Redirect issues with browser.

View previous topic View next topic Go down

Redirect issues with browser.

Post by Azztec on Fri May 14, 2010 12:05 pm

Hi guys I have an issue with getting redirected to websites of an advertising nature, I have got malwarebytes and it has found a fair few trojans and adwares which it has managed to rid, however i am still getting the redirections.
I have followed the beginner instructions and am forwarding the relevent logs for you to look at and advise on Thanks in advance.

I have attached the txt as an attachement and posted the extras.

OTL Extras logfile created on: 14/05/2010 12:04:26 - Run 1
OTL by OldTimer - Version 3.2.4.1 Folder = C:\Documents and Settings\User\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 64.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 67.34 Gb Free Space | 28.92% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: USER-2ACEEDB3C2
Current User Name: User
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = Reg Error: Value error.] -- Reg Error: Key error. File not found

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent -- (BitTorrent, Inc.)
"C:\WINDOWS\system32\lxdxcoms.exe" = C:\WINDOWS\system32\lxdxcoms.exe:*:Enabled:3600-4600 Series Server -- ( )
"C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxpswx.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxpswx.exe:*:Enabled:Printer Status Window Interface -- ()
"C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxtime.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxtime.exe:*:Enabled:Lexmark Connect Time Executable -- (Lexmark International, Inc.)
"C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxjswx.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdxjswx.exe:*:Enabled:Job Status Window Interface -- ()
"C:\Team17\Worms Armageddon\wa.exe" = C:\Team17\Worms Armageddon\wa.exe:*:Enabled:Worms Armageddon -- File not found
"C:\Team17\Worms2\frontend.exe" = C:\Team17\Worms2\frontend.exe:*:Enabled:Worms 2 Frontend -- File not found
"C:\Documents and Settings\User\Desktop\Left 4 Dead\Left.4.Dead.2-THEPiRATEGAY\left4dead2.exe" = C:\Documents and Settings\User\Desktop\Left 4 Dead\Left.4.Dead.2-THEPiRATEGAY\left4dead2.exe:*:Enabled:left4dead2 -- File not found
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{2CD2C0DB-81C3-416B-9FA6-589B9235359B}" = OpenOffice.org 2.4
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3744B641-61DE-417F-BCDC-9CCED4224DF8}" = LightScribe System Software
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8B7917E0-AF55-4E8A-9473-017F0AA03AC8}" = QuickTime
"{9BB25A44-1CE8-44B1-A709-CD4A574762F9}" = Dora Backpack
"{9FD45917-95E6-449D-ACC9-01E634A34CBD}_is1" = MPEG Video Wizard DVD 5.0.0.107 (04/2010)
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A6332A5D-CD49-48C7-A34E-4B3F7043B653}" = Dora the Explorer - Lost City
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3
"{AD298C10-EED0-4075-A9F1-4C8C93ACBD08}" = Dora Fairytale Adventure
"{BD01E97F-2A6A-495E-BE38-22C7B80F3CD7}" = Cheetah DVD Burner
"{BE686891-3C56-4714-AFEF-341A7867BA80}" = REALTEK USB Wireless LAN Driver and Utility
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C4A4722E-79F9-417C-BD72-8D359A090C97}" = Samsung PC Studio 3
"{C8C8387B-A98B-44E8-807A-1A9B7F51FFDA}" = Blaze Media Pro
"{C950420B-4182-49EA-850A-A6A2ABF06C6B}" = Marvell Miniport Driver
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"{D642ACC5-F7E9-48F3-A7EE-B49C5447A10E}" = Samsung PC Studio 3
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Alt.Binz" = Alt.Binz 0.25.0
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.4
"AVS4YOU Video Converter 6_is1" = AVS Video Converter 6
"BitTorrent" = BitTorrent
"Delta Force Task Force Dagger" = Delta Force Task Force Dagger
"E.M. Total Video Player 1.31_is1" = E.M. Total Video Player 1.31
"FG_2.4" = Jump Ahead 2000 Year 1 v2.4
"Freedom Fighters" = Freedom Fighters
"Fun Learning Spelling" = Fun Learning Spelling
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"JAY2M_1.3" = Jump Ahead 2000 Maths Year 2 v1.3
"Lexmark 3600-4600 Series" = Lexmark 3600-4600 Series
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"Mpeg Video Wizard DVD 5.0" = MPEG Video Wizard DVD 5.0.0.107 (04/2010)
"MSNINST" = MSN
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"QuickPar" = QuickPar 0.9
"Reader Rabbit Thinking Adventures Ages 4-6" = Reader Rabbit Thinking Adventures Ages 4-6
"RegSupreme Pro_is1" = RegSupreme Pro
"SAMSUNG CDMA Modem" = SAMSUNG CDMA Modem Driver Set
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"SureThing CD Labeler LightScribe_is1" = SureThing CD Labeler LightScribe 5.0.581.0
"Total Video Converter 3.10_is1" = Total Video Converter 3.10
"Ultra Mobile 3GP Video Converter_is1" = Ultra Mobile 3GP Video Converter 5.2.0603
"VLC media player" = VLC media player 1.0.5
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"Your Uninstaller! 2008_is1" = Your Uninstaller! 2008 Version 6.0
"ZoneAlarm Security Suite" = ZoneAlarm Security Suite

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Blaze Media Pro" = Blaze Media Pro

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 14/03/2010 17:52:17 | Computer Name = USER-2ACEEDB3C2 | Source = MsiInstaller | ID = 1013
Description = Product: QuickTime -- The cabinet file 'AppleApplicationSupport.cab'
required for this installation is corrupt and cannot be used. This could indicate
a network error, an error reading from the CD-ROM, or a problem with this package.

Error - 14/03/2010 17:52:17 | Computer Name = USER-2ACEEDB3C2 | Source = MsiInstaller | ID = 11335
Description = Product: Apple Application Support -- Error 1335. The cabinet file
'AppleApplicationSupport.cab' required for this installation is corrupt and cannot
be used. This could indicate a network error, an error reading from the CD-ROM,
or a problem with this package.

Error - 14/03/2010 18:02:56 | Computer Name = USER-2ACEEDB3C2 | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x0355ceb0.

Error - 22/03/2010 15:53:46 | Computer Name = USER-2ACEEDB3C2 | Source = Application Hang | ID = 1002
Description = Hanging application Dora_Backpack.exe, version 0.1.0.5, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 27/03/2010 21:27:43 | Computer Name = USER-2ACEEDB3C2 | Source = LoadPerf | ID = 3001
Description = The performance counter name string value in the registry is incorrectly
formatted.
The bogus string is 5252, the bogus index value is the first DWORD in Data section
while the last valid index values are the second and third DWORD in Data section.

Error - 27/03/2010 21:27:43 | Computer Name = USER-2ACEEDB3C2 | Source = LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service WmiApRpl (WmiApRpl)
failed. The Error code is the first DWORD in Data section.

Error - 27/03/2010 21:27:46 | Computer Name = USER-2ACEEDB3C2 | Source = LoadPerf | ID = 3001
Description = The performance counter name string value in the registry is incorrectly
formatted.
The bogus string is 5252, the bogus index value is the first DWORD in Data section
while the last valid index values are the second and third DWORD in Data section.

Error - 28/03/2010 10:35:04 | Computer Name = USER-2ACEEDB3C2 | Source = Application Error | ID = 1000
Description = Faulting application fg.exe, version 0.0.0.0, faulting module fg.exe,
version 0.0.0.0, fault address 0x000290a8.

Error - 28/03/2010 10:37:55 | Computer Name = USER-2ACEEDB3C2 | Source = Application Error | ID = 1000
Description = Faulting application fg.exe, version 0.0.0.0, faulting module fg.exe,
version 0.0.0.0, fault address 0x000290a8.

Error - 28/03/2010 10:51:10 | Computer Name = USER-2ACEEDB3C2 | Source = Application Error | ID = 1000
Description = Faulting application fg.exe, version 0.0.0.0, faulting module user32.dll,
version 5.1.2600.5512, fault address 0x00018944.

[ System Events ]
Error - 13/05/2010 20:02:10 | Computer Name = USER-2ACEEDB3C2 | Source = Service Control Manager | ID = 7000
Description = The lxdxCATSCustConnectService service failed to start due to the
following error: %%1053

Error - 13/05/2010 20:02:12 | Computer Name = USER-2ACEEDB3C2 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
PCIIde

Error - 13/05/2010 20:19:55 | Computer Name = USER-2ACEEDB3C2 | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the lxdxCATSCustConnectService
service to connect.

Error - 13/05/2010 20:19:55 | Computer Name = USER-2ACEEDB3C2 | Source = Service Control Manager | ID = 7000
Description = The lxdxCATSCustConnectService service failed to start due to the
following error: %%1053

Error - 13/05/2010 20:20:01 | Computer Name = USER-2ACEEDB3C2 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
PCIIde

Error - 13/05/2010 21:34:42 | Computer Name = USER-2ACEEDB3C2 | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the lxdxCATSCustConnectService
service to connect.

Error - 13/05/2010 21:34:42 | Computer Name = USER-2ACEEDB3C2 | Source = Service Control Manager | ID = 7000
Description = The lxdxCATSCustConnectService service failed to start due to the
following error: %%1053

Error - 13/05/2010 21:34:43 | Computer Name = USER-2ACEEDB3C2 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
PCIIde

Error - 14/05/2010 06:07:44 | Computer Name = USER-2ACEEDB3C2 | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the lxdxCATSCustConnectService
service to connect.

Error - 14/05/2010 06:07:44 | Computer Name = USER-2ACEEDB3C2 | Source = Service Control Manager | ID = 7000
Description = The lxdxCATSCustConnectService service failed to start due to the
following error: %%1053


< End of report >

Azztec
Novice
Novice

Posts Posts : 11
Joined Joined : 2010-05-14
OS OS : xp
Points Points : 24111
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Redirect issues with browser.

Post by Belahzur on Fri May 14, 2010 12:09 pm

Hello.
Please post the other log too. Smile


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245059
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Redirect issues with browser.

Post by Azztec on Fri May 14, 2010 1:41 pm

Here is the other log. thanks again.


OTL logfile created on: 14/05/2010 12:04:26 - Run 1
OTL by OldTimer - Version 3.2.4.1 Folder = C:\Documents and Settings\User\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 64.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 67.34 Gb Free Space | 28.92% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: USER-2ACEEDB3C2
Current User Name: User
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/05/14 12:03:17 | 000,570,880 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\User\My Documents\Downloads\OTL.exe
PRC - [2010/04/29 15:39:34 | 000,304,464 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2010/04/29 15:39:32 | 000,437,584 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2010/04/01 19:00:32 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/02/09 23:16:32 | 000,654,648 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\BitTorrent\bittorrent.exe
PRC - [2008/04/14 01:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/03/14 00:11:10 | 000,919,016 | ---- | M] (Zone Labs, LLC) -- C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2008/03/14 00:11:08 | 000,075,304 | ---- | M] (Zone Labs, LLC) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe
PRC - [2008/02/28 01:53:25 | 000,594,600 | ---- | M] ( ) -- C:\WINDOWS\system32\lxdxcoms.exe
PRC - [2007/12/03 15:53:58 | 000,139,264 | ---- | M] () -- C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
PRC - [2007/05/11 08:50:24 | 000,804,376 | ---- | M] ( ) -- C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
PRC - [2007/03/29 15:22:04 | 000,786,432 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Program Files\REALTEK USB Wireless LAN Driver and Utility\RtWLan.exe
PRC - [2004/10/14 09:11:10 | 001,388,544 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
PRC - [2004/09/23 12:41:54 | 000,860,160 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMax4.exe
PRC - [2002/09/20 14:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe


========== Modules (SafeList) ==========

MOD - [2010/05/14 12:03:17 | 000,570,880 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\User\My Documents\Downloads\OTL.exe
MOD - [2008/04/14 01:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx
MOD - [2007/05/11 08:50:26 | 000,012,312 | ---- | M] () -- C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\MlfHook.dll
MOD - [2006/05/03 22:53:54 | 000,174,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\framedyn.dll


========== Win32 Services (SafeList) ==========

SRV - [2010/04/29 15:39:34 | 000,304,464 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2008/03/14 00:11:08 | 000,075,304 | ---- | M] (Zone Labs, LLC) [Auto | Running] -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2008/02/28 01:53:25 | 000,594,600 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\System32\lxdxcoms.exe -- (lxdx_device)
SRV - [2008/02/28 01:53:22 | 000,098,984 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdxserv.exe -- (lxdxCATSCustConnectService)
SRV - [2002/09/20 14:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) [Auto | Running] -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default))


========== Driver Services (SafeList) ==========

DRV - [2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2008/07/16 15:57:11 | 000,392,704 | ---- | M] (Sensaura) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (senfilt)
DRV - [2008/07/16 15:57:11 | 000,088,960 | ---- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MidiSyn.sys -- (MidiSyn)
DRV - [2008/03/14 00:11:18 | 000,394,952 | ---- | M] (Zone Labs, LLC) [Kernel | System | Running] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - [2008/02/27 04:10:44 | 000,051,176 | ---- | M] (Zone Labs, LLC) [Kernel | Boot | Running] -- C:\WINDOWS\system32\ZoneLabs\srescan.sys -- (srescan)
DRV - [2007/07/19 16:10:28 | 000,127,768 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\klif.sys -- (KLIF)
DRV - [2007/02/08 19:46:00 | 000,209,152 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rtl8187B.sys -- (RTL8187B)
DRV - [2006/07/24 16:05:00 | 000,005,632 | ---- | M] () [File_System | System | Running] -- C:\WINDOWS\system32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2005/08/30 17:59:00 | 000,094,000 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ss_mdm.sys -- (ss_mdm)
DRV - [2005/08/30 17:58:56 | 000,008,304 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ss_mdfl.sys -- (ss_mdfl)
DRV - [2005/08/30 17:57:18 | 000,058,320 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ss_bus.sys -- (ss_bus) SAMSUNG Mobile USB Device 1.0 driver (WDM)
DRV - [2005/04/01 08:25:00 | 000,230,272 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
DRV - [2004/10/28 11:49:28 | 000,031,744 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Documents and Settings\Tayyeb.USER-2ACEEDB3C2\Local Settings\Temp\kbeepm.sys -- (kbeepm)
DRV - [2004/08/03 23:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.co.uk/"
FF - prefs.js..extensions.enabledItems: {35106bca-6c78-48c7-ac28-56df30b51d2d}:1.2.4

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/05/10 13:06:15 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/05/14 11:56:41 | 000,000,000 | ---D | M]

[2010/05/10 13:06:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Mozilla\Extensions
[2010/05/14 00:16:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hzod52s9.default\extensions
[2010/05/13 23:50:17 | 000,000,000 | ---D | M] (PopupMaster) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\hzod52s9.default\extensions\{35106bca-6c78-48c7-ac28-56df30b51d2d}
[2010/05/14 11:56:44 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/05/14 11:56:44 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/05/14 11:56:29 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/04/01 17:56:49 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/04/01 17:56:50 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/04/01 17:56:50 | 000,000,769 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/04/01 17:56:50 | 000,001,135 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2004/08/04 13:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll File not found
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Zone Labs, LLC)
O4 - HKCU..\Run: [BitTorrent] C:\Program Files\BitTorrent\bittorrent.exe (BitTorrent, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\REALTEK USB Wireless LAN Utility.lnk = C:\Program Files\REALTEK USB Wireless LAN Driver and Utility\RtWLan.exe (Realtek Semiconductor Corp.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} [You must be registered and logged in to see this link.] (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/06/04 17:39:41 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2008/06/04 17:23:20 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\system32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found


SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: vsmon - C:\WINDOWS\System32\ZoneLabs\vsmon.exe (Zone Labs, LLC)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - Microsoft NetShow Player
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows script 5.6
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Security Update for Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.MKVC - C:\WINDOWS\System32\KMVIDC32.DLL ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2010/05/14 11:57:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun
[2010/05/14 11:56:41 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010/05/14 11:56:41 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/05/14 11:56:41 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/05/14 11:56:41 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/05/14 11:47:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Desktop\java new instal
[2010/05/14 11:10:01 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2010/05/14 01:24:56 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/05/14 01:24:55 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/05/14 01:24:55 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/05/14 00:55:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Desktop\malwarebyte torrent
[2010/05/14 00:42:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Application Data\Malwarebytes
[2010/05/14 00:41:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/05/13 23:50:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Application Data\ATManager
[2010/05/13 00:03:54 | 000,000,000 | ---D | C] -- C:\Program Files\RegSupreme Pro
[2010/05/10 13:06:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Application Data\Mozilla
[2010/05/09 23:33:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Desktop\pak naat image
[2010/05/09 22:24:45 | 000,000,000 | ---D | C] -- C:\Program Files\Womble Multimedia
[2010/05/09 22:16:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Desktop\womble
[2010/05/09 18:49:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Desktop\naat paK
[2010/05/07 23:58:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Google
[2010/05/07 22:50:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2010/05/07 22:45:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Local Settings\Application Data\Temp
[2010/05/07 22:45:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2010/05/07 22:45:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Local Settings\Application Data\Google
[2010/05/07 22:45:08 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2010/05/07 22:44:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\DivX
[2010/05/04 20:53:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\My Documents\My Art
[2010/05/04 20:51:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Application Data\Samsung
[2010/05/04 20:47:55 | 000,174,592 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\framedyn.dll
[2010/05/04 20:47:19 | 000,094,000 | ---- | C] (MCCI) -- C:\WINDOWS\System32\drivers\ss_mdm.sys
[2010/05/04 20:47:19 | 000,058,320 | ---- | C] (MCCI) -- C:\WINDOWS\System32\drivers\ss_bus.sys
[2010/05/04 20:47:19 | 000,008,304 | ---- | C] (MCCI) -- C:\WINDOWS\System32\drivers\ss_mdfl.sys
[2010/05/04 20:47:19 | 000,006,144 | ---- | C] (MCCI) -- C:\WINDOWS\System32\drivers\ss_cmnt.sys
[2010/05/04 20:47:19 | 000,006,144 | ---- | C] (MCCI) -- C:\WINDOWS\System32\drivers\ss_cm.sys
[2010/05/04 20:47:19 | 000,005,808 | ---- | C] (MCCI) -- C:\WINDOWS\System32\drivers\ss_whnt.sys
[2010/05/04 20:47:19 | 000,005,808 | ---- | C] (MCCI) -- C:\WINDOWS\System32\drivers\ss_wh.sys
[2010/05/04 20:47:19 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Samsung_USB_Drivers
[2010/05/04 20:46:53 | 000,000,000 | ---D | C] -- C:\Program Files\Samsung
[2010/05/04 20:44:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Desktop\g600
[2010/04/28 21:57:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Desktop\PS3
[2010/04/27 23:08:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Desktop\NVQ4 Folder
[2010/04/27 21:51:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Application Data\U3
[2010/04/23 13:38:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Desktop\r4 software
[2010/02/19 23:08:46 | 000,438,272 | ---- | C] ( ) -- C:\WINDOWS\System32\LXDXhcp.dll
[2010/02/19 23:07:54 | 001,105,920 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxserv.dll
[2010/02/19 23:07:54 | 000,843,776 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxusb1.dll
[2010/02/19 23:07:54 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxprox.dll
[2010/02/19 23:07:53 | 000,663,552 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxhbn3.dll
[2010/02/19 23:07:53 | 000,647,168 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxpmui.dll
[2010/02/19 23:07:53 | 000,364,544 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxinpa.dll
[2010/02/19 23:07:53 | 000,339,968 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxiesc.dll
[2010/02/19 23:07:52 | 000,851,968 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxcomc.dll
[2010/02/19 23:07:52 | 000,376,832 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxcomm.dll
[2010/02/19 23:07:49 | 000,569,344 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxlmpm.dll
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/05/14 12:10:21 | 014,343,200 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.dat
[2010/05/14 12:03:35 | 003,670,016 | ---- | M] () -- C:\Documents and Settings\User\ntuser.dat
[2010/05/14 12:01:00 | 000,000,232 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2010/05/14 11:56:28 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010/05/14 11:56:28 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/05/14 11:56:28 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/05/14 11:56:28 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/05/14 11:56:28 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010/05/14 11:25:19 | 000,001,131 | ---- | M] () -- C:\rollback.ini
[2010/05/14 11:09:11 | 000,000,803 | ---- | M] () -- C:\Documents and Settings\User\Desktop\Internet Explorer.lnk
[2010/05/14 11:07:58 | 000,355,091 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2010/05/14 11:06:42 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/05/14 11:06:35 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/05/14 03:02:22 | 000,192,260 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.idx
[2010/05/14 03:02:05 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\User\ntuser.ini
[2010/05/14 01:25:20 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/05/14 01:02:55 | 000,004,212 | -H-- | M] () -- C:\WINDOWS\System32\zllictbl.dat
[2010/05/13 00:04:20 | 000,000,023 | -HS- | M] () -- C:\WINDOWS\System32\fdcdfacbf_d.dll
[2010/05/13 00:04:20 | 000,000,023 | ---- | M] () -- C:\WINDOWS\System32\afcefffffe1_d.ocx
[2010/05/12 22:55:59 | 000,017,920 | ---- | M] () -- C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/05/12 21:07:24 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/05/11 01:00:36 | 000,000,888 | ---- | M] () -- C:\Documents and Settings\User\Desktop\MPEG Video Wizard DVD 5.0.lnk
[2010/05/10 13:06:07 | 000,001,602 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/05/04 20:51:17 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\LauncherAccess.dt
[2010/05/04 20:48:04 | 000,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
[2010/04/29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/04/19 22:58:57 | 000,000,712 | ---- | M] () -- C:\Documents and Settings\User\Desktop\Shortcut to JBidwatcher-2.1pre5.lnk
[2010/04/16 01:12:37 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/05/14 11:09:11 | 000,000,803 | ---- | C] () -- C:\Documents and Settings\User\Desktop\Internet Explorer.lnk
[2010/05/14 01:25:20 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/05/13 00:04:20 | 000,000,023 | -HS- | C] () -- C:\WINDOWS\System32\fdcdfacbf_d.dll
[2010/05/13 00:04:20 | 000,000,023 | ---- | C] () -- C:\WINDOWS\System32\afcefffffe1_d.ocx
[2010/05/11 01:00:36 | 000,000,888 | ---- | C] () -- C:\Documents and Settings\User\Desktop\MPEG Video Wizard DVD 5.0.lnk
[2010/05/10 13:06:07 | 000,001,602 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/05/04 20:51:17 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\LauncherAccess.dt
[2010/05/04 20:47:09 | 000,000,766 | ---- | C] () -- C:\WINDOWS\System32\Uninstall.ico
[2010/05/04 20:47:04 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2010/04/19 22:58:57 | 000,000,712 | ---- | C] () -- C:\Documents and Settings\User\Desktop\Shortcut to JBidwatcher-2.1pre5.lnk
[2010/03/28 15:52:36 | 000,000,000 | ---- | C] () -- C:\WINDOWS\SETUP32.INI
[2010/03/28 15:52:19 | 000,000,036 | ---- | C] () -- C:\WINDOWS\Tiny_Run.ini
[2010/03/22 00:16:38 | 000,796,048 | ---- | C] () -- C:\WINDOWS\System32\libeay32_0.9.6l.dll
[2010/03/21 19:52:40 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
[2010/03/13 01:16:26 | 000,137,464 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2010/03/09 23:23:03 | 000,000,287 | ---- | C] () -- C:\WINDOWS\game.ini
[2010/03/03 18:28:21 | 000,000,420 | ---- | C] () -- C:\WINDOWS\KA.INI
[2010/02/28 05:35:20 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\AVERM.dll
[2010/02/28 05:35:20 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\AVEQT.dll
[2010/02/27 23:07:10 | 006,963,712 | ---- | C] () -- C:\WINDOWS\System32\videotrans.dll
[2010/02/27 23:07:10 | 000,452,608 | ---- | C] () -- C:\WINDOWS\System32\videoformat.dll
[2010/02/27 23:07:10 | 000,172,032 | ---- | C] () -- C:\WINDOWS\System32\viscomgifenc.dll
[2010/02/27 23:07:10 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\viscomtran.dll
[2010/02/27 23:07:10 | 000,154,624 | ---- | C] () -- C:\WINDOWS\System32\imgscaler.dll
[2010/02/27 23:07:10 | 000,028,160 | ---- | C] () -- C:\WINDOWS\System32\img_utils.dll
[2010/02/27 23:07:10 | 000,019,456 | ---- | C] () -- C:\WINDOWS\System32\videocore.dll
[2010/02/27 22:23:55 | 000,002,552 | ---- | C] () -- C:\WINDOWS\WAVEMIX.INI
[2010/02/27 22:13:23 | 000,000,154 | ---- | C] () -- C:\WINDOWS\STUDIO2.INI
[2010/02/27 01:09:34 | 000,323,584 | ---- | C] () -- C:\WINDOWS\System32\FoxImager.dll
[2010/02/20 23:44:15 | 000,047,104 | ---- | C] () -- C:\WINDOWS\System32\KMVIDC32.DLL
[2010/02/20 23:31:47 | 000,000,083 | ---- | C] () -- C:\WINDOWS\wa.INI
[2010/02/20 23:29:09 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2010/02/19 23:08:54 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\lxdxrwrd.ini
[2010/02/19 23:08:47 | 000,348,160 | ---- | C] () -- C:\WINDOWS\System32\LXDXinst.dll
[2010/02/19 23:07:55 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxdxvs.dll
[2010/02/19 23:07:52 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\lxdxgrd.dll
[2010/02/19 23:07:51 | 000,360,448 | R--- | C] () -- C:\WINDOWS\System32\lxdxcoin.dll
[2010/02/19 23:06:29 | 000,782,336 | ---- | C] () -- C:\WINDOWS\System32\lxdxdrs.dll
[2010/02/19 23:06:29 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\lxdxcaps.dll
[2010/02/19 23:06:29 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\lxdxcnv4.dll
[2006/10/21 18:59:59 | 000,262,144 | ---- | C] () -- C:\WINDOWS\System32\Manipulate.dll
[2006/09/24 19:53:54 | 000,268,242 | ---- | C] () -- C:\WINDOWS\System32\erdmpg-parse.dll
[2006/09/24 19:53:42 | 002,518,779 | ---- | C] () -- C:\WINDOWS\System32\erdmpg-enc.dll
[2006/09/24 19:52:04 | 000,030,693 | ---- | C] () -- C:\WINDOWS\System32\erdmpg-int.dll
[2005/11/17 18:57:30 | 000,258,560 | ---- | C] () -- C:\WINDOWS\System32\MusicTagsAX.dll
[2005/10/15 04:10:24 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\comLyricGetter.dll
[2004/02/01 20:21:56 | 000,097,280 | ---- | C] () -- C:\WINDOWS\System32\Uncommon.dll
[2003/08/07 21:01:50 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll

========== Custom Scans ==========


< >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\*.exe /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2008/06/04 17:27:04 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2008/06/04 17:27:04 | 000,634,880 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2008/06/04 17:27:04 | 000,888,832 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\*.sys >
[2004/08/04 13:00:00 | 000,009,029 | ---- | M] () -- C:\WINDOWS\system32\ansi.sys
[2004/08/04 13:00:00 | 000,027,097 | ---- | M] () -- C:\WINDOWS\system32\country.sys
[2004/08/04 13:00:00 | 000,004,768 | ---- | M] () -- C:\WINDOWS\system32\himem.sys
[2004/08/04 13:00:00 | 000,042,809 | ---- | M] () -- C:\WINDOWS\system32\key01.sys
[2004/08/04 13:00:00 | 000,042,537 | ---- | M] () -- C:\WINDOWS\system32\keyboard.sys
[2004/08/04 13:00:00 | 000,027,866 | ---- | M] () -- C:\WINDOWS\system32\ntdos.sys
[2004/08/04 13:00:00 | 000,029,146 | ---- | M] () -- C:\WINDOWS\system32\ntdos404.sys
[2004/08/04 13:00:00 | 000,029,370 | ---- | M] () -- C:\WINDOWS\system32\ntdos411.sys
[2004/08/04 13:00:00 | 000,029,274 | ---- | M] () -- C:\WINDOWS\system32\ntdos412.sys
[2004/08/04 13:00:00 | 000,029,146 | ---- | M] () -- C:\WINDOWS\system32\ntdos804.sys
[2004/08/04 13:00:00 | 000,033,840 | ---- | M] () -- C:\WINDOWS\system32\ntio.sys
[2004/08/04 13:00:00 | 000,034,560 | ---- | M] () -- C:\WINDOWS\system32\ntio404.sys
[2004/08/04 13:00:00 | 000,035,648 | ---- | M] () -- C:\WINDOWS\system32\ntio411.sys
[2004/08/04 13:00:00 | 000,035,424 | ---- | M] () -- C:\WINDOWS\system32\ntio412.sys
[2004/08/04 13:00:00 | 000,034,560 | ---- | M] () -- C:\WINDOWS\system32\ntio804.sys
[2008/03/14 00:11:18 | 000,394,952 | ---- | M] (Zone Labs, LLC) -- C:\WINDOWS\system32\vsdatant.sys
[2008/04/13 19:44:59 | 000,017,664 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\watchdog.sys
[2009/08/14 14:21:25 | 001,850,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\win32k.sys
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\drivers\*.dll >
[2008/04/14 01:11:48 | 000,004,255 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv01nt5.dll
[2008/04/14 01:11:48 | 000,003,967 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv02nt5.dll
[2008/04/14 01:11:48 | 000,003,615 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv05nt5.dll
[2008/04/14 01:11:48 | 000,003,647 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv07nt5.dll
[2008/04/14 01:11:48 | 000,003,135 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv08nt5.dll
[2008/04/14 01:11:48 | 000,003,711 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv09nt5.dll
[2008/04/14 01:11:48 | 000,003,775 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\adv11nt5.dll
[2008/04/14 01:11:50 | 000,021,183 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv01nt5.dll
[2008/04/14 01:11:50 | 000,011,359 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv02nt5.dll
[2008/04/14 01:11:50 | 000,025,471 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv04nt5.dll
[2008/04/14 01:11:50 | 000,014,143 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv06nt5.dll
[2008/04/14 01:11:50 | 000,017,279 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\atv10nt5.dll
[2008/04/14 01:11:50 | 000,015,423 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\ch7xxnt5.dll
[2008/04/14 01:12:05 | 000,003,901 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\siint5.dll
[2008/04/14 01:12:08 | 000,011,325 | ---- | M] (Intel(R) Corporation) -- C:\WINDOWS\system32\drivers\vchnt5.dll

< %systemroot%\system32\drivers\*.ini >

< %systemroot%\system32\drivers\*.exe >

< %SYSTEMDRIVE%\*.* >
[2008/06/04 17:39:41 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2008/06/04 17:35:55 | 000,000,211 | -HS- | M] () -- C:\boot.ini
[2008/06/04 17:39:41 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2008/06/04 17:39:41 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/05/14 11:48:39 | 000,008,573 | ---- | M] () -- C:\JavaRa.log
[2008/06/04 17:39:41 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2004/08/04 13:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/07/16 15:43:41 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2010/05/14 11:06:27 | 2145,386,496 | -HS- | M] () -- C:\pagefile.sys
[2010/05/14 11:25:19 | 000,001,131 | ---- | M] () -- C:\rollback.ini

< %PROGRAMFILES%\*. >
[2010/03/09 23:18:31 | 000,000,000 | ---D | M] -- C:\Program Files\Activision
[2010/03/18 23:10:42 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
[2010/04/03 13:42:11 | 000,000,000 | ---D | M] -- C:\Program Files\AltBinz
[2008/07/16 15:57:31 | 000,000,000 | ---D | M] -- C:\Program Files\Analog Devices
[2010/03/14 22:51:45 | 000,000,000 | ---D | M] -- C:\Program Files\Apple Software Update
[2010/05/13 23:50:18 | 000,000,000 | ---D | M] -- C:\Program Files\Ask.com
[2010/03/21 19:35:37 | 000,000,000 | ---D | M] -- C:\Program Files\Atari
[2010/02/19 23:26:02 | 000,000,000 | ---D | M] -- C:\Program Files\AVG
[2010/04/03 11:24:39 | 000,000,000 | ---D | M] -- C:\Program Files\AVS4YOU
[2010/02/19 22:45:52 | 000,000,000 | ---D | M] -- C:\Program Files\BitTorrent
[2010/05/09 22:06:27 | 000,000,000 | ---D | M] -- C:\Program Files\Blaze Media Pro
[2010/03/14 22:59:01 | 000,000,000 | ---D | M] -- C:\Program Files\Bonjour
[2010/03/11 18:51:54 | 000,000,000 | ---D | M] -- C:\Program Files\BTL
[2010/02/27 01:09:33 | 000,000,000 | ---D | M] -- C:\Program Files\Cheetah Burner
[2010/04/06 00:10:06 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
[2010/02/27 22:22:14 | 000,000,000 | ---D | M] -- C:\Program Files\Crayola
[2010/05/11 00:51:58 | 000,000,000 | ---D | M] -- C:\Program Files\DivX
[2010/03/11 23:22:14 | 000,000,000 | ---D | M] -- C:\Program Files\EA Games
[2010/03/06 19:05:56 | 000,000,000 | ---D | M] -- C:\Program Files\Fun Learning
[2010/05/07 23:58:02 | 000,000,000 | ---D | M] -- C:\Program Files\Google
[2010/05/04 20:46:53 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
[2010/04/01 18:11:04 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
[2010/05/14 11:56:25 | 000,000,000 | ---D | M] -- C:\Program Files\Java
[2010/03/11 00:19:48 | 000,000,000 | ---D | M] -- C:\Program Files\JGsoft
[2010/03/11 23:07:47 | 000,000,000 | ---D | M] -- C:\Program Files\Lexmark 3600-4600 Series
[2010/05/14 01:29:19 | 000,000,000 | ---D | M] -- C:\Program Files\Malwarebytes' Anti-Malware
[2008/07/16 15:29:56 | 000,000,000 | ---D | M] -- C:\Program Files\Marvell
[2010/02/20 01:38:09 | 000,000,000 | ---D | M] -- C:\Program Files\Messenger
[2008/06/04 17:39:53 | 000,000,000 | ---D | M] -- C:\Program Files\microsoft frontpage
[2010/03/12 21:10:52 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
[2010/05/10 13:06:07 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
[2010/02/17 14:30:13 | 000,000,000 | ---D | M] -- C:\Program Files\MSBuild
[2010/02/19 21:52:04 | 000,000,000 | ---D | M] -- C:\Program Files\MSN
[2008/06/04 17:37:12 | 000,000,000 | ---D | M] -- C:\Program Files\MSN Gaming Zone
[2008/07/16 15:44:49 | 000,000,000 | ---D | M] -- C:\Program Files\NetMeeting
[2010/03/09 22:37:15 | 000,000,000 | ---D | M] -- C:\Program Files\NovaLogic
[2008/06/04 17:37:19 | 000,000,000 | ---D | M] -- C:\Program Files\Online Services
[2008/07/16 15:36:10 | 000,000,000 | ---D | M] -- C:\Program Files\OpenOffice.org 2.4
[2010/02/20 01:35:13 | 000,000,000 | ---D | M] -- C:\Program Files\Outlook Express
[2010/04/08 02:03:46 | 000,000,000 | ---D | M] -- C:\Program Files\QuickPar
[2010/03/14 23:01:56 | 000,000,000 | ---D | M] -- C:\Program Files\QuickTime
[2010/02/21 21:49:38 | 000,000,000 | ---D | M] -- C:\Program Files\REALTEK USB Wireless LAN Driver and Utility
[2010/02/17 14:30:10 | 000,000,000 | ---D | M] -- C:\Program Files\Reference Assemblies
[2010/05/13 23:50:18 | 000,000,000 | ---D | M] -- C:\Program Files\RegSupreme Pro
[2010/05/04 20:46:53 | 000,000,000 | ---D | M] -- C:\Program Files\Samsung
[2010/04/06 00:10:57 | 000,000,000 | ---D | M] -- C:\Program Files\SureThing CD Labeler 5
[2010/03/28 15:54:06 | 000,000,000 | ---D | M] -- C:\Program Files\The Learning Company
[2010/04/02 16:21:04 | 000,000,000 | ---D | M] -- C:\Program Files\Total Video Converter
[2010/02/20 01:22:26 | 000,000,000 | ---D | M] -- C:\Program Files\Total Video Player
[2010/02/28 05:39:59 | 000,000,000 | ---D | M] -- C:\Program Files\Ultra Mobile 3GP Video Converter
[2010/04/07 21:19:13 | 000,000,000 | ---D | M] -- C:\Program Files\VideoLAN
[2010/02/27 03:24:01 | 000,000,000 | ---D | M] -- C:\Program Files\vso
[2010/02/20 23:29:14 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Player
[2008/07/16 15:44:48 | 000,000,000 | ---D | M] -- C:\Program Files\Windows NT
[2010/02/27 22:00:36 | 000,000,000 | ---D | M] -- C:\Program Files\WinRAR
[2010/05/10 22:47:53 | 000,000,000 | ---D | M] -- C:\Program Files\Womble Multimedia
[2008/06/04 17:39:53 | 000,000,000 | ---D | M] -- C:\Program Files\xerox
[2010/02/27 03:03:30 | 000,000,000 | ---D | M] -- C:\Program Files\Your Uninstaller 2008
[2010/03/22 00:16:33 | 000,000,000 | ---D | M] -- C:\Program Files\Zone Labs

< %appdata%\*.* >
[2008/06/04 17:29:57 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\User\Application Data\desktop.ini


< MD5 for: AGP440.SYS >
[2004/08/04 13:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/07/16 15:42:03 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008/07/16 15:42:03 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/04 00:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys
[2004/08/04 00:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\AGP440.SYS

< MD5 for: ATAPI.SYS >
[2004/08/04 13:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/07/16 15:42:03 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/07/16 15:42:03 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2004/08/04 13:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2008/04/13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\atapi.sys

< MD5 for: DISK.SYS >
[2004/08/04 13:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:disk.sys
[2008/07/16 15:42:03 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:disk.sys
[2008/07/16 15:42:03 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:disk.sys
[2004/08/04 13:00:00 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=00CA44E4534865F8A3B64F7C0984BFF0 -- C:\WINDOWS\$NtServicePackUninstall$\disk.sys
[2008/04/13 19:40:47 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\ServicePackFiles\i386\disk.sys
[2008/04/13 19:40:47 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\system32\drivers\disk.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 01:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/14 01:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll
[2004/08/04 13:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/14 01:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/14 01:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll
[2004/08/04 13:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 13:00:00 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/14 01:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/14 01:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll

< MD5 for: USBSTOR.SYS >
[2004/08/04 13:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:usbstor.sys
[2008/07/16 15:42:03 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:usbstor.sys
[2008/07/16 15:42:03 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:usbstor.sys
[2004/08/03 23:08:48 | 000,026,496 | ---- | M] (Microsoft Corporation) MD5=6CD7B22193718F1D17A47A1CD6D37E75 -- C:\WINDOWS\$NtServicePackUninstall$\usbstor.sys
[2008/04/13 19:45:38 | 000,026,368 | ---- | M] (Microsoft Corporation) MD5=A32426D9B14A089EAA1D922E0C5801A9 -- C:\WINDOWS\ServicePackFiles\i386\usbstor.sys
[2008/04/13 19:45:38 | 000,026,368 | ---- | M] (Microsoft Corporation) MD5=A32426D9B14A089EAA1D922E0C5801A9 -- C:\WINDOWS\system32\drivers\usbstor.sys

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-05-06 14:55:35

========== Alternate Data Streams ==========

@Alternate Data Stream - 148 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B3D74A13
< End of report >

Azztec
Novice
Novice

Posts Posts : 11
Joined Joined : 2010-05-14
OS OS : xp
Points Points : 24111
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Redirect issues with browser.

Post by Belahzur on Fri May 14, 2010 2:01 pm

Hello.

I see that you are running BitTorrent.
P2P(Peer to peer) applications are designed to help you easily share and distribute files between you and a group of people. But they can also be used to distribute malware, and thus are not considered safe.
The removal of these programs is optional, but highly recommended.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

    BitTorrent

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245059
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Redirect issues with browser.

Post by Azztec on Fri May 14, 2010 4:55 pm

Malwarebytes' Anti-Malware 1.46
[You must be registered and logged in to see this link.]

Database version: 4098

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

14/05/2010 17:22:40
mbam-log-2010-05-14 (17-22-40).txt

Scan type: Full scan (C:\|)
Objects scanned: 230588
Time elapsed: 1 hour(s), 12 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

heres the malware log

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Azztec
Novice
Novice

Posts Posts : 11
Joined Joined : 2010-05-14
OS OS : xp
Points Points : 24111
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Redirect issues with browser.

Post by Azztec on Fri May 14, 2010 5:07 pm

Another thing belahzur I have uninstalled bit torrent, should i also be deleting all the files i have downloaded from it?
thanks

Azztec
Novice
Novice

Posts Posts : 11
Joined Joined : 2010-05-14
OS OS : xp
Points Points : 24111
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Redirect issues with browser.

Post by Azztec on Fri May 14, 2010 5:15 pm

fyi

still got the redirect seems to be originating from an address "Clicks. search 312.com" saying my request will load ina few seconds or something to that effect and then taking me to some other site.

Azztec
Novice
Novice

Posts Posts : 11
Joined Joined : 2010-05-14
OS OS : xp
Points Points : 24111
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Redirect issues with browser.

Post by Azztec on Fri May 14, 2010 10:47 pm

windows malicious removal tool kicked in and discovered something like "Win32/Alureon.A" it was able to do a partial removal.
does this help you in any way.

thanks in advance.

Azztec
Novice
Novice

Posts Posts : 11
Joined Joined : 2010-05-14
OS OS : xp
Points Points : 24111
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Redirect issues with browser.

Post by Belahzur on Sat May 15, 2010 12:22 am

Hello.

  • Download combofix from here
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]

    1. If you are using Firefox, make sure that your download settings are as follows:

    * Tools->Options->Main tab
    * Set to "Always ask me where to Save the files".

    2. During the download, rename Combofix to Combo-Fix as follows:





    3. It is important you rename Combofix during the download, but not after.
    4. Please do not rename Combofix to other names, but only to the one indicated.
    5. Close any open browsers.
    6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

  • We need to disable your local AV (Anti-virus) before running Combofix.
  • See [You must be registered and logged in to see this link.] for how to disable your AV.
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245059
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Redirect issues with browser.

Post by Azztec on Sat May 15, 2010 5:41 pm

Hi here is the Combo fix log.
Thanks.

ComboFix 10-05-14.06 - User 15/05/2010 18:31:05.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1596 [GMT 1:00]
Running from: c:\documents and settings\User\My Documents\Downloads\Combo-Fix.exe
AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Updated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
FW: ZoneAlarm Security Suite Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\User\Application Data\ATManager
c:\windows\system32\fdcdfacbf_d.dll
c:\windows\system32\hostgxtm.dll
c:\windows\system32\skinboxer43.dll

.
((((((((((((((((((((((((( Files Created from 2010-04-15 to 2010-05-15 )))))))))))))))))))))))))))))))
.

2010-05-14 23:21 . 2010-05-14 23:21 -------- d-----w- c:\program files\gs
2010-05-14 23:20 . 2010-05-14 23:21 -------- d-----w- c:\program files\GameEx
2010-05-14 22:39 . 2010-05-14 22:39 96512 ----a-w- c:\windows\system32\drivers\ATAPI.SYS
2010-05-14 19:34 . 2010-05-14 22:41 -------- d-----w- c:\windows\system32\MpEngineStore
2010-05-14 10:56 . 2010-05-14 10:56 503808 ----a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2981f19e-n\msvcp71.dll
2010-05-14 10:56 . 2010-05-14 10:56 499712 ----a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2981f19e-n\jmc.dll
2010-05-14 10:56 . 2010-05-14 10:56 348160 ----a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2981f19e-n\msvcr71.dll
2010-05-14 10:56 . 2010-05-14 10:56 12800 ----a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-755dd8de-n\decora-d3d.dll
2010-05-14 10:56 . 2010-05-14 10:56 61440 ----a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-755dd8de-n\decora-sse.dll
2010-05-14 10:56 . 2010-05-14 10:56 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-05-14 00:24 . 2010-04-29 14:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-14 00:24 . 2010-05-14 00:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-14 00:24 . 2010-04-29 14:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-05-13 23:42 . 2010-05-13 23:42 -------- d-----w- c:\documents and settings\User\Application Data\Malwarebytes
2010-05-13 23:41 . 2010-05-13 23:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-05-12 23:03 . 2010-05-13 22:50 -------- d-----w- c:\program files\RegSupreme Pro
2010-05-09 21:24 . 2010-05-10 21:47 -------- d-----w- c:\program files\Womble Multimedia
2010-05-07 21:50 . 2010-05-07 21:50 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-05-07 21:49 . 2010-05-10 23:45 57344 ----a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-05-07 21:49 . 2010-05-07 21:44 1180952 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\DivXSetup.exe
2010-05-07 21:49 . 2010-03-15 18:54 530625 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DivX7\DivX Converter\DivXConverterUninstall.exe
2010-05-07 21:49 . 2010-03-15 18:54 530625 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DivX7\DivX Plus DirectShow Filters\DivXDSFiltersUninstall.exe
2010-05-07 21:45 . 2010-05-07 21:53 -------- d-----w- c:\documents and settings\User\Local Settings\Application Data\Temp
2010-05-07 21:45 . 2010-05-07 21:45 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2010-05-07 21:45 . 2010-05-07 22:09 -------- d-----w- c:\documents and settings\User\Local Settings\Application Data\Google
2010-05-07 21:45 . 2010-05-07 22:58 -------- d-----w- c:\program files\Google
2010-05-07 21:44 . 2010-05-10 23:45 -------- d-----w- c:\documents and settings\All Users\Application Data\DivX
2010-05-04 19:51 . 2010-05-04 19:51 -------- d-----w- c:\documents and settings\User\Application Data\Samsung
2010-05-04 19:47 . 2006-05-03 21:53 174592 ----a-w- c:\windows\system32\framedyn.dll
2010-05-04 19:47 . 2010-05-04 19:47 -------- d-----w- c:\windows\system32\Samsung_USB_Drivers
2010-05-04 19:47 . 2005-08-30 16:59 94000 ----a-w- c:\windows\system32\drivers\ss_mdm.sys
2010-05-04 19:47 . 2005-08-30 16:58 8304 ----a-w- c:\windows\system32\drivers\ss_mdfl.sys
2010-05-04 19:47 . 2005-08-30 16:58 6144 ----a-w- c:\windows\system32\drivers\ss_cmnt.sys
2010-05-04 19:47 . 2005-08-30 16:58 6144 ----a-w- c:\windows\system32\drivers\ss_cm.sys
2010-05-04 19:47 . 2005-08-30 16:57 58320 ----a-w- c:\windows\system32\drivers\ss_bus.sys
2010-05-04 19:47 . 2005-08-30 16:57 5808 ----a-w- c:\windows\system32\drivers\ss_whnt.sys
2010-05-04 19:47 . 2005-08-30 16:57 5808 ----a-w- c:\windows\system32\drivers\ss_wh.sys
2010-05-04 19:47 . 2006-07-24 15:05 5632 ----a-w- c:\windows\system32\drivers\StarOpen.sys
2010-05-04 19:46 . 2010-05-04 19:46 -------- d-----w- c:\program files\Samsung
2010-04-27 20:52 . 2006-12-11 09:20 180224 ----a-w- c:\documents and settings\User\Application Data\U3\000018742C63369B\79EB5C19-AB0E-4dd7-BE89-BF96301D35Z8\Exec\U3AppWrapper.exe
2010-04-27 20:52 . 2006-12-11 09:20 983829 ----a-w- c:\documents and settings\User\Application Data\U3\000018742C63369B\79EB5C19-AB0E-4dd7-BE89-BF96301D35Z8\Exec\master.exe
2010-04-27 20:52 . 2006-12-11 09:20 72192 ----a-w- c:\documents and settings\User\Application Data\U3\000018742C63369B\79EB5C19-AB0E-4dd7-BE89-BF96301D35Z8\Exec\TASKLIST.EXE
2010-04-27 20:52 . 2006-12-11 09:20 72192 ----a-w- c:\documents and settings\User\Application Data\U3\000018742C63369B\79EB5C19-AB0E-4dd7-BE89-BF96301D35Z8\Exec\TASKKILL.EXE
2010-04-27 20:52 . 2006-12-11 09:20 325 ----a-w- c:\documents and settings\User\Application Data\U3\000018742C63369B\79EB5C19-AB0E-4dd7-BE89-BF96301D35Z8\Exec\stopApp.bat
2010-04-27 20:52 . 2006-12-11 09:20 15 ----a-w- c:\documents and settings\User\Application Data\U3\000018742C63369B\79EB5C19-AB0E-4dd7-BE89-BF96301D35Z8\Exec\run_me.bat
2010-04-27 20:52 . 2006-12-11 09:20 40960 ----a-w- c:\documents and settings\User\Application Data\U3\000018742C63369B\79EB5C19-AB0E-4dd7-BE89-BF96301D35Z8\Exec\appstop.exe
2010-04-27 20:51 . 2006-12-07 09:45 3096576 ---ha-w- c:\documents and settings\User\Application Data\U3\temp\Launchpad Removal.exe
2010-04-27 20:51 . 2010-04-27 20:51 -------- d-----w- c:\documents and settings\User\Application Data\U3

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-15 17:37 . 2010-03-21 23:20 14633504 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-05-15 14:45 . 2010-03-21 23:20 196340 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-05-14 23:20 . 2010-02-15 20:39 18504 ----a-w- c:\documents and settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-05-14 23:04 . 2010-04-07 20:20 -------- d-----w- c:\documents and settings\User\Application Data\vlc
2010-05-14 10:58 . 2010-02-27 02:00 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-05-14 10:56 . 2008-07-16 14:35 -------- d-----w- c:\program files\Common Files\Java
2010-05-14 10:56 . 2008-07-16 14:35 -------- d-----w- c:\program files\Java
2010-05-14 00:02 . 2010-02-19 21:08 4212 ---h--w- c:\windows\system32\zllictbl.dat
2010-05-13 22:50 . 2010-02-19 21:46 -------- d-----w- c:\program files\Ask.com
2010-05-10 23:51 . 2010-03-15 18:54 -------- d-----w- c:\program files\DivX
2010-05-10 23:45 . 2010-03-15 18:54 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-05-09 21:06 . 2010-03-14 02:27 -------- d-----w- c:\program files\Blaze Media Pro
2010-05-07 21:49 . 2010-04-02 15:13 -------- d-----w- c:\documents and settings\User\Application Data\DivX
2010-05-05 20:36 . 2010-02-27 13:47 1 ----a-w- c:\documents and settings\User\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2010-05-05 20:36 . 2008-07-31 13:55 -------- d-----w- c:\documents and settings\User\Application Data\OpenOffice.org2
2010-05-04 19:46 . 2008-07-16 14:57 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-11 02:00 . 2010-04-08 23:53 -------- d-----w- c:\documents and settings\User\Application Data\dvdcss
2010-04-08 11:31 . 2010-04-08 11:31 32861 ----a-w- c:\documents and settings\All Users\SPL2.tmp
2010-04-08 01:03 . 2010-04-04 09:26 -------- d-----w- c:\program files\QuickPar
2010-04-07 20:19 . 2010-04-07 20:19 -------- d-----w- c:\program files\VideoLAN
2010-04-07 19:54 . 2010-04-04 08:40 -------- d-----w- c:\documents and settings\Tayyeb.USER-2ACEEDB3C2\Application Data\Apple Computer
2010-04-07 17:29 . 2010-03-21 18:52 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2010-04-05 23:10 . 2010-04-05 23:09 -------- d-----w- c:\program files\SureThing CD Labeler 5
2010-04-05 23:10 . 2010-04-05 23:10 -------- d-----w- c:\program files\Common Files\SureThing Shared
2010-04-05 22:37 . 2010-04-05 22:37 -------- d-----w- c:\documents and settings\All Users\Application Data\LightScribe
2010-04-05 22:36 . 2010-04-05 22:36 -------- d-----w- c:\program files\Common Files\LightScribe
2010-04-04 22:00 . 2010-03-14 21:57 -------- d-----w- c:\program files\Common Files\Apple
2010-04-04 08:44 . 2010-04-04 08:45 1597952 ----a-w- c:\windows\Internet Logs\xDB3.tmp
2010-04-04 08:40 . 2010-02-21 18:16 17672 ----a-w- c:\documents and settings\Tayyeb.USER-2ACEEDB3C2\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-03 12:42 . 2010-04-03 12:41 -------- d-----w- c:\program files\AltBinz
2010-04-03 12:18 . 2010-03-14 21:59 -------- d-----w- c:\documents and settings\User\Application Data\Apple Computer
2010-04-03 11:34 . 2010-04-03 10:28 -------- d-----w- c:\documents and settings\User\Application Data\AVS4YOU
2010-04-03 10:28 . 2010-04-03 10:18 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU
2010-04-03 10:24 . 2010-04-03 10:18 -------- d-----w- c:\program files\AVS4YOU
2010-04-03 10:22 . 2010-04-03 10:20 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-04-02 17:36 . 2010-03-14 21:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2010-04-02 15:21 . 2010-03-14 02:03 -------- d-----w- c:\program files\Total Video Converter
2010-04-02 13:10 . 2010-03-22 19:41 -------- d-----w- c:\documents and settings\Tayyeb.USER-2ACEEDB3C2\Application Data\MailFrontier
2010-03-30 23:05 . 2010-03-31 15:24 1267712 ----a-w- c:\windows\Internet Logs\xDB1.tmp
2010-03-30 23:05 . 2010-03-31 15:24 1466880 ----a-w- c:\windows\Internet Logs\xDB2.tmp
2010-03-28 15:28 . 2010-03-14 09:31 -------- d-----w- c:\documents and settings\Tayyeb.USER-2ACEEDB3C2\Application Data\BitTorrent
2010-03-28 14:54 . 2010-03-28 14:54 -------- d-----w- c:\program files\The Learning Company
2010-03-26 23:36 . 2010-03-13 00:16 137464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-03-26 23:36 . 2010-03-13 00:16 214520 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-03-22 17:31 . 2010-03-21 23:16 -------- d-----w- c:\documents and settings\All Users\Application Data\MailFrontier
2010-03-21 23:22 . 2010-03-21 23:22 -------- d-----w- c:\documents and settings\User\Application Data\MailFrontier
2010-03-21 23:16 . 2010-03-21 23:16 -------- d-----w- c:\program files\Zone Labs
2010-03-21 18:35 . 2010-02-27 21:21 -------- d-----w- c:\program files\Atari
2010-03-18 22:10 . 2010-03-10 21:33 -------- d-----w- c:\program files\Common Files\Adobe
2010-03-15 19:23 . 2010-03-15 19:23 98304 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-03-13 00:15 . 2010-03-13 00:15 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-03-11 22:25 . 2010-03-10 22:38 532 ----a-w- c:\windows\eReg.dat
2010-03-11 12:38 . 2004-08-04 12:00 832512 ----a-w- c:\windows\system32\wininet.dll
2010-03-11 12:38 . 2004-08-04 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-03-11 12:38 . 2004-08-04 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2010-03-09 11:09 . 2004-08-04 12:00 430080 ----a-w- c:\windows\system32\vbscript.dll
2010-03-05 17:52 . 2010-03-05 17:52 57406 ----a-w- c:\documents and settings\All Users\SPL1.tmp
2010-02-28 00:39 . 2010-02-28 00:39 1923768 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe
2010-02-27 23:59 . 2010-02-27 23:59 0 ----a-w- c:\windows\nsreg.dat
2010-02-24 13:11 . 2004-08-04 12:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-21 20:49 . 2010-02-21 20:49 21035 ----a-w- c:\windows\system32\drivers\AegisP.sys
2010-02-20 22:49 . 2010-02-20 22:44 47104 ----a-w- c:\windows\system32\KMVIDC32.DLL
2010-02-20 22:29 . 2010-02-20 22:29 4608 ----a-w- c:\windows\system32\w95inf32.dll
2010-02-20 22:29 . 2010-02-20 22:29 2272 ----a-w- c:\windows\system32\w95inf16.dll
2010-02-16 14:08 . 2004-08-04 12:00 2146304 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 13:25 . 2004-08-03 22:59 2024448 ----a-w- c:\windows\system32\ntkrnlpa.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-03-19 2363392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-02-15 417792]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-13 919016]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-04-29 437584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
REALTEK USB Wireless LAN Utility.lnk - c:\program files\REALTEK USB Wireless LAN Driver and Utility\RtWLan.exe [2010-2-21 786432]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\lxdxcoms.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxpswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxtime.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxjswx.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=

R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [21/02/2010 21:48 38144]
R2 lxdx_device;lxdx_device;c:\windows\system32\lxdxcoms.exe -service --> c:\windows\system32\lxdxcoms.exe -service [?]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [14/05/2010 01:25 304464]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [14/05/2010 01:24 20952]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\rtl8187B.sys [21/02/2010 21:48 209152]
S1 MpKslec6e37ed;MpKslec6e37ed;\??\c:\windows\system32\MpEngineStore\MpKslec6e37ed.sys --> c:\windows\system32\MpEngineStore\MpKslec6e37ed.sys [?]
S1 vvdfqcag;vvdfqcag;\??\c:\windows\system32\drivers\vvdfqcag.sys --> c:\windows\system32\drivers\vvdfqcag.sys [?]
S2 lxdxCATSCustConnectService;lxdxCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdxserv.exe [19/02/2010 23:07 98984]
S3 kbeepm;kbeepm;\??\c:\docume~1\TAYYEB~1.USE\LOCALS~1\Temp\kbeepm.sys --> c:\docume~1\TAYYEB~1.USE\LOCALS~1\Temp\kbeepm.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2010-03-19 10:15 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\hzod52s9.default\
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - ORPHANS REMOVED - - - -

BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dll
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dll
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dll
HKCU-Run-BitTorrent - c:\program files\BitTorrent\bittorrent.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2010-05-15 18:37
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2010-05-15 18:38:57
ComboFix-quarantined-files.txt 2010-05-15 17:38

Pre-Run: 72,058,056,704 bytes free
Post-Run: 75,138,473,984 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 270A0E4A019B73F1056247DDE154C60D

Azztec
Novice
Novice

Posts Posts : 11
Joined Joined : 2010-05-14
OS OS : xp
Points Points : 24111
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Redirect issues with browser.

Post by Belahzur on Sat May 15, 2010 9:15 pm

Hello.

  1. Close any open browsers.
  2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  3. Open notepad and copy/paste the text in the quotebox below into it:
    Code:

    KILLALL::

    Driver::
    MpKslec6e37ed
    vvdfqcag
    kbeepm
  4. Save this as CFScript.txt, in the same location as ComboFix.exe



  5. Referring to the picture above, drag CFScript into ComboFix.exe
  6. When finished, it shall produce a log for you at C:\ComboFix.txt
  7. Please post the contents of the log in your next reply.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245059
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Redirect issues with browser.

Post by Azztec on Sun May 16, 2010 1:47 am

HELP!! combofix has got to the end and is displaying a message that it is rebooting windows and to allow it to do so and warns against a manual reboot.
Combo fix is jammed at this screen and has been so for the last 3 hours.
what do i do???
please reply quick.

Azztec
Novice
Novice

Posts Posts : 11
Joined Joined : 2010-05-14
OS OS : xp
Points Points : 24111
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Redirect issues with browser.

Post by Azztec on Sun May 16, 2010 3:22 am

Well after pms to three mods and getting no reply ( although 2 were online) and a further hour or so with Combofix stalled i took the plunge and switched off my machine, on rebooting i got a log report for you ( although i am somewhat worried when i do not get a reply when problems arise with your advice.

ComboFix 10-05-15.01 - User 15/05/2010 23:46:59.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1648 [GMT 1:00]
Running from: c:\documents and settings\User\My Documents\Downloads\Combo-Fix.exe
Command switches used :: c:\documents and settings\User\My Documents\Downloads\CFScript.txt
AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Updated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
FW: ZoneAlarm Security Suite Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\hostgxtm.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_KBEEPM
-------\Legacy_MPKSLEC6E37ED
-------\Service_kbeepm
-------\Service_MpKslec6e37ed
-------\Service_vvdfqcag


((((((((((((((((((((((((( Files Created from 2010-04-16 to 2010-05-16 )))))))))))))))))))))))))))))))
.

2010-05-14 23:21 . 2010-05-14 23:21 -------- d-----w- c:\program files\gs
2010-05-14 23:20 . 2010-05-14 23:21 -------- d-----w- c:\program files\GameEx
2010-05-14 22:39 . 2010-05-14 22:39 96512 ----a-w- c:\windows\system32\drivers\ATAPI.SYS
2010-05-14 19:34 . 2010-05-14 22:41 -------- d-----w- c:\windows\system32\MpEngineStore
2010-05-14 10:56 . 2010-05-14 10:56 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-05-14 00:24 . 2010-04-29 14:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-14 00:24 . 2010-05-14 00:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-14 00:24 . 2010-04-29 14:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-05-13 23:42 . 2010-05-13 23:42 -------- d-----w- c:\documents and settings\User\Application Data\Malwarebytes
2010-05-13 23:41 . 2010-05-13 23:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-05-12 23:03 . 2010-05-13 22:50 -------- d-----w- c:\program files\RegSupreme Pro
2010-05-09 21:24 . 2010-05-10 21:47 -------- d-----w- c:\program files\Womble Multimedia
2010-05-07 21:50 . 2010-05-07 21:50 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-05-07 21:45 . 2010-05-07 21:53 -------- d-----w- c:\documents and settings\User\Local Settings\Application Data\Temp
2010-05-07 21:45 . 2010-05-07 21:45 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2010-05-07 21:45 . 2010-05-07 22:09 -------- d-----w- c:\documents and settings\User\Local Settings\Application Data\Google
2010-05-07 21:45 . 2010-05-07 22:58 -------- d-----w- c:\program files\Google
2010-05-07 21:44 . 2010-05-10 23:45 -------- d-----w- c:\documents and settings\All Users\Application Data\DivX
2010-05-04 19:51 . 2010-05-04 19:51 -------- d-----w- c:\documents and settings\User\Application Data\Samsung
2010-05-04 19:47 . 2006-05-03 21:53 174592 ----a-w- c:\windows\system32\framedyn.dll
2010-05-04 19:47 . 2010-05-04 19:47 -------- d-----w- c:\windows\system32\Samsung_USB_Drivers
2010-05-04 19:47 . 2005-08-30 16:59 94000 ----a-w- c:\windows\system32\drivers\ss_mdm.sys
2010-05-04 19:47 . 2005-08-30 16:58 8304 ----a-w- c:\windows\system32\drivers\ss_mdfl.sys
2010-05-04 19:47 . 2005-08-30 16:58 6144 ----a-w- c:\windows\system32\drivers\ss_cmnt.sys
2010-05-04 19:47 . 2005-08-30 16:58 6144 ----a-w- c:\windows\system32\drivers\ss_cm.sys
2010-05-04 19:47 . 2005-08-30 16:57 58320 ----a-w- c:\windows\system32\drivers\ss_bus.sys
2010-05-04 19:47 . 2005-08-30 16:57 5808 ----a-w- c:\windows\system32\drivers\ss_whnt.sys
2010-05-04 19:47 . 2005-08-30 16:57 5808 ----a-w- c:\windows\system32\drivers\ss_wh.sys
2010-05-04 19:47 . 2006-07-24 15:05 5632 ----a-w- c:\windows\system32\drivers\StarOpen.sys
2010-05-04 19:46 . 2010-05-04 19:46 -------- d-----w- c:\program files\Samsung
2010-04-27 20:51 . 2010-04-27 20:51 -------- d-----w- c:\documents and settings\User\Application Data\U3

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-15 22:52 . 2010-03-21 23:20 14708768 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-05-15 18:05 . 2010-03-21 23:20 197276 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-05-14 23:20 . 2010-02-15 20:39 18504 ----a-w- c:\documents and settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-05-14 23:04 . 2010-04-07 20:20 -------- d-----w- c:\documents and settings\User\Application Data\vlc
2010-05-14 10:58 . 2010-02-27 02:00 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-05-14 10:56 . 2008-07-16 14:35 -------- d-----w- c:\program files\Common Files\Java
2010-05-14 10:56 . 2010-05-14 10:56 503808 ----a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2981f19e-n\msvcp71.dll
2010-05-14 10:56 . 2010-05-14 10:56 499712 ----a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2981f19e-n\jmc.dll
2010-05-14 10:56 . 2010-05-14 10:56 348160 ----a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2981f19e-n\msvcr71.dll
2010-05-14 10:56 . 2010-05-14 10:56 12800 ----a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-755dd8de-n\decora-d3d.dll
2010-05-14 10:56 . 2010-05-14 10:56 61440 ----a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-755dd8de-n\decora-sse.dll
2010-05-14 10:56 . 2008-07-16 14:35 -------- d-----w- c:\program files\Java
2010-05-14 00:02 . 2010-02-19 21:08 4212 ---h--w- c:\windows\system32\zllictbl.dat
2010-05-13 22:50 . 2010-02-19 21:46 -------- d-----w- c:\program files\Ask.com
2010-05-10 23:51 . 2010-03-15 18:54 -------- d-----w- c:\program files\DivX
2010-05-10 23:45 . 2010-05-07 21:49 57344 ----a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-05-10 23:45 . 2010-03-15 18:54 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-05-09 21:06 . 2010-03-14 02:27 -------- d-----w- c:\program files\Blaze Media Pro
2010-05-07 21:49 . 2010-04-02 15:13 -------- d-----w- c:\documents and settings\User\Application Data\DivX
2010-05-07 21:44 . 2010-05-07 21:49 1180952 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\DivXSetup.exe
2010-05-05 20:36 . 2010-02-27 13:47 1 ----a-w- c:\documents and settings\User\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2010-05-05 20:36 . 2008-07-31 13:55 -------- d-----w- c:\documents and settings\User\Application Data\OpenOffice.org2
2010-05-04 19:46 . 2008-07-16 14:57 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-11 02:00 . 2010-04-08 23:53 -------- d-----w- c:\documents and settings\User\Application Data\dvdcss
2010-04-08 11:31 . 2010-04-08 11:31 32861 ----a-w- c:\documents and settings\All Users\SPL2.tmp
2010-04-08 01:03 . 2010-04-04 09:26 -------- d-----w- c:\program files\QuickPar
2010-04-07 20:19 . 2010-04-07 20:19 -------- d-----w- c:\program files\VideoLAN
2010-04-07 19:54 . 2010-04-04 08:40 -------- d-----w- c:\documents and settings\Tayyeb.USER-2ACEEDB3C2\Application Data\Apple Computer
2010-04-07 17:29 . 2010-03-21 18:52 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2010-04-05 23:10 . 2010-04-05 23:09 -------- d-----w- c:\program files\SureThing CD Labeler 5
2010-04-05 23:10 . 2010-04-05 23:10 -------- d-----w- c:\program files\Common Files\SureThing Shared
2010-04-05 22:37 . 2010-04-05 22:37 -------- d-----w- c:\documents and settings\All Users\Application Data\LightScribe
2010-04-05 22:36 . 2010-04-05 22:36 -------- d-----w- c:\program files\Common Files\LightScribe
2010-04-04 22:00 . 2010-03-14 21:57 -------- d-----w- c:\program files\Common Files\Apple
2010-04-04 08:44 . 2010-04-04 08:45 1597952 ----a-w- c:\windows\Internet Logs\xDB3.tmp
2010-04-04 08:40 . 2010-02-21 18:16 17672 ----a-w- c:\documents and settings\Tayyeb.USER-2ACEEDB3C2\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-03 12:42 . 2010-04-03 12:41 -------- d-----w- c:\program files\AltBinz
2010-04-03 12:18 . 2010-03-14 21:59 -------- d-----w- c:\documents and settings\User\Application Data\Apple Computer
2010-04-03 11:34 . 2010-04-03 10:28 -------- d-----w- c:\documents and settings\User\Application Data\AVS4YOU
2010-04-03 10:28 . 2010-04-03 10:18 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU
2010-04-03 10:24 . 2010-04-03 10:18 -------- d-----w- c:\program files\AVS4YOU
2010-04-03 10:22 . 2010-04-03 10:20 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-04-02 17:36 . 2010-03-14 21:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2010-04-02 15:21 . 2010-03-14 02:03 -------- d-----w- c:\program files\Total Video Converter
2010-04-02 13:10 . 2010-03-22 19:41 -------- d-----w- c:\documents and settings\Tayyeb.USER-2ACEEDB3C2\Application Data\MailFrontier
2010-03-30 23:05 . 2010-03-31 15:24 1267712 ----a-w- c:\windows\Internet Logs\xDB1.tmp
2010-03-30 23:05 . 2010-03-31 15:24 1466880 ----a-w- c:\windows\Internet Logs\xDB2.tmp
2010-03-28 15:28 . 2010-03-14 09:31 -------- d-----w- c:\documents and settings\Tayyeb.USER-2ACEEDB3C2\Application Data\BitTorrent
2010-03-28 14:54 . 2010-03-28 14:54 -------- d-----w- c:\program files\The Learning Company
2010-03-26 23:36 . 2010-03-13 00:16 137464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-03-26 23:36 . 2010-03-13 00:16 214520 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-03-22 17:31 . 2010-03-21 23:16 -------- d-----w- c:\documents and settings\All Users\Application Data\MailFrontier
2010-03-21 23:22 . 2010-03-21 23:22 -------- d-----w- c:\documents and settings\User\Application Data\MailFrontier
2010-03-21 23:16 . 2010-03-21 23:16 -------- d-----w- c:\program files\Zone Labs
2010-03-21 18:35 . 2010-02-27 21:21 -------- d-----w- c:\program files\Atari
2010-03-18 22:10 . 2010-03-10 21:33 -------- d-----w- c:\program files\Common Files\Adobe
2010-03-15 19:23 . 2010-03-15 19:23 98304 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-03-15 18:54 . 2010-05-07 21:49 530625 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DivX7\DivX Plus DirectShow Filters\DivXDSFiltersUninstall.exe
2010-03-15 18:54 . 2010-05-07 21:49 530625 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DivX7\DivX Converter\DivXConverterUninstall.exe
2010-03-13 00:15 . 2010-03-13 00:15 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-03-11 22:25 . 2010-03-10 22:38 532 ----a-w- c:\windows\eReg.dat
2010-03-11 12:38 . 2004-08-04 12:00 832512 ----a-w- c:\windows\system32\wininet.dll
2010-03-11 12:38 . 2004-08-04 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-03-11 12:38 . 2004-08-04 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2010-03-09 11:09 . 2004-08-04 12:00 430080 ----a-w- c:\windows\system32\vbscript.dll
2010-03-05 17:52 . 2010-03-05 17:52 57406 ----a-w- c:\documents and settings\All Users\SPL1.tmp
2010-02-28 00:39 . 2010-02-28 00:39 1923768 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe
2010-02-27 23:59 . 2010-02-27 23:59 0 ----a-w- c:\windows\nsreg.dat
2010-02-24 13:11 . 2004-08-04 12:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-21 20:49 . 2010-02-21 20:49 21035 ----a-w- c:\windows\system32\drivers\AegisP.sys
2010-02-20 22:49 . 2010-02-20 22:44 47104 ----a-w- c:\windows\system32\KMVIDC32.DLL
2010-02-20 22:29 . 2010-02-20 22:29 4608 ----a-w- c:\windows\system32\w95inf32.dll
2010-02-20 22:29 . 2010-02-20 22:29 2272 ----a-w- c:\windows\system32\w95inf16.dll
2010-02-16 14:08 . 2004-08-04 12:00 2146304 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 13:25 . 2004-08-03 22:59 2024448 ----a-w- c:\windows\system32\ntkrnlpa.exe
.

((((((((((((((((((((((((((((( [You must be registered and logged in to see this link.] )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-05-16 03:08 . 2010-05-16 03:08 16384 c:\windows\temp\Perflib_Perfdata_1c0.dat
+ 2010-03-21 23:20 . 2010-05-16 03:08 775584 c:\windows\system32\ZoneLabs\avsys\bases\sfdb.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-03-19 2363392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-02-15 417792]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-13 919016]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-04-29 437584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
REALTEK USB Wireless LAN Utility.lnk - c:\program files\REALTEK USB Wireless LAN Driver and Utility\RtWLan.exe [2010-2-21 786432]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\lxdxcoms.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxpswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxtime.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxjswx.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=

R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [21/02/2010 21:48 38144]
R2 lxdx_device;lxdx_device;c:\windows\system32\lxdxcoms.exe -service --> c:\windows\system32\lxdxcoms.exe -service [?]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [14/05/2010 01:25 304464]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [14/05/2010 01:24 20952]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\rtl8187B.sys [21/02/2010 21:48 209152]
S2 lxdxCATSCustConnectService;lxdxCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdxserv.exe [19/02/2010 23:07 98984]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2010-03-19 10:15 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\hzod52s9.default\
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2010-05-16 04:08
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3308)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\lxdxcoms.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
.
**************************************************************************
.
Completion time: 2010-05-16 04:14:12 - machine was rebooted
ComboFix-quarantined-files.txt 2010-05-16 03:14
ComboFix2.txt 2010-05-15 17:38

Pre-Run: 67,741,507,584 bytes free
Post-Run: 67,654,955,008 bytes free

- - End Of File - - 4BE93DBA25088B6775D167531332FB15

Azztec
Novice
Novice

Posts Posts : 11
Joined Joined : 2010-05-14
OS OS : xp
Points Points : 24111
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Redirect issues with browser.

Post by Belahzur on Sun May 16, 2010 7:45 pm

Hello.

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /uninstall

This will also reset your restore points.

Run ESET Online Scan
Please do an online scan with [You must be registered and logged in to see this link.]. Please use Internet Explorer as it uses ActiveX.

  • Check (tick) this box: YES, I accept the Terms of Use.
  • Click on the Start button next to it.
  • When prompted to run ActiveX. click Yes.
  • You will be asked to install an ActiveX. Click Install.
  • Once installed, the scanner will be initialized.
  • After the scanner is initialized, click Start.
  • Check (tick) Remove found threats box.
  • Check (tick) Scan unwanted applications.
  • Click on Scan.
  • It will start scanning. Please be patient.
  • Once the scan is done, the log will be saved here: C:\Program Files\esetonlinescanner\log.txt.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245059
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Redirect issues with browser.

Post by Azztec on Sun May 16, 2010 11:27 pm

Heres the online eset log.it seems to have found one item and removed it.
thanks.
Is there anything else i need to do or am i clean now?

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=7.00.6000.17023 (vista_gdr.100222-0012)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=e38ab259e129f140ac35f7c85d9c9f94
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-05-16 11:23:56
# local_time=2010-05-17 12:23:56 (+0000, GMT Daylight Time)
# country="United Kingdom"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1026 16777214 0 2 4836406 4836406 0 0
# compatibility_mode=8192 67108863 100 0 246 246 0 0
# compatibility_mode=9217 16777173 100 67 4836077 68603197 0 0
# scanned=66447
# found=1
# cleaned=1
# scan_time=6260
C:\Documents and Settings\User\Desktop\AVS\AVS VC\AVS.VC.6.3.1.367_[DesTroYeR]\AVS Video Converter v6.3.1.367\Crack\AVSVideoConverter.exe a variant of MSIL/TrojanDropper.Agent.AL trojan (deleted - quarantined) 00000000000000000000000000000000 C

Azztec
Novice
Novice

Posts Posts : 11
Joined Joined : 2010-05-14
OS OS : xp
Points Points : 24111
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Redirect issues with browser.

Post by Belahzur on Mon May 17, 2010 9:46 pm

Hello.

Please download CKScanner by askey127 from [You must be registered and logged in to see this link.]
Save it to your desktop.

  • Doubleclick CKScanner.exe and click Search For Files.
  • After a very short time, when the cursor hourglass disappears, click Save List To File.
  • A message box will verify that the file is saved.
  • Double-click the CKFiles.txt icon on your desktop and copy/paste the contents in your next reply.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245059
# Likes # Likes : 1

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum