|
Malware Removal Discussion about Trojans, viruses, hoaxes, firewalls, spyware, and general Security issues. If you suspect your PC is infected with a virus, trojan or spyware app please include any supporting documentation or logs |
![]() |
|
Topic Tools |
#16
|
||||
|
||||
Ran ESET online scanner - everything looks OK!
ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=7 # iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339) # OnlineScanner.ocx=1.0.0.6211 # api_version=3.0.2 # EOSSerial=ef98bfd58848f34f846469352b5802f9 # end=finished # remove_checked=true # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2009-12-05 11:13:07 # local_time=2009-12-06 12:13:07 (+0100, West-Europa (standaardtijd)) # country="United Kingdom" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=5121 16776613 100 96 1232186 13000079 0 0 # compatibility_mode=8192 67108863 100 0 8415 8415 0 0 # scanned=96630 # found=0 # cleaned=0 # scan_time=3035 |
#17
|
||||
|
||||
Great
![]() Please post back with a fresh OTL logfile and we will cleanup our work. |
#18
|
||||
|
||||
OTL.txt part 1
OTL logfile created on: 06/12/2009 13:32:24 - Run 3
OTL by OldTimer - Version 3.1.11.6 Folder = K:\cth Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000809 | Country: Verenigd Koninkrijk | Language: ENG | Date Format: dd/MM/yyyy 2.00 Gb Total Physical Memory | 1.39 Gb Available Physical Memory | 69.30% Memory free 2.60 Gb Paging File | 2.08 Gb Available in Paging File | 80.00% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 108.52 Gb Total Space | 66.90 Gb Free Space | 61.65% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Drive J: | 74.53 Gb Total Space | 63.58 Gb Free Space | 85.31% Space Free | Partition Type: NTFS Drive K: | 963.70 Mb Total Space | 892.22 Mb Free Space | 92.58% Space Free | Partition Type: FAT Computer Name: GWJARDINE Current User Name: Dad Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard ========== Processes (SafeList) ========== PRC - [2009/12/05 14:00:34 | 00,536,064 | ---- | M] (OldTimer Tools) -- K:\cth\OTL.exe PRC - [2009/10/29 06:54:44 | 01,218,008 | ---- | M] (McAfee, Inc.) -- c:\Program Files\McAfee.com\Agent\mcagent.exe PRC - [2009/10/27 11:19:46 | 00,895,696 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MPF\MpfSrv.exe PRC - [2009/09/21 19:52:27 | 00,520,024 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe PRC - [2009/09/21 19:52:26 | 01,028,432 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe PRC - [2009/09/16 10:22:08 | 00,144,704 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\Mcshield.exe PRC - [2009/09/16 09:28:38 | 00,606,736 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe PRC - [2009/07/10 00:26:20 | 00,865,832 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MSC\mcmscsvc.exe PRC - [2009/07/08 11:54:34 | 00,359,952 | ---- | M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe PRC - [2009/07/07 19:10:02 | 02,482,848 | ---- | M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe PRC - [2009/07/07 17:45:22 | 00,436,752 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\McAfee\MSC\McUICnt.exe PRC - [2009/05/07 23:30:22 | 00,192,128 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MSM\McSmtFwk.exe PRC - [2009/03/08 14:09:26 | 00,638,816 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe PRC - [2009/01/23 09:46:14 | 00,203,280 | ---- | M] () -- C:\Program Files\McAfee\SiteAdvisor\McSACore.exe PRC - [2008/04/14 18:02:58 | 01,037,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007/01/31 14:55:42 | 00,096,370 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe PRC - [2006/11/13 13:39:52 | 01,289,000 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft ActiveSync\wcescomm.exe PRC - [2006/11/13 13:39:34 | 00,199,464 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft ActiveSync\rapimgr.exe PRC - [2006/10/18 20:05:26 | 00,204,288 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnscfg.exe PRC - [2006/06/05 12:59:18 | 00,174,080 | ---- | M] (Nokia.) -- C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe PRC - [2006/05/16 22:15:10 | 00,071,288 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe PRC - [2005/06/06 22:46:24 | 00,057,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe PRC - [2004/05/12 15:18:56 | 00,241,664 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\HP\hpcoretech\hpcmpmgr.exe PRC - [2003/07/28 14:43:44 | 00,188,416 | ---- | M] (HP) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb0 9.exe PRC - [2003/07/28 13:19:00 | 00,077,824 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe PRC - [2003/07/10 13:34:10 | 00,139,264 | ---- | M] (InterVideo Inc.) -- C:\Program Files\InterVideo\WinDVR\WinScheduler.exe PRC - [2003/06/25 11:24:48 | 00,049,152 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd.exe PRC - [2003/05/21 18:37:08 | 00,229,437 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe PRC - [2002/09/11 13:00:00 | 00,016,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\unsecapp.exe PRC - [2001/05/01 16:06:22 | 00,053,248 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\MsPMSPSv.exe ========== Modules (SafeList) ========== MOD - [2009/12/05 14:00:34 | 00,536,064 | ---- | M] (OldTimer Tools) -- K:\cth\OTL.exe MOD - [2009/01/23 09:46:18 | 00,013,840 | ---- | M] () -- C:\Program Files\McAfee\SiteAdvisor\sahook.dll ========== Win32 Services (SafeList) ========== SRV - [2009/10/27 11:19:46 | 00,895,696 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MPF\MPFSrv.exe -- (MpfService) SRV - [2009/09/21 19:52:26 | 01,028,432 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service) SRV - [2009/09/16 11:23:32 | 00,365,072 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS) SRV - [2009/09/16 10:22:08 | 00,144,704 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\Mcshield.exe -- (McShield) SRV - [2009/09/16 09:28:38 | 00,606,736 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe -- (McSysmon) SRV - [2009/07/10 00:26:20 | 00,865,832 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MSC\mcmscsvc.exe -- (mcmscsvc) SRV - [2009/07/08 11:54:34 | 00,359,952 | ---- | M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe -- (McProxy) SRV - [2009/07/07 19:10:02 | 02,482,848 | ---- | M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe -- (McNASvc) SRV - [2009/01/23 09:46:14 | 00,203,280 | ---- | M] () -- C:\Program Files\McAfee\SiteAdvisor\McSACore.exe -- (McAfee SiteAdvisor Service) SRV - [2008/11/04 01:06:28 | 00,441,712 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2007/01/31 14:55:42 | 00,096,370 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8) SRV - [2006/10/26 13:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2006/06/05 12:59:18 | 00,174,080 | ---- | M] (Nokia.) -- C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe -- (ServiceLayer) SRV - [2005/04/03 23:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT) SRV - [2003/07/28 14:07:58 | 00,278,528 | R--- | M] (HP) -- C:\WINDOWS\system32\hpdj -- (hpdj) SRV - [2003/07/28 13:19:00 | 00,077,824 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc) SRV - [2003/06/24 17:22:48 | 00,020,480 | ---- | M] (X10) -- C:\WINDOWS\system32\x10nets.exe -- (x10nets) SRV - [2001/05/01 16:06:22 | 00,053,248 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\MsPMSPSv.exe -- (WMDM PMSP Service) ========== Driver Services (SafeList) ========== DRV - [2009/10/25 06:11:34 | 00,077,312 | ---- | M] () -- C:\WINDOWS\MBR.exe -- (mbr) DRV - [2009/09/16 10:22:48 | 00,214,664 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\system32\drivers\mfehidk.sys -- (mfehidk) DRV - [2009/09/16 10:22:48 | 00,079,816 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\system32\drivers\mfeavfk.sys -- (mfeavfk) DRV - [2009/09/16 10:22:48 | 00,040,552 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\system32\drivers\mfesmfk.sys -- (mfesmfk) DRV - [2009/09/16 10:22:48 | 00,035,272 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\system32\drivers\mfebopk.sys -- (mfebopk) DRV - [2009/09/16 10:22:14 | 00,034,248 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\system32\drivers\mferkdk.sys -- (mferkdk) DRV - [2009/08/30 19:33:49 | 00,082,380 | ---- | M] (Oak Technology Inc.) -- C:\WINDOWS\system32\drivers\AFS2K.SYS -- (AFS2K) DRV - [2009/07/16 12:32:26 | 00,120,136 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\system32\drivers\Mpfp.sys -- (MPFP) DRV - [2009/04/24 18:52:58 | 00,064,160 | ---- | M] (Lavasoft AB) -- C:\WINDOWS\system32\DRIVERS\Lbd.sys -- (Lbd) DRV - [2009/02/10 04:34:04 | 00,043,872 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20) DRV - [2009/02/10 04:34:00 | 00,009,200 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\system32\drivers\cdralw2k.sys -- (Cdralw2k) DRV - [2009/02/10 04:34:00 | 00,009,072 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\system32\drivers\cdr4_xp.sys -- (Cdr4_xp) DRV - [2008/04/13 19:56:49 | 00,012,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\usb8023x.sys -- (usb_rndisx) DRV - [2008/04/13 19:45:12 | 00,060,032 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\usbaudio.sys -- (usbaudio) DRV - [2008/04/13 19:36:39 | 00,043,008 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\WINDOWS\System32\DRIVERS\amdagp.sys -- (amdagp) DRV - [2008/04/13 19:36:39 | 00,040,960 | ---- | M] (Silicon Integrated Systems Corporation) -- C:\WINDOWS\System32\DRIVERS\sisagp.sys -- (sisagp) DRV - [2007/11/13 11:25:55 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv) DRV - [2005/12/15 12:57:46 | 01,368,000 | ---- | M] (C-Media Inc) -- C:\WINDOWS\system32\drivers\cmuda.sys -- (cmuda) DRV - [2005/08/30 00:49:38 | 00,094,000 | ---- | M] (MCCI) -- C:\WINDOWS\system32\drivers\ssm_mdm.sys -- (ssm_mdm) DRV - [2005/08/30 00:49:34 | 00,008,336 | ---- | M] (MCCI) -- C:\WINDOWS\system32\drivers\ssm_mdfl.sys -- (ssm_mdfl) DRV - [2005/08/30 00:47:38 | 00,058,320 | ---- | M] (MCCI) -- C:\WINDOWS\system32\drivers\ssm_bus.sys -- (ssm_bus) SAMSUNG Mobile USB Device II 1.0 driver (WDM) DRV - [2005/04/29 02:05:58 | 00,026,672 | ---- | M] (Windows (R) 2000 DDK provider) -- C:\WINDOWS\system32\drivers\UimBus.sys -- (UimBus) DRV - [2005/04/27 11:03:24 | 00,120,995 | ---- | M] () -- C:\WINDOWS\system32\drivers\Uim_IM.sys -- (Uim_IM) DRV - [2003/11/01 21:19:38 | 00,017,920 | ---- | M] (CEntrance, Inc.) -- C:\WINDOWS\system32\drivers\ceusbaud.sys -- (CEUSBAUD) DRV - [2003/09/19 07:34:06 | 00,759,050 | R--- | M] (Creative Technology Ltd.) -- C:\WINDOWS\system32\drivers\P1120Vid.sys -- (P1120VID) DRV - [2003/09/16 03:16:00 | 00,126,352 | ---- | M] () -- C:\WINDOWS\system32\drivers\NVCAP.SYS -- (nvcap) nVidia WDM Video Capture (universal) DRV - [2003/09/16 03:16:00 | 00,022,644 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\drivers\NVTVSND.SYS -- (nvtvSND) DRV - [2003/09/16 03:16:00 | 00,020,580 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\drivers\NVTUNEP.SYS -- (nvTUNEP) DRV - [2003/09/16 03:16:00 | 00,013,330 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\drivers\NVXBAR.SYS -- (NVXBAR) DRV - [2003/07/28 13:19:00 | 01,341,339 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2003/06/12 18:31:46 | 00,075,904 | ---- | M] (VIA Technologies inc,.ltd) -- C:\WINDOWS\SYSTEM32\DRIVERS\viasraid.sys -- (viasraid) DRV - [2003/03/04 11:56:26 | 00,145,408 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\drivers\e100b325.sys -- (E100B) Intel(R) DRV - [2003/02/11 18:38:58 | 00,064,384 | ---- | M] (Promise Technology, Inc.) -- C:\WINDOWS\SYSTEM32\DRIVERS\ulsata.sys -- (UlSata) DRV - [2002/10/21 19:40:04 | 00,006,016 | ---- | M] (Silicon Integrated Systems Corp.) -- C:\WINDOWS\SYSTEM32\DRIVERS\siside.sys -- (SiSide) DRV - [2002/10/01 08:22:32 | 00,009,856 | ---- | M] (Padus, Inc.) -- C:\WINDOWS\system32\drivers\pfc.sys -- (pfc) DRV - [2002/09/11 13:00:00 | 00,179,584 | ---- | M] (Mylex Corporation) -- C:\WINDOWS\System32\DRIVERS\dac2w2k.sys -- (dac2w2k) DRV - [2002/09/11 13:00:00 | 00,049,024 | ---- | M] (QLogic Corporation) -- C:\WINDOWS\System32\DRIVERS\ql1280.sys -- (ql1280) DRV - [2002/09/11 13:00:00 | 00,045,312 | ---- | M] (QLogic Corporation) -- C:\WINDOWS\System32\DRIVERS\ql12160.sys -- (ql12160) DRV - [2002/09/11 13:00:00 | 00,040,320 | ---- | M] (QLogic Corporation) -- C:\WINDOWS\System32\DRIVERS\ql1080.sys -- (ql1080) DRV - [2002/09/11 13:00:00 | 00,036,736 | ---- | M] (Promise Technology, Inc.) -- C:\WINDOWS\System32\DRIVERS\ultra.sys -- (ultra) DRV - [2002/09/11 13:00:00 | 00,032,640 | ---- | M] (LSI Logic) -- C:\WINDOWS\System32\DRIVERS\symc8xx.sys -- (symc8xx) DRV - [2002/09/11 13:00:00 | 00,030,688 | ---- | M] (LSI Logic) -- C:\WINDOWS\System32\DRIVERS\sym_u3.sys -- (sym_u3) DRV - [2002/09/11 13:00:00 | 00,028,384 | ---- | M] (LSI Logic) -- C:\WINDOWS\System32\DRIVERS\sym_hi.sys -- (sym_hi) DRV - [2002/09/11 13:00:00 | 00,026,496 | ---- | M] (Advanced System Products, Inc.) -- C:\WINDOWS\System32\DRIVERS\asc.sys -- (asc) DRV - [2002/09/11 13:00:00 | 00,019,072 | ---- | M] (Adaptec, Inc.) -- C:\WINDOWS\System32\DRIVERS\sparrow.sys -- (Sparrow) DRV - [2002/09/11 13:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink) DRV - [2002/09/11 13:00:00 | 00,017,280 | ---- | M] (American Megatrends Inc.) -- C:\WINDOWS\System32\DRIVERS\mraid35x.sys -- (mraid35x) DRV - [2002/09/11 13:00:00 | 00,016,256 | ---- | M] (Symbios Logic Inc.) -- C:\WINDOWS\System32\DRIVERS\symc810.sys -- (symc810) DRV - [2002/09/11 13:00:00 | 00,014,848 | ---- | M] (Advanced System Products, Inc.) -- C:\WINDOWS\System32\DRIVERS\asc3550.sys -- (asc3550) DRV - [2002/09/11 13:00:00 | 00,006,656 | ---- | M] (CMD Technology, Inc.) -- C:\WINDOWS\System32\DRIVERS\cmdide.sys -- (CmdIde) DRV - [2002/09/11 13:00:00 | 00,005,248 | ---- | M] (Acer Laboratories Inc.) -- C:\WINDOWS\System32\DRIVERS\aliide.sys -- (AliIde) DRV - [2002/05/22 06:29:04 | 00,026,112 | ---- | M] () -- C:\WINDOWS\system32\drivers\wdmwanmp.sys -- (WDMWANMP) DRV - [2002/05/22 06:26:52 | 00,587,776 | ---- | M] () -- C:\WINDOWS\System32\DRIVERS\WDMCAPI.sys -- (WDMCAPI) DRV - [2001/10/18 19:00:00 | 00,006,144 | ---- | M] (VIA Technologies, Inc.) -- C:\WINDOWS\SYSTEM32\DRIVERS\viaidexp.sys -- (viaide1) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\C urrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Inter net Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.standbyservice.nl IE - HKU\S-1-5-19\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Inter net Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.standbyservice.nl IE - HKU\S-1-5-20\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Inter net Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1045052069-2688705137-1675932612-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.hotsheet.com/ IE - HKU\S-1-5-21-1045052069-2688705137-1675932612-1006\S-1-5-21-1045052069-2688705137-1675932612-1006\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FA A-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2009/08/30 14:40:59 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2009/09/02 14:56:12 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2008/06/28 12:46:03 | 00,000,000 | ---D | M] [2008/12/22 21:06:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Dad\Application Data\Mozilla\Extensions [2008/12/22 21:06:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Dad\Application Data\Mozilla\Extensions\home2@tomtom.com |
#19
|
||||
|
||||
OTL.txt part 2
O1 HOSTS File: (776 bytes) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.) O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll () O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll () O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft) O4 - HKLM..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard) O4 - HKLM..\Run: [HP Component Manager] C:\Program Files\HP\hpcoretech\hpcmpmgr.exe (Hewlett-Packard Company) O4 - HKLM..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe (Hewlett-Packard) O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb0 9.exe (HP) O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [NVIDIA Remote Control Panel] File not found O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation) O4 - HKLM..\Run: [WINSCHEDULER] C:\Program Files\InterVideo\WinDVR\WinScheduler.exe (InterVideo Inc.) O4 - HKU\.DEFAULT..\Run: [NvMediaCenter] C:\WINDOWS\System32\NVMCTRAY.DLL (NVIDIA Corporation) O4 - HKU\S-1-5-18..\Run: [NvMediaCenter] C:\WINDOWS\System32\NVMCTRAY.DLL (NVIDIA Corporation) O4 - HKU\S-1-5-21-1045052069-2688705137-1675932612-1006..\Run: [H/PC Connection Agent] C:\Program Files\Microsoft ActiveSync\wcescomm.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-1045052069-2688705137-1675932612-1006..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe (Adobe Systems Incorporated) O4 - HKU\S-1-5-21-1045052069-2688705137-1675932612-1006..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated) O4 - Startup: C:\Documents and Settings\Dad\Menu Start\Programma's\Opstarten\OneNote-inhoudsopgave.onetoc2 () O4 - Startup: C:\Documents and Settings\Joy\Menu Start\Programma's\Opstarten\OneNote 2007 Schermopname en Snel starten.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: LinkResolveIgnoreLinkInfo = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoResolveSearch = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoCDBurning = 0 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVer sion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVer sion\policies\Explorer: CDRAutoRun = 0 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVer sion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\polic ies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\polic ies\Explorer: CDRAutoRun = 0 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\polic ies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\polic ies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Recovery present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\polic ies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Recovery present O7 - HKU\S-1-5-21-1045052069-2688705137-1675932612-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-1045052069-2688705137-1675932612-1006\Software\Policies\Microsoft\Internet Explorer\Recovery present O7 - HKU\S-1-5-21-1045052069-2688705137-1675932612-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S-1-5-21-1045052069-2688705137-1675932612-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: LinkResolveIgnoreLinkInfo = 0 O7 - HKU\S-1-5-21-1045052069-2688705137-1675932612-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-21-1045052069-2688705137-1675932612-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDrives = 0 O7 - HKU\S-1-5-21-1045052069-2688705137-1675932612-1006_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-1045052069-2688705137-1675932612-1006_Classes\Software\Policies\Microsoft\Internet Explorer\Recovery present O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: E&xporteren naar Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_13.dll (Sun Microsystems, Inc.) O9 - Extra Button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKU\S-1-5-21-1045052069-2688705137-1675932612-1006\..Trusted Domains: 34 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} Reg Error: Key error. (PCPitstop Utility) O16 - DPF: {15589FA1-C456-11CE-BF01-000000000000} http://www.errornuker.com/products/e...rInstaller.exe (Reg Error: Value error.) O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} Reg Error: Key error. (Trend Micro ActiveX Scan Agent 6.6) O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} Reg Error: Key error. (Reg Error: Key error.) O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {BC0AE9E6-E549-4554-A222-EA083A894683} http://a01-b01.mypicturetown.com/P2P.../x/Upld_47.CAB (QuickUpload) O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} http://download.mcafee.com/molbin/sh...26/mcgdmgr.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/s...sh/swflash.cab (Shockwave Flash Object) O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.) O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138 O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll () O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Mijn huidige introductiepagina) - About:Home O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2003/11/17 21:46:34 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe () O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2009/12/05 22:02:20 | 00,000,000 | ---D | C] -- C:\Program Files\ESET [2009/12/05 17:35:14 | 00,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2009/12/05 17:35:14 | 00,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2009/12/05 17:35:14 | 00,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2009/12/05 17:35:14 | 00,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2009/12/05 17:31:25 | 00,000,000 | ---D | C] -- C:\Qoobox [2009/12/05 12:35:01 | 00,157,712 | ---- | C] (Trend Micro Inc.) -- C:\WINDOWS\System32\drivers\tmcomm.sys [2009/11/16 20:59:29 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Dad\Bureaublad\html [2009/11/15 15:01:23 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Dad\Application Data\FileZilla [2009/11/15 15:01:11 | 00,000,000 | ---D | C] -- C:\Program Files\FileZilla FTP Client [2009/11/14 16:41:08 | 00,000,000 | ---D | C] -- J:\Documents and Settings\Dad\Mijn documenten\HTML [2008/01/28 20:50:41 | 00,774,144 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\RngInterstitial.dll [2006/04/28 10:41:32 | 00,009,216 | ---- | C] ( ) -- C:\WINDOWS\System32\capi2032.dll [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2009/12/06 13:14:24 | 00,013,322 | ---- | M] () -- J:\Documents and Settings\Dad\Mijn documenten\Shed.xlsx [2009/12/06 11:01:22 | 00,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009/12/06 11:01:19 | 00,015,689 | ---- | M] () -- C:\WINDOWS\System32\Config.MPF [2009/12/06 11:00:04 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009/12/06 11:00:01 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009/12/06 01:01:02 | 07,077,888 | ---- | M] () -- C:\Documents and Settings\Dad\ntuser.dat [2009/12/06 01:01:02 | 00,000,188 | -HS- | M] () -- C:\Documents and Settings\Dad\ntuser.ini [2009/12/06 01:00:37 | 04,868,722 | -H-- | M] () -- C:\Documents and Settings\Dad\Local Settings\Application Data\IconCache.db [2009/12/06 00:29:29 | 00,082,856 | ---- | M] () -- C:\Documents and Settings\Dad\Local Settings\Application Data\GDIPFONTCACHEV1.DAT [2009/12/05 18:15:05 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2009/12/05 12:31:46 | 00,000,036 | ---- | M] () -- C:\Documents and Settings\Dad\Local Settings\Application Data\housecall.guid.cache [2009/12/04 19:52:30 | 00,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job [2009/12/04 16:59:52 | 00,000,108 | -H-- | M] () -- C:\WINDOWS\System32\x10prod.sys [2009/12/03 16:14:06 | 00,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2009/12/03 16:13:56 | 00,019,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2009/11/30 20:00:50 | 00,188,928 | ---- | M] () -- C:\Documents and Settings\Dad\Bureaublad\Kalender2009.xls [2009/11/28 22:31:08 | 00,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2009/11/22 09:44:47 | 00,298,848 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2009/11/14 01:47:57 | 00,260,608 | ---- | M] () -- C:\WINDOWS\PEV.exe [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] |
#20
|
||||
|
||||
OTL.txt part 3
========== Files Created - No Company Name ==========
[2009/12/06 13:14:24 | 00,013,322 | ---- | C] () -- J:\Documents and Settings\Dad\Mijn documenten\Shed.xlsx [2009/12/05 17:35:14 | 00,260,608 | ---- | C] () -- C:\WINDOWS\PEV.exe [2009/12/05 17:35:14 | 00,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe [2009/12/05 17:35:14 | 00,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe [2009/12/05 17:35:14 | 00,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe [2009/12/05 17:35:14 | 00,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe [2009/12/05 12:31:46 | 00,000,036 | ---- | C] () -- C:\Documents and Settings\Dad\Local Settings\Application Data\housecall.guid.cache [2009/12/04 16:59:52 | 00,000,108 | -H-- | C] () -- C:\WINDOWS\System32\x10prod.sys [2009/11/30 20:00:49 | 00,188,928 | ---- | C] () -- C:\Documents and Settings\Dad\Bureaublad\Kalender2009.xls [2009/02/11 20:01:16 | 00,002,528 | ---- | C] () -- C:\Documents and Settings\Dad\Application Data\$_hpcst$.hpc [2008/08/03 11:51:26 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\PKP_DLbz.DAT [2008/08/03 11:20:46 | 00,000,268 | RH-- | C] () -- C:\Documents and Settings\All Users\Application Data\Piano Med [2008/08/03 11:20:46 | 00,000,020 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\PKP_DLdw.DAT [2008/08/03 11:17:54 | 00,000,268 | RH-- | C] () -- C:\Documents and Settings\All Users\Application Data\Piano [2008/08/03 11:17:54 | 00,000,020 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT [2008/04/20 20:06:27 | 00,081,920 | R--- | C] () -- C:\WINDOWS\System32\srctrl.dll [2008/04/20 20:01:45 | 02,729,472 | ---- | C] () -- C:\WINDOWS\System32\fun_avcodec.dll [2007/09/05 15:50:45 | 00,000,125 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2007/04/07 13:55:10 | 00,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll [2007/04/07 13:55:07 | 00,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll [2007/04/07 13:55:07 | 00,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll [2007/04/07 13:55:07 | 00,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll [2007/04/07 13:55:07 | 00,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll [2007/04/07 13:55:07 | 00,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll [2007/02/18 13:21:20 | 00,000,000 | ---- | C] () -- C:\WINDOWS\WinHDM.INI [2007/02/18 13:01:40 | 03,870,720 | ---- | C] () -- C:\WINDOWS\System32\qt-mt323.dll [2007/02/18 13:01:16 | 00,006,160 | ---- | C] () -- C:\WINDOWS\System32\drivers\UimFIO.sys [2007/02/18 13:01:15 | 00,120,995 | ---- | C] () -- C:\WINDOWS\System32\drivers\Uim_IM.sys [2007/02/18 13:01:04 | 00,006,656 | ---- | C] () -- C:\WINDOWS\System32\WnASPI32.dll [2006/12/09 21:38:51 | 00,050,176 | ---- | C] () -- C:\Documents and Settings\Dad\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2006/11/05 14:13:06 | 00,000,063 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\Ts_infos.ini [2006/10/29 13:42:34 | 00,002,148 | ---- | C] () -- C:\WINDOWS\cdplayer.ini [2006/10/05 09:47:15 | 00,063,488 | ---- | C] () -- C:\WINDOWS\xobglu16.dll [2006/10/05 09:47:15 | 00,023,552 | ---- | C] () -- C:\WINDOWS\xobglu32.dll [2006/09/24 17:32:49 | 00,001,743 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache [2006/09/14 16:49:44 | 00,000,176 | ---- | C] () -- C:\WINDOWS\wininit.ini [2006/08/28 06:46:16 | 00,000,003 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\DragToDiscUserNameE.txt [2006/06/16 15:32:48 | 00,000,112 | ---- | C] () -- C:\WINDOWS\ActiveSkin.INI [2006/05/22 15:14:47 | 00,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI [2006/05/21 21:36:59 | 00,000,021 | ---- | C] () -- C:\WINDOWS\VI_setup.ini [2006/05/21 21:35:22 | 00,000,021 | ---- | C] () -- C:\WINDOWS\GCC_setup.ini [2006/05/21 21:34:45 | 00,000,021 | ---- | C] () -- C:\WINDOWS\ME_setup.ini [2006/05/21 21:34:14 | 00,000,021 | ---- | C] () -- C:\WINDOWS\PI_SETUP.ini [2006/05/20 10:42:41 | 00,000,049 | ---- | C] () -- C:\WINDOWS\wpd99.drv [2006/05/20 10:42:31 | 00,000,028 | ---- | C] () -- C:\WINDOWS\pdf995.ini [2006/05/20 10:39:48 | 00,118,784 | ---- | C] () -- C:\WINDOWS\System32\pdfmona.dll [2006/05/20 10:39:48 | 00,051,716 | ---- | C] () -- C:\WINDOWS\System32\pdf995mon.dll [2006/05/17 19:06:44 | 00,012,190 | ---- | C] () -- C:\WINDOWS\hpdj5100.ini [2006/05/14 16:22:41 | 00,000,580 | ---- | C] () -- C:\WINDOWS\hegames.ini [2006/04/28 22:33:53 | 00,000,126 | ---- | C] () -- C:\Documents and Settings\Dad\Local Settings\Application Data\fusioncache.dat [2006/04/28 10:45:46 | 00,126,352 | ---- | C] () -- C:\WINDOWS\System32\drivers\NVCAP.SYS [2006/04/28 10:41:33 | 01,900,544 | ---- | C] () -- C:\WINDOWS\System32\cmiwcnfg.dll [2006/04/28 10:41:33 | 00,028,672 | ---- | C] () -- C:\WINDOWS\System32\cmirmdrv.dll [2006/04/28 10:41:32 | 00,587,776 | ---- | C] () -- C:\WINDOWS\System32\drivers\WDMCAPI.sys [2006/04/28 10:41:32 | 00,038,667 | ---- | C] () -- C:\WINDOWS\System32\isdncoin.dll [2006/04/28 10:41:32 | 00,026,112 | ---- | C] () -- C:\WINDOWS\System32\drivers\wdmwanmp.sys [2006/04/28 10:41:32 | 00,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll [2006/04/28 10:41:32 | 00,008,976 | ---- | C] () -- C:\WINDOWS\System32\capi20.dll [2006/04/28 10:41:25 | 00,027,136 | ---- | C] () -- C:\WINDOWS\System32\nvcod.dll [2003/11/17 23:31:41 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2003/11/17 23:00:46 | 00,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2003/11/17 22:32:39 | 00,000,979 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2003/11/17 21:56:34 | 00,000,818 | ---- | C] () -- C:\WINDOWS\orun32.ini [1998/08/16 05:00:00 | 00,004,096 | ---- | C] () -- C:\WINDOWS\System32\sysres.dll ========== Alternate Data Streams ========== @Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP ![]() @Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34 < End of report > Regards, Graham. |
#21
|
||||
|
||||
Hi,
Step 1 Run OTL
Step 1 Delete ComboFix and Clean Up Click Start > Run > type combofix /Uninstall > OK (Note the space between combofix and /Uninstall) Please advise if this step is missed for any reason as it performs some important actions. Step 3 Doubleclick OTL one more time and hit Cleanup. That will remove OTL and all helper tools. Your machine appears to be clean, please take the time to read below on how to secure the machine and take the necessary steps to keep it Clean ![]() Below I have outlined a series of categories that outline how you can increase the security of your computer so that you will not be infected again in the future. Practice Safe Internet One of the main reasons people get infected in the first place is that they are not practicing Safe Internet. You practice Safe Internet when you educate yourself on how to properly use the Internet through the use of security tools and good practice. Knowing how you can get infected and what types of files and sites to avoid will be the most crucial step in keeping your computer malware free. The reality is that the majority of people who are infected with malware are ones who click on things they shouldn't be clicking on. Whether these things are files or sites it doesn't really matter. If something is out to get you, and you click on it, it most likely will. Below are a list of simple precautions to take to keep your computer clean and running securely:
It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates. Make Internet Explorer 7 more secure
If we have helped you, please consider supporting Cyber Tech Help with a subscription. |
#22
|
||||
|
||||
Hi Tom:
All done! The systems appears to be back to normal now. Thank you very much. ![]() Regards, Graham. ========== OTL ========== Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8 A-E604-49b4-9D64-90988571CECB}\ not found. OTL by OldTimer - Version 3.1.11.6 log created on 12062009_140255 |
#23
|
||||
|
||||
Now we are finished.
You're welcome ![]() |
![]() |
Bookmarks |
«
Previous Topic
|
Next Topic
»
|
|
![]() |
||||
Topic | Topic Starter | Forum | Replies | Last Post |
Antimalware Go | Super48 | Malware Removal | 69 | March 20th, 2011 03:49 AM |
antimalware doctor- combo fix log | k9mom007 | Malware Removal | 283 | September 23rd, 2010 10:55 PM |
Antimalware doctor | Jerry56 | Windows XP | 4 | August 17th, 2010 06:56 PM |
antimalware doctor | Saga286 | Malware Removal | 1 | July 29th, 2010 05:12 AM |
Malwarebytes AntiMalware | shkhaslam | Malware Removal | 4 | November 19th, 2009 04:18 AM |
All times are GMT +1. The time now is 11:39 PM.