removing infection trojan.win32.generic!bt
i used the ad-aware free internet security to scan my computer it found 7 infections that it couldn't remove like couldn't set an action for them. i will list them bellow
Yontoo [1519] pup 2 were found
objects path c:\program file\...\oieclient.ddl
Yontoo pup found 2 infections
objects path HKCR: CLSID\[f\...\BAB4151CAD8}:
HKLM: software\...\BAB4151CAD8}:
win32.trojan.agent which is malware
objects path c:\users\owner\...\olbar4ffx.exe
Yontoo (v) which is adware
objects path c:\users\owner\...\installer.exe
trojan.win32.generic!Bt which is malware
objects path c:\users\owner\...\yer-setup.exe
if the program found the infections why couldn't it remove them. is there a way to remove them with program or manually if their is could you let me on it, that would be great
Yontoo [1519] pup 2 were found
objects path c:\program file\...\oieclient.ddl
Yontoo pup found 2 infections
objects path HKCR: CLSID\[f\...\BAB4151CAD8}:
HKLM: software\...\BAB4151CAD8}:
win32.trojan.agent which is malware
objects path c:\users\owner\...\olbar4ffx.exe
Yontoo (v) which is adware
objects path c:\users\owner\...\installer.exe
trojan.win32.generic!Bt which is malware
objects path c:\users\owner\...\yer-setup.exe
if the program found the infections why couldn't it remove them. is there a way to remove them with program or manually if their is could you let me on it, that would be great
0
-
Hi xradb22t,
Can you send me a PM with your Dropbox account name, or the email address associated with it? I can give you access to my Dropbox sample folder.
Andy
Lavasoft Malware Labs0 -
hi all i am a newbie to this forums so help me out a little ok. i found intructions for the removal for the trojan.win32.generic!bt
[url="http://www.lavasoft.com/mylavasoft/malware-descriptions/blog/nrgbot"]http://www.lavasoft....ns/blog/nrgbot[/url]
i dont get were to find the
C:\ recycler\ s-1-5-21-02433556031-8888888379-781863308\ <rnd>.exe
can someone help me with this pls. i can find all the others but i dont get were to locate this0 -
Hi xradb22t,
I have merged your two topics.
The link in your second post is about the trojan Nrgbot. Even if Ad-Aware reports Trojan.Win32.Generic!BT, it isn't necessary that it is Nrgbot since Trojan.Win32.Generic!BT is a generic name used for several types of malicious programs. In your case, I think that too is a part of Yontoo.
Please, to get help with cleaning your computer follow the instructions in the topic [url="http://www.lavasoftsupport.com/index.php?showtopic=30823"]Read This Before You Post![/url].0 -
i have downloaded the new ad aware free antivirus and im scanning the computer to see if it finds anything but i done as you requested i have gotten dds got 2 files and im going to post them. i just hope the new ad aware free antivirus can find what i wrote in my first post. can you identify if i have any infections.
[attachment=9504:DDS log.txt]
[attachment=9505:Attach.txt]0 -
Please, answer in this topic by writing in the box called "Reply to this topic".
Uninstall:
Ask Toolbar, reason: http://www.systemlookup.com/CLSID/56968-GenericAskToolbar_dll_GENERI_1_DLL.html
Conduit Engine, reason: http://www.systemlookup.com/CLSID/70651-ConduitEngin_dll_ConduitEngine_dll_ConduitEngin0_dll_ConduitEngin1_dll_prxConduitEngin_dll_prxConduitEngine_dll_prxConduitEngin0_dll_prxConduitEngin1_dll_prxConduitEngin2_dll_ldrConduitEngine_dll_Local_DLL.html
DVDVideoSoftTB Toolbar http://www.systemlookup.com/CLSID/71740-tbDVDV_dll_tbDVD0_dll_tbDVD1_dll_tbDVD2_dll_prxtbDVDV_dll_prxtbDVD0_dll_prxtbDVD1_dll_prxtbDVD2_dll.html
PCHelpSoft Toolbar, reason: http://www.mywot.com/en/scorecard/pchelpsoft.com
Java(TM) 6 Update 17, reason: Old version with known vulnerabilities which makes it easy to infect your computer from a web page.
I also recommend you to uninstall uTorrent since a lot of malicious programs are distributed in that way.
Change your start page in Internet Explorer to something else than funmoods.com, see comments on http://www.mywot.com/en/scorecard/funmoods.com
When that is done, please restart the computer and run DDS program again. Paste the content of DDS.txt into your answer and I will check what is still in the log.0 -
i have removed what you asked
uninstalled ask toolbar 8/20/12
uninstalled conduit engine 8/20/12
uninstalled dvd video softwaretb 8/19/12 yesterday
uninstalled pchelpsoftwaretb 8/19/12
uninstalled javatm 6 update 17 8/20/12
i also uninstalled aspca reminder by we-care.com my reasons i have no idea what it was and should it have been on this computer
you will notice i have not removed utorrent my reason is
i have been using this program as well on my laptop, and i never got an infection on my computer. This one your looking at is my sisters which was infected so im helping her remove these infections. i dont know where she downloads from, but i download movies of kickasstorrents.com, its from the sites where you get the torrent file thats where the infections get in from.
you will also notice that in internet explorer the start up page is still funmoods.com. but i have already changed that done it after i made the dds logs
[attachment=9506:DDS log.txt]
[attachment=9507:Attach.txt]0 -
Much better logs now /smile.png' class='bbc_emoticon' alt=':)' /> but Yontoo is still there and some other minor things.
You have switched back to Ad-Aware 9.6 now, haven't you?
That is better to use 9.6 when Avast is installed.
I think OTL will be the easiest way to remove Yontoo.
Save OTL on the Desktop. [url="http://oldtimer.geekstogo.com/OTL.exe/"]http://oldtimer.geekstogo.com/OTL.exe[/url]
Close all programs.
Double-click OTL to run it.
Click on [b]Quick Scan[/b] and do not use the computer while the program runs.
When the program finishes two log files are created on the Desktop, OTL.txt och Extras.txt. Copy the content of the log OTL.txt and paste it directly into your answer but attach Extras.txt.0 -
Yontoo is there because i cant remove it, click the uninstall button and this error shows up
< x c:\progra~3\tarmai~1\ {889df~1\ setup.dat>
error 2 while loading archive
the system cannot find the file specified.
i switched back to ad-aware 9.6 cause the anti-virus during a scan froze and was not responding besides it even froze the laptop i was running it on.
i think that the infections are gone because i did another scan with ad-aware 9.6 it did not find anything i will write down what i did
Path C:\users\owner\app data\local\temp
in the temp folder i scrolled down untill i found the yantoo layers folder opened it and found this item\ yl jscript script file. considered it dangerous sent it to recycle bin\ should i have deleted it or not. clicked out of the folder and scrolled to the bottom and found these:
zona1.0.0.8 jar
zonainstall
YontooIEclient.dll
i sent these to the recycle bin as well.
found a file for the babylon toolbar opened it found a jscript script file for it and sent it to recycle bin and deleted everything that was assocciated with it.
after i did all of that i rebooted the laptop, noticed that before it started up slowly after it started up quickly. should i have done what i did or it was a unnecessary move? i did a scan with ad-aware 9.6 after restarting it did not find the infections.i will post the olt logs bellow
OTL logfile created on: 8/21/2012 11:20:59 GO TO SLEEP! - Run 1
OTL by OldTimer - Version 3.2.58.1 Folder = C:\Users\owner\Downloads\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
3.67 Gb Total Physical Memory | 2.07 Gb Available Physical Memory | 56.50% Memory free
7.34 Gb Paging File | 5.47 Gb Available in Paging File | 74.56% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 289.23 Gb Total Space | 64.86 Gb Free Space | 22.42% Space Free | Partition Type: NTFS
Drive D: | 3.77 Gb Total Space | 3.19 Gb Free Space | 84.83% Space Free | Partition Type: FAT32
Computer Name: OWNER-VAIO | User Name: owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
[color=#E56717]========== Processes (SafeList) ==========[/color]
PRC - [2012/08/20 14:46:10 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\owner\Downloads\Desktop\OTL.exe
PRC - [2012/08/19 21:42:12 | 002,152,720 | ---- | M] (Lavasoft Limited) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2012/07/03 09:21:30 | 004,273,976 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2012/07/03 09:21:29 | 000,044,808 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2012/05/28 22:50:30 | 000,296,056 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
PRC - [2011/11/03 12:06:56 | 001,187,072 | ---- | M] (Lavasoft Limited) -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2011/02/14 18:32:52 | 001,230,704 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
PRC - [2010/08/17 22:45:28 | 000,327,472 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files (x86)\uTorrent\uTorrent.exe
PRC - [2009/12/14 13:06:24 | 002,320,920 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2009/12/14 13:06:08 | 000,268,824 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2009/11/20 16:25:24 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2009/11/20 16:25:22 | 000,284,696 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2009/10/24 04:18:54 | 000,360,224 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
PRC - [2009/10/05 14:57:46 | 000,016,384 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\CCP.exe
PRC - [2009/10/05 14:42:48 | 000,161,080 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWi.exe
PRC - [2009/10/05 14:42:48 | 000,033,792 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\PowerManager.exe
PRC - [2009/10/05 14:42:46 | 000,017,920 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\ThirdPartyAppMgr.exe
PRC - [2009/08/26 20:24:00 | 000,320,880 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
PRC - [2008/09/18 11:59:10 | 000,104,960 | ---- | M] (ArcSoft, Inc.) -- C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
[color=#E56717]========== Modules (No Company Name) ==========[/color]
MOD - [2012/06/13 12:10:13 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\a501b7960f6c6e2e39162b83f3303aaa\System.Web.ni.dll
MOD - [2012/06/13 12:09:34 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll
MOD - [2012/06/13 12:09:25 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll
MOD - [2012/05/11 03:42:46 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll
MOD - [2012/05/11 03:41:56 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll
MOD - [2012/05/11 03:41:49 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012/05/11 03:41:45 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012/05/11 03:41:44 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012/05/11 03:41:37 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2012/04/23 15:35:09 | 000,630,784 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
MOD - [2012/03/21 15:32:36 | 005,025,792 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
MOD - [2012/01/03 19:51:03 | 003,190,784 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
MOD - [2011/02/14 18:33:34 | 000,096,112 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2011/02/14 18:32:52 | 001,230,704 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
MOD - [2011/02/06 12:32:14 | 000,067,872 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2010/11/04 18:58:14 | 002,048,000 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll
MOD - [2010/11/04 18:58:10 | 000,303,104 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
MOD - [2010/11/04 18:58:09 | 000,385,024 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
MOD - [2009/10/05 14:57:46 | 000,016,384 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\CCP.exe
MOD - [2009/10/05 14:42:50 | 000,121,856 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\SonyCommonLib.dll
MOD - [2009/10/05 14:42:50 | 000,015,360 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.Plugin.NativeWifiThirdPartyApp.dll
MOD - [2009/10/05 14:42:50 | 000,011,264 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.Plugin.TosBtThirdPartyApp.dll
MOD - [2009/10/05 14:42:50 | 000,007,680 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\DebugMsg.dll
MOD - [2009/10/05 14:42:50 | 000,004,608 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.PluginManager.Power.dll
MOD - [2009/10/05 14:42:48 | 000,161,080 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWi.exe
MOD - [2009/10/05 14:42:48 | 000,107,008 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\DevicePanel.dll
MOD - [2009/10/05 14:42:48 | 000,033,792 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\PowerManager.exe
MOD - [2009/10/05 14:42:48 | 000,027,648 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.Plugin.BtPower.dll
MOD - [2009/10/05 14:42:48 | 000,023,040 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.PluginManager.Generic.dll
MOD - [2009/10/05 14:42:48 | 000,018,944 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\DictionaryLookup.dll
MOD - [2009/10/05 14:42:48 | 000,006,656 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.Plugin.WlanPower.dll
MOD - [2009/10/05 14:42:48 | 000,005,120 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.PluginManager.ThirdPartyApp.dll
MOD - [2009/10/05 14:42:48 | 000,005,120 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\Kinoubi.Plugins.Plugin.Generic.dll
MOD - [2009/10/05 14:42:46 | 000,017,920 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\ThirdPartyAppMgr.exe
MOD - [2009/10/05 14:42:46 | 000,015,360 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\SharedInterfaces.dll
MOD - [2009/10/05 14:42:46 | 000,011,264 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\MessageXML.dll
MOD - [2009/10/05 14:42:46 | 000,009,728 | ---- | M] () -- C:\Program Files (x86)\Sony\SmartWi Connection Utility\Resources.dll
[color=#E56717]========== Win32 Services (SafeList) ==========[/color]
SRV:[b]64bit:[/b] - [2012/07/03 09:21:29 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV:[b]64bit:[/b] - [2011/08/11 16:38:04 | 000,140,672 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCore64.exe -- (!SASCORE)
SRV:[b]64bit:[/b] - [2009/09/04 14:35:12 | 000,873,248 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV:[b]64bit:[/b] - [2009/07/13 18:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2012/08/19 21:42:12 | 002,152,720 | ---- | M] (Lavasoft Limited) [Auto | Running] -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2009/12/14 13:06:24 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2009/12/14 13:06:08 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2009/11/20 16:25:24 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2009/10/24 04:18:54 | 000,360,224 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe -- (PMBDeviceInfoProvider)
SRV - [2009/08/31 02:59:30 | 000,362,992 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe -- (Roxio Upnp Server 10)
SRV - [2009/08/31 02:59:18 | 000,313,840 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe -- (Roxio UPnP Renderer 10)
SRV - [2009/06/10 14:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/09/18 11:59:10 | 000,104,960 | ---- | M] (ArcSoft, Inc.) [Auto | Running] -- C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe -- (uCamMonitor)
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
DRV:[b]64bit:[/b] - [2012/08/19 21:45:48 | 000,055,384 | ---- | M] (Sunbelt Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\SBREDrv.sys -- (SBRE)
DRV:[b]64bit:[/b] - [2012/07/03 09:21:52 | 000,958,400 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:[b]64bit:[/b] - [2012/07/03 09:21:52 | 000,355,856 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
DRV:[b]64bit:[/b] - [2012/07/03 09:21:52 | 000,071,064 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:[b]64bit:[/b] - [2012/07/03 09:21:52 | 000,059,728 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
DRV:[b]64bit:[/b] - [2012/07/03 09:21:52 | 000,054,072 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
DRV:[b]64bit:[/b] - [2012/07/03 09:21:51 | 000,025,232 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV:[b]64bit:[/b] - [2012/02/29 23:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:[b]64bit:[/b] - [2011/11/03 12:06:56 | 000,069,376 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\Lbd.sys -- (Lbd)
DRV:[b]64bit:[/b] - [2011/07/22 09:26:56 | 000,014,928 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys -- (SASDIFSV)
DRV:[b]64bit:[/b] - [2011/07/12 14:55:18 | 000,012,368 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\saskutil64.sys -- (SASKUTIL)
DRV:[b]64bit:[/b] - [2011/03/10 23:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:[b]64bit:[/b] - [2011/03/10 23:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:[b]64bit:[/b] - [2011/02/18 17:36:58 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:[b]64bit:[/b] - [2010/11/20 06:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:[b]64bit:[/b] - [2010/11/20 04:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:[b]64bit:[/b] - [2010/11/20 02:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:[b]64bit:[/b] - [2010/07/12 11:36:10 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:[b]64bit:[/b] - [2010/05/26 10:39:08 | 000,006,144 | ---- | M] (Sophos Plc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\ED5B.tmp -- (MEMSWEEP2)
DRV:[b]64bit:[/b] - [2009/12/24 13:06:08 | 006,106,624 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:[b]64bit:[/b] - [2009/12/16 13:03:59 | 000,244,736 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:[b]64bit:[/b] - [2009/12/16 13:03:04 | 007,778,176 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:[b]64bit:[/b] - [2009/12/14 13:06:07 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)
DRV:[b]64bit:[/b] - [2009/11/20 16:09:48 | 000,537,112 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:[b]64bit:[/b] - [2009/11/17 21:30:44 | 000,021,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)
DRV:[b]64bit:[/b] - [2009/11/17 21:30:32 | 000,132,648 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
DRV:[b]64bit:[/b] - [2009/11/17 21:30:32 | 000,098,344 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
DRV:[b]64bit:[/b] - [2009/11/17 21:30:21 | 000,052,264 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btusbflt.sys -- (btusbflt)
DRV:[b]64bit:[/b] - [2009/11/17 21:23:46 | 000,035,104 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)
DRV:[b]64bit:[/b] - [2009/11/13 13:08:21 | 000,151,936 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:[b]64bit:[/b] - [2009/11/12 13:16:19 | 000,395,264 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)
DRV:[b]64bit:[/b] - [2009/11/12 13:06:44 | 001,542,656 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:[b]64bit:[/b] - [2009/11/06 13:27:30 | 000,093,696 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimssne64.sys -- (rimspci)
DRV:[b]64bit:[/b] - [2009/11/04 02:59:59 | 000,253,488 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Apfiltr.sys -- (ApfiltrService)
DRV:[b]64bit:[/b] - [2009/09/15 13:09:08 | 000,075,776 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\risdsne64.sys -- (risdsnpe)
DRV:[b]64bit:[/b] - [2009/08/19 13:09:21 | 000,011,392 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SFEP.sys -- (SFEP)
DRV:[b]64bit:[/b] - [2009/07/13 18:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:[b]64bit:[/b] - [2009/07/13 18:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:[b]64bit:[/b] - [2009/07/13 18:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:[b]64bit:[/b] - [2009/07/13 17:00:13 | 000,013,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Dot4Scan.sys -- (Dot4Scan)
DRV:[b]64bit:[/b] - [2009/06/10 13:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:[b]64bit:[/b] - [2009/06/10 13:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:[b]64bit:[/b] - [2009/06/10 13:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:[b]64bit:[/b] - [2009/06/10 13:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:[b]64bit:[/b] - [2009/05/26 15:32:04 | 000,019,968 | ---- | M] (ArcSoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ArcSoftKsUFilter.sys -- (ArcSoftKsUFilter)
DRV:[b]64bit:[/b] - [2009/05/18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:[b]64bit:[/b] - [2008/06/27 07:51:10 | 000,088,632 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\adfs.sys -- (adfs)
DRV:[b]64bit:[/b] - [2008/05/06 16:06:00 | 000,014,464 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wdcsam64.sys -- (WDC_SAM)
DRV:[b]64bit:[/b] - [2007/05/09 21:50:48 | 000,050,208 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LVUSBS64.sys -- (LVUSBS64)
DRV:[b]64bit:[/b] - [2007/05/09 21:46:48 | 001,127,328 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LV302V64.SYS -- (PID_PEPI)
DRV:[b]64bit:[/b] - [2007/05/09 21:46:36 | 000,016,032 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lv302a64.sys -- (lvpepf64)
DRV - [2012/08/19 21:45:17 | 000,017,152 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Lavasoft\Ad-Aware\kernexplorer64.sys -- (Lavasoft Kernexplorer)
DRV - [2009/07/13 18:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
[color=#E56717]========== Internet Explorer ==========[/color]
IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=SNNT&bmod=SNNT
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SNNT
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=SNNT&bmod=SNNT
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?brand=SNNT&bmod=SNNT
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://search.conduit.com?SearchSource=10&ctid=CT2269050
IE - HKCU\..\URLSearchHook: {5c4cae29-c754-4ca3-89e1-90b82459159a} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {3C19222F-EFA5-4EA1-A900-8E362B8E09CD}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&AF=110788&tt=290312_bexdll&babsrc=SP_ss&mntrId=84bcf95d0000000000002a8158ff39ee
IE - HKCU\..\SearchScopes\{1678DB53-E92D-4508-8025-BE5029078AB5}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=DVS2&o=1587&src=kw&q={searchTerms}&locale=&apn_ptnrs=^AA9&apn_dtid=^YYYYYY^CL^US&apn_uid=f1c2c0af-a25e-43e6-b521-289f4bd6989e&apn_sauid=50716A05-16FC-4904-8CFF-C3BB284DB926
IE - HKCU\..\SearchScopes\{2BDD4ACF-C260-4080-B312-1669121CCAAF}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3106575
IE - HKCU\..\SearchScopes\{3C19222F-EFA5-4EA1-A900-8E362B8E09CD}: "URL" = http://start.funmoods.com/results.php?f=4&a=ironto&q={searchTerms}
IE - HKCU\..\SearchScopes\{63140ECF-C629-BE59-8F0E-90B4FF340C03}: "URL" = http://www.bing.com/search?q={searchTerms}&pc=Z128&form=ZGAIDF&install_date=20111009&iesrc={referrer:source}
IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SNNT_enUS374US374
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
[color=#E56717]========== FireFox ==========[/color]
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video [2011/03/22 23:56:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa [2011/03/22 23:56:55 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/08/15 14:05:56 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{859BC3F0-6A37-4BDF-9801-32B85DA58F70}: C:\Users\owner\AppData\Local\{859BC3F0-6A37-4BDF-9801-32B85DA58F70} [2010/04/17 18:34:50 | 000,000,000 | ---D | M]
[2012/03/20 11:42:23 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[color=#E56717]========== Chrome ==========[/color]
CHR - homepage: http://start.funmoods.com/?f=1&a=ironto
CHR - default_search_provider: Search (Enabled)
CHR - default_search_provider: search_url = http://start.funmoods.com/results.php?f=4&a=axl&q={searchTerms}
CHR - default_search_provider: suggest_url =
CHR - homepage: http://start.funmoods.com/?f=1&a=ironto
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.79\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.79\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.79\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\owner\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.170.4 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeploytk.dll
CHR - plugin: Java(TM) Platform SE 6 U17 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll
CHR - plugin: RealNetworks(tm) RealPlayer Chrome Background Extension Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
CHR - plugin: RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - Extension: YouTube = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: DivX HiQ = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnjbmmemklcjgepojigaapkoodmkgbae\2.1.1.94_0\
CHR - Extension: avast! WebRep = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1456_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
CHR - Extension: DivX Plus Web Player HTML5 video = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.1.94_0\
CHR - Extension: Gmail = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: Yann Arthus-Bertrand = C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\plaekpceeonanmjojailaojkconcgofc\3_0\
O1 HOSTS File: ([2012/08/15 14:21:59 | 000,444,105 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 www.123fporn.info
O1 - Hosts: 15252 more lines...
O2:[b]64bit:[/b] - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
O2:[b]64bit:[/b] - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:[b]64bit:[/b] - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found.
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll File not found
O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo Layers Runtime\YontooIEClient.dll File not found
O3:[b]64bit:[/b] - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:[b]64bit:[/b] - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O3:[b]64bit:[/b] - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:[b]64bit:[/b] - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4:[b]64bit:[/b] - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:[b]64bit:[/b] - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:[b]64bit:[/b] - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:[b]64bit:[/b] - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avast] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [SmartWiHelper] C:\Program Files (x86)\Sony\SmartWi Connection Utility\SmartWiHelper.exe (Sony Electronics Corporation)
O4 - HKLM..\Run: [TkBellExe] c:\program files (x86)\real\realplayer\Update\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - HKCU..\Run: [uTorrent] C:\Program Files (x86)\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:[b]64bit:[/b] - Extra context menu item: Free YouTube Download - C:\Users\owner\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()
O8:[b]64bit:[/b] - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\owner\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\owner\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\owner\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9:[b]64bit:[/b] - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:[b]64bit:[/b] - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13[b]64bit:[/b] - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6DD0B22D-C026-4940-9700-1362E8BA5673}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EB67E911-867D-4C13-AE00-E3C7ECA0A89B}: DhcpNameServer = 192.168.0.1
O18:[b]64bit:[/b] - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\linkscanner - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\ms-help - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\ms-itss - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\wlmailhtml - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\linkscanner - No CLSID value found
O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:[b]64bit:[/b] - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\VESWinlogon: DllName - (VESWinlogon.dll) - C:\Windows\SysWow64\VESWinlogon.dll (Sony Corporation)
O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{002e4363-4d35-11e0-826b-54424903294d}\Shell - "" = AutoRun
O33 - MountPoints2\{002e4363-4d35-11e0-826b-54424903294d}\Shell\AutoRun\command - "" = D:\LaunchU3.exe -a
O33 - MountPoints2\{b7c9ae67-4384-11df-b12c-54424903294d}\Shell - "" = AutoRun
O33 - MountPoints2\{b7c9ae67-4384-11df-b12c-54424903294d}\Shell\AutoRun\command - "" = "D:\WD SmartWare.exe" autoplay=true
O33 - MountPoints2\{dcf2eb74-95ea-11e0-ac82-54424903294d}\Shell - "" = AutoRun
O33 - MountPoints2\{dcf2eb74-95ea-11e0-ac82-54424903294d}\Shell\AutoRun\command - "" = D:\LaunchU3.exe -a
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
[2012/08/21 11:18:57 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\owner\Downloads\Desktop\OTL.exe
[2012/08/19 21:56:50 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\qdvd.dll
[2012/08/19 21:56:50 | 000,366,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\qdvd.dll
[2012/08/19 21:50:42 | 000,055,384 | ---- | C] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys
[2012/08/19 21:40:35 | 000,000,000 | ---D | C] -- C:\Users\owner\AppData\Roaming\SUPERAntiSpyware.com
[2012/08/19 21:40:28 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2012/08/19 21:37:42 | 000,069,376 | ---- | C] (Lavasoft AB) -- C:\Windows\SysNative\drivers\Lbd.sys
[2012/08/19 21:37:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
[2012/08/19 21:37:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Lavasoft
[2012/08/19 21:37:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft
[2012/08/19 20:06:32 | 000,000,000 | ---D | C] -- C:\Users\owner\AppData\Local\Downloaded Installations
[2012/08/17 13:31:07 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012/08/15 17:31:18 | 000,000,000 | -HSD | C] -- C:\Windows\SysWow64\%APPDATA%
[2012/08/15 14:52:25 | 000,000,000 | ---D | C] -- C:\Users\owner\Documents\Zona Downloads
[2012/08/15 14:35:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VS Revo Group
[2012/08/15 14:33:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/08/15 14:33:55 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012/08/15 14:33:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/08/15 14:20:18 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012/08/15 14:20:18 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012/08/15 14:20:17 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012/08/15 14:20:17 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012/08/15 14:20:17 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012/08/15 14:20:16 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012/08/15 14:20:16 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012/08/15 14:20:16 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012/08/15 14:20:16 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012/08/15 14:20:16 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012/08/15 14:20:16 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012/08/15 14:20:14 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012/08/15 14:20:14 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012/08/15 14:18:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy
[2012/08/15 14:17:09 | 000,503,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll
[2012/08/15 14:16:57 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netapi32.dll
[2012/08/15 14:16:57 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browcli.dll
[2012/08/15 14:16:57 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\browcli.dll
[2012/08/15 14:16:56 | 000,956,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\localspl.dll
[2012/08/15 14:16:55 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll
[2012/08/15 14:16:55 | 000,492,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll
[2012/08/15 14:16:55 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\splwow64.exe
[2012/08/12 21:51:46 | 000,000,000 | ---D | C] -- C:\ProgramData\GFI Software
[2012/08/12 21:51:04 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012/08/12 20:19:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2012/08/12 13:08:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2012/08/12 13:08:50 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
[2012/08/21 11:24:09 | 000,014,144 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/08/21 11:24:09 | 000,014,144 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/08/21 11:15:15 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/08/21 11:15:07 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/08/21 11:14:57 | 2955,485,184 | -HS- | M] () -- C:\hiberfil.sys
[2012/08/20 14:46:10 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\owner\Downloads\Desktop\OTL.exe
[2012/08/20 11:15:42 | 000,000,912 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/08/19 23:59:39 | 000,131,072 | ---- | M] () -- C:\Windows\ocsetup_uninstall_OEMHelpCustomization.etl
[2012/08/19 21:45:48 | 000,055,384 | ---- | M] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys
[2012/08/19 21:40:32 | 000,001,808 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012/08/19 21:37:43 | 000,001,060 | ---- | M] () -- C:\Users\Public\Desktop\Ad-Aware.lnk
[2012/08/19 20:26:26 | 000,000,000 | ---- | M] () -- C:\Windows\SysNative\SBRC.dat
[2012/08/17 13:18:20 | 000,000,064 | ---- | M] () -- C:\Windows\SysWow64\rp_stats.dat
[2012/08/17 13:18:20 | 000,000,044 | ---- | M] () -- C:\Windows\SysWow64\rp_rules.dat
[2012/08/15 14:33:57 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/08/15 14:25:00 | 003,073,232 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012/08/15 14:22:51 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2012/08/15 14:21:59 | 000,444,105 | R--- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012/08/10 15:05:42 | 000,726,444 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/08/10 15:05:42 | 000,624,412 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/08/10 15:05:42 | 000,106,756 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/07/26 00:52:38 | 000,116,937 | ---- | M] () -- C:\test.xml
[2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[color=#E56717]========== Files Created - No Company Name ==========[/color]
[2012/08/19 23:58:20 | 000,131,072 | ---- | C] () -- C:\Windows\ocsetup_uninstall_OEMHelpCustomization.etl
[2012/08/19 21:40:32 | 000,001,808 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012/08/19 21:37:43 | 000,001,060 | ---- | C] () -- C:\Users\Public\Desktop\Ad-Aware.lnk
[2012/08/19 20:26:26 | 000,000,000 | ---- | C] () -- C:\Windows\SysNative\SBRC.dat
[2012/08/17 13:18:20 | 000,000,064 | ---- | C] () -- C:\Windows\SysWow64\rp_stats.dat
[2012/08/17 13:18:20 | 000,000,044 | ---- | C] () -- C:\Windows\SysWow64\rp_rules.dat
[2012/08/15 14:33:57 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2011/10/19 23:52:15 | 000,027,071 | ---- | C] () -- C:\Users\owner\AppData\Roaming\Crescendo.dmp
[2010/12/26 22:03:32 | 000,003,584 | ---- | C] () -- C:\Users\owner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/12/15 05:45:51 | 000,004,096 | -H-- | C] () -- C:\Users\owner\AppData\Local\keyfile3.drm
[2010/05/05 19:31:37 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010/04/17 18:34:56 | 000,000,120 | ---- | C] () -- C:\Users\owner\AppData\Local\Qticuca.dat
[2010/04/17 18:34:56 | 000,000,000 | ---- | C] () -- C:\Users\owner\AppData\Local\Vgumipizulufu.bin
[color=#E56717]========== Files - Unicode (All) ==========[/color]
[2012/06/12 17:07:22 | 003,800,532 | ---- | C] ()(C:\Users\owner\Downloads\Desktop\???? ??????? _????? ??? ?? memory_ ????.mp3) -- C:\Users\owner\Downloads\Desktop\Вика Дайнеко _Сотри его из memory_ клип.mp3
[2012/05/06 13:16:28 | 003,800,532 | ---- | M] ()(C:\Users\owner\Downloads\Desktop\???? ??????? _????? ??? ?? memory_ ????.mp3) -- C:\Users\owner\Downloads\Desktop\Вика Дайнеко _Сотри его из memory_ клип.mp3
[2012/02/09 01:56:09 | 000,023,087 | ---- | M] ()(C:\Users\Public\Documents\????.docx) -- C:\Users\Public\Documents\торт.docx
[2012/02/09 01:56:09 | 000,023,087 | ---- | C] ()(C:\Users\Public\Documents\????.docx) -- C:\Users\Public\Documents\торт.docx
[2012/02/09 01:56:05 | 000,018,218 | ---- | M] ()(C:\Users\Public\Documents\?????.docx) -- C:\Users\Public\Documents\салат.docx
[2012/02/09 01:56:04 | 000,018,218 | ---- | C] ()(C:\Users\Public\Documents\?????.docx) -- C:\Users\Public\Documents\салат.docx
[2011/09/23 19:16:37 | 000,011,090 | ---- | M] ()(C:\Users\Public\Documents\? ?????? ???? ????? ??????.docx) -- C:\Users\Public\Documents\В грубые ясли рукою нежной.docx
[2011/09/23 19:16:37 | 000,011,090 | ---- | C] ()(C:\Users\Public\Documents\? ?????? ???? ????? ??????.docx) -- C:\Users\Public\Documents\В грубые ясли рукою нежной.docx
[2011/09/16 03:02:19 | 000,002,429 | ---- | M] ()(C:\Users\Public\Documents\?????????.crs) -- C:\Users\Public\Documents\обрашайся.crs
[2011/09/16 03:02:19 | 000,002,429 | ---- | C] ()(C:\Users\Public\Documents\?????????.crs) -- C:\Users\Public\Documents\обрашайся.crs
[2011/03/06 16:22:23 | 000,011,475 | ---- | M] ()(C:\Users\Public\Documents\?? ????????? ???.docx) -- C:\Users\Public\Documents\Не забывайте тех.docx
[2011/03/06 16:22:22 | 000,011,475 | ---- | C] ()(C:\Users\Public\Documents\?? ????????? ???.docx) -- C:\Users\Public\Documents\Не забывайте тех.docx
[2010/12/27 18:29:48 | 000,013,258 | ---- | M] ()(C:\Users\Public\Documents\??? ?????.docx) -- C:\Users\Public\Documents\квн песня.docx
[2010/12/20 16:35:29 | 000,013,258 | ---- | C] ()(C:\Users\Public\Documents\??? ?????.docx) -- C:\Users\Public\Documents\квн песня.docx
[2010/12/19 21:58:21 | 000,625,152 | ---- | C] ()(C:\Users\Public\Documents\1570 ????????.doc) -- C:\Users\Public\Documents\1570 вопросов.doc
[2010/12/15 06:10:46 | 000,012,094 | ---- | M] ()(C:\Users\Public\Documents\??? ????????.docx) -- C:\Users\Public\Documents\Кто счастлив.docx
[2010/12/15 06:10:45 | 000,012,094 | ---- | C] ()(C:\Users\Public\Documents\??? ????????.docx) -- C:\Users\Public\Documents\Кто счастлив.docx
[2010/12/15 06:10:28 | 000,024,628 | ---- | M] ()(C:\Users\Public\Documents\?????? ?? ?????????1.docx) -- C:\Users\Public\Documents\Сценки на праздники1.docx
[2010/12/15 06:10:27 | 000,024,628 | ---- | C] ()(C:\Users\Public\Documents\?????? ?? ?????????1.docx) -- C:\Users\Public\Documents\Сценки на праздники1.docx
[2010/12/11 16:14:45 | 000,026,163 | ---- | M] ()(C:\Users\Public\Documents\????? ??? ? ?????.docx) -- C:\Users\Public\Documents\Новый Год в клубе.docx
[2010/12/08 23:03:09 | 000,022,494 | ---- | M] ()(C:\Users\Public\Documents\??????? ????.docx) -- C:\Users\Public\Documents\Доверие Богу.docx
[2010/12/08 05:45:47 | 000,019,028 | ---- | M] ()(C:\Users\Public\Documents\??????????? ????.docx) -- C:\Users\Public\Documents\ДЕЙСТВУЮЩИЕ ЛИЦА.docx
[2010/12/08 05:45:47 | 000,019,028 | ---- | C] ()(C:\Users\Public\Documents\??????????? ????.docx) -- C:\Users\Public\Documents\ДЕЙСТВУЮЩИЕ ЛИЦА.docx
[2010/12/08 05:35:01 | 000,014,303 | ---- | M] ()(C:\Users\Public\Documents\?????? ?? ?????????.docx) -- C:\Users\Public\Documents\Сценки на праздники.docx
[2010/12/08 05:35:01 | 000,014,303 | ---- | C] ()(C:\Users\Public\Documents\?????? ?? ?????????.docx) -- C:\Users\Public\Documents\Сценки на праздники.docx
[2010/12/08 05:15:39 | 000,022,494 | ---- | C] ()(C:\Users\Public\Documents\??????? ????.docx) -- C:\Users\Public\Documents\Доверие Богу.docx
[2010/12/08 04:57:54 | 000,026,163 | ---- | C] ()(C:\Users\Public\Documents\????? ??? ? ?????.docx) -- C:\Users\Public\Documents\Новый Год в клубе.docx
[2010/11/26 17:24:12 | 000,011,247 | ---- | M] ()(C:\Users\Public\Documents\?? ??? ?????????.docx) -- C:\Users\Public\Documents\Ты моя жемчужина.docx
[2010/11/26 17:24:12 | 000,011,247 | ---- | C] ()(C:\Users\Public\Documents\?? ??? ?????????.docx) -- C:\Users\Public\Documents\Ты моя жемчужина.docx
[2009/05/26 08:12:10 | 000,625,152 | ---- | M] ()(C:\Users\Public\Documents\1570 ????????.doc) -- C:\Users\Public\Documents\1570 вопросов.doc
< End of report >
[attachment=9508:Extras.Txt]0 -
Do you find anything with "Java" among the plugins?
Maybe [url="http://superuser.com/questions/201613/disable-java-plugin-in-google-chrome"]http://superuser.com...n-google-chrome[/url] is useful.
Please, continue with the rest even if you have problems with Java.0 -
There are some left-overs of funmood, the uninstalled toolbars, Yontoo, that you have to remove.
1.
CHR - plugin: Java Deployment Toolkit 6.0.170.4 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeploytk.dll
CHR - plugin: Java™ Platform SE 6 U17 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
Those two lines are that old Java version, which is still installed in Google Chrome. Can you find how to remove it from Chrome?
2.
Save SystemLook on the desktop: http://jpshortstuff.247fixes.com/SystemLook_x64.exe
Double-click on SystemLook file to run it.
Copy all lines in the box
[code]
:dir
C:\Users\owner\AppData\Local\{859BC3F0-6A37-4BDF-9801-32B85DA58F70}
[/code]
and paste in the big text field in SýstemLook.
Click on the Look button to start the search.
When finished Notepad will pop-up with the log. Copy the log and paste into your answer. If Notepad doesn't pop-up you can find the log as SystemLook.txt on the Desktop.
3.
Close all programs including antivirus programs and other similar programs. Otherwise they might stop OTL.
How? See http://www.bleepingcomputer.com/forums/topic114351.html
Start the program OTL.
Copy all the lines in the box:
[code]
:OTL
IE - HKLM\..\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: "URL" = http://search.condui...&ctid=CT2269050
IE - HKCU\..\URLSearchHook: {5c4cae29-c754-4ca3-89e1-90b82459159a} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {3C19222F-EFA5-4EA1-A900-8E362B8E09CD}
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylo...0002a8158ff39ee
IE - HKCU\..\SearchScopes\{1678DB53-E92D-4508-8025-BE5029078AB5}: "URL" = http://websearch.ask...FF-C3BB284DB926
IE - HKCU\..\SearchScopes\{2BDD4ACF-C260-4080-B312-1669121CCAAF}: "URL" = http://search.condui...&ctid=CT3106575
IE - HKCU\..\SearchScopes\{3C19222F-EFA5-4EA1-A900-8E362B8E09CD}: "URL" = http://start.funmood...q={searchTerms}
CHR - homepage: http://start.funmood...m/?f=1&a=ironto
CHR - default_search_provider: search_url = http://start.funmood...q={searchTerms}
CHR - homepage: http://start.funmood...m/?f=1&a=ironto
O2:64bit: - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found.
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll File not found
O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo Layers Runtime\YontooIEClient.dll File not found
:Commands
[CREATERESTOREPOINT]
[REBOOT]
[/code]
Paste them into the field Custom Scans/Fixes.
Click on Run Fix.
If you are asked to restart the computer do that.
Notepad will pop-up with a log. Copy it and paste it into your answer.
If it is not pop-upped, you can find it in the folder c:\_OTL\Moved Files and its name contains the date and time for when OTL was run.
Be sure that antivirus programs etc. are active before connecting to internet.
4.
Run OTL as you did the first time and post OTL.txt (Extras.txt will not be created).0 -
there is one problem with removing the java deployment toolkit. i opened the chrome browser in the address bar i typed
chrome://plugins which is how you can access all the installed plugins in google chrome.
i did not find the Java Deployment Toolkit 6.0.170.4 and the Java™ Platform SE 6 U17 among all the plugins in google chrome so i couldn't remove them.
thats the only way i know of removing plugins and disabling in google chrome.0 -
i didn't find anything with java among the plugins
i will past the systemlook log bellow
[attachment=9510:SystemLook.txt]
should i leave the two files that popped up on the desktop
desktop.ini
desktop.ini
they look like there blanked out gray color
post the ost log bellow
[attachment=9511:OTL.Txt]0 -
Yes, leave the two desktop.ini. They are marked as hidden but at the moment you can see hidden files even if they have another color.
Please, see if you can find the log file that were created when you ran OTL to fix something (3.). It should be in the folder c:\_OTL\Moved Files and its name contains the date and time for when OTL was run.0 -
here is the file
[attachment=9512:08222012_001449.log]
is this the one0 -
Yes, that was the right log /smile.png' class='bbc_emoticon' alt=':)' />
Close all programs including antivirus programs and other similar programs. Otherwise they might stop OTL.
How? See http://www.bleepingcomputer.com/forums/topic114351.html
Start the program OTL.
Copy all the lines in the box:
[code]
:OTL
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://search.conduit.com?SearchSource=10&ctid=CT2269050
CHR - homepage: http://start.funmoods.com/?f=1&a=ironto
CHR - default_search_provider: search_url = http://start.funmoods.com/results.php?f=4&a=axl&q={searchTerms}
CHR - homepage: http://start.funmoods.com/?f=1&a=ironto
CHR - plugin: Java Deployment Toolkit 6.0.170.4 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeploytk.dll
CHR - plugin: Java(TM) Platform SE 6 U17 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:DFC5A2B2
:Commands
[CREATERESTOREPOINT]
[REBOOT]
[/code]
Paste them into the field Custom Scans/Fixes.
Click on Run Fix.
If you are asked to restart the computer do that.
Check that the start page and default search provider in Google Chrome aren't funmoods.com.
Notepad will pop-up with a log. Copy it and paste it into your answer.
If it is not pop-upped, you can find it in the folder c:\_OTL\Moved Files and its name contains the date and time for when OTL was run.
Be sure that antivirus programs etc. are active before connecting to internet.0 -
sorry that my reply will be a little different from your instructions, i am going to report the following.
Ad-aware free internet security only found what it could posted in my first topic with all the detection's, i will post what it failed to detect.
[attachment=9516:08.22.2012.log]
in this log it shows what ad-aware did not detect, so i had more infections on this computer that what was posted in my first topic.
another what it did not detect that will not be in the log is backdoor.frauder.
found these with anvi smart defender and what it found it removed.
ad-aware should have detected them in the first place, even the ad-aware 10 anti-virus that i used will not be able to detect them as well.
i will reply following your instructions after this report.0 -
You can NOT trust Anvi Smart Defender. Here is a review of it[quote] In testing, it proved almost wholly unable to cleanup malware threats and also did a very poor job preventing malware attacks on a clean system. Worse, it repeatedly identified perfectly valid Windows files as malware. You've been warned; stay away.[/quote]http://www.pcmag.com/article2/0,2817,2405313,00.asp
There are of course no viruses inside Adobe Reader, for example. Anvi has also removed something that has to do with Avast.
I recommend that you do a system restore to a restore point created before you run Anvi:
Start menu - Programs - Accessories - System Tools - System Restore
That will undo most of the damage Anvi did.0 -
hey i followed your instructions with the olt. it didn't quite complete when i ran the olt run fix it in the processes it only showed creating restorepoint rebooting and nothing else so it did not work.
after the reboot the computer always freezes and i cannot do anything on it anymore, it is unresponsive i need help dont know what to do. any help please need to fix this.0 -
If you no longer can do the system restore in normal mode, please boot the computer to the System Recovery Options and perform the system restore, see http://www.sevenforums.com/tutorials/700-system-restore.html Option Two. 0 -
why did i use anvi? simple i had no where else to turn to.
the malware that i posted in one of my replies did not get detected by
Malware-bytes Anti-malware
Superantispyware which is able to detect malware as well
these two are at the top of malware removers, if they didn't detect them it doesn't mean they weren't present.
those malware i posted were on the computer, i just don't see why they couldn't be detected.
does this mean that one of those malware hid all of those infections and bypassed them so that they don't get detected.
what anvi did on this computer i am using to reply in this topic. first off this computer had no internet access because all of those
malware were blocking the computer from communicating with the dns server. i did a network diagnostic troubleshooter and it reported that the dns server is not responding.
after the scan and if those infections were removed, previously there was a yellow ! mark on the bars where it says if you have
access to the network, you probably know what those bars are, well anyway now i do have access to the internet and it seems those malware were removed, because this computer was running slow on start-up and slow at loading programs in windows,
now its running much faster than before.
i uninstalled anvi for safety and did a system restore picked one 2 days before i used the program. 2 days ago i had no access to the internet and my computer was running slow, now after the restore i have access and the computer seems to be running much better than before.
is there a way to see if it did remove them or not or did it do any damage, can one of the logs by dds or otl show if anything was done. if there is i will make it and post it0 -
yes i meant what anvi detected
[font="helvetica, arial, sans-serif"][color="#282828"]When did i loose my internet connection, i lost my internet connection when this computer got infected. i did not make any changes. here is the otl log i created. [/color][/font]
[attachment=9517:OTL.Txt]
[font="helvetica, arial, sans-serif"][color="#282828"]is there a possible chance to report what you find to malware-bytes so they could improve their program at detecting malicious software and hard to detect malware. i don't want to open a user account with them to report it myself, to much of a hassle and i wouldn't even know what to report.[/color][/font]0 -
[quote]the malware that i posted in one of my replies[/quote]Do you mean those in your first post? They have been removed.
Or do you mean those that Anvi claimed you had? Anvi didn't detect any active malware. Anvi claimed that files belonging to your WinRAR, Adobe Reader, DVDVideoSoft Free Audio CD to MP3 Converter and Avast were malware, for example pretending that Adobe Reader contains a password stealer for online games. If you didn't have cracked versions of those programs it is nonsense (and since Adobe Reader is free it makes no sense to have a cracked version of it). I suggest that you reinstall those four programs to be sure that they aren't damaged by Anvi.
If you want me to help you, please don't run other programs. If you get any problems, as a lost internet connection, please tell me.
When did you loose your internet connection, after doing what?
Please, run OTL and paste OTL.txt.0 -
Sorry, I don't report anything to Malwarebytes, only to Lavasoft.
Repeat step 3 and 4 in post#9, since the system restore undid those changes.0 -
is it to late to try and use hijack this, like you posted in Please help fight malware! submitting files is easy, or i should not do that?
here is the olt log i created
[attachment=9518:OTL.Txt]0 -
We don't use the HijackThis program any more, nowadays it is DDS, OTL and other programs instead. All these programs moves the malware files to a quarantine and when everything is fine with the computer, I will tell you how to collect the quarantined files and send them to Lavasoft.
1. Change your home page in Google Chrome. At the moment it is a search page provided by Conduit, which is spying on you (more than Google).
2. Close all programs including antivirus programs and other similar programs as Comodo. Otherwise they might stop OTL.
How? See http://www.bleepingcomputer.com/forums/topic114351.html
Start the program OTL.
Copy all the lines in the box:
[code]
:OTL
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://search.conduit.com?SearchSource=10&ctid=CT2269050
:Commands
[CREATERESTOREPOINT]
[REBOOT]
[/code]
Paste them into the field Custom Scans/Fixes.
Click on Run Fix.
If you are asked to restart the computer do that.
Notepad will pop-up with a log. Copy it and paste it into your answer.
If it is not pop-upped, you can find it in the folder c:\_OTL\Moved Files and its name contains the date and time for when OTL was run.
Be sure that antivirus programs etc. are active before connecting to internet.
Run a Quick Scan in OTL and post OTL.txt.
3. Run an online scan with Eset http://www.eset.com/onlinescan/
To shorten the scanning time disable your antivirus program while scanning.
Un-check "Remove found threats"
Check "Scan Archives"
Click "Advanced Settings"
Check:
Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth Technology
Click Scan
When the scan completes copy the result of the scan and paste it into your answer.0 -
this is the second half to my previous reply i did the scan with eset online scanner and this is what it found.
[attachment=9521:eset scan.txt]
what is the next step after detection, how am i going to move the infected files to lavasoft.0 -
i will post the 1 log i did with the instructions
[attachment=9519:08252012_031838.log]
my home page is still conduit because i set home page to Google default and it does not want to make Google the default home page. the fix with otl did not work.
i will post the quick scan log bellow
[attachment=9520:OTL.Txt]
the rest i will post in the next reply don't have time gotta run have to do something else.0 -
Are you sure that you included the line:
:OTL
when you tried to fix with OTL?
Please, try again.0 -
i have redone the fix and i will post the log
[attachment=9522:08262012_001909.log]
i downloaded Avira-Antivir because different antiviruses find different things just to check if i dont have anything else that is infected. although i will not keep 2 anti viruses installed ran the scan with avira saved the log i made and i will post it bellow, have already uninstalled it.
[attachment=9523:AVSCAN-20120825-232137-BB8540BD.LOG]
it did find an infection, its almost at the bottom where it says, starting to scan executable file (registry).
it found a file, that contains virus patterns of Adware Adware/installcore.gen.
should i remove the program its associated with/ Foxtab video to mp30 -
Good! OTL fix worked.
You shouldn't install more antivirus programs, it is possible that Windows will crash during startup due to conflicting drivers. You should use online scanners to get a second opinion.
It is possible that FoxTab Video To MP3 is responsible for installing one of the toolbars or settings in the browser you have removed. You can uninstall it. Eset also complained on the same file.
1.
Close all programs including antivirus programs and other similar programs. Otherwise they might stop OTL.
How? See http://www.bleepingcomputer.com/forums/topic114351.html
Start the program OTL.
Copy all the lines in the box:
[code]
:Files
C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll
C:\Users\All Users\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll
C:\Users\owner\AppData\Local\Temp\is135653842\MyBabylonTB.exe
C:\Users\owner\AppData\Local\Temp\is135653842\setup.exe
C:\Users\owner\AppData\Local\Temp\is1438683437\zgInstaller.exe
C:\Users\owner\Downloads\4shared_Desktop_3.3.5.exe
C:\Users\owner\Downloads\FreeStudio.exe
:Commands
[REBOOT]
[/code]
Paste them into the field Custom Scans/Fixes.
Click on Run Fix.
If you are asked to restart the computer do that.
Notepad will pop-up with a log. Copy it and paste it into your answer.
If it is not pop-upped, you can find it in the folder c:\_OTL\Moved Files and its name contains the date and time for when OTL was run.
Be sure that antivirus programs etc. are active before connecting to internet.
2.
Run a Quick Scan and paste that log, too.0
Please sign in to leave a comment.
Comments
59 comments