I don't know what Malware I may have

I can't open users or other settings on my computer. I ran chkdsk and still have the problem

Hi smelser7,

Welcome to Bleeping Computer!

My name is mpascal, and I will be helping you fix your problem.

Before we begin, I would like give a few guidelines so that we can fix your problem as quickly and efficiently as possible:

• Be sure to follow all my instructions carefully! If there is anything you don't understand, don't hesitate to ask.
• Please do not do anything or perform other steps unless I have asked you to do so.
• Please make sure you post all logs I ask you to, and make sure that the entire log gets posted.
• Don't attach any logs unless asked. Posting them in the forums will make them easier to analyze.
• If you are unsure of how to reply, or need help with anything regarding the website, please look here.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below I will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

STEP 1 - MBAM

Note: In the event that you already have MBAM installed, you do not need to reinstall it. Simply Updating it and doing a Quickscan is sufficient.

Please download Malwarebytes Anti-Malware (v1.44) and save it to your desktop.

Download Link 1
Download Link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
  For instructions with screenshots, please refer to the How to use Malwarebytes' Anti-Malware Guide.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
• If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
• Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
• Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

STEP 2 - GMER

Please download GMER from one of the following locations and save it to your desktop:

• Main Mirror
  This version will download a randomly named file (Recommended)
• Zipped Mirror
  This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

• Disconnect from the Internet and close all running programs.
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
• Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
  
  
  
• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
• Now click the Scan button. If you see a rootkit warning window, click OK.
• When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
• Click the Copy button and paste the results into your next reply.
• Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

-- If you encounter any problems, try running GMER in safe mode.
-- If GMER crashes or keeps resulting in a BSODs, uncheck Devices on the right side before scanning.

STEP 3 - OTL

Download OTL to your desktop.

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output.
• In the Custom Scans box, copy and paste the following:
  CODE
  netsvcs
  %SYSTEMDRIVE%\*.*
  %systemroot%\Fonts\*.com
  %systemroot%\Fonts\*.dll
  %systemroot%\Fonts\*.ini
  %systemroot%\Fonts\*.ini2
  %systemroot%\Fonts\*.exe
  %systemroot%\system32\spool\prtprocs\w32x86\*.*
  %systemroot%\REPAIR\*.bak1
  %systemroot%\REPAIR\*.ini
  %systemroot%\system32\*.jpg
  %systemroot%\*.jpg
  %systemroot%\*.png
  %systemroot%\*.scr
  %systemroot%\*._sy
  %APPDATA%\Adobe\Update\*.*
  %ALLUSERSPROFILE%\Favorites\*.*
  %APPDATA%\Microsoft\*.*
  %PROGRAMFILES%\*.*
  %APPDATA%\Update\*.*
  %systemroot%\*. /mp /s
  CREATERESTOREPOINT
  %systemroot%\System32\config\*.sav
  %PROGRAMFILES%\bak. /s
  %systemroot%\system32\bak. /s
  %ALLUSERSPROFILE%\Start Menu\*.lnk /x
  %systemroot%\system32\config\systemprofile\*.dat /x
  %systemroot%\*.config
  %systemroot%\system32\*.db
  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of the files, and post it with your next reply.

STEP 4 - Reply

Please reply with the following logs:

• MBAM Log
• GMER Log
• OTL Log

I did what you said, I think. This is what happened when I tried to run GMER I got a message - load driver ( C\docume user\locals 1\temp/agxoy korb.sys" )A required privilege is not held by the client. I got it to run in safe mode but there was nothing in the report. When I ran Maul wear Bytes it removed 36 items.

OTL logfile created on: 9/8/2010 12:21:36 PM - Run 1
OTL by OldTimer - Version 3.2.11.0 Folder = C:\Documents and Settings\User\My Documents
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

766.00 Mb Total Physical Memory | 347.00 Mb Available Physical Memory | 45.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 70.00% Paging File free
Paging file location(s): C:\pagefile.sys 1149 1149 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 27.95 Gb Total Space | 14.48 Gb Free Space | 51.82% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 283.81 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: OWNER-DCAA56001
Current User Name: User
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\User\My Documents\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe (Crawler.com)
PRC - C:\Program Files\Spyware Terminator\sp_rsser.exe (Crawler.com)
PRC - C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe (Siber Systems)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\afwServ.exe (AVAST Software)
PRC - C:\Program Files\Uniblue\SpeedUpMyPC\sump.exe (Uniblue Systems Limited)
PRC - C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing, S.L.)
PRC - C:\Program Files\LimeWire\LimeWire.exe (Lime Wire, LLC)
PRC - C:\Program Files\NCH Software\ExpressInvoice\expressinvoice.exe (NCH Software)
PRC - C:\Program Files\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Pure Networks\Network Magic\nmapp.exe (Pure Networks, Inc.)
PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Pure Networks, Inc.)
PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Pure Networks, Inc.)
PRC - C:\WINDOWS\system32\ntvdm.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (Nero AG)
PRC - C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
PRC - C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
PRC - C:\Program Files\GE\USB 2.0 Card Reader\shwicon2k.exe (Alcor Micro, Corp.)
PRC - C:\Program Files\Iomega\AutoDisk\ADService.exe (Iomega Corporation)
PRC - C:\Program Files\Iomega\AutoDisk\ADUserMon.exe (Iomega Corporation)
PRC - C:\Program Files\Iomega\System32\AppServices.exe (Iomega Corporation)
PRC - C:\Program Files\Iomega\DriveIcons\Imgicon.exe (Iomega)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_S0EIC1.EXE (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Caere\OmniPagePro90\OPware32.exe (Caere Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\User\My Documents\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\Program Files\Iomega\DriveIcons\Imghook.dll (Iomega Corporation)
MOD - C:\Program Files\Caere\OmniPagePro90\OPHOOK32.dll (Caere Corporation)


========== Win32 Services (SafeList) ==========

SRV - (Iomega Activity Disk2) -- File not found
SRV - (sp_rssrv) -- C:\Program Files\Spyware Terminator\sp_rsser.exe (Crawler.com)
SRV - (avast! Web Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Mail Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Firewall) -- C:\Program Files\Alwil Software\Avast5\afwServ.exe (AVAST Software)
SRV - (ExpressInvoiceService) -- C:\Program Files\NCH Software\ExpressInvoice\expressinvoice.exe (NCH Software)
SRV - (nmraapache) -- C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe (Pure Networks, Inc.)
SRV - (nmservice) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Pure Networks, Inc.)
SRV - (_IOMEGA_ACTIVE_DISK_SERVICE_) -- C:\Program Files\Iomega\AutoDisk\ADService.exe (Iomega Corporation)
SRV - (Iomega App Services) -- C:\Program Files\Iomega\System32\AppServices.exe (Iomega Corporation)


========== Driver Services (SafeList) ==========

DRV - (RPSKT) Security Services Driver (x86) -- C:\WINDOWS\System32\DRIVERS\rp_skt32.sys File not found
DRV - (aswFW) -- C:\WINDOWS\System32\drivers\aswFW.sys (AVAST Software)
DRV - (aswSnx) -- C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswNdis2) -- C:\WINDOWS\System32\drivers\aswNdis2.sys (AVAST Software)
DRV - (aswTdi) -- C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswSP) -- C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswRdr) -- C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswMon2) -- C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswFsBlk) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (Aavmker4) -- C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (sp_rsdrv2) -- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ()
DRV - (aswNdis) -- C:\WINDOWS\system32\DRIVERS\aswNdis.sys (ALWIL Software)
DRV - (NuidFltr) -- C:\WINDOWS\system32\drivers\nuidfltr.sys (Microsoft Corporation)
DRV - (pnarp) -- C:\WINDOWS\system32\drivers\pnarp.sys (Pure Networks, Inc.)
DRV - (purendis) -- C:\WINDOWS\system32\drivers\purendis.sys (Pure Networks, Inc.)
DRV - (ppa3) -- C:\WINDOWS\system32\DRIVERS\ppa3.sys (Microsoft Corporation)
DRV - (JL2005C) -- C:\WINDOWS\system32\drivers\jl2005c.sys (Windows ® 2000 DDK provider)
DRV - (SunkFilt) -- C:\WINDOWS\system32\drivers\Sunkfilt.sys (Alcor Micro Corp.)
DRV - (BCMModem) -- C:\WINDOWS\system32\drivers\BCMSM.sys (Broadcom Corporation)
DRV - (bcm4sbxp) -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (iomdisk) -- C:\WINDOWS\System32\DRIVERS\iomdisk.sys (Iomega Corporation)
DRV - (MODEMCSA) -- C:\WINDOWS\system32\drivers\MODEMCSA.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\..\URLSearchHook: {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaultthis.engineName: "NCH Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2117678&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://by157w.bay157.mail.live.com/?rru=inbox"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.1
FF - prefs.js..extensions.enabledItems: {22119944-ED35-4ab1-910B-E619EA06A115}:6.9.98
FF - prefs.js..extensions.enabledItems: piclens@cooliris.com:1.12.0.36949
FF - prefs.js..extensions.enabledItems: {62760FD6-B943-48C9-AB09-F99C6FE96088}:2.1
FF - prefs.js..extensions.enabledItems: lazarus@interclue.com:2.0.5
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100503
FF - prefs.js..extensions.enabledItems: {c2db4fe6-8409-45ce-8010-189a7b5cce86}:2.5.6.0
FF - prefs.js..extensions.enabledItems: foxmarks@kei.com:3.7.8
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..keyword.URL: "http://websearch.ask.com/redirect?client=ff&src=kw&tb=FXTV5&o=16046&locale=en_US&apn_uid=37E4C7C8-574B-429C-A17C-9E1BDF3B420A&apn_ptnrs=OE&apn_sauid=2F459E29-C843-4C88-89F0-9FA981D18AF5&apn_dtid=&q="

FF - HKLM\software\mozilla\Firefox\Extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files\Siber Systems\AI RoboForm\Firefox [2009/08/28 17:29:57 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/08/02 13:10:19 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/03 14:11:51 | 000,000,000 | ---D | M]

[2010/04/22 09:51:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Mozilla\Extensions
[2010/04/22 09:51:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Mozilla\Extensions\mozswing@mozswing.org
[2010/09/06 13:20:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions
[2010/04/30 20:51:26 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/07/14 15:03:18 | 000,000,000 | ---D | M] (eBay Sidebar for Firefox) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}
[2010/04/30 20:51:25 | 000,000,000 | ---D | M] (Firefox Showcase) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\{89506680-e3f4-484c-a2c0-ed711d481eda}
[2010/05/12 11:36:12 | 000,000,000 | ---D | M] (WOT) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010/02/25 16:20:26 | 000,000,000 | ---D | M] (NCH Toolbar) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\{c2db4fe6-8409-45ce-8010-189a7b5cce86}
[2010/07/14 15:02:32 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/08/13 17:54:38 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus®)) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}(2)
[2010/07/03 20:34:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\foxmarks@kei.com
[2009/12/31 11:58:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\lazarus@interclue.com
[2010/06/19 11:31:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\piclens@cooliris.com
[2010/06/19 11:31:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\piclens@cooliris.com-trash
[2010/09/03 14:15:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\toolbar@ask(2).com
[2010/09/02 18:52:52 | 000,002,557 | ---- | M] () -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\searchplugins\askcom.xml
[2010/02/25 16:07:30 | 000,001,819 | ---- | M] () -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\searchplugins\bing.xml
[2010/02/25 11:49:46 | 000,000,909 | ---- | M] () -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\searchplugins\conduit.xml
[2010/09/05 23:28:06 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2010/07/23 16:08:57 | 000,414,692 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 14321 more lines...
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKLM\..\Toolbar: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.
O3 - HKLM\..\Toolbar: (&RoboForm) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKLM\..\Toolbar: (no name) - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O4 - HKLM..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe (Iomega Corporation)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Deskup] C:\Program Files\Iomega\DriveIcons\deskup.exe (Iomega)
O4 - HKLM..\Run: [EPSON Stylus Photo 820 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0EIC1.EXE (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\Imgicon.exe (Iomega)
O4 - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [nmapp] C:\Program Files\Pure Networks\Network Magic\nmapp.exe (Pure Networks, Inc.)
O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Pure Networks, Inc.)
O4 - HKLM..\Run: [OmniPage] C:\Program Files\Caere\OmniPagePro90\OPware32.exe (Caere Corporation)
O4 - HKLM..\Run: [Sunkist2k] C:\Program Files\GE\USB 2.0 Card Reader\shwicon2k.exe (Alcor Micro, Corp.)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [RoboForm] C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - HKLM..\RunOnce: [aswAhAScr.dll] C:\Program Files\Alwil Software\Avast5\aswRegSvr.exe ()
O4 - HKLM..\RunOnce: [aswasOutExt.dll] C:\Program Files\Alwil Software\Avast5\aswRegSvr.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing, S.L.)
O4 - Startup: C:\Documents and Settings\User\Start Menu\Programs\Startup\LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe (Lime Wire, LLC)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - Reg Error: Key error. File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: tasteofhome ([]https in Trusted sites)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/...b?1250348623265 (WUWebControl Class)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_19)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 71.242.0.12
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Pure Networks, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/08/15 10:31:22 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/07/18 15:11:00 | 000,000,183 | R--- | M] () - E:\autorun.bat -- [ CDFS ]
O32 - AutoRun File - [2006/07/18 15:11:03 | 000,000,055 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O33 - MountPoints2\{b48ed285-9416-11de-b982-000bdb0e1ce5}\Shell - "" = AutoRun
O33 - MountPoints2\{b48ed285-9416-11de-b982-000bdb0e1ce5}\Shell\AutoRun - "" = Auto&Play
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902053519425536)

========== Files/Folders - Created Within 30 Days ==========

[2010/09/08 12:17:15 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\User\My Documents\OTL.exe
[2010/09/08 12:01:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Application Data\VSRevoGroup
[2010/09/06 19:19:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Application Data\Malwarebytes
[2010/09/06 19:18:15 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/09/06 19:18:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/09/06 19:17:54 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/09/06 19:17:53 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/09/06 19:15:56 | 006,153,352 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\User\My Documents\mbam-setup-1.46.exe
[2010/09/03 18:56:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Local Settings\Application Data\WinZip
[2010/09/03 15:41:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2010/09/03 15:40:25 | 000,000,000 | ---D | C] -- C:\Program Files\WinZip
[2010/09/03 14:46:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\My Documents\Downloads
[2010/09/03 14:16:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Application Data\Spyware Terminator
[2010/09/03 14:16:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spyware Terminator
[2010/09/03 09:33:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spyware Terminator(3)
[2010/09/02 21:44:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spyware Terminator(2)
[2010/08/30 16:23:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Application Data\Leadertech
[2010/08/30 16:19:19 | 000,000,000 | ---D | C] -- C:\Program Files\palmOne
[2010/08/30 16:16:12 | 050,014,317 | ---- | C] (palmOne, Inc. ) -- C:\Documents and Settings\User\My Documents\PD414esetup.exe
[2010/08/23 20:30:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\My Documents\gmer
[2010/08/23 20:08:32 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData
[2010/08/22 13:26:36 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com
[2010/08/22 13:26:21 | 000,000,000 | ---D | C] -- C:\Program Files\Foxit Software
[2010/08/22 13:25:16 | 007,019,008 | ---- | C] (Foxit Software Company) -- C:\Documents and Settings\User\My Documents\FoxitReader411_enu_Setup.exe
[2010/08/20 21:01:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\My Documents\eBayISAPI.dll_files
[2010/08/19 18:27:12 | 000,000,000 | ---D | C] -- C:\WINDOWS\SxsCaPendDel
[2010/08/14 12:06:28 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2010/08/14 11:45:45 | 016,883,056 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\User\My Documents\IE8-WindowsXP-x86-ENU.exe
[2010/08/14 11:33:02 | 000,000,000 | -HSD | C] -- C:\WINDOWS\CSC
[2010/08/13 19:16:52 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\User\My Documents\rundll32.exe
[2010/08/13 17:54:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Local Settings\Application Data\NOS
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/09/08 12:17:59 | 000,000,807 | ---- | M] () -- C:\Documents and Settings\User\Desktop\Shortcut to OTL.lnk
[2010/09/08 12:17:16 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\User\My Documents\OTL.exe
[2010/09/08 12:15:55 | 000,002,626 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010/09/08 12:03:07 | 000,001,536 | ---- | M] () -- C:\Documents and Settings\User\Start Menu\Programs\Startup\LimeWire On Startup.lnk
[2010/09/08 12:01:00 | 000,000,232 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2010/09/08 11:59:07 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/09/08 11:57:40 | 000,000,310 | ---- | M] () -- C:\WINDOWS\tasks\GlaryInitialize.job
[2010/09/08 11:57:12 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/09/08 11:57:00 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/09/08 11:56:18 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\User\ntuser.ini
[2010/09/08 11:56:17 | 007,864,320 | ---- | M] () -- C:\Documents and Settings\User\ntuser.dat
[2010/09/08 11:56:15 | 000,594,832 | -H-- | M] () -- C:\Documents and Settings\User\Local Settings\Application Data\IconCache.db
[2010/09/08 11:50:14 | 000,000,838 | ---- | M] () -- C:\Documents and Settings\User\Desktop\Shortcut to cmj1xh3m.lnk
[2010/09/08 11:49:44 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\User\My Documents\cmj1xh3m.exe
[2010/09/08 11:38:07 | 000,000,974 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1220945662-688789844-1801674531-1003UA.job
[2010/09/08 11:19:26 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\User\My Documents\73emijdx.exe
[2010/09/07 23:38:01 | 000,000,922 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1220945662-688789844-1801674531-1003Core.job
[2010/09/07 13:00:00 | 000,000,326 | ---- | M] () -- C:\WINDOWS\tasks\GoodSync - RoboForm Online.job
[2010/09/07 11:12:17 | 000,038,848 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2010/09/07 11:11:54 | 000,167,592 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2010/09/07 10:54:16 | 000,099,792 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFW.sys
[2010/09/07 10:53:58 | 000,340,048 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2010/09/07 10:53:35 | 000,190,416 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswNdis2.sys
[2010/09/07 10:52:25 | 000,046,672 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2010/09/07 10:52:03 | 000,165,584 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2010/09/07 10:47:46 | 000,023,376 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2010/09/07 10:47:19 | 000,100,176 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2010/09/07 10:47:16 | 000,094,544 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2010/09/07 10:47:07 | 000,017,744 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2010/09/07 10:46:51 | 000,028,880 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2010/09/06 21:17:23 | 000,284,915 | ---- | M] () -- C:\Documents and Settings\User\My Documents\gmer(3).zip
[2010/09/06 21:14:18 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\User\My Documents\qxq0mks1.exe
[2010/09/06 19:18:23 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/09/06 19:16:15 | 006,153,352 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\User\My Documents\mbam-setup-1.46.exe
[2010/09/03 22:04:00 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/09/03 19:11:05 | 000,005,397 | ---- | M] () -- C:\Documents and Settings\User\My Documents\89.jpg
[2010/09/03 18:49:43 | 000,001,732 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\WinZip.lnk
[2010/09/03 18:49:39 | 000,001,660 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
[2010/09/03 15:37:52 | 014,501,192 | ---- | M] () -- C:\Documents and Settings\User\My Documents\winzip145.exe
[2010/09/03 15:28:33 | 000,000,745 | ---- | M] () -- C:\Documents and Settings\User\My Documents\xp_exe_fix(2).zip
[2010/08/30 16:59:41 | 002,375,392 | R--- | M] () -- C:\Documents and Settings\User\My Documents\Palm III ex.PDF
[2010/08/30 16:17:08 | 050,014,317 | ---- | M] (palmOne, Inc. ) -- C:\Documents and Settings\User\My Documents\PD414esetup.exe
[2010/08/23 20:29:41 | 000,284,915 | ---- | M] () -- C:\Documents and Settings\User\My Documents\gmer(2).zip
[2010/08/23 20:23:52 | 000,000,779 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Shortcut to dds.lnk
[2010/08/23 20:23:33 | 000,525,824 | ---- | M] () -- C:\Documents and Settings\User\My Documents\dds.scr
[2010/08/23 20:22:29 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\User\defogger_reenable
[2010/08/23 20:20:21 | 000,284,915 | ---- | M] () -- C:\Documents and Settings\User\My Documents\gmer.zip
[2010/08/23 20:14:43 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Defogger.exe
[2010/08/23 19:59:21 | 000,123,519 | ---- | M] () -- C:\Documents and Settings\User\My Documents\trn_trackside_winner_100823.jpg
[2010/08/22 20:16:55 | 002,836,376 | R--- | M] () -- C:\Documents and Settings\User\My Documents\m500series_ug.pdf
[2010/08/22 13:27:02 | 000,000,217 | ---- | M] () -- C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\eBay.url
[2010/08/22 13:27:02 | 000,000,217 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\eBay.url
[2010/08/22 13:25:18 | 007,019,008 | ---- | M] (Foxit Software Company) -- C:\Documents and Settings\User\My Documents\FoxitReader411_enu_Setup.exe
[2010/08/20 21:01:52 | 000,110,890 | ---- | M] () -- C:\Documents and Settings\User\My Documents\eBayISAPI.dll.htm
[2010/08/19 11:22:48 | 000,081,321 | ---- | M] () -- C:\WINDOWS\SGTBox.INI
[2010/08/18 10:51:57 | 000,000,675 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/08/15 03:01:37 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/08/14 20:50:56 | 000,000,815 | ---- | M] () -- C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/08/14 12:08:32 | 000,000,873 | ---- | M] () -- C:\WINDOWS\System32\spupdsvc.inf
[2010/08/14 11:45:55 | 016,883,056 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\User\My Documents\IE8-WindowsXP-x86-ENU.exe
[2010/08/13 19:28:42 | 000,000,745 | ---- | M] () -- C:\Documents and Settings\User\My Documents\xp_exe_fix.zip
[2010/08/13 19:07:46 | 000,000,126 | ---- | M] () -- C:\WINDOWS\System32\mmc.exe.config
[2010/08/13 18:26:29 | 000,970,672 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/08/13 18:19:38 | 000,441,454 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/08/13 18:19:38 | 000,071,264 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/08/13 18:19:37 | 000,501,780 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/08/13 18:01:49 | 000,001,700 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Internet Security.lnk
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/08 12:17:59 | 000,000,807 | ---- | C] () -- C:\Documents and Settings\User\Desktop\Shortcut to OTL.lnk
[2010/09/08 12:03:07 | 000,001,536 | ---- | C] () -- C:\Documents and Settings\User\Start Menu\Programs\Startup\LimeWire On Startup.lnk
[2010/09/08 11:50:13 | 000,000,838 | ---- | C] () -- C:\Documents and Settings\User\Desktop\Shortcut to cmj1xh3m.lnk
[2010/09/08 11:49:43 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\User\My Documents\cmj1xh3m.exe
[2010/09/08 11:19:24 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\User\My Documents\73emijdx.exe
[2010/09/06 21:17:20 | 000,284,915 | ---- | C] () -- C:\Documents and Settings\User\My Documents\gmer(3).zip
[2010/09/06 21:14:17 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\User\My Documents\qxq0mks1.exe
[2010/09/06 19:18:23 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/09/03 19:11:04 | 000,005,397 | ---- | C] () -- C:\Documents and Settings\User\My Documents\89.jpg
[2010/09/03 18:49:43 | 000,001,732 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\WinZip.lnk
[2010/09/03 18:49:31 | 000,001,660 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
[2010/09/03 15:36:55 | 014,501,192 | ---- | C] () -- C:\Documents and Settings\User\My Documents\winzip145.exe
[2010/09/03 15:28:32 | 000,000,745 | ---- | C] () -- C:\Documents and Settings\User\My Documents\xp_exe_fix(2).zip
[2010/08/30 17:00:29 | 002,375,392 | R--- | C] () -- C:\Documents and Settings\User\My Documents\Palm III ex.PDF
[2010/08/23 20:29:41 | 000,284,915 | ---- | C] () -- C:\Documents and Settings\User\My Documents\gmer(2).zip
[2010/08/23 20:23:52 | 000,000,779 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Shortcut to dds.lnk
[2010/08/23 20:23:32 | 000,525,824 | ---- | C] () -- C:\Documents and Settings\User\My Documents\dds.scr
[2010/08/23 20:22:29 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\User\defogger_reenable
[2010/08/23 20:20:20 | 000,284,915 | ---- | C] () -- C:\Documents and Settings\User\My Documents\gmer.zip
[2010/08/23 20:14:43 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Defogger.exe
[2010/08/23 19:59:20 | 000,123,519 | ---- | C] () -- C:\Documents and Settings\User\My Documents\trn_trackside_winner_100823.jpg
[2010/08/22 20:17:47 | 002,836,376 | R--- | C] () -- C:\Documents and Settings\User\My Documents\m500series_ug.pdf
[2010/08/22 13:27:02 | 000,000,217 | ---- | C] () -- C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\eBay.url
[2010/08/22 13:27:02 | 000,000,217 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\eBay.url
[2010/08/20 21:01:47 | 000,110,890 | ---- | C] () -- C:\Documents and Settings\User\My Documents\eBayISAPI.dll.htm
[2010/08/19 18:37:11 | 007,864,320 | ---- | C] () -- C:\Documents and Settings\User\ntuser.dat
[2010/08/14 12:08:32 | 000,000,873 | ---- | C] () -- C:\WINDOWS\System32\spupdsvc.inf
[2010/08/13 19:28:41 | 000,000,745 | ---- | C] () -- C:\Documents and Settings\User\My Documents\xp_exe_fix.zip
[2010/08/13 19:07:46 | 000,000,126 | ---- | C] () -- C:\WINDOWS\System32\mmc.exe.config
[2010/08/13 18:01:49 | 000,001,700 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Internet Security.lnk
[2010/07/22 12:47:14 | 000,142,592 | ---- | C] () -- C:\WINDOWS\System32\drivers\sp_rsdrv2.sys
[2010/07/16 11:00:56 | 000,000,177 | ---- | C] () -- C:\WINDOWS\WinInit.ini
[2010/06/30 13:15:54 | 000,001,571 | ---- | C] () -- C:\WINDOWS\Faxcpp1.ini
[2010/06/30 13:15:54 | 000,000,422 | ---- | C] () -- C:\WINDOWS\Faxcpp.ini
[2010/06/30 13:15:11 | 000,241,664 | ---- | C] () -- C:\WINDOWS\System32\Image32.dll
[2010/06/30 13:15:11 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\Png32.dll
[2010/06/30 13:15:11 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\Jpeg32.dll
[2010/06/30 13:15:11 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\Tga32.dll
[2010/06/30 13:15:11 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\Pcx32.dll
[2010/06/30 13:15:11 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\Twscan32.dll
[2010/06/16 16:01:44 | 001,028,096 | ---- | C] () -- C:\WINDOWS\System32\MGIIpl2P5.dll
[2010/06/16 16:01:43 | 001,228,800 | ---- | C] () -- C:\WINDOWS\System32\MGIIpl2M6.dll
[2010/06/16 16:01:43 | 001,200,128 | ---- | C] () -- C:\WINDOWS\System32\MGIIpl2M5.dll
[2010/06/16 16:01:42 | 001,265,664 | ---- | C] () -- C:\WINDOWS\System32\MGIIpl2A6.dll
[2010/06/16 16:01:42 | 001,073,152 | ---- | C] () -- C:\WINDOWS\System32\MGIIpl2P6.dll
[2010/06/16 16:01:42 | 001,064,960 | ---- | C] () -- C:\WINDOWS\System32\MGIIpl2PX.dll
[2010/06/16 16:01:42 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\MGIIpl2.dll
[2010/06/16 16:01:41 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\JPEGLIB.DLL
[2010/06/16 16:01:40 | 000,332,800 | ---- | C] () -- C:\WINDOWS\System32\FPXLIB.DLL
[2010/06/16 16:01:40 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\CPUINF32.DLL
[2010/05/23 16:24:52 | 000,081,321 | ---- | C] () -- C:\WINDOWS\SGTBox.INI
[2010/05/17 19:38:25 | 000,000,572 | ---- | C] () -- C:\WINDOWS\maxlink.ini
[2010/05/17 19:36:44 | 000,000,000 | ---- | C] () -- C:\WINDOWS\OP70.INI
[2010/05/17 18:55:35 | 000,008,575 | R--- | C] () -- C:\WINDOWS\System32\D125UFW.INI
[2010/03/09 20:44:08 | 000,000,081 | ---- | C] () -- C:\WINDOWS\PARSONS.INI
[2009/12/29 16:28:50 | 000,000,038 | ---- | C] () -- C:\WINDOWS\Pt.dll
[2009/11/28 22:37:14 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\User\Application Data\wklnhst.dat
[2009/11/10 12:18:44 | 000,000,046 | ---- | C] () -- C:\Documents and Settings\User\Application Data\GNAT.INI
[2009/10/29 20:11:41 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2009/10/19 15:50:40 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009/09/12 15:24:46 | 000,000,574 | ---- | C] () -- C:\WINDOWS\hegames.ini
[2009/09/05 20:01:21 | 000,000,023 | ---- | C] () -- C:\WINDOWS\Edmark.ini
[2009/09/05 17:16:07 | 000,001,594 | ---- | C] () -- C:\WINDOWS\disney.ini
[2009/09/04 10:21:28 | 000,000,165 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI
[2009/08/31 17:14:23 | 000,000,162 | ---- | C] () -- C:\WINDOWS\mrpotato.ini
[2009/08/20 11:39:17 | 000,000,046 | ---- | C] () -- C:\WINDOWS\QTW.INI
[2009/08/20 11:33:54 | 000,000,112 | ---- | C] () -- C:\WINDOWS\TLCAPPS.INI
[2000/12/13 19:22:24 | 000,100,432 | ---- | C] () -- C:\Program Files\Win2000PPAHotfix.exe

========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/02/27 14:19:32 | 000,000,035 | ---- | M] () -- C:\aa.txt
[2009/08/15 10:31:22 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2009/08/15 11:08:10 | 000,000,320 | -HS- | M] () -- C:\boot.ini
[2009/08/15 10:31:22 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2010/08/30 16:21:41 | 003,902,110 | ---- | M] () -- C:\HuskyInstallerLog.txt
[2009/08/15 10:31:22 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2009/08/15 10:31:22 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2004/08/04 06:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2009/08/15 11:37:05 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2010/09/08 11:56:58 | 1204,813,824 | -HS- | M] () -- C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/08/15 10:30:32 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 08:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/07/06 06:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/09/07 11:12:17 | 000,038,848 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2000/12/12 12:17:40 | 000,100,432 | ---- | M] () -- C:\Program Files\Win2000PPAHotfix.exe

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2009/08/15 06:17:01 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2009/08/15 06:17:01 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2009/08/15 06:17:01 | 000,888,832 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2009/08/15 11:42:10 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-08-15 07:01:49

========== Files - Unicode (All) ==========
[2009/08/21 10:00:51 | 000,000,040 | ---- | M] ()(C:\WINDOWS\System32\????????????????????4???????????????????????) -- C:\WINDOWS\System32\㩃停潲牧浡䘠汩獥噜牥穩湯噜牥穩湯䤠瑮牥敮⁴敓畣楲祴匠極整卜晡䍥湯敮瑣䍜湯楦屧噘敩⹷潣普杩
[2009/08/21 10:00:51 | 000,000,040 | ---- | C] ()(C:\WINDOWS\System32\????????????????????4???????????????????????) -- C:\WINDOWS\System32\㩃停潲牧浡䘠汩獥噜牥穩湯噜牥穩湯䤠瑮牥敮⁴敓畣楲祴匠極整卜晡䍥湯敮瑣䍜湯楦屧噘敩⹷潣普杩
< End of report >

Edited by mpascal, 11 September 2010 - 01:52 AM.

Can you post the MBAM log where it removed the 36 items? It should be under the Logs tab in MBAM.

This is what I have.

Hi there,

We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply for further review.

I can't post the log. It tells me that the file is to large. How can I send it to you?

Can you attach it? Or copy and paste it here?

Edited by mpascal, 13 September 2010 - 12:53 AM.

I can't find a way to get you this information. when I copy & try to paste in our blog there is no past opp. It looks we used to much space to just send it. Can we start a new communication or something.This report is 8 pages long. PLEASE LET ME KNOW!!
Thank You, Donald

Hmm 8 pages is unusually long. Do you know which section is taking up the most room? Can you just split it up and post it?

Can you let me know what part you need? The post Says that I have used 496.55k of 512k of attachment space & will not let me attach this file. Should I run the scan again to see if I get a different result ? Can I start a new topic to get more attachment space? Can you give me an e-mail address to send it to? Let me know what you think.
Thanks, Donald

Hi there,

A new topic won't give you more attachment space. Can you post the Other Deletions section if it isn't too long. It should be the one at the very beginning.

(((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\User\LOCALS~1\Temp\jna6494151118920965403.dll
c:\documents and settings\User\Local Settings\Temp\jna6494151118920965403.dll
c:\documents and settings\User\My Documents\rundll32.exe
c:\windows\system32\system

There should be one really long section then, can you find out which one?

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_FAD


((((((((((((((((((((((((( Files Created from 2010-08-11 to 2010-09-11 )))))))))))))))))))))))))))))))
.

2010-09-08 16:01 . 2010-09-08 16:01 -------- d-----w- c:\documents and settings\User\Application Data\VSRevoGroup
2010-09-06 23:19 . 2010-09-06 23:19 -------- d-----w- c:\documents and settings\User\Application Data\Malwarebytes
2010-09-06 23:18 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-06 23:18 . 2010-09-06 23:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-09-06 23:17 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-06 23:17 . 2010-09-06 23:18 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-03 22:56 . 2010-09-03 22:56 -------- d-----w- c:\documents and settings\User\Local Settings\Application Data\WinZip
2010-09-03 19:41 . 2010-09-03 22:52 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip
2010-09-03 18:16 . 2010-09-03 18:16 -------- d-----w- c:\windows\system32\wbem\Repository
2010-09-03 18:16 . 2010-09-11 21:01 -------- d-----w- c:\documents and settings\User\Application Data\Spyware Terminator
2010-09-03 18:16 . 2010-09-09 10:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Spyware Terminator
2010-09-03 13:33 . 2010-09-03 18:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Spyware Terminator(3)
2010-09-03 01:44 . 2010-09-03 18:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Spyware Terminator(2)
2010-08-30 20:23 . 2010-08-30 20:23 -------- d-----w- c:\documents and settings\User\Application Data\Leadertech
2010-08-30 20:19 . 2010-09-03 18:14 -------- d-----w- c:\program files\palmOne
2010-08-24 00:08 . 2010-08-24 00:11 -------- d-----w- c:\windows\system32\NtmsData
2010-08-22 17:26 . 2010-09-03 18:15 -------- d-----w- c:\program files\Ask.com
2010-08-22 17:26 . 2010-08-22 17:26 -------- d-----w- c:\program files\Foxit Software
2010-08-19 22:27 . 2010-08-19 22:39 -------- d-----w- c:\windows\SxsCaPendDel
2010-08-14 16:06 . 2010-08-14 16:08 -------- dc-h--w- c:\windows\ie8
2010-08-13 21:54 . 2010-08-13 21:54 -------- d-----w- c:\documents and settings\User\Local Settings\Application Data\NOS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-11 22:38 . 2010-04-22 13:50 -------- d-----w- c:\documents and settings\User\Application Data\LimeWire
2010-09-11 21:01 . 2010-07-22 16:46 -------- d-----w- c:\program files\Spyware Terminator
2010-09-07 15:12 . 2010-07-04 23:53 38848 ----a-w- c:\windows\avastSS.scr
2010-09-07 15:11 . 2010-03-26 17:04 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-09-07 14:54 . 2010-03-26 17:06 99792 ----a-w- c:\windows\system32\drivers\aswFW.sys
2010-09-07 14:53 . 2010-03-26 17:06 340048 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2010-09-07 14:53 . 2010-03-26 17:05 190416 ----a-w- c:\windows\system32\drivers\aswNdis2.sys
2010-09-07 14:52 . 2010-03-26 17:05 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-09-07 14:52 . 2010-03-26 17:06 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-09-07 14:47 . 2010-03-26 17:05 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-09-07 14:47 . 2010-03-26 17:05 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-09-07 14:47 . 2010-03-26 17:05 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-09-07 14:47 . 2010-03-26 17:06 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-09-07 14:46 . 2010-03-26 17:05 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-08-30 16:50 . 2010-07-05 14:04 -------- d-----w- c:\documents and settings\User\Application Data\Canon
2010-08-19 22:34 . 2010-03-06 20:22 -------- d-----w- c:\program files\eBay
2010-08-19 22:34 . 2009-08-15 14:53 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-08-19 22:21 . 2009-10-10 00:08 -------- d-----w- c:\program files\NCH Swift Sound
2010-08-19 22:15 . 2010-07-23 19:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-08-13 21:54 . 2010-04-09 14:09 -------- d-----w- c:\program files\Common Files\Adobe
2010-08-01 21:35 . 2010-08-01 21:33 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-07-26 00:03 . 2009-09-02 22:29 -------- d-----w- c:\program files\Quicken
2010-07-26 00:02 . 2010-07-26 00:02 2812928 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\Quicken\Inet\Common\patch\Update\191916-191106.dll
2010-07-26 00:01 . 2010-05-10 19:12 243032 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\Quicken\Inet\Common\patch\Update\QWPATCH.EXE
2010-07-23 23:37 . 2010-07-23 23:37 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-07-23 21:24 . 2010-04-18 01:42 -------- d-----w- c:\program files\Google
2010-07-23 20:57 . 2009-10-09 20:29 -------- d-----w- c:\program files\NCH Software
2010-07-23 20:57 . 2009-10-09 20:29 -------- d-----w- c:\documents and settings\All Users\Application Data\NCH Software
2010-07-23 20:54 . 2009-10-09 20:30 -------- d-----w- c:\documents and settings\User\Application Data\NCH Software
2010-07-22 16:47 . 2010-07-22 16:47 6144 ----a-w- c:\documents and settings\All Users\Application Data\Spyware Terminator\sp_rsdel.exe
2010-07-22 16:47 . 2010-07-22 16:47 5632 ----a-w- c:\documents and settings\All Users\Application Data\Spyware Terminator\fileobjinfo.sys
2010-07-22 16:47 . 2010-07-22 16:47 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-07-18 23:31 . 2009-12-29 20:14 -------- d-----w- c:\program files\Hello Kitty Photo Booth
2010-07-16 15:33 . 2010-07-15 18:49 -------- d-----w- c:\documents and settings\User\Application Data\Uniblue
2010-07-16 13:52 . 2010-07-15 18:38 -------- d-----w- c:\program files\Uniblue
2010-07-15 19:33 . 2009-12-01 21:04 -------- d-----w- c:\documents and settings\User\Application Data\GoodSync
2010-07-15 18:39 . 2010-07-15 18:39 -------- d-----w- c:\documents and settings\User\Application Data\System Tweaker
2010-07-08 15:33 . 2010-07-14 19:03 50176 ----a-w- c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\ebayShortcutMaker.dll
2010-07-08 15:33 . 2010-07-14 19:03 80896 ----a-w- c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\ebayAccessComponent.dll
2010-06-30 12:31 . 2004-08-04 10:00 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-27 20:54 . 2009-08-21 16:26 339368 -c--a-w- c:\documents and settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-24 12:22 . 2006-03-04 03:33 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44 . 2004-08-04 10:00 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2004-08-04 10:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2004-08-04 10:00 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 16:08 . 2010-06-19 15:31 103424 ----a-w- c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\piclens@cooliris.com\libs\pixomatic.dll
2010-06-14 16:08 . 2010-06-19 15:31 545280 ----a-w- c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\piclens@cooliris.com\libs\PicLensHelper.exe
2010-06-14 16:08 . 2010-06-19 15:31 4687360 ----a-w- c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\piclens@cooliris.com\libs\cooliris192.dll
2010-06-14 16:08 . 2010-06-19 15:31 425984 ----a-w- c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\piclens@cooliris.com\libs\LaunchCooliris.exe
2010-06-14 16:08 . 2010-06-19 15:31 152064 ----a-w- c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\piclens@cooliris.com\plugins\npcoolirisplugin.dll
2010-06-14 16:08 . 2010-06-19 15:31 4687872 ----a-w- c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\piclens@cooliris.com\libs\cooliris190.dll
2010-06-14 16:08 . 2010-06-19 15:31 57856 ----a-w- c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
2010-06-14 14:31 . 2009-08-15 14:27 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2004-08-04 10:00 1172480 ----a-w- c:\windows\system32\msxml3.dll
2000-12-12 16:17 . 2000-12-13 23:22 100432 -c----w- c:\program files\Win2000PPAHotfix.exe
2010-03-28 21:30 . 2009-08-21 16:22 24342560 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-03-28 21:30 . 2009-08-21 14:02 496416 --sha-w- c:\windows\system32\drivers\fidbox2.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\snxPluginsShell]
@="{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}"
[HKEY_CLASSES_ROOT\CLSID\{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}]
2010-09-07 15:14 152160 ----a-w- c:\program files\Alwil Software\Avast5\snxPlugins.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2010-07-03 160328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-06-22 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-06-22 126976]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 122880]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-05-16 648504]
"nmapp"="c:\program files\Pure Networks\Network Magic\nmapp.exe" [2008-05-21 451896]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2006-11-22 813912]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-02-05 849280]
"Iomega Drive Icons"="c:\program files\Iomega\DriveIcons\ImgIcon.exe" [2002-08-13 86016]
"ADUserMon"="c:\program files\Iomega\AutoDisk\ADUserMon.exe" [2002-09-24 147456]
"Deskup"="c:\program files\Iomega\DriveIcons\deskup.exe" [2002-07-16 32768]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-09-07 2838912]
"Sunkist2k"="c:\program files\GE\USB 2.0 Card Reader\shwicon2k.exe" [2004-12-10 139264]
"OmniPage"="c:\program files\Caere\OmniPagePro90\opware32.exe" [1998-10-12 44032]
"EPSON Stylus Photo 820 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S0EIC1.EXE" [2002-04-10 74240]

c:\documents and settings\User\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2010-3-30 503808]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2010-4-5 494920]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Documents and Settings\\User\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\User\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service
"4100:UDP"= 4100:UDP:uPNP Router Control Port
"96:TCP"= 96:TCP:Express Accounts Web Control Panel

R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [3/26/2010 1:04 PM 12112]
R0 aswNdis2;avast! Firewall Core Firewall Service;c:\windows\system32\drivers\aswNdis2.sys [3/26/2010 1:05 PM 190416]
R1 aswFW;avast! TDI Firewall driver;c:\windows\system32\drivers\aswFW.sys [3/26/2010 1:06 PM 99792]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [3/26/2010 1:06 PM 340048]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [3/26/2010 1:06 PM 165584]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [7/22/2010 12:47 PM 142592]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [3/26/2010 1:06 PM 17744]
R2 ExpressInvoiceService;Express Invoice;c:\program files\NCH Software\ExpressInvoice\expressinvoice.exe [10/9/2009 4:29 PM 3002372]
S2 avast! Firewall;avast! Firewall;c:\program files\Alwil Software\Avast5\afwServ.exe [3/26/2010 1:04 PM 119200]
.
Contents of the 'Scheduled Tasks' folder

2010-09-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 15:50]

2010-09-11 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2009-08-18 14:30]

2010-09-10 c:\windows\Tasks\GoodSync - RoboForm Online.job
- c:\program files\Siber Systems\GoodSync\GoodSync.exe [2010-05-03 05:30]

2010-09-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1220945662-688789844-1801674531-1003Core.job
- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-10-07 23:11]

2010-09-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1220945662-688789844-1801674531-1003UA.job
- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-10-07 23:11]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: eBay Search - c:\program files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
IE: Send Image to Photo Library
Trusted Zone: tasteofhome
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2117678&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://by157w.bay157.mail.live.com/?rru=inbox
FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=FXTV5&o=16046&locale=en_US&apn_uid=37E4C7C8-574B-429C-A17C-9E1BDF3B420A&apn_ptnrs=OE&apn_sauid=2F459E29-C843-4C88-89F0-9FA981D18AF5&apn_dtid=&q=
FF - component: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\ebayAccessComponent.dll
FF - component: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\ebayShortcutMaker.dll
FF - component: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\lazarus@interclue.com\platform\WINNT_x86-msvc\components\WeaveCrypto.dll
FF - component: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\piclens@cooliris.com\components\coolirisstub.dll
FF - component: c:\program files\Siber Systems\AI RoboForm\Firefox\components\rfproxy_31.dll
FF - plugin: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\slb03uha.default\extensions\piclens@cooliris.com\plugins\npcoolirisplugin.dll
FF - plugin: c:\documents and settings\User\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\User\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: c:\documents and settings\User\Local Settings\Application Data\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -

Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)
AddRemove-LFSVCOMM&10C4&85A7 - c:\windows\system32\Silabs\DriverUninstaller.exe VCP CP210x Cardinal\LFSVCOMM&10C4&85A7



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-11 18:35
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


C:\## aswSnx private storage

scan completed successfully
hidden files: 1

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Iomega Activity Disk2]
"ImagePath"=""
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3256)
c:\windows\system32\WININET.dll
c:\program files\Caere\OmniPagePro90\ophook32.dll
c:\program files\Iomega\DriveIcons\IMGHOOK.DLL
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\progra~1\Iomega\System32\AppServices.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\program files\Iomega\AutoDisk\ADService.exe
c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
c:\windows\BCMSMMSG.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-09-11 18:45:44 - machine was rebooted
ComboFix-quarantined-files.txt 2010-09-11 22:45

Pre-Run: 14,944,206,848 bytes free
Post-Run: 15,177,211,904 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - BB434E612C59D5342E59D1204429C489