Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

High Memory Usage by Host Process


  • This topic is locked This topic is locked
30 replies to this topic

#1 RonT38

RonT38

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:40 PM

Posted 07 June 2011 - 08:11 AM

OS - Windows Vista Home Premium
Computer - Acer Aspire

Computer started running slow. Noticed svchost.exe was maxing the resources. Ran CCleaner, Super Antispyware, and Malwarebytes. Found and cleaned a couple trojans with Super AntiSpyware. Created a BC account. Ran HJT, but didn't post log. I did post in Am I Infected and was later asked to read and follow the Guide and post a new topic.

Here are the scan logs. I couldn't access BC from the affected computer. I had to save the logs to a flash disk and post from another computer.

I ran DeFogger before running the scans. I tried to run the GMER scan but the computer blue screened (this is the first time that has happened).

Thanks for your help. ~Ron

I forgot to include the link to previous posts - http://www.bleepingcomputer.com/forums/topic399644.html/page__gopid__2281442#entry2281442

Attached Files


Edited by rigel, 07 June 2011 - 03:44 PM.


BC AdBot (Login to Remove)

 


#2 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:02:40 AM

Posted 14 June 2011 - 03:11 PM

Hello and welcome to the forums!

My secret agent name on the forums is SweetTech (you can call me ST for short), it's a pleasure to meet you. :)

I am very sorry for the delay in responding, but as you can see we are at the moment being flooded with logs which, when paired with the never-ending shortage of helpers, resulted in the delayed responding to your thread.

I would be glad to take a look at your log and help you with solving any malware problems.

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

  • Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forums.
  • Please make sure to carefully read any instruction that I give you. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
  • If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
  • In Windows Vista and Windows 7, all tools need to be started by right clicking and selecting Run as Administrator!
  • If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
  • Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
  • Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
  • I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together ;)
    Because of this, you must reply within three days
    failure to reply will result in the topic being closed!
  • Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
    Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________

Rootkit UnHooker (RkU)
Please download Rootkit Unhooker from one of the following links and save it to your desktop.
Link 1 (.exe file)
Link 2 (zipped file)
Link 3 (.rar file)In order to use this tool if you downloaded from either of the second two links, you will need to extract the RKUnhookerLE.exe file using a program capable of extracing ZIP and RAR compressed files. If you don't have an extraction program, you can downlaod, install and use the free 7-zip utility.

  • Double-click on RKUnhookerLE.exe to start the program.
    Vista/Windows 7 users right-click and select Run As Administrator.
  • Click the Report tab, then click Scan.
  • Check Drivers, Stealth Code, and uncheck the rest.
  • Click OK.
  • Wait until it's finished and then go to File > Save Report.
  • Save the report to your Desktop.
  • Copy and paste the contents of the report into your next reply.
-- Note: You may get this warning...just ignore it, click OK and continue: "Rootkit Unhooker has detected a parasite inside itself! It is recommended to remove parasite, okay?".



NEXT:


Running OTL

We need to create a FULL OTL Report
  • Please download OTL from here:
  • Save it to your desktop.
  • Double click on the Posted Image icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Change the "Extra Registry" option to "SafeList"
  • Push the Posted Image button.
  • Two reports will open, copy and paste them in a reply here:
    • OTL.txt <-- Will be opened
    • Extras.txt <-- Will be minimized

NEXT:


Please provide an update on how things are running in your next reply.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#3 RonT38

RonT38
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:40 PM

Posted 15 June 2011 - 12:11 AM

I'm posting this from another computer for two reasons. First, when I had went to bleepingcomputer.com on the computer I'm having trouble with, to read the post and get the downloads suggested, I was notified of a survey I could take and win a gift (I didn't bite). When I tried to go back a page I was redirected to another site. So, I had to use another computer to download the two programs I needed to use to scan my computer.

Secondly, after installing and running the scans, I tried to go to BC again, and this time I got an error messge when I tried to log into the post. This is the error message:

Windows Internet Explorer

Internet Explorer cannot open the Internet site http://bleepingcomputer.com/forums/topic402301.html/page_p_2281441_hl_high+memory+usage_fromsearch_1#entry2281441.
Operation aborted

When I clicked the red X in the corner of the error message window the page closed.
Here are the scan logs. I used a flash disk to transfer them (I scanned the disk before opening them):

RkU Version: 3.8.389.593, Type LE (SR2)
==============================================
OS Name: Windows Vista
Version 6.0.6000
Number of processors #1
==============================================
>Drivers
==============================================
0x8CC1A000 C:\Windows\system32\DRIVERS\igdkmd32.sys 6184960 bytes (Intel Corporation, Intel Graphics Kernel Mode Driver)
0x81C00000 C:\Windows\system32\ntkrnlpa.exe 3805184 bytes (Microsoft Corporation, NT Kernel & System)
0x81C00000 PnpManager 3805184 bytes
0x81C00000 RAW 3805184 bytes
0x81C00000 WMIxWDM 3805184 bytes
0xA2600000 Win32k 2097152 bytes
0xA2600000 C:\Windows\System32\win32k.sys 2097152 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0x8D44B000 C:\Windows\system32\drivers\RTKVHDA.sys 1789952 bytes (Realtek Semiconductor Corp., Realtek® High Definition Audio Function Driver)
0x955C7000 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20110606.002\NAVEX15.SYS 1536000 bytes (Symantec Corporation, AV Engine)
0x854BF000 C:\Windows\System32\Drivers\Ntfs.sys 1081344 bytes (Microsoft Corporation, NT File System Driver)
0x85241000 C:\Windows\system32\drivers\ndis.sys 1064960 bytes (Microsoft Corporation, NDIS 6.0 wrapper driver)
0x8BCFD000 C:\Windows\system32\DRIVERS\HSX_DPV.sys 1060864 bytes (Conexant Systems, Inc., HSF_DP driver)
0x8051F000 C:\Windows\system32\CI.dll 921600 bytes (Microsoft Corporation, Code Integrity Module)
0x94830000 C:\Windows\system32\drivers\peauth.sys 909312 bytes (Microsoft Corporation, Protected Environment Authentication and Authorization Export Driver)
0x8C4B9000 C:\Windows\System32\drivers\tcpip.sys 868352 bytes (Microsoft Corporation, TCP/IP Driver)
0x8E938000 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20110518.001\BHDrvx86.sys 819200 bytes (Symantec Corporation, BASH Driver)
0x896D9000 C:\Windows\System32\Drivers\dump_iaStor.sys 815104 bytes
0x806E1000 C:\Windows\system32\DRIVERS\iaStor.sys 815104 bytes (Intel Corporation, Intel Matrix Storage Manager driver - ia32)
0x85345000 C:\Windows\system32\drivers\NIS\1206000.01D\SYMEFA.SYS 765952 bytes (Symantec Corporation, Symantec Extended File Attributes)
0x8C58D000 C:\Windows\system32\DRIVERS\HSX_CNXT.sys 737280 bytes (Conexant Systems, Inc., HSF_CNXT driver)
0x8BA74000 C:\Windows\System32\drivers\dxgkrnl.sys 638976 bytes (Microsoft Corporation, DirectX Graphics Kernel)
0x9418F000 C:\Windows\system32\drivers\spsys.sys 581632 bytes (Microsoft Corporation, security processor)
0x950AA000 C:\Windows\System32\Drivers\NIS\1206000.01D\SRTSP.SYS 548864 bytes (Symantec Corporation, Symantec AutoProtect)
0x804A4000 C:\Windows\system32\drivers\Wdf01000.sys 503808 bytes (Microsoft Corporation, WDF Dynamic)
0x85455000 C:\Windows\System32\Drivers\ksecdd.sys 434176 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0x9407B000 C:\Windows\system32\drivers\HTTP.sys 430080 bytes (Microsoft Corporation, HTTP Protocol Stack)
0x80266000 C:\Windows\system32\mcupdate_GenuineIntel.dll 393216 bytes (Microsoft Corporation, Intel Microcode Update Library)
0x8CB61000 C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys 385024 bytes (Symantec Corporation, Symantec Eraser Control Driver)
0x8CBBF000 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20110603.003\IDSvix86.sys 372736 bytes (Symantec Corporation, IDS Core Driver)
0x8BCA4000 C:\Windows\System32\Drivers\NIS\1206000.01D\SYMTDIV.SYS 364544 bytes (Symantec Corporation, Network Dispatch Driver)
0x80633000 C:\Windows\system32\drivers\NIS\1206000.01D\SYMDS.SYS 356352 bytes (Symantec Corporation, Symantec Data Store)
0x9425D000 C:\Windows\System32\DRIVERS\srv.sys 331776 bytes (Microsoft Corporation, Server driver)
0x807A8000 C:\Windows\System32\drivers\volmgrx.sys 303104 bytes (Microsoft Corporation, Volume Manager Extension Driver)
0x8C7C5000 C:\Windows\system32\drivers\afd.sys 290816 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0x80461000 C:\Windows\system32\drivers\acpi.sys 274432 bytes (Microsoft Corporation, ACPI Driver for NT)
0x8C422000 C:\Windows\system32\DRIVERS\storport.sys 262144 bytes (Microsoft Corporation, Microsoft Storage Port Driver)
0x8A420000 C:\Windows\system32\DRIVERS\yk60x86.sys 258048 bytes (Marvell, NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller)
0x8BA37000 C:\Windows\system32\DRIVERS\HSXHWAZL.sys 249856 bytes (Conexant Systems, Inc., HSF_HWAZL WDM driver)
0x8962F000 C:\Windows\system32\DRIVERS\USBPORT.SYS 249856 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0x8021A000 C:\Windows\system32\CLFS.SYS 241664 bytes (Microsoft Corporation, Common Log File System Driver)
0x8C84C000 C:\Windows\system32\DRIVERS\NWADIenum.sys 241664 bytes (Novatel Wireless Inc, NWADI Interface Bus Enumerator)
0x89849000 C:\Windows\system32\DRIVERS\rdbss.sys 241664 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0x8C993000 C:\Windows\system32\DRIVERS\mrxsmb10.sys 233472 bytes (Microsoft Corporation, Longhorn SMB Downlevel SubRdr)
0x855C7000 C:\Windows\system32\drivers\NETIO.SYS 233472 bytes (Microsoft Corporation, Network I/O Subsystem)
0x8541F000 C:\Windows\system32\drivers\volsnap.sys 221184 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0x81FA1000 ACPI_HAL 212992 bytes
0x81FA1000 C:\Windows\system32\hal.dll 212992 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0x8C90D000 C:\Windows\system32\DRIVERS\usbhub.sys 212992 bytes (Microsoft Corporation, Default Hub Driver for USB)
0x8AB70000 C:\Windows\System32\DRIVERS\netbt.sys 204800 bytes (Microsoft Corporation, MBT Transport driver)
0x8068A000 C:\Windows\system32\drivers\fltmgr.sys 200704 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0x9400D000 C:\Windows\System32\Drivers\RDPWD.SYS 188416 bytes (Microsoft Corporation, RDP Terminal Stack Driver)
0x8AA3A000 C:\Windows\system32\drivers\portcls.sys 184320 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0x89884000 C:\Windows\system32\DRIVERS\SynTP.sys 180224 bytes (Synaptics, Inc., Synaptics Touchpad Driver)
0x8ADD5000 C:\Windows\system32\DRIVERS\msiscsi.sys 176128 bytes (Microsoft Corporation, Microsoft iSCSI Initiator Driver)
0x85216000 C:\Windows\system32\drivers\msrpc.sys 176128 bytes (Microsoft Corporation, Kernel Remote Procedure Call Provider)
0x8BB99000 C:\Windows\system32\DRIVERS\nwifi.sys 176128 bytes (Microsoft Corporation, NativeWiFi Miniport Driver)
0x8C6C9000 C:\Windows\system32\DRIVERS\ks.sys 172032 bytes (Microsoft Corporation, Kernel CSA Library)
0x86087000 C:\Windows\System32\Drivers\fastfat.SYS 163840 bytes (Microsoft Corporation, Fast FAT File System Driver)
0x89819000 C:\Windows\system32\Drivers\SYMEVENT.SYS 155648 bytes (Symantec Corporation, Symantec Event Library)
0x89683000 C:\Windows\system32\drivers\drmk.sys 151552 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0x857DB000 C:\Windows\System32\drivers\ecache.sys 151552 bytes (Microsoft Corporation, Special Memory Device Cache)
0x80434000 C:\Windows\system32\drivers\pci.sys 151552 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0x8C495000 C:\Windows\system32\drivers\NIS\1206000.01D\Ironx86.SYS 147456 bytes (Symantec Corporation, Iron Driver)
0x8C70C000 C:\Windows\System32\DRIVERS\srv2.sys 147456 bytes (Microsoft Corporation, Smb 2.0 Server driver)
0x8BC04000 C:\Windows\system32\DRIVERS\ndiswan.sys 143360 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0x8C7A3000 C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS 139264 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASKUTIL.SYS)
0x857A9000 C:\Windows\system32\drivers\CLASSPNP.SYS 135168 bytes (Microsoft Corporation, SCSI Class System Dll)
0x8A52F000 C:\Windows\System32\drivers\VIDEOPRT.SYS 135168 bytes (Microsoft Corporation, Video Port Driver)
0x8ACE2000 C:\Windows\system32\drivers\mrxdav.sys 131072 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0x806BB000 C:\Windows\system32\drivers\ataport.SYS 122880 bytes (Microsoft Corporation, ATAPI Driver Extension)
0x86141000 C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys 122880 bytes (Symantec Corporation, Symantec Eraser Utility Driver)
0x8BB2E000 C:\Windows\system32\DRIVERS\mrxsmb.sys 122880 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0x8A478000 C:\Windows\system32\drivers\luafv.sys 110592 bytes (Microsoft Corporation, LUA File Virtualization Filter Driver)
0x8AC29000 C:\Windows\System32\DRIVERS\srvnet.sys 110592 bytes (Microsoft Corporation, Server Network driver)
0x8A45F000 C:\Windows\system32\DRIVERS\bowser.sys 102400 bytes (Microsoft Corporation, NT Lan Manager Datagram Receiver Driver)
0x8AAB7000 C:\Windows\System32\drivers\fwpkclnt.sys 102400 bytes (Microsoft Corporation, FWP/IPsec Kernel-Mode API)
0x898F2000 C:\Windows\system32\DRIVERS\cdrom.sys 98304 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0x8ABF5000 C:\Windows\System32\Drivers\dfsc.sys 94208 bytes (Microsoft Corporation, DFS Client MUP Surrogate Driver)
0x89971000 C:\Windows\system32\DRIVERS\rasl2tp.sys 94208 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0x8A5BE000 C:\Windows\system32\DRIVERS\cdfs.sys 90112 bytes (Microsoft Corporation, CD-ROM File System Driver)
0x8AA10000 C:\Windows\system32\DRIVERS\pacer.sys 90112 bytes (Microsoft Corporation, QoS Packet Scheduler)
0x8777A000 C:\Windows\system32\DRIVERS\tdx.sys 86016 bytes (Microsoft Corporation, TDI Translation Driver)
0x899C8000 C:\Windows\System32\drivers\mpsdrv.sys 81920 bytes (Microsoft Corporation, Microsoft Protection Service Driver)
0x8C8F9000 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20110606.002\NAVENG.SYS 81920 bytes (Symantec Corporation, AV Engine)
0x8AA26000 C:\Windows\system32\DRIVERS\smb.sys 81920 bytes (Microsoft Corporation, SMB Transport driver)
0x8778F000 C:\Windows\system32\DRIVERS\i8042prt.sys 77824 bytes (Microsoft Corporation, i8042 Port Driver)
0x8A40D000 C:\Windows\system32\DRIVERS\raspptp.sys 77824 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0x89605000 C:\Windows\system32\DRIVERS\rspndr.sys 77824 bytes (Microsoft Corporation, Link-Layer Topology Responder Driver for NDIS 6)
0x8AB2D000 C:\Windows\system32\DRIVERS\wanarp.sys 77824 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0x8764E000 C:\Windows\system32\DRIVERS\HDAudBus.sys 73728 bytes (Microsoft Corporation, High Definition Audio Bus Driver)
0x896A9000 C:\Windows\system32\DRIVERS\mrxsmb20.sys 73728 bytes (Microsoft Corporation, Longhorn SMB 2.0 Redirector)
0x85204000 C:\Windows\system32\drivers\psdvdisk.sys 73728 bytes (HiTRUST, PSD Virtual Disk Driver)
0x857CA000 C:\Windows\system32\drivers\disk.sys 69632 bytes (Microsoft Corporation, PnP Disk Driver)
0x8961E000 C:\Acer\Empowering Technology\eRecovery\int15.sys 69632 bytes
0x80623000 C:\Windows\system32\drivers\fileinfo.sys 65536 bytes (Microsoft Corporation, FileInfo Filter Driver)
0x97390000 C:\Windows\system32\DRIVERS\lltdio.sys 65536 bytes (Microsoft Corporation, Link-Layer Topology Mapper I/O Driver)
0x8040B000 C:\Windows\System32\drivers\mountmgr.sys 65536 bytes (Microsoft Corporation, Mount Point Manager)
0x8605F000 C:\Windows\System32\Drivers\NDProxy.SYS 65536 bytes (Microsoft Corporation, NDIS Proxy)
0x9F618000 C:\Windows\system32\DRIVERS\monitor.sys 61440 bytes (Microsoft Corporation, Monitor Driver)
0x85401000 C:\Windows\System32\Drivers\mup.sys 61440 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0x85410000 C:\Windows\System32\drivers\partmgr.sys 61440 bytes (Microsoft Corporation, Partition Management Driver)
0x8BB10000 C:\Windows\system32\DRIVERS\raspppoe.sys 61440 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0x8BB1F000 C:\Windows\system32\DRIVERS\termdd.sys 61440 bytes (Microsoft Corporation, Terminal Server Driver)
0x80425000 C:\Windows\system32\drivers\volmgr.sys 61440 bytes (Microsoft Corporation, Volume Manager Driver)
0xB3010000 C:\Windows\System32\cdd.dll 57344 bytes (Microsoft Corporation, Canonical Display Driver)
0x8AC0C000 C:\Windows\system32\DRIVERS\intelppm.sys 57344 bytes (Microsoft Corporation, Processor Device Driver)
0x8ACA6000 C:\Windows\system32\DRIVERS\netbios.sys 57344 bytes (Microsoft Corporation, NetBIOS interface driver)
0x8AC7C000 C:\Windows\System32\Drivers\Npfs.SYS 57344 bytes (Microsoft Corporation, NPFS Driver)
0x807F2000 C:\Windows\system32\drivers\PCIIDEX.SYS 57344 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0x8AC1A000 C:\Windows\system32\DRIVERS\usbehci.sys 57344 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0xA0C4A000 C:\Windows\System32\Drivers\crashdmp.sys 53248 bytes (Microsoft Corporation, Crash Dump Driver)
0x8A508000 C:\Windows\system32\drivers\modem.sys 53248 bytes (Microsoft Corporation, Modem Device Driver)
0x8A4BA000 C:\Windows\system32\DRIVERS\umbus.sys 53248 bytes (Microsoft Corporation, User-Mode Bus Enumerator)
0x8A493000 C:\Windows\System32\drivers\watchdog.sys 53248 bytes (Microsoft Corporation, Watchdog Driver)
0x8020D000 C:\Windows\system32\drivers\WDFLDR.SYS 53248 bytes (Microsoft Corporation, WDFLDR)
0xA0A72000 C:\Windows\System32\DRIVERS\tssecsrv.sys 49152 bytes (Microsoft Corporation, TS Security Filter Driver)
0x899DC000 C:\Windows\System32\drivers\vga.sys 49152 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0x8A5B3000 C:\Windows\system32\DRIVERS\kbdclass.sys 45056 bytes (Microsoft Corporation, Keyboard Class Driver)
0x8A5D4000 C:\Windows\system32\DRIVERS\mouclass.sys 45056 bytes (Microsoft Corporation, Mouse Class Driver)
0x8A5F5000 C:\Windows\System32\Drivers\Msfs.SYS 45056 bytes (Microsoft Corporation, Mailslot driver)
0x8A5EA000 C:\Windows\system32\DRIVERS\ndistapi.sys 45056 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0x8A550000 C:\Windows\system32\drivers\NIS\1206000.01D\SRTSPX.SYS 45056 bytes (Symantec Corporation, Symantec AutoProtect)
0x9B06B000 C:\Windows\System32\drivers\tcpipreg.sys 45056 bytes (Microsoft Corporation, TCP/IP Registry Compatibility Driver)
0x8A5DF000 C:\Windows\system32\DRIVERS\TDI.SYS 45056 bytes (Microsoft Corporation, TDI Wrapper)
0x9B081000 C:\Windows\system32\drivers\tdtcp.sys 45056 bytes (Microsoft Corporation, TCP Transport Driver)
0x8A587000 C:\Windows\system32\DRIVERS\tunnel.sys 45056 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)
0x8A592000 C:\Windows\system32\DRIVERS\usbuhci.sys 45056 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0x8041B000 C:\Windows\system32\DRIVERS\BATTC.SYS 40960 bytes (Microsoft Corporation, Battery Class Driver)
0x8AADA000 C:\Windows\system32\DRIVERS\DKbFltr.sys 40960 bytes (Dritek System Inc., Dritek PS2 Keyboard Filter Driver)
0x9D0FE000 C:\Windows\System32\drivers\Dxapi.sys 40960 bytes (Microsoft Corporation, DirectX API Driver)
0x8AAEE000 C:\Windows\system32\DRIVERS\mssmbios.sys 40960 bytes (Microsoft Corporation, System Management BIOS Driver)
0x9D108000 C:\Windows\system32\DRIVERS\ndisuio.sys 40960 bytes (Microsoft Corporation, NDIS User mode I/O driver)
0x8AA94000 C:\Windows\system32\drivers\nsiproxy.sys 40960 bytes (Microsoft Corporation, NSI Proxy)
0x9D112000 C:\Windows\System32\Drivers\secdrv.SYS 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver)
0xA0EA1000 C:\Windows\System32\Drivers\BlackBox.SYS 36864 bytes (RKU Driver)
0x857A0000 C:\Windows\system32\drivers\crcdisk.sys 36864 bytes (Microsoft Corporation, Disk Block Verification Filter Driver)
0x898B0000 C:\Windows\System32\Drivers\Fs_Rec.SYS 36864 bytes (Microsoft Corporation, File System Recognizer Driver)
0x8061A000 C:\Windows\system32\DRIVERS\psdfilter.sys 36864 bytes (HiTRUST, PSD Filter Driver)
0x80604000 C:\Windows\system32\drivers\PSDNServ.sys 36864 bytes (HiTRUST, PSD Named Pipe Driver)
0x8025D000 C:\Windows\system32\PSHED.dll 36864 bytes (Microsoft Corporation, Platform Specific Hardware Error Driver)
0x898B9000 C:\Windows\System32\DRIVERS\rasacd.sys 36864 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xB3000000 C:\Windows\System32\TSDDD.dll 36864 bytes (Microsoft Corporation, Framebuffer Display Driver)
0x8990A000 C:\Windows\system32\DRIVERS\tunmp.sys 36864 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)
0x89913000 C:\Windows\system32\DRIVERS\wmiacpi.sys 36864 bytes (Microsoft Corporation, Windows Management Interface for ACPI)
0x80204000 C:\Windows\system32\drivers\WMILIB.SYS 36864 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0x806D9000 C:\Windows\system32\drivers\atapi.sys 32768 bytes (Microsoft Corporation, ATAPI IDE Miniport Driver)
0x80255000 C:\Windows\system32\BOOTVID.dll 32768 bytes (Microsoft Corporation, VGA Boot Driver)
0x802C6000 C:\Windows\system32\kdcom.dll 32768 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0x80459000 C:\Windows\system32\drivers\msisadrv.sys 32768 bytes (Microsoft Corporation, ISA Driver)
0x876E4000 C:\Windows\System32\DRIVERS\RDPCDD.sys 32768 bytes (Microsoft Corporation, RDP Miniport)
0x876EC000 C:\Windows\system32\drivers\rdpencdd.sys 32768 bytes (Microsoft Corporation, RDP Miniport)
0x8060D000 C:\Windows\System32\Drivers\spldr.sys 32768 bytes (Microsoft Corporation, loader for security processor)
0x96CB5000 C:\Windows\system32\DRIVERS\xaudio.sys 32768 bytes (Conexant Systems, Inc., Modem Audio Device Driver)
0x8AD68000 C:\Windows\System32\Drivers\Beep.SYS 28672 bytes (Microsoft Corporation, BEEP Driver)
0x80404000 C:\Windows\system32\drivers\intelide.sys 28672 bytes (Microsoft Corporation, Intel PCI IDE Driver)
0x8AD61000 C:\Windows\System32\Drivers\Null.SYS 28672 bytes (Microsoft Corporation, NULL Driver)
0x897AC000 C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter)
0x897D0000 C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS 24576 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASDIFSV.SYS)
0x80615000 C:\Windows\system32\DRIVERS\PxHelp20.sys 20480 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)
0x87660000 C:\Windows\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver)
0x94578000 C:\Windows\system32\DRIVERS\mdmxsdk.sys 16384 bytes (Conexant, Diagnostic Interface x86 Driver)
0x80201000 C:\Windows\system32\DRIVERS\compbatt.sys 12288 bytes (Microsoft Corporation, Composite Battery Driver)
0x94918000 C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl 8192 bytes (Cyberlink Corp., FCL Driver)
0x8C8E3000 C:\Windows\system32\DRIVERS\NTIDrvr.sys 8192 bytes (NewTech Infosystems, Inc., NTI CD-ROM Filter Driver)
0x8C8F1000 C:\Windows\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0x8C8DD000 C:\Windows\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
==============================================
>Stealth
==============================================

OTL logfile created on: 6/14/2011 10:08:26 PM - Run 1
OTL by OldTimer - Version 3.2.24.0 Folder = C:\Users\Cydnie\Desktop
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16982)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1013.81 Mb Total Physical Memory | 182.86 Mb Available Physical Memory | 18.04% Memory free
2.23 Gb Paging File | 0.81 Gb Available in Paging File | 36.30% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 51.01 Gb Total Space | 25.01 Gb Free Space | 49.02% Space Free | Partition Type: NTFS
Drive D: | 51.01 Gb Total Space | 50.92 Gb Free Space | 99.82% Space Free | Partition Type: NTFS

Computer Name: CYDNIE-PC | User Name: Cydnie | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/06/14 21:11:12 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Cydnie\Desktop\OTL.exe
PRC - [2011/06/03 21:49:17 | 000,208,896 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Users\Cydnie\AppData\Local\Temp\RtkBtMnt.exe
PRC - [2011/05/25 06:28:38 | 002,424,192 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
PRC - [2011/04/16 18:45:11 | 000,130,008 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton Internet Security\Engine\18.6.0.29\ccsvchst.exe
PRC - [2010/02/19 00:08:57 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2007/10/17 12:59:56 | 000,842,248 | ---- | M] (Dritek System Inc.) -- C:\Program Files\Launch Manager\LManager.exe
PRC - [2007/08/15 16:33:20 | 000,268,288 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mcbuilder.exe
PRC - [2007/07/06 13:07:52 | 000,450,560 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
PRC - [2007/07/06 13:06:00 | 004,669,440 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007/07/03 12:40:10 | 000,053,248 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
PRC - [2007/06/28 20:50:52 | 000,024,576 | ---- | M] () -- C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
PRC - [2007/06/13 18:56:18 | 000,765,952 | R--- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eNet\eNMTray.exe
PRC - [2007/06/13 18:54:36 | 000,135,168 | R--- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eNet\eNet Service.exe
PRC - [2007/06/13 13:23:54 | 000,167,936 | ---- | M] (acer) -- C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
PRC - [2007/05/24 15:38:22 | 000,206,952 | ---- | M] (CyberLink Corp.) -- C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
PRC - [2007/04/25 18:34:30 | 000,457,512 | ---- | M] (HiTRSUT) -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
PRC - [2007/04/25 18:33:36 | 000,457,216 | ---- | M] (HiTRUST) -- C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
PRC - [2007/04/25 12:35:56 | 000,323,584 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
PRC - [2007/04/23 11:53:48 | 000,024,576 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
PRC - [2007/04/13 09:49:00 | 000,101,528 | ---- | M] () -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe
PRC - [2007/04/03 19:50:00 | 001,603,152 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
PRC - [2007/03/21 14:00:04 | 000,355,096 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2007/03/21 14:00:00 | 000,174,872 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2007/02/09 08:35:54 | 000,397,312 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
PRC - [2006/11/24 14:57:54 | 000,107,008 | ---- | M] () -- C:\Acer\Mobility Center\MobilityService.exe
PRC - [2006/11/02 03:45:34 | 000,020,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\RacAgent.exe


========== Modules (SafeList) ==========

MOD - [2011/06/14 21:11:12 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Cydnie\Desktop\OTL.exe
MOD - [2011/04/28 18:29:01 | 000,413,112 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton Internet Security\Engine\18.6.0.29\asoehook.dll
MOD - [2009/07/12 02:02:02 | 000,653,120 | R--- | M] (Microsoft Corporation) -- C:\Program Files\Norton Internet Security\Engine\18.6.0.29\microsoft.vc90.crt\msvcr90.dll
MOD - [2009/07/12 02:02:00 | 000,569,664 | R--- | M] (Microsoft Corporation) -- C:\Program Files\Norton Internet Security\Engine\18.6.0.29\microsoft.vc90.crt\msvcp90.dll
MOD - [2006/11/02 03:38:57 | 001,648,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2011/04/16 18:45:11 | 000,130,008 | R--- | M] (Symantec Corporation) [Unknown | Running] -- C:\Program Files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe -- (NIS)
SRV - [2007/08/15 14:03:53 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/07/03 12:40:10 | 000,053,248 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe -- (eRecoveryService)
SRV - [2007/06/28 20:50:52 | 000,024,576 | ---- | M] () [Auto | Running] -- C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe -- (eSettingsService)
SRV - [2007/06/13 18:54:36 | 000,135,168 | R--- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\eNet\eNet Service.exe -- (eNet Service)
SRV - [2007/06/13 13:23:54 | 000,167,936 | ---- | M] (acer) [Auto | Running] -- C:\Acer\Empowering Technology\ePower\ePowerSvc.exe -- (WMIService)
SRV - [2007/04/25 18:34:30 | 000,457,512 | ---- | M] (HiTRSUT) [Auto | Running] -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe -- (eDataSecurity Service)
SRV - [2007/04/23 11:53:48 | 000,024,576 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe -- (eLockService)
SRV - [2007/04/13 09:49:00 | 000,101,528 | ---- | M] () [Auto | Running] -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe -- (IJPLMSVC)
SRV - [2007/03/21 14:00:04 | 000,355,096 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel®
SRV - [2006/11/24 14:57:54 | 000,107,008 | ---- | M] () [Auto | Running] -- C:\Acer\Mobility Center\MobilityService.exe -- (MobilityService)


========== Driver Services (SafeList) ==========

DRV - [2011/05/19 20:34:25 | 001,542,392 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20110606.002\NAVEX15.SYS -- (NAVEX15)
DRV - [2011/05/19 20:34:25 | 000,086,008 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20110606.002\NAVENG.SYS -- (NAVENG)
DRV - [2011/05/15 12:12:13 | 000,126,584 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2011/05/15 12:11:14 | 000,374,392 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2011/05/15 12:11:14 | 000,105,592 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2011/04/30 01:44:12 | 000,802,936 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20110518.001\BHDrvx86.sys -- (BHDrvx86)
DRV - [2011/03/30 21:00:09 | 000,516,216 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\Drivers\NIS\1206000.01D\SRTSP.SYS -- (SRTSP)
DRV - [2011/03/30 21:00:09 | 000,050,168 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\NIS\1206000.01D\SRTSPX.SYS -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2011/03/21 18:39:49 | 000,331,384 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\Drivers\NIS\1206000.01D\SYMTDIV.SYS -- (SYMTDIv)
DRV - [2011/03/14 20:31:23 | 000,744,568 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\system32\drivers\NIS\1206000.01D\SYMEFA.SYS -- (SymEFA)
DRV - [2011/03/14 12:58:33 | 000,353,912 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20110603.003\IDSvix86.sys -- (IDSVix86)
DRV - [2011/01/27 00:47:10 | 000,340,088 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\NIS\1206000.01D\SYMDS.SYS -- (SymDS)
DRV - [2011/01/26 23:07:05 | 000,136,312 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\NIS\1206000.01D\Ironx86.SYS -- (SymIRON)
DRV - [2010/05/10 12:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/02/17 12:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2009/03/20 20:03:36 | 000,032,408 | ---- | M] (Smith Micro Inc.) [Kernel | On_Demand | Stopped] -- C:\Program Files\Verizon Wireless\VZAccess Manager\SMSIVZAM5.sys -- (SMSIVZAM5)
DRV - [2008/07/07 13:23:56 | 000,020,480 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NwUsbCdFil.sys -- (NWUSBCDFIL)
DRV - [2008/06/02 17:28:50 | 000,222,720 | ---- | M] (Novatel Wireless Inc) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NWADIenum.sys -- (NWADI)
DRV - [2008/05/09 12:08:40 | 000,174,336 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nwusbser2.sys -- (NWUSBPort2)
DRV - [2008/05/09 12:08:40 | 000,174,336 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nwusbser.sys -- (NWUSBPort)
DRV - [2008/05/09 12:08:40 | 000,174,336 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nwusbmdm.sys -- (NWUSBModem)
DRV - [2007/04/23 21:19:04 | 000,705,024 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2006/12/07 20:12:02 | 000,076,584 | ---- | M] () [Kernel | Auto | Running] -- C:\Acer\Empowering Technology\eRecovery\int15.sys -- (int15)
DRV - [2006/11/28 18:44:52 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2006/11/02 18:51:58 | 000,013,560 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Running] -- C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl -- ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796})
DRV - [2006/11/02 06:35:58 | 000,542,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\blackbox.dll -- (BlackBox)
DRV - [2006/11/02 01:30:56 | 000,044,544 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.us.acer.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://en.us.acer.yahoo.com


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-3002486612-2040308753-4284617920-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SEARCH PAGE = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
IE - HKU\S-1-5-21-3002486612-2040308753-4284617920-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKU\S-1-5-21-3002486612-2040308753-4284617920-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKU\S-1-5-21-3002486612-2040308753-4284617920-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKU\S-1-5-21-3002486612-2040308753-4284617920-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3002486612-2040308753-4284617920-1000\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKU\S-1-5-21-3002486612-2040308753-4284617920-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3002486612-2040308753-4284617920-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:25426

FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPlgn\ [2011/05/15 12:19:58 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\coFFPlgn\ [2011/05/15 12:11:31 | 000,000,000 | ---D | M]


O1 HOSTS File: ([2011/03/31 17:59:30 | 000,001,527 | RHS- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 74.50.127.5 www.google.com
O1 - Hosts: 74.50.127.5 www.google.com.au
O1 - Hosts: 74.50.127.5 www.google.be
O1 - Hosts: 74.50.127.5 www.google.com.br
O1 - Hosts: 74.50.127.5 www.google.ca
O1 - Hosts: 74.50.127.5 www.google.ch
O1 - Hosts: 74.50.127.5 www.google.de
O1 - Hosts: 74.50.127.5 www.google.dk
O1 - Hosts: 74.50.127.5 www.google.fr
O1 - Hosts: 74.50.127.5 www.google.ie
O1 - Hosts: 74.50.127.5 www.google.it
O1 - Hosts: 74.50.127.5 www.google.co.jp
O1 - Hosts: 74.50.127.5 www.google.nl
O1 - Hosts: 74.50.127.5 www.google.no
O1 - Hosts: 74.50.127.5 www.google.co.nz
O1 - Hosts: 74.50.127.5 www.google.pl
O1 - Hosts: 74.50.127.5 www.google.se
O1 - Hosts: 74.50.127.5 www.google.co.uk
O1 - Hosts: 74.50.127.5 www.google.co.za
O1 - Hosts: 74.50.127.5 www.bing.com
O1 - Hosts: 74.50.127.5 search.yahoo.com
O1 - Hosts: 74.50.127.5 uk.search.yahoo.com
O1 - Hosts: 74.50.127.5 ca.search.yahoo.com
O1 - Hosts: 4 more lines...
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - No CLSID value found.
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\System32\ActiveToolBand.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKU\S-1-5-21-3002486612-2040308753-4284617920-1000\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKU\S-1-5-21-3002486612-2040308753-4284617920-1000\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [Acer Assist Launcher] C:\Program Files\Acer Assist\launcher.exe ()
O4 - HKLM..\Run: [Acer Product Registration] C:\Program Files\Acer Registration\ACE1.exe (Leader Technologies)
O4 - HKLM..\Run: [Acer Tour] File not found
O4 - HKLM..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (Acer Inc.)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe (HiTRUST)
O4 - HKLM..\Run: [eRecoveryService] File not found
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [PlayMovie] C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-3002486612-2040308753-4284617920-1000..\Run: [Acer Tour Reminder] File not found
O4 - HKU\S-1-5-21-3002486612-2040308753-4284617920-1000..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 2
O7 - HKU\S-1-5-21-3002486612-2040308753-4284617920-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisallowRun = 1
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 216.129.224.49 216.220.0.1
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop BackupWallPaper: C:\Users\Cydnie\AppData\Roaming\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 15:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{9e199780-1925-11df-95fa-001d720eac3b}\Shell - "" = AutoRun
O33 - MountPoints2\{9e199780-1925-11df-95fa-001d720eac3b}\Shell\AutoRun\command - "" = F:\VZAccess_Manager.exe /z detect
O33 - MountPoints2\{9e1997d3-1925-11df-95fa-001d720eac3b}\Shell - "" = AutoRun
O33 - MountPoints2\{9e1997d3-1925-11df-95fa-001d720eac3b}\Shell\AutoRun\command - "" = H:\VZAccess_Manager.exe /z detect
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\VZAccess_Manager.exe /z detect
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\VZAccess_Manager.exe /z detect
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/06/14 21:15:39 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\Cydnie\Desktop\OTL.exe
[2011/06/12 14:42:04 | 001,984,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\authui.dll
[2011/06/12 14:42:03 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntprint.dll
[2011/06/12 14:41:59 | 008,138,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ssBranded.scr
[2011/06/12 14:41:56 | 000,120,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dhcpcsvc6.dll
[2011/06/12 14:41:56 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntprint.exe
[2011/06/12 14:41:56 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dhcpcmonitor.dll
[2011/06/06 19:39:33 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/06/03 23:14:32 | 000,000,000 | ---D | C] -- C:\ProgramData\WinZip
[2011/06/03 23:14:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip
[2011/06/03 23:14:22 | 000,000,000 | ---D | C] -- C:\Program Files\WinZip
[2011/06/03 22:34:12 | 000,607,294 | R--- | C] (Swearware) -- C:\Users\Cydnie\Desktop\dds.scr
[2011/06/03 21:59:03 | 000,024,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\nshhttp.dll
[2011/06/03 21:58:22 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\httpapi.dll
[2011/05/29 20:36:36 | 000,000,000 | ---D | C] -- C:\perflogs
[2011/05/29 19:16:31 | 000,000,000 | ---D | C] -- C:\Users\Cydnie\AppData\Local\ElevatedDiagnostics
[2011/05/29 17:37:02 | 000,000,000 | ---D | C] -- C:\Windows\System32\WindowsPowerShell
[2011/05/29 17:37:01 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell 1.0
[2011/05/29 17:31:07 | 000,434,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2011/05/29 17:14:40 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft ATS
[2011/05/29 15:47:39 | 000,220,672 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codecp.acm
[2011/05/29 15:47:39 | 000,062,464 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codeca.acm
[2011/05/20 07:51:15 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2011/05/20 07:51:15 | 000,000,000 | ---D | C] -- C:\Users\Cydnie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2011/05/20 07:45:03 | 000,000,000 | ---D | C] -- C:\Users\Cydnie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2011/05/20 07:42:15 | 000,000,000 | ---D | C] -- C:\Users\Cydnie\AppData\Local\Google
[2011/05/20 07:41:37 | 000,000,000 | ---D | C] -- C:\Users\Cydnie\AppData\Local\Deployment
[2011/05/20 07:41:37 | 000,000,000 | ---D | C] -- C:\Users\Cydnie\AppData\Local\Apps
[2011/05/19 20:01:57 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2007/12/11 13:26:10 | 000,016,384 | ---- | C] ( ) -- C:\Windows\System32\ClearEvent.exe
[2007/08/15 14:51:47 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\Interop.Shell32.dll

========== Files - Modified Within 30 Days ==========

[2011/06/14 22:20:00 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{D2E09563-F1B7-4B0D-A354-8A6A22574F57}.job
[2011/06/14 21:57:09 | 000,038,688 | ---- | M] () -- C:\Users\Cydnie\Desktop\RK_Report
[2011/06/14 21:54:40 | 000,631,848 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/06/14 21:54:40 | 000,108,626 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/06/14 21:49:47 | 000,003,472 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/06/14 21:49:47 | 000,003,472 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/06/14 21:49:29 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/06/14 21:49:13 | 1063,706,624 | -HS- | M] () -- C:\hiberfil.sys
[2011/06/14 21:11:12 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Cydnie\Desktop\OTL.exe
[2011/06/14 21:10:48 | 000,139,264 | ---- | M] () -- C:\Users\Cydnie\Desktop\RKUnhookerLE.EXE
[2011/06/12 17:47:06 | 000,000,912 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3002486612-2040308753-4284617920-1000UA.job
[2011/06/12 14:03:43 | 222,558,897 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011/06/06 19:53:48 | 000,000,910 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/06 19:39:33 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/06/03 23:29:37 | 000,004,705 | ---- | M] () -- C:\Users\Cydnie\Desktop\Attach.zip
[2011/06/03 23:20:01 | 000,001,858 | ---- | M] () -- C:\Users\Public\Desktop\WinZip.lnk
[2011/06/03 22:33:09 | 000,000,000 | ---- | M] () -- C:\Users\Cydnie\defogger_reenable
[2011/06/03 22:23:22 | 000,050,477 | ---- | M] () -- C:\Users\Cydnie\Desktop\Defogger.exe
[2011/06/03 21:51:43 | 000,002,525 | ---- | M] () -- C:\Users\Cydnie\Desktop\HiJackThis.lnk
[2011/06/02 20:36:30 | 000,302,592 | ---- | M] () -- C:\Users\Cydnie\Desktop\bjqc6lnr.exe
[2011/06/02 06:27:59 | 000,607,294 | R--- | M] (Swearware) -- C:\Users\Cydnie\Desktop\dds.scr
[2011/05/29 17:16:32 | 001,392,640 | ---- | M] () -- C:\Windows\ocsetup_install_MicrosoftWindowsPowerShell.etl
[2011/05/29 17:16:32 | 000,032,768 | ---- | M] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.perf
[2011/05/29 17:16:32 | 000,032,768 | ---- | M] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.dpx
[2011/05/29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/05/29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011/05/28 13:25:17 | 000,002,051 | ---- | M] () -- C:\Users\Cydnie\Desktop\Google Chrome.lnk
[2011/05/28 13:25:17 | 000,002,013 | ---- | M] () -- C:\Users\Cydnie\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/05/20 07:47:01 | 000,000,860 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3002486612-2040308753-4284617920-1000Core.job

========== Files Created - No Company Name ==========

[2011/06/14 21:57:09 | 000,038,688 | ---- | C] () -- C:\Users\Cydnie\Desktop\RK_Report
[2011/06/14 21:15:31 | 000,139,264 | ---- | C] () -- C:\Users\Cydnie\Desktop\RKUnhookerLE.EXE
[2011/06/14 20:54:23 | 000,001,975 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
[2011/06/14 20:54:21 | 000,002,140 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Kodak software updater.lnk
[2011/06/12 14:02:55 | 222,558,897 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2011/06/03 23:29:37 | 000,004,705 | ---- | C] () -- C:\Users\Cydnie\Desktop\Attach.zip
[2011/06/03 23:20:01 | 000,001,858 | ---- | C] () -- C:\Users\Public\Desktop\WinZip.lnk
[2011/06/03 22:34:41 | 000,050,477 | ---- | C] () -- C:\Users\Cydnie\Desktop\Defogger.exe
[2011/06/03 22:34:28 | 000,302,592 | ---- | C] () -- C:\Users\Cydnie\Desktop\bjqc6lnr.exe
[2011/06/03 22:33:09 | 000,000,000 | ---- | C] () -- C:\Users\Cydnie\defogger_reenable
[2011/05/30 15:11:09 | 1063,706,624 | -HS- | C] () -- C:\hiberfil.sys
[2011/05/29 17:15:37 | 000,032,768 | ---- | C] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.perf
[2011/05/29 17:15:37 | 000,032,768 | ---- | C] () -- C:\Windows\ocsetup_cbs_install_MicrosoftWindowsPowerShell.dpx
[2011/05/29 17:15:36 | 001,392,640 | ---- | C] () -- C:\Windows\ocsetup_install_MicrosoftWindowsPowerShell.etl
[2011/05/20 07:51:15 | 000,002,525 | ---- | C] () -- C:\Users\Cydnie\Desktop\HiJackThis.lnk
[2011/05/20 07:45:10 | 000,002,051 | ---- | C] () -- C:\Users\Cydnie\Desktop\Google Chrome.lnk
[2011/05/20 07:45:10 | 000,002,013 | ---- | C] () -- C:\Users\Cydnie\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/05/20 07:42:22 | 000,000,912 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3002486612-2040308753-4284617920-1000UA.job
[2011/05/20 07:42:21 | 000,000,860 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3002486612-2040308753-4284617920-1000Core.job
[2010/06/29 21:17:27 | 000,000,000 | ---- | C] () -- C:\Windows\WinInit.ini
[2008/12/20 10:00:31 | 000,031,007 | ---- | C] () -- C:\Users\Cydnie\AppData\Roaming\UserTile.png
[2008/11/17 05:57:49 | 000,000,552 | ---- | C] () -- C:\Users\Cydnie\AppData\Local\d3d8caps.dat
[2008/08/22 10:28:56 | 000,000,680 | ---- | C] () -- C:\Users\Cydnie\AppData\Local\d3d9caps.dat
[2008/05/05 09:10:07 | 000,000,000 | ---- | C] () -- C:\Windows\setup32.INI
[2008/05/05 08:47:46 | 000,000,515 | ---- | C] () -- C:\Windows\EReg077.dat
[2008/05/05 08:46:06 | 000,000,353 | ---- | C] () -- C:\Windows\TLCAPPS.INI
[2008/05/04 10:07:12 | 000,004,608 | ---- | C] () -- C:\Users\Cydnie\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/12/11 13:47:30 | 000,910,304 | ---- | C] () -- C:\Windows\System32\igmedkrn.dll
[2007/12/11 13:47:30 | 000,249,856 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2007/12/11 13:47:30 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1244.dll
[2007/12/11 13:26:10 | 000,016,384 | ---- | C] () -- C:\Windows\System32\LauncheRyAgentUser.exe
[2007/12/11 13:25:46 | 000,076,584 | ---- | C] () -- C:\Windows\System32\drivers\int15.sys
[2007/12/11 13:25:46 | 000,015,656 | ---- | C] () -- C:\Windows\System32\drivers\int15_64.sys
[2007/12/11 13:25:09 | 000,065,536 | ---- | C] () -- C:\Windows\System32\NATTraversal.dll
[2007/08/15 17:32:01 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN4.dll
[2007/08/15 14:51:42 | 000,331,776 | ---- | C] () -- C:\Windows\System32\ScrollBarLib.dll
[2007/08/04 02:27:40 | 000,001,132 | ---- | C] () -- C:\Windows\RtDefLvl.ini
[2007/08/04 02:27:40 | 000,000,008 | ---- | C] () -- C:\Windows\System32\drivers\RtkHDAud.dat
[2007/08/04 01:46:38 | 000,872,448 | ---- | C] () -- C:\Windows\iconv.dll
[2007/08/04 01:46:37 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2007/08/04 01:46:37 | 000,743,424 | ---- | C] () -- C:\Windows\libxml2.dll
[2007/08/04 01:46:37 | 000,000,042 | ---- | C] () -- C:\Windows\PreLaunch.ini
[2007/04/25 18:33:22 | 000,266,240 | ---- | C] () -- C:\Windows\System32\NotesExtmngr.dll
[2007/04/25 18:32:50 | 000,204,800 | ---- | C] () -- C:\Windows\System32\NotesActnMenu.dll
[2007/04/25 18:32:46 | 000,086,016 | ---- | C] () -- C:\Windows\System32\MSNSpook.dll
[2007/04/25 18:31:00 | 000,028,672 | ---- | C] () -- C:\Windows\System32\BatchCrypto.dll
[2007/04/25 18:30:52 | 000,073,728 | ---- | C] () -- C:\Windows\System32\APISlice.dll
[2007/04/25 18:30:44 | 000,063,488 | ---- | C] () -- C:\Windows\System32\ShowErrMsg.dll
[2006/12/25 17:44:48 | 000,022,016 | ---- | C] () -- C:\Windows\System32\MailFormat_U.dll
[2006/11/13 07:50:06 | 000,071,680 | ---- | C] () -- C:\Windows\System32\HTCA_SelfExtract.bin
[2006/11/02 06:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 06:47:37 | 000,297,240 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 06:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 04:33:01 | 000,631,848 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 04:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 04:33:01 | 000,108,626 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 04:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 04:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 02:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 02:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 01:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 01:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006/11/02 01:22:43 | 000,099,999 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2006/11/02 01:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2004/05/19 12:33:44 | 000,053,248 | ---- | C] () -- C:\Windows\System32\pxhpinst.exe
[2001/12/26 17:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll
[2001/09/04 00:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll
[2001/07/30 17:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll
[2001/07/23 23:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:A95A95AC
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:131C0EE9
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:0A73A758
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:9F683177
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:B623B5B8
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:7B212553
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:AA9519A6
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:B203B914
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:798A3728
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:94188BC6

< End of report >

OTL Extras logfile created on: 6/14/2011 10:08:26 PM - Run 1
OTL by OldTimer - Version 3.2.24.0 Folder = C:\Users\Cydnie\Desktop
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16982)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1013.81 Mb Total Physical Memory | 182.86 Mb Available Physical Memory | 18.04% Memory free
2.23 Gb Paging File | 0.81 Gb Available in Paging File | 36.30% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 51.01 Gb Total Space | 25.01 Gb Free Space | 49.02% Space Free | Partition Type: NTFS
Drive D: | 51.01 Gb Total Space | 50.92 Gb Free Space | 99.82% Space Free | Partition Type: NTFS

Computer Name: CYDNIE-PC | User Name: Cydnie | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 1
"InternetSettingsDisableNotify" = 1
"AutoUpdateDisableNotify" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{57B99C8C-B70A-4AD1-BD17-75E0F97D14AA}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{779AE2FF-24B9-4646-A7AE-F349F37E7FB6}" = dir=in | app=c:\program files\acer arcade deluxe\dvdivine\dvdivine.exe |
"{87C48522-5A06-4330-BF61-D6708D6E8FEE}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{A836040F-F9AF-4920-8666-6BBE0976C6AC}" = dir=in | app=c:\program files\acer arcade deluxe\play movie\playmovie.exe |
"{A938958D-0AAA-4D1D-AE23-76587650AD73}" = dir=in | app=c:\program files\acer arcade deluxe\dv wizard\dv wizard.exe |
"{B6FAE6BB-C1A3-4AEC-9185-BDA38CE3A841}" = dir=in | app=c:\program files\acer arcade deluxe\homemedia\homemedia.exe |
"{C829FFB0-A0B6-4821-A5BF-4D8A4D25A580}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{CFEFF2A4-44D4-4204-AFBE-C39A80A8AE1A}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{D25D070A-1D20-4167-826A-3BB83A662548}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{E4733464-8C5B-407C-81E2-EEED7B141C7D}" = dir=in | app=c:\program files\acer arcade deluxe\play movie\pmvservice.exe |
"{EA1999E4-A2D4-4A87-96A9-F7D977EBFC3C}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{F1F5DDBF-6436-4DD4-97F6-4A207C2C7894}" = dir=in | app=c:\program files\acer arcade deluxe\acer arcade deluxe\acer arcade deluxe.exe |
"{F930D9A8-250B-4E3F-8E07-1F7864FCAD16}" = dir=in | app=c:\program files\acer arcade deluxe\videomagician\videomagician.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{116FF17B-1A30-4FC2-9B01-5BC5BD46B0B3}" = Acer eLock Management
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP3500_series" = Canon iP3500 series
"{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"{1598034D-7147-432C-8CA8-888E0632D124}" = NTI Backup NOW! 4.7
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{7641FD7D-E94E-424E-A95C-0593C84DC0C0}" = VZAccess Manager
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{7B2ADCB5-3F3D-478A-90A9-A8C04EF82BF6}" = Mobile Broadband Generic Drivers
"{81063354-9060-42B2-A000-1EBE96778AA9}" = iTunes
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110111700}" = Zuma Deluxe
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11029123}" = Bricks of Egypt
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111263673}" = Treasures of the Deep
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111271497}" = Mystery Case Files - Prime Suspects
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111307457}" = Galapago
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111310630}" = Big Kahuna Reef 2
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111473353}" = Dynasty
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11170417}" = Luxor 2
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111771833}" = Jewel Quest Solitaire
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112179547}" = Mystery Case Files Ravenhearst
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{94389919-B0AA-4882-9BE8-9F0B004ECA35}" = Acer Tour
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology
"{AC76BA86-7AD7-1033-7B44-A81000000003}" = Adobe Reader 8.1.0
"{AEEAE013-92F1-4515-B278-139F1A692A36}" = Acer eDataSecurity Management
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer 3.72
"{BF839132-BD43-4056-ACBF-4377F4A88E2A}" = Acer ePresentation Management
"{C06554A1-2C1E-4D20-B613-EE62C79927CC}" = Acer eNet Management
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240C2}" = WinZip 15.5
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe 1.4.142.1
"{CE65A9A0-9686-45C6-9098-3C9543A412F0}" = Acer eSettings Management
"{EFBDC2B0-FAA8-4B78-8DE1-AEBE7958FA37}" = Acer Arcade Deluxe
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"Acer Assist" = Acer Assist
"Acer Registration" = Acer Registration
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Belarc Advisor" = Belarc Advisor 8.1
"Canon iP3500 series User Registration" = Canon iP3500 series User Registration
"CANONIJPLM100" = PIXMA Extended Survey Program
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"CCleaner" = CCleaner
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFAOR2C06_118" = HDAUDIO Soft Data Fax Modem with SmartCP
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"GridVista" = Acer GridVista
"HDMI" = Intel® Graphics Media Accelerator Driver
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"Imj32.exe" = Reader Rabbit presents Math Journey for Grades 1-3
"InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"InstallShield_{1598034D-7147-432C-8CA8-888E0632D124}" = NTI Backup NOW! 4.7
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.0.1200
"Mobile Broadband Generic Drivers" = Mobile Broadband Generic Drivers
"NIS" = Norton Internet Security
"Reader Rabbit's® Math Ages 6 - 9" = Reader Rabbit's® Math Ages 6 - 9
"rr2gw32.exe" = Reader Rabbit's 2nd Grade
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Toolbar" = Yahoo! Toolbar

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-3002486612-2040308753-4284617920-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 6/14/2011 11:53:04 PM | Computer Name = Cydnie-PC | Source = Windows Search Service | ID = 3031
Description =

Error - 6/14/2011 11:53:04 PM | Computer Name = Cydnie-PC | Source = Windows Search Service | ID = 3031
Description =

Error - 6/14/2011 11:53:04 PM | Computer Name = Cydnie-PC | Source = Windows Search Service | ID = 3031
Description =

Error - 6/14/2011 11:53:04 PM | Computer Name = Cydnie-PC | Source = Windows Search Service | ID = 3031
Description =

Error - 6/14/2011 11:54:35 PM | Computer Name = Cydnie-PC | Source = LoadPerf | ID = 3012
Description =

Error - 6/14/2011 11:54:35 PM | Computer Name = Cydnie-PC | Source = LoadPerf | ID = 3011
Description =

Error - 6/14/2011 11:57:10 PM | Computer Name = Cydnie-PC | Source = Windows Search Service | ID = 3031
Description =

Error - 6/14/2011 11:57:10 PM | Computer Name = Cydnie-PC | Source = Windows Search Service | ID = 3031
Description =

Error - 6/14/2011 11:57:10 PM | Computer Name = Cydnie-PC | Source = Windows Search Service | ID = 3031
Description =

Error - 6/15/2011 12:24:28 AM | Computer Name = Cydnie-PC | Source = Windows Search Service | ID = 3031
Description =

[ Media Center Events ]
Error - 4/28/2011 7:48:46 PM | Computer Name = Cydnie-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 4/29/2011 7:34:23 PM | Computer Name = Cydnie-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 4/30/2011 1:40:29 PM | Computer Name = Cydnie-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 5/8/2011 11:01:46 PM | Computer Name = Cydnie-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 5/14/2011 9:19:05 PM | Computer Name = Cydnie-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 5/16/2011 12:35:05 AM | Computer Name = Cydnie-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 5/20/2011 10:40:12 AM | Computer Name = Cydnie-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 5/23/2011 3:32:48 PM | Computer Name = Cydnie-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 5/24/2011 11:26:26 PM | Computer Name = Cydnie-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 5/29/2011 1:09:31 PM | Computer Name = Cydnie-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ System Events ]
Error - 6/12/2011 5:33:10 PM | Computer Name = Cydnie-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 6/12/2011 8:01:56 PM | Computer Name = Cydnie-PC | Source = DCOM | ID = 10010
Description =

Error - 6/12/2011 8:04:37 PM | Computer Name = Cydnie-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 6/12/2011 8:09:58 PM | Computer Name = Cydnie-PC | Source = DCOM | ID = 10010
Description =

Error - 6/14/2011 10:52:28 PM | Computer Name = Cydnie-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 6/14/2011 10:55:32 PM | Computer Name = Cydnie-PC | Source = DCOM | ID = 10010
Description =

Error - 6/14/2011 10:58:43 PM | Computer Name = Cydnie-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 6/14/2011 11:49:38 PM | Computer Name = Cydnie-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 9:47:22 PM on 6/14/2011 was unexpected.

Error - 6/14/2011 11:50:02 PM | Computer Name = Cydnie-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 6/15/2011 12:17:35 AM | Computer Name = Cydnie-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =


< End of report >

Thanks for your help,
~Ron

#4 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:02:40 AM

Posted 15 June 2011 - 02:51 PM

Hi Ron!

I'm posting this from another computer for two reasons. First, when I had went to bleepingcomputer.com on the computer I'm having trouble with, to read the post and get the downloads suggested, I was notified of a survey I could take and win a gift (I didn't bite). When I tried to go back a page I was redirected to another site. So, I had to use another computer to download the two programs I needed to use to scan my computer.

Okay. Thanks for that information.

I can see that your host files appears to be infected which is why you've been experiencing issues with redirects.

We'll fix that up shortly, and then run another tool to see what it finds.

Please be sure to let me know how things are running in your next reply.

OTL Fix

We need to run an OTL Fix
  • Please reopen Posted Image on your desktop.
  • Copy and Paste the following code into the Posted Image textbox.
    :Services
    :OTL
    IE - HKU\S-1-5-21-3002486612-2040308753-4284617920-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:25426
    O1 - Hosts: 74.50.127.5 www.google.com
    O1 - Hosts: 74.50.127.5 www.google.com.au
    O1 - Hosts: 74.50.127.5 www.google.be
    O1 - Hosts: 74.50.127.5 www.google.com.br
    O1 - Hosts: 74.50.127.5 www.google.ca
    O1 - Hosts: 74.50.127.5 www.google.ch
    O1 - Hosts: 74.50.127.5 www.google.de
    O1 - Hosts: 74.50.127.5 www.google.dk
    O1 - Hosts: 74.50.127.5 www.google.fr
    O1 - Hosts: 74.50.127.5 www.google.ie
    O1 - Hosts: 74.50.127.5 www.google.it
    O1 - Hosts: 74.50.127.5 www.google.co.jp
    O1 - Hosts: 74.50.127.5 www.google.nl
    O1 - Hosts: 74.50.127.5 www.google.no
    O1 - Hosts: 74.50.127.5 www.google.co.nz
    O1 - Hosts: 74.50.127.5 www.google.pl
    O1 - Hosts: 74.50.127.5 www.google.se
    O1 - Hosts: 74.50.127.5 www.google.co.uk
    O1 - Hosts: 74.50.127.5 www.google.co.za
    O1 - Hosts: 74.50.127.5 www.bing.com
    O1 - Hosts: 74.50.127.5 search.yahoo.com
    O1 - Hosts: 74.50.127.5 uk.search.yahoo.com
    O1 - Hosts: 74.50.127.5 ca.search.yahoo.com
    O1 - Hosts: 4 more lines...
    O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - No CLSID value found.
    O4 - HKLM..\Run: [Acer Tour] File not found
    O4 - HKLM..\Run: [eRecoveryService] File not found
    O4 - HKU\S-1-5-21-3002486612-2040308753-4284617920-1000..\Run: [Acer Tour Reminder] File not found
    O7 - HKU\S-1-5-21-3002486612-2040308753-4284617920-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisallowRun = 1
    O33 - MountPoints2\{9e199780-1925-11df-95fa-001d720eac3b}\Shell - "" = AutoRun
    O33 - MountPoints2\{9e199780-1925-11df-95fa-001d720eac3b}\Shell\AutoRun\command - "" = F:\VZAccess_Manager.exe /z detect
    O33 - MountPoints2\{9e1997d3-1925-11df-95fa-001d720eac3b}\Shell - "" = AutoRun
    O33 - MountPoints2\{9e1997d3-1925-11df-95fa-001d720eac3b}\Shell\AutoRun\command - "" = H:\VZAccess_Manager.exe /z detect
    O33 - MountPoints2\G\Shell - "" = AutoRun
    O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\VZAccess_Manager.exe /z detect
    O33 - MountPoints2\H\Shell - "" = AutoRun
    O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\VZAccess_Manager.exe /z detect
    @Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:A95A95AC
    @Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:131C0EE9
    @Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:0A73A758
    @Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:9F683177
    @Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:B623B5B8
    @Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:7B212553
    @Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:AA9519A6
    @Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:B203B914
    @Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:798A3728
    @Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:94188BC6
    
    :Reg
    
    :Files
    ipconfig /flushdns /c
    :Commands
    [purity]
    [resethosts]
    [CreateRestorePoint]
    
  • Push Posted Image
  • OTL may ask to reboot the machine. Please do so if asked.
  • Click the OK button.
  • A report will open. Copy and Paste that report in your next reply.
  • If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.


NEXT:



Running ComboFix
Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
  • IMPORTANT - Disable your Anti-Virus and Anti-Spyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

    Note: If AVG or CA Internet Security Suite is installed, you must remove these programs before using Combofix. If for some reason these applications will not uninstall, try uninstalling with AppRemover by Opswat.
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the ComboFix log in your next reply as well as describe how your computer is running now

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#5 RonT38

RonT38
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:40 PM

Posted 16 June 2011 - 09:25 PM

Hey SweetTech,
I was excited to see your reply. Excited because I can see there is a fix for the problem I'm experiencing.

I opened OTL and pasted the script into Custom Scans/Fixes. I clicked Run Fix and when it started I got an error message saying that it couldn't create a Google folder in a certain location (sorry, I didn't write down the error message before I clicked Ok). Now it seems to be frozen. The status bar reads, "Processing 01 - Hosts: 74.50.127.5 www.google.com" and it's been that way for about 15 to 20 minutes.

I'm thinking maybe I shouldn't have clicked Ok on the error message, or did something else happen? I won't do anything until I hear back from you.

Thanks for your help,
~Ron

#6 RonT38

RonT38
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:40 PM

Posted 17 June 2011 - 06:38 AM

This is a correction to what the error message actually stated (it had nothing to do with making a Google folder). This morning, I found that the computer restarted on it's own and I figured it had completed the scan, but it hadn't (I checked the log and it was blank). It restarted because of a Windows update, so I ran the OTL scan again, and got the same error message as before. Here is the correct message:
OTL [Error Message]
Cannot create file C:\Windows\System32\drivers\etc\Hosts

I apologize for the confusion. My wife gets after me for my bad memory, I know I should have probably rescanned and checked before posting the earlier message, but I was worried that the computer might not have actually frozen and the OTL scan was actually running (which it wasn't).

~Ron

#7 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:02:40 AM

Posted 17 June 2011 - 09:37 AM

Hi Ron!

No worries! Please try performing these instructions instead.

OTL Fix

We need to run an OTL Fix
  • Please reopen Posted Image on your desktop.
  • Copy and Paste the following code into the Posted Image textbox.
    :Services
    :OTL
    IE - HKU\S-1-5-21-3002486612-2040308753-4284617920-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:25426
    O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - No CLSID value found.
    O4 - HKLM..\Run: [Acer Tour] File not found
    O4 - HKLM..\Run: [eRecoveryService] File not found
    O4 - HKU\S-1-5-21-3002486612-2040308753-4284617920-1000..\Run: [Acer Tour Reminder] File not found
    O7 - HKU\S-1-5-21-3002486612-2040308753-4284617920-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisallowRun = 1
    O33 - MountPoints2\{9e199780-1925-11df-95fa-001d720eac3b}\Shell - "" = AutoRun
    O33 - MountPoints2\{9e199780-1925-11df-95fa-001d720eac3b}\Shell\AutoRun\command - "" = F:\VZAccess_Manager.exe /z detect
    O33 - MountPoints2\{9e1997d3-1925-11df-95fa-001d720eac3b}\Shell - "" = AutoRun
    O33 - MountPoints2\{9e1997d3-1925-11df-95fa-001d720eac3b}\Shell\AutoRun\command - "" = H:\VZAccess_Manager.exe /z detect
    O33 - MountPoints2\G\Shell - "" = AutoRun
    O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\VZAccess_Manager.exe /z detect
    O33 - MountPoints2\H\Shell - "" = AutoRun
    O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\VZAccess_Manager.exe /z detect
    @Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:A95A95AC
    @Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:131C0EE9
    @Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:0A73A758
    @Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:9F683177
    @Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:B623B5B8
    @Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:7B212553
    @Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:AA9519A6
    @Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:B203B914
    @Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:798A3728
    @Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:94188BC6
    
    :Reg
    
    :Files
    echo,Y|cacls "%WinDir%\system32\drivers\etc\hosts" /G everyone:f /c
    ipconfig /flushdns /c
    :Commands
    [purity]
    [resethosts]
    [CreateRestorePoint]
    
  • Push Posted Image
  • OTL may ask to reboot the machine. Please do so if asked.
  • Click the OK button.
  • A report will open. Copy and Paste that report in your next reply.
  • If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.


NEXT:



Running ComboFix
Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
  • IMPORTANT - Disable your Anti-Virus and Anti-Spyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

    Note: If AVG or CA Internet Security Suite is installed, you must remove these programs before using Combofix. If for some reason these applications will not uninstall, try uninstalling with AppRemover by Opswat.
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the ComboFix log in your next reply as well as describe how your computer is running now

Edited by SweetTech, 17 June 2011 - 09:37 AM.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#8 RonT38

RonT38
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:40 PM

Posted 17 June 2011 - 01:26 PM

Hi SweetTech,
Thanks for the revised OTL code, I was able to run it. I had a problem with ComboFix, though. I'll relate that problem at the end of the OTL log.

Here is the OTL log:
========== SERVICES/DRIVERS ==========
========== OTL ==========
HKU\S-1-5-21-3002486612-2040308753-4284617920-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Acer Tour deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\eRecoveryService deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3002486612-2040308753-4284617920-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Acer Tour Reminder deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3002486612-2040308753-4284617920-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\DisallowRun deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e199780-1925-11df-95fa-001d720eac3b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9e199780-1925-11df-95fa-001d720eac3b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e199780-1925-11df-95fa-001d720eac3b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9e199780-1925-11df-95fa-001d720eac3b}\ not found.
File F:\VZAccess_Manager.exe /z detect not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e1997d3-1925-11df-95fa-001d720eac3b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9e1997d3-1925-11df-95fa-001d720eac3b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e1997d3-1925-11df-95fa-001d720eac3b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9e1997d3-1925-11df-95fa-001d720eac3b}\ not found.
File H:\VZAccess_Manager.exe /z detect not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ not found.
File G:\VZAccess_Manager.exe /z detect not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H\ not found.
File H:\VZAccess_Manager.exe /z detect not found.
ADS C:\ProgramData\TEMP:A95A95AC deleted successfully.
ADS C:\ProgramData\TEMP:131C0EE9 deleted successfully.
ADS C:\ProgramData\TEMP:0A73A758 deleted successfully.
ADS C:\ProgramData\TEMP:9F683177 deleted successfully.
ADS C:\ProgramData\TEMP:B623B5B8 deleted successfully.
ADS C:\ProgramData\TEMP:7B212553 deleted successfully.
ADS C:\ProgramData\TEMP:AA9519A6 deleted successfully.
ADS C:\ProgramData\TEMP:B203B914 deleted successfully.
ADS C:\ProgramData\TEMP:798A3728 deleted successfully.
ADS C:\ProgramData\TEMP:94188BC6 deleted successfully.
========== REGISTRY ==========
========== FILES ==========
< echo,Y|cacls "%WinDir%\system32\drivers\etc\hosts" /G everyone:f /c >
Are you sure (Y/N)?processed file: C:\Windows\system32\drivers\etc\hosts
C:\Users\Cydnie\Desktop\cmd.bat deleted successfully.
C:\Users\Cydnie\Desktop\cmd.txt deleted successfully.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Cydnie\Desktop\cmd.bat deleted successfully.
C:\Users\Cydnie\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully


OTL by OldTimer - Version 3.2.24.0 log created on 06172011_114132

When I ran ComboFix, the first thing that happened was I was given a notice that a newer version of ComboFix was available and did I want to download it. I clicked "Yes".

The newer version installed and started, and then I got a Windows error message:
pev.cfxxe has stopped working
A problem caused the program to stop working correctly. Windows will close the program and notify you is a solution is available.
I clicked OK.

After a brief period, I got another notice that a newer version of ComboFix was available and did I want to install. I clicked "Yes", again. ComboFix downloaded and while it was extracting files I got another error message:

Error opening file for writing:
C\32788R22FW\License\iexplore.exe
Click Abort to stop the installation,
Retry to try again, or
Ignore to skip this file.

I clicked Retry a few times and nothing happened. What should I do next?
Thanks,
~Ron

#9 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:02:40 AM

Posted 17 June 2011 - 01:44 PM

Ron,

Can you please be sure that you've disabled your Security Programs and try to run it again. If it still gives you issues, try running it in Safe mode.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#10 RonT38

RonT38
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:40 PM

Posted 17 June 2011 - 06:22 PM

Yay! You're awesome, SweetTech!

I forgot to mention in other reply that I had disabled the security programs. This time I booted in Safe Mode and ran ComboFix. There were a couple of instances where it said "Access Denied...need an Administrator account...", but it did complete the scan and create a log, which I'll attach below. I heard a noticeable decrease in fan speed as soon as the infected files were deleted.

After the log was created, I rebooted the machine in Normal mode and it seemed to boot properly. Again, I noticed a distinct decrease in the usual fan speed, which to me was an indication that it wasn't maxing out the resources. The only problem I see now happened when I tried to open Task Manager. When I pressed ctrl alt delete, I got this message - "Logon process has failed to create the security options dialog" and Task Manager didn't open.

I'm sending this reply with the previously infected Acer Aspire! Here's the OTL log created previously and the newly created ComboFix Log:

========== SERVICES/DRIVERS ==========
========== OTL ==========
HKU\S-1-5-21-3002486612-2040308753-4284617920-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Acer Tour deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\eRecoveryService deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3002486612-2040308753-4284617920-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Acer Tour Reminder deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3002486612-2040308753-4284617920-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\DisallowRun deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e199780-1925-11df-95fa-001d720eac3b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9e199780-1925-11df-95fa-001d720eac3b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e199780-1925-11df-95fa-001d720eac3b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9e199780-1925-11df-95fa-001d720eac3b}\ not found.
File F:\VZAccess_Manager.exe /z detect not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e1997d3-1925-11df-95fa-001d720eac3b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9e1997d3-1925-11df-95fa-001d720eac3b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e1997d3-1925-11df-95fa-001d720eac3b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9e1997d3-1925-11df-95fa-001d720eac3b}\ not found.
File H:\VZAccess_Manager.exe /z detect not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ not found.
File G:\VZAccess_Manager.exe /z detect not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H\ not found.
File H:\VZAccess_Manager.exe /z detect not found.
ADS C:\ProgramData\TEMP:A95A95AC deleted successfully.
ADS C:\ProgramData\TEMP:131C0EE9 deleted successfully.
ADS C:\ProgramData\TEMP:0A73A758 deleted successfully.
ADS C:\ProgramData\TEMP:9F683177 deleted successfully.
ADS C:\ProgramData\TEMP:B623B5B8 deleted successfully.
ADS C:\ProgramData\TEMP:7B212553 deleted successfully.
ADS C:\ProgramData\TEMP:AA9519A6 deleted successfully.
ADS C:\ProgramData\TEMP:B203B914 deleted successfully.
ADS C:\ProgramData\TEMP:798A3728 deleted successfully.
ADS C:\ProgramData\TEMP:94188BC6 deleted successfully.
========== REGISTRY ==========
========== FILES ==========
< echo,Y|cacls "%WinDir%\system32\drivers\etc\hosts" /G everyone:f /c >
Are you sure (Y/N)?processed file: C:\Windows\system32\drivers\etc\hosts
C:\Users\Cydnie\Desktop\cmd.bat deleted successfully.
C:\Users\Cydnie\Desktop\cmd.txt deleted successfully.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Cydnie\Desktop\cmd.bat deleted successfully.
C:\Users\Cydnie\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully


OTL by OldTimer - Version 3.2.24.0 log created on 06172011_114132

ComboFix 11-06-17.02 - Cydnie 06/17/2011 16:14:57.1.1 - x86 MINIMAL
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.1014.733 [GMT -6:00]
Running from: c:\users\Cydnie\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\42fafa
c:\programdata\42fafa\070f4753a604f199f192fd0174f1f195.ocx
c:\programdata\42fafa\1353.mof
c:\programdata\42fafa\4e15bf5f84368bf3443f10c2ce298e75.ocx
c:\programdata\42fafa\BackUp\Empowering Technology Launcher.lnk
c:\programdata\42fafa\BMP.ico
c:\programdata\42fafa\krvq01u8z6ai8z6wdm9q0gi45e7tm9q01ufngzjd5e7tm9qw.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\ANTIGEN.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\ANTIGEN.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\ANTIGEN.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\ANTIGEN.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\ANTIGEN.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\cb.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\cb.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\cb.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\cb.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\cb.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\cid.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\cid.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\cid.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\cid.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\cid.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\CLSV.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\CLSV.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\CLSV.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\CLSV.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\CLSV.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\DBOLE.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\DBOLE.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\DBOLE.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\DBOLE.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\DBOLE.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\ddv.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\ddv.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\ddv.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\ddv.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\ddv.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\delfile.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\delfile.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\delfile.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\dudl.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\dudl.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\dudl.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\dudl.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\eb.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\eb.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\eb.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\eb.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\eb.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\energy.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\energy.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\energy.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\energy.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\energy.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\exec.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\exec.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\exec.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\exec.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\exec.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\fan.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\fan.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\fan.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\fan.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\fan.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\fix.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\fix.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\fix.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\fix.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\FS.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\FS.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\FS.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\FS.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\FS.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\FW.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\FW.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\FW.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\FW.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\gid.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\gid.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\gid.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\gid.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\grid.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\grid.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\grid.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\grid.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\grid.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\hymt.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\hymt.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\hymt.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\hymt.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\hymt.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\kernel32.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\kernel32.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\kernel32.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\kernel32.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\kernel32.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\pal.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\pal.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\pal.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\pal.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\pal.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\PE.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\PE.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\PE.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\PE.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\PE.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\ppal.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\ppal.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\ppal.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\ppal.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\ppal.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\runddl.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\runddl.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\runddl.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\runddl.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\runddl.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\runddlkey.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\runddlkey.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\runddlkey.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\runddlkey.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\runddlkey.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\SICKBOY.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\SICKBOY.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\SICKBOY.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\SICKBOY.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\SICKBOY.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\sld.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\sld.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\sld.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\sld.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\sld.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\SM.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\SM.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\SM.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\SM.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\snl2w.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\snl2w.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\snl2w.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\snl2w.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\std.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\std.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\std.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\std.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\tempdoc.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\tempdoc.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\tempdoc.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\tempdoc.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\tempdoc.tmp
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\tjd.dll
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\tjd.drv
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\tjd.exe
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\tjd.sys
c:\users\Cydnie\AppData\Roaming\Microsoft\Windows\Recent\tjd.tmp
c:\users\Cydnie\Favorites\ehthumbs_vista.db
.
.
((((((((((((((((((((((((( Files Created from 2011-05-17 to 2011-06-17 )))))))))))))))))))))))))))))))
.
.
2011-06-17 17:51 . 2011-06-17 22:13 -------- d-----w- C:\32788R22FWJFW
2011-06-17 02:03 . 2011-06-17 02:03 -------- d-----w- C:\_OTL
2011-06-12 20:42 . 2007-06-27 02:21 1984512 ----a-w- c:\windows\system32\authui.dll
2011-06-12 20:42 . 2007-06-26 02:51 220160 ----a-w- c:\windows\system32\ntprint.dll
2011-06-12 20:41 . 2007-07-13 02:20 8138240 ----a-w- c:\windows\system32\ssBranded.scr
2011-06-12 20:41 . 2007-05-24 02:25 69632 ----a-w- c:\windows\system32\sendmail.dll
2011-06-12 20:41 . 2007-06-26 02:49 120320 ----a-w- c:\windows\system32\dhcpcsvc6.dll
2011-06-12 20:41 . 2007-06-26 02:49 10240 ----a-w- c:\windows\system32\dhcpcmonitor.dll
2011-06-12 20:41 . 2007-06-26 02:21 61440 ----a-w- c:\windows\system32\ntprint.exe
2011-06-07 01:39 . 2011-06-07 01:39 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-04 05:14 . 2011-06-04 05:23 -------- d-----w- c:\programdata\WinZip
2011-06-04 03:59 . 2010-02-20 23:54 24064 ----a-w- c:\windows\system32\nshhttp.dll
2011-06-04 03:58 . 2010-02-20 23:51 31232 ----a-w- c:\windows\system32\httpapi.dll
2011-06-04 03:58 . 2010-02-20 21:30 396800 ----a-w- c:\windows\system32\drivers\http.sys
2011-05-30 02:36 . 2011-05-30 02:36 -------- d-----w- C:\perflogs
2011-05-30 01:16 . 2011-05-30 01:16 -------- d-----w- c:\users\Cydnie\AppData\Local\ElevatedDiagnostics
2011-05-29 23:32 . 2010-02-23 13:14 211968 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-05-29 23:32 . 2010-02-23 13:14 58368 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-05-29 23:32 . 2010-02-23 13:14 102400 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-05-29 23:31 . 2010-03-04 19:24 434176 ----a-w- c:\windows\system32\vbscript.dll
2011-05-29 23:27 . 2009-08-24 12:47 378368 ----a-w- c:\windows\system32\winhttp.dll
2011-05-29 23:14 . 2011-05-29 23:46 -------- d-----w- c:\program files\Microsoft ATS
2011-05-29 23:09 . 2010-02-18 12:05 815104 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-05-29 23:09 . 2010-02-18 14:19 179712 ----a-w- c:\windows\system32\iphlpsvc.dll
2011-05-29 23:09 . 2010-02-18 12:04 25088 ----a-w- c:\windows\system32\drivers\tunnel.sys
2011-05-29 23:09 . 2010-02-18 14:22 167424 ----a-w- c:\windows\system32\tcpipcfg.dll
2011-05-29 23:09 . 2010-02-18 12:04 22016 ----a-w- c:\windows\system32\netiougc.exe
2011-05-29 23:09 . 2010-02-18 12:04 15360 ----a-w- c:\windows\system32\drivers\TUNMP.SYS
2011-05-29 21:47 . 2010-01-21 16:02 62464 ----a-w- c:\windows\system32\l3codeca.acm
2011-05-29 21:47 . 2010-01-21 16:02 220672 ----a-w- c:\windows\system32\l3codecp.acm
2011-05-20 13:51 . 2011-05-20 13:51 388096 ----a-r- c:\users\Cydnie\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-05-20 13:51 . 2011-05-20 13:51 -------- d-----w- c:\program files\Trend Micro
2011-05-20 13:42 . 2011-05-20 13:44 -------- d-----w- c:\users\Cydnie\AppData\Local\Google
2011-05-20 13:41 . 2011-05-20 13:42 -------- d-----w- c:\users\Cydnie\AppData\Local\Deployment
2011-05-20 13:41 . 2011-05-20 13:41 -------- d-----w- c:\users\Cydnie\AppData\Local\Apps
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-29 15:11 . 2011-04-01 02:20 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-29 15:11 . 2011-04-01 02:20 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-15 18:12 . 2011-04-03 21:01 126584 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2011-03-31 03:00 . 2011-05-15 18:12 516216 ----a-w- c:\windows\system32\drivers\NIS\1206000.01D\srtsp.sys
2011-03-31 03:00 . 2011-05-15 18:12 50168 ----a-w- c:\windows\system32\drivers\NIS\1206000.01D\srtspx.sys
2011-03-22 00:39 . 2011-05-15 18:12 331384 ----a-w- c:\windows\system32\drivers\NIS\1206000.01D\symtdiv.sys
2011-03-22 00:39 . 2011-05-15 18:12 296568 ----a-w- c:\windows\system32\drivers\NIS\1206000.01D\symnets.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-02-19 1232896]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-05-25 2424192]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 174872]
"RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 4669440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-03-08 40048]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-05-09 865840]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-04-04 154392]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-26 457216]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2007-10-17 842248]
"Acer Assist Launcher"="c:\program files\Acer Assist\launcher.exe" [2007-02-02 1261568]
"Acer Product Registration"="c:\program files\Acer Registration\ACE1.exe" [2007-02-02 3383296]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-30 421888]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2007-05-24 206952]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-04-04 133912]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-02-16 141608]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-04-04 138008]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-15 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 1603152]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-05-22 151552]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2007-8-15 535336]
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [N/A]
Kodak software updater.lnk - c:\program files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20110616.003\BHDrvx86.sys [2011-05-19 810616]
R1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20110615.001\IDSvix86.sys [2011-06-03 367736]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1206000.01D\Ironx86.SYS [2011-01-27 136312]
R1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\NIS\1206000.01D\SYMTDIV.SYS [2011-03-22 331384]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl [2006-11-03 13560]
R2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe [2011-04-17 130008]
R3 BlackBox;BlackBox SR2; [x]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-05-15 105592]
R3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\DRIVERS\NwUsbCdFil.sys [2008-07-07 20480]
R3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\DRIVERS\nwusbser2.sys [2008-05-09 174336]
R3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [2009-03-21 32408]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1206000.01D\SYMDS.SYS [2011-01-27 340088]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1206000.01D\SYMEFA.SYS [2011-03-15 744568]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3002486612-2040308753-4284617920-1000Core.job
- c:\users\Cydnie\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-20 13:42]
.
2011-06-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3002486612-2040308753-4284617920-1000UA.job
- c:\users\Cydnie\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-20 13:42]
.
2011-06-17 c:\windows\Tasks\User_Feed_Synchronization-{D2E09563-F1B7-4B0D-A354-8A6A22574F57}.job
- c:\windows\system32\msfeedssync.exe [2006-11-02 09:45]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://en.us.acer.yahoo.com
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 216.129.224.49 216.220.0.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-17 16:19
Windows 6.0.6000 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\18.6.0.29\diMaster.dll\" /prefetch:1"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2011-06-17 16:20:55
ComboFix-quarantined-files.txt 2011-06-17 22:20
.
Pre-Run: 27,240,267,776 bytes free
Post-Run: 27,190,181,888 bytes free
.
- - End Of File - - ADB5E1B1B147BBE1159964F0D5F0180B

I know we're almost there. I'll wait for the next step.
A sincere "Thank You" for getting us back to this point!
~Ron

#11 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:02:40 AM

Posted 17 June 2011 - 06:51 PM

Hi Ron!

I forgot to mention in other reply that I had disabled the security programs. This time I booted in Safe Mode and ran ComboFix. There were a couple of instances where it said "Access Denied...need an Administrator account...", but it did complete the scan and create a log, which I'll attach below. I heard a noticeable decrease in fan speed as soon as the infected files were deleted.

Glad to hear that ComboFix was finally able to produce a log file. :)

The only problem I see now happened when I tried to open Task Manager. When I pressed ctrl alt delete, I got this message - "Logon process has failed to create the security options dialog" and Task Manager didn't open.

Reboot the computer again, and see if that error message with Task Manager goes away.

I know we're almost there. I'll wait for the next step.

We are making some excellant progress! YOu're doing a fantastic job running all of these scans/fixes!

A sincere "Thank You" for getting us back to this point!

You're very welcome! :)


Lets see what these scans find, and see where we stand then.

Malwarebytes' Anti-Malware

I see that you have Malwarebytes' Anti-Malware installed on your computer could you please do a scan using these settings:

  • Open Malwarebytes' Anti-Malware
  • Select the Update tab
  • Click Check for Updates
  • After the update have been completed, Select the Scanner tab.
  • Select Perform quick scan, then click on Scan
  • Leave the default options as it is and click on Start Scan
  • When done, you will be prompted. Click OK, then click on Show Results
  • Checked (ticked) all items and click on Remove Selected
  • After it has removed the items, Notepad will open. Please post this log in your next reply. You can also find the log in the Logs tab. The bottom most log is the latest
Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT:



ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.



  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the Posted Image button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the Posted Image icon on your desktop.
  • Check Posted Image
  • Click the Posted Image button.
  • Accept any security warnings from your browser.
  • Check Posted Image
  • Make sure that the option "Remove found threats" is Unchecked
  • When the Computer scan settings display shows, click the Advanced option, the place a check next to the following (if it is not already checked):
    • Enable Anti-Stealth technology
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push Posted Image
  • Push Posted Image, and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the Posted Image button.
  • Push Posted Image


NEXT:



Security Check
Download Security Check by screen317 from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#12 RonT38

RonT38
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:40 PM

Posted 17 June 2011 - 10:04 PM

I rebooted and tried to run Malwarebytes. I got this message:
Malwarebytes' Anti-Malware
An error has occurred. Please report this error code to our support team.
PROGRAM_ERROR-UPDATING (12163,0,IsInternetConnected)

I checked the Internet connection and it was working. I downloaded Malwarebytes from the Internet and installed it over the old one and tried it again. I got the same error message again. Next, I uninstalled Malwarebytes and restarted the computer, and I got this error message when it rebooted:
Microsoft Windows
Host Process for Windows services stopped working and was closed.
A problem caused teh application to stop working correctly. Windows will notify you if a solution is available.
I clicked Close.

I reinstalled Malwarebytes and when it tried to update I got the same error message as before. The database was 20 days old, so I decided to run a scan without updating. Here is the log from that scan:
Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 6705

Windows 6.0.6000
Internet Explorer 7.0.6000.16982

6/17/2011 8:33:16 PM
mbam-log-2011-06-17 (20-33-16).txt

Scan type: Quick scan
Objects scanned: 147697
Time elapsed: 4 minute(s), 52 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Next, I disabled Norton Anti-Virus and Super Antispyware. Then, I tried to use the ESET Online Scanner, but while installing it, I got a message that another anti-virus program had been detected, Microsoft Defender (Windows Defender, I can't remember which). I searched for it in Programs, C:drive, and Add/Remove Programs and couldn't find it anywhere. I decided not to run the scan, and instead post what I've got so far.

Thanks again,
~Ron

#13 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:02:40 AM

Posted 18 June 2011 - 09:46 AM

Hi Ron!

Can you please check these settings to make sure no proxy is set:

Check - Reset Proxy settings
Malware can alter your proxy settings. If altered, it can affect your ability to browse or download tools required for disinfection.

Internet Explorer Proxy settings:
  • Open Internet Explorer > click Tools > Internet Options > Connections tab.
  • Click the LAN Settings... button and uncheck "Use a proxy server for your LAN"
    or change the settings to the proxy you normally use if you previously reconfigured it.
  • Remove any unknown addresses from the Address box. 80 is the default Port so it does not have to be changed.
  • Click OK... then click OK again.
  • Close Internet Explorer and -restart- the computer.
  • An example of how to do this with screenshots can be found in steps 3-7 under the section Automated Removal Instructions... in this guide.

Firefox Proxy settings:
  • Open Firefox, click Tools > Options > Advanced and click the Network Tab.
  • Under the Connection section click on the Settings... button.
  • Under Configure Proxies to Access the Internet, check No proxy. This is the default option if you don't use a proxy.
  • Click OK... then click OK again.
  • Close Firefox and -restart- the computer.

For other browsers, please refer to How to configure browser proxy settings.


Then try to update MBAM and see if it will update to the latest version.

I wouldn't worry about disabling Windows Defender, I'd just try and run a scan with it.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#14 RonT38

RonT38
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:11:40 PM

Posted 19 June 2011 - 12:03 AM

Hi SweetTech, I checked the settings in Malwarebytes and Internet Explorer and neither were set to proxies. IE was set to Automatically Detect. I still couldn't update Malwarebytes. I did run the ESET scan and the Security Check scan. Here are the logs:

ESET Log:
C:\Program Files\Acer GameZone\Jewel Quest Solitaire\aJewelQuestSolitaire.exe Win32/Agent.RKC trojan
C:\Qoobox\Quarantine\C\ProgramData\42fafa\1353.mof.vir Win32/RogueAV.A trojan

Security Check Log:
Results of screen317's Security Check version 0.99.14
Windows Vista (UAC is enabled)
Out of date service pack!!
Internet Explorer 7 Out of date!
``````````````````````````````
Antivirus/Firewall Check:

Windows Firewall Enabled!
ESET Online Scanner v3
Norton Internet Security
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware
CCleaner
Adobe Flash Player
````````````````````````````````
Process Check:
objlist.exe by Laurent

Norton ccSvcHst.exe
``````````End of Log````````````

I'm still getting the "Host Process for Windows services stopped working and was closed" error message, too. The computer is running better, though. No high fan speed. Better response once it's loaded. Boot is kind of slow.

Thanks for your patience and your help,
~Ron

#15 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:02:40 AM

Posted 19 June 2011 - 08:32 AM

Ron,

Please try to download the MBAM Database version from this link here and run it: http://data-cdn.mbamupdates.com/tools/mbam-rules.exe

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users