Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

HiJackThis denies writing, computer freezed up


  • This topic is locked This topic is locked
24 replies to this topic

#1 Artemisia

Artemisia

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:15 PM

Posted 03 June 2011 - 11:27 AM

Hello. Just now my computer completely froze up with 50%-80% of CPU working. It started working again after I closed Google Chrome, but now I'm worried I may have a virus or malware. I ran HiJackThis, but it keeps saying it can't rewrite to the notepad/host file. I've never had this error come up on this computer before. Can someone check my files and make sure everything is on the up and up? Thanks.


.
DDS (Ver_2011-06-03.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by Artemisia at 12:14:08 on 2011-06-03
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4058.2573 [GMT -4:00]
.
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_7f58c91b65c73836\STacSV64.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE
C:\Windows\system32\conhost.exe
C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Windows\Explorer.EXE
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files (x86)\Stickies\stickies.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Windows\system32\conhost.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskhost.exe
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_7f58c91b65c73836\AESTSr64.exe
C:\Windows\system32\HPSIsvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Users\Artemisia\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Artemisia\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Artemisia\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Artemisia\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Artemisia\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\Artemisia\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Artemisia\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uSearch Bar = Preserve
uStart Page = hxxp://www.google.com/
uDefault_Page_URL = hxxp://www.dell.com
mWinlogon: Userinit=userinit.exe
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
uRun: [Google Update] "C:\Users\Artemisia\AppData\Local\Google\Update\GoogleUpdate.exe" /c
uRun: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
mRun: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
StartupFolder: C:\Users\ARTEMI~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Stickies.lnk - C:\Program Files (x86)\Stickies\stickies.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - C:\Windows\system32\GPhotos.scr/200
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
Trusted Zone: phoenix.edu\ecampus
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 209.18.47.61 209.18.47.62 192.168.1.1
TCP: Interfaces\{2272A55D-3C42-4045-A060-3B42A0B68979} : DhcpNameServer = 209.18.47.61 209.18.47.62 192.168.1.1
TCP: Interfaces\{2272A55D-3C42-4045-A060-3B42A0B68979}\3416C6970737F6 : DhcpNameServer = 167.206.245.129 167.206.245.130
TCP: Interfaces\{4A401D2E-4E6B-4F7E-B79C-424371FD65EF} : DhcpNameServer = 209.18.47.61 209.18.47.62 192.168.1.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO-X64: URLRedirectionBHO - No File
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
mRun-x64: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
Hosts: 127.0.0.1 www.spywareinfo.com
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;C:\Windows\system32\drivers\aswSnx.sys --> C:\Windows\system32\drivers\aswSnx.sys [?]
R1 aswSP;aswSP;C:\Windows\system32\drivers\aswSP.sys --> C:\Windows\system32\drivers\aswSP.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 AESTFilters;Andrea ST Filters Service;C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_7f58c91b65c73836\AESTSr64.exe [2011-1-30 89600]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\drivers\aswFsBlk.sys --> C:\Windows\system32\drivers\aswFsBlk.sys [?]
R2 aswMonFlt;aswMonFlt;\??\C:\Windows\system32\drivers\aswMonFlt.sys --> C:\Windows\system32\drivers\aswMonFlt.sys [?]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2011-5-22 42184]
R2 HPSIService;HP SI Service;C:\Windows\system32\HPSIsvc.exe --> C:\Windows\system32\HPSIsvc.exe [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-3-14 136176]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-3-14 136176]
S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys --> C:\Windows\system32\Drivers\RtsUStor.sys [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
.
=============== Created Last 30 ================
.
2011-06-03 15:45:15 388096 ----a-r- C:\Users\Artemisia\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-06-03 15:45:15 -------- d-----w- C:\Program Files (x86)\Trend Micro
2011-06-03 15:21:58 -------- d-----w- C:\Users\Artemisia\AppData\Local\{958E6033-418D-4CE5-883D-24B70A4B693D}
2011-06-02 15:07:33 -------- d-----w- C:\Users\Artemisia\AppData\Local\{A7FC2872-AB54-4ED6-A9F5-69D925BF3618}
2011-06-01 13:41:04 -------- d-----w- C:\Users\Artemisia\AppData\Local\{1E1BCA19-FA5F-43F0-975A-8FCC9201D794}
2011-05-30 21:49:02 -------- d-----w- C:\Users\Artemisia\AppData\Local\Microsoft_Corp
2011-05-30 14:41:50 -------- d-----w- C:\Users\Artemisia\AppData\Local\{B8525292-6DB4-43BA-81C0-AAF5657C4AF2}
2011-05-29 17:34:40 -------- d-----w- C:\Users\Artemisia\AppData\Local\{9E56BE57-4EA0-4686-BDF1-D64DAE55B6CE}
2011-05-29 03:03:21 -------- d-----w- C:\Users\Artemisia\AppData\Local\{831B344B-47DD-435D-8E83-C8A696B065C8}
2011-05-28 12:02:04 -------- d-----w- C:\Users\Artemisia\AppData\Local\{1C242514-DF86-43A2-82EC-2DBC6728D9EF}
2011-05-28 11:49:48 -------- d-----w- C:\Users\Artemisia\AppData\Local\{F3E90F80-C6A5-4720-972F-E7A77CC382E5}
2011-05-27 22:15:16 197120 ----a-w- C:\Windows\System32\d3d10_1.dll
2011-05-27 22:15:16 161792 ----a-w- C:\Windows\SysWow64\d3d10_1.dll
2011-05-26 18:06:06 -------- d-----w- C:\Users\Artemisia\AppData\Local\{A3E88FCA-A0E0-4B33-897D-B2C766750BB3}
2011-05-26 01:08:45 -------- d-----w- C:\Users\Artemisia\AppData\Local\{B4E9D88F-A296-4E54-85AD-EE99141DDF0A}
2011-05-25 13:08:34 -------- d-----w- C:\Users\Artemisia\AppData\Local\{42FD2F98-7E35-4E87-B363-824DAD633A26}
2011-05-25 11:34:10 27520 ----a-w- C:\Windows\System32\drivers\Diskdump.sys
2011-05-25 01:08:23 -------- d-----w- C:\Users\Artemisia\AppData\Local\{30732808-366C-4BE3-836D-2DE070795AF0}
2011-05-24 13:08:11 -------- d-----w- C:\Users\Artemisia\AppData\Local\{23024F45-178C-4581-9D7A-5251E05B1EE4}
2011-05-23 14:48:16 -------- d-----w- C:\Users\Artemisia\AppData\Local\{AB38E4ED-AA51-4D46-B42B-F895469D0BE4}
2011-05-22 17:19:53 -------- d-----w- C:\Users\Artemisia\AppData\Local\{CA622B5F-142B-4C94-92F4-75B90A8D350C}
2011-05-22 15:50:09 600920 ----a-w- C:\Windows\System32\drivers\aswSnx.sys
2011-05-22 03:19:42 -------- d-----w- C:\Users\Artemisia\AppData\Local\{DF5B7827-6D55-4402-AA3E-A3A1D1CC0126}
2011-05-21 15:19:31 -------- d-----w- C:\Users\Artemisia\AppData\Local\{C6A5BD12-15C0-411C-A6E5-6A323A055D06}
2011-05-21 03:19:20 -------- d-----w- C:\Users\Artemisia\AppData\Local\{A59462BE-7D4E-44CA-AB00-37B726F01087}
2011-05-20 14:25:10 -------- d-----w- C:\Users\Artemisia\AppData\Local\{36EA2163-2145-47C9-B983-F9FE66CF477C}
2011-05-20 02:24:59 -------- d-----w- C:\Users\Artemisia\AppData\Local\{CC56707A-CC21-4440-AB32-43D9201E9128}
2011-05-19 12:34:22 -------- d-----w- C:\Users\Artemisia\AppData\Local\{CBB76768-12FB-4741-A3D1-8AB150C0B084}
2011-05-19 11:41:19 142336 ----a-w- C:\Windows\System32\poqexec.exe
2011-05-19 11:41:19 123904 ----a-w- C:\Windows\SysWow64\poqexec.exe
2011-05-18 14:21:53 -------- d-----w- C:\Users\Artemisia\AppData\Local\{28F89B47-54B7-4468-8C25-097013E0D09D}
2011-05-17 14:51:25 -------- d-----w- C:\Users\Artemisia\AppData\Local\{27A5A777-24C4-4D96-82A2-F4820237B2D4}
2011-05-16 18:43:03 -------- d-----w- C:\Users\Artemisia\AppData\Local\{05D3E926-AE82-4F5B-8F23-25F21DE96AC6}
2011-05-15 22:14:39 -------- d-----w- C:\Users\Artemisia\AppData\Local\{16535767-704B-48B4-8EAF-A0528928CD74}
2011-05-14 15:37:02 -------- d-----w- C:\Users\Artemisia\AppData\Local\{97F0080C-B97A-4BDE-BF2C-1FFEFBAE8833}
2011-05-13 18:49:00 -------- d-----w- C:\Users\Artemisia\AppData\Local\{C0FC871C-6633-478A-96E6-7263800F78A2}
2011-05-12 12:58:16 -------- d-----w- C:\Users\Artemisia\AppData\Local\{056202E1-B045-4488-BB13-A9344357DB3C}
2011-05-12 00:58:05 -------- d-----w- C:\Users\Artemisia\AppData\Local\{E8F23931-C137-4050-9BF0-9AA338FEC39D}
2011-05-11 12:12:49 -------- d-----w- C:\Users\Artemisia\AppData\Local\{102D1AA9-2FEB-42DB-B123-0ED71D1A6B91}
2011-05-11 10:41:23 5562240 ----a-w- C:\Windows\System32\ntoskrnl.exe
2011-05-11 10:41:22 3967872 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2011-05-11 10:41:21 3912576 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2011-05-11 10:41:20 98816 ----a-w- C:\Windows\System32\drivers\usbccgp.sys
2011-05-11 10:41:20 7936 ----a-w- C:\Windows\System32\drivers\usbd.sys
2011-05-11 10:41:20 52736 ----a-w- C:\Windows\System32\drivers\usbehci.sys
2011-05-11 10:41:20 343040 ----a-w- C:\Windows\System32\drivers\usbhub.sys
2011-05-11 10:41:20 325120 ----a-w- C:\Windows\System32\drivers\usbport.sys
2011-05-11 10:41:20 30720 ----a-w- C:\Windows\System32\drivers\usbuhci.sys
2011-05-10 21:40:34 -------- d-----w- C:\Users\Artemisia\AppData\Local\{32CA54B9-3B06-4860-ABD5-2C4FB79C2255}
2011-05-09 19:03:24 -------- d-----w- C:\Users\Artemisia\AppData\Local\{F7F1DD6E-C5D0-42FF-AD62-B90C8FD9DE60}
2011-05-09 00:48:20 -------- d-----w- C:\Users\Artemisia\AppData\Local\{11B82ADE-3A69-4CAB-AC2C-8789B0A5D191}
2011-05-08 11:51:09 -------- d-----w- C:\Users\Artemisia\AppData\Local\{A9676EAF-42B5-4936-8F7D-C82F2A2F343C}
2011-05-07 15:05:11 -------- d-----w- C:\Users\Artemisia\AppData\Local\{22BB4FB1-E28A-4C53-9113-AC96348C004F}
2011-05-07 03:05:00 -------- d-----w- C:\Users\Artemisia\AppData\Local\{37143A17-5721-4971-A6E4-ECA170016979}
2011-05-06 16:49:48 -------- d-----w- C:\Users\Artemisia\AppData\Roaming\WhiteSmoke
2011-05-06 16:49:24 -------- d-----w- C:\Program Files (x86)\WhiteSmoke
2011-05-06 16:44:13 -------- d--h--w- C:\Users\Artemisia\AppData\Roaming\InstallJammer Registry
2011-05-06 16:44:02 -------- d-----w- C:\Users\Artemisia\AppData\Roaming\Riverpoint Writer
2011-05-06 12:31:13 -------- d-----w- C:\Users\Artemisia\AppData\Local\{F7C7B4F7-BDA0-44BA-A884-A4137407CC36}
2011-05-05 22:52:46 -------- d-----w- C:\Users\Artemisia\AppData\Local\{88E3CE12-F6D8-4F49-91E9-2482BD52521E}
.
==================== Find3M ====================
.
2011-05-10 12:10:59 40112 ----a-w- C:\Windows\avastSS.scr
2011-05-10 11:59:48 64344 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
2011-04-14 09:07:59 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2011-04-13 22:40:10 4284416 ----a-w- C:\Windows\SysWow64\GPhotos.scr
2011-03-25 17:48:10 175616 ----a-w- C:\Windows\System32\msclmd.dll
2011-03-25 17:48:10 152576 ----a-w- C:\Windows\SysWow64\msclmd.dll
2011-03-21 17:22:06 74272 ----a-w- C:\Windows\System32\RtNicProp64.dll
2011-03-21 17:22:06 452200 ----a-w- C:\Windows\System32\drivers\Rt64win7.sys
2011-03-21 17:22:06 107552 ----a-w- C:\Windows\System32\RTNUninst64.dll
2011-03-12 12:08:49 1465344 ----a-w- C:\Windows\System32\XpsPrint.dll
2011-03-12 11:23:45 870912 ----a-w- C:\Windows\SysWow64\XpsPrint.dll
2011-03-11 06:41:37 189824 ----a-w- C:\Windows\System32\drivers\storport.sys
2011-03-11 06:41:34 166272 ----a-w- C:\Windows\System32\drivers\nvstor.sys
2011-03-11 06:41:34 1659776 ----a-w- C:\Windows\System32\drivers\ntfs.sys
2011-03-11 06:41:34 148352 ----a-w- C:\Windows\System32\drivers\nvraid.sys
2011-03-11 06:41:26 410496 ----a-w- C:\Windows\System32\drivers\iaStorV.sys
2011-03-11 06:41:12 27008 ----a-w- C:\Windows\System32\drivers\amdxata.sys
2011-03-11 06:41:12 107904 ----a-w- C:\Windows\System32\drivers\amdsata.sys
2011-03-11 06:34:51 1359872 ----a-w- C:\Windows\System32\mfc42u.dll
2011-03-11 06:34:50 1395712 ----a-w- C:\Windows\System32\mfc42.dll
2011-03-11 06:33:29 2565632 ----a-w- C:\Windows\System32\esent.dll
2011-03-11 06:30:28 96768 ----a-w- C:\Windows\System32\fsutil.exe
2011-03-11 05:33:59 1164288 ----a-w- C:\Windows\SysWow64\mfc42u.dll
2011-03-11 05:33:59 1137664 ----a-w- C:\Windows\SysWow64\mfc42.dll
2011-03-11 05:33:09 1699328 ----a-w- C:\Windows\SysWow64\esent.dll
2011-03-11 05:31:07 74240 ----a-w- C:\Windows\SysWow64\fsutil.exe
2011-03-08 06:29:32 976896 ----a-w- C:\Windows\System32\inetcomm.dll
2011-03-08 05:28:29 741376 ----a-w- C:\Windows\SysWow64\inetcomm.dll
2011-03-07 05:33:13 981504 ----a-w- C:\Windows\SysWow64\wininet.dll_old0
2011-03-07 05:33:10 1230336 ----a-w- C:\Windows\SysWow64\urlmon.dll_old0
.
============= FINISH: 12:17:09.47 ===============

Attached Files


So confused.

BC AdBot (Login to Remove)

 


#2 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:08:15 PM

Posted 11 June 2011 - 10:22 AM

Hello and welcome to the forums!

My secret agent name on the forums is SweetTech (you can call me ST for short), it's a pleasure to meet you. :)

I am very sorry for the delay in responding, but as you can see we are at the moment being flooded with logs which, when paired with the never-ending shortage of helpers, resulted in the delayed responding to your thread.

I would be glad to take a look at your log and help you with solving any malware problems.

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

  • Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forums.
  • Please make sure to carefully read any instruction that I give you. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
  • If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
  • In Windows Vista and Windows 7, all tools need to be started by right clicking and selecting Run as Administrator!
  • If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
  • Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
  • Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
  • I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together ;)
    Because of this, you must reply within three days
    failure to reply will result in the topic being closed!
  • Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
    Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________

Running OTL

We need to create a FULL OTL Report
  • Please download OTL from here:
  • Save it to your desktop.
  • Double click on the Posted Image icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Change the "Extra Registry" option to "SafeList"
  • Push the Posted Image button.
  • Two reports will open, copy and paste them in a reply here:
    • OTL.txt <-- Will be opened
    • Extras.txt <-- Will be minimized

NEXT:


Please provide an update on how things are running in your next reply.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#3 Artemisia

Artemisia
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:15 PM

Posted 11 June 2011 - 11:19 AM

OTL logfile created on: 6/11/2011 12:10:44 PM - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Users\Artemisia\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.96 Gb Total Physical Memory | 2.60 Gb Available Physical Memory | 65.60% Memory free
7.92 Gb Paging File | 6.67 Gb Available in Paging File | 84.19% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 287.00 Gb Total Space | 241.77 Gb Free Space | 84.24% Space Free | Partition Type: NTFS
Drive E: | 14.89 Gb Total Space | 5.70 Gb Free Space | 38.28% Space Free | Partition Type: FAT32

Computer Name: MOLTABOCCA | User Name: Artemisia | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/06/11 12:09:18 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Artemisia\Downloads\OTL.exe
PRC - [2011/05/10 08:10:58 | 003,459,712 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2011/05/10 08:10:57 | 000,042,184 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2011/02/03 11:40:36 | 001,122,304 | ---- | M] (Zhorn Software) -- C:\Program Files (x86)\Stickies\stickies.exe
PRC - [2010/11/20 08:17:56 | 000,164,864 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
PRC - [2009/03/05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe


========== Modules (SafeList) ==========

MOD - [2011/06/11 12:09:18 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Artemisia\Downloads\OTL.exe
MOD - [2011/05/10 08:10:55 | 000,199,792 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\snxhk.dll
MOD - [2010/11/20 07:55:09 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011/05/10 08:10:57 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV:64bit: - [2010/04/07 09:04:24 | 000,127,800 | ---- | M] (HP) [Auto | Running] -- C:\Windows\SysNative\HPSIsvc.exe -- (HPSIService)
SRV:64bit: - [2010/02/26 06:03:00 | 000,244,736 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_7f58c91b65c73836\stacsv64.exe -- (STacSV)
SRV:64bit: - [2009/07/17 10:06:22 | 000,033,280 | ---- | M] () [Auto | Running] -- C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE -- (wltrysvc)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/03/03 06:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_7f58c91b65c73836\AESTSr64.exe -- (AESTFilters)
SRV - [2010/03/18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2011/05/10 07:59:48 | 000,064,344 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2011/03/21 13:22:06 | 000,452,200 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011/03/11 02:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 02:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011/02/11 19:16:38 | 010,628,640 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010/11/20 09:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 07:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/02/26 06:03:00 | 000,505,856 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:64bit: - [2009/07/17 13:06:18 | 002,769,400 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2009/07/17 10:06:20 | 000,022,520 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bcm42rly.sys -- (BCM42RLY)
DRV:64bit: - [2009/07/13 21:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 21:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 21:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- C:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 16:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/08 20:15:18 | 000,215,552 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2009/03/25 18:28:56 | 000,230,960 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Apfiltr.sys -- (ApfiltrService)

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = C:\Users\Artemisia\Downloads
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



O1 HOSTS File: ([2011/02/02 22:44:53 | 000,429,816 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 123fporn.info
O1 - Hosts: 14794 more lines...
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Users\Artemisia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stickies.lnk = C:\Program Files (x86)\Stickies\stickies.exe (Zhorn Software)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: phoenix.edu ([ecampus] https in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62 192.168.1.1
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{38808260-2f09-11e0-982b-a4badbc9cf62}\Shell - "" = AutoRun
O33 - MountPoints2\{38808260-2f09-11e0-982b-a4badbc9cf62}\Shell\AutoRun\command - "" = E:\SISetup.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/06/08 13:23:06 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{6BAE77F6-8590-4DFF-BB66-C93D9E05E50E}
[2011/06/08 09:25:15 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\Documents\Sewing Projects
[2011/06/06 19:59:03 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{FE4B562C-C3CB-4070-A6AD-75B856DBFA0A}
[2011/06/05 22:57:11 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{DBDCEFED-E0BD-4086-A371-EE6176CC0AE4}
[2011/06/05 10:23:18 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{A5F9A706-3F3B-4C64-A126-005B0B63407B}
[2011/06/05 09:53:04 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{0EF83660-7AED-4E0F-9AE5-7A7FACDEF55B}
[2011/06/04 11:22:53 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{7BD289A5-7182-4B4F-947A-DDF66B690B61}
[2011/06/03 11:45:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro
[2011/06/03 11:45:15 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2011/06/03 11:21:58 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{958E6033-418D-4CE5-883D-24B70A4B693D}
[2011/06/02 11:07:33 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{A7FC2872-AB54-4ED6-A9F5-69D925BF3618}
[2011/06/01 09:41:04 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{1E1BCA19-FA5F-43F0-975A-8FCC9201D794}
[2011/05/30 17:49:02 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\Microsoft_Corp
[2011/05/30 10:41:50 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{B8525292-6DB4-43BA-81C0-AAF5657C4AF2}
[2011/05/29 13:34:40 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{9E56BE57-4EA0-4686-BDF1-D64DAE55B6CE}
[2011/05/28 23:03:21 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{831B344B-47DD-435D-8E83-C8A696B065C8}
[2011/05/28 08:02:04 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{1C242514-DF86-43A2-82EC-2DBC6728D9EF}
[2011/05/28 07:49:48 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{F3E90F80-C6A5-4720-972F-E7A77CC382E5}
[2011/05/27 18:17:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Intel
[2011/05/27 18:15:16 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1.dll
[2011/05/27 18:15:16 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d10_1.dll
[2011/05/26 14:06:06 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{A3E88FCA-A0E0-4B33-897D-B2C766750BB3}
[2011/05/25 21:08:45 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{B4E9D88F-A296-4E54-85AD-EE99141DDF0A}
[2011/05/25 09:08:34 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{42FD2F98-7E35-4E87-B363-824DAD633A26}
[2011/05/25 07:34:10 | 000,027,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\Diskdump.sys
[2011/05/24 21:08:23 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{30732808-366C-4BE3-836D-2DE070795AF0}
[2011/05/24 09:08:11 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{23024F45-178C-4581-9D7A-5251E05B1EE4}
[2011/05/23 10:48:16 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{AB38E4ED-AA51-4D46-B42B-F895469D0BE4}
[2011/05/22 13:19:53 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{CA622B5F-142B-4C94-92F4-75B90A8D350C}
[2011/05/22 12:48:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2011/05/22 11:50:09 | 000,600,920 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
[2011/05/21 23:19:42 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{DF5B7827-6D55-4402-AA3E-A3A1D1CC0126}
[2011/05/21 11:19:31 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{C6A5BD12-15C0-411C-A6E5-6A323A055D06}
[2011/05/20 23:19:20 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{A59462BE-7D4E-44CA-AB00-37B726F01087}
[2011/05/20 10:25:10 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{36EA2163-2145-47C9-B983-F9FE66CF477C}
[2011/05/19 22:24:59 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{CC56707A-CC21-4440-AB32-43D9201E9128}
[2011/05/19 08:34:22 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{CBB76768-12FB-4741-A3D1-8AB150C0B084}
[2011/05/19 07:41:19 | 000,142,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\poqexec.exe
[2011/05/19 07:41:19 | 000,123,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\poqexec.exe
[2011/05/18 10:21:53 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{28F89B47-54B7-4468-8C25-097013E0D09D}
[2011/05/17 10:51:25 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{27A5A777-24C4-4D96-82A2-F4820237B2D4}
[2011/05/17 08:45:06 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe
[2011/05/17 08:45:06 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe
[2011/05/17 08:45:06 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe
[2011/05/16 14:43:03 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{05D3E926-AE82-4F5B-8F23-25F21DE96AC6}
[2011/05/15 18:14:39 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{16535767-704B-48B4-8EAF-A0528928CD74}
[2011/05/14 11:37:02 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{97F0080C-B97A-4BDE-BF2C-1FFEFBAE8833}
[2011/05/13 14:49:00 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{C0FC871C-6633-478A-96E6-7263800F78A2}

========== Files - Modified Within 30 Days ==========

[2011/06/11 11:53:00 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/11 11:39:00 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3655914709-1299690327-1797242728-1000UA.job
[2011/06/11 08:19:08 | 000,014,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/06/11 08:19:08 | 000,014,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/06/11 08:16:09 | 000,726,316 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011/06/11 08:16:09 | 000,624,178 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011/06/11 08:16:09 | 000,106,522 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011/06/11 08:12:07 | 000,000,900 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/11 08:11:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/06/11 08:10:58 | 3191,623,680 | -HS- | M] () -- C:\hiberfil.sys
[2011/06/10 21:04:15 | 000,001,138 | ---- | M] () -- C:\Users\Public\Desktop\Second Life Viewer 2.lnk
[2011/06/08 07:39:00 | 000,000,872 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3655914709-1299690327-1797242728-1000Core.job
[2011/06/03 11:37:49 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2011/05/27 18:30:20 | 000,001,204 | ---- | M] () -- C:\Users\Artemisia\Desktop\UOP.lnk
[2011/05/27 17:42:14 | 000,001,147 | ---- | M] () -- C:\Users\Artemisia\Desktop\My Pictures.lnk
[2011/05/23 10:25:57 | 000,004,174 | ---- | M] () -- C:\ProgramData\P1100OS.HTM

========== Files Created - No Company Name ==========

[2011/06/10 21:04:15 | 000,001,138 | ---- | C] () -- C:\Users\Public\Desktop\Second Life Viewer 2.lnk
[2011/05/27 17:38:10 | 000,001,204 | ---- | C] () -- C:\Users\Artemisia\Desktop\UOP.lnk
[2011/05/23 10:25:57 | 000,024,772 | ---- | C] () -- C:\ProgramData\P1100DEF.css
[2011/05/23 10:25:57 | 000,004,174 | ---- | C] () -- C:\ProgramData\P1100OS.HTM
[2011/05/23 10:25:57 | 000,002,944 | ---- | C] () -- C:\ProgramData\P1100SIG.GIF
[2011/05/21 22:55:42 | 000,001,147 | ---- | C] () -- C:\Users\Artemisia\Desktop\My Pictures.lnk
[2011/02/09 13:17:38 | 000,004,608 | ---- | C] () -- C:\Users\Artemisia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/02/03 11:47:41 | 000,000,032 | ---- | C] () -- C:\Windows\SysWow64\EUOD.DAT
[2011/02/01 18:55:19 | 000,000,126 | ---- | C] () -- C:\Windows\QUICKEN.INI
[2011/02/01 16:18:13 | 000,007,605 | ---- | C] () -- C:\Users\Artemisia\AppData\Local\Resmon.ResmonCfg
[2011/01/30 13:04:44 | 000,134,592 | ---- | C] () -- C:\Windows\SysWow64\igfcg500.bin
[2010/08/25 20:34:30 | 000,982,240 | ---- | C] () -- C:\Windows\SysWow64\igkrng500.bin
[2010/08/25 20:34:30 | 000,439,308 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng500.bin
[2010/08/25 20:34:30 | 000,092,356 | ---- | C] () -- C:\Windows\SysWow64\igfcg500m.bin
[2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2009/04/01 11:48:16 | 000,053,478 | ---- | C] () -- C:\Windows\mvtcpui.ini

< End of report >

OTL Extras logfile created on: 6/11/2011 12:10:44 PM - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Users\Artemisia\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.96 Gb Total Physical Memory | 2.60 Gb Available Physical Memory | 65.60% Memory free
7.92 Gb Paging File | 6.67 Gb Available in Paging File | 84.19% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 287.00 Gb Total Space | 241.77 Gb Free Space | 84.24% Space Free | Partition Type: NTFS
Drive E: | 14.89 Gb Total Space | 5.70 Gb Free Space | 38.28% Space Free | Partition Type: FAT32

Computer Name: MOLTABOCCA | User Name: Artemisia | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l File not found
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{26A24AE4-039D-4CA4-87B4-2F86416022FF}" = Java™ 6 Update 22 (64-bit)
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{87CF757E-C1F1-4D22-865C-00C6950B5258}" = Quickset64
"{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}" = Dell Edoc Viewer
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010
"{90140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{D07A61E5-A59C-433C-BCBD-22025FA2287B}" = Windows Live Language Selector
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
"CCleaner" = CCleaner
"Dell Wireless WLAN Card Utility" = Dell Wireless WLAN Card Utility
"HDMI" = Intel® Graphics Media Accelerator Driver
"HP LaserJet Professional P1100-P1560-P1600 Series" = HP LaserJet Professional P1100-P1560-P1600 Series
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java™ 6 Update 25
"{42D68A86-DB1C-4256-B8C9-5D0D92919AF5}" = Banctec Service Agreement
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{510D2239-6C2E-457B-9590-485EC552D94D}" = Garmin USB Drivers
"{51C7AD07-C3F6-4635-8E8A-231306D810FE}" = Cisco LEAP Module
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}" = Cisco EAP-FAST Module
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-AA0000000001}" = Adobe Reader X (10.0.1)
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{CCF6F57B-F6B4-4508-BF45-63AAC9DE416A}" = Quicken 2010
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D17111CB-C992-42A9-9D56-C19395102AAA}" = Garmin WebUpdater
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DBCC73BA-C69A-4BF5-B4BF-F07501EE7039}" = AnswerWorks 5.0 English Runtime
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}" = Cisco PEAP Module
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"Adobe AIR" = Adobe AIR
"avast" = avast! Free Antivirus
"Cisco Connect" = Cisco Connect
"Office14.SingleImage" = Microsoft Office Professional 2010
"Paint Shop Pro 5.01" = Paint Shop Pro 5.01
"Picasa 3" = Picasa 3
"SecondLifeViewer2" = SecondLifeViewer2 (remove only)
"WinLiveSuite" = Windows Live Essentials
"ZhornStickies" = Stickies 7.1a

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"FF389026-F961-42C5-BACD-B4A3AA73E0F3" = Riverpoint Writer
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

Hijack this now let me run, and the computer didn't freeze up. But I'd still like a review of my system to make sure there isn't any funny business there. Thank you.
So confused.

#4 Artemisia

Artemisia
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:15 PM

Posted 11 June 2011 - 11:21 AM

Okay, that list of hosts is scaring me...
So confused.

#5 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:08:15 PM

Posted 11 June 2011 - 11:28 AM

Hi!

I'm not really seeing much in your logs. We'll run through additional scans to see where we stand.

The entries in the host file aren't anything to worry about. 127.0.0.1 is a local IP address for your computer only, so if you try to access any of those sites, they will not load. This is usually from a tool like HP Hosts. We'll reset your hosts file shortly.

Lets get started!

Disable SpyBot TeaTimer
We need to disable Spybot S&D's "TeaTimer"
TeaTimer works by preventing ANY changes to the system. It will attempt to undo any fixes we run, because it blocks these fixes from running.

In order to safeguard your system from problems that can be brought on by a half finished fix, we need to disable TeaTimer. We can reenable it when we're done if you like.
  • Open SpyBot Search and Destroy by going to Start -> All Programs -> Spybot Search and Destroy -> Spybot Search and Destroy.
  • If prompted with a legal dialog, accept the warning.
  • Click Posted Image and then on "Advanced Mode"
    Posted Image
  • You may be presented with a warning dialog. If so, press Posted Image
  • Click on Posted Image
  • Click on Posted Image
  • Uncheck this checkbox:
    Posted Image
  • Close/Exit Spybot Search and Destroy


NEXT:



OTL Fix

We need to run an OTL Fix
  • Please reopen Posted Image on your desktop.
  • Copy and Paste the following code into the Posted Image textbox.
    :Services
    :OTL
    O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
    O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
    O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
    O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB (Reg Error: Key error.)
    O33 - MountPoints2\{38808260-2f09-11e0-982b-a4badbc9cf62}\Shell - "" = AutoRun
    O33 - MountPoints2\{38808260-2f09-11e0-982b-a4badbc9cf62}\Shell\AutoRun\command - "" = E:\SISetup.exe
    [2011/06/08 13:23:06 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{6BAE77F6-8590-4DFF-BB66-C93D9E05E50E}
    [2011/06/06 19:59:03 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{FE4B562C-C3CB-4070-A6AD-75B856DBFA0A}
    [2011/06/05 22:57:11 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{DBDCEFED-E0BD-4086-A371-EE6176CC0AE4}
    [2011/06/05 10:23:18 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{A5F9A706-3F3B-4C64-A126-005B0B63407B}
    [2011/06/05 09:53:04 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{0EF83660-7AED-4E0F-9AE5-7A7FACDEF55B}
    [2011/06/04 11:22:53 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{7BD289A5-7182-4B4F-947A-DDF66B690B61}
    [2011/06/03 11:21:58 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{958E6033-418D-4CE5-883D-24B70A4B693D}
    [2011/06/02 11:07:33 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{A7FC2872-AB54-4ED6-A9F5-69D925BF3618}
    [2011/06/01 09:41:04 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{1E1BCA19-FA5F-43F0-975A-8FCC9201D794}
    [2011/05/30 10:41:50 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{B8525292-6DB4-43BA-81C0-AAF5657C4AF2}
    [2011/05/29 13:34:40 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{9E56BE57-4EA0-4686-BDF1-D64DAE55B6CE}
    [2011/05/28 23:03:21 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{831B344B-47DD-435D-8E83-C8A696B065C8}
    [2011/05/28 08:02:04 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{1C242514-DF86-43A2-82EC-2DBC6728D9EF}
    [2011/05/28 07:49:48 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{F3E90F80-C6A5-4720-972F-E7A77CC382E5}
    [2011/05/26 14:06:06 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{A3E88FCA-A0E0-4B33-897D-B2C766750BB3}
    [2011/05/25 21:08:45 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{B4E9D88F-A296-4E54-85AD-EE99141DDF0A}
    [2011/05/25 09:08:34 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{42FD2F98-7E35-4E87-B363-824DAD633A26}
    [2011/05/24 21:08:23 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{30732808-366C-4BE3-836D-2DE070795AF0}
    [2011/05/24 09:08:11 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{23024F45-178C-4581-9D7A-5251E05B1EE4}
    [2011/05/23 10:48:16 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{AB38E4ED-AA51-4D46-B42B-F895469D0BE4}
    [2011/05/22 13:19:53 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{CA622B5F-142B-4C94-92F4-75B90A8D350C}
    [2011/05/21 23:19:42 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{DF5B7827-6D55-4402-AA3E-A3A1D1CC0126}
    [2011/05/21 11:19:31 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{C6A5BD12-15C0-411C-A6E5-6A323A055D06}
    [2011/05/20 23:19:20 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{A59462BE-7D4E-44CA-AB00-37B726F01087}
    [2011/05/20 10:25:10 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{36EA2163-2145-47C9-B983-F9FE66CF477C}
    [2011/05/19 22:24:59 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{CC56707A-CC21-4440-AB32-43D9201E9128}
    [2011/05/19 08:34:22 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{CBB76768-12FB-4741-A3D1-8AB150C0B084}
    [2011/05/18 10:21:53 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{28F89B47-54B7-4468-8C25-097013E0D09D}
    [2011/05/17 10:51:25 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{27A5A777-24C4-4D96-82A2-F4820237B2D4}
    [2011/05/16 14:43:03 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{05D3E926-AE82-4F5B-8F23-25F21DE96AC6}
    [2011/05/15 18:14:39 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{16535767-704B-48B4-8EAF-A0528928CD74}
    [2011/05/14 11:37:02 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{97F0080C-B97A-4BDE-BF2C-1FFEFBAE8833}
    [2011/05/13 14:49:00 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{C0FC871C-6633-478A-96E6-7263800F78A2}
    
    :Reg
    
    :Files
    ipconfig /flushdns /c
    :Commands
    [purity]
    [resethosts]
    [CreateRestorePoint]
    [emptytemp]
    [EMPTYFLASH]
    
  • Push Posted Image
  • OTL may ask to reboot the machine. Please do so if asked.
  • Click the OK button.
  • A report will open. Copy and Paste that report in your next reply.
  • If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.


NEXT:



Java Outdated

Important Note: Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system.Please follow these steps to remove older version Java components and update:
  • Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  • Look for "Java Platform, Standard Edition".
  • Click the "Download JRE" button to the right.
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • From the list, select your OS and Platform (32-bit or 64-bit).
  • If a download for an Offline Installation is available, it is recommended to choose that and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
Go to Posted Image > Control Panel, double-click on Add/Remove Programs or Programs and Features in Vista/Windows 7 and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u26-windows-i586.exe to install the newest version.
  • If using Windows 7 or Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
  • When the Java Setup - Welcome window opens, click the Install > button.
  • If offered to install a Toolbar, just uncheck the box before continuing unless you want it.
  • The McAfee Security Scan Plus tool is installed by default unless you uncheck the McAfee installation box when updating Java.
-- Starting with Java 6u10, the uninstaller incorporated in each new release uses Enhanced Auto update to automatically remove the previous version when updating to a later update release. It will not remove older versions, so they will need to be removed manually.
-- Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.


Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications but it's not necessary.
To disable the JQS service if you don't want to use it:
  • Go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter.
  • Click Ok and reboot your computer.


NEXT



Scanning with MalwareBytes' Anti-Malware

Please download Malwarebytes' Anti-Malware (v1.51.0.1200) and save it to your desktop.
Download Link 1
Download Link 2Malwarebytes' may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

  • Make sure you are connected to the Internet and double-click on mbam-setup.exe to install the application.
    For instructions with screenshots, please refer to this Guide.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • Malwarebytes will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself. Press the OK button and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
  • Under the Scanner tab, make sure the "Perform Quick Scan" option is selected.
  • Click on the Scan button.
  • When finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box, then click the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked and then click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows the database version and your operating system.
  • Exit Malwarebytes' when done.
Note: If Malwarebytes' encounters a file that is difficult to remove, you will be asked to reboot your computer so it can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally will prevent Malwarebytes' from removing all the malware.



NEXT:



ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.



  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the Posted Image button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the Posted Image icon on your desktop.
  • Check Posted Image
  • Click the Posted Image button.
  • Accept any security warnings from your browser.
  • Check Posted Image
  • Make sure that the option "Remove found threats" is Unchecked
  • When the Computer scan settings display shows, click the Advanced option, the place a check next to the following (if it is not already checked):
    • Enable Anti-Stealth technology
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push Posted Image
  • Push Posted Image, and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the Posted Image button.
  • Push Posted Image


NEXT:



Security Check
Download Security Check by screen317 from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#6 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:08:15 PM

Posted 13 June 2011 - 12:59 PM

Hi!

It's been several days since I last posted instructions for you to complete. Do you still require assistance in getting your computer cleaned up?

Please Note: Unless notified in advance, threads with no response in 3 days get closed.

Thanks,
SweetTech.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#7 Artemisia

Artemisia
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:15 PM

Posted 13 June 2011 - 06:08 PM

Yes, I just need some time. Will work on it today and tomorrow. Thank you.
So confused.

#8 Artemisia

Artemisia
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:15 PM

Posted 13 June 2011 - 06:15 PM

I'm getting this error message (screenshot)
Posted Image
So confused.

#9 Artemisia

Artemisia
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:15 PM

Posted 13 June 2011 - 06:17 PM

The program is hanging on this for the last five minutes:
Posted Image
So confused.

#10 Artemisia

Artemisia
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:15 PM

Posted 13 June 2011 - 06:33 PM

This was the original problem. Programs are not allowed to write to the hosts file. I turned off Spybot TeaTimer and ran the program as an administrator. Please answer quickly, as the program is still hanging on the "DO NOT INTERRUPT" line.
So confused.

#11 Artemisia

Artemisia
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:15 PM

Posted 13 June 2011 - 06:53 PM

Here's Malwarebytes log. No malicious files were found:

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 6850

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

6/13/2011 7:41:10 PM
mbam-log-2011-06-13 (19-41-10).txt

Scan type: Quick scan
Objects scanned: 158387
Time elapsed: 1 minute(s), 52 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
So confused.

#12 Artemisia

Artemisia
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:15 PM

Posted 13 June 2011 - 07:37 PM

OTL is still stuck. Here's a screenshot:
Posted Image
So confused.

#13 Artemisia

Artemisia
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:15 PM

Posted 14 June 2011 - 09:53 AM

I ran ESET. It said it didn't find anything. I didn't see a link for step 12.
OTL is still stuck on "DO NOT INTERRUPT". It's been over 15 hours.
So confused.

#14 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:08:15 PM

Posted 14 June 2011 - 12:36 PM

Hi!

Please exit out of the OTL window and run this fix instead:

We need to run an OTL Fix
  • Please reopen Posted Image on your desktop.
  • Copy and Paste the following code into the Posted Image textbox.
    :Services
    :OTL
    O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
    O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
    O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
    O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/2.9.3.0/GarminAxControl.CAB (Reg Error: Key error.)
    O33 - MountPoints2\{38808260-2f09-11e0-982b-a4badbc9cf62}\Shell - "" = AutoRun
    O33 - MountPoints2\{38808260-2f09-11e0-982b-a4badbc9cf62}\Shell\AutoRun\command - "" = E:\SISetup.exe
    [2011/06/08 13:23:06 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{6BAE77F6-8590-4DFF-BB66-C93D9E05E50E}
    [2011/06/06 19:59:03 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{FE4B562C-C3CB-4070-A6AD-75B856DBFA0A}
    [2011/06/05 22:57:11 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{DBDCEFED-E0BD-4086-A371-EE6176CC0AE4}
    [2011/06/05 10:23:18 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{A5F9A706-3F3B-4C64-A126-005B0B63407B}
    [2011/06/05 09:53:04 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{0EF83660-7AED-4E0F-9AE5-7A7FACDEF55B}
    [2011/06/04 11:22:53 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{7BD289A5-7182-4B4F-947A-DDF66B690B61}
    [2011/06/03 11:21:58 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{958E6033-418D-4CE5-883D-24B70A4B693D}
    [2011/06/02 11:07:33 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{A7FC2872-AB54-4ED6-A9F5-69D925BF3618}
    [2011/06/01 09:41:04 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{1E1BCA19-FA5F-43F0-975A-8FCC9201D794}
    [2011/05/30 10:41:50 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{B8525292-6DB4-43BA-81C0-AAF5657C4AF2}
    [2011/05/29 13:34:40 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{9E56BE57-4EA0-4686-BDF1-D64DAE55B6CE}
    [2011/05/28 23:03:21 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{831B344B-47DD-435D-8E83-C8A696B065C8}
    [2011/05/28 08:02:04 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{1C242514-DF86-43A2-82EC-2DBC6728D9EF}
    [2011/05/28 07:49:48 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{F3E90F80-C6A5-4720-972F-E7A77CC382E5}
    [2011/05/26 14:06:06 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{A3E88FCA-A0E0-4B33-897D-B2C766750BB3}
    [2011/05/25 21:08:45 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{B4E9D88F-A296-4E54-85AD-EE99141DDF0A}
    [2011/05/25 09:08:34 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{42FD2F98-7E35-4E87-B363-824DAD633A26}
    [2011/05/24 21:08:23 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{30732808-366C-4BE3-836D-2DE070795AF0}
    [2011/05/24 09:08:11 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{23024F45-178C-4581-9D7A-5251E05B1EE4}
    [2011/05/23 10:48:16 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{AB38E4ED-AA51-4D46-B42B-F895469D0BE4}
    [2011/05/22 13:19:53 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{CA622B5F-142B-4C94-92F4-75B90A8D350C}
    [2011/05/21 23:19:42 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{DF5B7827-6D55-4402-AA3E-A3A1D1CC0126}
    [2011/05/21 11:19:31 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{C6A5BD12-15C0-411C-A6E5-6A323A055D06}
    [2011/05/20 23:19:20 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{A59462BE-7D4E-44CA-AB00-37B726F01087}
    [2011/05/20 10:25:10 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{36EA2163-2145-47C9-B983-F9FE66CF477C}
    [2011/05/19 22:24:59 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{CC56707A-CC21-4440-AB32-43D9201E9128}
    [2011/05/19 08:34:22 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{CBB76768-12FB-4741-A3D1-8AB150C0B084}
    [2011/05/18 10:21:53 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{28F89B47-54B7-4468-8C25-097013E0D09D}
    [2011/05/17 10:51:25 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{27A5A777-24C4-4D96-82A2-F4820237B2D4}
    [2011/05/16 14:43:03 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{05D3E926-AE82-4F5B-8F23-25F21DE96AC6}
    [2011/05/15 18:14:39 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{16535767-704B-48B4-8EAF-A0528928CD74}
    [2011/05/14 11:37:02 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{97F0080C-B97A-4BDE-BF2C-1FFEFBAE8833}
    [2011/05/13 14:49:00 | 000,000,000 | ---D | C] -- C:\Users\Artemisia\AppData\Local\{C0FC871C-6633-478A-96E6-7263800F78A2}
    
    :Reg
    
    :Files
    ipconfig /flushdns /c
    :Commands
    [CreateRestorePoint]
    [emptytemp]
    [EMPTYFLASH]
    
  • Push Posted Image
  • OTL may ask to reboot the machine. Please do so if asked.
  • Click the OK button.
  • A report will open. Copy and Paste that report in your next reply.
  • If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.


Then perform the SecurityCheck scan and post that log for me to review.

Edited by SweetTech, 14 June 2011 - 12:36 PM.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#15 Artemisia

Artemisia
  • Topic Starter

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:15 PM

Posted 14 June 2011 - 09:56 PM

I tried your new script. It got stuck on 'creating restore point', then the screen went black. I had to shut down the computer, and it told me the system shut down incorrectly. I started it up normally, and was able to see my computer.

I don't know if the script caused any damage to my computer. I think the OTL process is making my computer worse, not better. I will not run another script, as everytime I do the script freezes or the computer unexpectedly shuts down. If you think the script has damaged my computer because it turned off at 'creating restore point', please let me know.

I ran the security check. Here is the log:

Results of screen317's Security Check version 0.99.13
Windows 7 (UAC is enabled)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:

Windows Firewall Enabled!
avast! Free Antivirus
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:

Spybot - Search & Destroy
Java™ 6 Update 26
Out of date Java installed!
Adobe Reader X (10.0.1)
````````````````````````````````
Process Check:
objlist.exe by Laurent

Alwil Software Avast5 AvastSvc.exe
Alwil Software Avast5 AvastUI.exe
``````````End of Log````````````
So confused.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users