Internet
Closed
Gervarod
-
Apr 26, 2010 at 05:48 AM
Ambucias Posts 47356 Registration date Monday February 1, 2010 Status Moderator Last seen February 15, 2023 - Apr 29, 2010 at 09:53 AM
Ambucias Posts 47356 Registration date Monday February 1, 2010 Status Moderator Last seen February 15, 2023 - Apr 29, 2010 at 09:53 AM
Related:
- Internet
- Fenix internet l - Guide
- Internet cafe simulator 2 pc download - Download - Simulation
- Internet explorer 11 for windows 10 64-bit - Download - Browsers
- Internet cafe simulator pc download - Download - Simulation
- Share internet from pc to iphone - Guide
5 responses
Ambucias
Posts
47356
Registration date
Monday February 1, 2010
Status
Moderator
Last seen
February 15, 2023
11,167
Apr 26, 2010 at 07:37 AM
Apr 26, 2010 at 07:37 AM
Hi Gervarod,
Oh boy, here we go again!
Do you have a greenhouse where you grow theses viruses?:)))
Lets Hyjack this one, but I can promise you an answer until later today.
Catch you later alligator!
Oh boy, here we go again!
Do you have a greenhouse where you grow theses viruses?:)))
Lets Hyjack this one, but I can promise you an answer until later today.
Catch you later alligator!
Ambucias
Posts
47356
Registration date
Monday February 1, 2010
Status
Moderator
Last seen
February 15, 2023
11,167
Apr 26, 2010 at 04:31 PM
Apr 26, 2010 at 04:31 PM
Hello Gervarod
You log looks okay at first glance. Yet I would get rid of
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
It is risky yet useless.
Do you always get redirected to the same sites? I would think that there is Trojan Horse muffins in your registry and perhaps sys32.
It is difficult to check at a distance.
Lets try to things:
1. Download CCleaner and run both a temp file and registry clean.
https://ccm.net/downloads/security-and-maintenance/4555-ccleaner/
2. Run your Spybot
You log looks okay at first glance. Yet I would get rid of
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
It is risky yet useless.
Do you always get redirected to the same sites? I would think that there is Trojan Horse muffins in your registry and perhaps sys32.
It is difficult to check at a distance.
Lets try to things:
1. Download CCleaner and run both a temp file and registry clean.
https://ccm.net/downloads/security-and-maintenance/4555-ccleaner/
2. Run your Spybot
Ambucias
Posts
47356
Registration date
Monday February 1, 2010
Status
Moderator
Last seen
February 15, 2023
11,167
Apr 27, 2010 at 05:42 AM
Apr 27, 2010 at 05:42 AM
Hello Gervarod,
I think that you are marooned even doomed, let's erase your hardrive and start all over!
Come to think of it let's not...
I looked at the Top 5 review site, not nice at all!
Did you remove ?
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
1. Download link: http://live.sysinternals.com/procexp.exe
*2. Double-click to run it.
*3. Select Security Tool process from the list.
See if you can locate any unfamiliar processes such as numerical processes
press "Delete" button to end the process.
*4. Close Process Explorer.
5. Download
http://pagesperso-orange.fr/NosTools/C_XX/AD-R.exe
*Close all running applications
*Double click the installer and install it in its default location (C: Program files)
*Under Vista: Make a right-click the shortcut created and click "Run as Administrator"
*At the main menu select "S" (Start scan)
*A report will appear after scan the post it on the forum (it is also saved as C: Ad-Report-SCAN.log)
I think that you are marooned even doomed, let's erase your hardrive and start all over!
Come to think of it let's not...
I looked at the Top 5 review site, not nice at all!
Did you remove ?
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
1. Download link: http://live.sysinternals.com/procexp.exe
*2. Double-click to run it.
*3. Select Security Tool process from the list.
See if you can locate any unfamiliar processes such as numerical processes
press "Delete" button to end the process.
*4. Close Process Explorer.
5. Download
http://pagesperso-orange.fr/NosTools/C_XX/AD-R.exe
*Close all running applications
*Double click the installer and install it in its default location (C: Program files)
*Under Vista: Make a right-click the shortcut created and click "Run as Administrator"
*At the main menu select "S" (Start scan)
*A report will appear after scan the post it on the forum (it is also saved as C: Ad-Report-SCAN.log)
Ambucias
Posts
47356
Registration date
Monday February 1, 2010
Status
Moderator
Last seen
February 15, 2023
11,167
Apr 27, 2010 at 07:32 AM
Apr 27, 2010 at 07:32 AM
No that was a joke, just to see your reaction, never mind my dark sense of humour.
Did the removal of the BHO help?
Have you run the apps I sent you?
Did the removal of the BHO help?
Have you run the apps I sent you?
Ambucias
Posts
47356
Registration date
Monday February 1, 2010
Status
Moderator
Last seen
February 15, 2023
11,167
Apr 27, 2010 at 07:52 AM
Apr 27, 2010 at 07:52 AM
I cant see anything
Ambucias
Posts
47356
Registration date
Monday February 1, 2010
Status
Moderator
Last seen
February 15, 2023
11,167
Apr 27, 2010 at 08:48 AM
Apr 27, 2010 at 08:48 AM
Only if the tool did not give you the option to fix,
Using explorer find and delete the following:
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("browser.search.defaultengine", "Ask.com");
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("browser.search.order.1", "Ask.com");
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("extensions.asktb.cbid", "UH");
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("extensions.asktb.default-channel-url-mask", "hxxp://www.ask.com/web?q={query}&o={o}&l={l}&qsrc={qsrc}");
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("extensions.asktb.fresh-install", false);
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("extensions.asktb.l", "dis");
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("extensions.asktb.last-config-req", "1270706778485");
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("extensions.asktb.locale", "en_US");
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("extensions.asktb.o", "15154");
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("extensions.asktb.overlay-reloaded-using-restart", true);
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("extensions.asktb.qsrc", "2871");
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("extensions.asktb.r", "2");
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("extensions.asktb.search-suggestions-uri", "hxxp://ss.websearch.ask.com/query?qsrc=2922&li=ff&sstype=prefix&q={searchTerms}");
The reboot and report to me.
P.S. Do you know what the weather is like right now in Australia?
Using explorer find and delete the following:
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("browser.search.defaultengine", "Ask.com");
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("browser.search.order.1", "Ask.com");
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("extensions.asktb.cbid", "UH");
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("extensions.asktb.default-channel-url-mask", "hxxp://www.ask.com/web?q={query}&o={o}&l={l}&qsrc={qsrc}");
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("extensions.asktb.fresh-install", false);
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("extensions.asktb.l", "dis");
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("extensions.asktb.last-config-req", "1270706778485");
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("extensions.asktb.locale", "en_US");
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("extensions.asktb.o", "15154");
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("extensions.asktb.overlay-reloaded-using-restart", true);
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("extensions.asktb.qsrc", "2871");
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("extensions.asktb.r", "2");
C:\Users\HomeComputer\..\hvyghk99.default\prefs.js - user_pref("extensions.asktb.search-suggestions-uri", "hxxp://ss.websearch.ask.com/query?qsrc=2922&li=ff&sstype=prefix&q={searchTerms}");
The reboot and report to me.
P.S. Do you know what the weather is like right now in Australia?
Ambucias
Posts
47356
Registration date
Monday February 1, 2010
Status
Moderator
Last seen
February 15, 2023
11,167
Apr 27, 2010 at 09:00 AM
Apr 27, 2010 at 09:00 AM
Just wondered, for here, in Quebec, although we had balmy weather, today we have light melting snow, and I also wondered if you knew how I got to know that you are in Australia.
Ambucias
Posts
47356
Registration date
Monday February 1, 2010
Status
Moderator
Last seen
February 15, 2023
11,167
Apr 27, 2010 at 09:16 AM
Apr 27, 2010 at 09:16 AM
Yes, you got it!
So did the tool give you the option to fix or are you going to delete manually?
So did the tool give you the option to fix or are you going to delete manually?
Didn't find the answer you are looking for?
Ask a question
Ambucias
Posts
47356
Registration date
Monday February 1, 2010
Status
Moderator
Last seen
February 15, 2023
11,167
Apr 27, 2010 at 10:14 AM
Apr 27, 2010 at 10:14 AM
Allright then, we will administrate the ultimate, most powerfull medicinal compound.
Mind you we did clean a lot horse mamure.
Just a note aside, when I went to top5 review, when I saw the window asking "Why have been redirected to this site" anybody normal and quick on the mouse, would want to know. Bang you are infected! SOB's!
Type, type, type... I will just copy and paste but pretend I did type and take it personal.
To keep your system safe, you must follow the instructions hereunder to the letter:
1. Download Combofix to your desktop.
http://www.combofix.org/download.php
2.Close all open Windows including this one.
Close or disable all running Antivirus, Antispyware, and Firewall programs as they may interfere with the proper running of ComboFix.
3. Double click on the ComboFix icon.
Windows is issuing this prompt because ComboFix does not have a digital signature. This is perfectly normal and safe and you can click on the Run button to continue.
4. Accept the disclaimer and the recovery
5.You should now press the Yes button to continue. If at any time during the Recovery Console installation you receive a message stating that it failed to install, please allow ComboFix to continue with the scan of your computer.
ComboFix will disconnect your computer from the Internet, so do not be surprised or concerned if you receive any warnings stating that you are no longer on the Internet. When ComboFix has finished it will automatically restore your Internet connection.
While the program is scanning your computer, it will change your clock format, so do not be concerned when you see this happen. When ComboFix is finished it will restore your clock settings to their previous settings.
If you see your Windows desktop disappear, do not worry. This is normal and ComboFix will restore your desktop before it is finished. Eventually you will see a new screen that states the program is almost finished and telling you the programs log file, or report, will be located at C:\ComboFix.txt.
Once you are done, paste the log here and report to me on how your system is behaving.
That should fic it for sure. When you find that you are no longer getting redirected, please make a new restore point.
I must now go off line, it is 11:15 AM, must run some errunds. Will return in 6 hours if not tomorrow morning, evening for you.
Good luck and don't do anything I wouldn't do.
Mind you we did clean a lot horse mamure.
Just a note aside, when I went to top5 review, when I saw the window asking "Why have been redirected to this site" anybody normal and quick on the mouse, would want to know. Bang you are infected! SOB's!
Type, type, type... I will just copy and paste but pretend I did type and take it personal.
To keep your system safe, you must follow the instructions hereunder to the letter:
1. Download Combofix to your desktop.
http://www.combofix.org/download.php
2.Close all open Windows including this one.
Close or disable all running Antivirus, Antispyware, and Firewall programs as they may interfere with the proper running of ComboFix.
3. Double click on the ComboFix icon.
Windows is issuing this prompt because ComboFix does not have a digital signature. This is perfectly normal and safe and you can click on the Run button to continue.
4. Accept the disclaimer and the recovery
5.You should now press the Yes button to continue. If at any time during the Recovery Console installation you receive a message stating that it failed to install, please allow ComboFix to continue with the scan of your computer.
ComboFix will disconnect your computer from the Internet, so do not be surprised or concerned if you receive any warnings stating that you are no longer on the Internet. When ComboFix has finished it will automatically restore your Internet connection.
While the program is scanning your computer, it will change your clock format, so do not be concerned when you see this happen. When ComboFix is finished it will restore your clock settings to their previous settings.
If you see your Windows desktop disappear, do not worry. This is normal and ComboFix will restore your desktop before it is finished. Eventually you will see a new screen that states the program is almost finished and telling you the programs log file, or report, will be located at C:\ComboFix.txt.
Once you are done, paste the log here and report to me on how your system is behaving.
That should fic it for sure. When you find that you are no longer getting redirected, please make a new restore point.
I must now go off line, it is 11:15 AM, must run some errunds. Will return in 6 hours if not tomorrow morning, evening for you.
Good luck and don't do anything I wouldn't do.
Hell good if you told me combofix took a while to get started but it was done mate. heres the log file from it...............
ComboFix 10-04-26.05 - HomeComputer 28/04/2010 2:08.1.2 - x86
Microsoft® Windows Vista(TM) Home Premium 6.0.6001.1.1252.61.1033.18.3032.2013 [GMT 10:00]
Running from: c:\users\HomeComputer\Downloads\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\install.exe
c:\users\HomeComputer\AppData\Roaming\inst.exe
c:\windows\system32\oem10.inf
.
((((((((((((((((((((((((( Files Created from 2010-03-27 to 2010-04-27 )))))))))))))))))))))))))))))))
.
2010-04-27 16:19 . 2010-04-27 16:20 -------- d-----w- c:\users\HomeComputer\AppData\Local\temp
2010-04-27 16:19 . 2010-04-27 16:19 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-04-27 16:19 . 2010-04-27 16:19 -------- d-----w- c:\users\April\AppData\Local\temp
2010-04-27 13:04 . 2010-04-27 14:44 -------- d-----w- C:\Ad-Remover
2010-04-27 03:06 . 2010-04-27 03:06 -------- d-----w- c:\program files\CCleaner
2010-04-26 16:48 . 2010-04-26 16:48 388096 ----a-r- c:\users\HomeComputer\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-04-26 11:11 . 2010-04-26 11:11 -------- d-----w- c:\program files\BattleshipGame
2010-04-23 14:22 . 2010-04-23 14:22 -------- d-----w- c:\program files\Trend Micro
2010-04-23 11:25 . 2010-04-24 03:19 -------- d-----w- c:\programdata\fssg
2010-04-22 08:10 . 2010-04-27 14:15 -------- d-----w- c:\users\HomeComputer\AppData\Roaming\mp3ripper
2010-04-22 08:10 . 2009-03-17 15:48 72704 ----a-w- c:\users\HomeComputer\AppData\Roaming\MSDLL\avutil-49.dll
2010-04-22 08:10 . 2009-03-17 15:48 694784 ----a-w- c:\users\HomeComputer\AppData\Roaming\MSDLL\avformat-52.dll
2010-04-22 08:10 . 2009-03-17 15:48 62976 ----a-w- c:\users\HomeComputer\AppData\Roaming\MSDLL\avfilter-0.dll
2010-04-22 08:10 . 2009-03-17 15:48 181760 ----a-w- c:\users\HomeComputer\AppData\Roaming\MSDLL\swscale-0.dll
2010-04-22 08:10 . 2009-03-17 15:48 10752 ----a-w- c:\users\HomeComputer\AppData\Roaming\MSDLL\avdevice-52.dll
2010-04-22 08:10 . 2008-08-29 07:58 321536 ----a-w- c:\users\HomeComputer\AppData\Roaming\MSDLL\SDL.dll
2010-04-22 08:10 . 2008-07-27 12:36 22528 ----a-w- c:\users\HomeComputer\AppData\Roaming\MSDLL\myutil.dll
2010-04-22 08:10 . 2010-04-22 08:10 -------- d-----w- c:\users\HomeComputer\AppData\Roaming\MSDLL
2010-04-22 08:10 . 2010-04-22 08:10 -------- d-----w- c:\program files\Free YouTube MP3 Ripper
2010-04-22 08:10 . 2009-05-29 17:26 8346624 ----a-w- c:\users\HomeComputer\AppData\Roaming\MSDLL\avcodec-52.dll
2010-04-21 23:06 . 2010-04-14 16:35 162768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-04-21 23:06 . 2010-04-14 16:31 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-04-21 23:06 . 2010-04-14 16:31 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-04-21 23:06 . 2010-04-14 16:35 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-04-21 23:06 . 2010-04-14 16:31 51792 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2010-04-21 23:06 . 2010-04-14 16:47 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-04-21 23:06 . 2010-04-14 16:47 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-04-21 17:32 . 2010-04-21 23:06 -------- d-----w- c:\programdata\Alwil Software
2010-04-21 17:32 . 2010-04-21 17:32 -------- d-----w- c:\program files\Alwil Software
2010-04-21 15:46 . 2010-04-21 15:49 -------- d-----w- C:\ConverterOutput
2010-04-21 15:46 . 2004-10-12 04:42 262144 ----a-w- c:\windows\system32\TomsMoComp_ff.dll
2010-04-21 15:46 . 2004-10-05 06:16 395776 ----a-w- c:\windows\system32\libmplayer.dll
2010-04-21 15:46 . 2004-10-03 15:50 112640 ----a-w- c:\windows\system32\libmpeg2_ff.dll
2010-04-21 15:46 . 2004-09-10 03:50 34820 ----a-w- c:\windows\system32\ffdshow.reg
2010-04-21 15:46 . 2004-10-12 04:40 2255360 ----a-w- c:\windows\system32\libavcodec.dll
2010-04-21 15:46 . 2010-04-21 15:46 -------- d-----w- c:\program files\Cucusoft
2010-04-21 15:41 . 2010-04-21 22:40 -------- d-----w- c:\users\HomeComputer\AppData\Roaming\Vso
2010-04-21 15:41 . 2010-04-21 22:40 47360 ----a-w- c:\users\HomeComputer\AppData\Roaming\pcouffin.sys
2010-04-21 09:31 . 2010-04-21 09:31 -------- d-----w- c:\users\April\AppData\Local\Apple
2010-04-20 07:58 . 2010-04-20 07:58 -------- d-----w- c:\users\April\AppData\Local\WLDM
2010-04-19 17:02 . 2010-04-19 17:02 -------- d-----w- c:\windows\system32\EventProviders
2010-04-18 11:46 . 2010-04-18 11:46 -------- d-----w- c:\users\HomeComputer\AppData\Local\Apple Computer
2010-04-18 11:32 . 2010-04-18 11:33 -------- d-----w- c:\program files\QuickTime
2010-04-18 11:32 . 2010-04-18 11:32 -------- d-----w- c:\programdata\Apple Computer
2010-04-18 11:32 . 2010-04-18 11:32 -------- d-----w- c:\program files\Common Files\Apple
2010-04-18 11:31 . 2010-04-18 11:31 -------- d-----w- c:\users\HomeComputer\AppData\Local\Apple
2010-04-18 11:31 . 2010-04-18 11:31 -------- d-----w- c:\program files\Apple Software Update
2010-04-18 11:31 . 2010-04-18 11:31 -------- d-----w- c:\programdata\Apple
2010-04-18 10:25 . 2010-04-18 10:25 -------- d-----w- c:\users\HomeComputer\AppData\Local\WLDM
2010-04-18 06:47 . 2010-04-18 06:47 -------- d-----w- c:\programdata\Office Genuine Advantage
2010-04-18 05:39 . 2010-04-18 05:39 -------- d-----w- c:\users\April\AppData\Roaming\DivX
2010-04-17 15:20 . 2010-04-27 14:34 -------- d-----w- c:\users\HomeComputer\Tracing
2010-04-17 15:20 . 2010-04-17 15:20 -------- d-----w- c:\program files\Microsoft
2010-04-17 15:20 . 2010-04-17 15:20 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-04-17 15:19 . 2010-04-18 10:25 -------- d-----w- c:\program files\Windows Live
2010-04-17 15:19 . 2010-04-17 15:19 -------- d-----w- c:\windows\PCHEALTH
2010-04-17 15:17 . 2010-04-17 15:17 -------- d-----w- c:\program files\Common Files\Windows Live
2010-04-16 10:01 . 2010-04-16 10:01 -------- d-----w- c:\users\HomeComputer\AppData\Roaming\runic games
2010-04-16 09:57 . 2010-04-16 09:57 -------- d-----w- c:\program files\SystemRequirementsLab
2010-04-16 09:57 . 2010-04-16 09:57 85504 ----a-w- c:\users\HomeComputer\AppData\Roaming\SystemRequirementsLab\srlproxy_cyri_4.1.71.0A.dll
2010-04-16 09:57 . 2010-04-16 09:57 -------- d-----w- c:\users\HomeComputer\AppData\Roaming\SystemRequirementsLab
2010-04-16 00:01 . 2010-04-23 11:23 -------- d-----w- c:\programdata\F-Secure
2010-04-15 23:51 . 2010-04-15 23:51 -------- d-----w- c:\windows\Sun
2010-04-15 23:51 . 2010-04-15 23:51 -------- d-----w- c:\program files\Common Files\Java
2010-04-15 23:51 . 2010-04-15 23:50 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-04-15 23:50 . 2010-04-15 23:50 -------- d-----w- c:\program files\Java
2010-04-15 23:43 . 2010-04-15 23:43 56766 ----a-w- c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-04-15 23:43 . 2010-04-15 23:43 57679 ----a-w- c:\programdata\DivX\Player\Uninstaller.exe
2010-04-15 23:43 . 2010-04-15 23:43 84040 ----a-w- c:\programdata\DivX\TransferWizard\Uninstaller.exe
2010-04-15 23:43 . 2010-04-15 23:43 57532 ----a-w- c:\programdata\DivX\DSASPDecoder\Uninstaller.exe
2010-04-15 23:43 . 2010-04-15 23:43 54166 ----a-w- c:\programdata\DivX\DSAVCDecoder\Uninstaller.exe
2010-04-15 23:43 . 2010-04-15 23:43 54153 ----a-w- c:\programdata\DivX\DFXPlugin\Uninstaller.exe
2010-04-15 23:43 . 2010-04-15 23:43 54128 ----a-w- c:\programdata\DivX\Converter\Uninstaller.exe
2010-04-15 23:43 . 2010-04-15 23:43 57409 ----a-w- c:\programdata\DivX\ControlPanel\Uninstaller.exe
2010-04-15 12:19 . 2010-04-15 12:19 -------- d-----w- c:\users\April\AppData\Local\Mozilla
2010-04-15 12:19 . 2010-04-20 08:04 -------- d-----w- c:\users\April\AppData\Roaming\vlc
2010-04-15 11:09 . 2010-04-15 11:09 -------- d-----w- c:\programdata\NCH Software
2010-04-15 11:09 . 2010-04-16 09:13 -------- d-----w- c:\users\HomeComputer\AppData\Roaming\NCH Swift Sound
2010-04-15 03:28 . 2010-01-15 00:04 98304 ----a-w- c:\windows\system32\cabview.dll
2010-04-15 03:28 . 2009-12-23 12:43 171520 ----a-w- c:\windows\system32\wintrust.dll
2010-04-15 03:28 . 2010-02-18 14:49 898952 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-04-15 03:28 . 2010-02-18 14:11 190464 ----a-w- c:\windows\system32\iphlpsvc.dll
2010-04-15 03:28 . 2010-02-18 11:52 25088 ----a-w- c:\windows\system32\drivers\tunnel.sys
2010-04-15 03:28 . 2010-02-18 14:49 3598216 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-04-15 03:28 . 2010-02-18 14:49 3545992 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-04-15 03:28 . 2010-03-04 18:54 430080 ----a-w- c:\windows\system32\vbscript.dll
2010-04-15 03:28 . 2010-02-23 11:32 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-04-15 03:28 . 2010-02-23 11:32 78848 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-04-15 03:28 . 2010-02-23 11:32 105984 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-14 18:01 . 2010-04-15 03:47 -------- d-----w- c:\program files\SpeedFan
2010-04-14 17:43 . 2010-04-14 17:43 -------- d-----w- c:\programdata\McAfee
2010-04-14 17:30 . 2010-04-14 17:30 -------- d-----w- c:\program files\Isotope244 Graphics
2010-04-14 05:53 . 2010-04-25 17:03 -------- d-----w- c:\users\HomeComputer\AppData\Roaming\dvdcss
2010-04-11 09:19 . 2010-04-11 09:19 -------- d-----w- c:\users\HomeComputer\AppData\Roaming\AVS4YOU
2010-04-11 09:19 . 2010-04-11 09:19 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-04-11 09:18 . 2008-08-13 00:22 974848 ----a-w- c:\windows\system32\mfc70.dll
2010-04-11 09:18 . 2008-08-13 00:22 487424 ----a-w- c:\windows\system32\msvcp70.dll
2010-04-11 09:18 . 2008-08-13 00:22 344064 ----a-w- c:\windows\system32\msvcr70.dll
2010-04-11 09:18 . 2008-08-13 00:22 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2010-04-11 09:18 . 2008-08-13 00:22 24576 ----a-w- c:\windows\system32\msxml3a.dll
2010-04-11 09:18 . 2010-04-26 12:29 -------- d-----w- c:\program files\AVS4YOU
2010-04-11 09:18 . 2010-04-11 09:19 -------- d-----w- c:\programdata\AVS4YOU
2010-04-11 08:17 . 2010-04-11 08:17 -------- d-----w- c:\users\HomeComputer\AppData\Local\WMTools Downloaded Files
2010-04-11 08:11 . 2010-04-15 03:28 -------- d-----w- c:\program files\Movie Maker 2.6
2010-04-11 07:12 . 2010-04-11 07:12 -------- d-----w- c:\program files\IObit
2010-04-11 05:26 . 2010-04-26 13:02 -------- d-----w- c:\program files\Kioskea.exe
2010-04-09 16:16 . 2010-04-15 23:43 57344 ----a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-04-09 16:10 . 2010-04-09 16:15 52963 ----a-w- c:\programdata\DivX\MSVC80CRTRedist\Uninstaller.exe
2010-04-09 16:10 . 2010-04-09 16:15 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-04-09 16:09 . 2010-04-15 23:43 -------- d-----w- c:\program files\DivX
2010-04-09 16:08 . 2010-04-15 23:42 144696 ----a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.exe
2010-04-09 16:08 . 2010-04-15 23:43 -------- d-----w- c:\programdata\DivX
2010-04-09 15:13 . 2007-12-27 03:33 118784 ----a-w- c:\windows\system32\MSSTDFMT.DLL
2010-04-09 15:13 . 2007-12-13 21:59 81920 ----a-w- c:\windows\system32\GkSui20.EXE
2010-04-09 15:13 . 2010-04-21 16:07 -------- d-----w- c:\program files\YouTube Movie Ripper V4.0.2
2010-04-09 13:30 . 2009-08-24 12:16 378368 ----a-w- c:\windows\system32\winhttp.dll
2010-04-09 13:13 . 2010-04-09 13:13 -------- d-----w- c:\users\HomeComputer\AppData\Roaming\Canneverbe Limited
2010-04-09 13:13 . 2010-04-09 13:13 -------- d-----w- c:\programdata\Canneverbe Limited
2010-04-09 13:13 . 2009-11-12 04:48 7168 ----a-w- c:\windows\system32\drivers\StarOpen.sys
2010-04-09 13:13 . 2010-04-09 13:13 -------- d-----w- c:\program files\CDBurnerXP
2010-04-08 19:02 . 2010-04-08 01:07 -------- d-----w- c:\windows\Panther
2010-04-08 19:02 . 2010-04-08 19:02 -------- d-----w- C:\Boot
2010-04-08 19:01 . 2010-04-08 19:01 -------- d-----w- c:\windows\system32\OEM
2010-04-08 14:25 . 2010-04-08 14:25 -------- d-----w- c:\program files\Utherverse Digital Inc
2010-04-08 13:04 . 2010-04-08 13:06 -------- d-----w- c:\program files\Pristy Utils
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-15 23:43 . 2010-04-09 16:15 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2010-04-15 23:42 . 2010-04-09 16:15 754984 ----a-w- c:\programdata\DivX\Setup\Resource.dll
2010-04-15 12:17 . 2010-04-15 12:17 65800 ----a-w- c:\users\April\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-10 17:33 . 2010-04-09 16:15 -------- d-----w- c:\users\HomeComputer\AppData\Roaming\DivX
2010-04-09 16:15 . 2010-04-09 16:15 56978 ----a-w- c:\programdata\DivX\WebPlayer\Uninstaller.exe
2010-04-09 16:15 . 2010-04-09 16:15 53600 ----a-w- c:\programdata\DivX\Update\Uninstaller.exe
2010-04-09 16:15 . 2010-04-09 16:15 57054 ----a-w- c:\programdata\DivX\DSDesktopComponents\Uninstaller.exe
2010-04-09 16:15 . 2010-04-09 16:15 56458 ----a-w- c:\programdata\DivX\DivXDecoderShortcut\Uninstaller.exe
2010-04-09 16:15 . 2010-04-09 16:15 54174 ----a-w- c:\programdata\DivX\DSAACDecoder\Uninstaller.exe
2010-04-09 16:15 . 2010-04-09 16:15 54629 ----a-w- c:\programdata\DivX\TranscodeEngine\Uninstaller.exe
2010-04-09 16:15 . 2010-04-09 16:15 54101 ----a-w- c:\programdata\DivX\MPEG2Plugin\Uninstaller.exe
2010-04-09 16:15 . 2010-04-09 16:15 54073 ----a-w- c:\programdata\DivX\Qt4.5\Uninstaller.exe
2010-04-09 16:15 . 2010-04-09 16:15 56969 ----a-w- c:\programdata\DivX\ASPEncoder\Uninstaller.exe
2010-04-09 16:07 . 2010-04-09 16:15 1180952 ----a-w- c:\programdata\DivX\Setup\DivXSetup.exe
2010-04-08 08:27 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2010-04-08 04:42 . 2010-04-08 01:24 65800 ----a-w- c:\users\HomeComputer\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-08 03:17 . 2010-04-08 03:16 -------- d-----w- c:\program files\IDT
2010-04-08 03:13 . 2010-04-08 01:24 680 ----a-w- c:\users\HomeComputer\AppData\Local\d3d9caps.dat
2010-04-08 03:10 . 2010-04-08 03:10 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_Apfiltr_01009.Wdf
2010-04-08 03:10 . 2010-04-08 03:10 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
2010-04-08 01:06 . 2010-04-08 01:06 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2010-03-09 16:25 . 2010-04-08 07:26 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-03-09 14:01 . 2010-04-08 07:26 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2010-03-08 17:59 . 2010-03-08 17:59 94208 ----a-w- c:\windows\system32\dpl100.dll
2010-02-25 16:03 . 2010-04-08 03:16 536576 ----a-w- c:\windows\system32\idtmini1.exe
2010-02-25 16:03 . 2010-04-08 03:16 3350528 ----a-w- c:\windows\system32\stlang.dll
2010-02-25 16:03 . 2010-04-08 03:16 945664 ----a-w- c:\windows\system32\stapo.dll
2010-02-25 16:03 . 2010-04-08 03:16 527360 ------w- c:\windows\system32\stapi32.dll
2010-02-25 16:03 . 2010-04-08 03:16 423424 ----a-w- c:\windows\system32\drivers\stwrt.sys
2010-02-25 16:03 . 2010-04-08 03:16 405504 ----a-w- c:\windows\system32\stcplx.dll
2010-02-25 16:03 . 2010-04-08 03:16 175616 ----a-w- c:\windows\system32\st326272.dll
2010-02-19 19:27 . 2010-02-19 19:27 720384 ----a-w- c:\windows\system32\DivX.dll
2010-02-19 19:27 . 2010-02-19 19:27 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
2010-02-19 19:27 . 2010-02-19 19:27 856064 ----a-w- c:\windows\system32\divx_xx07.dll
2010-02-19 19:27 . 2010-02-19 19:27 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
2010-02-19 19:27 . 2010-02-19 19:27 843776 ----a-w- c:\windows\system32\divx_xx16.dll
2010-02-19 19:27 . 2010-02-19 19:27 839680 ----a-w- c:\windows\system32\divx_xx11.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"Steam"="c:\program files\steam\steam.exe" [2010-04-27 1238352]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-04-08 319792]
"InternodeUsage"="c:\progra~1\INTERN~2\mum.exe" [2010-04-08 1363456]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"WindowsLivePhone"="c:\program files\Windows Live\Device Manager\msgrdvmn.exe" [2008-12-22 787816]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"Dell Webcam Central"="c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-01-09 405639]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-05-07 178712]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-11-16 3810304]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-06-03 206064]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2010-01-18 274432]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2010-02-25 495708]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-01-16 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-01-16 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-01-16 150552]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-03-05 1135912]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"WindowsLivePhone"="c:\program files\Windows Live\Device Manager\msgrdvmn.exe" [2008-12-22 787816]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-04-14 2790472]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
R2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32coinst,serviceStartProc [x]
R3 PCD5SRVC{3F6A8B78-EC003E00-05040104};PCD5SRVC{3F6A8B78-EC003E00-05040104} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\DELLSU~1\HWDiag\bin\PCD5SRVC.pkms [2008-11-04 22904]
S1 aswSP;aswSP; [x]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_0145da1d\aestsrv.exe [2009-03-02 81920]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-04-14 51792]
S2 SteamWatch;SteamWatch;c:\program files\SteamWatch\SteamWatch.exe [2008-03-24 13824]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2008-12-30 144128]
.
Contents of the 'Scheduled Tasks' folder
2010-04-10 c:\windows\Tasks\Install_NSS.job
- c:\program files\DivX\Symantec\scstubinstaller.exe [2010-03-08 18:00]
.
.
------- Supplementary Scan -------
.
FF - ProfilePath - c:\users\HomeComputer\AppData\Roaming\Mozilla\Firefox\Profiles\hvyghk99.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.au/
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-28 02:19
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys >>UNKNOWN [0x875198C8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x8a3a5322
\Driver\ACPI -> acpi.sys @ 0x80689d4c
\Driver\atapi -> ataport.SYS @ 0x822e09a8
\Driver\iaStor -> iaStor.sys @ 0x8224b592
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->user & kernel MBR OK
**************************************************************************
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PCD5SRVC{3F6A8B78-EC003E00-05040104}]
"ImagePath"="\??\c:\progra~1\DELLSU~1\HWDiag\bin\PCD5SRVC.pkms"
.
Completion time: 2010-04-28 02:22:37
ComboFix-quarantined-files.txt 2010-04-27 16:22
Pre-Run: 226,310,823,936 bytes free
Post-Run: 226,276,245,504 bytes free
- - End Of File - - 6B1F698AA97357DF29961D4A20B29BE3
Hope it got rid of it for me thanks
ComboFix 10-04-26.05 - HomeComputer 28/04/2010 2:08.1.2 - x86
Microsoft® Windows Vista(TM) Home Premium 6.0.6001.1.1252.61.1033.18.3032.2013 [GMT 10:00]
Running from: c:\users\HomeComputer\Downloads\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\install.exe
c:\users\HomeComputer\AppData\Roaming\inst.exe
c:\windows\system32\oem10.inf
.
((((((((((((((((((((((((( Files Created from 2010-03-27 to 2010-04-27 )))))))))))))))))))))))))))))))
.
2010-04-27 16:19 . 2010-04-27 16:20 -------- d-----w- c:\users\HomeComputer\AppData\Local\temp
2010-04-27 16:19 . 2010-04-27 16:19 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-04-27 16:19 . 2010-04-27 16:19 -------- d-----w- c:\users\April\AppData\Local\temp
2010-04-27 13:04 . 2010-04-27 14:44 -------- d-----w- C:\Ad-Remover
2010-04-27 03:06 . 2010-04-27 03:06 -------- d-----w- c:\program files\CCleaner
2010-04-26 16:48 . 2010-04-26 16:48 388096 ----a-r- c:\users\HomeComputer\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-04-26 11:11 . 2010-04-26 11:11 -------- d-----w- c:\program files\BattleshipGame
2010-04-23 14:22 . 2010-04-23 14:22 -------- d-----w- c:\program files\Trend Micro
2010-04-23 11:25 . 2010-04-24 03:19 -------- d-----w- c:\programdata\fssg
2010-04-22 08:10 . 2010-04-27 14:15 -------- d-----w- c:\users\HomeComputer\AppData\Roaming\mp3ripper
2010-04-22 08:10 . 2009-03-17 15:48 72704 ----a-w- c:\users\HomeComputer\AppData\Roaming\MSDLL\avutil-49.dll
2010-04-22 08:10 . 2009-03-17 15:48 694784 ----a-w- c:\users\HomeComputer\AppData\Roaming\MSDLL\avformat-52.dll
2010-04-22 08:10 . 2009-03-17 15:48 62976 ----a-w- c:\users\HomeComputer\AppData\Roaming\MSDLL\avfilter-0.dll
2010-04-22 08:10 . 2009-03-17 15:48 181760 ----a-w- c:\users\HomeComputer\AppData\Roaming\MSDLL\swscale-0.dll
2010-04-22 08:10 . 2009-03-17 15:48 10752 ----a-w- c:\users\HomeComputer\AppData\Roaming\MSDLL\avdevice-52.dll
2010-04-22 08:10 . 2008-08-29 07:58 321536 ----a-w- c:\users\HomeComputer\AppData\Roaming\MSDLL\SDL.dll
2010-04-22 08:10 . 2008-07-27 12:36 22528 ----a-w- c:\users\HomeComputer\AppData\Roaming\MSDLL\myutil.dll
2010-04-22 08:10 . 2010-04-22 08:10 -------- d-----w- c:\users\HomeComputer\AppData\Roaming\MSDLL
2010-04-22 08:10 . 2010-04-22 08:10 -------- d-----w- c:\program files\Free YouTube MP3 Ripper
2010-04-22 08:10 . 2009-05-29 17:26 8346624 ----a-w- c:\users\HomeComputer\AppData\Roaming\MSDLL\avcodec-52.dll
2010-04-21 23:06 . 2010-04-14 16:35 162768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-04-21 23:06 . 2010-04-14 16:31 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-04-21 23:06 . 2010-04-14 16:31 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-04-21 23:06 . 2010-04-14 16:35 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-04-21 23:06 . 2010-04-14 16:31 51792 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2010-04-21 23:06 . 2010-04-14 16:47 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-04-21 23:06 . 2010-04-14 16:47 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-04-21 17:32 . 2010-04-21 23:06 -------- d-----w- c:\programdata\Alwil Software
2010-04-21 17:32 . 2010-04-21 17:32 -------- d-----w- c:\program files\Alwil Software
2010-04-21 15:46 . 2010-04-21 15:49 -------- d-----w- C:\ConverterOutput
2010-04-21 15:46 . 2004-10-12 04:42 262144 ----a-w- c:\windows\system32\TomsMoComp_ff.dll
2010-04-21 15:46 . 2004-10-05 06:16 395776 ----a-w- c:\windows\system32\libmplayer.dll
2010-04-21 15:46 . 2004-10-03 15:50 112640 ----a-w- c:\windows\system32\libmpeg2_ff.dll
2010-04-21 15:46 . 2004-09-10 03:50 34820 ----a-w- c:\windows\system32\ffdshow.reg
2010-04-21 15:46 . 2004-10-12 04:40 2255360 ----a-w- c:\windows\system32\libavcodec.dll
2010-04-21 15:46 . 2010-04-21 15:46 -------- d-----w- c:\program files\Cucusoft
2010-04-21 15:41 . 2010-04-21 22:40 -------- d-----w- c:\users\HomeComputer\AppData\Roaming\Vso
2010-04-21 15:41 . 2010-04-21 22:40 47360 ----a-w- c:\users\HomeComputer\AppData\Roaming\pcouffin.sys
2010-04-21 09:31 . 2010-04-21 09:31 -------- d-----w- c:\users\April\AppData\Local\Apple
2010-04-20 07:58 . 2010-04-20 07:58 -------- d-----w- c:\users\April\AppData\Local\WLDM
2010-04-19 17:02 . 2010-04-19 17:02 -------- d-----w- c:\windows\system32\EventProviders
2010-04-18 11:46 . 2010-04-18 11:46 -------- d-----w- c:\users\HomeComputer\AppData\Local\Apple Computer
2010-04-18 11:32 . 2010-04-18 11:33 -------- d-----w- c:\program files\QuickTime
2010-04-18 11:32 . 2010-04-18 11:32 -------- d-----w- c:\programdata\Apple Computer
2010-04-18 11:32 . 2010-04-18 11:32 -------- d-----w- c:\program files\Common Files\Apple
2010-04-18 11:31 . 2010-04-18 11:31 -------- d-----w- c:\users\HomeComputer\AppData\Local\Apple
2010-04-18 11:31 . 2010-04-18 11:31 -------- d-----w- c:\program files\Apple Software Update
2010-04-18 11:31 . 2010-04-18 11:31 -------- d-----w- c:\programdata\Apple
2010-04-18 10:25 . 2010-04-18 10:25 -------- d-----w- c:\users\HomeComputer\AppData\Local\WLDM
2010-04-18 06:47 . 2010-04-18 06:47 -------- d-----w- c:\programdata\Office Genuine Advantage
2010-04-18 05:39 . 2010-04-18 05:39 -------- d-----w- c:\users\April\AppData\Roaming\DivX
2010-04-17 15:20 . 2010-04-27 14:34 -------- d-----w- c:\users\HomeComputer\Tracing
2010-04-17 15:20 . 2010-04-17 15:20 -------- d-----w- c:\program files\Microsoft
2010-04-17 15:20 . 2010-04-17 15:20 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-04-17 15:19 . 2010-04-18 10:25 -------- d-----w- c:\program files\Windows Live
2010-04-17 15:19 . 2010-04-17 15:19 -------- d-----w- c:\windows\PCHEALTH
2010-04-17 15:17 . 2010-04-17 15:17 -------- d-----w- c:\program files\Common Files\Windows Live
2010-04-16 10:01 . 2010-04-16 10:01 -------- d-----w- c:\users\HomeComputer\AppData\Roaming\runic games
2010-04-16 09:57 . 2010-04-16 09:57 -------- d-----w- c:\program files\SystemRequirementsLab
2010-04-16 09:57 . 2010-04-16 09:57 85504 ----a-w- c:\users\HomeComputer\AppData\Roaming\SystemRequirementsLab\srlproxy_cyri_4.1.71.0A.dll
2010-04-16 09:57 . 2010-04-16 09:57 -------- d-----w- c:\users\HomeComputer\AppData\Roaming\SystemRequirementsLab
2010-04-16 00:01 . 2010-04-23 11:23 -------- d-----w- c:\programdata\F-Secure
2010-04-15 23:51 . 2010-04-15 23:51 -------- d-----w- c:\windows\Sun
2010-04-15 23:51 . 2010-04-15 23:51 -------- d-----w- c:\program files\Common Files\Java
2010-04-15 23:51 . 2010-04-15 23:50 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-04-15 23:50 . 2010-04-15 23:50 -------- d-----w- c:\program files\Java
2010-04-15 23:43 . 2010-04-15 23:43 56766 ----a-w- c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-04-15 23:43 . 2010-04-15 23:43 57679 ----a-w- c:\programdata\DivX\Player\Uninstaller.exe
2010-04-15 23:43 . 2010-04-15 23:43 84040 ----a-w- c:\programdata\DivX\TransferWizard\Uninstaller.exe
2010-04-15 23:43 . 2010-04-15 23:43 57532 ----a-w- c:\programdata\DivX\DSASPDecoder\Uninstaller.exe
2010-04-15 23:43 . 2010-04-15 23:43 54166 ----a-w- c:\programdata\DivX\DSAVCDecoder\Uninstaller.exe
2010-04-15 23:43 . 2010-04-15 23:43 54153 ----a-w- c:\programdata\DivX\DFXPlugin\Uninstaller.exe
2010-04-15 23:43 . 2010-04-15 23:43 54128 ----a-w- c:\programdata\DivX\Converter\Uninstaller.exe
2010-04-15 23:43 . 2010-04-15 23:43 57409 ----a-w- c:\programdata\DivX\ControlPanel\Uninstaller.exe
2010-04-15 12:19 . 2010-04-15 12:19 -------- d-----w- c:\users\April\AppData\Local\Mozilla
2010-04-15 12:19 . 2010-04-20 08:04 -------- d-----w- c:\users\April\AppData\Roaming\vlc
2010-04-15 11:09 . 2010-04-15 11:09 -------- d-----w- c:\programdata\NCH Software
2010-04-15 11:09 . 2010-04-16 09:13 -------- d-----w- c:\users\HomeComputer\AppData\Roaming\NCH Swift Sound
2010-04-15 03:28 . 2010-01-15 00:04 98304 ----a-w- c:\windows\system32\cabview.dll
2010-04-15 03:28 . 2009-12-23 12:43 171520 ----a-w- c:\windows\system32\wintrust.dll
2010-04-15 03:28 . 2010-02-18 14:49 898952 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-04-15 03:28 . 2010-02-18 14:11 190464 ----a-w- c:\windows\system32\iphlpsvc.dll
2010-04-15 03:28 . 2010-02-18 11:52 25088 ----a-w- c:\windows\system32\drivers\tunnel.sys
2010-04-15 03:28 . 2010-02-18 14:49 3598216 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-04-15 03:28 . 2010-02-18 14:49 3545992 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-04-15 03:28 . 2010-03-04 18:54 430080 ----a-w- c:\windows\system32\vbscript.dll
2010-04-15 03:28 . 2010-02-23 11:32 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-04-15 03:28 . 2010-02-23 11:32 78848 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-04-15 03:28 . 2010-02-23 11:32 105984 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-14 18:01 . 2010-04-15 03:47 -------- d-----w- c:\program files\SpeedFan
2010-04-14 17:43 . 2010-04-14 17:43 -------- d-----w- c:\programdata\McAfee
2010-04-14 17:30 . 2010-04-14 17:30 -------- d-----w- c:\program files\Isotope244 Graphics
2010-04-14 05:53 . 2010-04-25 17:03 -------- d-----w- c:\users\HomeComputer\AppData\Roaming\dvdcss
2010-04-11 09:19 . 2010-04-11 09:19 -------- d-----w- c:\users\HomeComputer\AppData\Roaming\AVS4YOU
2010-04-11 09:19 . 2010-04-11 09:19 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-04-11 09:18 . 2008-08-13 00:22 974848 ----a-w- c:\windows\system32\mfc70.dll
2010-04-11 09:18 . 2008-08-13 00:22 487424 ----a-w- c:\windows\system32\msvcp70.dll
2010-04-11 09:18 . 2008-08-13 00:22 344064 ----a-w- c:\windows\system32\msvcr70.dll
2010-04-11 09:18 . 2008-08-13 00:22 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2010-04-11 09:18 . 2008-08-13 00:22 24576 ----a-w- c:\windows\system32\msxml3a.dll
2010-04-11 09:18 . 2010-04-26 12:29 -------- d-----w- c:\program files\AVS4YOU
2010-04-11 09:18 . 2010-04-11 09:19 -------- d-----w- c:\programdata\AVS4YOU
2010-04-11 08:17 . 2010-04-11 08:17 -------- d-----w- c:\users\HomeComputer\AppData\Local\WMTools Downloaded Files
2010-04-11 08:11 . 2010-04-15 03:28 -------- d-----w- c:\program files\Movie Maker 2.6
2010-04-11 07:12 . 2010-04-11 07:12 -------- d-----w- c:\program files\IObit
2010-04-11 05:26 . 2010-04-26 13:02 -------- d-----w- c:\program files\Kioskea.exe
2010-04-09 16:16 . 2010-04-15 23:43 57344 ----a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-04-09 16:10 . 2010-04-09 16:15 52963 ----a-w- c:\programdata\DivX\MSVC80CRTRedist\Uninstaller.exe
2010-04-09 16:10 . 2010-04-09 16:15 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-04-09 16:09 . 2010-04-15 23:43 -------- d-----w- c:\program files\DivX
2010-04-09 16:08 . 2010-04-15 23:42 144696 ----a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.exe
2010-04-09 16:08 . 2010-04-15 23:43 -------- d-----w- c:\programdata\DivX
2010-04-09 15:13 . 2007-12-27 03:33 118784 ----a-w- c:\windows\system32\MSSTDFMT.DLL
2010-04-09 15:13 . 2007-12-13 21:59 81920 ----a-w- c:\windows\system32\GkSui20.EXE
2010-04-09 15:13 . 2010-04-21 16:07 -------- d-----w- c:\program files\YouTube Movie Ripper V4.0.2
2010-04-09 13:30 . 2009-08-24 12:16 378368 ----a-w- c:\windows\system32\winhttp.dll
2010-04-09 13:13 . 2010-04-09 13:13 -------- d-----w- c:\users\HomeComputer\AppData\Roaming\Canneverbe Limited
2010-04-09 13:13 . 2010-04-09 13:13 -------- d-----w- c:\programdata\Canneverbe Limited
2010-04-09 13:13 . 2009-11-12 04:48 7168 ----a-w- c:\windows\system32\drivers\StarOpen.sys
2010-04-09 13:13 . 2010-04-09 13:13 -------- d-----w- c:\program files\CDBurnerXP
2010-04-08 19:02 . 2010-04-08 01:07 -------- d-----w- c:\windows\Panther
2010-04-08 19:02 . 2010-04-08 19:02 -------- d-----w- C:\Boot
2010-04-08 19:01 . 2010-04-08 19:01 -------- d-----w- c:\windows\system32\OEM
2010-04-08 14:25 . 2010-04-08 14:25 -------- d-----w- c:\program files\Utherverse Digital Inc
2010-04-08 13:04 . 2010-04-08 13:06 -------- d-----w- c:\program files\Pristy Utils
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-15 23:43 . 2010-04-09 16:15 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2010-04-15 23:42 . 2010-04-09 16:15 754984 ----a-w- c:\programdata\DivX\Setup\Resource.dll
2010-04-15 12:17 . 2010-04-15 12:17 65800 ----a-w- c:\users\April\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-10 17:33 . 2010-04-09 16:15 -------- d-----w- c:\users\HomeComputer\AppData\Roaming\DivX
2010-04-09 16:15 . 2010-04-09 16:15 56978 ----a-w- c:\programdata\DivX\WebPlayer\Uninstaller.exe
2010-04-09 16:15 . 2010-04-09 16:15 53600 ----a-w- c:\programdata\DivX\Update\Uninstaller.exe
2010-04-09 16:15 . 2010-04-09 16:15 57054 ----a-w- c:\programdata\DivX\DSDesktopComponents\Uninstaller.exe
2010-04-09 16:15 . 2010-04-09 16:15 56458 ----a-w- c:\programdata\DivX\DivXDecoderShortcut\Uninstaller.exe
2010-04-09 16:15 . 2010-04-09 16:15 54174 ----a-w- c:\programdata\DivX\DSAACDecoder\Uninstaller.exe
2010-04-09 16:15 . 2010-04-09 16:15 54629 ----a-w- c:\programdata\DivX\TranscodeEngine\Uninstaller.exe
2010-04-09 16:15 . 2010-04-09 16:15 54101 ----a-w- c:\programdata\DivX\MPEG2Plugin\Uninstaller.exe
2010-04-09 16:15 . 2010-04-09 16:15 54073 ----a-w- c:\programdata\DivX\Qt4.5\Uninstaller.exe
2010-04-09 16:15 . 2010-04-09 16:15 56969 ----a-w- c:\programdata\DivX\ASPEncoder\Uninstaller.exe
2010-04-09 16:07 . 2010-04-09 16:15 1180952 ----a-w- c:\programdata\DivX\Setup\DivXSetup.exe
2010-04-08 08:27 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2010-04-08 04:42 . 2010-04-08 01:24 65800 ----a-w- c:\users\HomeComputer\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-08 03:17 . 2010-04-08 03:16 -------- d-----w- c:\program files\IDT
2010-04-08 03:13 . 2010-04-08 01:24 680 ----a-w- c:\users\HomeComputer\AppData\Local\d3d9caps.dat
2010-04-08 03:10 . 2010-04-08 03:10 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_Apfiltr_01009.Wdf
2010-04-08 03:10 . 2010-04-08 03:10 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
2010-04-08 01:06 . 2010-04-08 01:06 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2010-03-09 16:25 . 2010-04-08 07:26 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-03-09 14:01 . 2010-04-08 07:26 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2010-03-08 17:59 . 2010-03-08 17:59 94208 ----a-w- c:\windows\system32\dpl100.dll
2010-02-25 16:03 . 2010-04-08 03:16 536576 ----a-w- c:\windows\system32\idtmini1.exe
2010-02-25 16:03 . 2010-04-08 03:16 3350528 ----a-w- c:\windows\system32\stlang.dll
2010-02-25 16:03 . 2010-04-08 03:16 945664 ----a-w- c:\windows\system32\stapo.dll
2010-02-25 16:03 . 2010-04-08 03:16 527360 ------w- c:\windows\system32\stapi32.dll
2010-02-25 16:03 . 2010-04-08 03:16 423424 ----a-w- c:\windows\system32\drivers\stwrt.sys
2010-02-25 16:03 . 2010-04-08 03:16 405504 ----a-w- c:\windows\system32\stcplx.dll
2010-02-25 16:03 . 2010-04-08 03:16 175616 ----a-w- c:\windows\system32\st326272.dll
2010-02-19 19:27 . 2010-02-19 19:27 720384 ----a-w- c:\windows\system32\DivX.dll
2010-02-19 19:27 . 2010-02-19 19:27 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
2010-02-19 19:27 . 2010-02-19 19:27 856064 ----a-w- c:\windows\system32\divx_xx07.dll
2010-02-19 19:27 . 2010-02-19 19:27 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
2010-02-19 19:27 . 2010-02-19 19:27 843776 ----a-w- c:\windows\system32\divx_xx16.dll
2010-02-19 19:27 . 2010-02-19 19:27 839680 ----a-w- c:\windows\system32\divx_xx11.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"Steam"="c:\program files\steam\steam.exe" [2010-04-27 1238352]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-04-08 319792]
"InternodeUsage"="c:\progra~1\INTERN~2\mum.exe" [2010-04-08 1363456]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"WindowsLivePhone"="c:\program files\Windows Live\Device Manager\msgrdvmn.exe" [2008-12-22 787816]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"Dell Webcam Central"="c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-01-09 405639]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-05-07 178712]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-11-16 3810304]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-06-03 206064]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2010-01-18 274432]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2010-02-25 495708]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-01-16 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-01-16 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-01-16 150552]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-03-05 1135912]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"WindowsLivePhone"="c:\program files\Windows Live\Device Manager\msgrdvmn.exe" [2008-12-22 787816]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-04-14 2790472]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
R2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32coinst,serviceStartProc [x]
R3 PCD5SRVC{3F6A8B78-EC003E00-05040104};PCD5SRVC{3F6A8B78-EC003E00-05040104} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\DELLSU~1\HWDiag\bin\PCD5SRVC.pkms [2008-11-04 22904]
S1 aswSP;aswSP; [x]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_0145da1d\aestsrv.exe [2009-03-02 81920]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-04-14 51792]
S2 SteamWatch;SteamWatch;c:\program files\SteamWatch\SteamWatch.exe [2008-03-24 13824]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2008-12-30 144128]
.
Contents of the 'Scheduled Tasks' folder
2010-04-10 c:\windows\Tasks\Install_NSS.job
- c:\program files\DivX\Symantec\scstubinstaller.exe [2010-03-08 18:00]
.
.
------- Supplementary Scan -------
.
FF - ProfilePath - c:\users\HomeComputer\AppData\Roaming\Mozilla\Firefox\Profiles\hvyghk99.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.au/
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-28 02:19
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys >>UNKNOWN [0x875198C8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x8a3a5322
\Driver\ACPI -> acpi.sys @ 0x80689d4c
\Driver\atapi -> ataport.SYS @ 0x822e09a8
\Driver\iaStor -> iaStor.sys @ 0x8224b592
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->user & kernel MBR OK
**************************************************************************
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PCD5SRVC{3F6A8B78-EC003E00-05040104}]
"ImagePath"="\??\c:\progra~1\DELLSU~1\HWDiag\bin\PCD5SRVC.pkms"
.
Completion time: 2010-04-28 02:22:37
ComboFix-quarantined-files.txt 2010-04-27 16:22
Pre-Run: 226,310,823,936 bytes free
Post-Run: 226,276,245,504 bytes free
- - End Of File - - 6B1F698AA97357DF29961D4A20B29BE3
Hope it got rid of it for me thanks
Ambucias
Posts
47356
Registration date
Monday February 1, 2010
Status
Moderator
Last seen
February 15, 2023
11,167
Apr 27, 2010 at 05:07 PM
Apr 27, 2010 at 05:07 PM
Hello Gervarod,
I almost missed your reply. Somehow the system had deleted it, probably because of word in the filter.
Anyhow it seems to me that your system is clean now.
However, PLEASE BE CAREFUL, if you use Flash drives or other removable USB memory devices, they may be infected. Please don't ask me how to disinfect your pendrive for I find it a pain to explain.
But let me know if you are still being redirected.
I almost missed your reply. Somehow the system had deleted it, probably because of word in the filter.
Anyhow it seems to me that your system is clean now.
However, PLEASE BE CAREFUL, if you use Flash drives or other removable USB memory devices, they may be infected. Please don't ask me how to disinfect your pendrive for I find it a pain to explain.
But let me know if you are still being redirected.
Apr 26, 2010 at 10:01 AM
Regards,Gervarod
Apr 26, 2010 at 11:52 AM
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 02:49:20, on 27/04/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18444)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Windows Live\Device Manager\msgrdvmn.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Internode\mum.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Free YouTube MP3 Ripper\FreeYouTubeMP3Ripper.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=53EEB45F21EA47F2B95DF58497B5E6B6
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.ask.com/?o=15157&l=dis
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=53EEB45F21EA47F2B95DF58497B5E6B6
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=53EEB45F21EA47F2B95DF58497B5E6B6
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Dell Webcam Central] "C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [WindowsLivePhone] C:\Program Files\Windows Live\Device Manager\msgrdvmn.exe /AutoRun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [InternodeUsage] C:\PROGRA~1\INTERN~2\mum.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WindowsLivePhone] "C:\Program Files\Windows Live\Device Manager\msgrdvmn.exe" /AutoRun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_0145da1d\aestsrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: SupportSoft Sprocket Service (DellSupportCenter) (sprtsvc_DellSupportCenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_0145da1d\STacSV.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: SteamWatch - Douglas Marttinen - C:\Program Files\SteamWatch\SteamWatch.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)