OTL won't run but I tried ComboFix again and it worked so here's the log:
ComboFix 09-10-25.02 - Claire 26/10/2009 12:39.1.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.3061.1578 [GMT 0:00]
Running from: c:\users\Claire\Desktop\Combo-Fix.exe
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\oem2.inf
c:\windows\system32\sctfmbm\ATIDLL_zsslxs.dll
c:\windows\system32\sctfmbm\AWTKernel32_tsmlmd.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}
-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE}
((((((((((((((((((((((((( Files Created from 2009-09-26 to 2009-10-26 )))))))))))))))))))))))))))))))
.
2009-10-26 12:45 . 2009-10-26 12:47 -------- d-----w- c:\users\Claire\AppData\Local\temp
2009-10-26 12:45 . 2009-10-26 12:45 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-10-25 14:28 . 2009-10-25 14:28 -------- d-----w- c:\program files\Trend Micro
2009-10-23 18:31 . 2009-10-23 18:31 -------- d-----w- c:\users\Claire\AppData\Local\AVG Security Toolbar
2009-10-15 21:57 . 2009-09-10 16:48 218624 ----a-w- c:\windows\system32\msv1_0.dll
2009-10-15 21:57 . 2009-08-27 12:40 834048 ----a-w- c:\windows\system32\wininet.dll
2009-10-15 21:56 . 2009-08-27 13:29 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-10-15 21:56 . 2009-08-04 12:34 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-10-15 21:56 . 2009-08-04 12:34 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-10-15 21:55 . 2009-09-04 11:41 60928 ----a-w- c:\windows\system32\msasn1.dll
2009-10-15 21:55 . 2009-09-14 09:29 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2009-10-15 21:55 . 2009-05-08 12:53 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2009-10-15 09:23 . 2009-10-15 09:23 -------- d-----w- c:\programdata\AVG Security Toolbar
2009-10-15 01:19 . 2009-10-15 01:19 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-10-13 19:24 . 2009-10-13 19:24 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2009-10-10 12:04 . 2009-10-11 22:02 -------- d-----w- C:\$AVG8.VAULT$
2009-10-10 11:28 . 2009-10-10 11:28 -------- d-----w- c:\programdata\Downloaded Installations
2009-10-10 11:28 . 2009-10-10 11:28 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-10-10 11:28 . 2009-10-10 11:28 12552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2009-10-10 11:28 . 2009-10-10 11:28 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-10-10 11:28 . 2009-10-10 11:28 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-10-10 11:28 . 2009-10-26 10:52 -------- d-----w- c:\windows\system32\drivers\Avg
2009-10-10 11:28 . 2009-10-10 11:28 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-10-10 11:26 . 2009-10-10 11:26 23832 ----a-w- c:\windows\system32\drivers\avgfwd6x.sys
2009-10-02 16:08 . 2009-10-01 09:29 195440 ------w- c:\windows\system32\MpSigStub.exe
2009-10-02 15:03 . 2009-10-02 15:03 -------- d-----w- C:\AVGTemp
2009-10-01 12:17 . 2009-10-01 12:17 0 ----a-w- C:\pcwords2.dat
2009-10-01 12:17 . 2009-10-01 12:17 0 ----a-w- C:\pcwords.dat
2009-10-01 09:44 . 2009-10-01 09:44 -------- d-----w- c:\program files\Tall Emu
2009-10-01 09:18 . 2009-10-01 09:22 -------- d-----w- c:\programdata\BitDefender
2009-10-01 09:18 . 2009-10-01 09:18 -------- d-----w- c:\program files\BitDefender
2009-10-01 09:17 . 2009-10-01 09:18 -------- d-----w- c:\program files\Common Files\BitDefender
2009-09-30 23:04 . 2009-10-02 14:37 -------- d-----w- c:\program files\TrojanHunter 5.2
2009-09-30 21:55 . 2009-10-02 15:27 -------- d-----w- c:\program files\Loaris Trojan Remover
2009-09-30 21:17 . 2009-09-30 21:33 -------- d-----w- c:\programdata\SITEguard
2009-09-30 21:16 . 2009-09-30 21:16 -------- d-----w- c:\program files\Common Files\iS3
2009-09-30 21:15 . 2009-10-02 16:06 -------- d-----w- c:\programdata\STOPzilla!
2009-09-30 17:49 . 2009-09-30 17:49 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2009-09-30 17:49 . 2009-10-02 15:38 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-09-30 14:47 . 2009-10-24 11:07 0 ----a-w- c:\windows\win32k.sys
2009-09-27 08:43 . 2009-10-02 15:38 -------- d-----w- c:\program files\Spybot - Search & Destroy
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-26 12:40 . 2009-05-28 12:19 -------- d-----w- c:\users\Claire\AppData\Roaming\Skype
2009-10-26 09:03 . 2009-05-28 20:02 -------- d-----w- c:\users\Claire\AppData\Roaming\skypePM
2009-10-16 02:11 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-10-16 02:03 . 2009-06-25 21:48 -------- d-----w- c:\programdata\Microsoft Help
2009-10-10 11:26 . 2009-05-27 16:22 -------- d-----w- c:\programdata\avg8
2009-10-03 02:01 . 2009-05-26 15:09 680 ----a-w- c:\users\Claire\AppData\Local\d3d9caps.dat
2009-10-02 16:01 . 2009-10-02 16:01 184 ----a-w- c:\windows\system32\drivers\kgpcpy.cfg
2009-10-02 15:38 . 2009-05-29 10:38 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-09-24 22:23 . 2009-09-24 22:23 -------- d-----w- c:\users\Claire\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-09-23 15:31 . 2009-06-29 07:55 -------- d-----w- c:\program files\vSoft
2009-08-29 00:27 . 2009-09-17 13:46 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-29 00:14 . 2009-09-17 13:46 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-17 22:33 . 2009-08-17 22:33 1193832 ----a-w- c:\windows\system32\FM20.DLL
2009-08-14 16:27 . 2009-09-16 19:01 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 15:53 . 2009-09-16 19:01 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 13:49 . 2009-09-16 19:01 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 13:49 . 2009-09-16 19:01 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 13:49 . 2009-09-16 19:01 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 13:49 . 2009-09-16 19:01 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 13:49 . 2009-09-16 19:01 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 13:49 . 2009-09-16 19:01 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 13:49 . 2009-09-16 19:01 10240 ----a-w- c:\windows\system32\finger.exe
2009-08-14 13:48 . 2009-09-16 19:01 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-08-14 13:48 . 2009-09-16 19:01 105984 ----a-w- c:\windows\system32\netiohlp.dll
2009-06-07 16:36 . 2009-06-07 16:36 2158321 ----a-w- c:\program files\mozilla firefox\components\1298079.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-09-02 10:58 1107200 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-04-21 24264488]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-09-15 1998576]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-12-08 3444736]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-05-10 36864]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-10-25 167936]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-15 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-15 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-15 133656]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-22 2025752]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
QuickSet.lnk - c:\program files\Dell\QuickSet\quickset.exe [2008-2-22 1193240]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(
:Dc,7a,dd,a8,08,df,c9,01
R0 AvgRkx86;avgrkx86.sys;c:\windows\System32\drivers\avgrkx86.sys [10/10/2009 11:28 12552]
R1 Avgfwfd;AVG network filter service;c:\windows\System32\drivers\avgfwd6x.sys [10/10/2009 11:26 23832]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [10/10/2009 11:28 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [10/10/2009 11:28 108552]
R2 atisvc_doybiw;atisvc_doybiw;c:\windows\System32\sctfmbm\atisvc_doybiw.exe [07/06/2009 16:36 447415]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [10/10/2009 11:27 297752]
R2 avgfws8;AVG8 Firewall;c:\progra~1\AVG\AVG8\avgfws8.exe [10/10/2009 11:27 1370488]
R2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [02/05/2008 18:09 161048]
R3 OEM02Dev;Creative Camera OEM002 Driver;c:\windows\System32\drivers\OEM02Dev.sys [26/05/2009 15:30 235648]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;c:\windows\System32\drivers\OEM02Vfx.sys [26/05/2009 15:30 7424]
S3 IntcHdmiAddService;Intel® High Definition Audio HDMI Service;c:\windows\System32\drivers\IntcHdmi.sys [26/05/2009 15:36 111616]
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.koower.com/
mStart Page = hxxp://www.koower.com/
uInternet Settings,ProxyOverride = <local>
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Claire\AppData\Roaming\Mozilla\Firefox\Profiles\1ztuoi1u.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - prefs.js: browser.startup.homepage - www.google.co.uk
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - component: c:\program files\Mozilla Firefox\components\1298079.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-DLD.EXE - (no file)
**************************************************************************
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files:
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\bcmwltry.exe
c:\windows\system32\WLANExt.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\progra~1\AVG\AVG8\avgam.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\Internet Explorer\iexplore.exe
c:\combo-fix27232c\CF30840.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\combo-fix27232c\PEV.cfxxe
.
**************************************************************************
.
Completion time: 2009-10-26 12:51 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-26 12:50
Pre-Run: 243,376,521,216 bytes free
Post-Run: 243,383,824,384 bytes free
- - End Of File - - 0F06AAD1D4682D53F84254D7B3399D8B
Sign In
Register
Help
This topic is locked
MultiQuote
