe
[2009/10/01 22:34:30 | 00,361,369 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\dds.scr
[2009/10/01 21:29:51 | 00,026,624 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\My Documents\Will medication list for Farm School.doc
[2009/10/01 16:30:32 | 00,002,713 | -HS- | M] () -- C:\WINDOWS\System32\pidizowi.exe
[2009/09/30 23:43:10 | 00,000,468 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\My Documents\Shortcut to Addresses.lnk
[2009/09/30 22:28:53 | 00,050,688 | -HS- | M] () -- C:\WINDOWS\System32\jayoriji.dll
[2009/09/30 22:27:21 | 00,001,734 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\HijackThis.lnk
[2009/09/30 07:49:26 | 00,000,267 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2009/09/30 07:01:00 | 00,000,244 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2009/09/30 04:27:21 | 00,002,713 | -HS- | M] () -- C:\WINDOWS\System32\zilebobi.exe
[2009/09/30 01:36:08 | 00,000,552 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat
[2009/09/29 21:24:41 | 00,000,945 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\Spybot - Search & Destroy.lnk
[2009/09/28 21:22:59 | 00,262,146 | ---- | M] () -- C:\registrybackup.reg
[2009/09/28 20:53:03 | 00,001,917 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2009/09/28 17:04:17 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\41.exe
[2009/09/27 15:40:33 | 00,271,360 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\My Documents\backup inbox.pst
[2009/09/26 21:16:29 | 00,001,648 | ---- | M] () -- C:\WINDOWS\tasks\wrSpySweeper_LAF4985DAB3564EF0983B0A9F737C9B6D.job
[2009/09/20 18:46:33 | 00,020,480 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\Bill form.xls
[2009/09/15 22:31:06 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/09/15 21:08:19 | 00,870,128 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Application Data\mcs.rma
[2009/09/15 21:08:19 | 00,000,004 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Application Data\A8C0B6
[2009/09/14 23:13:48 | 00,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/09/14 21:40:53 | 00,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2009/09/12 13:19:31 | 00,002,497 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\Microsoft Office Word 2003 (2).lnk
[2009/09/10 14:54:06 | 00,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/09/10 14:53:50 | 00,019,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

========== Files - No Company Name ==========
[2100/02/24 14:15:04 | 00,000,821 | ---- | C] () -- C:\WINDOWS\Lexmark_ICM.ini
[2100/02/16 16:09:06 | 00,000,062 | ---- | C] () -- C:\WINDOWS\System32\LXASUSCI.INI
[2009/10/02 18:14:57 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/10/02 17:31:03 | 00,001,689 | ---- | C] () -- C:\WINDOWS\System32\gojobeju.cfg
[2009/10/02 17:31:03 | 00,000,234 | ---- | C] () -- C:\WINDOWS\System32\gojobeju.bat
[2009/10/01 22:37:10 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Desktop\settings.dat
[2009/10/01 22:34:29 | 00,361,369 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Desktop\dds.scr
[2009/10/01 16:30:32 | 00,002,713 | -HS- | C] () -- C:\WINDOWS\System32\pidizowi.exe
[2009/09/30 23:43:10 | 00,000,468 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\My Documents\Shortcut to Addresses.lnk
[2009/09/30 22:27:21 | 00,001,734 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Desktop\HijackThis.lnk
[2009/09/30 04:27:21 | 00,002,713 | -HS- | C] () -- C:\WINDOWS\System32\zilebobi.exe
[2009/09/30 01:36:08 | 00,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2009/09/30 01:26:55 | 00,000,218 | ---- | C] () -- C:\xcrashdump.dat
[2009/09/29 23:09:22 | 00,000,945 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Desktop\Spybot - Search & Destroy.lnk
[2009/09/29 22:43:43 | 00,000,267 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2009/09/28 21:22:59 | 00,262,146 | ---- | C] () -- C:\registrybackup.reg
[2009/09/28 16:43:19 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\41.exe
[2009/08/28 22:08:06 | 00,017,271 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\qaginenez._dl
[2009/08/28 22:08:06 | 00,011,262 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\ofiq.reg
[2009/08/28 22:08:05 | 00,018,009 | ---- | C] () -- C:\Program Files\Common Files\syqaf.pif
[2009/08/28 22:08:05 | 00,017,219 | ---- | C] () -- C:\WINDOWS\onokukesy.sys
[2009/08/28 22:08:05 | 00,015,966 | ---- | C] () -- C:\Program Files\Common Files\ezepagudyn.exe
[2009/08/28 22:08:05 | 00,015,445 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\melolobow.reg
[2009/08/28 22:08:05 | 00,013,823 | ---- | C] () -- C:\Program Files\Common Files\ocynyroq.sys
[2009/08/28 22:08:05 | 00,012,384 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hasez.lib
[2009/08/28 22:08:05 | 00,011,974 | ---- | C] () -- C:\Program Files\Common Files\ugad.bat
[2009/08/28 22:08:05 | 00,011,195 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Application Data\exin.bin
[2009/08/28 22:08:05 | 00,011,183 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\ebyq.scr
[2009/08/28 22:08:05 | 00,010,997 | ---- | C] () -- C:\Program Files\Common Files\ujumylalu.dat
[2009/07/02 17:30:51 | 00,038,400 | -HS- | C] () -- C:\WINDOWS\System32\borababu.dll
[2009/07/02 17:30:51 | 00,027,136 | -HS- | C] () -- C:\WINDOWS\System32\tepusiga.dll
[2009/06/30 22:29:03 | 00,050,688 | -HS- | C] () -- C:\WINDOWS\System32\vajapaso.dll
[2009/06/30 22:29:03 | 00,050,688 | -HS- | C] () -- C:\WINDOWS\System32\kihugali.dll
[2009/06/30 22:29:03 | 00,050,688 | -HS- | C] () -- C:\WINDOWS\System32\botapepe.dll
[2009/06/30 22:28:22 | 00,050,688 | -HS- | C] () -- C:\WINDOWS\System32\jayoriji.dll
[2009/04/15 21:43:11 | 00,870,128 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Application Data\mcs.rma
[2009/04/15 21:43:11 | 00,000,004 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Application Data\A8C0B6
[2009/04/03 19:41:06 | 00,000,133 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\fusioncache.dat
[2008/02/16 19:25:42 | 00,000,412 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2008/02/13 20:26:28 | 00,000,004 | RHS- | C] () -- C:\Documents and Settings\All Users\Application Data\sysqcl1129139270.dat
[2007/06/09 15:44:08 | 00,524,288 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2007/06/09 15:44:08 | 00,139,264 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2007/05/13 20:58:44 | 00,098,304 | ---- | C] () -- C:\WINDOWS\System32\resourceGeneric.dll
[2006/10/29 09:02:53 | 00,684,032 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
[2006/10/29 09:02:53 | 00,155,648 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll
[2006/08/20 11:42:55 | 00,056,320 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll
[2006/07/16 16:44:18 | 00,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll
[2006/07/16 16:44:18 | 00,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll
[2006/07/16 16:44:18 | 00,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll
[2006/07/16 16:42:54 | 00,000,197 | ---- | C] () -- C:\WINDOWS\disneysy.ini
[2006/03/25 12:09:31 | 00,201,216 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/01/11 04:00:53 | 00,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2005/12/16 14:48:29 | 00,000,029 | ---- | C] () -- C:\WINDOWS\atid.ini
[2005/12/06 20:57:17 | 00,002,528 | ---- | C] () -- C:\WINDOWS\FCIC.INI
[2005/10/28 13:46:17 | 00,000,078 | ---- | C] () -- C:\WINDOWS\TONKA.INI
[2005/10/23 23:29:56 | 00,102,912 | ---- | C] () -- C:\WINDOWS\System32\islzma.dll
[2005/10/23 23:29:54 | 00,684,032 | ---- | C] () -- C:\WINDOWS\libeay32.dll
[2005/10/23 23:29:54 | 00,155,648 | ---- | C] () -- C:\WINDOWS\ssleay32.dll
[2005/10/23 08:38:15 | 00,000,000 | ---- | C] () -- C:\WINDOWS\SETUP32.INI
[2005/10/22 19:15:55 | 00,003,636 | ---- | C] () -- C:\WINDOWS\disney.ini
[2005/10/18 20:09:32 | 00,000,222 | ---- | C] () -- C:\WINDOWS\Quicken.ini
[2005/09/20 18:51:14 | 00,012,288 | ---- | C] () -- C:\WINDOWS\System32\Hlinkprx.dll
[2005/09/15 22:40:14 | 00,003,392 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2005/08/18 18:31:47 | 00,000,750 | ---- | C] () -- C:\WINDOWS\hegames.ini
[2005/07/13 23:50:25 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/07/09 10:27:30 | 00,001,681 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2005/07/08 18:59:26 | 00,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
[2005/06/24 22:34:04 | 00,000,020 | ---- | C] () -- C:\WINDOWS\ACMonitor_X83.ini
[2005/06/24 22:30:07 | 00,004,672 | ---- | C] () -- C:\WINDOWS\System32\LXASUSCI.DLL
[2005/06/24 00:02:58 | 00,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
[2005/06/23 23:58:28 | 00,086,016 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.dll
[2005/06/23 23:57:34 | 00,074,632 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2005/06/21 00:31:05 | 05,366,470 | -H-- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\IconCache.db
[2005/06/21 00:28:23 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\Amy & Greg\Application Data\desktop.ini
[2005/06/20 19:32:40 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini
[2005/06/11 12:47:00 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\fpprintmon.dll
[2005/04/14 17:01:34 | 00,032,768 | R--- | C] () -- C:\WINDOWS\System32\dwsvclnt.dll
[2004/08/12 09:33:16 | 00,000,736 | ---- | C] () -- C:\WINDOWS\win.ini
[2004/08/12 09:30:36 | 00,000,243 | ---- | C] () -- C:\WINDOWS\SYSTEM.INI
[2003/01/07 15:05:08 | 00,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/04/10 13:11:04 | 00,000,194 | ---- | C] () -- C:\WINDOWS\X83_DS.ini
[2002/03/04 22:33:24 | 00,102,400 | ---- | C] () -- C:\WINDOWS\System32\LXASBCE.DLL
[2001/03/05 14:07:22 | 00,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXASICO.DLL
[2001/01/05 13:34:30 | 00,016,812 | ---- | C] () -- C:\WINDOWS\System32\lxas2kpm.dll
[2001/01/05 12:08:02 | 00,008,427 | ---- | C] () -- C:\WINDOWS\System32\lxas2kui.dll
[2000/10/24 09:08:36 | 00,118,784 | ---- | C] () -- C:\WINDOWS\System32\LFKODAK.DLL
[2000/10/24 09:08:33 | 00,338,944 | ---- | C] () -- C:\WINDOWS\System32\lffpx7.dll
[1997/10/24 14:56:36 | 00,000,643 | ---- | C] () -- C:\WINDOWS\LEXSTAT.INI
< End of report >

Again, thanks! I'll be out for a little while, but I look forward to your next post.

Greg

#4 Buckeye_Sam

Malware Expert

Members
17,382 posts
OFFLINE

Gender:Male
Location:Pickerington, Ohio
Local time:12:24 PM

Posted 03 October 2009 - 09:23 AM

Go ahead and boot into normal mode now and then run through the same steps - run Malwarebytes to remove anything it finds and then create a new log for OTL. Please post both logs.

#5 ag24

Topic Starter

Members
10 posts
OFFLINE

Local time:01:24 PM

Posted 03 October 2009 - 02:45 PM

Hi Sam.

I ran MBAM and OTL again. After I ran MBAM and rebooted, a number of error messages popped up. Each box frame said: "lsass.exe - Bad Image" or "net.exe - Bad Image" or "userinit.exe - Bad Image" etc. (a bunch of .exe files). Inside the box the message was "The application or DLL c:\Windows\system 32\bapenuge.dll is not a valid Windows image. Please check this against installation diskette" or the same message, but substitute "robejaku.dll". Also, after running OTL, this message appeared: "Access violation at address 00563528 in module OTL.exe. Read of address 00000000"

Here's my MBAM log:

Malwarebytes' Anti-Malware 1.41
Database version: 2896
Windows 5.1.2600 Service Pack 2

10/3/2009 1:35:14 PM
mbam-log-2009-10-03 (13-35-14).txt

Scan type: Quick Scan
Objects scanned: 183922
Time elapsed: 1 hour(s), 2 minute(s), 45 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 2
Registry Keys Infected: 1
Registry Values Infected: 3
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
c:\WINDOWS\system32\robejaku.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\bapenuge.dll (Trojan.Vundo) -> Delete on reboot.

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{157ec1a2-48f5-4e8e-bb22-6d50d27e27c8} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jehohahek (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{157ec1a2-48f5-4e8e-bb22-6d50d27e27c8} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\bodenezol (Trojan.Vundo.H) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\robejaku.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\robejaku.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\WINDOWS\system32\robejaku.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\bapenuge.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\yifiroso.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

Here's my OTL log:

OTL logfile created on: 10/3/2009 3:34:10 PM - Run 2
OTL by OldTimer - Version 3.0.18.0 Folder = C:\Documents and Settings\Amy & Greg\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.07 Mb Total Physical Memory | 191.53 Mb Available Physical Memory | 37.55% Memory free
1.35 Gb Paging File | 1.10 Gb Available in Paging File | 81.75% Paging File free
Paging file location(s): C:\pagefile.sys 900 1800 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.82 Gb Total Space | 68.46 Gb Free Space | 29.41% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 991.22 Mb Total Space | 905.48 Mb Free Space | 91.35% Space Free | Partition Type: FAT
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HOME
Current User Name: Amy & Greg
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2009/06/20 22:54:44 | 01,205,760 | ---- | M] (Webroot Software, Inc. ) -- C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
PRC - [2004/08/25 13:26:56 | 00,389,120 | ---- | M] () -- C:\WINDOWS\System32\Ati2evxx.exe
PRC - [2008/09/10 16:50:26 | 00,116,040 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2008/08/29 10:18:44 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2003/02/20 10:21:16 | 00,046,080 | ---- | M] (C-Dilla Ltd) -- C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
PRC - [2004/12/10 10:46:36 | 00,134,224 | ---- | M] (Command Software Systems, Inc.) -- C:\Program Files\Common Files\Command Software\dvpapi.exe
PRC - [2007/01/04 17:38:08 | 00,024,652 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe
PRC - [2009/04/21 18:26:52 | 04,048,240 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
PRC - [2005/09/30 20:22:50 | 00,096,341 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe
PRC - [2007/06/13 06:23:07 | 01,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2005/10/19 19:33:24 | 00,186,368 | ---- | M] () -- C:\bak\foobar.exe
PRC - [2007/04/03 21:50:00 | 01,603,152 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
PRC - [2007/02/04 13:02:14 | 00,079,400 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
PRC - [2008/09/10 17:40:06 | 00,289,576 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunesHelper.exe
PRC - [2009/05/13 15:40:08 | 06,345,840 | ---- | M] (Webroot Software, Inc.) -- C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
PRC - [2005/09/23 23:05:26 | 00,029,696 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
PRC - [2007/01/04 17:38:18 | 00,112,336 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
PRC - [2008/09/10 17:39:48 | 00,536,872 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe
PRC - [2009/10/02 19:03:37 | 00,519,168 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Amy & Greg\Desktop\OTL.exe
PRC - [2009/04/21 18:26:50 | 00,165,232 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\Program Files\Webroot\Spy Sweeper\SSU.EXE

========== Win32 Services (SafeList) ==========

SRV - [2008/09/10 16:50:26 | 00,116,040 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device [Auto | Running])
SRV - [2004/07/15 01:49:26 | 00,032,768 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
SRV - [2004/08/25 13:26:56 | 00,389,120 | ---- | M] () -- C:\WINDOWS\System32\Ati2evxx.exe -- (Ati HotKey Poller [Auto | Running])
SRV - [2004/08/25 12:52:00 | 00,516,096 | ---- | M] () -- C:\WINDOWS\System32\ati2sgag.exe -- (ATI Smart [Auto | Stopped])
SRV - [2008/08/29 10:18:44 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service [Auto | Running])
SRV - [2003/02/20 10:21:16 | 00,046,080 | ---- | M] (C-Dilla Ltd) -- C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE -- (C-DillaSrv [Auto | Running])
SRV - [2005/09/30 20:22:50 | 00,096,341 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8 [Auto | Running])
SRV - File not found -- -- (CurtainsSysSvc [Auto | Stopped])
SRV - [2004/12/10 10:46:36 | 00,134,224 | ---- | M] (Command Software Systems, Inc.) -- C:\Program Files\Common Files\Command Software\dvpapi.exe -- (dvpapi [Auto | Running])
SRV - [2004/08/12 09:25:59 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2005/04/04 00:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped])
SRV - [2008/09/10 17:39:48 | 00,536,872 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service [On_Demand | Running])
SRV - [2005/11/24 17:03:22 | 00,053,337 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe -- (MSCSPTISRV [On_Demand | Stopped])
SRV - [2006/10/26 14:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped])
SRV - [2005/11/24 16:57:44 | 00,053,337 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe -- (PACSPTISVR [On_Demand | Stopped])
SRV - [2005/11/24 16:47:30 | 00,069,718 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -- (SPTISRV [On_Demand | Stopped])
SRV - [2006/01/06 22:25:12 | 00,069,632 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe -- (SSScsiSV [On_Demand | Stopped])
SRV - [2007/01/04 17:38:08 | 00,024,652 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe -- (Viewpoint Manager Service [Auto | Running])
SRV - [2009/04/21 18:26:52 | 04,048,240 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- (WebrootSpySweeperService [Auto | Running])
SRV - [2006/10/18 20:05:24 | 00,913,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped])
SRV - [2009/06/20 22:54:44 | 01,205,760 | ---- | M] (Webroot Software, Inc. ) -- C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe -- (WRConsumerService [Auto | Running])

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch
IE - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\S-1-5-21-1390067357-2111687655-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\S-1-5-21-1390067357-2111687655-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

O1 HOSTS File: (813 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {40989f49-577e-406a-af72-fe14fa06f123} - File not found
O2 - BHO: (no name) - {4a967869-1ef3-41ff-b8b8-c8d3e51d2e94} - File not found
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {75279743-0cf9-4572-b99b-a3f5403ac425} - File not found
O2 - BHO: (no name) - {a8042716-16ed-4089-8579-c63a9b8d8948} - File not found
O3 - HKLM\..\Toolbar: (Ask.com Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - No CLSID value found.
O3 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\..\Toolbar\WebBrowser: (Ask.com Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [AuthConsoleStart] File not found
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [filit] C:\bak\foobar.exe ()
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
O4 - HKLM..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe (Webroot Software, Inc.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [workflo] D:\install\workflow.exe File not found
O4 - HKU\S-1-5-19..\Run: [fetuyobegu] File not found
O4 - HKU\S-1-5-20..\Run: [fetuyobegu] File not found
O4 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 0
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disableregistrytools = 0
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disabletaskmgr = 0
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (America Online, Inc.)
O9 - Extra Button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll (Picasa, Inc.)
O9 - Extra 'Tools' menuitem : Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll (Picasa, Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} http://support.dell.com/systemprofiler/SysPro.CAB (SysProWmi Class)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/8/b...heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1B9935E4-8A50-4DD8-BD09-A7518723BF97} https://quicken.ehosts.net/netagent/objects/custappx3.cab (Talisma NetAgent Customer ActiveX Control version 3)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc2.cab (Office Update Installation Engine)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A30FBBDC-FA29-4606-8565-14AADCCA6708} https://photos.riteaid.com/control/RiteAidO...PhotoOnline.cab (Rite Aid One Hour Photo Online Control)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/pub/shock...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} http://cvs.pnimedia.com/upload/activex/v2_...upv2.0.0.10.cab? (Photo Upload Plugin Class)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (\system32\siriluje.dll) - File not found
O20 - AppInit_DLLs: (c:\windows\system32\nugebini.dll) - C:\WINDOWS\System32\nugebini.dll File not found
O20 - AppInit_DLLs: (c:\windows\system32\) - C:\WINDOWS\System32 [2009/10/03 15:31:46 | 00,000,000 | ---D | M]
O20 - AppInit_DLLs: (bapenuge.dll) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O21 - SSODL: dijebudih - {22f72728-9d58-465a-b50c-9a66aa4518c3} - C:\WINDOWS\System32\siriluje.dll File not found
O21 - SSODL: jezajadik - {a687e524-5b8b-4757-864f-6c7d50fac87d} - C:\WINDOWS\System32\nugebini.dll File not found
O21 - SSODL: nesitiwun - {ff742604-c228-402a-ae90-8117c7525f7a} - C:\WINDOWS\System32\gubebusi.dll File not found
O22 - SharedTaskScheduler: {22f72728-9d58-465a-b50c-9a66aa4518c3} - gahurihor - C:\WINDOWS\System32\siriluje.dll File not found
O22 - SharedTaskScheduler: {a687e524-5b8b-4757-864f-6c7d50fac87d} - mujuzedij - C:\WINDOWS\System32\nugebini.dll File not found
O22 - SharedTaskScheduler: {ff742604-c228-402a-ae90-8117c7525f7a} - mujuzedij - C:\WINDOWS\System32\gubebusi.dll File not found
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O30 - LSA: Authentication Packages - (OWS\S) - File not found
O30 - LSA: Security Packages - (\ATI) - File not found
O30 - LSA: Security Packages - (CONTROL) - C:\WINDOWS\System32\CONTROL.exe (Microsoft Corporation)
O30 - LSA: Security Packages - (PANEL) - File not found
O30 - LSA: Security Packages - (soft) - File not found
O30 - LSA: Security Packages - (corpora) - File not found
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/06/21 00:21:09 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\WD SmartWare.exe -- File not found
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
O35 - comfile [open] -- "%1" %* File not found
O35 - exefile [open] -- "%1" %* File not found

========== Files/Folders - Created Within 14 Days ==========

[3 C:\WINDOWS\*.tmp files]
[2009/10/02 18:14:53 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/09/29 21:24:35 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2009/09/30 23:23:16 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Western Digital
[2009/10/02 18:14:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Amy & Greg\Application Data\Malwarebytes
[2009/09/30 23:22:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\Western Digital
[2009/10/02 18:14:53 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/09/29 21:24:35 | 00,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2009/09/30 22:27:20 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2009/10/02 19:03:36 | 00,519,168 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Amy & Greg\Desktop\OTL.exe
[2009/10/02 18:14:54 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/10/02 18:14:53 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/10/02 18:13:24 | 04,045,544 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Amy & Greg\Desktop\mbam-setup.exe
[2009/10/01 22:37:03 | 00,472,064 | ---- | C] ( ) -- C:\Documents and Settings\Amy & Greg\Desktop\RootRepeal.exe
[2009/09/30 23:43:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Amy & Greg\My Documents\Copy of BCBSRI
[2009/09/30 23:43:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Amy & Greg\My Documents\Copy of Addresses
[2009/09/28 23:22:56 | 00,000,000 | -HSD | C] -- C:\WINDOWS\CSC

========== Files - Modified Within 14 Days ==========

[1 C:\*.tmp files]
[4 C:\WINDOWS\System32\*.tmp files]
[3 C:\WINDOWS\*.tmp files]
[2009/10/03 15:33:52 | 00,011,168 | -H-- | M] () -- C:\WINDOWS\System32\seyebajo
[2009/10/03 15:29:18 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/10/03 15:28:49 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/10/03 15:28:34 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/10/03 13:01:02 | 00,000,244 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2009/10/03 12:30:39 | 00,001,648 | ---- | M] () -- C:\WINDOWS\tasks\wrSpySweeper_LAF4985DAB3564EF0983B0A9F737C9B6D.job
[2009/10/03 12:28:59 | 00,052,224 | -HS- | M] () -- C:\WINDOWS\System32\garayudi.dll
[2009/10/02 19:03:37 | 00,519,168 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Amy & Greg\Desktop\OTL.exe
[2009/10/02 18:14:57 | 00,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/10/02 18:13:29 | 04,045,544 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Amy & Greg\Desktop\mbam-setup.exe
[2009/10/02 17:31:03 | 00,001,689 | ---- | M] () -- C:\WINDOWS\System32\gojobeju.cfg
[2009/10/02 17:31:03 | 00,000,234 | ---- | M] () -- C:\WINDOWS\System32\gojobeju.bat
[2009/10/02 17:30:52 | 00,038,400 | -HS- | M] () -- C:\WINDOWS\System32\borababu.dll
[2009/10/02 17:30:52 | 00,027,136 | -HS- | M] () -- C:\WINDOWS\System32\tepusiga.dll
[2009/10/01 23:26:10 | 00,000,218 | ---- | M] () -- C:\xcrashdump.dat
[2009/10/01 22:37:10 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\settings.dat
[2009/10/01 22:37:03 | 00,472,064 | ---- | M] ( ) -- C:\Documents and Settings\Amy & Greg\Desktop\RootRepeal.exe
[2009/10/01 22:34:30 | 00,361,369 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\dds.scr
[2009/10/01 21:29:51 | 00,026,624 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\My Documents\Will medication list for Farm School.doc
[2009/10/01 16:30:32 | 00,002,713 | -HS- | M] () -- C:\WINDOWS\System32\pidizowi.exe
[2009/09/30 23:43:10 | 00,000,468 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\My Documents\Shortcut to Addresses.lnk
[2009/09/30 22:28:53 | 00,050,688 | -HS- | M] () -- C:\WINDOWS\System32\jayoriji.dll
[2009/09/30 22:27:21 | 00,001,734 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\HijackThis.lnk
[2009/09/30 07:49:26 | 00,000,267 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2009/09/30 04:27:21 | 00,002,713 | -HS- | M] () -- C:\WINDOWS\System32\zilebobi.exe
[2009/09/30 01:36:08 | 00,000,552 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat
[2009/09/29 21:24:41 | 00,000,945 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\Spybot - Search & Destroy.lnk
[2009/09/28 21:22:59 | 00,262,146 | ---- | M] () -- C:\registrybackup.reg
[2009/09/28 20:53:03 | 00,001,917 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2009/09/28 17:04:17 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\41.exe
[2009/09/27 15:40:33 | 00,271,360 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\My Documents\backup inbox.pst
[2009/09/20 18:46:33 | 00,020,480 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\Bill form.xls

========== Files - No Company Name ==========
[2100/02/24 14:15:04 | 00,000,821 | ---- | C] () -- C:\WINDOWS\Lexmark_ICM.ini
[2100/02/16 16:09:06 | 00,000,062 | ---- | C] () -- C:\WINDOWS\System32\LXASUSCI.INI
[2009/10/02 18:14:57 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/10/02 17:31:03 | 00,001,689 | ---- | C] () -- C:\WINDOWS\System32\gojobeju.cfg
[2009/10/02 17:31:03 | 00,000,234 | ---- | C] () -- C:\WINDOWS\System32\gojobeju.bat
[2009/10/01 22:37:10 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Desktop\settings.dat
[2009/10/01 22:34:29 | 00,361,369 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Desktop\dds.scr
[2009/10/01 16:30:32 | 00,002,713 | -HS- | C] () -- C:\WINDOWS\System32\pidizowi.exe
[2009/09/30 23:43:10 | 00,000,468 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\My Documents\Shortcut to Addresses.lnk
[2009/09/30 22:27:21 | 00,001,734 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Desktop\HijackThis.lnk
[2009/09/30 04:27:21 | 00,002,713 | -HS- | C] () -- C:\WINDOWS\System32\zilebobi.exe
[2009/09/30 01:36:08 | 00,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2009/09/30 01:26:55 | 00,000,218 | ---- | C] () -- C:\xcrashdump.dat
[2009/09/29 23:09:22 | 00,000,945 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Desktop\Spybot - Search & Destroy.lnk
[2009/09/29 22:43:43 | 00,000,267 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2009/09/28 21:22:59 | 00,262,146 | ---- | C] () -- C:\registrybackup.reg
[2009/09/28 16:43:19 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\41.exe
[2009/08/28 22:08:06 | 00,017,271 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\qaginenez._dl
[2009/08/28 22:08:06 | 00,011,262 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\ofiq.reg
[2009/08/28 22:08:05 | 00,018,009 | ---- | C] () -- C:\Program Files\Common Files\syqaf.pif
[2009/08/28 22:08:05 | 00,015,966 | ---- | C] () -- C:\Program Files\Common Files\ezepagudyn.exe
[2009/08/28 22:08:05 | 00,015,445 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\melolobow.reg
[2009/08/28 22:08:05 | 00,013,823 | ---- | C] () -- C:\Program Files\Common Files\ocynyroq.sys
[2009/08/28 22:08:05 | 00,012,384 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hasez.lib
[2009/08/28 22:08:05 | 00,011,974 | ---- | C] () -- C:\Program Files\Common Files\ugad.bat
[2009/08/28 22:08:05 | 00,011,195 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Application Data\exin.bin
[2009/08/28 22:08:05 | 00,011,183 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\ebyq.scr
[2009/08/28 22:08:05 | 00,010,997 | ---- | C] () -- C:\Program Files\Common Files\ujumylalu.dat
[2009/04/15 21:43:11 | 00,870,128 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Application Data\mcs.rma
[2009/04/15 21:43:11 | 00,000,004 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Application Data\A8C0B6
[2009/04/03 19:41:06 | 00,000,133 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\fusioncache.dat
[2008/02/13 20:26:28 | 00,000,004 | RHS- | C] () -- C:\Documents and Settings\All Users\Application Data\sysqcl1129139270.dat
[2006/03/25 12:09:31 | 00,201,216 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/09/15 22:40:14 | 00,003,392 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2005/06/23 23:57:34 | 00,074,632 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2005/06/21 00:31:05 | 05,366,470 | -H-- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\IconCache.db
[2005/06/21 00:28:23 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\Amy & Greg\Application Data\desktop.ini
[2005/06/20 19:32:40 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini

========== LOP Check ==========

[2007/04/06 09:27:02 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Administrator\Application Data
[2005/10/22 00:35:08 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Aim
[2009/10/02 18:14:53 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\All Users\Application Data
[2008/09/13 16:43:49 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[2008/01/03 22:52:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Age of Empires 3
[2005/06/24 00:26:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Authentium
[2007/06/09 15:46:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVS4YOU
[2008/02/16 19:20:47 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ
[2005/12/31 10:28:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Disney Interactive
[2005/12/06 20:57:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FirstClass
[2005/10/18 20:09:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Intuit
[2008/02/16 19:25:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft
[2007/04/17 20:50:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Trymedia
[2007/01/11 20:19:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/09/30 23:23:16 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Western Digital
[2009/10/02 18:14:59 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Amy & Greg\Application Data
[2005/10/19 21:26:03 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Amy & Greg\Application Data\Aim
[2008/05/17 23:14:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Amy & Greg\Application Data\Canon
[2005/07/08 19:29:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Amy & Greg\Application Data\CyberLink
[2005/10/18 20:08:47 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Amy & Greg\Application Data\Intuit
[2008/02/16 19:25:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Amy & Greg\Application Data\ScanSoft
[2007/04/16 23:35:47 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Amy & Greg\Application Data\U3
[2008/09/20 23:14:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Amy & Greg\Application Data\Viewpoint
[2007/04/06 09:27:02 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Default User\Application Data
[2008/12/20 22:37:40 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Guest\Application Data
[2005/09/10 22:14:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Guest\Application Data\Aim
[2009/09/29 22:43:36 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Janie\Application Data
[2005/12/16 14:51:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Janie\Application Data\acccore
[2005/07/05 15:14:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Janie\Application Data\Aim
[2008/03/09 12:03:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Janie\Application Data\Canon
[2009/09/23 21:07:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Janie\Application Data\Common Files
[2007/02/03 18:12:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Janie\Application Data\CyberLink
[2007/11/17 20:36:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Janie\Application Data\Jane s Hotel
[2009/02/24 20:38:48 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\Janie\Application Data\Move Networks
[2007/04/15 21:39:01 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Janie\Application Data\U3
[2007/01/11 20:19:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Janie\Application Data\Viewpoint
[2005/10/23 23:30:17 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data
[2005/06/21 00:24:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data
[2008/12/27 12:15:57 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Will\Application Data
[2007/01/31 21:37:51 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Will\Application Data\3DMaker
[2005/11/08 09:51:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Will\Application Data\Aim
[2007/06/14 15:45:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Will\Application Data\AVS4YOU
[2007/08/20 18:08:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Will\Application Data\Backyard Baseball 2007
[2008/12/01 21:47:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Will\Application Data\Canon
[2005/09/23 20:27:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Will\Application Data\CyberLink
[2007/04/18 20:34:56 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Will\Application Data\SBTT
[2007/06/09 16:02:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Will\Application Data\STOIK
[2007/03/27 20:23:49 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Will\Application Data\U3
[2009/09/15 22:31:06 | 00,000,284 | ---- | M] () -- C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
[2004/08/12 09:23:47 | 00,000,065 | RH-- | M] () -- C:\WINDOWS\Tasks\desktop.ini
[2009/10/03 15:28:49 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\Tasks\SA.DAT
[2009/10/03 13:01:02 | 00,000,244 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
[2009/10/03 12:30:39 | 00,001,648 | ---- | M] () -- C:\WINDOWS\Tasks\wrSpySweeper_LAF4985DAB3564EF0983B0A9F737C9B6D.job

========== Purity Check ==========

< End of report >

Thanks for your help!

Greg

#6 Buckeye_Sam

Malware Expert

Members
17,382 posts
OFFLINE

Gender:Male
Location:Pickerington, Ohio
Local time:12:24 PM

Posted 03 October 2009 - 05:07 PM

Run OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
PRC - [2005/10/19 19:33:24 | 00,186,368 | ---- | M] () -- C:\bak\foobar.exe
O2 - BHO: (no name) - {40989f49-577e-406a-af72-fe14fa06f123} - File not found
O2 - BHO: (no name) - {4a967869-1ef3-41ff-b8b8-c8d3e51d2e94} - File not found
O2 - BHO: (no name) - {75279743-0cf9-4572-b99b-a3f5403ac425} - File not found
O2 - BHO: (no name) - {a8042716-16ed-4089-8579-c63a9b8d8948} - File not found
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - No CLSID value found.
O3 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: [filit] C:\bak\foobar.exe ()
O4 - HKLM..\Run: [workflo] D:\install\workflow.exe File not found
O4 - HKU\S-1-5-19..\Run: [fetuyobegu] File not found
O4 - HKU\S-1-5-20..\Run: [fetuyobegu] File not found
O20 - AppInit_DLLs: (\system32\siriluje.dll) - File not found
O20 - AppInit_DLLs: (c:\windows\system32\nugebini.dll) - C:\WINDOWS\System32\nugebini.dll File not found
O20 - AppInit_DLLs: (bapenuge.dll) - File not found
O21 - SSODL: dijebudih - {22f72728-9d58-465a-b50c-9a66aa4518c3} - C:\WINDOWS\System32\siriluje.dll File not found
O21 - SSODL: jezajadik - {a687e524-5b8b-4757-864f-6c7d50fac87d} - C:\WINDOWS\System32\nugebini.dll File not found
O21 - SSODL: nesitiwun - {ff742604-c228-402a-ae90-8117c7525f7a} - C:\WINDOWS\System32\gubebusi.dll File not found
O22 - SharedTaskScheduler: {22f72728-9d58-465a-b50c-9a66aa4518c3} - gahurihor - C:\WINDOWS\System32\siriluje.dll File not found
O22 - SharedTaskScheduler: {a687e524-5b8b-4757-864f-6c7d50fac87d} - mujuzedij - C:\WINDOWS\System32\nugebini.dll File not found
O22 - SharedTaskScheduler: {ff742604-c228-402a-ae90-8117c7525f7a} - mujuzedij - C:\WINDOWS\System32\gubebusi.dll File not found

:Files
C:\WINDOWS\System32\garayudi.dll
C:\WINDOWS\System32\gojobeju.cfg
C:\WINDOWS\System32\gojobeju.bat
C:\WINDOWS\System32\borababu.dll
C:\WINDOWS\System32\tepusiga.dll
C:\WINDOWS\System32\pidizowi.exe
C:\WINDOWS\System32\jayoriji.dll
C:\WINDOWS\System32\zilebobi.exe
C:\WINDOWS\System32\41.exe

:Commands
[purity]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
You will get a log that shows the results of the fix. Please post it.
Then also run and post a new OTL log.

====================

Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan

Tick the box next to YES, I accept the Terms of Use
Click Start
When asked, allow the ActiveX control to install
Click Start
Make sure that the options Remove found threats and the option Scan unwanted applications is checked
Click Scan (This scan can take several hours, so please be patient)
Once the scan is completed, you may close the window
Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic

#7 ag24

Topic Starter

Members
10 posts
OFFLINE

Local time:01:24 PM

Posted 03 October 2009 - 07:54 PM

OK -- Here we go!

Fix log:

All processes killed
========== OTL ==========
Process foobar.exe killed successfully!
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{40989f49-577e-406a-af72-fe14fa06f123}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40989f49-577e-406a-af72-fe14fa06f123}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4a967869-1ef3-41ff-b8b8-c8d3e51d2e94}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4a967869-1ef3-41ff-b8b8-c8d3e51d2e94}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75279743-0cf9-4572-b99b-a3f5403ac425}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75279743-0cf9-4572-b99b-a3f5403ac425}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a8042716-16ed-4089-8579-c63a9b8d8948}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a8042716-16ed-4089-8579-c63a9b8d8948}\ deleted successfully.
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{DE9C389F-3316-41A7-809B-AA305ED9D922} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DE9C389F-3316-41A7-809B-AA305ED9D922}\ not found.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{DE9C389F-3316-41A7-809B-AA305ED9D922} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DE9C389F-3316-41A7-809B-AA305ED9D922}\ not found.
Registry value HKEY_USERS\S-1-5-21-1390067357-2111687655-839522115-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\filit deleted successfully.
C:\bak\foobar.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\workflo deleted successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run\\fetuyobegu deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run\\fetuyobegu deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:\system32\siriluje.dll deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:c:\windows\system32\nugebini.dll deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:bapenuge.dll deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\dijebudih deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22f72728-9d58-465a-b50c-9a66aa4518c3}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\jezajadik deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a687e524-5b8b-4757-864f-6c7d50fac87d}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\nesitiwun deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ff742604-c228-402a-ae90-8117c7525f7a}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{22f72728-9d58-465a-b50c-9a66aa4518c3} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22f72728-9d58-465a-b50c-9a66aa4518c3}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{a687e524-5b8b-4757-864f-6c7d50fac87d} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a687e524-5b8b-4757-864f-6c7d50fac87d}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{ff742604-c228-402a-ae90-8117c7525f7a} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ff742604-c228-402a-ae90-8117c7525f7a}\ not found.
========== FILES ==========
DllUnregisterServer procedure not found in C:\WINDOWS\System32\garayudi.dll
C:\WINDOWS\System32\garayudi.dll NOT unregistered.
C:\WINDOWS\System32\garayudi.dll moved successfully.
C:\WINDOWS\System32\gojobeju.cfg moved successfully.
C:\WINDOWS\System32\gojobeju.bat moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\System32\borababu.dll
C:\WINDOWS\System32\borababu.dll NOT unregistered.
C:\WINDOWS\System32\borababu.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\System32\tepusiga.dll
C:\WINDOWS\System32\tepusiga.dll NOT unregistered.
C:\WINDOWS\System32\tepusiga.dll moved successfully.
C:\WINDOWS\System32\pidizowi.exe moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\System32\jayoriji.dll
C:\WINDOWS\System32\jayoriji.dll NOT unregistered.
C:\WINDOWS\System32\jayoriji.dll moved successfully.
C:\WINDOWS\System32\zilebobi.exe moved successfully.
C:\WINDOWS\System32\41.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 17086845 bytes

User: All Users

User: Amy & Greg
->Temp folder emptied: 13383870 bytes
File delete failed. C:\Documents and Settings\Amy & Greg\Local Settings\Temporary Internet Files\Content.IE5\1RCJKA38\iframe[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Amy & Greg\Local Settings\Temporary Internet Files\Content.IE5\1RCJKA38\topic261666[1].htm scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Amy & Greg\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Amy & Greg\Local Settings\Temporary Internet Files\AntiPhishing\A0AB7674-8D67-4F4D-B5E1-96FAEADFB79D.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 151654512 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Guest
->Temp folder emptied: 8139932 bytes
->Temporary Internet Files folder emptied: 3568716 bytes

User: Janie
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 565193803 bytes

User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 248673133 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes

User: TEMP
->Temporary Internet Files folder emptied: 32768 bytes

User: Will
->Temp folder emptied: 1724583719 bytes
->Temporary Internet Files folder emptied: 826901270 bytes

C:\~QTWTMP.TMP folder deleted successfully.
%systemdrive% .tmp files removed: 14648 bytes
%systemroot% .tmp files removed: 2142714 bytes
%systemroot%\System32 .tmp files removed: 154641 bytes
Windows Temp folder emptied: 8140732 bytes
RecycleBin emptied: 1375943203 bytes

Total Files Cleaned = 620.63 mb

OTL by OldTimer - Version 3.0.18.0 log created on 10032009_184725

Files\Folders moved on Reboot...
C:\Documents and Settings\Amy & Greg\Local Settings\Temporary Internet Files\Content.IE5\1RCJKA38\iframe[1].htm moved successfully.
C:\Documents and Settings\Amy & Greg\Local Settings\Temporary Internet Files\Content.IE5\1RCJKA38\topic261666[1].htm moved successfully.
C:\Documents and Settings\Amy & Greg\Local Settings\Temporary Internet Files\AntiPhishing\A0AB7674-8D67-4F4D-B5E1-96FAEADFB79D.dat moved successfully.

Registry entries deleted on Reboot...

OTL log:

OTL logfile created on: 10/3/2009 7:13:49 PM - Run 3
OTL by OldTimer - Version 3.0.18.0 Folder = C:\Documents and Settings\Amy & Greg\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.07 Mb Total Physical Memory | 202.64 Mb Available Physical Memory | 39.73% Memory free
1.35 Gb Paging File | 1.08 Gb Available in Paging File | 79.81% Paging File free
Paging file location(s): C:\pagefile.sys 900 1800 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.82 Gb Total Space | 73.19 Gb Free Space | 31.43% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 991.22 Mb Total Space | 905.48 Mb Free Space | 91.35% Space Free | Partition Type: FAT
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HOME
Current User Name: Amy & Greg
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2009/06/20 22:54:44 | 01,205,760 | ---- | M] (Webroot Software, Inc. ) -- C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
PRC - [2004/08/25 13:26:56 | 00,389,120 | ---- | M] () -- C:\WINDOWS\System32\Ati2evxx.exe
PRC - [2007/06/13 06:23:07 | 01,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2008/09/10 16:50:26 | 00,116,040 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2008/08/29 10:18:44 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2003/02/20 10:21:16 | 00,046,080 | ---- | M] (C-Dilla Ltd) -- C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
PRC - [2004/12/10 10:46:36 | 00,134,224 | ---- | M] (Command Software Systems, Inc.) -- C:\Program Files\Common Files\Command Software\dvpapi.exe
PRC - [2007/01/04 17:38:08 | 00,024,652 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe
PRC - [2009/04/21 18:26:52 | 04,048,240 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
PRC - [2005/09/30 20:22:50 | 00,096,341 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe
PRC - [2004/08/12 09:34:39 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wscntfy.exe
PRC - [2004/08/12 09:25:00 | 00,069,120 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\notepad.exe
PRC - [2007/04/03 21:50:00 | 01,603,152 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
PRC - [2007/02/04 13:02:14 | 00,079,400 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
PRC - [2008/09/10 17:40:06 | 00,289,576 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunesHelper.exe
PRC - [2009/05/13 15:40:08 | 06,345,840 | ---- | M] (Webroot Software, Inc.) -- C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
PRC - [2005/09/23 23:05:26 | 00,029,696 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
PRC - [2008/09/10 17:39:48 | 00,536,872 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe
PRC - [2007/01/04 17:38:18 | 00,112,336 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
PRC - [2009/06/29 04:35:10 | 00,634,632 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe
PRC - [2009/04/21 18:26:50 | 00,165,232 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
PRC - [2009/10/02 19:03:37 | 00,519,168 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Amy & Greg\Desktop\OTL.exe

========== Win32 Services (SafeList) ==========

SRV - [2008/09/10 16:50:26 | 00,116,040 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device [Auto | Running])
SRV - [2004/07/15 01:49:26 | 00,032,768 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
SRV - [2004/08/25 13:26:56 | 00,389,120 | ---- | M] () -- C:\WINDOWS\System32\Ati2evxx.exe -- (Ati HotKey Poller [Auto | Running])
SRV - [2004/08/25 12:52:00 | 00,516,096 | ---- | M] () -- C:\WINDOWS\System32\ati2sgag.exe -- (ATI Smart [Auto | Stopped])
SRV - [2008/08/29 10:18:44 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service [Auto | Running])
SRV - [2003/02/20 10:21:16 | 00,046,080 | ---- | M] (C-Dilla Ltd) -- C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE -- (C-DillaSrv [Auto | Running])
SRV - [2005/09/30 20:22:50 | 00,096,341 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8 [Auto | Running])
SRV - File not found -- -- (CurtainsSysSvc [Auto | Stopped])
SRV - [2004/12/10 10:46:36 | 00,134,224 | ---- | M] (Command Software Systems, Inc.) -- C:\Program Files\Common Files\Command Software\dvpapi.exe -- (dvpapi [Auto | Running])
SRV - [2004/08/12 09:25:59 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2005/04/04 00:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped])
SRV - [2008/09/10 17:39:48 | 00,536,872 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service [On_Demand | Running])
SRV - [2005/11/24 17:03:22 | 00,053,337 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe -- (MSCSPTISRV [On_Demand | Stopped])
SRV - [2006/10/26 14:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped])
SRV - [2005/11/24 16:57:44 | 00,053,337 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe -- (PACSPTISVR [On_Demand | Stopped])
SRV - [2005/11/24 16:47:30 | 00,069,718 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -- (SPTISRV [On_Demand | Stopped])
SRV - [2006/01/06 22:25:12 | 00,069,632 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe -- (SSScsiSV [On_Demand | Stopped])
SRV - [2007/01/04 17:38:08 | 00,024,652 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe -- (Viewpoint Manager Service [Auto | Running])
SRV - [2009/04/21 18:26:52 | 04,048,240 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- (WebrootSpySweeperService [Auto | Running])
SRV - [2006/10/18 20:05:24 | 00,913,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped])
SRV - [2009/06/20 22:54:44 | 01,205,760 | ---- | M] (Webroot Software, Inc. ) -- C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe -- (WRConsumerService [Auto | Running])

========== Driver Services (SafeList) ==========

DRV - [2004/08/25 13:28:46 | 00,787,456 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\DRIVERS\ati2mtag.sys -- (ati2mtag [On_Demand | Running])
DRV - [2003/02/20 10:22:48 | 00,058,288 | ---- | M] (Macrovision) -- C:\WINDOWS\System32\drivers\CDANT.SYS -- (C-Dilla [On_Demand | Stopped])
DRV - [2004/12/10 10:30:48 | 00,707,176 | R--- | M] (Command Software Systems, Inc.) -- C:\WINDOWS\System32\DRIVERS\css-dvp.sys -- (CSS DVP [Auto | Running])
DRV - [2004/02/10 15:49:14 | 00,154,112 | ---- | M] (Intel Corporation) -- C:\WINDOWS\System32\DRIVERS\e100b325.sys -- (E100B [On_Demand | Running])
DRV - [2008/04/17 13:12:54 | 00,015,464 | ---- | M] (GEAR Software Inc.) -- C:\WINDOWS\System32\DRIVERS\GEARAspiWDM.sys -- (GEARAspiWDM [On_Demand | Running])
DRV - [2007/04/06 09:24:55 | 00,029,184 | ---- | M] (Gteko Ltd.) -- C:\WINDOWS\System32\DRIVERS\goprot51.sys -- (GoProto [On_Demand | Stopped])
DRV - [2004/11/10 08:50:52 | 00,032,256 | ---- | M] (Global RISC) -- C:\WINDOWS\System32\Drivers\GRTdiMon.sys -- (GRTdiMon [Auto | Running])
DRV - [2004/08/12 09:26:42 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2005/04/25 05:03:00 | 00,020,640 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running])
DRV - [2004/06/09 09:29:56 | 00,006,977 | ---- | M] (Gteko Ltd.) -- C:\WINDOWS\System32\DDMI2.sys -- (SDDMI2 [On_Demand | Stopped])
DRV - [2007/11/13 06:25:53 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [Auto | Running])
DRV - [2004/09/17 09:02:54 | 00,732,928 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\System32\drivers\senfilt.sys -- (senfilt [On_Demand | Running])
DRV - [2005/01/27 15:31:06 | 00,260,352 | ---- | M] (Analog Devices, Inc.) -- C:\WINDOWS\System32\drivers\smwdm.sys -- (smwdm [On_Demand | Running])
DRV - [2009/04/21 18:27:02 | 00,029,808 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\WINDOWS\system32\DRIVERS\ssfs0bbc.sys -- (ssfs0bbc [Boot | Running])
DRV - [2009/04/21 18:27:04 | 00,023,152 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\WINDOWS\SYSTEM32\Drivers\SSHRMD.SYS -- (SSHRMD [Boot | Running])
DRV - [2009/04/21 18:27:04 | 00,176,752 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\WINDOWS\SYSTEM32\Drivers\SSIDRV.SYS -- (SSIDRV [Boot | Running])
DRV - [2008/01/04 21:34:36 | 00,023,920 | ---- | M] (Webroot Software Inc (www.webroot.com)) -- C:\WINDOWS\System32\Drivers\sskbfd.sys -- (SSKBFD [On_Demand | Stopped])
DRV - [2007/10/31 15:09:14 | 00,030,464 | ---- | M] (Apple, Inc.) -- C:\WINDOWS\System32\Drivers\usbaapl.sys -- (USBAAPL [On_Demand | Stopped])

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch
IE - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\S-1-5-21-1390067357-2111687655-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\S-1-5-21-1390067357-2111687655-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

O1 HOSTS File: (813 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O3 - HKLM\..\Toolbar: (Ask.com Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\..\Toolbar\WebBrowser: (Ask.com Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [AuthConsoleStart] File not found
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
O4 - HKLM..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe (Webroot Software, Inc.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 0
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disableregistrytools = 0
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disabletaskmgr = 0
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (America Online, Inc.)
O9 - Extra Button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll (Picasa, Inc.)
O9 - Extra 'Tools' menuitem : Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll (Picasa, Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} http://support.dell.com/systemprofiler/SysPro.CAB (SysProWmi Class)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/8/b...heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1B9935E4-8A50-4DD8-BD09-A7518723BF97} https://quicken.ehosts.net/netagent/objects/custappx3.cab (Talisma NetAgent Customer ActiveX Control version 3)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc2.cab (Office Update Installation Engine)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A30FBBDC-FA29-4606-8565-14AADCCA6708} https://photos.riteaid.com/control/RiteAidO...PhotoOnline.cab (Rite Aid One Hour Photo Online Control)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/pub/shock...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} http://cvs.pnimedia.com/upload/activex/v2_...upv2.0.0.10.cab? (Photo Upload Plugin Class)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (c:\windows\system32\) - C:\WINDOWS\System32 [2009/10/03 19:07:53 | 00,000,000 | ---D | M]
O20 - AppInit_DLLs: (bapenuge.dll) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O30 - LSA: Authentication Packages - (OWS\S) - File not found
O30 - LSA: Security Packages - (\ATI) - File not found
O30 - LSA: Security Packages - (CONTROL) - C:\WINDOWS\System32\CONTROL.exe (Microsoft Corporation)
O30 - LSA: Security Packages - (PANEL) - File not found
O30 - LSA: Security Packages - (soft) - File not found
O30 - LSA: Security Packages - (corpora) - File not found
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/06/21 00:21:09 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\WD SmartWare.exe -- File not found
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
O35 - comfile [open] -- "%1" %* File not found
O35 - exefile [open] -- "%1" %* File not found

========== Files/Folders - Created Within 30 Days ==========

[2009/10/02 18:14:53 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/09/29 21:24:35 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2009/09/30 23:23:16 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Western Digital
[2009/10/02 18:14:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Amy & Greg\Application Data\Malwarebytes
[2009/09/30 23:22:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\Western Digital
[2009/10/02 18:14:53 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/09/29 21:24:35 | 00,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2009/09/30 22:27:20 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2009/10/03 18:47:25 | 00,000,000 | ---D | C] -- C:\_OTL
[2009/10/02 19:03:36 | 00,519,168 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Amy & Greg\Desktop\OTL.exe
[2009/10/02 18:14:54 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/10/02 18:14:53 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/10/02 18:13:24 | 04,045,544 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Amy & Greg\Desktop\mbam-setup.exe
[2009/10/01 22:37:03 | 00,472,064 | ---- | C] ( ) -- C:\Documents and Settings\Amy & Greg\Desktop\RootRepeal.exe
[2009/09/30 23:43:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Amy & Greg\My Documents\Copy of BCBSRI
[2009/09/30 23:43:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Amy & Greg\My Documents\Copy of Addresses
[2009/09/28 23:22:56 | 00,000,000 | -HSD | C] -- C:\WINDOWS\CSC
[2005/06/23 23:58:28 | 00,151,552 | ---- | C] ( ) -- C:\WINDOWS\System32\ATIDEMGR.dll

========== Files - Modified Within 30 Days ==========

[2009/10/03 19:14:25 | 00,011,168 | -H-- | M] () -- C:\WINDOWS\System32\seyebajo
[2009/10/03 19:09:41 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/10/03 19:09:22 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/10/03 19:09:20 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/10/03 19:01:02 | 00,000,244 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2009/10/03 12:30:39 | 00,001,648 | ---- | M] () -- C:\WINDOWS\tasks\wrSpySweeper_LAF4985DAB3564EF0983B0A9F737C9B6D.job
[2009/10/02 19:03:37 | 00,519,168 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Amy & Greg\Desktop\OTL.exe
[2009/10/02 18:14:57 | 00,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/10/02 18:13:29 | 04,045,544 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Amy & Greg\Desktop\mbam-setup.exe
[2009/10/01 23:26:10 | 00,000,218 | ---- | M] () -- C:\xcrashdump.dat
[2009/10/01 22:37:10 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\settings.dat
[2009/10/01 22:37:03 | 00,472,064 | ---- | M] ( ) -- C:\Documents and Settings\Amy & Greg\Desktop\RootRepeal.exe
[2009/10/01 22:34:30 | 00,361,369 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\dds.scr
[2009/10/01 21:29:51 | 00,026,624 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\My Documents\Will medication list for Farm School.doc
[2009/09/30 23:43:10 | 00,000,468 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\My Documents\Shortcut to Addresses.lnk
[2009/09/30 22:27:21 | 00,001,734 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\HijackThis.lnk
[2009/09/30 07:49:26 | 00,000,267 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2009/09/30 01:36:08 | 00,000,552 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat
[2009/09/29 21:24:41 | 00,000,945 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\Spybot - Search & Destroy.lnk
[2009/09/28 21:22:59 | 00,262,146 | ---- | M] () -- C:\registrybackup.reg
[2009/09/28 20:53:03 | 00,001,917 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2009/09/27 15:40:33 | 00,271,360 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\My Documents\backup inbox.pst
[2009/09/20 18:46:33 | 00,020,480 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\Bill form.xls
[2009/09/15 22:31:06 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/09/15 21:08:19 | 00,870,128 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Application Data\mcs.rma
[2009/09/15 21:08:19 | 00,000,004 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Application Data\A8C0B6
[2009/09/14 23:13:48 | 00,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/09/14 21:40:53 | 00,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2009/09/12 13:19:31 | 00,002,497 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\Microsoft Office Word 2003 (2).lnk
[2009/09/10 14:54:06 | 00,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/09/10 14:53:50 | 00,019,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

========== Files - No Company Name ==========
[2100/02/24 14:15:04 | 00,000,821 | ---- | C] () -- C:\WINDOWS\Lexmark_ICM.ini
[2100/02/16 16:09:06 | 00,000,062 | ---- | C] () -- C:\WINDOWS\System32\LXASUSCI.INI
[2009/10/02 18:14:57 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/10/01 22:37:10 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Desktop\settings.dat
[2009/10/01 22:34:29 | 00,361,369 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Desktop\dds.scr
[2009/09/30 23:43:10 | 00,000,468 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\My Documents\Shortcut to Addresses.lnk
[2009/09/30 22:27:21 | 00,001,734 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Desktop\HijackThis.lnk
[2009/09/30 01:36:08 | 00,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2009/09/30 01:26:55 | 00,000,218 | ---- | C] () -- C:\xcrashdump.dat
[2009/09/29 23:09:22 | 00,000,945 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Desktop\Spybot - Search & Destroy.lnk
[2009/09/29 22:43:43 | 00,000,267 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2009/09/28 21:22:59 | 00,262,146 | ---- | C] () -- C:\registrybackup.reg
[2009/08/28 22:08:06 | 00,017,271 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\qaginenez._dl
[2009/08/28 22:08:06 | 00,011,262 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\ofiq.reg
[2009/08/28 22:08:05 | 00,018,009 | ---- | C] () -- C:\Program Files\Common Files\syqaf.pif
[2009/08/28 22:08:05 | 00,017,219 | ---- | C] () -- C:\WINDOWS\onokukesy.sys
[2009/08/28 22:08:05 | 00,015,966 | ---- | C] () -- C:\Program Files\Common Files\ezepagudyn.exe
[2009/08/28 22:08:05 | 00,015,445 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\melolobow.reg
[2009/08/28 22:08:05 | 00,013,823 | ---- | C] () -- C:\Program Files\Common Files\ocynyroq.sys
[2009/08/28 22:08:05 | 00,012,384 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hasez.lib
[2009/08/28 22:08:05 | 00,011,974 | ---- | C] () -- C:\Program Files\Common Files\ugad.bat
[2009/08/28 22:08:05 | 00,011,195 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Application Data\exin.bin
[2009/08/28 22:08:05 | 00,011,183 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\ebyq.scr
[2009/08/28 22:08:05 | 00,010,997 | ---- | C] () -- C:\Program Files\Common Files\ujumylalu.dat
[2009/07/03 12:29:14 | 00,052,224 | -HS- | C] () -- C:\WINDOWS\System32\mofawulo.dll
[2009/07/03 12:29:14 | 00,052,224 | -HS- | C] () -- C:\WINDOWS\System32\helileve.dll
[2009/04/21 18:26:56 | 00,031,088 | ---- | C] () -- C:\WINDOWS\System32\wrLZMA.dll
[2009/04/15 21:43:11 | 00,870,128 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Application Data\mcs.rma
[2009/04/15 21:43:11 | 00,000,004 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Application Data\A8C0B6
[2009/04/03 19:41:06 | 00,000,133 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\fusioncache.dat
[2008/02/16 19:25:42 | 00,000,412 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2008/02/13 20:26:28 | 00,000,004 | RHS- | C] () -- C:\Documents and Settings\All Users\Application Data\sysqcl1129139270.dat
[2007/06/09 15:44:08 | 00,524,288 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2007/06/09 15:44:08 | 00,139,264 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2007/05/13 20:58:44 | 00,098,304 | ---- | C] () -- C:\WINDOWS\System32\resourceGeneric.dll
[2006/10/29 09:02:53 | 00,684,032 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
[2006/10/29 09:02:53 | 00,155,648 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll
[2006/08/20 11:42:55 | 00,056,320 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll
[2006/07/16 16:44:18 | 00,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll
[2006/07/16 16:44:18 | 00,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll
[2006/07/16 16:44:18 | 00,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll
[2006/07/16 16:42:54 | 00,000,197 | ---- | C] () -- C:\WINDOWS\disneysy.ini
[2006/03/25 12:09:31 | 00,201,216 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/01/11 04:00:53 | 00,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2005/12/16 14:48:29 | 00,000,029 | ---- | C] () -- C:\WINDOWS\atid.ini
[2005/12/06 20:57:17 | 00,002,528 | ---- | C] () -- C:\WINDOWS\FCIC.INI
[2005/10/28 13:46:17 | 00,000,078 | ---- | C] () -- C:\WINDOWS\TONKA.INI
[2005/10/23 23:29:56 | 00,102,912 | ---- | C] () -- C:\WINDOWS\System32\islzma.dll
[2005/10/23 23:29:54 | 00,684,032 | ---- | C] () -- C:\WINDOWS\libeay32.dll
[2005/10/23 23:29:54 | 00,155,648 | ---- | C] () -- C:\WINDOWS\ssleay32.dll
[2005/10/23 08:38:15 | 00,000,000 | ---- | C] () -- C:\WINDOWS\SETUP32.INI
[2005/10/22 19:15:55 | 00,003,636 | ---- | C] () -- C:\WINDOWS\disney.ini
[2005/10/18 20:09:32 | 00,000,222 | ---- | C] () -- C:\WINDOWS\Quicken.ini
[2005/09/20 18:51:14 | 00,012,288 | ---- | C] () -- C:\WINDOWS\System32\Hlinkprx.dll
[2005/09/15 22:40:14 | 00,003,392 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2005/08/18 18:31:47 | 00,000,750 | ---- | C] () -- C:\WINDOWS\hegames.ini
[2005/07/13 23:50:25 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/07/09 10:27:30 | 00,001,681 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2005/07/08 18:59:26 | 00,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
[2005/06/24 22:34:04 | 00,000,020 | ---- | C] () -- C:\WINDOWS\ACMonitor_X83.ini
[2005/06/24 22:30:07 | 00,004,672 | ---- | C] () -- C:\WINDOWS\System32\LXASUSCI.DLL
[2005/06/24 00:02:58 | 00,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
[2005/06/23 23:58:28 | 00,086,016 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.dll
[2005/06/23 23:57:34 | 00,074,632 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2005/06/21 00:31:05 | 05,366,470 | -H-- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\IconCache.db
[2005/06/21 00:28:23 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\Amy & Greg\Application Data\desktop.ini
[2005/06/20 19:32:40 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini
[2005/06/11 12:47:00 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\fpprintmon.dll
[2005/04/14 17:01:34 | 00,032,768 | R--- | C] () -- C:\WINDOWS\System32\dwsvclnt.dll
[2004/08/12 09:33:16 | 00,000,736 | ---- | C] () -- C:\WINDOWS\win.ini
[2004/08/12 09:30:36 | 00,000,243 | ---- | C] () -- C:\WINDOWS\SYSTEM.INI
[2003/01/07 15:05:08 | 00,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/04/10 13:11:04 | 00,000,194 | ---- | C] () -- C:\WINDOWS\X83_DS.ini
[2002/03/04 22:33:24 | 00,102,400 | ---- | C] () -- C:\WINDOWS\System32\LXASBCE.DLL
[2001/03/05 14:07:22 | 00,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXASICO.DLL
[2001/01/05 13:34:30 | 00,016,812 | ---- | C] () -- C:\WINDOWS\System32\lxas2kpm.dll
[2001/01/05 12:08:02 | 00,008,427 | ---- | C] () -- C:\WINDOWS\System32\lxas2kui.dll
[2000/10/24 09:08:36 | 00,118,784 | ---- | C] () -- C:\WINDOWS\System32\LFKODAK.DLL
[2000/10/24 09:08:33 | 00,338,944 | ---- | C] () -- C:\WINDOWS\System32\lffpx7.dll
[1997/10/24 14:56:36 | 00,000,643 | ---- | C] () -- C:\WINDOWS\LEXSTAT.INI
< End of report >

ESET log:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=6
# iexplore.exe=7.00.6000.16876 (vista_gdr.090625-2339)
# OnlineScanner.ocx=1.0.0.6050
# api_version=3.0.2
# EOSSerial=4002d77ed7749243bc33fe4de2c1fba2
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2009-10-04 12:48:36
# local_time=2009-10-03 08:48:36 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# scanned=143051
# found=11
# cleaned=11
# scan_time=5169
C:\eminem vs 2pac.scr probably a variant of Win32/Rbot trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\foobar.exe probably a variant of Win32/Genetik trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\funny pic.scr probably a variant of Win32/Rbot trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\photo album.scr probably a variant of Win32/Rbot trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\wse.exe Win32/Opanki.AY worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\FraudVirusResponseLab.zip Win32/Bagle.gen.zip worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinFraudLoadffp.zip Win32/Bagle.gen.zip worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Amy & Greg\foobar.exe a variant of Win32/TrojanProxy.Agent.FB trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Amy & Greg\My Documents\Stuff on E drive\Janie\Install_AIM.exe Win32/Adware.WBug.A application (deleted - quarantined) 00000000000000000000000000000000 C
C:\RECYCLER\S-1-5-21-1390067357-2111687655-839522115-1005\Dc12.com a variant of Win32/Oscarbot worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\_OTL\MovedFiles\10032009_184725\bak\foobar.exe a variant of Win32/TrojanProxy.Agent.FB trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

Thanks.

Greg

#8 Buckeye_Sam

Malware Expert

Members
17,382 posts
OFFLINE

Gender:Male
Location:Pickerington, Ohio
Local time:12:24 PM

Posted 04 October 2009 - 09:42 AM

Run OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
O20 - AppInit_DLLs: (bapenuge.dll) - File not found

:Files
C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\qaginenez._dl
C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\ofiq.reg
C:\Program Files\Common Files\syqaf.pif
C:\WINDOWS\onokukesy.sys
C:\Program Files\Common Files\ezepagudyn.exe
C:\Documents and Settings\All Users\Application Data\melolobow.reg
C:\Program Files\Common Files\ocynyroq.sys
C:\Documents and Settings\All Users\Application Data\hasez.lib
C:\Program Files\Common Files\ugad.bat
C:\Documents and Settings\Amy & Greg\Application Data\exin.bin
C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\ebyq.scr
C:\Program Files\Common Files\ujumylalu.dat
C:\WINDOWS\System32\mofawulo.dll
C:\WINDOWS\System32\helileve.dll


:Commands
[purity]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
You will get a log that shows the results of the fix. Please post it.
Then also run and post a new OTL log.

=====================

Please update Malwarebytes and run a full scan.

Open Malwarebytes and select the Update tab.
Click on the Check for Updates button and allow the program to download the latest updates.
Once you have the latest updates, select the Scanner tab.
Select "Perform full scan" and click the Scan button.
If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
Make sure that everything is checked, and click Remove Selected.
When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply and exit MBAM.

#9 ag24

Topic Starter

Members
10 posts
OFFLINE

Local time:01:24 PM

Posted 04 October 2009 - 10:37 AM

Hi Sam.

I logged in to Windows and got the following error message in a box where the frame said, "taskkill.exe - Unable to Locate component":
"This application failed to start because framedyn.dll was not found. Re-installing the application may fix this problem."
This happened repeatedly, not allowing me to continue so I shut down and am now logged into safe mode. By the way, I had Spy Sweeper running and before I shut down, Spy Sweeper caught "jehohahek" trying to install and I clicked remove.
When I opened the browser in safe mode, another browser window popped open.

I'm now starting the steps you asked me to take. I'll write back soon.

Greg

#10 ag24

Topic Starter

Members
10 posts
OFFLINE

Local time:01:24 PM

Posted 04 October 2009 - 10:52 AM

I ran your fix. When I rebooted I missed catching the reboot to open in safemode, so it opened normal windows. The log appeared, but nothing else on my desktop was available. I closed and reopened in safemode, but I lost the log. I ran the OTL log -- here it is:

OTL logfile created on: 10/4/2009 11:50:00 AM - Run 4
OTL by OldTimer - Version 3.0.18.0 Folder = C:\Documents and Settings\Amy & Greg\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.07 Mb Total Physical Memory | 335.25 Mb Available Physical Memory | 65.72% Memory free
1.35 Gb Paging File | 1.23 Gb Available in Paging File | 91.09% Paging File free
Paging file location(s): C:\pagefile.sys 900 1800 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.82 Gb Total Space | 73.16 Gb Free Space | 31.42% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 991.22 Mb Total Space | 905.48 Mb Free Space | 91.35% Space Free | Partition Type: FAT
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HOME
Current User Name: Amy & Greg
Logged in as Administrator.

Current Boot Mode: SafeMode with Networking
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2009/06/20 22:54:44 | 01,205,760 | ---- | M] (Webroot Software, Inc. ) -- C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
PRC - [2007/06/13 06:23:07 | 01,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2009/04/21 18:26:52 | 04,048,240 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
PRC - [2009/10/02 19:03:37 | 00,519,168 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Amy & Greg\Desktop\OTL.exe
PRC - [2009/06/29 04:35:10 | 00,634,632 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe

========== Win32 Services (SafeList) ==========

SRV - [2008/09/10 16:50:26 | 00,116,040 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device [Auto | Stopped])
SRV - [2004/07/15 01:49:26 | 00,032,768 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
SRV - [2004/08/25 13:26:56 | 00,389,120 | ---- | M] () -- C:\WINDOWS\System32\Ati2evxx.exe -- (Ati HotKey Poller [Auto | Stopped])
SRV - [2004/08/25 12:52:00 | 00,516,096 | ---- | M] () -- C:\WINDOWS\System32\ati2sgag.exe -- (ATI Smart [Auto | Stopped])
SRV - [2008/08/29 10:18:44 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service [Auto | Stopped])
SRV - [2003/02/20 10:21:16 | 00,046,080 | ---- | M] (C-Dilla Ltd) -- C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE -- (C-DillaSrv [Auto | Stopped])
SRV - [2005/09/30 20:22:50 | 00,096,341 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8 [Auto | Stopped])
SRV - File not found -- -- (CurtainsSysSvc [Auto | Stopped])
SRV - [2004/12/10 10:46:36 | 00,134,224 | ---- | M] (Command Software Systems, Inc.) -- C:\Program Files\Common Files\Command Software\dvpapi.exe -- (dvpapi [Auto | Stopped])
SRV - [2004/08/12 09:25:59 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2005/04/04 00:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped])
SRV - [2008/09/10 17:39:48 | 00,536,872 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service [On_Demand | Stopped])
SRV - [2005/11/24 17:03:22 | 00,053,337 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe -- (MSCSPTISRV [On_Demand | Stopped])
SRV - [2006/10/26 14:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped])
SRV - [2005/11/24 16:57:44 | 00,053,337 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe -- (PACSPTISVR [On_Demand | Stopped])
SRV - [2005/11/24 16:47:30 | 00,069,718 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -- (SPTISRV [On_Demand | Stopped])
SRV - [2006/01/06 22:25:12 | 00,069,632 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe -- (SSScsiSV [On_Demand | Stopped])
SRV - [2007/01/04 17:38:08 | 00,024,652 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe -- (Viewpoint Manager Service [Auto | Stopped])
SRV - [2009/04/21 18:26:52 | 04,048,240 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- (WebrootSpySweeperService [Auto | Running])
SRV - [2006/10/18 20:05:24 | 00,913,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped])
SRV - [2009/06/20 22:54:44 | 01,205,760 | ---- | M] (Webroot Software, Inc. ) -- C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe -- (WRConsumerService [Auto | Running])

========== Driver Services (SafeList) ==========

DRV - [2004/08/25 13:28:46 | 00,787,456 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\DRIVERS\ati2mtag.sys -- (ati2mtag [On_Demand | Stopped])
DRV - [2003/02/20 10:22:48 | 00,058,288 | ---- | M] (Macrovision) -- C:\WINDOWS\System32\drivers\CDANT.SYS -- (C-Dilla [On_Demand | Stopped])
DRV - [2004/12/10 10:30:48 | 00,707,176 | R--- | M] (Command Software Systems, Inc.) -- C:\WINDOWS\System32\DRIVERS\css-dvp.sys -- (CSS DVP [Auto | Stopped])
DRV - [2004/02/10 15:49:14 | 00,154,112 | ---- | M] (Intel Corporation) -- C:\WINDOWS\System32\DRIVERS\e100b325.sys -- (E100B [On_Demand | Running])
DRV - [2008/04/17 13:12:54 | 00,015,464 | ---- | M] (GEAR Software Inc.) -- C:\WINDOWS\System32\DRIVERS\GEARAspiWDM.sys -- (GEARAspiWDM [On_Demand | Running])
DRV - [2007/04/06 09:24:55 | 00,029,184 | ---- | M] (Gteko Ltd.) -- C:\WINDOWS\System32\DRIVERS\goprot51.sys -- (GoProto [On_Demand | Stopped])
DRV - [2004/11/10 08:50:52 | 00,032,256 | ---- | M] (Global RISC) -- C:\WINDOWS\System32\Drivers\GRTdiMon.sys -- (GRTdiMon [Auto | Stopped])
DRV - [2004/08/12 09:26:42 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2005/04/25 05:03:00 | 00,020,640 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running])
DRV - [2004/06/09 09:29:56 | 00,006,977 | ---- | M] (Gteko Ltd.) -- C:\WINDOWS\System32\DDMI2.sys -- (SDDMI2 [On_Demand | Stopped])
DRV - [2007/11/13 06:25:53 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [Auto | Stopped])
DRV - [2004/09/17 09:02:54 | 00,732,928 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\System32\drivers\senfilt.sys -- (senfilt [On_Demand | Stopped])
DRV - [2005/01/27 15:31:06 | 00,260,352 | ---- | M] (Analog Devices, Inc.) -- C:\WINDOWS\System32\drivers\smwdm.sys -- (smwdm [On_Demand | Stopped])
DRV - [2009/04/21 18:27:02 | 00,029,808 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\WINDOWS\system32\DRIVERS\ssfs0bbc.sys -- (ssfs0bbc [Boot | Running])
DRV - [2009/04/21 18:27:04 | 00,023,152 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\WINDOWS\SYSTEM32\Drivers\SSHRMD.SYS -- (SSHRMD [Boot | Running])
DRV - [2009/04/21 18:27:04 | 00,176,752 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\WINDOWS\SYSTEM32\Drivers\SSIDRV.SYS -- (SSIDRV [Boot | Running])
DRV - [2008/01/04 21:34:36 | 00,023,920 | ---- | M] (Webroot Software Inc (www.webroot.com)) -- C:\WINDOWS\System32\Drivers\sskbfd.sys -- (SSKBFD [On_Demand | Stopped])
DRV - [2007/10/31 15:09:14 | 00,030,464 | ---- | M] (Apple, Inc.) -- C:\WINDOWS\System32\Drivers\usbaapl.sys -- (USBAAPL [On_Demand | Stopped])

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch
IE - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\S-1-5-21-1390067357-2111687655-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\S-1-5-21-1390067357-2111687655-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

O1 HOSTS File: (813 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O3 - HKLM\..\Toolbar: (Ask.com Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\..\Toolbar\WebBrowser: (Ask.com Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [4569247401] C:\WINDOWS\System32\config\systemprofile\Application Data\4569247401\4569247401.exe ()
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [AuthConsoleStart] File not found
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [jehohahek] C:\WINDOWS\System32\zifewiba.DLL ()
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
O4 - HKLM..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe (Webroot Software, Inc.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 0
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disableregistrytools = 0
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disabletaskmgr = 0
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (America Online, Inc.)
O9 - Extra Button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll (Picasa, Inc.)
O9 - Extra 'Tools' menuitem : Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll (Picasa, Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} http://support.dell.com/systemprofiler/SysPro.CAB (SysProWmi Class)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/8/b...heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1B9935E4-8A50-4DD8-BD09-A7518723BF97} https://quicken.ehosts.net/netagent/objects/custappx3.cab (Talisma NetAgent Customer ActiveX Control version 3)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc2.cab (Office Update Installation Engine)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A30FBBDC-FA29-4606-8565-14AADCCA6708} https://photos.riteaid.com/control/RiteAidO...PhotoOnline.cab (Rite Aid One Hour Photo Online Control)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/pub/shock...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} http://cvs.pnimedia.com/upload/activex/v2_...upv2.0.0.10.cab? (Photo Upload Plugin Class)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (c:\windows\system32\) - C:\WINDOWS\System32 [2009/10/04 11:39:25 | 00,000,000 | ---D | M]
O20 - AppInit_DLLs: (c:\windows\system32\zifewiba.dll) - C:\WINDOWS\System32\zifewiba.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O21 - SSODL: jugarojeg - {d2f64c98-f176-46eb-bfe6-e2f14ee68b77} - C:\WINDOWS\System32\zifewiba.dll ()
O22 - SharedTaskScheduler: {d2f64c98-f176-46eb-bfe6-e2f14ee68b77} - kupuhivus - C:\WINDOWS\System32\zifewiba.dll ()
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O30 - LSA: Authentication Packages - (OWS\S) - File not found
O30 - LSA: Security Packages - (\ATI) - File not found
O30 - LSA: Security Packages - (CONTROL) - C:\WINDOWS\System32\CONTROL.exe (Microsoft Corporation)
O30 - LSA: Security Packages - (PANEL) - File not found
O30 - LSA: Security Packages - (soft) - File not found
O30 - LSA: Security Packages - (corpora) - File not found
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/06/21 00:21:09 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\WD SmartWare.exe -- File not found
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
O35 - comfile [open] -- "%1" %* File not found
O35 - exefile [open] -- "%1" %* File not found

========== Files/Folders - Created Within 30 Days ==========

[2009/10/02 18:14:53 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/09/29 21:24:35 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2009/09/30 23:23:16 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Western Digital
[2009/10/02 18:14:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Amy & Greg\Application Data\Malwarebytes
[2009/09/30 23:22:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\Western Digital
[2009/10/03 19:19:31 | 00,000,000 | ---D | C] -- C:\Program Files\ESET
[2009/10/02 18:14:53 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/09/29 21:24:35 | 00,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2009/09/30 22:27:20 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2009/10/03 18:47:25 | 00,000,000 | ---D | C] -- C:\_OTL
[2009/10/02 19:03:36 | 00,519,168 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Amy & Greg\Desktop\OTL.exe
[2009/10/02 18:14:54 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/10/02 18:14:53 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/10/02 18:13:24 | 04,045,544 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Amy & Greg\Desktop\mbam-setup.exe
[2009/10/01 22:37:03 | 00,472,064 | ---- | C] ( ) -- C:\Documents and Settings\Amy & Greg\Desktop\RootRepeal.exe
[2009/09/30 23:43:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Amy & Greg\My Documents\Copy of BCBSRI
[2009/09/30 23:43:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Amy & Greg\My Documents\Copy of Addresses
[2009/09/28 23:22:56 | 00,000,000 | -HSD | C] -- C:\WINDOWS\CSC
[2005/06/23 23:58:28 | 00,151,552 | ---- | C] ( ) -- C:\WINDOWS\System32\ATIDEMGR.dll

========== Files - Modified Within 30 Days ==========

[2009/10/04 11:45:01 | 00,002,497 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\Microsoft Office Word 2003 (2).lnk
[2009/10/04 11:44:26 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/10/04 11:44:00 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/10/04 11:43:18 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/10/04 11:41:04 | 00,001,055 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\Security Tool.lnk
[2009/10/04 11:35:30 | 00,011,168 | -H-- | M] () -- C:\WINDOWS\System32\seyebajo
[2009/10/04 11:26:23 | 01,048,611 | -HS- | M] () -- C:\WINDOWS\System32\sidenohe.exe
[2009/10/04 11:26:22 | 00,090,624 | -HS- | M] () -- C:\WINDOWS\System32\zifewiba.dll
[2009/10/04 11:26:20 | 00,038,912 | -HS- | M] () -- C:\WINDOWS\System32\herifolu.dll
[2009/10/04 00:29:30 | 00,271,360 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\My Documents\backup inbox.pst
[2009/10/04 00:01:00 | 00,000,244 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2009/10/03 22:45:04 | 00,020,480 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\Bill form.xls
[2009/10/03 12:30:39 | 00,001,648 | ---- | M] () -- C:\WINDOWS\tasks\wrSpySweeper_LAF4985DAB3564EF0983B0A9F737C9B6D.job
[2009/10/02 19:03:37 | 00,519,168 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Amy & Greg\Desktop\OTL.exe
[2009/10/02 18:14:57 | 00,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/10/02 18:13:29 | 04,045,544 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Amy & Greg\Desktop\mbam-setup.exe
[2009/10/01 23:26:10 | 00,000,218 | ---- | M] () -- C:\xcrashdump.dat
[2009/10/01 22:37:10 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\settings.dat
[2009/10/01 22:37:03 | 00,472,064 | ---- | M] ( ) -- C:\Documents and Settings\Amy & Greg\Desktop\RootRepeal.exe
[2009/10/01 22:34:30 | 00,361,369 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\dds.scr
[2009/10/01 21:29:51 | 00,026,624 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\My Documents\Will medication list for Farm School.doc
[2009/09/30 23:43:10 | 00,000,468 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\My Documents\Shortcut to Addresses.lnk
[2009/09/30 22:27:21 | 00,001,734 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\HijackThis.lnk
[2009/09/30 07:49:26 | 00,000,267 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2009/09/30 01:36:08 | 00,000,552 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat
[2009/09/29 21:24:41 | 00,000,945 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\Spybot - Search & Destroy.lnk
[2009/09/28 21:22:59 | 00,262,146 | ---- | M] () -- C:\registrybackup.reg
[2009/09/28 20:53:03 | 00,001,917 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2009/09/15 22:31:06 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/09/15 21:08:19 | 00,870,128 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Application Data\mcs.rma
[2009/09/15 21:08:19 | 00,000,004 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Application Data\A8C0B6
[2009/09/14 23:13:48 | 00,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/09/14 21:40:53 | 00,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2009/09/10 14:54:06 | 00,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/09/10 14:53:50 | 00,019,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

========== Files - No Company Name ==========
[2100/02/24 14:15:04 | 00,000,821 | ---- | C] () -- C:\WINDOWS\Lexmark_ICM.ini
[2100/02/16 16:09:06 | 00,000,062 | ---- | C] () -- C:\WINDOWS\System32\LXASUSCI.INI
[2009/10/04 11:41:04 | 00,001,055 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Desktop\Security Tool.lnk
[2009/10/02 18:14:57 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/10/01 22:37:10 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Desktop\settings.dat
[2009/10/01 22:34:29 | 00,361,369 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Desktop\dds.scr
[2009/09/30 23:43:10 | 00,000,468 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\My Documents\Shortcut to Addresses.lnk
[2009/09/30 22:27:21 | 00,001,734 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Desktop\HijackThis.lnk
[2009/09/30 01:36:08 | 00,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2009/09/30 01:26:55 | 00,000,218 | ---- | C] () -- C:\xcrashdump.dat
[2009/09/29 23:09:22 | 00,000,945 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Desktop\Spybot - Search & Destroy.lnk
[2009/09/29 22:43:43 | 00,000,267 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2009/09/28 21:22:59 | 00,262,146 | ---- | C] () -- C:\registrybackup.reg
[2009/07/04 11:26:19 | 00,090,624 | -HS- | C] () -- C:\WINDOWS\System32\zifewiba.dll
[2009/07/04 11:26:19 | 00,038,912 | -HS- | C] () -- C:\WINDOWS\System32\herifolu.dll
[2009/04/15 21:43:11 | 00,870,128 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Application Data\mcs.rma
[2009/04/15 21:43:11 | 00,000,004 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Application Data\A8C0B6
[2009/04/03 19:41:06 | 00,000,133 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\fusioncache.dat
[2008/02/16 19:25:42 | 00,000,412 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2008/02/13 20:26:28 | 00,000,004 | RHS- | C] () -- C:\Documents and Settings\All Users\Application Data\sysqcl1129139270.dat
[2007/06/09 15:44:08 | 00,524,288 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2007/06/09 15:44:08 | 00,139,264 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2007/05/13 20:58:44 | 00,098,304 | ---- | C] () -- C:\WINDOWS\System32\resourceGeneric.dll
[2006/10/29 09:02:53 | 00,684,032 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
[2006/10/29 09:02:53 | 00,155,648 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll
[2006/08/20 11:42:55 | 00,056,320 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll
[2006/07/16 16:44:18 | 00,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll
[2006/07/16 16:44:18 | 00,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll
[2006/07/16 16:44:18 | 00,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll
[2006/07/16 16:42:54 | 00,000,197 | ---- | C] () -- C:\WINDOWS\disneysy.ini
[2006/03/25 12:09:31 | 00,201,216 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/01/11 04:00:53 | 00,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2005/12/16 14:48:29 | 00,000,029 | ---- | C] () -- C:\WINDOWS\atid.ini
[2005/12/06 20:57:17 | 00,002,528 | ---- | C] () -- C:\WINDOWS\FCIC.INI
[2005/10/28 13:46:17 | 00,000,078 | ---- | C] () -- C:\WINDOWS\TONKA.INI
[2005/10/23 23:29:56 | 00,102,912 | ---- | C] () -- C:\WINDOWS\System32\islzma.dll
[2005/10/23 23:29:54 | 00,684,032 | ---- | C] () -- C:\WINDOWS\libeay32.dll
[2005/10/23 23:29:54 | 00,155,648 | ---- | C] () -- C:\WINDOWS\ssleay32.dll
[2005/10/23 08:38:15 | 00,000,000 | ---- | C] () -- C:\WINDOWS\SETUP32.INI
[2005/10/22 19:15:55 | 00,003,636 | ---- | C] () -- C:\WINDOWS\disney.ini
[2005/10/18 20:09:32 | 00,000,222 | ---- | C] () -- C:\WINDOWS\Quicken.ini
[2005/09/20 18:51:14 | 00,012,288 | ---- | C] () -- C:\WINDOWS\System32\Hlinkprx.dll
[2005/09/15 22:40:14 | 00,003,392 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2005/08/18 18:31:47 | 00,000,750 | ---- | C] () -- C:\WINDOWS\hegames.ini
[2005/07/13 23:50:25 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/07/09 10:27:30 | 00,001,681 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2005/07/08 18:59:26 | 00,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
[2005/06/24 22:34:04 | 00,000,020 | ---- | C] () -- C:\WINDOWS\ACMonitor_X83.ini
[2005/06/24 22:30:07 | 00,004,672 | ---- | C] () -- C:\WINDOWS\System32\LXASUSCI.DLL
[2005/06/24 00:02:58 | 00,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
[2005/06/23 23:58:28 | 00,086,016 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.dll
[2005/06/23 23:57:34 | 00,074,632 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2005/06/21 00:31:05 | 05,366,470 | -H-- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\IconCache.db
[2005/06/21 00:28:23 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\Amy & Greg\Application Data\desktop.ini
[2005/06/20 19:32:40 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini
[2005/06/11 12:47:00 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\fpprintmon.dll
[2005/04/14 17:01:34 | 00,032,768 | R--- | C] () -- C:\WINDOWS\System32\dwsvclnt.dll
[2004/08/12 09:33:16 | 00,000,736 | ---- | C] () -- C:\WINDOWS\win.ini
[2004/08/12 09:30:36 | 00,000,243 | ---- | C] () -- C:\WINDOWS\SYSTEM.INI
[2003/01/07 15:05:08 | 00,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/04/10 13:11:04 | 00,000,194 | ---- | C] () -- C:\WINDOWS\X83_DS.ini
[2002/03/04 22:33:24 | 00,102,400 | ---- | C] () -- C:\WINDOWS\System32\LXASBCE.DLL
[2001/03/05 14:07:22 | 00,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXASICO.DLL
[2001/01/05 13:34:30 | 00,016,812 | ---- | C] () -- C:\WINDOWS\System32\lxas2kpm.dll
[2001/01/05 12:08:02 | 00,008,427 | ---- | C] () -- C:\WINDOWS\System32\lxas2kui.dll
[2000/10/24 09:08:36 | 00,118,784 | ---- | C] () -- C:\WINDOWS\System32\LFKODAK.DLL
[2000/10/24 09:08:33 | 00,338,944 | ---- | C] () -- C:\WINDOWS\System32\lffpx7.dll
[1997/10/24 14:56:36 | 00,000,643 | ---- | C] () -- C:\WINDOWS\LEXSTAT.INI
< End of report >

Now I'm updating and running Malwarebytes.

Greg

#11 ag24

Topic Starter

Members
10 posts
OFFLINE

Local time:01:24 PM

Posted 04 October 2009 - 12:05 PM

Hi Sam.

Here's the log. I rebooted into "non-safe" mode and got in ok. I got one error message related to an .exe not found. I missed the exact message - clicked OK too quickly.

Log:

Malwarebytes' Anti-Malware 1.41
Database version: 2905
Windows 5.1.2600 Service Pack 2 (Safe Mode)

10/4/2009 12:58:31 PM
mbam-log-2009-10-04 (12-58-31).txt

Scan type: Full Scan (C:\|D:\|F:\|)
Objects scanned: 279529
Time elapsed: 1 hour(s), 3 minute(s), 47 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 1
Registry Values Infected: 4
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 50

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
c:\WINDOWS\system32\zifewiba.dll (Trojan.Vundo.H) -> Delete on reboot.

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{d2f64c98-f176-46eb-bfe6-e2f14ee68b77} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jehohahek (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{d2f64c98-f176-46eb-bfe6-e2f14ee68b77} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\jugarojeg (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4569247401 (Rogue.SecurityTool) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\zifewiba.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\zifewiba.dll -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\WINDOWS\system32\zifewiba.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\config\systemprofile\Application Data\4569247401\4569247401.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0000030.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0000048.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001048.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001049.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001099.exe (Rogue.SystemSecurity) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001100.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001101.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001102.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001103.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001104.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001105.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001106.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001107.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001108.exe (Rootkit.Rustock) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001109.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001110.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001111.dll (Rogue.AntiVirusPro) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001112.exe (Rogue.PC_AntiSpyware2010) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001113.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001114.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001115.exe (Rogue.SystemSecurity) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001116.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001117.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001118.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001119.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001120.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001121.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001122.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001123.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001124.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001125.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001126.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001127.exe (Rogue.SystemSecurity) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001128.exe (Rogue.SystemSecurity) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001129.exe (Rogue.SystemSecurity) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001130.exe (Rogue.SystemSecurity) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001131.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001132.sys (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001133.sys (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001134.sys (Rootkit.Rustock) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{57B2554B-3732-4068-8BB6-7671BB408042}\RP0\A0001140.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\herifolu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sidenohe.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\_OTL\MovedFiles\10032009_184725\WINDOWS\System32\garayudi.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\_OTL\MovedFiles\10042009_113924\WINDOWS\System32\helileve.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\_OTL\MovedFiles\10042009_113924\WINDOWS\System32\mofawulo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Amy & Greg\Desktop\Security Tool.LNK (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Amy & Greg\Start Menu\Programs\Security Tool.LNK (Rogue.SecurityTool) -> Quarantined and deleted successfully.

#12 Buckeye_Sam

Malware Expert

Members
17,382 posts
OFFLINE

Gender:Male
Location:Pickerington, Ohio
Local time:12:24 PM

Posted 05 October 2009 - 07:04 AM

Looking much better. Please post another OTL log from normal mode.

#13 ag24

Topic Starter

Members
10 posts
OFFLINE

Local time:01:24 PM

Posted 05 October 2009 - 08:47 PM

Hey Sam.

I'm psyched it's looking better!

Here's the OTL log:

OTL logfile created on: 10/5/2009 9:44:26 PM - Run 5
OTL by OldTimer - Version 3.0.18.0 Folder = C:\Documents and Settings\Amy & Greg\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.07 Mb Total Physical Memory | 176.39 Mb Available Physical Memory | 34.58% Memory free
1.35 Gb Paging File | 1.08 Gb Available in Paging File | 79.86% Paging File free
Paging file location(s): C:\pagefile.sys 900 1800 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.82 Gb Total Space | 73.11 Gb Free Space | 31.40% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 991.22 Mb Total Space | 905.48 Mb Free Space | 91.35% Space Free | Partition Type: FAT
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HOME
Current User Name: Amy & Greg
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2009/06/20 22:54:44 | 01,205,760 | ---- | M] (Webroot Software, Inc. ) -- C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
PRC - [2004/08/25 13:26:56 | 00,389,120 | ---- | M] () -- C:\WINDOWS\System32\Ati2evxx.exe
PRC - [2007/06/13 06:23:07 | 01,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2007/04/03 21:50:00 | 01,603,152 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
PRC - [2007/02/04 13:02:14 | 00,079,400 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
PRC - [2008/09/10 17:40:06 | 00,289,576 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunesHelper.exe
PRC - [2009/05/13 15:40:08 | 06,345,840 | ---- | M] (Webroot Software, Inc.) -- C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
PRC - [2005/09/23 23:05:26 | 00,029,696 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
PRC - [2008/09/10 16:50:26 | 00,116,040 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2008/08/29 10:18:44 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2003/02/20 10:21:16 | 00,046,080 | ---- | M] (C-Dilla Ltd) -- C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
PRC - [2004/12/10 10:46:36 | 00,134,224 | ---- | M] (Command Software Systems, Inc.) -- C:\Program Files\Common Files\Command Software\dvpapi.exe
PRC - [2007/01/04 17:38:08 | 00,024,652 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe
PRC - [2009/04/21 18:26:52 | 04,048,240 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
PRC - [2005/09/30 20:22:50 | 00,096,341 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe
PRC - [2008/09/10 17:39:48 | 00,536,872 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe
PRC - [2004/08/12 09:34:39 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wscntfy.exe
PRC - [2007/01/04 17:38:18 | 00,112,336 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
PRC - [2009/06/29 04:35:10 | 00,634,632 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe
PRC - [2009/04/21 18:26:50 | 00,165,232 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
PRC - [2009/10/02 19:03:37 | 00,519,168 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Amy & Greg\Desktop\OTL.exe

========== Win32 Services (SafeList) ==========

SRV - [2008/09/10 16:50:26 | 00,116,040 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device [Auto | Running])
SRV - [2004/07/15 01:49:26 | 00,032,768 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
SRV - [2004/08/25 13:26:56 | 00,389,120 | ---- | M] () -- C:\WINDOWS\System32\Ati2evxx.exe -- (Ati HotKey Poller [Auto | Running])
SRV - [2004/08/25 12:52:00 | 00,516,096 | ---- | M] () -- C:\WINDOWS\System32\ati2sgag.exe -- (ATI Smart [Auto | Stopped])
SRV - [2008/08/29 10:18:44 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service [Auto | Running])
SRV - [2003/02/20 10:21:16 | 00,046,080 | ---- | M] (C-Dilla Ltd) -- C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE -- (C-DillaSrv [Auto | Running])
SRV - [2005/09/30 20:22:50 | 00,096,341 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8 [Auto | Running])
SRV - File not found -- -- (CurtainsSysSvc [Auto | Stopped])
SRV - [2004/12/10 10:46:36 | 00,134,224 | ---- | M] (Command Software Systems, Inc.) -- C:\Program Files\Common Files\Command Software\dvpapi.exe -- (dvpapi [Auto | Running])
SRV - [2004/08/12 09:25:59 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2005/04/04 00:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped])
SRV - [2008/09/10 17:39:48 | 00,536,872 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service [On_Demand | Running])
SRV - [2005/11/24 17:03:22 | 00,053,337 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe -- (MSCSPTISRV [On_Demand | Stopped])
SRV - [2006/10/26 14:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped])
SRV - [2005/11/24 16:57:44 | 00,053,337 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe -- (PACSPTISVR [On_Demand | Stopped])
SRV - [2005/11/24 16:47:30 | 00,069,718 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -- (SPTISRV [On_Demand | Stopped])
SRV - [2006/01/06 22:25:12 | 00,069,632 | ---- | M] (Sony Corporation) -- C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe -- (SSScsiSV [On_Demand | Stopped])
SRV - [2007/01/04 17:38:08 | 00,024,652 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe -- (Viewpoint Manager Service [Auto | Running])
SRV - [2009/04/21 18:26:52 | 04,048,240 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- (WebrootSpySweeperService [Auto | Running])
SRV - [2006/10/18 20:05:24 | 00,913,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped])
SRV - [2009/06/20 22:54:44 | 01,205,760 | ---- | M] (Webroot Software, Inc. ) -- C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe -- (WRConsumerService [Auto | Running])

========== Driver Services (SafeList) ==========

DRV - [2004/08/25 13:28:46 | 00,787,456 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\DRIVERS\ati2mtag.sys -- (ati2mtag [On_Demand | Running])
DRV - [2003/02/20 10:22:48 | 00,058,288 | ---- | M] (Macrovision) -- C:\WINDOWS\System32\drivers\CDANT.SYS -- (C-Dilla [On_Demand | Stopped])
DRV - [2004/12/10 10:30:48 | 00,707,176 | R--- | M] (Command Software Systems, Inc.) -- C:\WINDOWS\System32\DRIVERS\css-dvp.sys -- (CSS DVP [Auto | Running])
DRV - [2004/02/10 15:49:14 | 00,154,112 | ---- | M] (Intel Corporation) -- C:\WINDOWS\System32\DRIVERS\e100b325.sys -- (E100B [On_Demand | Running])
DRV - [2008/04/17 13:12:54 | 00,015,464 | ---- | M] (GEAR Software Inc.) -- C:\WINDOWS\System32\DRIVERS\GEARAspiWDM.sys -- (GEARAspiWDM [On_Demand | Running])
DRV - [2007/04/06 09:24:55 | 00,029,184 | ---- | M] (Gteko Ltd.) -- C:\WINDOWS\System32\DRIVERS\goprot51.sys -- (GoProto [On_Demand | Stopped])
DRV - [2004/11/10 08:50:52 | 00,032,256 | ---- | M] (Global RISC) -- C:\WINDOWS\System32\Drivers\GRTdiMon.sys -- (GRTdiMon [Auto | Running])
DRV - [2004/08/12 09:26:42 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2005/04/25 05:03:00 | 00,020,640 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running])
DRV - [2004/06/09 09:29:56 | 00,006,977 | ---- | M] (Gteko Ltd.) -- C:\WINDOWS\System32\DDMI2.sys -- (SDDMI2 [On_Demand | Stopped])
DRV - [2007/11/13 06:25:53 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [Auto | Running])
DRV - [2004/09/17 09:02:54 | 00,732,928 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\System32\drivers\senfilt.sys -- (senfilt [On_Demand | Running])
DRV - [2005/01/27 15:31:06 | 00,260,352 | ---- | M] (Analog Devices, Inc.) -- C:\WINDOWS\System32\drivers\smwdm.sys -- (smwdm [On_Demand | Running])
DRV - [2009/04/21 18:27:02 | 00,029,808 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\WINDOWS\system32\DRIVERS\ssfs0bbc.sys -- (ssfs0bbc [Boot | Running])
DRV - [2009/04/21 18:27:04 | 00,023,152 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\WINDOWS\SYSTEM32\Drivers\SSHRMD.SYS -- (SSHRMD [Boot | Running])
DRV - [2009/04/21 18:27:04 | 00,176,752 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\WINDOWS\SYSTEM32\Drivers\SSIDRV.SYS -- (SSIDRV [Boot | Running])
DRV - [2008/01/04 21:34:36 | 00,023,920 | ---- | M] (Webroot Software Inc (www.webroot.com)) -- C:\WINDOWS\System32\Drivers\sskbfd.sys -- (SSKBFD [On_Demand | Stopped])
DRV - [2007/10/31 15:09:14 | 00,030,464 | ---- | M] (Apple, Inc.) -- C:\WINDOWS\System32\Drivers\usbaapl.sys -- (USBAAPL [On_Demand | Stopped])

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch
IE - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\S-1-5-21-1390067357-2111687655-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\S-1-5-21-1390067357-2111687655-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

O1 HOSTS File: (813 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O3 - HKLM\..\Toolbar: (Ask.com Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\..\Toolbar\WebBrowser: (Ask.com Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [AuthConsoleStart] File not found
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
O4 - HKLM..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe (Webroot Software, Inc.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 0
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disableregistrytools = 0
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disabletaskmgr = 0
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1390067357-2111687655-839522115-1003_Classes\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (America Online, Inc.)
O9 - Extra Button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll (Picasa, Inc.)
O9 - Extra 'Tools' menuitem : Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll (Picasa, Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} http://support.dell.com/systemprofiler/SysPro.CAB (SysProWmi Class)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/8/b...heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1B9935E4-8A50-4DD8-BD09-A7518723BF97} https://quicken.ehosts.net/netagent/objects/custappx3.cab (Talisma NetAgent Customer ActiveX Control version 3)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc2.cab (Office Update Installation Engine)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A30FBBDC-FA29-4606-8565-14AADCCA6708} https://photos.riteaid.com/control/RiteAidO...PhotoOnline.cab (Rite Aid One Hour Photo Online Control)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/pub/shock...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} http://cvs.pnimedia.com/upload/activex/v2_...upv2.0.0.10.cab? (Photo Upload Plugin Class)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (c:\windows\system32\) - C:\WINDOWS\System32 [2009/10/04 12:59:44 | 00,000,000 | ---D | M]
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O30 - LSA: Authentication Packages - (OWS\S) - File not found
O30 - LSA: Security Packages - (\ATI) - File not found
O30 - LSA: Security Packages - (CONTROL) - C:\WINDOWS\System32\CONTROL.exe (Microsoft Corporation)
O30 - LSA: Security Packages - (PANEL) - File not found
O30 - LSA: Security Packages - (soft) - File not found
O30 - LSA: Security Packages - (corpora) - File not found
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/06/21 00:21:09 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\WD SmartWare.exe -- File not found
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
O35 - comfile [open] -- "%1" %* File not found
O35 - exefile [open] -- "%1" %* File not found

========== Files/Folders - Created Within 30 Days ==========

[2009/10/02 18:14:53 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/09/29 21:24:35 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2009/09/30 23:23:16 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Western Digital
[2009/10/02 18:14:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Amy & Greg\Application Data\Malwarebytes
[2009/09/30 23:22:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\Western Digital
[2009/10/03 19:19:31 | 00,000,000 | ---D | C] -- C:\Program Files\ESET
[2009/10/02 18:14:53 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/09/29 21:24:35 | 00,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2009/09/30 22:27:20 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2009/10/03 18:47:25 | 00,000,000 | ---D | C] -- C:\_OTL
[2009/10/02 19:03:36 | 00,519,168 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Amy & Greg\Desktop\OTL.exe
[2009/10/02 18:14:54 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/10/02 18:14:53 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/10/02 18:13:24 | 04,045,544 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Amy & Greg\Desktop\mbam-setup.exe
[2009/10/01 22:37:03 | 00,472,064 | ---- | C] ( ) -- C:\Documents and Settings\Amy & Greg\Desktop\RootRepeal.exe
[2009/09/30 23:43:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Amy & Greg\My Documents\Copy of BCBSRI
[2009/09/30 23:43:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Amy & Greg\My Documents\Copy of Addresses
[2009/09/28 23:22:56 | 00,000,000 | -HSD | C] -- C:\WINDOWS\CSC
[2005/06/23 23:58:28 | 00,151,552 | ---- | C] ( ) -- C:\WINDOWS\System32\ATIDEMGR.dll

========== Files - Modified Within 30 Days ==========

[2009/10/05 21:42:03 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/10/05 21:41:33 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/10/05 21:41:24 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/10/04 13:01:00 | 00,000,244 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2009/10/04 11:45:01 | 00,002,497 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\Microsoft Office Word 2003 (2).lnk
[2009/10/04 11:35:30 | 00,011,168 | -H-- | M] () -- C:\WINDOWS\System32\seyebajo
[2009/10/04 00:29:30 | 00,271,360 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\My Documents\backup inbox.pst
[2009/10/03 22:45:04 | 00,020,480 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\Bill form.xls
[2009/10/03 12:30:39 | 00,001,648 | ---- | M] () -- C:\WINDOWS\tasks\wrSpySweeper_LAF4985DAB3564EF0983B0A9F737C9B6D.job
[2009/10/02 19:03:37 | 00,519,168 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Amy & Greg\Desktop\OTL.exe
[2009/10/02 18:14:57 | 00,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/10/02 18:13:29 | 04,045,544 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Amy & Greg\Desktop\mbam-setup.exe
[2009/10/01 23:26:10 | 00,000,218 | ---- | M] () -- C:\xcrashdump.dat
[2009/10/01 22:37:10 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\settings.dat
[2009/10/01 22:37:03 | 00,472,064 | ---- | M] ( ) -- C:\Documents and Settings\Amy & Greg\Desktop\RootRepeal.exe
[2009/10/01 22:34:30 | 00,361,369 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\dds.scr
[2009/10/01 21:29:51 | 00,026,624 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\My Documents\Will medication list for Farm School.doc
[2009/09/30 23:43:10 | 00,000,468 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\My Documents\Shortcut to Addresses.lnk
[2009/09/30 22:27:21 | 00,001,734 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\HijackThis.lnk
[2009/09/30 07:49:26 | 00,000,267 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2009/09/30 01:36:08 | 00,000,552 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat
[2009/09/29 21:24:41 | 00,000,945 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Desktop\Spybot - Search & Destroy.lnk
[2009/09/28 21:22:59 | 00,262,146 | ---- | M] () -- C:\registrybackup.reg
[2009/09/28 20:53:03 | 00,001,917 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2009/09/15 22:31:06 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/09/15 21:08:19 | 00,870,128 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Application Data\mcs.rma
[2009/09/15 21:08:19 | 00,000,004 | ---- | M] () -- C:\Documents and Settings\Amy & Greg\Application Data\A8C0B6
[2009/09/14 23:13:48 | 00,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/09/14 21:40:53 | 00,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2009/09/10 14:54:06 | 00,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/09/10 14:53:50 | 00,019,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

========== Files - No Company Name ==========
[2100/02/24 14:15:04 | 00,000,821 | ---- | C] () -- C:\WINDOWS\Lexmark_ICM.ini
[2100/02/16 16:09:06 | 00,000,062 | ---- | C] () -- C:\WINDOWS\System32\LXASUSCI.INI
[2009/10/02 18:14:57 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/10/01 22:37:10 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Desktop\settings.dat
[2009/10/01 22:34:29 | 00,361,369 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Desktop\dds.scr
[2009/09/30 23:43:10 | 00,000,468 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\My Documents\Shortcut to Addresses.lnk
[2009/09/30 22:27:21 | 00,001,734 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Desktop\HijackThis.lnk
[2009/09/30 01:36:08 | 00,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2009/09/30 01:26:55 | 00,000,218 | ---- | C] () -- C:\xcrashdump.dat
[2009/09/29 23:09:22 | 00,000,945 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Desktop\Spybot - Search & Destroy.lnk
[2009/09/29 22:43:43 | 00,000,267 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2009/09/28 21:22:59 | 00,262,146 | ---- | C] () -- C:\registrybackup.reg
[2009/04/21 18:26:56 | 00,031,088 | ---- | C] () -- C:\WINDOWS\System32\wrLZMA.dll
[2009/04/15 21:43:11 | 00,870,128 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Application Data\mcs.rma
[2009/04/15 21:43:11 | 00,000,004 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Application Data\A8C0B6
[2009/04/03 19:41:06 | 00,000,133 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\fusioncache.dat
[2008/02/16 19:25:42 | 00,000,412 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2008/02/13 20:26:28 | 00,000,004 | RHS- | C] () -- C:\Documents and Settings\All Users\Application Data\sysqcl1129139270.dat
[2007/06/09 15:44:08 | 00,524,288 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2007/06/09 15:44:08 | 00,139,264 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2007/05/13 20:58:44 | 00,098,304 | ---- | C] () -- C:\WINDOWS\System32\resourceGeneric.dll
[2006/10/29 09:02:53 | 00,684,032 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
[2006/10/29 09:02:53 | 00,155,648 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll
[2006/08/20 11:42:55 | 00,056,320 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll
[2006/07/16 16:44:18 | 00,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll
[2006/07/16 16:44:18 | 00,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll
[2006/07/16 16:44:18 | 00,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll
[2006/07/16 16:42:54 | 00,000,197 | ---- | C] () -- C:\WINDOWS\disneysy.ini
[2006/03/25 12:09:31 | 00,201,216 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/01/11 04:00:53 | 00,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2005/12/16 14:48:29 | 00,000,029 | ---- | C] () -- C:\WINDOWS\atid.ini
[2005/12/06 20:57:17 | 00,002,528 | ---- | C] () -- C:\WINDOWS\FCIC.INI
[2005/10/28 13:46:17 | 00,000,078 | ---- | C] () -- C:\WINDOWS\TONKA.INI
[2005/10/23 23:29:56 | 00,102,912 | ---- | C] () -- C:\WINDOWS\System32\islzma.dll
[2005/10/23 23:29:54 | 00,684,032 | ---- | C] () -- C:\WINDOWS\libeay32.dll
[2005/10/23 23:29:54 | 00,155,648 | ---- | C] () -- C:\WINDOWS\ssleay32.dll
[2005/10/23 08:38:15 | 00,000,000 | ---- | C] () -- C:\WINDOWS\SETUP32.INI
[2005/10/22 19:15:55 | 00,003,636 | ---- | C] () -- C:\WINDOWS\disney.ini
[2005/10/18 20:09:32 | 00,000,222 | ---- | C] () -- C:\WINDOWS\Quicken.ini
[2005/09/20 18:51:14 | 00,012,288 | ---- | C] () -- C:\WINDOWS\System32\Hlinkprx.dll
[2005/09/15 22:40:14 | 00,003,392 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2005/08/18 18:31:47 | 00,000,750 | ---- | C] () -- C:\WINDOWS\hegames.ini
[2005/07/13 23:50:25 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/07/09 10:27:30 | 00,001,681 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2005/07/08 18:59:26 | 00,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
[2005/06/24 22:34:04 | 00,000,020 | ---- | C] () -- C:\WINDOWS\ACMonitor_X83.ini
[2005/06/24 22:30:07 | 00,004,672 | ---- | C] () -- C:\WINDOWS\System32\LXASUSCI.DLL
[2005/06/24 00:02:58 | 00,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
[2005/06/23 23:58:28 | 00,086,016 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.dll
[2005/06/23 23:57:34 | 00,074,632 | ---- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2005/06/21 00:31:05 | 05,366,470 | -H-- | C] () -- C:\Documents and Settings\Amy & Greg\Local Settings\Application Data\IconCache.db
[2005/06/21 00:28:23 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\Amy & Greg\Application Data\desktop.ini
[2005/06/20 19:32:40 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini
[2005/06/11 12:47:00 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\fpprintmon.dll
[2005/04/14 17:01:34 | 00,032,768 | R--- | C] () -- C:\WINDOWS\System32\dwsvclnt.dll
[2004/08/12 09:33:16 | 00,000,736 | ---- | C] () -- C:\WINDOWS\win.ini
[2004/08/12 09:30:36 | 00,000,243 | ---- | C] () -- C:\WINDOWS\SYSTEM.INI
[2003/01/07 15:05:08 | 00,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/04/10 13:11:04 | 00,000,194 | ---- | C] () -- C:\WINDOWS\X83_DS.ini
[2002/03/04 22:33:24 | 00,102,400 | ---- | C] () -- C:\WINDOWS\System32\LXASBCE.DLL
[2001/03/05 14:07:22 | 00,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXASICO.DLL
[2001/01/05 13:34:30 | 00,016,812 | ---- | C] () -- C:\WINDOWS\System32\lxas2kpm.dll
[2001/01/05 12:08:02 | 00,008,427 | ---- | C] () -- C:\WINDOWS\System32\lxas2kui.dll
[2000/10/24 09:08:36 | 00,118,784 | ---- | C] () -- C:\WINDOWS\System32\LFKODAK.DLL
[2000/10/24 09:08:33 | 00,338,944 | ---- | C] () -- C:\WINDOWS\System32\lffpx7.dll
[1997/10/24 14:56:36 | 00,000,643 | ---- | C] () -- C:\WINDOWS\LEXSTAT.INI
< End of report >

How do I look?

Greg

#14 Buckeye_Sam

Malware Expert

Members
17,382 posts
OFFLINE

Gender:Male
Location:Pickerington, Ohio
Local time:12:24 PM

Posted 06 October 2009 - 07:39 AM

Looks clean to me!
How are things on your end? Any popups or other problems?

#15 ag24

Topic Starter

Members
10 posts
OFFLINE

Local time:01:24 PM

Posted 06 October 2009 - 08:28 AM

Thanks Sam!

I've been generally staying off until I get the bill of health

! But the few times I logged in all looked good.

I'm not sure how I got the virus. As you know, I currently have spysweeper -- would you recommend I use something else, like malwarebytes and stop using spysweeper, or do you have other suggestions?

I really appreciate your help!

Greg