1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Slow...

Discussion in 'Virus & Other Malware Removal' started by KennedyRec, Nov 9, 2011.

Thread Status:
Not open for further replies.
Advertisement
  1. KennedyRec

    KennedyRec Thread Starter

    Joined:
    Nov 9, 2011
    Messages:
    4
    Looking for some help, slow running Dell. Sorry, this is long.

    Windows defender is now disabled.

    HiJackthis info on the attachment, i had trouble getting a log .txt file created, so i took a screen shot and pasted into word.

    Thanks in advance-

    .
    DDS (Ver_2011-08-26.01) - NTFSx86
    Internet Explorer: 9.0.8112.16421
    Run by Kennedy Rec at 14:52:03 on 2011-11-09
    Microsoft® Windows Vista™ Business 6.0.6002.2.1252.1.1033.18.2046.457 [GMT -6:00]
    .
    AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
    SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Windows\system32\Ati2evxx.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\Ati2evxx.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\DRIVERS\xaudio.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Dell\MediaDirect\PCMService.exe
    C:\Program Files\Dell Support Center\bin\sprtcmd.exe
    C:\Program Files\Alwil Software\Avast5\AvastUI.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Windows\sttray.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Windows\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Windows\system32\WUDFHost.exe
    C:\Windows\System32\mobsync.exe
    C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.foxnews.com/
    uInternet Settings,ProxyOverride = <local>;*.local
    uInternet Settings,ProxyServer = http=127.0.0.1:6092
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
    BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar2.dll
    BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar2.dll
    uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
    uRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
    uRun: [msiegent] rundll32 "c:\users\kenned~1\appdata\local\temp\bridgini.dll",CreateProcessNotify
    mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
    mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
    mRun: [PCMService] "c:\program files\dell\mediadirect\PCMService.exe"
    mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"
    mRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
    mRun: [avast] "c:\program files\alwil software\avast5\avastUI.exe" /nogui
    mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
    mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [SigmatelSysTrayApp] sttray.exe
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickset.lnk - c:\windows\installer\{53a01cc6-14b0-4512-a2e7-10d39bf83dc4}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe
    mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
    DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} - hxxp://support.dell.com/systemprofiler/SysProExe.CAB
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
    TCP: DhcpNameServer = 209.18.47.61 209.18.47.62
    TCP: Interfaces\{7C77959A-BBAF-4F4A-A803-AA0AB6C4057A} : DhcpNameServer = 209.18.47.61 209.18.47.62
    TCP: Interfaces\{D3684C8E-0509-45B9-BE0F-786D46571729} : DhcpNameServer = 209.18.47.61 209.18.47.62
    .
    ============= SERVICES / DRIVERS ===============
    .
    R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-5-13 442200]
    R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-9-15 320856]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-9-15 20568]
    R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-9-15 54616]
    R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-9-15 44768]
    R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-9-15 21504]
    R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2009-3-30 366152]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2009-3-30 22216]
    S1 nuswvopi;nuswvopi;c:\windows\system32\drivers\nuswvopi.sys [2009-10-27 30784]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S3 elDiag;Diagostics Port Device Driver;c:\windows\system32\drivers\FTD2XX.sys [2007-2-15 34639]
    S3 elUsbCardBus;elu132.sys device driver;c:\windows\system32\drivers\elu132.sys [2007-2-15 95360]
    .
    =============== Created Last 30 ================
    .
    2011-11-09 18:08:22 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{cbb5be55-c5cf-49b6-b35e-aa4c56e2e025}\offreg.dll
    2011-11-09 17:11:03 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
    2011-11-09 17:11:02 98816 ----a-w- c:\windows\system32\mfps.dll
    2011-11-09 17:11:02 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll
    2011-11-09 17:11:02 302592 ----a-w- c:\windows\system32\mfmp4src.dll
    2011-11-09 17:11:02 2873344 ----a-w- c:\windows\system32\mf.dll
    2011-11-09 17:11:02 261632 ----a-w- c:\windows\system32\mfreadwrite.dll
    2011-11-09 17:11:01 586240 ----a-w- c:\windows\system32\stobject.dll
    2011-11-09 17:11:01 209920 ----a-w- c:\windows\system32\mfplat.dll
    2011-11-09 17:07:47 519680 ----a-w- c:\windows\system32\d3d11.dll
    2011-11-09 17:07:47 369664 ----a-w- c:\windows\system32\WMPhoto.dll
    2011-11-09 17:07:47 252928 ----a-w- c:\windows\system32\dxdiag.exe
    2011-11-09 17:07:47 195584 ----a-w- c:\windows\system32\dxdiagn.dll
    2011-11-09 17:07:46 974848 ----a-w- c:\windows\system32\WindowsCodecs.dll
    2011-11-09 17:07:46 321024 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll
    2011-11-09 17:07:46 189440 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
    2011-11-09 16:35:16 -------- d-----w- c:\windows\system32\eu-ES
    2011-11-09 16:35:16 -------- d-----w- c:\windows\system32\ca-ES
    2011-11-09 16:35:15 -------- d-----w- c:\windows\system32\vi-VN
    2011-11-09 16:25:37 -------- d-----w- c:\windows\system32\SPReview
    2011-11-09 15:32:09 928768 ----a-w- c:\windows\system32\scavenge.dll
    2011-11-09 15:31:53 57856 ----a-w- c:\windows\system32\compcln.exe
    2011-11-09 15:22:59 800768 ----a-w- c:\windows\system32\advapi32.dll
    2011-11-09 15:21:54 1514496 ----a-w- c:\windows\system32\WindowsAnytimeUpgradeCPL.dll
    2011-11-09 15:20:59 324608 ----a-w- c:\program files\windows nt\tabletextservice\TableTextService.dll
    2011-11-09 15:09:00 -------- d-----w- c:\windows\system32\EventProviders
    2011-11-09 15:05:45 -------- d-----w- C:\e20a8ea623d106bcf201c9
    2011-11-08 12:50:03 6668624 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{cbb5be55-c5cf-49b6-b35e-aa4c56e2e025}\mpengine.dll
    2011-10-13 16:37:30 388096 ----a-r- c:\users\kennedy rec\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
    2011-10-13 16:37:27 -------- d-----w- c:\program files\Trend Micro
    2011-10-13 14:47:54 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
    2011-10-13 14:47:54 107368 ----a-w- c:\windows\system32\GEARAspi.dll
    2011-10-13 14:45:27 -------- d-----w- c:\program files\iPod
    2011-10-13 14:45:22 -------- d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
    2011-10-13 14:45:22 -------- d-----w- c:\program files\iTunes
    2011-10-13 14:38:02 -------- d-----w- c:\program files\Bonjour
    .
    ==================== Find3M ====================
    .
    2011-11-09 17:10:58 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
    2011-11-09 17:07:48 4096 ----a-w- c:\windows\system32\drivers\en-us\dxgkrnl.sys.mui
    2011-10-19 23:10:58 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2011-09-06 20:45:29 41184 ----a-w- c:\windows\avastSS.scr
    2011-09-06 20:38:05 442200 ----a-w- c:\windows\system32\drivers\aswSnx.sys
    2011-09-06 20:36:26 54616 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
    2011-08-31 22:00:50 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-08-31 04:05:04 83816 ----a-w- c:\windows\system32\dns-sd.exe
    2011-08-31 04:05:04 73064 ----a-w- c:\windows\system32\dnssd.dll
    2011-08-31 04:05:04 50536 ----a-w- c:\windows\system32\jdns_sd.dll
    2011-08-31 04:05:04 178536 ----a-w- c:\windows\system32\dnssdX.dll
    .
    ============= FINISH: 14:54:17.25 ===============

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft® Windows Vista™ Business
    Boot Device: \Device\HarddiskVolume3
    Install Date: 2/9/2007 6:02:24 AM
    System Uptime: 11/9/2011 12:07:13 PM (2 hours ago)
    .
    Motherboard: Dell Inc. | | 0YD479
    Processor: Genuine Intel(R) CPU T2250 @ 1.73GHz | Microprocessor | 800/133mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 137 GiB total, 97.746 GiB free.
    D: is FIXED (NTFS) - 10 GiB total, 0.288 GiB free.
    E: is CDROM (UDF)
    F: is Removable
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP2023: 11/9/2011 9:17:17 AM - Windows Vista™ Service Pack 2
    RP2024: 11/9/2011 11:06:07 AM - Windows Modules Installer
    .
    ==== Installed Programs ======================
    .
    Adobe AIR
    Adobe Flash Player 11 ActiveX
    Adobe Reader 7.0.8
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    avast! Free Antivirus
    Bonjour
    Conexant HDA D110 MDC V.92 Modem
    Dell Support Center (Support Software)
    Dell System Customization Wizard
    DellSupport
    Google Toolbar for Internet Explorer
    HiJackThis
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Internet Explorer (Enable DEP)
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 25
    Malwarebytes' Anti-Malware version 1.51.2.1300
    MediaDirect
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft Office File Validation Add-In
    Microsoft Office Professional Edition 2003
    Microsoft Office Small Business Edition 2003
    Microsoft Streets & Trips 2006
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Modem Diagnostic Tool
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB941833)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    Navionics Chart Installer
    Navionics PC app-V1.3
    NetWaiting
    OGA Notifier 2.0.0048.0
    OutlookAddinSetup
    Picasa 3
    QuickSet
    QuickTime
    Security Update for CAPICOM (KB931906)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    SigmaTel Audio
    Sonic Activation Module
    Synaptics Pointing Device Driver
    U132 Diagnostics port drivers
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    URL Assistant
    USB CardBus Adapter Drivers
    User's Guides
    Windows Live OneCare safety scanner
    .
    ==== Event Viewer Messages From Past Week ========
    .
    11/9/2011 11:16:26 AM, Error: Service Control Manager [7043] - The Windows Update service did not shut down properly after receiving a preshutdown control.
    .
    ==== End Of File ===========================

    .
    DDS (Ver_2011-08-26.01) - NTFSx86
    Internet Explorer: 9.0.8112.16421
    Run by Kennedy Rec at 14:52:03 on 2011-11-09
    Microsoft® Windows Vista™ Business 6.0.6002.2.1252.1.1033.18.2046.457 [GMT -6:00]
    .
    AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
    SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Windows\system32\Ati2evxx.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\Ati2evxx.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\DRIVERS\xaudio.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Dell\MediaDirect\PCMService.exe
    C:\Program Files\Dell Support Center\bin\sprtcmd.exe
    C:\Program Files\Alwil Software\Avast5\AvastUI.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Windows\sttray.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Windows\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Windows\system32\WUDFHost.exe
    C:\Windows\System32\mobsync.exe
    C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.foxnews.com/
    uInternet Settings,ProxyOverride = <local>;*.local
    uInternet Settings,ProxyServer = http=127.0.0.1:6092
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
    BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar2.dll
    BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar2.dll
    uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
    uRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
    uRun: [msiegent] rundll32 "c:\users\kenned~1\appdata\local\temp\bridgini.dll",CreateProcessNotify
    mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
    mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
    mRun: [PCMService] "c:\program files\dell\mediadirect\PCMService.exe"
    mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"
    mRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
    mRun: [avast] "c:\program files\alwil software\avast5\avastUI.exe" /nogui
    mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
    mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [SigmatelSysTrayApp] sttray.exe
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickset.lnk - c:\windows\installer\{53a01cc6-14b0-4512-a2e7-10d39bf83dc4}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe
    mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
    DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} - hxxp://support.dell.com/systemprofiler/SysProExe.CAB
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
    TCP: DhcpNameServer = 209.18.47.61 209.18.47.62
    TCP: Interfaces\{7C77959A-BBAF-4F4A-A803-AA0AB6C4057A} : DhcpNameServer = 209.18.47.61 209.18.47.62
    TCP: Interfaces\{D3684C8E-0509-45B9-BE0F-786D46571729} : DhcpNameServer = 209.18.47.61 209.18.47.62
    .
    ============= SERVICES / DRIVERS ===============
    .
    R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-5-13 442200]
    R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-9-15 320856]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-9-15 20568]
    R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-9-15 54616]
    R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-9-15 44768]
    R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-9-15 21504]
    R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2009-3-30 366152]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2009-3-30 22216]
    S1 nuswvopi;nuswvopi;c:\windows\system32\drivers\nuswvopi.sys [2009-10-27 30784]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S3 elDiag;Diagostics Port Device Driver;c:\windows\system32\drivers\FTD2XX.sys [2007-2-15 34639]
    S3 elUsbCardBus;elu132.sys device driver;c:\windows\system32\drivers\elu132.sys [2007-2-15 95360]
    .
    =============== Created Last 30 ================
    .
    2011-11-09 18:08:22 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{cbb5be55-c5cf-49b6-b35e-aa4c56e2e025}\offreg.dll
    2011-11-09 17:11:03 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
    2011-11-09 17:11:02 98816 ----a-w- c:\windows\system32\mfps.dll
    2011-11-09 17:11:02 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll
    2011-11-09 17:11:02 302592 ----a-w- c:\windows\system32\mfmp4src.dll
    2011-11-09 17:11:02 2873344 ----a-w- c:\windows\system32\mf.dll
    2011-11-09 17:11:02 261632 ----a-w- c:\windows\system32\mfreadwrite.dll
    2011-11-09 17:11:01 586240 ----a-w- c:\windows\system32\stobject.dll
    2011-11-09 17:11:01 209920 ----a-w- c:\windows\system32\mfplat.dll
    2011-11-09 17:07:47 519680 ----a-w- c:\windows\system32\d3d11.dll
    2011-11-09 17:07:47 369664 ----a-w- c:\windows\system32\WMPhoto.dll
    2011-11-09 17:07:47 252928 ----a-w- c:\windows\system32\dxdiag.exe
    2011-11-09 17:07:47 195584 ----a-w- c:\windows\system32\dxdiagn.dll
    2011-11-09 17:07:46 974848 ----a-w- c:\windows\system32\WindowsCodecs.dll
    2011-11-09 17:07:46 321024 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll
    2011-11-09 17:07:46 189440 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
    2011-11-09 16:35:16 -------- d-----w- c:\windows\system32\eu-ES
    2011-11-09 16:35:16 -------- d-----w- c:\windows\system32\ca-ES
    2011-11-09 16:35:15 -------- d-----w- c:\windows\system32\vi-VN
    2011-11-09 16:25:37 -------- d-----w- c:\windows\system32\SPReview
    2011-11-09 15:32:09 928768 ----a-w- c:\windows\system32\scavenge.dll
    2011-11-09 15:31:53 57856 ----a-w- c:\windows\system32\compcln.exe
    2011-11-09 15:22:59 800768 ----a-w- c:\windows\system32\advapi32.dll
    2011-11-09 15:21:54 1514496 ----a-w- c:\windows\system32\WindowsAnytimeUpgradeCPL.dll
    2011-11-09 15:20:59 324608 ----a-w- c:\program files\windows nt\tabletextservice\TableTextService.dll
    2011-11-09 15:09:00 -------- d-----w- c:\windows\system32\EventProviders
    2011-11-09 15:05:45 -------- d-----w- C:\e20a8ea623d106bcf201c9
    2011-11-08 12:50:03 6668624 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{cbb5be55-c5cf-49b6-b35e-aa4c56e2e025}\mpengine.dll
    2011-10-13 16:37:30 388096 ----a-r- c:\users\kennedy rec\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
    2011-10-13 16:37:27 -------- d-----w- c:\program files\Trend Micro
    2011-10-13 14:47:54 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
    2011-10-13 14:47:54 107368 ----a-w- c:\windows\system32\GEARAspi.dll
    2011-10-13 14:45:27 -------- d-----w- c:\program files\iPod
    2011-10-13 14:45:22 -------- d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
    2011-10-13 14:45:22 -------- d-----w- c:\program files\iTunes
    2011-10-13 14:38:02 -------- d-----w- c:\program files\Bonjour
    .
    ==================== Find3M ====================
    .
    2011-11-09 17:10:58 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
    2011-11-09 17:07:48 4096 ----a-w- c:\windows\system32\drivers\en-us\dxgkrnl.sys.mui
    2011-10-19 23:10:58 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2011-09-06 20:45:29 41184 ----a-w- c:\windows\avastSS.scr
    2011-09-06 20:38:05 442200 ----a-w- c:\windows\system32\drivers\aswSnx.sys
    2011-09-06 20:36:26 54616 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
    2011-08-31 22:00:50 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-08-31 04:05:04 83816 ----a-w- c:\windows\system32\dns-sd.exe
    2011-08-31 04:05:04 73064 ----a-w- c:\windows\system32\dnssd.dll
    2011-08-31 04:05:04 50536 ----a-w- c:\windows\system32\jdns_sd.dll
    2011-08-31 04:05:04 178536 ----a-w- c:\windows\system32\dnssdX.dll
    .
    ============= FINISH: 14:54:17.25 ===============
     
  2. eddie5659

    eddie5659 Moderator Malware Specialist

    Joined:
    Mar 19, 2001
    Messages:
    37,197
    Hiya and welcome to Tech Support Guy :)

    Please download Malwarebytes' Anti-Malware from Here or Here

    Double Click mbam-setup.exe to install the application.
    • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select "Perform Full Scan", then click Scan.
    • The scan may take some time to finish,so please be patient.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Make sure that everything is checked, and click Remove Selected.
    • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
    • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    • Copy&Paste the entire report in your next reply.
    Extra Note:
    If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.






    Download and scan with SUPERAntiSpyware Free for Home Users
    • Double-click SUPERAntiSpyware.exe and use the default settings for installation.
    • An icon will be created on your desktop. Double-click that icon to launch the program.
    • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
    • Under "Configuration and Preferences", click the Preferences button.
    • Click the Scanning Control tab.
    • Under Scanner Options make sure the following are checked (leave all others unchecked):
      • Close browsers before scanning.
      • Scan for tracking cookies.
      • Terminate memory threats before quarantining.
    • Click the "Close" button to leave the control center screen.
    • Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
    • On the left, make sure you check C:\Fixed Drive.
    • On the right, under "Complete Scan", choose Perform Complete Scan.
    • Click "Next" to start the scan. Please be patient while it scans your computer.
    • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
    • Make sure everything has a checkmark next to it and click "Next".
    • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
    • If asked if you want to reboot, click "Yes".
    • To retrieve the removal information after reboot, launch SUPERAntispyware again.
      • Click Preferences, then click the Statistics/Logs tab.
      • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
      • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
      • Please copy and paste the Scan Log results in your next reply.
    • Click Close to exit the program.

    Please include the MBAM log and, SUPERAntiSpyware Scan Log and a fresh HijackThis log in your next reply

    eddie
     
  3. KennedyRec

    KennedyRec Thread Starter

    Joined:
    Nov 9, 2011
    Messages:
    4
    Here are the requested files-- Thanks again.

    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 5:32:57 PM, on 11/12/2011
    Platform: Windows Vista SP2 (WinNT 6.00.1906)
    MSIE: Internet Explorer v9.00 (9.00.8112.16421)
    Boot mode: Normal
    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Dell Support Center\bin\sprtcmd.exe
    C:\Program Files\Alwil Software\Avast5\AvastUI.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Dell Support Center\gs_agent\dsc.exe
    C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32Info.exe
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:6092
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [avast] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
    O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
    O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
    O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} (WMI Class) - http://support.dell.com/systemprofiler/SysProExe.CAB
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
    O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
    O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
    --
    End of file - 5311 bytes

    Malwarebytes' Anti-Malware 1.51.2.1300
    www.malwarebytes.org
    Database version: 8147
    Windows 6.0.6002 Service Pack 2
    Internet Explorer 9.0.8112.16421
    11/12/2011 2:36:11 PM
    mbam-log-2011-11-12 (14-36-10).txt
    Scan type: Full scan (C:\|)
    Objects scanned: 311481
    Time elapsed: 1 hour(s), 43 minute(s), 41 second(s)
    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0
    Memory Processes Infected:
    (No malicious items detected)
    Memory Modules Infected:
    (No malicious items detected)
    Registry Keys Infected:
    (No malicious items detected)
    Registry Values Infected:
    (No malicious items detected)
    Registry Data Items Infected:
    (No malicious items detected)
    Folders Infected:
    (No malicious items detected)
    Files Infected:
    (No malicious items detected)

    SUPERAntiSpyware Scan Log
    http://www.superantispyware.com
    Generated 11/12/2011 at 04:26 PM
    Application Version : 5.0.1136
    Core Rules Database Version : 7937
    Trace Rules Database Version: 5749
    Scan type : Quick Scan
    Total Scan Time : 00:40:03
    Operating System Information
    Windows Vista Business 32-bit, Service Pack 2 (Build 6.00.6002)
    UAC On - Limited User (Administrator User)
    Memory items scanned : 713
    Memory threats detected : 0
    Registry items scanned : 36507
    Registry threats detected : 0
    File items scanned : 14381
    File threats detected : 106
    Adware.Tracking Cookie
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\N81GNET0.txt [ /legolas-media.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\EXGIBKHV.txt [ /invitemedia.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\8RJGI4ZW.txt [ /2o7.net ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\48CO5446.txt [ /liveperson.net ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\GP52R4FP.txt [ /ad.yieldmanager.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\8PCT29BR.txt [ /serving-sys.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\5WUSJ013.txt [ /pointroll.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\IALRGV86.txt [ /amazon-adsystem.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\843B6G4Y.txt [ /insightexpressai.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\1DTRTV0W.txt [ /steelhousemedia.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\T6MKL7KQ.txt [ /a1.interclick.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\K150SDYE.txt [ /apmebf.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\UYV6QU4S.txt [ /atdmt.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\Z5RI01SJ.txt [ /collective-media.net ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\ML7HYIMV.txt [ /advertising.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\UZ0O480G.txt [ /liveperson.net ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\S9UHJQ76.txt [ /liveperson.net ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\OPYLK85F.txt [ /realmedia.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\ZL3JH07U.txt [ /doubleclick.net ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\5QGXPXWJ.txt [ /at.atwola.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\KB348R27.txt [ /adxpose.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\2V5A2WUZ.txt [ /ads.pointroll.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\4ORVF3PN.txt [ /bs.serving-sys.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\VCGU1NAC.txt [ /imrworldwide.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\XDLBJCOC.txt [ /specificclick.net ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\LN60U7G1.txt [ /revsci.net ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\B07D3DAR.txt [ /ad.wsod.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\8Y6W5QAH.txt [ /questionmarket.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\14A1AF9I.txt [ /ru4.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\9EUTQ08D.txt [ /zedo.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\MH2PDBX6.txt [ /yieldmanager.net ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\UIKBEV39.txt [ /liveperson.net ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\VHHXJ4ZM.txt [ /tribalfusion.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\11PVY7FL.txt [ /ads.pubmatic.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\NATZ89CA.txt [ /liveperson.net ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\3NC1LC6S.txt [ /r1-ads.ace.advertising.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\JIVJCKH7.txt [ /media6degrees.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\SG7M649Y.txt [ /kontera.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\U5JOT3O4.txt [ /viewablemedia.net ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\AG8KA45W.txt [ /ar.atwola.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\X1Y9IC9Q.txt [ /o1.qnsr.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\R9K97JD5.txt [ /s.clickability.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\B3L0LQ31.txt [ /e1.cdn.qnsr.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\0NQD7Q16.txt [ /qnsr.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\WE0PZ5LT.txt [ /tacoda.at.atwola.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\XS5YNFOY.txt [ /akamai.interclickproxy.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\L07VOTL3.txt [ /liveperson.net ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\K8N6Q90O.txt [ /statse.webtrendslive.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\PTJB2SB2.txt [ /www.qsstats.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\QNITC097.txt [ /interclick.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\A5PL4YF4.txt [ /lm.logicalmedia.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\RB2XWNAE.txt [ /ads.undertone.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\7DWS6V94.txt [ /trackalyzer.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\ZMOGDIXQ.txt [ /sales.liveperson.net ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\7M8VCGJZ.txt [ /fastclick.net ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\82GYN1EK.txt [ /adinterax.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\Q7K36CWW.txt [ /www.googleadservices.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\DZXTVRQM.txt [ /www.qsstats.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\0DB0B9DX.txt [ /eyewonder.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\K8YGXGFP.txt [ /mediaplex.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\Y7LF0DO6.txt [ /pro-market.net ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\CNGHJQDY.txt [ /casalemedia.com ]
    C:\Users\Kennedy Rec\AppData\Roaming\Microsoft\Windows\Cookies\E8ME5K6T.txt [ /www.googleadservices.com ]
    C:\USERS\KENNEDY REC\AppData\Roaming\Microsoft\Windows\Cookies\ZQ6ZHJTK.txt [ Cookie:kennedy [email protected]/adserving ]
    C:\USERS\KENNEDY REC\Cookies\N81GNET0.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\8RJGI4ZW.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\CYGADY3F.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\8PCT29BR.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\VC9LNBJX.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\5WUSJ013.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\IALRGV86.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\843B6G4Y.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\1DTRTV0W.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\Z5RI01SJ.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\KOPXZQ9J.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\S9UHJQ76.txt [ Cookie:kennedy [email protected]/hc/71605247 ]
    C:\USERS\KENNEDY REC\Cookies\OPYLK85F.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\ZL3JH07U.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\KB348R27.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\2V5A2WUZ.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\4ORVF3PN.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\VCGU1NAC.txt [ Cookie:kennedy [email protected]/cgi-bin ]
    C:\USERS\KENNEDY REC\Cookies\XDLBJCOC.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\8Y6W5QAH.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\14A1AF9I.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\9EUTQ08D.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\MH2PDBX6.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\VHHXJ4ZM.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\ZQ6ZHJTK.txt [ Cookie:kennedy [email protected]/adserving ]
    C:\USERS\KENNEDY REC\Cookies\3NC1LC6S.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\SG7M649Y.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\U5JOT3O4.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\TUZ5YVPR.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\TVAX6Q1M.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\L07VOTL3.txt [ Cookie:kennedy [email protected]/hc/63000276 ]
    C:\USERS\KENNEDY REC\Cookies\QNITC097.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\A5PL4YF4.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\7DWS6V94.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\ZMOGDIXQ.txt [ Cookie:kennedy [email protected]/hc/76226072 ]
    C:\USERS\KENNEDY REC\Cookies\7M8VCGJZ.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\82GYN1EK.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\Q7K36CWW.txt [ Cookie:kennedy [email protected]/pagead/conversion/1071232054/ ]
    C:\USERS\KENNEDY REC\Cookies\DZXTVRQM.txt [ Cookie:kennedy [email protected]/dcsfvmrnb00000ctq1udd7gnx_2c8n ]
    C:\USERS\KENNEDY REC\Cookies\0DB0B9DX.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\K8YGXGFP.txt [ Cookie:kennedy [email protected]/ ]
    C:\USERS\KENNEDY REC\Cookies\CNGHJQDY.txt [ Cookie:kennedy [email protected]/ ]
     
  4. eddie5659

    eddie5659 Moderator Malware Specialist

    Joined:
    Mar 19, 2001
    Messages:
    37,197
    Thanks :)

    Download OTL to your Desktop
    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
      • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
      • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic

    eddie
     
  5. KennedyRec

    KennedyRec Thread Starter

    Joined:
    Nov 9, 2011
    Messages:
    4
    Sorry for the delay, here are the logs- Thanks in advance-
    PK

    OTL Extras logfile created on: 11/17/2011 9:13:58 PM - Run 1
    OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Kennedy Rec\Desktop
    Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
    Internet Explorer (Version = 9.0.8112.16421)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    2.00 Gb Total Physical Memory | 0.87 Gb Available Physical Memory | 43.59% Memory free
    4.23 Gb Paging File | 1.93 Gb Available in Paging File | 45.65% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 137.00 Gb Total Space | 78.58 Gb Free Space | 57.36% Space Free | Partition Type: NTFS
    Drive D: | 10.00 Gb Total Space | 0.29 Gb Free Space | 2.88% Space Free | Partition Type: NTFS
    Drive E: | 4.38 Gb Total Space | 1.53 Gb Free Space | 34.87% Space Free | Partition Type: UDF
    Drive F: | 7.39 Gb Total Space | 7.02 Gb Free Space | 94.87% Space Free | Partition Type: FAT32

    Computer Name: KENNEDYREC-PC | User Name: Kennedy Rec | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
    .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
    exefile [open] -- "%1" %*
    helpfile [open] -- Reg Error: Key error.
    hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "cval" = 1
    "UpdatesDisableNotify" = 0
    "FirewallDisableNotify" = 0
    "AntiVirusDisableNotify" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
    "DisableMonitoring" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
    "DisableMonitoring" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
    "AntiVirusOverride" = 0
    "AntiSpywareOverride" = 0
    "FirewallOverride" = 0
    "VistaSp1" = Reg Error: Unknown registry data type -- File not found
    "VistaSp2" = Reg Error: Unknown registry data type -- File not found

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1774953698-1593180319-2558697840-1001]
    "EnableNotifications" = 1
    "EnableNotificationsRef" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "EnableFirewall" = 1
    "DisableNotifications" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 1
    "DisableNotifications" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
    "EnableFirewall" = 1
    "DisableNotifications" = 0

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


    ========== Vista Active Open Ports Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{0431B717-5B65-47D2-ADB3-71699E2862C3}" = lport=139 | protocol=6 | dir=in | app=system |
    "{1C5254EE-160A-469E-A350-1E26F86AB021}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
    "{23256069-F40A-4241-B984-009546CDA7E3}" = rport=139 | protocol=6 | dir=out | app=system |
    "{35393636-07DE-40C5-9730-12679B214E7A}" = rport=445 | protocol=6 | dir=out | app=system |
    "{5DD769F4-48A3-478B-ABA3-D5474CFB60DB}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 |
    "{62385AD8-8333-4D99-BB4C-D1DE49058E65}" = rport=137 | protocol=17 | dir=out | app=system |
    "{939B3BE8-3901-4323-943D-2F6D16F626EE}" = rport=138 | protocol=17 | dir=out | app=system |
    "{AD0870D3-1173-449C-965E-A4784AD37A87}" = lport=137 | protocol=17 | dir=in | app=system |
    "{C15C0363-8D5C-430D-B6DF-D84E60DD6FA6}" = lport=138 | protocol=17 | dir=in | app=system |
    "{DCE415D0-678A-4BEB-AF1B-26A6BB808410}" = lport=445 | protocol=6 | dir=in | app=system |

    ========== Vista Active Application Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{20296AED-D63E-4B81-A1C3-5BA91E11648C}" = protocol=1 | dir=in | [email protected],-28543 |
    "{5C528167-C560-48FE-9256-C200CE721B7E}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
    "{82808125-5B70-4A7C-AA10-80A7B0AD5016}" = protocol=1 | dir=out | [email protected],-28544 |
    "{8B1A9990-1CA3-49E5-9640-FE9ED34003F7}" = protocol=17 | dir=in | app=c:\windows\system32\wininit.exe |
    "{B7DDCBE0-BA6B-4215-A206-DD48C28C48FF}" = protocol=6 | dir=in | app=c:\windows\system32\wininit.exe |
    "{CA04DC00-95B3-4915-A1C0-9456E313544F}" = protocol=58 | dir=in | [email protected],-28545 |
    "{D78CB90A-914D-4C6D-9C50-741AA3E1723A}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
    "{DC16F467-32F4-4CDE-B370-EE9253EFA2C3}" = protocol=6 | dir=in | app=c:\windows\system32\wininit.exe |
    "{DD97DDE9-180C-4FE8-8E62-1A73D5B9CFDA}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
    "{DE62F1ED-FA28-4A0E-949E-1C3F74C92219}" = protocol=17 | dir=in | app=c:\windows\system32\wininit.exe |
    "{EBEC2CE9-DE7F-4F90-8C66-CFFB0242E877}" = protocol=58 | dir=out | [email protected],-28546 |

    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{01A20F31-98A4-38AC-75C0-8F2AB27C1510}" = Navionics Chart Installer
    "{13BA7B44-B712-4DEE-A7B8-1DD564F37AE5}" = Dell System Customization Wizard
    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    "{20BF56A9-AD50-40F5-9C85-F02EBE356241}" = Navionics PC app-V1.3
    "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
    "{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 25
    "{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
    "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
    "{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = URL Assistant
    "{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
    "{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{53A01CC6-14B0-4512-A2E7-10D39BF83DC4}" = QuickSet
    "{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}" = User's Guides
    "{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
    "{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
    "{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
    "{83ED1E80-A1B7-4226-BCF1-AC4A88151A6B}" = Microsoft Streets & Trips 2006
    "{8DC42D05-680B-41B0-8878-6C14D24602DB}" = QuickTime
    "{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
    "{91110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
    "{91CA0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Small Business Edition 2003
    "{9BDEF074-020E-458D-ADC5-8FF68E0C9B56}" = OutlookAddinSetup
    "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    "{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}" = MediaDirect
    "{A00B9A50-3090-4CFF-9CDA-82DA0BEDAA21}" = Apple Mobile Device Support
    "{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
    "{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
    "{a9264802-8a7a-40fe-a135-5c6d204aed7a}.sdb" = Internet Explorer (Enable DEP)
    "{AC76BA86-7AD7-1033-7B44-A70800000002}" = Adobe Reader 7.0.8
    "{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR
    "{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
    "{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
    "{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
    "{F63A3748-B93D-4360-9AD4-B064481A5C7B}" = Modem Diagnostic Tool
    "{FE0646A7-19D0-41B4-A2BB-2C35D644270D}" = Windows Live OneCare safety scanner
    "Adobe AIR" = Adobe AIR
    "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
    "avast" = avast! Free Antivirus
    "CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_14F100C3" = Conexant HDA D110 MDC V.92 Modem
    "elDiag" = U132 Diagnostics port drivers
    "elUsbCardBus" = USB CardBus Adapter Drivers
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
    "Navionics PC app-V1.3" = Navionics PC app-V1.3
    "navionicsChartInstaller.Air.A3B2DB703D5E0A7ECA24FBD4B07176191EDD3C63.1" = Navionics Chart Installer
    "Picasa 3" = Picasa 3
    "SynTPDeinstKey" = Synaptics Pointing Device Driver

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 11/17/2011 12:09:01 AM | Computer Name = KennedyRec-PC | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: m->NextScheduledSPRetry 5538

    Error - 11/17/2011 12:09:03 AM | Computer Name = KennedyRec-PC | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: Continuously busy for more than a second

    Error - 11/17/2011 12:09:03 AM | Computer Name = KennedyRec-PC | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: m->NextScheduledEvent 7660

    Error - 11/17/2011 12:09:03 AM | Computer Name = KennedyRec-PC | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: m->NextScheduledSPRetry 7660

    Error - 11/17/2011 12:09:04 AM | Computer Name = KennedyRec-PC | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: Continuously busy for more than a second

    Error - 11/17/2011 12:09:04 AM | Computer Name = KennedyRec-PC | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: m->NextScheduledEvent 8690

    Error - 11/17/2011 12:09:04 AM | Computer Name = KennedyRec-PC | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: m->NextScheduledSPRetry 8690

    Error - 11/17/2011 12:09:05 AM | Computer Name = KennedyRec-PC | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: Continuously busy for more than a second

    Error - 11/17/2011 12:09:05 AM | Computer Name = KennedyRec-PC | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: m->NextScheduledEvent 9844

    Error - 11/17/2011 12:09:05 AM | Computer Name = KennedyRec-PC | Source = Bonjour Service | ID = 100
    Description = Task Scheduling Error: m->NextScheduledSPRetry 9844

    [ System Events ]
    Error - 11/10/2011 10:34:13 AM | Computer Name = KennedyRec-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
    Description =

    Error - 11/10/2011 10:53:11 AM | Computer Name = KennedyRec-PC | Source = DCOM | ID = 10010
    Description =

    Error - 11/10/2011 1:10:58 PM | Computer Name = KennedyRec-PC | Source = bowser | ID = 8003
    Description =

    Error - 11/10/2011 7:01:35 PM | Computer Name = KennedyRec-PC | Source = DCOM | ID = 10010
    Description =

    Error - 11/12/2011 7:28:06 PM | Computer Name = KennedyRec-PC | Source = DCOM | ID = 10010
    Description =

    Error - 11/14/2011 7:12:40 PM | Computer Name = KennedyRec-PC | Source = DCOM | ID = 10010
    Description =

    Error - 11/15/2011 12:45:29 AM | Computer Name = KennedyRec-PC | Source = DCOM | ID = 10010
    Description =

    Error - 11/15/2011 11:12:14 AM | Computer Name = KennedyRec-PC | Source = DCOM | ID = 10010
    Description =

    Error - 11/16/2011 10:13:02 PM | Computer Name = KennedyRec-PC | Source = Service Control Manager | ID = 7011
    Description =

    Error - 11/17/2011 9:51:04 PM | Computer Name = KennedyRec-PC | Source = Service Control Manager | ID = 7011
    Description =

    < End of report >

    OTL logfile created on: 11/17/2011 9:13:58 PM - Run 1
    OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Kennedy Rec\Desktop
    Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
    Internet Explorer (Version = 9.0.8112.16421)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    2.00 Gb Total Physical Memory | 0.87 Gb Available Physical Memory | 43.59% Memory free
    4.23 Gb Paging File | 1.93 Gb Available in Paging File | 45.65% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 137.00 Gb Total Space | 78.58 Gb Free Space | 57.36% Space Free | Partition Type: NTFS
    Drive D: | 10.00 Gb Total Space | 0.29 Gb Free Space | 2.88% Space Free | Partition Type: NTFS
    Drive E: | 4.38 Gb Total Space | 1.53 Gb Free Space | 34.87% Space Free | Partition Type: UDF
    Drive F: | 7.39 Gb Total Space | 7.02 Gb Free Space | 94.87% Space Free | Partition Type: FAT32

    Computer Name: KENNEDYREC-PC | User Name: Kennedy Rec | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2011/11/17 21:12:43 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Kennedy Rec\Desktop\OTL.exe
    PRC - [2011/11/07 12:04:36 | 004,617,600 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    PRC - [2011/09/06 14:45:30 | 003,722,416 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
    PRC - [2011/09/06 14:45:28 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    PRC - [2011/08/31 16:00:48 | 000,449,608 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
    PRC - [2011/08/31 16:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    PRC - [2011/08/11 17:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCore.exe
    PRC - [2009/05/21 09:55:32 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe
    PRC - [2009/04/10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
    PRC - [2008/08/13 17:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    PRC - [2006/05/16 23:15:10 | 000,071,288 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe


    ========== Modules (No Company Name) ==========

    MOD - [2011/11/15 09:32:38 | 000,063,488 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
    MOD - [2011/11/15 09:32:38 | 000,052,736 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll
    MOD - [2011/11/12 03:15:09 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\c1c06a392871267db27f7cbc40e1c4fb\System.Xml.ni.dll
    MOD - [2011/11/12 03:14:38 | 007,950,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\f9c36ea806e77872dce891c77b68fac3\System.ni.dll
    MOD - [2011/11/12 03:14:08 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b6632a8b2f276a8e31f5b0f6b2006cd1\mscorlib.ni.dll
    MOD - [2011/11/09 17:24:49 | 000,117,760 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
    MOD - [2011/11/09 17:24:48 | 000,052,224 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
    MOD - [2006/10/24 22:44:00 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll


    ========== Win32 Services (SafeList) ==========

    SRV - File not found [On_Demand | Stopped] -- -- (stllssvr)
    SRV - File not found [Auto | Stopped] -- -- (CLTNetCnService)
    SRV - [2011/09/06 14:45:28 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
    SRV - [2011/08/31 16:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
    SRV - [2011/08/11 17:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE -- (!SASCORE)
    SRV - [2008/08/13 17:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
    SRV - [2008/01/19 01:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
    SRV - [2006/11/07 13:27:02 | 000,070,656 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)


    ========== Driver Services (SafeList) ==========

    DRV - [2011/09/06 14:38:05 | 000,442,200 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
    DRV - [2011/09/06 14:37:53 | 000,320,856 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
    DRV - [2011/09/06 14:36:38 | 000,034,392 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr)
    DRV - [2011/09/06 14:36:36 | 000,052,568 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
    DRV - [2011/09/06 14:36:26 | 000,054,616 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
    DRV - [2011/09/06 14:36:12 | 000,020,568 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
    DRV - [2011/08/31 16:00:50 | 000,022,216 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
    DRV - [2011/07/22 10:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
    DRV - [2011/07/12 15:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
    DRV - [2009/10/27 20:00:30 | 000,030,784 | ---- | M] (Microsoft Corporation) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\nuswvopi.sys -- (nuswvopi)
    DRV - [2007/02/13 03:00:00 | 000,383,800 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
    DRV - [2006/12/01 15:40:46 | 000,647,680 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
    DRV - [2006/11/20 13:13:58 | 000,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
    DRV - [2006/11/20 13:13:58 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
    DRV - [2006/11/20 13:13:56 | 000,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
    DRV - [2006/11/11 17:10:40 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
    DRV - [2006/11/02 01:30:55 | 000,200,704 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
    DRV - [2006/11/02 01:30:53 | 000,045,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
    DRV - [2006/10/30 11:42:28 | 001,786,880 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)
    DRV - [2006/10/24 22:53:08 | 002,068,992 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
    DRV - [2006/10/05 16:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
    DRV - [2006/08/17 15:43:52 | 000,007,424 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\Program Files\DellSupport\Drivers\dsunidrv.sys -- (dsunidrv)
    DRV - [2006/03/21 11:07:33 | 000,095,360 | ---- | M] (Elan Digital Systems Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\elu132.sys -- (elUsbCardBus)
    DRV - [2005/12/15 09:27:52 | 000,034,639 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\FTD2XX.sys -- (elDiag)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========


    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6092

    FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)



    O1 HOSTS File: ([2009/10/27 20:38:32 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
    O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
    O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
    O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll (Dell Inc.)
    O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
    O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
    O4 - HKLM..\Run: [avast] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
    O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
    O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
    O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" File not found
    O4 - HKCU..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} http://support.dell.com/systemprofiler/SysProExe.CAB (WMI Class)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
    O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7C77959A-BBAF-4F4A-A803-AA0AB6C4057A}: DhcpNameServer = 209.18.47.61 209.18.47.62
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D3684C8E-0509-45B9-BE0F-786D46571729}: DhcpNameServer = 209.18.47.61 209.18.47.62
    O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
    O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
    O24 - Desktop WallPaper: C:\Users\Kennedy Rec\Desktop\P1040035.JPG
    O24 - Desktop BackupWallPaper: C:\Users\Kennedy Rec\Desktop\P1040035.JPG
    O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
    O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found.
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2006/09/18 15:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
    O32 - AutoRun File - [2009/08/28 08:22:40 | 000,000,000 | RH-- | M] () - E:\autorun.wbcat -- [ UDF ]
    O32 - AutoRun File - [2009/08/28 08:22:42 | 000,000,132 | ---- | M] () - E:\autorun.inf -- [ UDF ]
    O34 - HKLM BootExecute: (autocheck autochk *)
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    ========== Files/Folders - Created Within 30 Days ==========

    [2011/11/17 21:12:24 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Kennedy Rec\Desktop\OTL.exe
    [2011/11/10 09:11:41 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Portable Devices
    [2011/11/10 08:52:44 | 000,000,000 | ---D | C] -- C:\Windows\pss
    [2011/11/09 17:24:29 | 000,000,000 | ---D | C] -- C:\Users\Kennedy Rec\AppData\Roaming\SUPERAntiSpyware.com
    [2011/11/09 17:23:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
    [2011/11/09 17:23:14 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
    [2011/11/09 17:23:14 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
    [2011/11/09 10:35:16 | 000,000,000 | ---D | C] -- C:\Windows\System32\eu-ES
    [2011/11/09 10:35:16 | 000,000,000 | ---D | C] -- C:\Windows\System32\ca-ES
    [2011/11/09 10:35:15 | 000,000,000 | ---D | C] -- C:\Windows\System32\vi-VN
    [2011/11/09 10:25:37 | 000,000,000 | ---D | C] -- C:\Windows\System32\SPReview
    [2011/11/09 09:09:00 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders
    [2011/11/09 09:05:45 | 000,000,000 | ---D | C] -- C:\e20a8ea623d106bcf201c9
    [2011/11/03 18:17:26 | 000,000,000 | ---D | C] -- C:\Users\Kennedy Rec\Desktop\Cover Letters
    [2011/11/03 18:17:19 | 000,000,000 | ---D | C] -- C:\Users\Kennedy Rec\Desktop\Resumes

    ========== Files - Modified Within 30 Days ==========

    [2011/11/17 21:12:43 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Kennedy Rec\Desktop\OTL.exe
    [2011/11/17 20:05:14 | 000,003,680 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
    [2011/11/17 20:05:14 | 000,003,680 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
    [2011/11/17 19:51:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
    [2011/11/17 10:45:24 | 000,002,533 | ---- | M] () -- C:\Users\Kennedy Rec\Desktop\Microsoft Streets & Trips 2006.lnk
    [2011/11/15 09:34:43 | 000,607,406 | ---- | M] () -- C:\Windows\System32\perfh009.dat
    [2011/11/15 09:34:43 | 000,105,014 | ---- | M] () -- C:\Windows\System32\perfc009.dat
    [2011/11/15 09:29:29 | 2145,849,344 | -HS- | M] () -- C:\hiberfil.sys
    [2011/11/14 10:20:49 | 000,006,656 | ---- | M] () -- C:\Users\Kennedy Rec\Desktop\Boulder Junction, Wisconsin, United States.est
    [2011/11/12 17:32:40 | 000,002,535 | ---- | M] () -- C:\Users\Kennedy Rec\Desktop\HiJackThis.lnk
    [2011/11/10 09:15:42 | 000,378,808 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
    [2011/11/10 09:11:05 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
    [2011/11/10 09:10:17 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
    [2011/11/09 17:23:27 | 000,001,802 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
    [2011/11/09 15:02:36 | 000,302,592 | ---- | M] () -- C:\Users\Kennedy Rec\Desktop\pngsbrwc.exe
    [2011/11/09 12:09:54 | 000,000,418 | RHS- | M] () -- C:\ProgramData\ntuser.pol
    [2011/11/09 11:51:57 | 000,000,945 | ---- | M] () -- C:\Users\Kennedy Rec\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
    [2011/11/09 11:13:17 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat
    [2011/11/09 11:13:17 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat
    [2011/11/09 11:12:49 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
    [2011/11/08 11:50:53 | 000,007,592 | ---- | M] () -- C:\Users\Kennedy Rec\AppData\Local\d3d9caps.dat
    [2011/11/05 13:43:09 | 000,026,383 | ---- | M] () -- C:\Users\Kennedy Rec\Desktop\Mantel.jpg
    [2011/11/05 13:17:23 | 001,835,523 | ---- | M] () -- C:\Users\Kennedy Rec\Desktop\Gun Show.JPG
    [2011/10/24 15:06:12 | 000,127,571 | ---- | M] () -- C:\Users\Kennedy Rec\Desktop\Explorer Title _Abstract[1].pdf

    ========== Files Created - No Company Name ==========

    [2011/11/10 09:11:05 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
    [2011/11/10 09:10:17 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
    [2011/11/09 17:23:27 | 000,001,802 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
    [2011/11/09 15:02:31 | 000,302,592 | ---- | C] () -- C:\Users\Kennedy Rec\Desktop\pngsbrwc.exe
    [2011/11/09 11:12:49 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
    [2011/11/09 09:23:40 | 000,392,170 | ---- | C] () -- C:\Windows\System32\onex.tmf
    [2011/11/09 09:23:35 | 000,009,212 | ---- | C] () -- C:\Windows\System32\RacUR.xml
    [2011/11/09 09:23:35 | 000,000,153 | ---- | C] () -- C:\Windows\System32\RacUREx.xml
    [2011/11/09 09:23:33 | 000,062,976 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
    [2011/11/09 09:23:21 | 000,344,698 | ---- | C] () -- C:\Windows\System32\eaphost.tmf
    [2011/11/09 09:23:17 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
    [2011/11/09 09:23:14 | 000,442,788 | ---- | C] () -- C:\Windows\System32\dot3.tmf
    [2011/11/09 09:21:53 | 000,208,966 | ---- | C] () -- C:\Windows\System32\WFP.TMF
    [2011/11/09 09:21:25 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
    [2011/11/09 09:21:14 | 000,092,918 | ---- | C] () -- C:\Windows\System32\slmgr.vbs
    [2011/11/09 09:21:12 | 000,009,239 | ---- | C] () -- C:\Windows\System32\spcinstrumentation.man
    [2011/11/09 09:21:01 | 000,130,008 | ---- | C] () -- C:\Windows\System32\systemsf.ebd
    [2011/11/05 14:27:10 | 000,026,383 | ---- | C] () -- C:\Users\Kennedy Rec\Desktop\Mantel.jpg
    [2011/11/05 13:17:23 | 001,835,523 | ---- | C] () -- C:\Users\Kennedy Rec\Desktop\Gun Show.JPG
    [2011/10/24 15:06:12 | 000,127,571 | ---- | C] () -- C:\Users\Kennedy Rec\Desktop\Explorer Title _Abstract[1].pdf
    [2010/02/09 19:06:27 | 000,000,418 | RHS- | C] () -- C:\ProgramData\ntuser.pol
    [2009/10/27 20:23:31 | 000,236,544 | ---- | C] () -- C:\Windows\PEV.exe
    [2009/10/27 20:23:31 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
    [2009/10/27 20:23:31 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
    [2009/10/27 20:23:31 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe
    [2009/10/27 20:23:31 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
    [2009/08/03 14:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
    [2009/08/03 14:07:42 | 000,230,768 | ---- | C] () -- C:\Windows\System32\OGAEXEC.exe
    [2009/03/03 18:18:42 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
    [2007/07/30 20:29:08 | 000,004,096 | -H-- | C] () -- C:\Users\Kennedy Rec\AppData\Local\keyfile3.drm
    [2007/02/23 14:24:21 | 000,003,957 | ---- | C] () -- C:\Windows\checkip.dat
    [2007/02/16 18:40:36 | 000,000,254 | ---- | C] () -- C:\Users\Kennedy Rec\AppData\Roaming\wklnhst.dat
    [2007/02/15 17:55:17 | 000,077,824 | ---- | C] () -- C:\Windows\System32\FTDIUNIN.exe
    [2007/02/15 17:55:17 | 000,000,077 | ---- | C] () -- C:\Windows\System32\elu132u1.ini
    [2007/02/15 17:55:17 | 000,000,077 | ---- | C] () -- C:\Windows\System32\elu132u0.ini
    [2007/02/14 16:54:10 | 000,007,592 | ---- | C] () -- C:\Users\Kennedy Rec\AppData\Local\d3d9caps.dat
    [2007/02/14 15:43:45 | 000,017,408 | ---- | C] () -- C:\Users\Kennedy Rec\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2007/02/09 13:55:58 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat
    [2007/02/09 13:55:58 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
    [2007/02/09 13:55:58 | 000,138,101 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
    [2007/02/09 13:55:42 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll
    [2007/02/09 13:55:32 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
    [2007/02/09 06:33:24 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
    [2007/02/09 06:21:23 | 000,000,120 | ---- | C] () -- C:\Windows\wininit.ini
    [2006/11/02 06:56:48 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
    [2006/11/02 06:47:43 | 000,378,808 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
    [2006/11/02 04:33:01 | 000,607,406 | ---- | C] () -- C:\Windows\System32\perfh009.dat
    [2006/11/02 04:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
    [2006/11/02 04:33:01 | 000,105,014 | ---- | C] () -- C:\Windows\System32\perfc009.dat
    [2006/11/02 04:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
    [2006/11/02 04:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
    [2006/11/02 02:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
    [2006/11/02 02:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
    [2006/11/02 01:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
    [2006/11/02 01:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
    [2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI

    ========== LOP Check ==========

    [2008/09/10 20:00:15 | 000,000,000 | ---D | M] -- C:\Users\Kennedy Rec\AppData\Roaming\GlarySoft
    [2011/04/28 17:17:27 | 000,000,000 | ---D | M] -- C:\Users\Kennedy Rec\AppData\Roaming\navionicsChartInstaller.Air.A3B2DB703D5E0A7ECA24FBD4B07176191EDD3C63.1
    [2008/08/12 19:47:24 | 000,000,000 | ---D | M] -- C:\Users\Kennedy Rec\AppData\Roaming\Snapfish
    [2007/02/16 18:40:38 | 000,000,000 | ---D | M] -- C:\Users\Kennedy Rec\AppData\Roaming\Template
    [2011/11/15 09:14:07 | 000,032,594 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

    ========== Purity Check ==========



    ========== Alternate Data Streams ==========

    @Alternate Data Stream - 76 bytes -> C:\Users\Kennedy Rec\Documents\My Google Gadgets:Roxio EMC Stream
    @Alternate Data Stream - 1524 bytes -> C:\Windows\System32\drivers\nuswvopi.sys:changelist
    @Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:DFC5A2B2
    < End of report >
     
  6. eddie5659

    eddie5659 Moderator Malware Specialist

    Joined:
    Mar 19, 2001
    Messages:
    37,197
    Thanks :)

    Please download JavaRa to your desktop and unzip it to its own folder
    • Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
    • Accept any prompts.
    • Now, go here and download the latest Java Version.

    After doing that, can you do this for me:

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following
      Code:
      :OTL
      IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local
      IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6092
      O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" File not found
      O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_25)
      O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_25)
      O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found.
      @Alternate Data Stream - 1524 bytes -> C:\Windows\System32\drivers\nuswvopi.sys:changelist
      @Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:DFC5A2B2
      :Files
      ipconfig /flushdns /c 
      :Commands 
      [purity] 
      [resethosts] 
      [emptytemp] 
      [EMPTYFLASH] 
      [CREATERESTOREPOINT] 
      [Reboot]
    • Then click the Run Fix button at the top
    • Click OK.
    • OTL may ask to reboot the machine. Please do so if asked.
    • The report should appear in Notepad after the reboot. Copy/Paste the report in your next reply


    eddie
     
  7. KennedyRec

    KennedyRec Thread Starter

    Joined:
    Nov 9, 2011
    Messages:
    4
    Here you go:

    All processes killed
    ========== OTL ==========
    HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
    HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched deleted successfully.
    Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}\ not found.
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
    ADS C:\Windows\System32\drivers\nuswvopi.sys:changelist deleted successfully.
    ADS C:\ProgramData\TEMP:DFC5A2B2 deleted successfully.
    ========== FILES ==========
    < ipconfig /flushdns /c >
    Windows IP Configuration
    Successfully flushed the DNS Resolver Cache.
    C:\Users\Kennedy Rec\Desktop\cmd.bat deleted successfully.
    C:\Users\Kennedy Rec\Desktop\cmd.txt deleted successfully.
    ========== COMMANDS ==========
    C:\Windows\System32\drivers\etc\Hosts moved successfully.
    HOSTS file reset successfully

    [EMPTYTEMP]

    User: All Users

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes
    ->Flash cache emptied: 56466 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Kennedy Rec
    ->Temp folder emptied: 14673507 bytes
    ->Temporary Internet Files folder emptied: 408766431 bytes
    ->Java cache emptied: 2208783 bytes
    ->Flash cache emptied: 3318099 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 62100820 bytes
    RecycleBin emptied: 42997945 bytes

    Total Files Cleaned = 509.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Default
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: Kennedy Rec
    ->Flash cache emptied: 0 bytes

    User: Public

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.31.0 log created on 11202011_195328
    Files\Folders moved on Reboot...
    File\Folder C:\Users\Kennedy Rec\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UP1SMZ2H\bind[3].htm not found!
    File\Folder C:\Users\Kennedy Rec\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OVEU1XRL\espn_go_com[1].htm not found!
    C:\Users\Kennedy Rec\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OVEU1XRL\mail[4].htm moved successfully.
    File\Folder C:\Users\Kennedy Rec\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\COWJ5WMH\streakModule[1].htm not found!
    C:\Users\Kennedy Rec\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3T5BZ6PM\mail[1].htm moved successfully.
    C:\Users\Kennedy Rec\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0BCY7VT9\mail[2].htm moved successfully.
    File\Folder C:\Windows\temp\_avast_\unp176828600.tmp not found!
    File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.
    Registry entries deleted on Reboot...
     
  8. eddie5659

    eddie5659 Moderator Malware Specialist

    Joined:
    Mar 19, 2001
    Messages:
    37,197
    Download ComboFix from one of these locations:

    Link 1
    Link 2


    * IMPORTANT !!! As you download it rename it to username123.exe and save it to your Desktop


    • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      • Remember to re-enable the protection again afterwards before connecting to the Internet.
    • Double click on ComboFix.exe & follow the prompts.

    • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


    [​IMG]


    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

    [​IMG]


    Click on Yes, to continue scanning for malware.

    When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

    eddie
     
  9. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/1026193

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice