# Rpc shutdown 60 second timer



## jenn_needs_help

Hello. i have this RPC shutdown problem and it is driving me crazy i dont have a start button or task bar. i ran dds and it only gave me back 1 log so i will post that. and i ran gmer it had a problem and shut down my computer the first time. the second time i ran it it went through so hopefully it will have the info you need. thanks in advance.
.
DDS (Ver_2011-08-26.01) - NTFSx86 
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_31
Run by Command Central at 12:42:18 on 2012-06-24
.
============== Running Processes ===============
.
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\FixBee\FBDefragSrv.exe
C:\Program Files\Motorola\MotoConnectService\MotoConnectService.exe
C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Motorola\MotoConnectService\MotoConnect.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe
C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\DATAMN~1.EXE
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\program files\real\realplayer\update\realsched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Trojan Remover\Trjscan.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
E:\dds.scr
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k HPZ12
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://my.netzero.net/s/search?r=minisearch
uDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=0&o=xph&d=1209&m=aspire_r1600
uSearch Bar = hxxp://my.netzero.net/s/search?r=minisearch
uInternet Connection Wizard,ShellNext = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=0&o=xph&d=1209&m=aspire_r1600
uSearchURL,(Default) = hxxp://my.netzero.net/s/search?r=minisearch
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
uURLSearchHooks: N/A: {00a6faf6-072e-44cf-8957-5838f569a31d} - c:\program files\mywebsearch\bar\1.bin\MWSSRCAS.DLL
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Wincore Mediabar: {28387537-e3f9-4ed7-860c-11e69af4a8a0} - c:\progra~1\imesha~1\mediabar\datamngr\toolbar\wincoreimdtx.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: DataMngr: {be7a24f5-69cb-4708-b77b-b1eda6043b95} - c:\progra~1\imesha~1\mediabar\datamngr\BROWSE~1.DLL
BHO: Wincore Mediabar: {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - c:\progra~1\bearsh~1\mediabar\datamngr\toolbar\wincorebsdtx.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: {99079a25-328f-4bd4-be04-00955acaa0a7} - No File
TB: Wincore Mediabar: {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - c:\progra~1\bearsh~1\mediabar\datamngr\toolbar\wincorebsdtx.dll
TB: Wincore Mediabar: {28387537-e3f9-4ed7-860c-11e69af4a8a0} - c:\progra~1\imesha~1\mediabar\datamngr\toolbar\wincoreimdtx.dll
TB: !{07B18EA9-A523-4961-B6BB-170DE4475CCA} - No File
TB: My Web Search: {07b18ea9-a523-4961-b6bb-170de4475cca} - c:\program files\mywebsearch\bar\1.bin\MWSBAR.DLL
{e7df6bff-55a5-4eb7-a673-4ed3e9456d39}
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [EgisTecLiveUpdate] "c:\program files\egistec egis software update\EgisUpdate.exe"
mRun: [mwlDaemon] c:\program files\egistec\mywinlocker 3\x86\mwlDaemon.exe
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [RemoteControl8] "c:\program files\cyberlink\powerdvd8\PDVD8Serv.exe"
mRun: [PDVD8LanguageShortcut] "c:\program files\cyberlink\powerdvd8\language\Language.exe"
mRun: [LGODDFU] "c:\program files\lg_fwupdate\fwupdate.exe" blrun
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [ROC_roc_dec12] "c:\program files\avg secure search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12
mRun: [DATAMNGR] c:\progra~1\imesha~1\mediabar\datamngr\DATAMN~1.EXE
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [RegTask] c:\program files\regtask\RegTask.exe
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
IE: &Search - http://edits.mywebsearch.com/toolba...933YYUS&a=QJosjdxEXqhc3w2FsxVZBw&n=2012032520
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
LSP: %SYSTEMROOT%\system32\nvLsp.dll
LSP: c:\program files\avira\antivir desktop\avsda.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\command central\application data\mozilla\firefox\profiles\oc1rlg6x.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.ask.com/?l=dis&o=16148
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=937811&p=
FF - component: c:\progra~1\crawler\firefox\components\xcomm.dll
FF - component: c:\progra~1\crawler\firefox\components\xshared.dll
FF - component: c:\progra~1\crawler\firefox\components\xsupport.dll
FF - component: c:\progra~1\crawler\firefox\components\xwsg.dll
FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\program files\google\update\1.3.21.65\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\weatherblink\bar\1.bin\NPgcStub.dll
.
---- FIREFOX POLICIES ----
FF - user.js: extensions.BabylonToolbar_i.id - 160582c500000000000090fba62a3da5
FF - user.js: extensions.BabylonToolbar_i.hardId - 160582c500000000000090fba62a3da5
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15425
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1720:42:30
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=108720
FF - user.js: extensions.BabylonToolbar_i.babExt - 
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
============= SERVICES / DRIVERS ===============
.
R? AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service
R? Ambfilt;Ambfilt
R? BTCFilterService;USB Networking Driver Filter Service
R? gupdate1ca97438fe2dfb6;Google Update Service (gupdate1ca97438fe2dfb6)
R? gupdatem;Google Update Service (gupdatem)
R? motccgp;Motorola USB Composite Device Driver
R? motccgpfl;MotCcgpFlService
R? Motousbnet;Motorola USB Networking Driver Service
R? motport;Motorola USB Diagnostic Port
R? motusbdevice;Motorola USB Dev Driver
R? MyWebSearchService;My Web Search Service
R? NWUSBCDFIL;Novatel Wireless Installation CD
R? NWUSBModem_000;Novatel Wireless USB Modem Driver (vGEN)
R? NWUSBPort_000;Novatel Wireless USB Status Port Driver (vGEN)
R? NWUSBPort2_000;Novatel Wireless USB Status2 Port Driver (vGEN)
R? SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver
R? SWDUMon;SWDUMon
R? WLAN(WLAN);XPC 802.11b/g Wireless Kit Driver(WLAN)
S? acfva;acfva
S? AntiVirMailService;Avira Mail Protection
S? AntiVirSchedulerService;Avira Scheduler
S? AntiVirService;Avira Realtime Protection
S? AntiVirWebService;Avira Web Protection
S? avgntflt;avgntflt
S? avkmgr;avkmgr
S? dgcfltr;DGC Filter Driver
S? FBDiskOptimizer;FBDiskOptimizer
S? LBeepKE;LBeepKE
S? MotoConnect Service;MotoConnect Service
S? mwlPSDFilter;mwlPSDFilter
S? mwlPSDNServ;mwlPSDNServ
S? mwlPSDVDisk;mwlPSDVDisk
S? MWLService;MyWinLocker Service
S? NVHDA;Service for NVIDIA High Definition Audio Driver
.
=============== Created Last 30 ================
.
2012-06-24 17:42:12 477240 ----a-w- c:\windows\system32\drivers\sptd.sys
2012-06-21 22:57:40 98816 ----a-w- c:\windows\sed.exe
2012-06-21 22:57:40 518144 ----a-w- c:\windows\SWREG.exe
2012-06-21 22:57:40 256000 ----a-w- c:\windows\PEV.exe
2012-06-21 22:57:40 208896 ----a-w- c:\windows\MBR.exe
2012-06-21 22:56:06 -------- d-s---w- C:\ComboFix
2012-06-21 21:55:22 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2012-06-21 21:55:22 77072 ----a-w- c:\windows\system32\ztvcabinet.dll
2012-06-21 21:55:22 75264 ----a-w- c:\windows\system32\unacev2.dll
2012-06-21 21:55:22 605968 ----a-w- c:\windows\system32\ztv7z.dll
2012-06-21 21:55:22 185616 ----a-w- c:\windows\system32\ztvunrar39.dll
2012-06-21 21:55:22 169744 ----a-w- c:\windows\system32\ztvunrar36.dll
2012-06-21 21:55:21 153088 ----a-w- c:\windows\system32\UNRAR3.dll
2012-06-21 21:55:19 -------- d-----w- c:\program files\Trojan Remover
2012-06-21 21:55:19 -------- d-----w- c:\documents and settings\all users\application data\Simply Super Software
2012-06-21 20:37:29 -------- d-----w- C:\20af6fb5af208c49bb
2012-06-21 19:50:15 -------- d-----w- C:\a45643d481b40159eb295c1744
2012-06-21 18:49:10 -------- d-----w- C:\97dd2c3269bd91880f644a13268fb008
2012-06-21 17:48:29 -------- d-----w- c:\program files\common files\SpeedMaxPc
2012-06-21 17:48:28 -------- d-----w- c:\program files\SpeedMaxPc
2012-06-21 17:48:28 -------- d-----w- c:\documents and settings\all users\application data\SpeedMaxPc
2012-06-21 17:47:46 -------- d-----w- C:\075e0d2bcea1f3f9b8f385885c0bb571
2012-06-21 17:08:57 -------- d-----w- C:\7c09594d0b144ab19fad4eea95
2012-06-20 18:17:56 -------- d-----w- c:\documents and settings\command central\application data\Avira
2012-06-20 16:28:12 83392 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-06-20 16:28:12 36000 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-06-20 16:28:10 -------- d-----w- c:\program files\Avira
2012-06-20 16:28:10 -------- d-----w- c:\documents and settings\all users\application data\Avira
2012-06-16 12:53:23 521728 -c----w- c:\windows\system32\dllcache\jsdbgui.dll
2012-05-29 04:05:35 11776 ----a-w- c:\program files\mozilla firefox\plugins\nprjplug.dll
2012-05-29 04:04:28 -------- d-----w- c:\program files\common files\xing shared
2012-05-29 04:03:48 150696 ----a-w- c:\program files\mozilla firefox\plugins\nppl3260.dll
2012-05-29 04:03:29 129144 ----a-w- c:\program files\mozilla firefox\plugins\nprpplugin.dll
.
==================== Find3M ====================
.
2012-05-31 13:22:09 599040 ----a-w- c:\windows\system32\crypt32.dll
2012-05-16 15:08:26 916992 ----a-w- c:\windows\system32\wininet.dll
2012-05-15 13:20:33 1863168 ----a-w- c:\windows\system32\win32k.sys
2012-05-11 14:42:33 43520 ------w- c:\windows\system32\licmgr10.dll
2012-05-11 14:42:33 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-05-11 11:38:02 385024 ------w- c:\windows\system32\html.iec
2012-05-06 03:33:24 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-06 03:33:24 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-04 13:16:13 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-04 12:32:19 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-02 13:46:36 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-04-16 19:55:33 73728 ----a-w- c:\windows\system32\javacpl.cpl
2012-04-16 19:55:33 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-09-13 03:43:23 161728 ----a-w- c:\program files\gcres.dll
2010-02-17 11:59:34 203776 -csha-w- c:\windows\system32\unrar.exe
.
============= FINISH: 12:43:21.00 ===============


----------



## jenn_needs_help

BUMP please.


----------



## Ried

Hello jenn,

I see you also ran ComboFix already. I need to see that log - kindly post the contents of the C:\ComboFix.txt


----------



## jenn_needs_help

i tried to run combofix but i dont have the windows restore so combofix would not run and i can not get on the internet with that computer. it seems the virus wont let me open up my verizon program for combo fix to download it. would it be possible to download it on this laptop and transfer it to the computer?


----------



## Ried

Yes it is, but do it this way please. :smile:

Download the tools/files needed to a flash drive or other removable media, and transfer them to the infected computer.

***************************************************

Download ComboFix from one *here*


--------------------------------------------------------------------

With malware infections being as they are today, it's strongly recommended to have the Windows Recovery Console pre-installed on your machine before doing any malware removal.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.


Go to Microsoft's website => How to obtain Windows XP Setup disks for a floppy boot installation

Scroll down to *Step 1*, and select the download that's appropriate for your Operating System. Download the file & save it as it's originally named.

* Note: If you have SP3, use the SP2 package.*


---------------------------------------------------------------------

*Transfer all files you just downloaded, to the desktop of the infected computer.*

==================================================


*Disable your AntiVirus and AntiSpyware applications *as they will interfere with our tools and the removal. If you are unsure how to do this, please refer to our sticky topic *How to disable your security applications*


==================================================














Drag the setup package onto ComboFix.exe and drop it.

Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.












At the next prompt, click 'Yes' to run the full ComboFix scan.

When the tool is finished, it will produce a report for you.
Please post the *C:\ComboFix.txt* in your next reply.


----------



## jenn_needs_help

well i seem to have another problem with this.the infected computer will not let me drag and drop programs. Is there another way to get the recovery program into combo fix. Sorry this is frustrating


----------



## Ried

It's okay. :smile:

Does Task Manager work? Press Ctrl Alt Del keys in succession. If it opens for you - tell me where ComboFix and the Microsoft package are located at this moment. Are they on the desktop or still on the flash drive. If they are still on the flash drive, I need to know that drive letter so I can give you a command to run to get this going.

I also need to know which Microsoft package you downloaded. Was it for Windows XP Home or Windows XP Pro?


----------



## jenn_needs_help

i downloaded the microsoft package for xp home. the programs are on the flash drive. i downloaded combofix but i am having problems installing it. it gets half way done then it just freezes. i had installed it previously but i deleted it. i just dont know what to do i dont want to have to go take the pc to best buy. lol thank you for all your help. i really appreciate it.The flash drive is Cruzer(E task manager will open but a few other programs wont.


----------



## Ried

We'll get through this. :smile:

Can you get ComboFix.exe on that same flash drive? If so, once both ComboFix.exe and the WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe files are both on the same flash drive (drive E:\), please do the following:

This will seem to be a bit of a pain, but it will be worth it. Open Task Manager and click File>New Task (Run...). Since you can't copy/paste, you'll have to type the following into the Open Window and click OK:

*"e:\ComboFix.exe"_"e:\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe"*

You must include all the quote marks you see, and I've placed an underscore *_* where there should be a space in the command. Do not type the underscore, simply hit the space bar and continue typing the rest of the command.

ComboFix should begin to run. Follow all prompts and post the C:\ComboFix.txt when it has completed.

****If you receive an error after typing in that command and clicking OK, then for now - just run ComboFix.exe straight out. You can run it from the flash drive.


----------



## jenn_needs_help

Right now what i have on the flash drive is.

combofix nsis installer swearware and winxp_en_hom_bf win32 self-extractor. is that what we are going for or do i need to install combofix on this laptop and drag it to the flash drive before i try to run it on the infected computer?


----------



## Ried

We can run it from the flash drive, but I'm confused - is comboFix.exe on the flash drive - just a folder for comboFix?


----------



## jenn_needs_help

Sorry its confusing me too lol. It says its an installer but when i try to run combofix it gets about halfway through then stops and does nothing.


----------



## Ried

Several questions for you. 

1. How are you running it? 
From flash drive by double clicking?
From Task Manager with the command I gave you earlier?
2. How old is this version of ComboFix? When did you download it?

3. You said it gets half way through - what stage does it get to?


----------



## jenn_needs_help

ok i can answer all of that.

1. I tried to run it first by double clicking it got halfway through. i will go into that on the next questions answer. i also tried to type in that command you gave me, it gave me an error so i just tried combofix.exe and it stopped at the same point as well.

2.I downloaded this combofix when you gave me the link. Sunday i believe.

3 it gets to Output folder: C:\32788r22fwjfw then it goes no futher.


----------



## Ried

Thanks. 

Open notepad and copy/paste or type the text in the quotebox below into it:




> @shutdown -a


(there is a space between shutdown and -a)

Save this as *fix.bat *Choose to "Save type as - All Files"

It should look like this:









Each time your machine threatens to shutdown, double click on fix.bat & it shall abort the shutdown procedure. That should ease some of your current difficulties.

Restart the machine and boot into Normal Mode. Double click that fix.bat every time you see the shutdown timer.

===================================

Go to your flash drive and locate ComboFix.exe. If you don't have file extensions set to be viewable, look for ComboFix. Right click the file and rename it to svchost (if you can see file extensions, rename it to svchost.exe)

Try again to run the renamed ComboFix. Give it time if it appears to stall - it may take 15 to 20 minutes to continue. Let me know how that goes for you.


----------



## jenn_needs_help

that would be alot more simple than typeing shutdown -a into the cmd window everytime. i will try that and let you know.
by the way happy independence day.


----------



## jenn_needs_help

I tried to let combofix run for an hour maybe a little more, then i get a message saying that an error had occured and combofix had to shutdown.I got all that combfix did and attached it. If that will help any. The fixbat thing works but i still have to click it every 2 minutes.


----------



## Ried

Thanks, but it still didn't run. I would need to know the exact error message you saw.

Let's try another tool to try to gather more info here. Please download aswMBR.exe and save it to your desktop. 

Double click aswMBR.exe to start the tool. Select *Yes* if prompted to download the Avast database.


Click *Scan*
Upon completion of the scan, click *Save log* and save it to your desktop, and post that log in your next reply for review. * Note - do NOT attempt any Fix yet. *

You will also notice another file created on the desktop named *MBR.dat*. Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well.


----------



## jenn_needs_help

Okay, i downloaded aswmbr. and i downloaded the avast updates.I also had to download the avastvirus protection thing so i could use the updates on the infected computer because i cannot connect to the internet with that computer. i put it all on my flashdrive. i am now trying to run the program it seems to freeze up just like combofix did. What should i do?


----------



## Ried

Try running it in Safe Mode.


----------



## jenn_needs_help

i can't even get into safe mode. When i boot up it skips the acer screen i just get a black screen then the blue one saying windows is starting up.


----------



## Ried

Does this machine have a working CD drive?


----------



## jenn_needs_help

i dont know if the virus will let it work but yes it did before whatever this is happened.


----------



## jenn_needs_help

when i am trying to run aswmbr a box pops up and it says. EgisUpdate..Program operation error. Please restart the computer and try again.


----------



## Ried

Ok, I hope it works because we seem to have little choice but to use a bootable CD AV to try to make some progress here. 

These instructions may seem a bit intimidating, but believe me, I've done this myself and it's not as difficult as it looks - just take it a step at a time. :smile:

Follow the instructions on *this page* for downloading the kav_rescue_10.iso (200 mb) file and creating the Kaspersky Rescue Disk.

This is an .iso file which means it is just a disk image. It cannot be run by double clicking, it must be burned to a CD using burning software. Go to ISO Image Burner - Free ISO image CD/DVD burning software and follow the instructions for downloading and installing the free image burning software.

Now you're set to create a bootable disc from the Kav_rescue_10.iso you downloaded earlier. Go back to Kaspersky's link --> How to record Kaspersky Rescue Disk 10 to a CD/DVD and boot my computer from the disk? and follow the step by step instructions for booting from that disc.

Once it boots from CD, press a key so it continues to boot from that CD.

Select the language, then be sure to select *Kaspersky Rescue Disk Graphic Mode*.

Kaspersky should begin scanning your machine. If it finds infection, look carefully at the files it lists. If any of them seem to be legit files, do not allow it to clean/quarantine/delete them. Rather, save the log to your flash drive and post the results for me to look over.

Let me know if you have any trouble or questions with any of the steps. I'll be around for the next 3 hrs to help you. :sayyes:


----------



## jenn_needs_help

ok i do have one question. I dont have any cd-rws just cd-r will that be ok for this or do i need to run to walmart? lol


----------



## Ried

CD-R is perfect. That means it is not re-writeable. You burn and create this bootable disc, and you can use it over and over again if need be - no chance of anyone accidentally writing anything else to it. :smile:


----------



## jenn_needs_help

ok cool i am downloading now. its going to take awhile i will let you know if i have any questions along the way.


----------



## Ried

Okay, take your time. If you get stuck and I happen to have gone offline, then we'll continue tomorrow. :smile: I'll send you a message when I'm calling it a night.


----------



## jenn_needs_help

I do have a question. How do i get to the bios to have the computer boot from the cd? i think i have everything else under control right now.


----------



## Ried

It depends on the machine. For most machines, restart the machine and tap F2. On others, it could be the delete key. If neither of those get you into the Bios, can you tell me the make and model of this machine?


----------



## jenn_needs_help

acer aspire r1600


----------



## jenn_needs_help

Well i am trying to burn the disk with that iso burning program and i get a hardware error 222 i am not sure what that is. but i am trying to burn it on the laptop not the infected computer because i am sure that wouldnt work.


----------



## Ried

Try changing the Write speed in ISOBurner. Just below the Burn button in ISOBurner, you'll see CD-R/RW Write Speed. It's probably already set at Max - try it at 4x. If you still get error, try 8x


----------



## jenn_needs_help

OK that problem is solved. I have the disk burnt. Now i dont know how to make the computer boot from the disk.


----------



## Ried

Have you tried the Del key?


----------



## jenn_needs_help

i have tried every key. i think it is because it skips the acer screen and i just get a blank screen. Is there any command to force it to boot from the cd?


----------



## Ried

It took me over an hour to find the Service Manual for this Acer so please download that .pdf and save it to your desktop so you'll have it for the future. :grin:

Service Manual --> http://tim.id.au/laptops/acer/aspire 1600.pdf

Go to page 48 and according to that, you should be able to access some sort of menu via F12



> Users can press F12 during POST to enter the Boot Options Menu directly (See “Multi-Boot Menu” on page
> 35), or by entering BIOS SETUP utility, Boot Options item.


----------



## jenn_needs_help

i have tried hitting everything but nothing works to get me to the boot menu could it be because i have a usb keyboard and mouse? or maybe because i dont get the load screen just the blue screen that says windows is starting up


----------



## Ried

You have to hit the key fast - long before you see that Windows loading screen. Hit the key repeatedly, not just once. Try F12, F2, the Del key.


----------



## jenn_needs_help

okay i hit the key. now i am just stuck on a black screen, i will let you know if i get to the boot menu


----------



## jenn_needs_help

ok nevermind its not working. it stayed on the black screen for a minute.then it went to the windows is loading up screen even with me hitting the keys a million times. grrr this is frustrating.


----------



## Ried

I feel for you. :sigh:

When you first start up the computer, do you see an Acer splash screen before you see the Windows is loading screen?


----------



## jenn_needs_help

No i dont i just get a black screen before the loading screen. i used to get a splash screen. but not since it started going crazy on me.


----------



## Ried

Okay, something else to try - bit of a far fetched idea but worth a shot. Restart the machine and hold down a couple of keys on the keyboard as it's booting up. Theoretically, this should cause a 'stuck key error', which may allow you to enter the BIOS setup.


----------



## jenn_needs_help

I hit a bunch of keys, lol. Now i just have a black screen. Windows isnt loading and neither is the boot menu or anything.


----------



## Ried

Just do a hard shut down then. We can try another tool. It is a large download (136 mb) so you may want to connect this laptop directly to the modem so you can download it directly. Alternately, if you have a spare blank CD, you can download it from another computer and save it to the disc.

Download Kaspersky's AVPTool from here Kaspersky Virus Removal Tool Download

Run the program you just downloaded to your desktop (it will be randomly named ) and follow the prompts to install it.


Click the cog wheel in the upper right 

Tick the boxes all the way down to, and including your main drive, once done select the Automatic scan tab and press Start Scan 

Allow AVP to delete all infections found
Once it has finished select report tab (last tab)
Select Detected threats report from the left and press Save button
Save it to your desktop and attach to your next post


----------



## jenn_needs_help

Well i downloaded that tool. It seems to be doing about the same thing combofix did. I let it try to install for about an hour maybe a little more and it gets no where. I had a box pop up while it was trying to install it said file progress. It just did nothing..any thing else you think we could try?


----------



## Ried

I'm wondering if Avira is interfering with all these tools. Can you get to it to disable it? Use Task Manager>File>New Task (Run..) to browse to the program so you can bring it up and hopefully disable it.


----------



## jenn_needs_help

ok i will try to do that and let you know what happens. i have tried to uninstall it, but it wouldnt let me.


----------



## Ried

What happens when you try to uninstall it? What is the message?


----------



## jenn_needs_help

let me try again. i dont think i get a message. The windows uninstaller freezes up.


----------



## jenn_needs_help

i am trying to remove it in the add or remove programs thing. and it just locks up after i click remove and uninstall. Do you think maybe avira is causeing me all my problems. because this craziness began when i switched from AVG to avira.Also in my processes. there is one called avgnt.exe and when i try to end it i get this message...The operation could not be completed access denied. I am on the administrator account.


----------



## Ried

It could be. Download and install Revo Uninstaller Revo Uninstaller Pro - Uninstall Software, Remove Programs easily, Forced Uninstall 30-day Free Trial (fully functional) and try removing Avira with that.


----------



## jenn_needs_help

jenn_needs_help said:


> in my processes. there is one called avgnt.exe and when i try to end it i get this message...The operation could not be completed access denied. I am on the administrator account.


Ok i will try that and let you know again.


----------



## jenn_needs_help

i downloaded revo, installed it, and attempted to remove Avira. I dont think avira is gone, avgnt.exe is avira. and it is still there. i force uninstalled it.Then when i get back on the computer it says you have successfully installed the latest verison of Avira, How can i get rid of this. i am starting to believe it is avira itself causing me all these problems


----------



## Ried

We can try yanking it out manually, but I need more info to find the critical pieces of it. Let's see if this next tool can give me what I need.

Download  OTL to your desktop.

Double click the icon to start the tool.
Click *Run Scan *and let the program run uninterrupted.
When the scan is complete, two text files will be created, *OTL.Txt * <- this one will be opened in Notepad and *Extras.txt*, on Desktop.

Please post or attach both logs in your next reply.


----------



## jenn_needs_help

well that program ran just fine. here is the info you requested.:sayyes:


----------



## Ried

Thanks, and finally, something going right. :smile:

Let's give this a shot. I hope you have already backed up anything that's important to you. Yanking out services and drivers of an AV can sometimes have unpredictable results - especially on XP. 

First order of business is to create a new Restore Point. Open Task Manager>File>New Task (Run...) and type in the following exactly as you see it:

*%SystemRoot%\system32\restore\rstrui.exe*

Wait a few seconds and System Restore should open for you. Place a tick in the circle next to *Create a restore point* and click Next. Follow the prompts and when it has completed, carry out the next set of instructions
. 
**Keep Task Manager open since that is your only way to navigate around the machine.

=====================================

Download *LSPFix.exe* as we will need it later. 

Next, download the attached *avirastop.zip* and save it to your desktop (if you can access items on your desktop. If not, save it to flash drive and use Task Manager to navigate to it. 

Double click to run it, extract all files. Double click (or New Task (Run...) the *avirastop.bat* within. 

You'll see a black box open. I have it set to Pause at the end so you can read the lines before it closes. Before we go any further, tell me if any of those lines say 'could not be stopped'. (press any key to close that window when done)

================================

If after stopping those services, you lose internet...

Double click on LSPFix.exe to run it. 
 Once running, you will be required to tick the disclaimer - "I know what I'm doing".
You'll find a windows with 2 panes. 
In the left pane which is labeled *'Keep'*, select all instances of this file:
 *avsda.dll*

Then click on the arrow pointing to the right, *>>*. 
This will move the entry to the right pane labeled *'Remove'*
Click the Finish button to complete the fix.
 If you see any other entries in the right pane, move them back to the *"Keep"* pane & post the filenames to inform me.


----------



## jenn_needs_help

ok awesome i will try that in the morning and let you know the results. Thanks alot. i have a glimmer of hope now.


----------



## Ried

:smile: Let's hope this frees up the machine a bit. I don't want to delete those services just yet. As I mentioned, yanking out an AV can be tricky. 

If all goes well and all services have stopped, see if ComboFix will run now. Disable Avast, then double click on ComboFix and follow all prompts.


----------



## jenn_needs_help

It would not create a restore point.The system restore didnt even open.A box popped up and said system restore is not able to protect your computer. Please restart your computer and then run system restore again.
Should i continue with the rest? I ran avira stop and it said that avira does not exist as an installed program, but it is definately still on my desktop and in my processes


----------



## Ried

Yes, please


----------



## jenn_needs_help

i ran lspfix, it looks like avgnt.exe is still in my processes though.i also have 6 svchost's in my processes. and i just got this message. avgnt.exe bad image. the application or dll c:\programfiles\logitech\setpoint\igscroll.dll is not a valid windows image please check this against your installation diskette. and in the left hand corner of the screen i got a message from avira saying my evaluation license will expire in 10 days so avira is still on there somewhere.


----------



## jenn_needs_help

WOW i restarted it. and i have a start button again and sound!!!!Should i try to run combofix again?


----------



## jenn_needs_help

I just got a message saying that windows just recovered from a serious error and a log of this error has been created.


----------



## jenn_needs_help

here is the combofix log

ComboFix 12-07-10.01 - Command Central 07/10/2012 13:49:27.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.895.433 [GMT -5:00]
Running from: E:\ComboFix.exe
Command switches used :: E:\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: AVG Internet Security 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Avira Desktop *Disabled/Outdated* {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE}
FW: AVG Internet Security 2012 *Enabled* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\All Users\Application Data\TEMP\{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}\PostBuild.exe
c:\documents and settings\Command Central\Application Data\.#
c:\documents and settings\Command Central\Application Data\02000000d163bd43757C.manifest
c:\documents and settings\Command Central\Application Data\02000000d163bd43757O.manifest
c:\documents and settings\Command Central\Application Data\02000000d163bd43757P.manifest
c:\documents and settings\Command Central\Application Data\02000000d163bd43757S.manifest
c:\documents and settings\Command Central\Application Data\SystemProc
c:\documents and settings\KIDS\Application Data\02000000d163bd43757C.manifest
c:\documents and settings\KIDS\Application Data\02000000d163bd43757O.manifest
c:\documents and settings\KIDS\Application Data\02000000d163bd43757P.manifest
c:\documents and settings\KIDS\Application Data\02000000d163bd43757S.manifest
c:\documents and settings\KIDS\Application Data\SystemProc
c:\program files\FunWebProducts
c:\program files\FunWebProducts\ScreenSaver\Cache\00136600
c:\program files\FunWebProducts\ScreenSaver\Cache\00164A1D
c:\program files\FunWebProducts\ScreenSaver\Cache\0017CB2F.swf
c:\program files\FunWebProducts\ScreenSaver\Cache\0018F5A6.swf
c:\program files\FunWebProducts\ScreenSaver\Cache\001936E5.swf
c:\program files\FunWebProducts\ScreenSaver\Cache\0019771A
c:\program files\FunWebProducts\ScreenSaver\Cache\001BE953.swf
c:\program files\FunWebProducts\ScreenSaver\Cache\001E0E36.swf
c:\program files\FunWebProducts\ScreenSaver\Cache\001FB02E.jpg
c:\program files\FunWebProducts\ScreenSaver\Cache\00200DCF.jpg
c:\program files\FunWebProducts\ScreenSaver\Cache\00205112.jpg
c:\program files\FunWebProducts\ScreenSaver\Cache\0020A944.jpg
c:\program files\FunWebProducts\ScreenSaver\Cache\files.ini
c:\program files\FunWebProducts\ScreenSaver\Images\00103E14.urr
c:\program files\FunWebProducts\ScreenSaver\Images\00135EAD.urr
c:\program files\FunWebProducts\ScreenSaver\Images\00164887.dat
c:\program files\FunWebProducts\ScreenSaver\Images\0017C9E7.dat
c:\program files\FunWebProducts\ScreenSaver\Images\0018F42F.dat
c:\program files\FunWebProducts\ScreenSaver\Images\001935FA.dat
c:\program files\FunWebProducts\ScreenSaver\Images\001975D2.dat
c:\program files\FunWebProducts\ScreenSaver\Images\001BE636.dat
c:\program files\FunWebProducts\ScreenSaver\Images\001E0A10.dat
c:\program files\FunWebProducts\ScreenSaver\Images\001FAC46.dat
c:\program files\FunWebProducts\ScreenSaver\Images\00200D04.dat
c:\program files\FunWebProducts\ScreenSaver\Images\00205076.dat
c:\program files\FunWebProducts\ScreenSaver\Images\0020A84A.dat
c:\program files\FunWebProducts\ScreenSaver\Images\101x135\00200D04.jpg
c:\program files\FunWebProducts\ScreenSaver\Images\f3wallpp.bmp
c:\program files\FunWebProducts\ScreenSaver\Images\wrkparam.lst
c:\program files\FunWebProducts\Shared\Cache\CursorManiaBtn.html
c:\program files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\1.bin\CHROME.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\chrome\M3FFXTBR.JAR
c:\program files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
c:\program files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
c:\program files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3REPROX.DLL
c:\program files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
c:\program files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL
c:\program files\MyWebSearch\bar\1.bin\F3SPACER.WMV
c:\program files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
c:\program files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
c:\program files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG
c:\program files\MyWebSearch\bar\1.bin\INSTALL.RDF
c:\program files\MyWebSearch\bar\1.bin\M3SKIN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3SKNLCR.DLL
c:\program files\MyWebSearch\bar\1.bin\M3TPINST.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL.vir
c:\program files\MyWebSearch\bar\Avatar\COMMON.F3S
c:\program files\MyWebSearch\bar\Cache\00028553
c:\program files\MyWebSearch\bar\Cache\00028AC1
c:\program files\MyWebSearch\bar\Cache\00029020.bmp
c:\program files\MyWebSearch\bar\Cache\0002939B.bin
c:\program files\MyWebSearch\bar\Cache\00029560.bin
c:\program files\MyWebSearch\bar\Cache\000297E1.bin
c:\program files\MyWebSearch\bar\Cache\files.ini
c:\program files\MyWebSearch\bar\Game\CHECKERS.F3S
c:\program files\MyWebSearch\bar\Game\CHESS.F3S
c:\program files\MyWebSearch\bar\Game\REVERSI.F3S
c:\program files\MyWebSearch\bar\gen1\COMMON.F3S
c:\program files\MyWebSearch\bar\History\search3
c:\program files\MyWebSearch\bar\icons\CM.ICO
c:\program files\MyWebSearch\bar\icons\MFC.ICO
c:\program files\MyWebSearch\bar\icons\PSS.ICO
c:\program files\MyWebSearch\bar\icons\SMILEY.ICO
c:\program files\MyWebSearch\bar\icons\WB.ICO
c:\program files\MyWebSearch\bar\icons\ZWINKY.ICO
c:\program files\MyWebSearch\bar\IE9Mesg\COMMON.F3S
c:\program files\MyWebSearch\bar\jsifb\COMMON.F3S
c:\program files\MyWebSearch\bar\Message\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\DOG.F3S
c:\program files\MyWebSearch\bar\Notifier\FISH.F3S
c:\program files\MyWebSearch\bar\Notifier\KUNGFU.F3S
c:\program files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
c:\program files\MyWebSearch\bar\Notifier\MAID.F3S
c:\program files\MyWebSearch\bar\Notifier\MAILBOX.F3S
c:\program files\MyWebSearch\bar\Notifier\OPERA.F3S
c:\program files\MyWebSearch\bar\Notifier\ROBOT.F3S
c:\program files\MyWebSearch\bar\Notifier\SEDUCT.F3S
c:\program files\MyWebSearch\bar\Notifier\SURFER.F3S
c:\program files\MyWebSearch\bar\Overlay\COMMON.F3S
c:\program files\MyWebSearch\bar\Settings\prevcfg2.htm
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\program files\MyWebSearch\bar\wbnotify\COMMON.F3S
c:\program files\WeatherBlinkEI
c:\program files\Windows Searchqu Toolbar
c:\program files\Windows Searchqu Toolbar\sysid.ini
c:\program files\Windows Searchqu Toolbar\uninstall.exe
c:\windows\GnuHashes.ini
c:\windows\Services.reg
c:\windows\SwSys1.bmp
c:\windows\SwSys2.bmp
c:\windows\system32\__c006C640.exe
c:\windows\system32\__c00A72A8.exe
c:\windows\system32\607643042
c:\windows\system32\965f88bd-707c-e2fe-3d74-c78606d84fd7.exe
c:\windows\system32\Cache
c:\windows\system32\Cache\062b9d26ec987e09.fb
c:\windows\system32\Cache\272512937d9e61a4.fb
c:\windows\system32\Cache\287204568329e189.fb
c:\windows\system32\Cache\28bc8f716fd76a47.fb
c:\windows\system32\Cache\2c53092c95605355.fb
c:\windows\system32\Cache\31a0997e9a5b5eb3.fb
c:\windows\system32\Cache\32c84fe32bb74d60.fb
c:\windows\system32\Cache\3917078cb68ec657.fb
c:\windows\system32\Cache\578730bc3b4b8bd0.fb
c:\windows\system32\Cache\590ba23ce359fd0c.fb
c:\windows\system32\Cache\610289e025a3ee9a.fb
c:\windows\system32\Cache\651c5d3cdbfb8bd1.fb
c:\windows\system32\Cache\6c59ac5e7e7a3ad0.fb
c:\windows\system32\Cache\6d03dad1035885d3.fb
c:\windows\system32\Cache\a6fc693134e7b64f.fb
c:\windows\system32\Cache\a8556537add6dfc5.fb
c:\windows\system32\Cache\ad10a52aff5e038d.fb
c:\windows\system32\Cache\c1fa887b03019701.fb
c:\windows\system32\Cache\c4d28dca2e7648be.fb
c:\windows\system32\Cache\c829d54729f40ada.fb
c:\windows\system32\Cache\d201ef9910cd39de.fb
c:\windows\system32\Cache\d2e94710a5708128.fb
c:\windows\system32\Cache\d79b9dfe81484ec4.fb
c:\windows\system32\Cache\e0de16f883bea794.fb
c:\windows\system32\Cache\f998975c9cc711ee.fb
c:\windows\system32\FAST2003.ocx
c:\windows\system32\FAST2006.ocx
c:\windows\system32\NSIS.Library.RegTool.v3.{D0DE834A-1D55-4149-9C9B-F647789AE19C}.exe
c:\windows\system32\SET5A.tmp
c:\windows\system32\SET5E.tmp
c:\windows\system32\SET5F.tmp
c:\windows\system32\SET66.tmp
c:\windows\system32\SysWoW32
c:\windows\system32\SysWoW32\@i1281349791v6
c:\windows\system32\SysWoW32\@i1281349791v7
c:\windows\system32\SysWoW32\@u1281349791v0
c:\windows\system32\SysWoW32\@u1281349791v1
c:\windows\system32\SysWoW32\@u1281349791v2
c:\windows\system32\SysWoW32\@u1281349791v3
c:\windows\system32\SysWoW32\_i1281349791v6
c:\windows\system32\SysWoW32\_i1281349791v7
c:\windows\system32\SysWoW32\_u1281349791v0
c:\windows\system32\SysWoW32\_u1281349791v1
c:\windows\system32\SysWoW32\_u1281349791v2
c:\windows\system32\SysWoW32\_u1281349791v3
c:\windows\system32\SysWoW32\mu1281349791v4.kwd
c:\windows\system32\SysWoW32\mu1281349791v5.kwd
c:\windows\system32\SysWoW32\mu1281349791v6.kwd
c:\windows\system32\SysWoW32\mu1281349791v7.kwd
c:\windows\system32\SysWoW32\wu1281349791v0
c:\windows\system32\SysWoW32\wu1281349791v0.kwd
c:\windows\system32\SysWoW32\wu1281349791v1
c:\windows\system32\SysWoW32\wu1281349791v1.kwd
c:\windows\system32\SysWoW32\wu1281349791v2
c:\windows\system32\SysWoW32\wu1281349791v2.kwd
c:\windows\system32\SysWoW32\wu1281349791v3
c:\windows\system32\SysWoW32\wu1281349791v3.kwd
C:\xcrashdump.dat
.
c:\windows\system32\drivers\i8042prt.sys . . . is missing!!
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_MYWEBSEARCHSERVICE
-------\Service_MyWebSearchService
.
.
((((((((((((((((((((((((( Files Created from 2012-06-10 to 2012-07-10 )))))))))))))))))))))))))))))))
.
.
2012-07-09 04:51 . 2012-07-09 04:51	--------	d-----w-	c:\documents and settings\Command Central\Local Settings\Application Data\VS Revo Group
2012-07-09 04:47 . 2012-07-09 04:47	--------	d-----w-	c:\program files\VS Revo Group
2012-07-06 03:59 . 2012-07-06 03:59	--------	d-----w-	c:\program files\ISO Image Burner
2012-07-05 23:45 . 2012-07-03 16:21	21256	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys
2012-07-05 23:43 . 2012-07-03 16:21	353688	----a-w-	c:\windows\system32\drivers\aswSP.sys
2012-07-05 19:09 . 2012-07-03 16:21	35928	----a-w-	c:\windows\system32\drivers\aswRdr.sys
2012-07-05 19:09 . 2012-07-03 16:21	54232	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2012-07-05 19:06 . 2012-07-03 16:21	721000	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2012-07-05 19:05 . 2012-07-03 16:21	97608	----a-w-	c:\windows\system32\drivers\aswmon2.sys
2012-07-05 19:05 . 2012-07-03 16:21	89624	----a-w-	c:\windows\system32\drivers\aswmon.sys
2012-07-05 19:00 . 2012-07-03 16:21	25256	----a-w-	c:\windows\system32\drivers\aavmker4.sys
2012-07-05 18:59 . 2012-07-03 16:21	41224	----a-w-	c:\windows\avastSS.scr
2012-07-05 18:59 . 2012-07-03 16:21	227648	----a-w-	c:\windows\system32\aswBoot.exe
2012-07-05 18:59 . 2012-07-05 23:40	--------	d-----w-	c:\documents and settings\All Users\Application Data\AVAST Software
2012-06-24 17:42 . 2012-06-24 17:42	477240	----a-w-	c:\windows\system32\drivers\sptd.sys
2012-06-21 21:55 . 2012-06-15 21:39	169744	----a-w-	c:\windows\system32\ztvunrar36.dll
2012-06-21 21:55 . 2012-06-15 21:35	185616	----a-w-	c:\windows\system32\ztvunrar39.dll
2012-06-21 21:55 . 2012-06-15 21:33	605968	----a-w-	c:\windows\system32\ztv7z.dll
2012-06-21 21:55 . 2012-06-15 21:33	77072	----a-w-	c:\windows\system32\ztvcabinet.dll
2012-06-21 21:55 . 2005-08-26 06:50	77312	----a-w-	c:\windows\system32\ztvunace26.dll
2012-06-21 21:55 . 2002-03-06 06:00	75264	----a-w-	c:\windows\system32\unacev2.dll
2012-06-21 21:55 . 2003-02-03 01:06	153088	----a-w-	c:\windows\system32\UNRAR3.dll
2012-06-21 21:55 . 2012-06-24 17:40	--------	d-----w-	c:\program files\Trojan Remover
2012-06-21 21:55 . 2012-06-21 21:55	--------	d-----w-	c:\documents and settings\All Users\Application Data\Simply Super Software
2012-06-21 20:37 . 2012-06-21 20:56	--------	d-----w-	C:\20af6fb5af208c49bb
2012-06-21 19:50 . 2012-06-21 20:08	--------	d-----w-	C:\a45643d481b40159eb295c1744
2012-06-21 18:49 . 2012-06-21 18:55	--------	d-----w-	C:\97dd2c3269bd91880f644a13268fb008
2012-06-21 17:48 . 2012-07-09 04:59	--------	d-----w-	c:\documents and settings\All Users\Application Data\SpeedMaxPc
2012-06-21 17:48 . 2012-06-21 17:48	--------	d-----w-	c:\program files\SpeedMaxPc
2012-06-21 17:47 . 2012-06-21 18:03	--------	d-----w-	C:\075e0d2bcea1f3f9b8f385885c0bb571
2012-06-21 17:08 . 2012-06-21 17:43	--------	d-----w-	C:\7c09594d0b144ab19fad4eea95
2012-06-20 18:17 . 2012-06-20 18:17	--------	d-----w-	c:\documents and settings\Command Central\Application Data\Avira
2012-06-20 16:28 . 2012-06-20 16:24	36000	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2012-06-20 16:28 . 2012-06-20 16:24	137928	----a-w-	c:\windows\system32\drivers\avipbb.sys
2012-06-20 16:28 . 2012-06-20 16:23	83392	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2012-06-20 16:28 . 2012-06-20 16:28	--------	d-----w-	c:\documents and settings\All Users\Application Data\Avira
2012-06-20 16:28 . 2012-06-20 16:28	--------	d-----w-	c:\program files\Avira
2012-06-16 12:53 . 2012-05-11 14:42	521728	-c----w-	c:\windows\system32\dllcache\jsdbgui.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-31 13:22 . 2009-08-13 01:44	599040	----a-w-	c:\windows\system32\crypt32.dll
2012-05-16 15:08 . 2009-08-13 01:44	916992	----a-w-	c:\windows\system32\wininet.dll
2012-05-15 13:20 . 2009-08-13 01:44	1863168	----a-w-	c:\windows\system32\win32k.sys
2012-05-11 14:42 . 2009-08-13 01:44	43520	------w-	c:\windows\system32\licmgr10.dll
2012-05-11 14:42 . 2009-08-13 01:44	1469440	------w-	c:\windows\system32\inetcpl.cpl
2012-05-11 11:38 . 2009-08-13 01:44	385024	------w-	c:\windows\system32\html.iec
2012-05-06 03:33 . 2012-04-17 15:03	419488	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2012-05-06 03:33 . 2012-01-02 09:32	70304	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-04 13:16 . 2008-04-14 00:54	2148352	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-05-04 12:32 . 2008-04-14 00:01	2026496	----a-w-	c:\windows\system32\ntkrnlpa.exe
2012-05-02 13:46 . 2009-08-13 00:57	139656	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-04-16 19:55 . 2012-04-16 19:55	73728	----a-w-	c:\windows\system32\javacpl.cpl
2012-04-16 19:55 . 2011-07-30 17:55	472808	----a-w-	c:\windows\system32\deployJava1.dll
2011-09-13 03:43 . 2011-09-24 21:38	161728	----a-w-	c:\program files\gcres.dll
2010-02-17 11:59	203776	-csha-w-	c:\windows\system32\unrar.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{28387537-e3f9-4ed7-860c-11e69af4a8a0}]
2012-02-27 08:49	89008	----a-w-	c:\progra~1\IMESHA~1\MediaBar\Datamngr\ToolBar\wincoreimdtx.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BE7A24F5-69CB-4708-B77B-B1EDA6043B95}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}]
2011-12-27 10:07	87480	----a-w-	c:\progra~1\BEARSH~1\MediaBar\Datamngr\ToolBar\wincorebsdtx.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}"= "c:\progra~1\BEARSH~1\MediaBar\Datamngr\ToolBar\wincorebsdtx.dll" [2011-12-27 87480]
"{28387537-e3f9-4ed7-860c-11e69af4a8a0}"= "c:\progra~1\IMESHA~1\MediaBar\Datamngr\ToolBar\wincoreimdtx.dll" [2012-02-27 89008]
.
[HKEY_CLASSES_ROOT\clsid\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}]
.
[HKEY_CLASSES_ROOT\clsid\{28387537-e3f9-4ed7-860c-11e69af4a8a0}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-07-03 16:21	121528	----a-w-	c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-05-15 06:02	120104	----a-w-	c:\program files\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2009-05-24 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-05-24 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-05-24 13758464]
"EgisTecLiveUpdate"="c:\program files\EgisTec Egis Software Update\EgisUpdate.exe" [2009-05-14 199464]
"mwlDaemon"="c:\program files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-05-15 345384]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-10-17 91432]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"LGODDFU"="c:\program files\lg_fwupdate\fwupdate.exe" [2007-02-26 249856]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-04-22 55824]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"RTHDCPL"="RTHDCPL.EXE" [2009-05-21 17881600]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2012-05-29 296056]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-07-03 4273976]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-06-20 348624]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-12-30 813584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-05-26 23:47	72208	----a-w-	c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\Bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
"c:\\Program Files\\BearShare Applications\\MediaBar\\Datamngr\\ToolBar\\dtUser.exe"=
"c:\\Program Files\\iMesh Applications\\MediaBar\\Datamngr\\ToolBar\\dtUser.exe"=
"c:\\Program Files\\File Type Assistant\\tsassist.exe"=
.
R0 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys --> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [7/5/2012 6:43 PM 353688]
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [6/20/2012 11:28 AM 36000]
R1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\drivers\mwlPSDFilter.sys [12/4/2008 8:34 PM 17840]
R1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\drivers\mwlPSDNserv.sys [12/4/2008 8:34 PM 15280]
R1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\drivers\mwlPSDVDisk.sys [12/4/2008 8:34 PM 58800]
R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [6/20/2012 11:28 AM 86224]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [7/5/2012 6:45 PM 21256]
R2 FBDiskOptimizer;FBDiskOptimizer;c:\program files\FixBee\FBDefragSrv.exe [3/25/2012 4:26 PM 608568]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [12/30/2009 4:13 PM 10384]
R2 MotoConnect Service;MotoConnect Service;c:\program files\Motorola\MotoConnectService\MotoConnectService.exe [7/2/2011 12:06 PM 91392]
R2 MWLService;MyWinLocker Service;c:\program files\EgisTec\MyWinLocker 3\x86\MWLService.exe [5/15/2009 1:03 AM 305448]
R3 acfva;acfva;c:\windows\system32\drivers\ACFVA32.sys [12/30/2009 4:29 PM 86656]
R3 dgcfltr;DGC Filter Driver;c:\windows\system32\drivers\ACFDCP32.sys [12/30/2009 4:29 PM 28928]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [8/12/2009 8:45 PM 46752]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [7/5/2012 2:06 PM 721000]
S2 AntiVirMailService;Avira Mail Protection;c:\program files\Avira\AntiVir Desktop\avmailc.exe [6/20/2012 11:28 AM 375760]
S2 AntiVirWebService;Avira Web Protection;c:\program files\Avira\AntiVir Desktop\avwebgrd.exe [6/20/2012 11:28 AM 465360]
S2 gupdate1ca97438fe2dfb6;Google Update Service (gupdate1ca97438fe2dfb6);c:\program files\Google\Update\GoogleUpdate.exe [1/17/2010 2:06 AM 133104]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [4/17/2012 10:03 AM 257696]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [1/3/2012 1:41 AM 1684736]
S3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\drivers\motfilt.sys [7/2/2011 12:06 PM 6016]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/17/2010 2:06 AM 133104]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [7/2/2011 12:06 PM 19712]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [7/2/2011 12:06 PM 8320]
S3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\drivers\Motousbnet.sys [7/2/2011 12:06 PM 24960]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [7/2/2011 12:06 PM 23936]
S3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\drivers\motusbdevice.sys [7/2/2011 12:06 PM 6656]
S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [7/8/2010 10:52 AM 20480]
S3 NWUSBModem_000;Novatel Wireless USB Modem Driver (vGEN);c:\windows\system32\drivers\nwusbmdm_000.sys [7/8/2010 10:52 AM 176384]
S3 NWUSBPort_000;Novatel Wireless USB Status Port Driver (vGEN);c:\windows\system32\drivers\nwusbser_000.sys [7/8/2010 10:52 AM 176384]
S3 NWUSBPort2_000;Novatel Wireless USB Status2 Port Driver (vGEN);c:\windows\system32\drivers\nwusbser2_000.sys [7/8/2010 10:52 AM 176384]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [4/14/2010 8:29 PM 32408]
S3 SWDUMon;SWDUMon;c:\windows\system32\drivers\SWDUMon.sys [9/27/2011 11:24 AM 12984]
S3 WLAN(WLAN);XPC 802.11b/g Wireless Kit Driver(WLAN);c:\windows\system32\drivers\ZD1211U.sys [8/16/2005 2:50 PM 278016]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt	REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-17 03:33]
.
2012-07-10 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2012-07-05 16:21]
.
2012-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-17 07:05]
.
2012-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-17 07:05]
.
2012-07-10 c:\windows\Tasks\ProgramUpdateCheck.job
- c:\program files\File Type Assistant\tsassist.exe [2012-04-22 03:19]
.
2012-07-10 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-135449575-224621903-1653462319-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 23:21]
.
2012-06-20 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-135449575-224621903-1653462319-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 23:21]
.
2012-07-10 c:\windows\Tasks\User_Feed_Synchronization-{7A2BE865-5DA3-44CC-A762-3D5D0312B742}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 09:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=0&o=xph&d=1209&m=aspire_r1600
uSearchURL,(Default) = hxxp://my.netzero.net/s/search?r=minisearch
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
LSP: %SYSTEMROOT%\system32\nvLsp.dll
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-10 - (no file)
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
HKLM-Run-ROC_roc_dec12 - c:\program files\AVG Secure Search\ROC_roc_dec12.exe
HKLM-Run-RegTask - c:\program files\RegTask\RegTask.exe
AddRemove-965f88bd-707c-e2fe-3d74-c78606d84fd7 - c:\windows\system32\965f88bd-707c-e2fe-3d74-c78606d84fd7.exe
AddRemove-Mozilla Firefox 5.0 (x86 en-US) - c:\program files\Mozilla Firefox\uninstall\helper.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2012-07-10 14:14
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1236)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
.
- - - - - - - > 'explorer.exe'(628)
c:\windows\system32\WININET.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\program files\EgisTec\MyWinLocker 3\x86\psdprotect.dll
c:\program files\EgisTec\MyWinLocker 3\x86\sysenv.dll
c:\program files\EgisTec\MyWinLocker 3\x86\XmlLite.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\RTHDCPL.EXE
c:\program files\Motorola\MotoConnectService\MotoConnect.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
.
**************************************************************************
.
Completion time: 2012-07-10 14:23:20 - machine was rebooted
ComboFix-quarantined-files.txt 2012-07-10 19:23
.
Pre-Run: 116,809,953,280 bytes free
Post-Run: 118,727,122,944 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
.
- - End Of File - - EEFFD289397C41D0839C5E0955FF265E


----------



## Ried

:woot:

Amazing how an Anti Virus can really mess up the Operating System, isn't it. 

Let's continue. This will get rid of Avira for good, and also the leftover AVG entries.

Read through this entire procedure and if you have any questions, please ask them before you begin. Then either print out, or copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions. 


***************************************************

Open *notepad* and copy/paste the text in the code box below into it:



> File::
> c:\windows\system32\drivers\avkmgr.sys
> c:\windows\system32\drivers\avipbb.sys
> c:\windows\system32\drivers\avgntflt.sys
> 
> Folder::
> c:\documents and settings\All Users\Application Data\Avira
> c:\program files\Avira
> c:\documents and settings\Command Central\Application Data\Avira
> c:\progra~1\IMESHA~1
> C:\progra~1\BEARSH~1
> 
> Registry::
> [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
> "c:\\Program Files\\BearShare Applications\\MediaBar\\Datamngr\\ToolBar\\dtUser.exe"=-
> "c:\\Program Files\\iMesh Applications\\MediaBar\\Datamngr\\ToolBar\\dtUser.exe"=-
> 
> Driver::
> avkmgr
> AntiVirSchedulerService
> AntiVirMailService
> AntiVirWebService
> 
> SecCenter::
> AV: AVG Internet Security 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
> AV: Avira Desktop *Disabled/Outdated* {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE}
> FW: AVG Internet Security 2012 *Enabled* {17DDD097-36FF-435F-9E1B-52D74245D6BF}


Save this as *CFScript.txt*, and as Type: All Files (*.*)
*in the same location as ComboFix.exe*

***************************************************

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

***************************************************












Refering to the picture above, drag CFScript into ComboFix.exe. ***NOTE: If you still cannot drag and drop, then click Start>Run and type the following into the Run box and click OK:*

*E:\ComboFix.exe E:\CFScript.txt*

(there is a space between E:\ComboFix.exe and E:\CFScript.txt)


When finished, it shall produce a log for you. Post the *C:\ComboFix.txt i*n your next reply.

What issues remain?


----------



## jenn_needs_help

well the only issuses i am having now is with avira i believe. i just get a alot of avguard and avgnt errors. i dont think i can disable avg. because i uninstalled that awhile back. i dont think i have anymore questions..i will let you know how this goes. so glad we are getting somewhere. and thank you so much for all your help i couldnt of done it without you.


----------



## jenn_needs_help

i had to drag the system recovery to the combofix as well as the cfscript i dont think it really did anything else. but here is the log. avira is still in my task bar and on my desktop


----------



## Ried

The fix didn't take place. Instead of running the CFScript.txt, it ran the Recovery Console script. :smile:

I should have mentioned this before - there is no need to drag and drop the Recovery Console package any longer. It got installed in the previous run. You can delete this file now E:\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

Do you still see the CFScript.txt on the flash drive? If so, disable Avast then drag and drop the CFScript.txt into ComboFix.exe

If the CFScript.txt is gone, repeat the procedure in my previous post to create another CFScript.txt, then drag and drop.


----------



## jenn_needs_help

ok it did it this time. i dont think avast is working right either though.since i installed it while the computer was messing up what do you think?


----------



## Ried

Can you open Avast? Does it update and will it scan? If you do have trouble, then yes, uninstall then reinstall it.

How is the machine behaving now? Can you copy/paste? Are you still getting Rpc shutdown message?


----------



## jenn_needs_help

i cant scan and the program just seems to be not responding to what i tell it to do. the machine is doing great other than that. i can copy/paste no rpc shutdown. seems to be doing just fine. i just need to uninstal and reinstal avast. out of all the free virus protection would avast be the one you would recommend?


----------



## Ried

Yes, Avast or Microsoft Security Essentials.

Just in case Avast gives you a problem uninstalling, here's their uninstaller if you find you need it avast! Uninstall Utility | Download aswClear for avast! Removal Do try uninstalling it via Control Panel>Add or Remove programs first. If that doesn't work, use the uninstaller as described in that link.

Let me know how that goes. :smile:


----------



## jenn_needs_help

well i think i spoke too soon. Internet explorer isnt working. it encounters a problem as soon as i open it and terminates. also when i connect my verizon mifi it wont tell me my data usage. like i'm not connected to the internet or something. And i thought it was fixed lol


----------



## Ried

How are you communicating with me now? Is it from another computer or are you using a browser other than IE?


----------



## jenn_needs_help

i am on a borrowed laptop until i get the desktop working.


----------



## Ried

Open *notepad* and copy/paste the text in the code box below into it:



> File::
> c:\windows\system32\drivers\avkmgr.sys
> c:\windows\system32\drivers\avipbb.sys
> c:\windows\system32\drivers\avgntflt.sys
> Folder::
> c:\documents and settings\All Users\Application Data\Avira
> c:\program files\Avira


Save this as *"CFScript.txt"*, and as Type: All Files (*.*)
in the same location as ComboFix.exe

***************************************************

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

***************************************************












Refering to the picture above, drag CFScript into ComboFix.exe


When finished, it shall produce a log for you. Post the *C:\ComboFix.txt i*n your next reply.

Is internet back?


----------



## jenn_needs_help

ComboFix 12-07-10.01 - Command Central 07/10/2012 22:28:10.5.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.895.501 [GMT -5:00]
Running from: E:\ComboFix.exe
Command switches used :: E:\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Avira Desktop *Disabled/Outdated* {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE}
.
FILE ::
"c:\windows\system32\drivers\avgntflt.sys"
"c:\windows\system32\drivers\avipbb.sys"
"c:\windows\system32\drivers\avkmgr.sys"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Avira\AntiVir Desktop\avpref.dll
c:\documents and settings\All Users\Application Data\Avira . . . . Failed to delete
c:\program files\Avira . . . . Failed to delete
.
c:\windows\system32\drivers\i8042prt.sys . . . is missing!!
.
.
((((((((((((((((((((((((( Files Created from 2012-06-11 to 2012-07-11 )))))))))))))))))))))))))))))))
.
.
2012-07-09 04:51 . 2012-07-09 04:51 -------- d-----w- c:\documents and settings\Command Central\Local Settings\Application Data\VS Revo Group
2012-07-09 04:47 . 2012-07-09 04:47 -------- d-----w- c:\program files\VS Revo Group
2012-07-06 03:59 . 2012-07-06 03:59 -------- d-----w- c:\program files\ISO Image Burner
2012-07-05 23:45 . 2012-07-03 16:21 21256 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-07-05 23:43 . 2012-07-03 16:21 353688 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-07-05 19:09 . 2012-07-03 16:21 35928 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-07-05 19:09 . 2012-07-03 16:21 54232 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-07-05 19:06 . 2012-07-03 16:21 721000 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-07-05 19:05 . 2012-07-03 16:21 97608 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2012-07-05 19:05 . 2012-07-03 16:21 89624 ----a-w- c:\windows\system32\drivers\aswmon.sys
2012-07-05 19:00 . 2012-07-03 16:21 25256 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2012-07-05 18:59 . 2012-07-03 16:21 41224 ----a-w- c:\windows\avastSS.scr
2012-07-05 18:59 . 2012-07-03 16:21 227648 ----a-w- c:\windows\system32\aswBoot.exe
2012-07-05 18:59 . 2012-07-05 23:40 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software
2012-06-24 17:42 . 2012-06-24 17:42 477240 ----a-w- c:\windows\system32\drivers\sptd.sys
2012-06-21 21:55 . 2012-06-15 21:39 169744 ----a-w- c:\windows\system32\ztvunrar36.dll
2012-06-21 21:55 . 2012-06-15 21:35 185616 ----a-w- c:\windows\system32\ztvunrar39.dll
2012-06-21 21:55 . 2012-06-15 21:33 605968 ----a-w- c:\windows\system32\ztv7z.dll
2012-06-21 21:55 . 2012-06-15 21:33 77072 ----a-w- c:\windows\system32\ztvcabinet.dll
2012-06-21 21:55 . 2005-08-26 06:50 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2012-06-21 21:55 . 2002-03-06 06:00 75264 ----a-w- c:\windows\system32\unacev2.dll
2012-06-21 21:55 . 2003-02-03 01:06 153088 ----a-w- c:\windows\system32\UNRAR3.dll
2012-06-21 21:55 . 2012-06-24 17:40 -------- d-----w- c:\program files\Trojan Remover
2012-06-21 21:55 . 2012-06-21 21:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Simply Super Software
2012-06-21 20:37 . 2012-06-21 20:56 -------- d-----w- C:\20af6fb5af208c49bb
2012-06-21 19:50 . 2012-06-21 20:08 -------- d-----w- C:\a45643d481b40159eb295c1744
2012-06-21 18:49 . 2012-06-21 18:55 -------- d-----w- C:\97dd2c3269bd91880f644a13268fb008
2012-06-21 17:48 . 2012-07-09 04:59 -------- d-----w- c:\documents and settings\All Users\Application Data\SpeedMaxPc
2012-06-21 17:48 . 2012-06-21 17:48 -------- d-----w- c:\program files\SpeedMaxPc
2012-06-21 17:47 . 2012-06-21 18:03 -------- d-----w- C:\075e0d2bcea1f3f9b8f385885c0bb571
2012-06-21 17:08 . 2012-06-21 17:43 -------- d-----w- C:\7c09594d0b144ab19fad4eea95
2012-06-20 16:28 . 2012-06-20 16:24 36000 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-06-20 16:28 . 2012-06-20 16:24 137928 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-06-20 16:28 . 2012-06-20 16:23 83392 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-06-20 16:28 . 2012-07-11 00:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2012-06-20 16:28 . 2012-06-20 16:28 -------- d-----w- c:\program files\Avira
2012-06-16 12:53 . 2012-05-11 14:42 521728 -c----w- c:\windows\system32\dllcache\jsdbgui.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-31 13:22 . 2009-08-13 01:44 599040 ----a-w- c:\windows\system32\crypt32.dll
2012-05-16 15:08 . 2009-08-13 01:44 916992 ----a-w- c:\windows\system32\wininet.dll
2012-05-15 13:20 . 2009-08-13 01:44 1863168 ----a-w- c:\windows\system32\win32k.sys
2012-05-11 14:42 . 2009-08-13 01:44 43520 ------w- c:\windows\system32\licmgr10.dll
2012-05-11 14:42 . 2009-08-13 01:44 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-05-11 11:38 . 2009-08-13 01:44 385024 ------w- c:\windows\system32\html.iec
2012-05-06 03:33 . 2012-04-17 15:03 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-06 03:33 . 2012-01-02 09:32 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-04 13:16 . 2008-04-14 00:54 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-04 12:32 . 2008-04-14 00:01 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-02 13:46 . 2009-08-13 00:57 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-04-16 19:55 . 2012-04-16 19:55 73728 ----a-w- c:\windows\system32\javacpl.cpl
2012-04-16 19:55 . 2011-07-30 17:55 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-09-13 03:43 . 2011-09-24 21:38 161728 ----a-w- c:\program files\gcres.dll
2010-02-17 11:59 203776 -csha-w- c:\windows\system32\unrar.exe
.
.
((((((((((((((((((((((((((((( [email protected]_19.13.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-07-11 03:41 . 2012-07-11 03:41 16384 c:\windows\Temp\Perflib_Perfdata_138.dat
+ 2009-08-13 01:44 . 2012-07-11 02:21 68588 c:\windows\system32\perfc009.dat
- 2009-08-13 01:44 . 2012-07-10 19:16 68588 c:\windows\system32\perfc009.dat
+ 2009-08-13 01:44 . 2012-07-11 02:21 434494 c:\windows\system32\perfh009.dat
- 2009-08-13 01:44 . 2012-07-10 19:16 434494 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-07-03 16:21 121528 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-05-15 06:02 120104 ----a-w- c:\program files\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2009-05-24 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-05-24 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-05-24 13758464]
"EgisTecLiveUpdate"="c:\program files\EgisTec Egis Software Update\EgisUpdate.exe" [2009-05-14 199464]
"mwlDaemon"="c:\program files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-05-15 345384]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-10-17 91432]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"LGODDFU"="c:\program files\lg_fwupdate\fwupdate.exe" [2007-02-26 249856]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-04-22 55824]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"RTHDCPL"="RTHDCPL.EXE" [2009-05-21 17881600]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2012-05-29 296056]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-07-03 4273976]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-12-30 813584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-05-26 23:47 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\Bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
"c:\\Program Files\\File Type Assistant\\tsassist.exe"=
.
R0 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys --> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [7/5/2012 6:43 PM 353688]
R1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\drivers\mwlPSDFilter.sys [12/4/2008 8:34 PM 17840]
R1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\drivers\mwlPSDNserv.sys [12/4/2008 8:34 PM 15280]
R1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\drivers\mwlPSDVDisk.sys [12/4/2008 8:34 PM 58800]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [7/5/2012 6:45 PM 21256]
R2 FBDiskOptimizer;FBDiskOptimizer;c:\program files\FixBee\FBDefragSrv.exe [3/25/2012 4:26 PM 608568]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [12/30/2009 4:13 PM 10384]
R2 MotoConnect Service;MotoConnect Service;c:\program files\Motorola\MotoConnectService\MotoConnectService.exe [7/2/2011 12:06 PM 91392]
R2 MWLService;MyWinLocker Service;c:\program files\EgisTec\MyWinLocker 3\x86\MWLService.exe [5/15/2009 1:03 AM 305448]
R3 acfva;acfva;c:\windows\system32\drivers\ACFVA32.sys [12/30/2009 4:29 PM 86656]
R3 dgcfltr;DGC Filter Driver;c:\windows\system32\drivers\ACFDCP32.sys [12/30/2009 4:29 PM 28928]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [8/12/2009 8:45 PM 46752]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [7/5/2012 2:06 PM 721000]
S2 gupdate1ca97438fe2dfb6;Google Update Service (gupdate1ca97438fe2dfb6);c:\program files\Google\Update\GoogleUpdate.exe [1/17/2010 2:06 AM 133104]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [4/17/2012 10:03 AM 257696]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [1/3/2012 1:41 AM 1684736]
S3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\drivers\motfilt.sys [7/2/2011 12:06 PM 6016]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/17/2010 2:06 AM 133104]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [7/2/2011 12:06 PM 19712]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [7/2/2011 12:06 PM 8320]
S3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\drivers\Motousbnet.sys [7/2/2011 12:06 PM 24960]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [7/2/2011 12:06 PM 23936]
S3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\drivers\motusbdevice.sys [7/2/2011 12:06 PM 6656]
S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [7/8/2010 10:52 AM 20480]
S3 NWUSBModem_000;Novatel Wireless USB Modem Driver (vGEN);c:\windows\system32\drivers\nwusbmdm_000.sys [7/8/2010 10:52 AM 176384]
S3 NWUSBPort_000;Novatel Wireless USB Status Port Driver (vGEN);c:\windows\system32\drivers\nwusbser_000.sys [7/8/2010 10:52 AM 176384]
S3 NWUSBPort2_000;Novatel Wireless USB Status2 Port Driver (vGEN);c:\windows\system32\drivers\nwusbser2_000.sys [7/8/2010 10:52 AM 176384]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [4/14/2010 8:29 PM 32408]
S3 SWDUMon;SWDUMon;c:\windows\system32\drivers\SWDUMon.sys [9/27/2011 11:24 AM 12984]
S3 WLAN(WLAN);XPC 802.11b/g Wireless Kit Driver(WLAN);c:\windows\system32\drivers\ZD1211U.sys [8/16/2005 2:50 PM 278016]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-17 03:33]
.
2012-07-11 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2012-07-05 16:21]
.
2012-07-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-17 07:05]
.
2012-07-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-17 07:05]
.
2012-07-11 c:\windows\Tasks\ProgramUpdateCheck.job
- c:\program files\File Type Assistant\tsassist.exe [2012-04-22 03:19]
.
2012-07-11 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-135449575-224621903-1653462319-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 23:21]
.
2012-06-20 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-135449575-224621903-1653462319-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 23:21]
.
2012-07-11 c:\windows\Tasks\User_Feed_Synchronization-{7A2BE865-5DA3-44CC-A762-3D5D0312B742}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 09:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=0&o=xph&d=1209&m=aspire_r1600
uSearchURL,(Default) = hxxp://my.netzero.net/s/search?r=minisearch
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
LSP: %SYSTEMROOT%\system32\nvLsp.dll
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2012-07-10 22:41
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1040)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
.
- - - - - - - > 'explorer.exe'(1244)
c:\windows\system32\WININET.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\program files\EgisTec\MyWinLocker 3\x86\psdprotect.dll
c:\program files\EgisTec\MyWinLocker 3\x86\sysenv.dll
c:\program files\EgisTec\MyWinLocker 3\x86\XmlLite.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\RTHDCPL.EXE
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\program files\Motorola\MotoConnectService\MotoConnect.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
.
**************************************************************************
.
Completion time: 2012-07-10 22:45:55 - machine was rebooted
ComboFix-quarantined-files.txt 2012-07-11 03:45
ComboFix2.txt 2012-07-11 00:43
ComboFix3.txt 2012-07-10 21:03
ComboFix4.txt 2012-07-10 20:41
ComboFix5.txt 2012-07-11 03:26
.
Pre-Run: 118,328,578,048 bytes free
Post-Run: 118,309,801,984 bytes free
.
- - End Of File - - 1E898FED34ABC1386EF2755390C94E62


nope ie just closes when i try to open it. and i cant see my data usage page on my verizon mifi


----------



## Ried

That darned Avira folder just won't go away. 

Click Start>Run and copy/paste the following, exactly as you see it, into the Run box and click OK:

*cmd /c rd /s/q "c:\program files\Avira"*

After that has completed, run a new scan with dds.scr and post the dds.txt


----------



## jenn_needs_help

.
DDS (Ver_2011-08-26.01) - NTFSx86 
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_31
Run by Command Central at 9:47:23 on 2012-07-11
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.895.453 [GMT -5:00]
.
AV: Avira Desktop *Disabled/Outdated* {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE}
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\FixBee\FBDefragSrv.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Google\Update\GoogleUpdate.exe
c:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Motorola\MotoConnectService\MotoConnectService.exe
C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe
C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\program files\real\realplayer\update\realsched.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Motorola\MotoConnectService\MotoConnect.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\WINDOWS\explorer.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=0&o=xph&d=1209&m=aspire_r1600
uSearchURL,(Default) = hxxp://my.netzero.net/s/search?r=minisearch
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [EgisTecLiveUpdate] "c:\program files\egistec egis software update\EgisUpdate.exe"
mRun: [mwlDaemon] c:\program files\egistec\mywinlocker 3\x86\mwlDaemon.exe
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [RemoteControl8] "c:\program files\cyberlink\powerdvd8\PDVD8Serv.exe"
mRun: [PDVD8LanguageShortcut] "c:\program files\cyberlink\powerdvd8\language\Language.exe"
mRun: [LGODDFU] "c:\program files\lg_fwupdate\fwupdate.exe" blrun
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
LSP: %SYSTEMROOT%\system32\nvLsp.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
============= SERVICES / DRIVERS ===============
.
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2012-7-5 353688]
R1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\drivers\mwlPSDFilter.sys [2008-12-4 17840]
R1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\drivers\mwlPSDNserv.sys [2008-12-4 15280]
R1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\drivers\mwlPSDVDisk.sys [2008-12-4 58800]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2012-7-5 21256]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2012-7-5 44808]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2012-6-20 83392]
R2 FBDiskOptimizer;FBDiskOptimizer;c:\program files\fixbee\FBDefragSrv.exe [2012-3-25 608568]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2009-12-30 10384]
R2 MotoConnect Service;MotoConnect Service;c:\program files\motorola\motoconnectservice\MotoConnectService.exe [2011-7-2 91392]
R2 MWLService;MyWinLocker Service;c:\program files\egistec\mywinlocker 3\x86\MWLService.exe [2009-5-15 305448]
R3 acfva;acfva;c:\windows\system32\drivers\ACFVA32.sys [2009-12-30 86656]
R3 dgcfltr;DGC Filter Driver;c:\windows\system32\drivers\ACFDCP32.sys [2009-12-30 28928]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [2009-8-12 46752]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2012-7-5 721000]
S2 AntiVirService;Avira Realtime Protection;"c:\program files\avira\antivir desktop\avguard.exe" --> c:\program files\avira\antivir desktop\avguard.exe [?]
S2 gupdate1ca97438fe2dfb6;Google Update Service (gupdate1ca97438fe2dfb6);c:\program files\google\update\GoogleUpdate.exe [2010-1-17 133104]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-17 257696]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2012-1-3 1684736]
S3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\drivers\motfilt.sys [2011-7-2 6016]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-1-17 133104]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2011-7-2 19712]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2011-7-2 8320]
S3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\drivers\Motousbnet.sys [2011-7-2 24960]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2011-7-2 23936]
S3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\drivers\motusbdevice.sys [2011-7-2 6656]
S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [2010-7-8 20480]
S3 NWUSBModem_000;Novatel Wireless USB Modem Driver (vGEN);c:\windows\system32\drivers\nwusbmdm_000.sys [2010-7-8 176384]
S3 NWUSBPort_000;Novatel Wireless USB Status Port Driver (vGEN);c:\windows\system32\drivers\nwusbser_000.sys [2010-7-8 176384]
S3 NWUSBPort2_000;Novatel Wireless USB Status2 Port Driver (vGEN);c:\windows\system32\drivers\nwusbser2_000.sys [2010-7-8 176384]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\verizo~1\vzacce~1\SMSIVZAM5.SYS [2010-4-14 32408]
S3 SWDUMon;SWDUMon;c:\windows\system32\drivers\SWDUMon.sys [2011-9-27 12984]
S3 WLAN(WLAN);XPC 802.11b/g Wireless Kit Driver(WLAN);c:\windows\system32\drivers\ZD1211U.sys [2005-8-16 278016]
.
=============== Created Last 30 ================
.
2012-07-10 18:46:57 -------- d-sha-r- C:\cmdcons
2012-07-10 18:26:54 98816 ----a-w- c:\windows\sed.exe
2012-07-10 18:26:54 518144 ----a-w- c:\windows\SWREG.exe
2012-07-10 18:26:54 256000 ----a-w- c:\windows\PEV.exe
2012-07-10 18:26:54 208896 ----a-w- c:\windows\MBR.exe
2012-07-09 04:51:25 -------- d-----w- c:\documents and settings\command central\local settings\application data\VS Revo Group
2012-07-09 04:47:19 -------- d-----w- c:\program files\VS Revo Group
2012-07-06 03:59:30 -------- d-----w- c:\program files\ISO Image Burner
2012-07-05 19:06:46 721000 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-07-05 18:59:49 41224 ----a-w- c:\windows\avastSS.scr
2012-07-05 18:59:13 -------- d-----w- c:\documents and settings\all users\application data\AVAST Software
2012-06-24 17:42:12 477240 ----a-w- c:\windows\system32\drivers\sptd.sys
2012-06-21 21:55:22 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2012-06-21 21:55:22 77072 ----a-w- c:\windows\system32\ztvcabinet.dll
2012-06-21 21:55:22 75264 ----a-w- c:\windows\system32\unacev2.dll
2012-06-21 21:55:22 605968 ----a-w- c:\windows\system32\ztv7z.dll
2012-06-21 21:55:22 185616 ----a-w- c:\windows\system32\ztvunrar39.dll
2012-06-21 21:55:22 169744 ----a-w- c:\windows\system32\ztvunrar36.dll
2012-06-21 21:55:21 153088 ----a-w- c:\windows\system32\UNRAR3.dll
2012-06-21 21:55:19 -------- d-----w- c:\program files\Trojan Remover
2012-06-21 21:55:19 -------- d-----w- c:\documents and settings\all users\application data\Simply Super Software
2012-06-21 20:37:29 -------- d-----w- C:\20af6fb5af208c49bb
2012-06-21 19:50:15 -------- d-----w- C:\a45643d481b40159eb295c1744
2012-06-21 18:49:10 -------- d-----w- C:\97dd2c3269bd91880f644a13268fb008
2012-06-21 17:48:28 -------- d-----w- c:\program files\SpeedMaxPc
2012-06-21 17:48:28 -------- d-----w- c:\documents and settings\all users\application data\SpeedMaxPc
2012-06-21 17:47:46 -------- d-----w- C:\075e0d2bcea1f3f9b8f385885c0bb571
2012-06-21 17:08:57 -------- d-----w- C:\7c09594d0b144ab19fad4eea95
2012-06-20 16:28:12 83392 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-06-20 16:28:12 36000 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-06-20 16:28:10 -------- d-----w- c:\program files\Avira
2012-06-20 16:28:10 -------- d-----w- c:\documents and settings\all users\application data\Avira
2012-06-16 12:53:23 521728 -c----w- c:\windows\system32\dllcache\jsdbgui.dll
.
==================== Find3M ====================
.
2012-05-31 13:22:09 599040 ----a-w- c:\windows\system32\crypt32.dll
2012-05-16 15:08:26 916992 ----a-w- c:\windows\system32\wininet.dll
2012-05-15 13:20:33 1863168 ----a-w- c:\windows\system32\win32k.sys
2012-05-11 14:42:33 43520 ------w- c:\windows\system32\licmgr10.dll
2012-05-11 14:42:33 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-05-11 11:38:02 385024 ------w- c:\windows\system32\html.iec
2012-05-06 03:33:24 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-06 03:33:24 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-04 13:16:13 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-04 12:32:19 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-02 13:46:36 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-04-16 19:55:33 73728 ----a-w- c:\windows\system32\javacpl.cpl
2012-04-16 19:55:33 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-09-13 03:43:23 161728 ----a-w- c:\program files\gcres.dll
2010-02-17 11:59:34 203776 -csha-w- c:\windows\system32\unrar.exe
.
============= FINISH: 9:48:34.79 ===============


----------



## Ried

This is really starting to get on my nerves - it shouldn't be this difficult at all to delete. Obviously something crazy happened when you first installed it. 

I was going to give you several instructions to try in this round, but I decided to just give you this one. If it won't delete, the message it gives may provide me with an important clue as to how to proceed. :smile:

Try deleting it in Safe Mode:

1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Use the up arrow key to highlight *Safe Mode *and press Enter.
5) *Login with your usual account* 

Click Start>My Computer and double click the C:\ drive to open Windows Explorer. 

Navigate to c:\Program Files\*Avira *folder. 
Right click the Avira folder and select 'Delete'

If it deleted successfully, navigate to the following files and delete them as well:

C:\WINDOWS\system32\drivers\*avkmgr.sys*
C:\WINDOWS\system32\drivers\*avipbb.sys*
C:\WINDOWS\system32\drivers\*avgntflt.sys*

Restart the machine.


----------



## jenn_needs_help

well i tried pressing f8 and i am stuck on a black screen, so i guess there are still a couple of symptoms


----------



## Ried

Download this *tool* to your flash drive, then move it to the C:\Program Files folder. It cannot be a shortcut to that tool, the tool itself must be in the same location at the Avira folder. To ensure you are copying the tool and not just placing a shortcut to it in the Program Files folder:

Open the E:\ drive and single click the tool Inherit.exe to highlight it. 
Next, click *'Edit*' in the top menu bar, then select *Copy to Folder*. 
A box will open for you - look for c:\Program Files and single click that line to highlight it.

Click Copy.
Once you've got the tool in the C:\Program Files folder, drag the Avira folder into Inherit.exe. It may take several minutes, but when it's through you will see a little box pop up that says Finish at the top. Click the OK button to close it.

Now try to delete the Avira folder. 

If it deletes, then navigate to these files and delete them as well:

C:\WINDOWS\system32\drivers\*avkmgr.sys*
C:\WINDOWS\system32\drivers\*avipbb.sys*
C:\WINDOWS\system32\drivers\*avgntflt.sys*

Do not reboot yet. Please tell me what happened with the deletions.


----------



## jenn_needs_help

ok drug it to inherit and then tried to delete it and it says error deleting file or folder cannot delete EVENTB: access is denied make sure the dick is not full or write protected and that the file is not currently in use. and what is this egis update. i keep getting messages saying it could not update.


----------



## Ried

Sorry, another download for you. Download Unlocker 1.9.1 - FileHippo.com and install it.

Once installed, navigate to c:\Program Files\Avira folder. Right click the folder select *Unlocker*. If the folder or file is locked, a window listing of lockers will appear. Click *Unlock All*, then try again to delete that folder.

Same as before, if that folder deleted, then you need to delete these files as well:

C:\WINDOWS\system32\drivers\*avkmgr.sys*
C:\WINDOWS\system32\drivers\*avipbb.sys*
C:\WINDOWS\system32\drivers\*avgntflt.sys*

Don't reboot the machine yet, tell me what happened with the deletions.


----------



## jenn_needs_help

ok i installed unlocker and tried to unlock avira it said it didnt have any locks on it.but unlocker could help me do what i wanted with it so i clicked delete. now it says the object could not be deleted. do you want to perform the requested delete operation at next reboot? 

should i click yes and try to reboot?


----------



## Ried

Yes, please do


----------



## jenn_needs_help

Well avira is still in my program files after restarting.


----------



## Ried

Are you able to drag that Avira folder out of Program Files folder, and onto the desktop?


----------



## jenn_needs_help

when i try to drag it to the desktop i get this message.

Error moving file or folder FAILSAFE: Access is denied. Make sure the disk is not full or write protected and that the file is not currently in use


----------



## Ried

Do you still have that avirastop.bat on your flash drive? If so, double click to run it, then try again to delete the Avira folder.


----------



## jenn_needs_help

i tried avirastop.bat but it said none of the files existed tried to delete the avira folder again and got the same error message


----------



## Ried

Okay, I need to see all Avira processes are currently active. Please run OTL.exe again. Double click to open the program and click on the Run Scan button and let it run.

Post only the OTL.txt for me, please.


----------



## jenn_needs_help

OTL logfile created on: 7/12/2012 10:00:15 PM - Run 2
OTL by OldTimer - Version 3.2.53.1 Folder = E:\
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

895.10 Mb Total Physical Memory | 505.50 Mb Available Physical Memory | 56.47% Memory free
2.12 Gb Paging File | 1.82 Gb Available in Paging File | 85.86% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 134.05 Gb Total Space | 111.10 Gb Free Space | 82.88% Space Free | Partition Type: NTFS
Drive E: | 7.46 Gb Total Space | 7.32 Gb Free Space | 98.07% Space Free | Partition Type: FAT32

Computer Name: JOHNNY | User Name: Command Central | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/07/09 20:31:28 | 000,595,968 | ---- | M] (OldTimer Tools) -- E:\OTL.exe
PRC - [2012/07/03 11:21:30 | 004,273,976 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2012/07/03 11:21:29 | 000,044,808 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2012/05/28 23:03:13 | 000,296,056 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe
PRC - [2011/08/11 20:02:58 | 000,608,568 | ---- | M] (FixBee., (www.fixbee.com)) -- C:\Program Files\FixBee\FBDefragSrv.exe
PRC - [2009/11/25 14:20:02 | 000,091,392 | ---- | M] () -- C:\Program Files\Motorola\MotoConnectService\MotoConnectService.exe
PRC - [2009/11/25 14:19:58 | 000,277,760 | ---- | M] (Motorola) -- C:\Program Files\Motorola\MotoConnectService\MotoConnect.exe
PRC - [2009/05/26 18:49:12 | 000,813,584 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPoint\SetPoint.exe
PRC - [2009/05/22 13:33:00 | 000,055,824 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
PRC - [2009/05/15 01:03:46 | 000,345,384 | ---- | M] (Egis Technology Inc.) -- C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
PRC - [2009/05/15 01:03:30 | 000,305,448 | ---- | M] (Egis Technology Inc.) -- C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe
PRC - [2009/05/13 21:39:42 | 000,199,464 | ---- | M] (Egis Technology Inc.) -- C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe
PRC - [2008/12/18 14:05:40 | 000,457,248 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
PRC - [2008/12/18 14:05:40 | 000,191,008 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
PRC - [2008/10/17 13:44:58 | 000,091,432 | ---- | M] (CyberLink Corp.) -- C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
PRC - [2008/04/14 07:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/02/26 11:40:26 | 000,249,856 | ---- | M] (BL) -- C:\Program Files\lg_fwupdate\fwupdate.exe


========== Modules (No Company Name) ==========

MOD - [2012/07/05 05:20:14 | 001,781,248 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\12070500\algo.dll
MOD - [2010/07/04 16:32:38 | 000,010,752 | ---- | M] () -- C:\Program Files\Unlocker\UnlockerCOM.dll
MOD - [2009/11/25 14:20:02 | 000,091,392 | ---- | M] () -- C:\Program Files\Motorola\MotoConnectService\MotoConnectService.exe
MOD - [2009/05/26 18:45:36 | 000,017,936 | ---- | M] () -- C:\Program Files\Logitech\SetPoint\khalwrapper.dll
MOD - [2008/12/18 14:05:40 | 000,457,248 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
MOD - [2008/12/18 14:05:40 | 000,191,008 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
MOD - [2008/12/18 14:04:44 | 000,109,088 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nv_common.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
SRV - File not found [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012/07/03 11:21:29 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2012/05/05 22:33:28 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2011/08/11 20:02:58 | 000,608,568 | ---- | M] (FixBee., (www.fixbee.com)) [Auto | Running] -- C:\Program Files\FixBee\FBDefragSrv.exe -- (FBDiskOptimizer)
SRV - [2009/11/25 14:20:02 | 000,091,392 | ---- | M] () [Auto | Running] -- C:\Program Files\Motorola\MotoConnectService\MotoConnectService.exe -- (MotoConnect Service)
SRV - [2009/05/26 18:46:32 | 000,121,360 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2009/05/15 01:03:30 | 000,305,448 | ---- | M] () [Auto | Running] -- C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe -- (MWLService)
SRV - [2008/12/18 14:05:40 | 000,457,248 | ---- | M] () [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM)
SRV - [2008/12/18 14:05:40 | 000,191,008 | ---- | M] () [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe -- (nSvcIp)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - [2012/07/03 11:21:54 | 000,054,232 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2012/07/03 11:21:53 | 000,721,000 | ---- | M] (AVAST Software) [File_System | System | Stopped] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2012/07/03 11:21:53 | 000,353,688 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2012/07/03 11:21:53 | 000,097,608 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2012/07/03 11:21:53 | 000,035,928 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (AswRdr)
DRV - [2012/07/03 11:21:53 | 000,021,256 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2012/07/03 11:21:52 | 000,025,256 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2012/06/24 12:42:12 | 000,477,240 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2012/06/20 11:24:05 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2012/06/20 11:24:01 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2012/06/20 11:23:59 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011/09/27 11:24:50 | 000,012,984 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SWDUMon.sys -- (SWDUMon)
DRV - [2010/07/08 10:52:32 | 000,231,424 | ---- | M] (Novatel Wireless Inc) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NWADIenum.sys -- (NWADI)
DRV - [2010/07/08 10:52:32 | 000,176,384 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nwusbser2_000.sys -- (NWUSBPort2_000) Novatel Wireless USB Status2 Port Driver (vGEN)
DRV - [2010/07/08 10:52:32 | 000,176,384 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nwusbser_000.sys -- (NWUSBPort_000) Novatel Wireless USB Status Port Driver (vGEN)
DRV - [2010/07/08 10:52:32 | 000,176,384 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nwusbmdm_000.sys -- (NWUSBModem_000) Novatel Wireless USB Modem Driver (vGEN)
DRV - [2010/07/08 10:52:32 | 000,020,480 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\NwUsbCdFil.sys -- (NWUSBCDFIL)
DRV - [2010/07/04 14:51:26 | 000,004,096 | ---- | M] () [Kernel | Unavailable | Unknown] -- C:\Program Files\Unlocker\UnlockerDriver5.sys -- (UnlockerDriver5)
DRV - [2010/04/14 20:29:22 | 000,032,408 | ---- | M] (Smith Micro Inc.) [Kernel | On_Demand | Stopped] -- C:\Program Files\Verizon Wireless\VZAccess Manager\SMSIVZAM5.sys -- (SMSIVZAM5)
DRV - [2009/10/27 12:06:04 | 000,024,960 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Motousbnet.sys -- (Motousbnet)
DRV - [2009/10/27 12:02:14 | 000,023,936 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motport.sys -- (motport)
DRV - [2009/10/27 12:02:14 | 000,023,936 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motmodem.sys -- (motmodem)
DRV - [2009/06/19 16:59:34 | 000,019,712 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motccgp.sys -- (motccgp)
DRV - [2009/05/22 10:37:50 | 005,082,624 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2009/05/06 19:16:26 | 000,006,656 | ---- | M] (Motorola Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motusbdevice.sys -- (motusbdevice)
DRV - [2009/04/22 18:13:36 | 000,037,392 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2009/04/22 18:13:28 | 000,035,600 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2009/02/04 13:08:52 | 000,010,384 | ---- | M] (Logitech, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\LBeepKE.sys -- (LBeepKE)
DRV - [2009/01/29 17:18:00 | 000,008,320 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motccgpfl.sys -- (motccgpfl)
DRV - [2009/01/29 17:11:20 | 000,006,016 | ---- | M] (Motorola Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motfilt.sys -- (BTCFilterService)
DRV - [2009/01/22 02:43:56 | 000,046,752 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvhda32.sys -- (NVHDA)
DRV - [2008/12/02 13:52:00 | 000,058,800 | ---- | M] (Egis Incorporated.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV - [2008/12/02 13:52:00 | 000,017,840 | ---- | M] (Egis Incorporated.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV - [2008/12/02 13:52:00 | 000,015,280 | ---- | M] (Egis Incorporated.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV - [2008/11/12 04:58:38 | 000,145,952 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\nvgts.sys -- (nvgts)
DRV - [2008/08/24 14:22:40 | 000,014,208 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2008/08/05 07:10:12 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)
DRV - [2008/07/31 22:36:26 | 000,022,016 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2008/07/31 22:36:20 | 000,054,784 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2007/11/02 15:51:30 | 000,006,400 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motswch.sys -- (MotoSwitchService)
DRV - [2007/07/10 03:14:16 | 000,028,928 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ACFDCP32.sys -- (dgcfltr)
DRV - [2007/06/29 05:39:46 | 000,086,656 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ACFVA32.sys -- (acfva)
DRV - [2007/03/15 04:52:34 | 000,012,672 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\ACFSDK32.sys -- (mdmxsdk)
DRV - [2006/01/04 02:41:48 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)
DRV - [2005/08/16 14:50:50 | 000,278,016 | ---- | M] (ZyDAS Technology Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZD1211U.sys -- (WLAN(WLAN)) XPC 802.11b/g Wireless Kit Driver(WLAN)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD21}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = {searchTerms} - Bing?}
IE - HKLM\..\SearchScopes\{597b1823-7ff0-4cd3-8095-9d8cba514992}: "URL" = MyWebSearch}
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = {searchTerms} - Google Search
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}: "URL" = {searchTerms - Search-results Web Search}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = {searchTerms - Search-results Web Search}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2408}: "URL" = {searchTerms - Search-results Web Search}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = B3 DB C6 01 14 9F B0 43 80 B9 31 DB 98 90 47 30 [binary data]
IE - HKCU\..\URLSearchHook: {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - No CLSID value found
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {47CA48B3-155D-416A-8775-086237034BAA}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = {searchTerms} - Bing
IE - HKCU\..\SearchScopes\{0D0CF3F6-FFAE-4951-BF14-785A9C269545}: "URL" = {searchTerms} - Ask.com Search
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = Babylon Search
IE - HKCU\..\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}: "URL" = {searchTerms} - Crawler.com
IE - HKCU\..\SearchScopes\{47CA48B3-155D-416A-8775-086237034BAA}: "URL" = {searchTerms - Yahoo! Search Results}
IE - HKCU\..\SearchScopes\{597b1823-7ff0-4cd3-8095-9d8cba514992}: "URL" = MyWebSearch}
IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = {searchTerms} - Google Search
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = Search 12:10:10&v=11.0.0.9&sap=dsp&q={searchTerms}
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}: "URL" = {searchTerms - Search-results Web Search}
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = {searchTerms - Search-results Web Search}
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2408}: "URL" = {searchTerms - Search-results Web Search}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "Ask.com Search Engine - Better Web Search"
FF - prefs.js..extensions.enabledItems: {9CE11043-9A15-4207-A565-0C94C42D590D}:11.3.7.0
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: {d7ba287b-ebf1-4238-8ec9-fcaf3443b390}:1.0
FF - prefs.js..extensions.enabledItems: {4B3803EA-5230-4DC3-A7FC-33638F3D3542}:1.3
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..keyword.URL: "Yahoo! Search - Web Search="
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&ilc=12&type=937811"
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Yahoo"


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: c:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/03/19 14:59:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\MyWebSearch\bar\1.bin
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/05/28 23:04:13 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/03/19 14:59:21 | 000,000,000 | ---D | M]

[2012/04/26 18:05:24 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Extensions
[2012/05/19 13:13:44 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions
[2010/05/10 17:14:34 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012/03/26 21:11:07 | 000,000,000 | ---D | M] (Wincore Mediabar) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}
[2011/07/30 12:23:20 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/02/04 16:23:38 | 000,000,000 | ---D | M] (Wincore Mediabar) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}
[2010/05/09 21:36:55 | 000,000,000 | ---D | M] (XUL Cache) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{d7ba287b-ebf1-4238-8ec9-fcaf3443b390}
[2011/09/24 13:06:30 | 000,000,000 | ---D | M] (AVG Security Toolbar) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected](2)
[2012/03/18 05:39:44 | 000,000,000 | ---D | M] (Babylon) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected]
[2012/02/16 16:03:36 | 000,000,000 | ---D | M] (My Web Search) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected]
[2012/01/03 16:27:44 | 000,002,333 | ---- | M] () -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\searchplugins\askcom.xml
[2012/03/26 21:10:40 | 000,002,517 | ---- | M] () -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\searchplugins\Search_Results.xml

O1 HOSTS File: ([2012/07/10 22:41:30 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [EgisTecLiveUpdate] C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [LGODDFU] C:\Program Files\lg_fwupdate\fwupdate.exe (BL)
O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
O4 - HKLM..\Run: [mwlDaemon] C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe ()
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [RemoteControl8] C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\nvLsp.dll (NVIDIA)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Command Central\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Command Central\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/08/12 20:00:49 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/07/12 15:19:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Command Central\Start Menu\Programs\CyberLink PowerDVD 8
[2012/07/12 09:24:10 | 000,000,000 | ---D | C] -- C:\Program Files\Unlocker
[2012/07/12 09:24:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Command Central\Start Menu\Programs\Unlocker
[2012/07/11 09:47:29 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2012/07/10 13:46:57 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2012/07/10 13:26:54 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2012/07/10 13:26:54 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2012/07/10 13:26:54 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2012/07/10 13:26:54 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2012/07/08 23:51:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Command Central\Local Settings\Application Data\VS Revo Group
[2012/07/08 23:47:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Revo Uninstaller Pro
[2012/07/08 23:47:19 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group
[2012/07/05 22:59:30 | 000,000,000 | ---D | C] -- C:\Program Files\ISO Image Burner
[2012/07/05 22:59:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\ISO Image Burner
[2012/07/05 18:47:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
[2012/07/05 18:45:01 | 000,021,256 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2012/07/05 18:43:10 | 000,353,688 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2012/07/05 14:09:19 | 000,035,928 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2012/07/05 14:09:13 | 000,054,232 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2012/07/05 14:06:46 | 000,721,000 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2012/07/05 14:05:38 | 000,097,608 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2012/07/05 14:05:38 | 000,089,624 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2012/07/05 14:00:42 | 000,025,256 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2012/07/05 13:59:49 | 000,041,224 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2012/07/05 13:59:48 | 000,227,648 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2012/07/05 13:59:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2012/06/24 12:56:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2012/06/24 12:44:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Command Central\My Documents\Simply Super Software
[2012/06/24 12:42:12 | 000,477,240 | ---- | C] (Duplex Secure Ltd.) -- C:\WINDOWS\System32\drivers\sptd.sys
[2012/06/21 17:56:00 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/06/21 17:55:44 | 000,000,000 | ---D | C] -- C:\WINDOWS\erdnt
[2012/06/21 16:55:22 | 000,605,968 | ---- | C] (Igor Pavlov) -- C:\WINDOWS\System32\ztv7z.dll
[2012/06/21 16:55:22 | 000,077,072 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ztvcabinet.dll
[2012/06/21 16:55:19 | 000,000,000 | ---D | C] -- C:\Program Files\Trojan Remover
[2012/06/21 16:55:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Simply Super Software
[2012/06/21 15:37:29 | 000,000,000 | ---D | C] -- C:\20af6fb5af208c49bb
[2012/06/21 14:50:15 | 000,000,000 | ---D | C] -- C:\a45643d481b40159eb295c1744
[2012/06/21 13:49:10 | 000,000,000 | ---D | C] -- C:\97dd2c3269bd91880f644a13268fb008
[2012/06/21 12:48:28 | 000,000,000 | ---D | C] -- C:\Program Files\SpeedMaxPc
[2012/06/21 12:48:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SpeedMaxPc
[2012/06/21 12:47:46 | 000,000,000 | ---D | C] -- C:\075e0d2bcea1f3f9b8f385885c0bb571
[2012/06/21 12:08:57 | 000,000,000 | ---D | C] -- C:\7c09594d0b144ab19fad4eea95
[2012/06/20 11:28:13 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2012/06/20 11:28:12 | 000,137,928 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2012/06/20 11:28:12 | 000,083,392 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2012/06/20 11:28:12 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avkmgr.sys
[2012/06/20 11:28:10 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2012/06/20 11:28:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Avira
[2012/06/16 07:53:23 | 000,521,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\jsdbgui.dll
[41 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/07/12 22:07:36 | 000,000,442 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{7A2BE865-5DA3-44CC-A762-3D5D0312B742}.job
[2012/07/12 21:32:00 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/07/12 21:26:11 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/07/12 18:41:00 | 000,000,334 | -H-- | M] () -- C:\WINDOWS\tasks\avast! Emergency Update.job
[2012/07/12 15:22:16 | 000,434,494 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/07/12 15:22:16 | 000,068,588 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/07/12 15:19:18 | 000,000,265 | ---- | M] () -- C:\WINDOWS\lgfwup.ini
[2012/07/12 15:19:14 | 000,234,676 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml
[2012/07/12 15:19:07 | 000,000,298 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-135449575-224621903-1653462319-1005.job
[2012/07/12 15:19:06 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/07/12 15:19:05 | 000,000,414 | ---- | M] () -- C:\WINDOWS\tasks\ProgramUpdateCheck.job
[2012/07/12 15:18:07 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/07/12 15:18:03 | 938,655,744 | -HS- | M] () -- C:\hiberfil.sys
[2012/07/11 22:20:16 | 000,085,504 | ---- | M] () -- C:\Program Files\Inherit.exe
[2012/07/11 09:50:20 | 000,004,835 | ---- | M] () -- C:\Documents and Settings\Command Central\Desktop\attach.zip
[2012/07/11 00:15:02 | 000,000,306 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-135449575-224621903-1653462319-1005.job
[2012/07/10 22:41:30 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2012/07/10 13:47:03 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2012/07/09 23:49:00 | 000,000,188 | ---- | M] () -- C:\Documents and Settings\Command Central\Desktop\avirastop.bat
[2012/07/08 23:47:23 | 000,000,947 | ---- | M] () -- C:\Documents and Settings\Command Central\Application Data\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
[2012/07/08 23:47:23 | 000,000,929 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Revo Uninstaller Pro.lnk
[2012/07/08 23:06:12 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/07/05 22:59:30 | 000,000,704 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\ISO Image Burner.lnk
[2012/07/05 18:47:20 | 000,001,693 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2012/07/05 18:41:18 | 000,002,625 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2012/07/03 11:21:54 | 000,054,232 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2012/07/03 11:21:53 | 000,721,000 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2012/07/03 11:21:53 | 000,353,688 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2012/07/03 11:21:53 | 000,097,608 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2012/07/03 11:21:53 | 000,089,624 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2012/07/03 11:21:53 | 000,035,928 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2012/07/03 11:21:53 | 000,021,256 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2012/07/03 11:21:52 | 000,025,256 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2012/07/03 11:21:32 | 000,041,224 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2012/07/03 11:21:28 | 000,227,648 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2012/06/20 21:45:47 | 000,000,226 | ---- | M] () -- C:\Documents and Settings\Command Central\My Documents\avg.reg
[2012/06/20 12:47:12 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2012/06/20 11:24:05 | 000,028,520 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2012/06/20 11:24:04 | 000,036,000 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avkmgr.sys
[2012/06/20 11:24:01 | 000,137,928 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2012/06/20 11:23:59 | 000,083,392 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2012/06/20 09:07:12 | 000,033,758 | ---- | M] () -- C:\Documents and Settings\Command Central\Local Settings\Application Data\dt.dat
[2012/06/15 16:39:36 | 000,169,744 | ---- | M] () -- C:\WINDOWS\System32\ztvunrar36.dll
[2012/06/15 16:35:32 | 000,185,616 | ---- | M] () -- C:\WINDOWS\System32\ztvunrar39.dll
[2012/06/15 16:33:54 | 000,605,968 | ---- | M] (Igor Pavlov) -- C:\WINDOWS\System32\ztv7z.dll
[2012/06/15 16:33:32 | 000,077,072 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\ztvcabinet.dll
[2012/06/14 10:41:57 | 000,249,496 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012/06/13 07:44:52 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[41 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/07/12 21:22:15 | 000,000,188 | ---- | C] () -- C:\Documents and Settings\Command Central\Desktop\avirastop.bat
[2012/07/11 22:23:26 | 000,085,504 | ---- | C] () -- C:\Program Files\Inherit.exe
[2012/07/11 09:50:20 | 000,004,835 | ---- | C] () -- C:\Documents and Settings\Command Central\Desktop\attach.zip
[2012/07/10 13:47:03 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2012/07/10 13:47:00 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2012/07/10 13:26:54 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012/07/10 13:26:54 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012/07/10 13:26:54 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012/07/10 13:26:54 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012/07/10 13:26:54 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012/07/08 23:47:23 | 000,000,947 | ---- | C] () -- C:\Documents and Settings\Command Central\Application Data\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
[2012/07/08 23:47:23 | 000,000,929 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Revo Uninstaller Pro.lnk
[2012/07/05 22:59:30 | 000,000,704 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\ISO Image Burner.lnk
[2012/07/05 18:47:20 | 000,001,693 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2012/07/05 14:00:43 | 000,000,334 | -H-- | C] () -- C:\WINDOWS\tasks\avast! Emergency Update.job
[2012/06/21 16:55:22 | 000,185,616 | ---- | C] () -- C:\WINDOWS\System32\ztvunrar39.dll
[2012/06/21 16:55:22 | 000,169,744 | ---- | C] () -- C:\WINDOWS\System32\ztvunrar36.dll
[2012/06/21 16:55:22 | 000,077,312 | ---- | C] () -- C:\WINDOWS\System32\ztvunace26.dll
[2012/06/21 16:55:22 | 000,075,264 | ---- | C] () -- C:\WINDOWS\System32\unacev2.dll
[2012/06/21 16:55:21 | 000,153,088 | ---- | C] () -- C:\WINDOWS\System32\UNRAR3.dll
[2012/06/20 21:45:47 | 000,000,226 | ---- | C] () -- C:\Documents and Settings\Command Central\My Documents\avg.reg
[2012/06/20 09:07:12 | 000,033,758 | ---- | C] () -- C:\Documents and Settings\Command Central\Local Settings\Application Data\dt.dat
[2012/06/20 00:15:42 | 000,000,306 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-135449575-224621903-1653462319-1005.job
[2012/06/20 00:15:42 | 000,000,298 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-135449575-224621903-1653462319-1005.job
[2012/02/16 00:50:11 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/12/25 04:52:40 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/09/27 11:24:50 | 000,012,984 | ---- | C] () -- C:\WINDOWS\System32\drivers\SWDUMon.sys
[2011/09/24 16:38:10 | 000,161,728 | ---- | C] () -- C:\Program Files\gcres.dll
[2011/07/07 18:39:15 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Command Central\Application Data\wklnhst.dat
[2010/07/17 12:11:23 | 000,514,726 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\phn.dat
[2010/07/15 18:14:27 | 000,000,064 | ---- | C] () -- C:\WINDOWS\GPlrLanc.dat

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\WINDOWS\System32\unrar.exe:SummaryInformation
< End of report >


----------



## Ried

Download The Avenger2 by SwanDog46 and save it to your flashdrive.

Open Notepad and copy/paste the text in the quotebox below into Notepad and save it to your flash drive. Name it something like Avenger script.



> Folders to delete:
> C:\program Files\Avira
> C:\Documents and Settings\All Users\Application Data\Avira
> 
> Drivers to disable:
> ssmdrv
> avipbb
> avgntflt


Insert your flash drive into this XP machine, then open that Notepad you just saved, click Edit>Select All>Copy 

Now, double click the Avenger.zip and extract all files. Open the Avenger folder and start The Avenger program by clicking on its icon.

 Right click on the window under *Input script here:*, and select Paste.
 You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V]), or click on the third button under the menu to paste it from the clipboard.
 Click on *Execute*
 Answer "*Yes*" twice when prompted.
4. *The Avenger will automatically do the following*:
It will *Restart your computer*. ( In cases where the code to execute contains "*Drivers to Delete*" or "*Drivers to Disable*", The Avenger will actually *restart your system twice.*)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. **This log file will be located at***C:\avenger.txt*
 The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to *C:\avenger\backup.zip*.
5. Please post the content of *c:\avenger.txt* into your reply


----------



## jenn_needs_help

Logfile of The Avenger Version 2.0, (c) by Swandog46
Swandog46's Public Anti-Malware Tools
Platform: Windows XP
*******************
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
Rootkit scan active.
No rootkits found!
Folder "C:\program Files\Avira" deleted successfully.
Folder "C:\Documents and Settings\All Users\Application Data\Avira" deleted successfully.
Driver "ssmdrv" disabled successfully.
Driver "avipbb" disabled successfully.
Driver "avgntflt" disabled successfully.
Completed script processing.
*******************
Finished! Terminate.


----------



## Ried

It appears to have been successful. Please run a new scan with dds.scr and post only the dds.txt


----------



## jenn_needs_help

.
DDS (Ver_2011-08-26.01) - NTFSx86 
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_31
Run by Command Central at 15:05:43 on 2012-07-13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.895.479 [GMT -5:00]
.
AV: Avira Desktop *Disabled/Outdated* {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE}
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\FixBee\FBDefragSrv.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Google\Update\GoogleUpdate.exe
c:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Motorola\MotoConnectService\MotoConnectService.exe
C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe
C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
C:\Program Files\Motorola\MotoConnectService\MotoConnect.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\program files\real\realplayer\update\realsched.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=0&o=xph&d=1209&m=aspire_r1600
uSearchURL,(Default) = hxxp://my.netzero.net/s/search?r=minisearch
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [EgisTecLiveUpdate] "c:\program files\egistec egis software update\EgisUpdate.exe"
mRun: [mwlDaemon] c:\program files\egistec\mywinlocker 3\x86\mwlDaemon.exe
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [RemoteControl8] "c:\program files\cyberlink\powerdvd8\PDVD8Serv.exe"
mRun: [PDVD8LanguageShortcut] "c:\program files\cyberlink\powerdvd8\language\Language.exe"
mRun: [LGODDFU] "c:\program files\lg_fwupdate\fwupdate.exe" blrun
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
LSP: %SYSTEMROOT%\system32\nvLsp.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
============= SERVICES / DRIVERS ===============
.
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2012-7-5 353688]
R1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\drivers\mwlPSDFilter.sys [2008-12-4 17840]
R1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\drivers\mwlPSDNserv.sys [2008-12-4 15280]
R1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\drivers\mwlPSDVDisk.sys [2008-12-4 58800]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2012-7-5 21256]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2012-7-5 44808]
R2 FBDiskOptimizer;FBDiskOptimizer;c:\program files\fixbee\FBDefragSrv.exe [2012-3-25 608568]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2009-12-30 10384]
R2 MotoConnect Service;MotoConnect Service;c:\program files\motorola\motoconnectservice\MotoConnectService.exe [2011-7-2 91392]
R2 MWLService;MyWinLocker Service;c:\program files\egistec\mywinlocker 3\x86\MWLService.exe [2009-5-15 305448]
R3 acfva;acfva;c:\windows\system32\drivers\ACFVA32.sys [2009-12-30 86656]
R3 dgcfltr;DGC Filter Driver;c:\windows\system32\drivers\ACFDCP32.sys [2009-12-30 28928]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [2009-8-12 46752]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2012-7-5 721000]
S2 AntiVirService;Avira Realtime Protection;"c:\program files\avira\antivir desktop\avguard.exe" --> c:\program files\avira\antivir desktop\avguard.exe [?]
S2 gupdate1ca97438fe2dfb6;Google Update Service (gupdate1ca97438fe2dfb6);c:\program files\google\update\GoogleUpdate.exe [2010-1-17 133104]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-17 257696]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2012-1-3 1684736]
S3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\drivers\motfilt.sys [2011-7-2 6016]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-1-17 133104]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2011-7-2 19712]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2011-7-2 8320]
S3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\drivers\Motousbnet.sys [2011-7-2 24960]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2011-7-2 23936]
S3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\drivers\motusbdevice.sys [2011-7-2 6656]
S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [2010-7-8 20480]
S3 NWUSBModem_000;Novatel Wireless USB Modem Driver (vGEN);c:\windows\system32\drivers\nwusbmdm_000.sys [2010-7-8 176384]
S3 NWUSBPort_000;Novatel Wireless USB Status Port Driver (vGEN);c:\windows\system32\drivers\nwusbser_000.sys [2010-7-8 176384]
S3 NWUSBPort2_000;Novatel Wireless USB Status2 Port Driver (vGEN);c:\windows\system32\drivers\nwusbser2_000.sys [2010-7-8 176384]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\verizo~1\vzacce~1\SMSIVZAM5.SYS [2010-4-14 32408]
S3 SWDUMon;SWDUMon;c:\windows\system32\drivers\SWDUMon.sys [2011-9-27 12984]
S3 WLAN(WLAN);XPC 802.11b/g Wireless Kit Driver(WLAN);c:\windows\system32\drivers\ZD1211U.sys [2005-8-16 278016]
S4 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2012-6-20 83392]
.
=============== Created Last 30 ================
.
2012-07-12 14:24:10 -------- d-----w- c:\program files\Unlocker
2012-07-12 03:23:26 85504 ----a-w- c:\program files\Inherit.exe
2012-07-10 18:46:57 -------- d-sha-r- C:\cmdcons
2012-07-10 18:26:54 98816 ----a-w- c:\windows\sed.exe
2012-07-10 18:26:54 518144 ----a-w- c:\windows\SWREG.exe
2012-07-10 18:26:54 256000 ----a-w- c:\windows\PEV.exe
2012-07-10 18:26:54 208896 ----a-w- c:\windows\MBR.exe
2012-07-09 04:51:25 -------- d-----w- c:\documents and settings\command central\local settings\application data\VS Revo Group
2012-07-09 04:47:19 -------- d-----w- c:\program files\VS Revo Group
2012-07-06 03:59:30 -------- d-----w- c:\program files\ISO Image Burner
2012-07-05 19:06:46 721000 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-07-05 18:59:49 41224 ----a-w- c:\windows\avastSS.scr
2012-07-05 18:59:13 -------- d-----w- c:\documents and settings\all users\application data\AVAST Software
2012-06-24 17:42:12 477240 ----a-w- c:\windows\system32\drivers\sptd.sys
2012-06-21 21:55:22 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2012-06-21 21:55:22 77072 ----a-w- c:\windows\system32\ztvcabinet.dll
2012-06-21 21:55:22 75264 ----a-w- c:\windows\system32\unacev2.dll
2012-06-21 21:55:22 605968 ----a-w- c:\windows\system32\ztv7z.dll
2012-06-21 21:55:22 185616 ----a-w- c:\windows\system32\ztvunrar39.dll
2012-06-21 21:55:22 169744 ----a-w- c:\windows\system32\ztvunrar36.dll
2012-06-21 21:55:21 153088 ----a-w- c:\windows\system32\UNRAR3.dll
2012-06-21 21:55:19 -------- d-----w- c:\program files\Trojan Remover
2012-06-21 21:55:19 -------- d-----w- c:\documents and settings\all users\application data\Simply Super Software
2012-06-21 20:37:29 -------- d-----w- C:\20af6fb5af208c49bb
2012-06-21 19:50:15 -------- d-----w- C:\a45643d481b40159eb295c1744
2012-06-21 18:49:10 -------- d-----w- C:\97dd2c3269bd91880f644a13268fb008
2012-06-21 17:48:28 -------- d-----w- c:\program files\SpeedMaxPc
2012-06-21 17:48:28 -------- d-----w- c:\documents and settings\all users\application data\SpeedMaxPc
2012-06-21 17:47:46 -------- d-----w- C:\075e0d2bcea1f3f9b8f385885c0bb571
2012-06-21 17:08:57 -------- d-----w- C:\7c09594d0b144ab19fad4eea95
2012-06-20 16:28:12 83392 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-06-20 16:28:12 36000 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-06-16 12:53:23 521728 -c----w- c:\windows\system32\dllcache\jsdbgui.dll
.
==================== Find3M ====================
.
2012-05-31 13:22:09 599040 ----a-w- c:\windows\system32\crypt32.dll
2012-05-16 15:08:26 916992 ----a-w- c:\windows\system32\wininet.dll
2012-05-15 13:20:33 1863168 ----a-w- c:\windows\system32\win32k.sys
2012-05-11 14:42:33 43520 ------w- c:\windows\system32\licmgr10.dll
2012-05-11 14:42:33 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-05-11 11:38:02 385024 ------w- c:\windows\system32\html.iec
2012-05-06 03:33:24 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-06 03:33:24 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-04 13:16:13 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-04 12:32:19 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-02 13:46:36 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-04-16 19:55:33 73728 ----a-w- c:\windows\system32\javacpl.cpl
2012-04-16 19:55:33 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-09-13 03:43:23 161728 ----a-w- c:\program files\gcres.dll
2010-02-17 11:59:34 203776 -csha-w- c:\windows\system32\unrar.exe
.
============= FINISH: 15:09:33.93 ===============


----------



## Ried

Open *notepad* and copy/paste the text in the code box below into it:



> Driver::
> ssmdrv
> avipbb
> avgntflt
> AntiVirService
> File::
> C:\WINDOWS\System32\drivers\ssmdrv.sys
> C:\WINDOWS\System32\drivers\avkmgr.sys
> C:\WINDOWS\System32\drivers\avipbb.sys
> C:\WINDOWS\System32\drivers\avgntflt.sys
> SecCenter::
> AV: Avira Desktop *Disabled/Outdated* {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE}


Save this as *"CFScript.txt"*, and as Type: All Files (*.*)
in the same location as ComboFix.exe

***************************************************

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

***************************************************












Refering to the picture above, drag CFScript into ComboFix.exe


When finished, it shall produce a log for you. Post the *C:\ComboFix.txt in* your next reply.

Do you have internet back now?


----------



## jenn_needs_help

IE is still closing on me when i open it. but i right clicked it and chose open without add-ons and it opened. but it still wouldnt let me browse webpages.


----------



## Ried

I did see mywebsearch in your add-ons and that is likely part of the problem. It's in FireFox as well, althoug that doesn't explain why you couldn't browse the internet.

Click Start>Run and type the following into the Run box and click OK:

*cmd.exe*

In the black box, type the following lines, one at a time, and press Enter:

*netsh_int_ip_reset_reset.log*

*netsh_winsock_reset_catalog*

(Note -- I've place a red underscore *_* where there should be a space in your command. Do not type the underscore, just press the space bar)

============================

Reboot the machine. Run IE without Add-ons, will it connect now?


----------



## jenn_needs_help

Yes i can browse now! awesome. you have been a big help. i dont know if it is all the way fixed but it looks like its darn close. how do i get rid of that mywebsearch thing. i am going to try to uninstall and reinstall avast now


----------



## Ried

:woot: Malwarebyte's Anti Malware may take care of that for us. If not, we'll tackle it another way. 

Download *Malwarebytes' Anti-Malware* to your desktop.


Double-click *mbam-setup.exe* and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to the following:
*Update Malwarebytes' Anti-Malware*
*Launch Malwarebytes' Anti-Malware*

Then click *Finish*.

If an update is found, it will download and install the latest version.
Once the program has loaded, select *Perform quick scan*, then click *Scan*.

When the scan is complete, click *OK*, then *Show Results* to view the results.
Be sure that everything is checked, and click *Remove Selected*.

When completed, a log will open in Notepad. Save it to your desktop. Malwarebytes' Anti-Malware may require a reboot to complete removals. After a reboot, if required, post that saved log in your next reply.


----------



## jenn_needs_help

Malwarebytes Anti-Malware (Trial) 1.62.0.1300
www.malwarebytes.org
Database version: v2012.07.14.01
Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Command Central :: JOHNNY [administrator]
Protection: Enabled
7/14/2012 12:45:27 AM
mbam-log-2012-07-14 (00-45-27).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 231712
Time elapsed: 18 minute(s), 45 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 17
HKCR\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\Typelib\{D518921A-4A03-425E-9873-B9A71756821E} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\Typelib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\Interface\{3E1656ED-F60E-4597-B6AA-B6A58E171495} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\Typelib\{F42228FB-E84E-479E-B922-FBBD096E792C} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA} (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{65bcd620-07dd-012f-819f-073cf1b8f7c6} (Adware.GamePlayLab) -> Quarantined and deleted successfully.
HKCR\MyWebSearch.SkinLauncher (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\MyWebSearch.SkinLauncher.1 (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\MyWebSearch.SkinLauncherSettings (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\MyWebSearch.SkinLauncherSettings.1 (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\MyWebSearch.ThirdPartyInstaller (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\MyWebSearch.ThirdPartyInstaller.1 (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Fun Web Products (PUP.MyWebSearch) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\CROSSRIDER (Adware.GamePlayLab) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (PUP.MyWebSearch) -> Quarantined and deleted successfully.
Registry Values Detected: 2
HKCU\Software\Crossrider|215AppVerifier (Adware.GamePlayLab) -> Data: e18fc386fc36bc86c7072dbe67918600 -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources|f3PopularScreensavers (PUP.MyWebSearch) -> Data: C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL -> Quarantined and deleted successfully.
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 3
C:\Program Files\gcres.dll (PUP.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\gcres.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sl666124295 (Trojan.Tracur) -> Quarantined and deleted successfully.
(end)


----------



## Ried

Can you run IE with Add-ons enabled now?


----------



## jenn_needs_help

Yes i can. but it freezes up quite a bit.


----------



## Ried

Ok, run a new scan with OTL.exe and post the log for me.


----------



## jenn_needs_help

OTL logfile created on: 7/14/2012 11:27:33 AM - Run 3
OTL by OldTimer - Version 3.2.53.1 Folder = E:\
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

895.10 Mb Total Physical Memory | 194.57 Mb Available Physical Memory | 21.74% Memory free
2.12 Gb Paging File | 1.34 Gb Available in Paging File | 63.20% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 134.05 Gb Total Space | 110.40 Gb Free Space | 82.36% Space Free | Partition Type: NTFS
Drive E: | 7.46 Gb Total Space | 7.32 Gb Free Space | 98.07% Space Free | Partition Type: FAT32
Drive F: | 62.21 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: JOHNNY | User Name: Command Central | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/07/09 20:31:28 | 000,595,968 | ---- | M] (OldTimer Tools) -- E:\OTL.exe
PRC - [2012/07/03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/07/03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/07/03 11:21:30 | 004,273,976 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2012/07/03 11:21:29 | 000,044,808 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2012/07/03 11:21:27 | 000,133,912 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\afwServ.exe
PRC - [2012/05/28 23:03:13 | 000,296,056 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe
PRC - [2011/08/11 20:02:58 | 000,608,568 | ---- | M] (FixBee., (www.fixbee.com)) -- C:\Program Files\FixBee\FBDefragSrv.exe
PRC - [2010/12/09 13:40:04 | 003,826,968 | ---- | M] (Smith Micro Software, Inc.) -- C:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe
PRC - [2009/11/25 14:20:02 | 000,091,392 | ---- | M] () -- C:\Program Files\Motorola\MotoConnectService\MotoConnectService.exe
PRC - [2009/11/25 14:19:58 | 000,277,760 | ---- | M] (Motorola) -- C:\Program Files\Motorola\MotoConnectService\MotoConnect.exe
PRC - [2009/05/26 18:49:12 | 000,813,584 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPoint\SetPoint.exe
PRC - [2009/05/22 13:33:00 | 000,055,824 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
PRC - [2009/05/15 01:03:46 | 000,345,384 | ---- | M] (Egis Technology Inc.) -- C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
PRC - [2009/05/15 01:03:30 | 000,305,448 | ---- | M] (Egis Technology Inc.) -- C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe
PRC - [2009/05/13 21:39:42 | 000,199,464 | ---- | M] (Egis Technology Inc.) -- C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe
PRC - [2008/12/18 14:05:40 | 000,457,248 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
PRC - [2008/12/18 14:05:40 | 000,191,008 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
PRC - [2008/10/17 13:44:58 | 000,091,432 | ---- | M] (CyberLink Corp.) -- C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
PRC - [2008/04/14 07:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/02/26 11:40:26 | 000,249,856 | ---- | M] (BL) -- C:\Program Files\lg_fwupdate\fwupdate.exe


========== Modules (No Company Name) ==========

MOD - [2012/07/14 06:19:49 | 001,783,296 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\12071401\algo.dll
MOD - [2009/11/25 14:20:02 | 000,091,392 | ---- | M] () -- C:\Program Files\Motorola\MotoConnectService\MotoConnectService.exe
MOD - [2009/05/26 18:45:36 | 000,017,936 | ---- | M] () -- C:\Program Files\Logitech\SetPoint\khalwrapper.dll
MOD - [2008/12/18 14:05:40 | 000,457,248 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
MOD - [2008/12/18 14:05:40 | 000,191,008 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
MOD - [2008/12/18 14:04:44 | 000,109,088 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nv_common.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
SRV - File not found [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012/07/13 21:37:58 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/07/03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/07/03 11:21:29 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2012/07/03 11:21:27 | 000,133,912 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\afwServ.exe -- (avast! Firewall)
SRV - [2011/08/11 20:02:58 | 000,608,568 | ---- | M] (FixBee., (www.fixbee.com)) [Auto | Running] -- C:\Program Files\FixBee\FBDefragSrv.exe -- (FBDiskOptimizer)
SRV - [2009/11/25 14:20:02 | 000,091,392 | ---- | M] () [Auto | Running] -- C:\Program Files\Motorola\MotoConnectService\MotoConnectService.exe -- (MotoConnect Service)
SRV - [2009/05/26 18:46:32 | 000,121,360 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2009/05/15 01:03:30 | 000,305,448 | ---- | M] () [Auto | Running] -- C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe -- (MWLService)
SRV - [2008/12/18 14:05:40 | 000,457,248 | ---- | M] () [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM)
SRV - [2008/12/18 14:05:40 | 000,191,008 | ---- | M] () [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe -- (nSvcIp)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - [2012/07/03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012/07/03 11:21:54 | 000,054,232 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2012/07/03 11:21:53 | 000,721,000 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2012/07/03 11:21:53 | 000,353,688 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2012/07/03 11:21:53 | 000,202,928 | ---- | M] (AVAST Software) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\aswNdis2.sys -- (aswNdis2)
DRV - [2012/07/03 11:21:53 | 000,097,608 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2012/07/03 11:21:53 | 000,035,928 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (AswRdr)
DRV - [2012/07/03 11:21:53 | 000,021,256 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2012/07/03 11:21:53 | 000,018,544 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswKbd.sys -- (aswKbd)
DRV - [2012/07/03 11:21:52 | 000,113,776 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswFW.sys -- (aswFW)
DRV - [2012/07/03 11:21:52 | 000,025,256 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2012/06/27 15:33:54 | 000,012,112 | ---- | M] (ALWIL Software) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\aswNdis.sys -- (aswNdis)
DRV - [2012/06/24 12:42:12 | 000,477,240 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2012/06/20 11:24:05 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2012/06/20 11:24:01 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2012/06/20 11:23:59 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011/09/27 11:24:50 | 000,012,984 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SWDUMon.sys -- (SWDUMon)
DRV - [2010/07/08 10:52:32 | 000,231,424 | ---- | M] (Novatel Wireless Inc) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NWADIenum.sys -- (NWADI)
DRV - [2010/07/08 10:52:32 | 000,176,384 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nwusbser2_000.sys -- (NWUSBPort2_000) Novatel Wireless USB Status2 Port Driver (vGEN)
DRV - [2010/07/08 10:52:32 | 000,176,384 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nwusbser_000.sys -- (NWUSBPort_000) Novatel Wireless USB Status Port Driver (vGEN)
DRV - [2010/07/08 10:52:32 | 000,176,384 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nwusbmdm_000.sys -- (NWUSBModem_000) Novatel Wireless USB Modem Driver (vGEN)
DRV - [2010/07/08 10:52:32 | 000,020,480 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\NwUsbCdFil.sys -- (NWUSBCDFIL)
DRV - [2010/07/04 14:51:26 | 000,004,096 | ---- | M] () [Kernel | Unavailable | Unknown] -- C:\Program Files\Unlocker\UnlockerDriver5.sys -- (UnlockerDriver5)
DRV - [2010/04/14 20:29:22 | 000,032,408 | ---- | M] (Smith Micro Inc.) [Kernel | On_Demand | Running] -- C:\Program Files\Verizon Wireless\VZAccess Manager\SMSIVZAM5.sys -- (SMSIVZAM5)
DRV - [2009/10/27 12:06:04 | 000,024,960 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Motousbnet.sys -- (Motousbnet)
DRV - [2009/10/27 12:02:14 | 000,023,936 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motport.sys -- (motport)
DRV - [2009/10/27 12:02:14 | 000,023,936 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motmodem.sys -- (motmodem)
DRV - [2009/06/19 16:59:34 | 000,019,712 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motccgp.sys -- (motccgp)
DRV - [2009/05/22 10:37:50 | 005,082,624 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2009/05/06 19:16:26 | 000,006,656 | ---- | M] (Motorola Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motusbdevice.sys -- (motusbdevice)
DRV - [2009/04/22 18:13:36 | 000,037,392 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2009/04/22 18:13:28 | 000,035,600 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2009/02/04 13:08:52 | 000,010,384 | ---- | M] (Logitech, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\LBeepKE.sys -- (LBeepKE)
DRV - [2009/01/29 17:18:00 | 000,008,320 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motccgpfl.sys -- (motccgpfl)
DRV - [2009/01/29 17:11:20 | 000,006,016 | ---- | M] (Motorola Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motfilt.sys -- (BTCFilterService)
DRV - [2009/01/22 02:43:56 | 000,046,752 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvhda32.sys -- (NVHDA)
DRV - [2008/12/02 13:52:00 | 000,058,800 | ---- | M] (Egis Incorporated.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV - [2008/12/02 13:52:00 | 000,017,840 | ---- | M] (Egis Incorporated.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV - [2008/12/02 13:52:00 | 000,015,280 | ---- | M] (Egis Incorporated.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV - [2008/11/12 04:58:38 | 000,145,952 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\nvgts.sys -- (nvgts)
DRV - [2008/08/24 14:22:40 | 000,014,208 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2008/08/05 07:10:12 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)
DRV - [2008/07/31 22:36:26 | 000,022,016 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2008/07/31 22:36:20 | 000,054,784 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2007/11/02 15:51:30 | 000,006,400 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\motswch.sys -- (MotoSwitchService)
DRV - [2007/07/10 03:14:16 | 000,028,928 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ACFDCP32.sys -- (dgcfltr)
DRV - [2007/06/29 05:39:46 | 000,086,656 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ACFVA32.sys -- (acfva)
DRV - [2007/03/15 04:52:34 | 000,012,672 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\ACFSDK32.sys -- (mdmxsdk)
DRV - [2006/01/04 02:41:48 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)
DRV - [2005/08/16 14:50:50 | 000,278,016 | ---- | M] (ZyDAS Technology Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZD1211U.sys -- (WLAN(WLAN)) XPC 802.11b/g Wireless Kit Driver(WLAN)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD21}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = {searchTerms} - Bing?}
IE - HKLM\..\SearchScopes\{597b1823-7ff0-4cd3-8095-9d8cba514992}: "URL" = MyWebSearch}
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = {searchTerms} - Google Search
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}: "URL" = {searchTerms - Search-results Web Search}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = {searchTerms - Search-results Web Search}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2408}: "URL" = {searchTerms - Search-results Web Search}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = B3 DB C6 01 14 9F B0 43 80 B9 31 DB 98 90 47 30 [binary data]
IE - HKCU\..\URLSearchHook: {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - No CLSID value found
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {47CA48B3-155D-416A-8775-086237034BAA}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = {searchTerms} - Bing
IE - HKCU\..\SearchScopes\{0D0CF3F6-FFAE-4951-BF14-785A9C269545}: "URL" = {searchTerms} - Ask.com Search
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = Babylon Search
IE - HKCU\..\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}: "URL" = {searchTerms} - Crawler.com
IE - HKCU\..\SearchScopes\{47CA48B3-155D-416A-8775-086237034BAA}: "URL" = {searchTerms - Yahoo! Search Results}
IE - HKCU\..\SearchScopes\{597b1823-7ff0-4cd3-8095-9d8cba514992}: "URL" = MyWebSearch}
IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = {searchTerms} - Google Search
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = Search 12:10:10&v=11.0.0.9&sap=dsp&q={searchTerms}
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}: "URL" = {searchTerms - Search-results Web Search}
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = {searchTerms - Search-results Web Search}
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2408}: "URL" = {searchTerms - Search-results Web Search}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "Ask.com Search Engine - Better Web Search"
FF - prefs.js..extensions.enabledItems: {9CE11043-9A15-4207-A565-0C94C42D590D}:11.3.7.0
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: {d7ba287b-ebf1-4238-8ec9-fcaf3443b390}:1.0
FF - prefs.js..extensions.enabledItems: {4B3803EA-5230-4DC3-A7FC-33638F3D3542}:1.3
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..keyword.URL: "Yahoo! Search - Web Search="
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&ilc=12&type=937811"
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Yahoo"


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: c:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/03/19 14:59:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\MyWebSearch\bar\1.bin
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/05/28 23:04:13 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/03/19 14:59:21 | 000,000,000 | ---D | M]

[2012/04/26 18:05:24 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Extensions
[2012/05/19 13:13:44 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions
[2010/05/10 17:14:34 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012/03/26 21:11:07 | 000,000,000 | ---D | M] (Wincore Mediabar) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}
[2011/07/30 12:23:20 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/02/04 16:23:38 | 000,000,000 | ---D | M] (Wincore Mediabar) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}
[2012/07/14 11:22:45 | 000,000,000 | ---D | M] (XUL Cache) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{d7ba287b-ebf1-4238-8ec9-fcaf3443b390}
[2011/09/24 13:06:30 | 000,000,000 | ---D | M] (AVG Security Toolbar) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected](2)
[2012/03/18 05:39:44 | 000,000,000 | ---D | M] (Babylon) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected]
[2012/02/16 16:03:36 | 000,000,000 | ---D | M] (My Web Search) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected]
[2012/01/03 16:27:44 | 000,002,333 | ---- | M] () -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\searchplugins\askcom.xml
[2012/03/26 21:10:40 | 000,002,517 | ---- | M] () -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\searchplugins\Search_Results.xml

O1 HOSTS File: ([2012/07/10 22:41:30 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [EgisTecLiveUpdate] C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [LGODDFU] C:\Program Files\lg_fwupdate\fwupdate.exe (BL)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
O4 - HKLM..\Run: [mwlDaemon] C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe ()
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [RemoteControl8] C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C9A07EC2-8A3E-489C-A24C-5670482D9736}: NameServer = 69.78.235.35 69.78.96.14
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Command Central\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Command Central\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/08/12 20:00:49 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2008/08/21 10:39:48 | 000,000,074 | R--- | M] () - F:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/07/14 10:12:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Command Central\Start Menu\Programs\CyberLink PowerDVD 8
[2012/07/14 00:26:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Command Central\Application Data\Malwarebytes
[2012/07/14 00:13:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/07/14 00:13:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2012/07/14 00:13:48 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012/07/14 00:13:48 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/07/13 21:59:03 | 000,113,776 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFW.sys
[2012/07/13 21:58:39 | 000,202,928 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswNdis2.sys
[2012/07/13 21:58:39 | 000,018,544 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswKbd.sys
[2012/07/13 21:58:28 | 000,012,112 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswNdis.sys
[2012/07/13 21:47:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\avast! Internet Security
[2012/07/13 21:39:34 | 000,353,688 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2012/07/13 21:39:34 | 000,021,256 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2012/07/13 21:39:32 | 000,721,000 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2012/07/13 21:39:32 | 000,054,232 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2012/07/13 21:39:32 | 000,035,928 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2012/07/13 21:39:31 | 000,097,608 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2012/07/13 21:39:31 | 000,089,624 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2012/07/13 21:39:31 | 000,025,256 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2012/07/13 21:38:42 | 000,041,224 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2012/07/13 21:38:41 | 000,227,648 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2012/07/12 09:24:10 | 000,000,000 | ---D | C] -- C:\Program Files\Unlocker
[2012/07/12 09:24:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Command Central\Start Menu\Programs\Unlocker
[2012/07/11 09:47:29 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2012/07/10 13:46:57 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2012/07/10 13:26:54 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2012/07/10 13:26:54 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2012/07/10 13:26:54 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2012/07/10 13:26:54 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2012/07/08 23:51:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Command Central\Local Settings\Application Data\VS Revo Group
[2012/07/08 23:47:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Revo Uninstaller Pro
[2012/07/08 23:47:19 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group
[2012/07/05 22:59:30 | 000,000,000 | ---D | C] -- C:\Program Files\ISO Image Burner
[2012/07/05 22:59:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\ISO Image Burner
[2012/07/05 13:59:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2012/06/24 12:56:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2012/06/24 12:44:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Command Central\My Documents\Simply Super Software
[2012/06/24 12:42:12 | 000,477,240 | ---- | C] (Duplex Secure Ltd.) -- C:\WINDOWS\System32\drivers\sptd.sys
[2012/06/21 17:56:00 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/06/21 17:55:44 | 000,000,000 | ---D | C] -- C:\WINDOWS\erdnt
[2012/06/21 16:55:22 | 000,605,968 | ---- | C] (Igor Pavlov) -- C:\WINDOWS\System32\ztv7z.dll
[2012/06/21 16:55:22 | 000,077,072 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ztvcabinet.dll
[2012/06/21 16:55:19 | 000,000,000 | ---D | C] -- C:\Program Files\Trojan Remover
[2012/06/21 16:55:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Simply Super Software
[2012/06/21 15:37:29 | 000,000,000 | ---D | C] -- C:\20af6fb5af208c49bb
[2012/06/21 14:50:15 | 000,000,000 | ---D | C] -- C:\a45643d481b40159eb295c1744
[2012/06/21 13:49:10 | 000,000,000 | ---D | C] -- C:\97dd2c3269bd91880f644a13268fb008
[2012/06/21 12:48:28 | 000,000,000 | ---D | C] -- C:\Program Files\SpeedMaxPc
[2012/06/21 12:47:46 | 000,000,000 | ---D | C] -- C:\075e0d2bcea1f3f9b8f385885c0bb571
[2012/06/21 12:08:57 | 000,000,000 | ---D | C] -- C:\7c09594d0b144ab19fad4eea95
[2012/06/20 11:28:13 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2012/06/20 11:28:12 | 000,137,928 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2012/06/20 11:28:12 | 000,083,392 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2012/06/20 11:28:12 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avkmgr.sys
[2012/06/16 07:53:23 | 000,521,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\jsdbgui.dll
[41 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/07/14 11:45:47 | 000,000,442 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{7A2BE865-5DA3-44CC-A762-3D5D0312B742}.job
[2012/07/14 11:32:01 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/07/14 11:26:02 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/07/14 10:15:58 | 000,434,494 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/07/14 10:15:57 | 000,068,588 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/07/14 10:15:53 | 000,000,414 | ---- | M] () -- C:\WINDOWS\tasks\ProgramUpdateCheck.job
[2012/07/14 10:13:27 | 000,000,316 | -H-- | M] () -- C:\WINDOWS\tasks\avast! Emergency Update.job
[2012/07/14 10:12:39 | 000,000,298 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-135449575-224621903-1653462319-1005.job
[2012/07/14 10:12:03 | 000,000,265 | ---- | M] () -- C:\WINDOWS\lgfwup.ini
[2012/07/14 10:11:54 | 000,234,676 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml
[2012/07/14 10:11:45 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/07/14 10:11:31 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/07/14 10:11:25 | 938,655,744 | -HS- | M] () -- C:\hiberfil.sys
[2012/07/14 10:11:25 | 000,249,496 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012/07/14 08:09:30 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012/07/14 00:34:27 | 000,000,788 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/13 21:58:38 | 000,002,625 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2012/07/13 21:47:10 | 000,001,693 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Internet Security.lnk
[2012/07/13 21:37:56 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/07/13 21:37:56 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/07/11 22:20:16 | 000,085,504 | ---- | M] () -- C:\Program Files\Inherit.exe
[2012/07/11 00:15:02 | 000,000,306 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-135449575-224621903-1653462319-1005.job
[2012/07/10 22:41:30 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2012/07/10 13:47:03 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2012/07/09 23:49:00 | 000,000,188 | ---- | M] () -- C:\Documents and Settings\Command Central\Desktop\avirastop.bat
[2012/07/08 23:47:23 | 000,000,947 | ---- | M] () -- C:\Documents and Settings\Command Central\Application Data\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
[2012/07/08 23:47:23 | 000,000,929 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Revo Uninstaller Pro.lnk
[2012/07/08 23:06:12 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/07/05 22:59:30 | 000,000,704 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\ISO Image Burner.lnk
[2012/07/03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012/07/03 11:21:54 | 000,054,232 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2012/07/03 11:21:53 | 000,721,000 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2012/07/03 11:21:53 | 000,353,688 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2012/07/03 11:21:53 | 000,202,928 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswNdis2.sys
[2012/07/03 11:21:53 | 000,097,608 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2012/07/03 11:21:53 | 000,089,624 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2012/07/03 11:21:53 | 000,035,928 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2012/07/03 11:21:53 | 000,021,256 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2012/07/03 11:21:53 | 000,018,544 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswKbd.sys
[2012/07/03 11:21:52 | 000,113,776 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFW.sys
[2012/07/03 11:21:52 | 000,025,256 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2012/07/03 11:21:32 | 000,041,224 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2012/07/03 11:21:28 | 000,227,648 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2012/06/27 15:33:54 | 000,012,112 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswNdis.sys
[2012/06/20 21:45:47 | 000,000,226 | ---- | M] () -- C:\Documents and Settings\Command Central\My Documents\avg.reg
[2012/06/20 12:47:12 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2012/06/20 11:24:05 | 000,028,520 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2012/06/20 11:24:04 | 000,036,000 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avkmgr.sys
[2012/06/20 11:24:01 | 000,137,928 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2012/06/20 11:23:59 | 000,083,392 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2012/06/20 09:07:12 | 000,033,758 | ---- | M] () -- C:\Documents and Settings\Command Central\Local Settings\Application Data\dt.dat
[2012/06/15 16:39:36 | 000,169,744 | ---- | M] () -- C:\WINDOWS\System32\ztvunrar36.dll
[2012/06/15 16:35:32 | 000,185,616 | ---- | M] () -- C:\WINDOWS\System32\ztvunrar39.dll
[2012/06/15 16:33:54 | 000,605,968 | ---- | M] (Igor Pavlov) -- C:\WINDOWS\System32\ztv7z.dll
[2012/06/15 16:33:32 | 000,077,072 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\ztvcabinet.dll
[41 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/07/14 00:13:58 | 000,000,788 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/07/13 21:47:10 | 000,001,693 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Internet Security.lnk
[2012/07/13 21:39:32 | 000,000,316 | -H-- | C] () -- C:\WINDOWS\tasks\avast! Emergency Update.job
[2012/07/12 21:22:15 | 000,000,188 | ---- | C] () -- C:\Documents and Settings\Command Central\Desktop\avirastop.bat
[2012/07/11 22:23:26 | 000,085,504 | ---- | C] () -- C:\Program Files\Inherit.exe
[2012/07/10 13:47:03 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2012/07/10 13:47:00 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2012/07/10 13:26:54 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012/07/10 13:26:54 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012/07/10 13:26:54 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012/07/10 13:26:54 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012/07/10 13:26:54 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012/07/08 23:47:23 | 000,000,947 | ---- | C] () -- C:\Documents and Settings\Command Central\Application Data\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
[2012/07/08 23:47:23 | 000,000,929 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Revo Uninstaller Pro.lnk
[2012/07/05 22:59:30 | 000,000,704 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\ISO Image Burner.lnk
[2012/06/21 16:55:22 | 000,185,616 | ---- | C] () -- C:\WINDOWS\System32\ztvunrar39.dll
[2012/06/21 16:55:22 | 000,169,744 | ---- | C] () -- C:\WINDOWS\System32\ztvunrar36.dll
[2012/06/21 16:55:22 | 000,077,312 | ---- | C] () -- C:\WINDOWS\System32\ztvunace26.dll
[2012/06/21 16:55:22 | 000,075,264 | ---- | C] () -- C:\WINDOWS\System32\unacev2.dll
[2012/06/21 16:55:21 | 000,153,088 | ---- | C] () -- C:\WINDOWS\System32\UNRAR3.dll
[2012/06/20 21:45:47 | 000,000,226 | ---- | C] () -- C:\Documents and Settings\Command Central\My Documents\avg.reg
[2012/06/20 09:07:12 | 000,033,758 | ---- | C] () -- C:\Documents and Settings\Command Central\Local Settings\Application Data\dt.dat
[2012/06/20 00:15:42 | 000,000,306 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-135449575-224621903-1653462319-1005.job
[2012/06/20 00:15:42 | 000,000,298 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-135449575-224621903-1653462319-1005.job
[2012/02/16 00:50:11 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/12/25 04:52:40 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/09/27 11:24:50 | 000,012,984 | ---- | C] () -- C:\WINDOWS\System32\drivers\SWDUMon.sys
[2011/07/07 18:39:15 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Command Central\Application Data\wklnhst.dat
[2010/07/17 12:11:23 | 000,514,726 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\phn.dat
[2010/07/15 18:14:27 | 000,000,064 | ---- | C] () -- C:\WINDOWS\GPlrLanc.dat

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\WINDOWS\System32\unrar.exe:SummaryInformation
< End of report >


----------



## Ried

Double click OTL.exe to start the tool.

Under the *Custom Scans/Fixes *box at the bottom, copy/paste in the following



> tl
> IE - HKLM\..\SearchScopes\{597b1823-7ff0-4cd3-8095-9d8cba514992}: "URL" = MyWebSearch}
> IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}: "URL" = {searchTerms - Search-results Web Search}
> IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = {searchTerms - Search-results Web Search}
> IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2408}: "URL" = {searchTerms - Search-results Web Search}
> IE - HKCU\..\SearchScopes\{0D0CF3F6-FFAE-4951-BF14-785A9C269545}: "URL" = {searchTerms} - Ask.com Search
> IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = Babylon Search
> IE - HKCU\..\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}: "URL" = {searchTerms} - Crawler.com
> IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = Search 12:10:10&v=11.0.0.9&sap=dsp&q={searchTerms}
> IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}: "URL" = {searchTerms - Search-results Web Search}
> IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = {searchTerms - Search-results Web Search}
> IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2408}: "URL" = {searchTerms - Search-results Web Search}
> FF - prefs.js..browser.startup.homepage: "Ask.com Search Engine - Better Web Search"
> FF - prefs.js..extensions.enabledItems: {9CE11043-9A15-4207-A565-0C94C42D590D}:11.3.7.0
> FF - prefs.js..extensions.enabledItems: {d7ba287b-ebf1-4238-8ec9-fcaf3443b390}:1.0
> FF - prefs.js..extensions.enabledItems: {4B3803EA-5230-4DC3-A7FC-33638F3D3542}:1.3
> FF - prefs.js..browser.search.defaultengine: "Ask.com"
> FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\MyWebSearch\bar\1.bin
> [2012/03/26 21:11:07 | 000,000,000 | ---D | M] (Wincore Mediabar) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}
> [2012/02/04 16:23:38 | 000,000,000 | ---D | M] (Wincore Mediabar) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}
> [2012/07/14 11:22:45 | 000,000,000 | ---D | M] (XUL Cache) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{d7ba287b-ebf1-4238-8ec9-fcaf3443b390}
> [2011/09/24 1330 | 000,000,000 | ---D | M] (AVG Security Toolbar) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected](2)
> [2012/03/18 05:39:44 | 000,000,000 | ---D | M] (Babylon) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected]
> [2012/02/16 16:03:36 | 000,000,000 | ---D | M] (My Web Search) -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected]
> [2012/01/03 16:27:44 | 000,002,333 | ---- | M] () -- C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\searchplugins\askcom.xml
> 
> :files
> C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}
> C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{d7ba287b-ebf1-4238-8ec9-fcaf3443b390}
> C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected](2)
> C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected]
> C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected]
> C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\searchplugins\askcom.xml
> C:\Program Files\MyWebSearch


Click the *Run Fix *button at the top

Let the program run and when it has completed, you will see a message "Fix Complete press ok to open the log"

Please post that log in your next reply. Any improvement?

Also - I need to see the log from that last run of ComboFix. You'll find the most recent log at C:\ComboFix.txt


----------



## jenn_needs_help

========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{597b1823-7ff0-4cd3-8095-9d8cba514992}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{597b1823-7ff0-4cd3-8095-9d8cba514992}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2408}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2408}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0D0CF3F6-FFAE-4951-BF14-785A9C269545}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D0CF3F6-FFAE-4951-BF14-785A9C269545}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2408}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2408}\ not found.
Prefs.js: "Ask.com Search Engine - Better Web Search" removed from browser.startup.homepage
Prefs.js: {9CE11043-9A15-4207-A565-0C94C42D590D}:11.3.7.0 removed from extensions.enabledItems
Prefs.js: {d7ba287b-ebf1-4238-8ec9-fcaf3443b390}:1.0 removed from extensions.enabledItems
Prefs.js: {4B3803EA-5230-4DC3-A7FC-33638F3D3542}:1.3 removed from extensions.enabledItems
Prefs.js: "Ask.com" removed from browser.search.defaultengine
File HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\MyWebSearch\bar\1.bin not found.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\components folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\skin\searchbar folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\skin\options folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\skin\lib\weatherbutton\panels\images folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\skin\lib\weatherbutton\panels folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\skin\lib\weatherbutton\icons folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\skin\lib\weatherbutton folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\skin\lib\uwa folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\skin\lib\radio\images folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\skin\lib\radio\css folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\skin\lib\radio folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\skin\lib\panels\images folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\skin\lib\panels\default\scripts folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\skin\lib\panels\default\images folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\skin\lib\panels\default\css folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\skin\lib\panels\default folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\skin\lib\panels\css folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\skin\lib\panels folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\skin\lib folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\skin folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\content\widgets\com.djboxservice.dj.DJBox\thumbs folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\content\widgets\com.djboxservice.dj.DJBox folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\content\widgets folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\content\modules folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\content\lib folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\content\data\search folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\content\data folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome\content folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}\chrome folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0} folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\components folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\skin\searchbar folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\skin\options folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\skin\lib\weatherbutton\panels\images folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\skin\lib\weatherbutton\panels folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\skin\lib\weatherbutton\icons folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\skin\lib\weatherbutton folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\skin\lib\uwa folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\skin\lib\radio\images folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\skin\lib\radio\css folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\skin\lib\radio folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\skin\lib\panels\images folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\skin\lib\panels\default\scripts folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\skin\lib\panels\default\images folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\skin\lib\panels\default\css folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\skin\lib\panels\default folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\skin\lib\panels\css folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\skin\lib\panels folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\skin\lib folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\skin folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\content\widgets\com.djboxservice.dj.DJBox\thumbs folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\content\widgets\com.djboxservice.dj.DJBox folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\content\widgets folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\content\modules folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\content\lib folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\content\data\search folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\content\data folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome\content folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}\chrome folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{d7ba287b-ebf1-4238-8ec9-fcaf3443b390}\defaults\preferences folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{d7ba287b-ebf1-4238-8ec9-fcaf3443b390}\defaults folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{d7ba287b-ebf1-4238-8ec9-fcaf3443b390} folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected](2)\modules(2)\skin(2) folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected](2)\modules(2) folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected](2)\locale(2)\en-US(2) folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected](2)\locale(2) folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected](2)\components(2)\FF4(2) folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected](2)\components(2) folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected](2)\chrome(2) folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected](2) folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected]\defaults\preferences folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected]\defaults folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected]\content\imgs\flgs folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected]\content\imgs folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected]\content folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected]\components folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected] folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected]\chrome folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected] folder moved successfully.
C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\searchplugins\askcom.xml moved successfully.
========== FILES ==========
File\Folder C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0} not found.
File\Folder C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\{d7ba287b-ebf1-4238-8ec9-fcaf3443b390} not found.
File\Folder C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected](2) not found.
File\Folder C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected] not found.
File\Folder C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\extensions\[email protected] not found.
File\Folder C:\Documents and Settings\Command Central\Application Data\Mozilla\Firefox\Profiles\oc1rlg6x.default\searchplugins\askcom.xml not found.
File\Folder C:\Program Files\MyWebSearch not found.

OTL by OldTimer - Version 3.2.53.1 log created on 07142012_164048



ComboFix 12-07-10.01 - Command Central 07/10/2012 22:28:10.5.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.895.501 [GMT -5:00]
Running from: E:\ComboFix.exe
Command switches used :: E:\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Avira Desktop *Disabled/Outdated* {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE}
.
FILE ::
"c:\windows\system32\drivers\avgntflt.sys"
"c:\windows\system32\drivers\avipbb.sys"
"c:\windows\system32\drivers\avkmgr.sys"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Avira\AntiVir Desktop\avpref.dll
c:\documents and settings\All Users\Application Data\Avira . . . . Failed to delete
c:\program files\Avira . . . . Failed to delete
.
c:\windows\system32\drivers\i8042prt.sys . . . is missing!!
.
.
((((((((((((((((((((((((( Files Created from 2012-06-11 to 2012-07-11 )))))))))))))))))))))))))))))))
.
.
2012-07-09 04:51 . 2012-07-09 04:51 -------- d-----w- c:\documents and settings\Command Central\Local Settings\Application Data\VS Revo Group
2012-07-09 04:47 . 2012-07-09 04:47 -------- d-----w- c:\program files\VS Revo Group
2012-07-06 03:59 . 2012-07-06 03:59 -------- d-----w- c:\program files\ISO Image Burner
2012-07-05 23:45 . 2012-07-03 16:21 21256 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-07-05 23:43 . 2012-07-03 16:21 353688 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-07-05 19:09 . 2012-07-03 16:21 35928 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-07-05 19:09 . 2012-07-03 16:21 54232 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-07-05 19:06 . 2012-07-03 16:21 721000 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-07-05 19:05 . 2012-07-03 16:21 97608 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2012-07-05 19:05 . 2012-07-03 16:21 89624 ----a-w- c:\windows\system32\drivers\aswmon.sys
2012-07-05 19:00 . 2012-07-03 16:21 25256 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2012-07-05 18:59 . 2012-07-03 16:21 41224 ----a-w- c:\windows\avastSS.scr
2012-07-05 18:59 . 2012-07-03 16:21 227648 ----a-w- c:\windows\system32\aswBoot.exe
2012-07-05 18:59 . 2012-07-05 23:40 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software
2012-06-24 17:42 . 2012-06-24 17:42 477240 ----a-w- c:\windows\system32\drivers\sptd.sys
2012-06-21 21:55 . 2012-06-15 21:39 169744 ----a-w- c:\windows\system32\ztvunrar36.dll
2012-06-21 21:55 . 2012-06-15 21:35 185616 ----a-w- c:\windows\system32\ztvunrar39.dll
2012-06-21 21:55 . 2012-06-15 21:33 605968 ----a-w- c:\windows\system32\ztv7z.dll
2012-06-21 21:55 . 2012-06-15 21:33 77072 ----a-w- c:\windows\system32\ztvcabinet.dll
2012-06-21 21:55 . 2005-08-26 06:50 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2012-06-21 21:55 . 2002-03-06 06:00 75264 ----a-w- c:\windows\system32\unacev2.dll
2012-06-21 21:55 . 2003-02-03 01:06 153088 ----a-w- c:\windows\system32\UNRAR3.dll
2012-06-21 21:55 . 2012-06-24 17:40 -------- d-----w- c:\program files\Trojan Remover
2012-06-21 21:55 . 2012-06-21 21:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Simply Super Software
2012-06-21 20:37 . 2012-06-21 20:56 -------- d-----w- C:\20af6fb5af208c49bb
2012-06-21 19:50 . 2012-06-21 20:08 -------- d-----w- C:\a45643d481b40159eb295c1744
2012-06-21 18:49 . 2012-06-21 18:55 -------- d-----w- C:\97dd2c3269bd91880f644a13268fb008
2012-06-21 17:48 . 2012-07-09 04:59 -------- d-----w- c:\documents and settings\All Users\Application Data\SpeedMaxPc
2012-06-21 17:48 . 2012-06-21 17:48 -------- d-----w- c:\program files\SpeedMaxPc
2012-06-21 17:47 . 2012-06-21 18:03 -------- d-----w- C:\075e0d2bcea1f3f9b8f385885c0bb571
2012-06-21 17:08 . 2012-06-21 17:43 -------- d-----w- C:\7c09594d0b144ab19fad4eea95
2012-06-20 16:28 . 2012-06-20 16:24 36000 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-06-20 16:28 . 2012-06-20 16:24 137928 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-06-20 16:28 . 2012-06-20 16:23 83392 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-06-20 16:28 . 2012-07-11 00:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2012-06-20 16:28 . 2012-06-20 16:28 -------- d-----w- c:\program files\Avira
2012-06-16 12:53 . 2012-05-11 14:42 521728 -c----w- c:\windows\system32\dllcache\jsdbgui.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-31 13:22 . 2009-08-13 01:44 599040 ----a-w- c:\windows\system32\crypt32.dll
2012-05-16 15:08 . 2009-08-13 01:44 916992 ----a-w- c:\windows\system32\wininet.dll
2012-05-15 13:20 . 2009-08-13 01:44 1863168 ----a-w- c:\windows\system32\win32k.sys
2012-05-11 14:42 . 2009-08-13 01:44 43520 ------w- c:\windows\system32\licmgr10.dll
2012-05-11 14:42 . 2009-08-13 01:44 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-05-11 11:38 . 2009-08-13 01:44 385024 ------w- c:\windows\system32\html.iec
2012-05-06 03:33 . 2012-04-17 15:03 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-06 03:33 . 2012-01-02 09:32 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-04 13:16 . 2008-04-14 00:54 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-04 12:32 . 2008-04-14 00:01 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-02 13:46 . 2009-08-13 00:57 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-04-16 19:55 . 2012-04-16 19:55 73728 ----a-w- c:\windows\system32\javacpl.cpl
2012-04-16 19:55 . 2011-07-30 17:55 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-09-13 03:43 . 2011-09-24 21:38 161728 ----a-w- c:\program files\gcres.dll
2010-02-17 11:59 203776 -csha-w- c:\windows\system32\unrar.exe
.
.
((((((((((((((((((((((((((((( [email protected]_19.13.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-07-11 03:41 . 2012-07-11 03:41 16384 c:\windows\Temp\Perflib_Perfdata_138.dat
+ 2009-08-13 01:44 . 2012-07-11 02:21 68588 c:\windows\system32\perfc009.dat
- 2009-08-13 01:44 . 2012-07-10 19:16 68588 c:\windows\system32\perfc009.dat
+ 2009-08-13 01:44 . 2012-07-11 02:21 434494 c:\windows\system32\perfh009.dat
- 2009-08-13 01:44 . 2012-07-10 19:16 434494 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-07-03 16:21 121528 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-05-15 06:02 120104 ----a-w- c:\program files\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2009-05-24 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-05-24 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-05-24 13758464]
"EgisTecLiveUpdate"="c:\program files\EgisTec Egis Software Update\EgisUpdate.exe" [2009-05-14 199464]
"mwlDaemon"="c:\program files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-05-15 345384]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-10-17 91432]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"LGODDFU"="c:\program files\lg_fwupdate\fwupdate.exe" [2007-02-26 249856]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-04-22 55824]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"RTHDCPL"="RTHDCPL.EXE" [2009-05-21 17881600]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2012-05-29 296056]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-07-03 4273976]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-12-30 813584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-05-26 23:47 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\Bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
"c:\\Program Files\\File Type Assistant\\tsassist.exe"=
.
R0 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys --> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [7/5/2012 6:43 PM 353688]
R1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\drivers\mwlPSDFilter.sys [12/4/2008 8:34 PM 17840]
R1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\drivers\mwlPSDNserv.sys [12/4/2008 8:34 PM 15280]
R1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\drivers\mwlPSDVDisk.sys [12/4/2008 8:34 PM 58800]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [7/5/2012 6:45 PM 21256]
R2 FBDiskOptimizer;FBDiskOptimizer;c:\program files\FixBee\FBDefragSrv.exe [3/25/2012 4:26 PM 608568]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [12/30/2009 4:13 PM 10384]
R2 MotoConnect Service;MotoConnect Service;c:\program files\Motorola\MotoConnectService\MotoConnectService.exe [7/2/2011 12:06 PM 91392]
R2 MWLService;MyWinLocker Service;c:\program files\EgisTec\MyWinLocker 3\x86\MWLService.exe [5/15/2009 1:03 AM 305448]
R3 acfva;acfva;c:\windows\system32\drivers\ACFVA32.sys [12/30/2009 4:29 PM 86656]
R3 dgcfltr;DGC Filter Driver;c:\windows\system32\drivers\ACFDCP32.sys [12/30/2009 4:29 PM 28928]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [8/12/2009 8:45 PM 46752]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [7/5/2012 2:06 PM 721000]
S2 gupdate1ca97438fe2dfb6;Google Update Service (gupdate1ca97438fe2dfb6);c:\program files\Google\Update\GoogleUpdate.exe [1/17/2010 2:06 AM 133104]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [4/17/2012 10:03 AM 257696]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [1/3/2012 1:41 AM 1684736]
S3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\drivers\motfilt.sys [7/2/2011 12:06 PM 6016]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/17/2010 2:06 AM 133104]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [7/2/2011 12:06 PM 19712]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [7/2/2011 12:06 PM 8320]
S3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\drivers\Motousbnet.sys [7/2/2011 12:06 PM 24960]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [7/2/2011 12:06 PM 23936]
S3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\drivers\motusbdevice.sys [7/2/2011 12:06 PM 6656]
S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [7/8/2010 10:52 AM 20480]
S3 NWUSBModem_000;Novatel Wireless USB Modem Driver (vGEN);c:\windows\system32\drivers\nwusbmdm_000.sys [7/8/2010 10:52 AM 176384]
S3 NWUSBPort_000;Novatel Wireless USB Status Port Driver (vGEN);c:\windows\system32\drivers\nwusbser_000.sys [7/8/2010 10:52 AM 176384]
S3 NWUSBPort2_000;Novatel Wireless USB Status2 Port Driver (vGEN);c:\windows\system32\drivers\nwusbser2_000.sys [7/8/2010 10:52 AM 176384]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [4/14/2010 8:29 PM 32408]
S3 SWDUMon;SWDUMon;c:\windows\system32\drivers\SWDUMon.sys [9/27/2011 11:24 AM 12984]
S3 WLAN(WLAN);XPC 802.11b/g Wireless Kit Driver(WLAN);c:\windows\system32\drivers\ZD1211U.sys [8/16/2005 2:50 PM 278016]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-17 03:33]
.
2012-07-11 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2012-07-05 16:21]
.
2012-07-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-17 07:05]
.
2012-07-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-17 07:05]
.
2012-07-11 c:\windows\Tasks\ProgramUpdateCheck.job
- c:\program files\File Type Assistant\tsassist.exe [2012-04-22 03:19]
.
2012-07-11 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-135449575-224621903-1653462319-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 23:21]
.
2012-06-20 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-135449575-224621903-1653462319-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 23:21]
.
2012-07-11 c:\windows\Tasks\User_Feed_Synchronization-{7A2BE865-5DA3-44CC-A762-3D5D0312B742}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 09:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=0&o=xph&d=1209&m=aspire_r1600
uSearchURL,(Default) = hxxp://my.netzero.net/s/search?r=minisearch
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
LSP: %SYSTEMROOT%\system32\nvLsp.dll
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2012-07-10 22:41
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1040)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
.
- - - - - - - > 'explorer.exe'(1244)
c:\windows\system32\WININET.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\program files\EgisTec\MyWinLocker 3\x86\psdprotect.dll
c:\program files\EgisTec\MyWinLocker 3\x86\sysenv.dll
c:\program files\EgisTec\MyWinLocker 3\x86\XmlLite.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\RTHDCPL.EXE
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\program files\Motorola\MotoConnectService\MotoConnect.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
.
**************************************************************************
.
Completion time: 2012-07-10 22:45:55 - machine was rebooted
ComboFix-quarantined-files.txt 2012-07-11 03:45
ComboFix2.txt 2012-07-11 00:43
ComboFix3.txt 2012-07-10 21:03
ComboFix4.txt 2012-07-10 20:41
ComboFix5.txt 2012-07-11 03:26
.
Pre-Run: 118,328,578,048 bytes free
Post-Run: 118,309,801,984 bytes free
.
- - End Of File - - 1E898FED34ABC1386EF2755390C94E62

i will try it out and let you know if there is any improvement,


----------



## Ried

Thanks. Also - the ComboFix.txt you posted is not the most recent one. That is a run prior to using Avenger to remove Avira folder. Look on your C:\ drive for a ComboFix.txt dated July 13, 2012


----------



## jenn_needs_help

it shows the last one being on the 10th..do you want me to run combofix again and post it?


----------



## Ried

Yes, but run it with the CFScript I gave you in Post #101 --> http://www.techsupportforum.com/forums/f50/rpc-shutdown-60-second-timer-652107-4.html#post3804522 Repeat that procedure, then post the resulting log.


----------



## jenn_needs_help

ComboFix 12-07-10.01 - Command Central 07/15/2012 20:41:35.6.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.895.177 [GMT -5:00]
Running from: E:\ComboFix.exe
Command switches used :: c:\documents and settings\Command Central\Desktop\CFScript.txt
AV: avast! Internet Security *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: avast! Internet Security *Enabled* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
FILE ::
"c:\windows\System32\drivers\avgntflt.sys"
"c:\windows\System32\drivers\avipbb.sys"
"c:\windows\System32\drivers\avkmgr.sys"
"c:\windows\System32\drivers\ssmdrv.sys"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\drivers\i8042prt.sys . . . is missing!!
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_ANTIVIRSERVICE
-------\Legacy_AVGNTFLT
-------\Legacy_AVIPBB
-------\Legacy_SSMDRV
-------\Service_AntiVirService
-------\Service_avgntflt
-------\Service_avipbb
-------\Service_ssmdrv
.
.
((((((((((((((((((((((((( Files Created from 2012-06-16 to 2012-07-16 )))))))))))))))))))))))))))))))
.
.
2012-07-14 05:26 . 2012-07-14 05:26 -------- d-----w- c:\documents and settings\Command Central\Application Data\Malwarebytes
2012-07-14 05:13 . 2012-07-14 05:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2012-07-14 05:13 . 2012-07-14 05:34 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-07-14 05:13 . 2012-07-03 18:46 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-14 02:59 . 2012-07-03 16:21 113776 ----a-w- c:\windows\system32\drivers\aswFW.sys
2012-07-14 02:58 . 2012-07-03 16:21 202928 ----a-w- c:\windows\system32\drivers\aswNdis2.sys
2012-07-14 02:58 . 2012-07-03 16:21 18544 ----a-w- c:\windows\system32\drivers\aswKbd.sys
2012-07-14 02:58 . 2012-06-27 20:33 12112 ----a-w- c:\windows\system32\drivers\aswNdis.sys
2012-07-14 02:39 . 2012-07-03 16:21 353688 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-07-14 02:39 . 2012-07-03 16:21 21256 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-07-14 02:39 . 2012-07-03 16:21 54232 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-07-14 02:39 . 2012-07-03 16:21 721000 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-07-14 02:39 . 2012-07-03 16:21 35928 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-07-14 02:39 . 2012-07-03 16:21 97608 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2012-07-14 02:39 . 2012-07-03 16:21 89624 ----a-w- c:\windows\system32\drivers\aswmon.sys
2012-07-14 02:39 . 2012-07-03 16:21 25256 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2012-07-14 02:38 . 2012-07-03 16:21 41224 ----a-w- c:\windows\avastSS.scr
2012-07-14 02:38 . 2012-07-03 16:21 227648 ----a-w- c:\windows\system32\aswBoot.exe
2012-07-12 14:24 . 2012-07-12 14:24 -------- d-----w- c:\program files\Unlocker
2012-07-12 03:23 . 2012-07-12 03:20 85504 ----a-w- c:\program files\Inherit.exe
2012-07-09 04:51 . 2012-07-09 04:51 -------- d-----w- c:\documents and settings\Command Central\Local Settings\Application Data\VS Revo Group
2012-07-09 04:47 . 2012-07-09 04:47 -------- d-----w- c:\program files\VS Revo Group
2012-07-06 03:59 . 2012-07-06 03:59 -------- d-----w- c:\program files\ISO Image Burner
2012-07-05 18:59 . 2012-07-14 02:38 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software
2012-06-24 17:42 . 2012-06-24 17:42 477240 ----a-w- c:\windows\system32\drivers\sptd.sys
2012-06-21 21:55 . 2012-06-15 21:39 169744 ----a-w- c:\windows\system32\ztvunrar36.dll
2012-06-21 21:55 . 2012-06-15 21:35 185616 ----a-w- c:\windows\system32\ztvunrar39.dll
2012-06-21 21:55 . 2012-06-15 21:33 605968 ----a-w- c:\windows\system32\ztv7z.dll
2012-06-21 21:55 . 2012-06-15 21:33 77072 ----a-w- c:\windows\system32\ztvcabinet.dll
2012-06-21 21:55 . 2005-08-26 06:50 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2012-06-21 21:55 . 2002-03-06 06:00 75264 ----a-w- c:\windows\system32\unacev2.dll
2012-06-21 21:55 . 2003-02-03 01:06 153088 ----a-w- c:\windows\system32\UNRAR3.dll
2012-06-21 21:55 . 2012-06-24 17:40 -------- d-----w- c:\program files\Trojan Remover
2012-06-21 21:55 . 2012-06-21 21:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Simply Super Software
2012-06-21 20:37 . 2012-06-21 20:56 -------- d-----w- C:\20af6fb5af208c49bb
2012-06-21 19:50 . 2012-06-21 20:08 -------- d-----w- C:\a45643d481b40159eb295c1744
2012-06-21 18:49 . 2012-06-21 18:55 -------- d-----w- C:\97dd2c3269bd91880f644a13268fb008
2012-06-21 17:48 . 2012-06-21 17:48 -------- d-----w- c:\program files\SpeedMaxPc
2012-06-21 17:47 . 2012-06-21 18:03 -------- d-----w- C:\075e0d2bcea1f3f9b8f385885c0bb571
2012-06-21 17:08 . 2012-06-21 17:43 -------- d-----w- C:\7c09594d0b144ab19fad4eea95
2012-06-20 16:28 . 2012-06-20 16:24 36000 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-06-20 16:28 . 2012-06-20 16:24 137928 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-06-20 16:28 . 2012-06-20 16:23 83392 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-06-16 12:53 . 2012-05-11 14:42 521728 -c----w- c:\windows\system32\dllcache\jsdbgui.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-14 02:37 . 2012-04-17 15:03 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-07-14 02:37 . 2012-01-02 09:32 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-13 13:19 . 2009-08-13 01:44 1866112 ----a-w- c:\windows\system32\win32k.sys
2012-06-05 15:50 . 2009-08-13 01:44 1372672 ----a-w- c:\windows\system32\msxml6.dll
2012-06-05 15:50 . 2009-08-13 01:44 1172480 ----a-w- c:\windows\system32\msxml3.dll
2012-06-04 04:32 . 2009-08-13 01:44 152576 ----a-w- c:\windows\system32\schannel.dll
2012-06-02 20:19 . 2009-08-07 01:24 22040 ----a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 20:19 . 2009-08-13 00:58 329240 ----a-w- c:\windows\system32\wucltui.dll
2012-06-02 20:19 . 2009-08-13 00:58 210968 ----a-w- c:\windows\system32\wuweb.dll
2012-06-02 20:19 . 2009-08-13 00:58 219160 ----a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 20:19 . 2009-08-07 01:24 15384 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 20:19 . 2009-08-13 01:44 97304 ----a-w- c:\windows\system32\cdm.dll
2012-06-02 20:19 . 2009-08-13 00:58 35864 ----a-w- c:\windows\system32\wups.dll
2012-06-02 20:19 . 2009-08-13 00:58 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 20:19 . 2009-08-07 01:24 45080 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 20:19 . 2009-08-07 01:24 15384 ----a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 20:19 . 2009-08-07 01:24 17944 ----a-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 20:19 . 2009-08-13 00:58 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 20:19 . 2009-08-13 00:58 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-05-31 13:22 . 2009-08-13 01:44 599040 ----a-w- c:\windows\system32\crypt32.dll
2012-05-16 15:08 . 2009-08-13 01:44 916992 ----a-w- c:\windows\system32\wininet.dll
2012-05-11 14:42 . 2009-08-13 01:44 43520 ------w- c:\windows\system32\licmgr10.dll
2012-05-11 14:42 . 2009-08-13 01:44 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-05-11 11:38 . 2009-08-13 01:44 385024 ------w- c:\windows\system32\html.iec
2012-05-04 13:16 . 2008-04-14 00:54 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-04 12:32 . 2008-04-14 00:01 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-02 13:46 . 2009-08-13 00:57 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2010-02-17 11:59 203776 -csha-w- c:\windows\system32\unrar.exe
.
.
((((((((((((((((((((((((((((( [email protected]_19.13.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-07-16 02:02 . 2012-07-16 02:02 16384 c:\windows\Temp\Perflib_Perfdata_c0.dat
+ 2012-07-14 01:50 . 2012-06-02 20:19 45080 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.6.7600.256\wups2.dll
+ 2012-07-14 01:50 . 2012-06-02 20:19 35864 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.6.7600.256\wups.dll
- 2009-08-13 01:44 . 2012-07-10 19:16 68588 c:\windows\system32\perfc009.dat
+ 2009-08-13 01:44 . 2012-07-16 02:15 68588 c:\windows\system32\perfc009.dat
+ 2009-08-13 00:58 . 2012-06-02 20:19 35864 c:\windows\system32\dllcache\wups.dll
+ 2009-08-13 00:58 . 2012-06-02 20:19 53784 c:\windows\system32\dllcache\wuauclt.exe
+ 2009-08-13 01:44 . 2012-06-02 20:19 97304 c:\windows\system32\dllcache\cdm.dll
+ 2012-07-14 21:31 . 2012-07-14 21:31 22016 c:\windows\Installer\5105a7.msi
- 2009-08-13 01:44 . 2012-07-10 19:16 434494 c:\windows\system32\perfh009.dat
+ 2009-08-13 01:44 . 2012-07-16 02:15 434494 c:\windows\system32\perfh009.dat
+ 2012-07-14 02:37 . 2012-07-14 02:37 686280 c:\windows\system32\Macromed\Flash\FlashUtil32_11_3_300_265_ActiveX.exe
+ 2012-07-14 02:37 . 2012-07-14 02:37 465096 c:\windows\system32\Macromed\Flash\FlashUtil32_11_3_300_265_ActiveX.dll
+ 2012-04-17 15:03 . 2012-07-14 02:37 250056 c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
+ 2009-08-12 17:54 . 2012-07-14 15:11 249496 c:\windows\system32\FNTCACHE.DAT
- 2009-08-12 17:54 . 2012-06-14 15:41 249496 c:\windows\system32\FNTCACHE.DAT
+ 2009-08-13 00:58 . 2012-06-02 20:19 210968 c:\windows\system32\dllcache\wuweb.dll
+ 2009-08-13 00:58 . 2012-06-02 20:19 329240 c:\windows\system32\dllcache\wucltui.dll
+ 2009-08-13 00:58 . 2012-06-02 20:19 577048 c:\windows\system32\dllcache\wuapi.dll
+ 2009-08-13 01:44 . 2012-06-04 04:32 152576 c:\windows\system32\dllcache\schannel.dll
- 2009-08-13 00:58 . 2010-11-09 14:52 536576 c:\windows\system32\dllcache\msado15.dll
+ 2009-08-13 00:58 . 2012-05-28 18:16 536576 c:\windows\system32\dllcache\msado15.dll
+ 2009-08-13 01:44 . 2012-06-08 14:26 8462848 c:\windows\system32\shell32.dll
+ 2009-08-13 00:58 . 2012-06-02 20:19 1933848 c:\windows\system32\dllcache\wuaueng.dll
+ 2009-08-13 01:44 . 2012-06-13 13:19 1866112 c:\windows\system32\dllcache\win32k.sys
+ 2009-08-13 01:44 . 2012-06-08 14:26 8462848 c:\windows\system32\dllcache\shell32.dll
+ 2009-08-13 01:44 . 2012-06-05 15:50 1372672 c:\windows\system32\dllcache\msxml6.dll
- 2009-08-13 01:44 . 2009-07-31 16:05 1372672 c:\windows\system32\dllcache\msxml6.dll
+ 2009-08-13 01:44 . 2012-06-05 15:50 1172480 c:\windows\system32\dllcache\msxml3.dll
- 2009-08-13 01:44 . 2010-06-14 07:41 1172480 c:\windows\system32\dllcache\msxml3.dll
+ 2010-01-07 09:59 . 2012-07-14 13:06 57442464 c:\windows\system32\MRT.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-07-03 16:21 121528 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-05-15 06:02 120104 ----a-w- c:\program files\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2009-05-24 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-05-24 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-05-24 13758464]
"EgisTecLiveUpdate"="c:\program files\EgisTec Egis Software Update\EgisUpdate.exe" [2009-05-14 199464]
"mwlDaemon"="c:\program files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-05-15 345384]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-10-17 91432]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"LGODDFU"="c:\program files\lg_fwupdate\fwupdate.exe" [2007-02-26 249856]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-04-22 55824]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"RTHDCPL"="RTHDCPL.EXE" [2009-05-21 17881600]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2012-05-29 296056]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-07-03 4273976]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-12-30 813584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-05-26 23:47 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\Bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
"c:\\Program Files\\File Type Assistant\\tsassist.exe"=
"c:\\Program Files\\AVAST Software\\Avast\\AvastUI.exe"=
.
R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [7/13/2012 9:58 PM 12112]
R0 aswNdis2;avast! Firewall Core Firewall Service;c:\windows\system32\drivers\aswNdis2.sys [7/13/2012 9:58 PM 202928]
R0 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys --> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]
R1 aswFW;avast! TDI Firewall driver;c:\windows\system32\drivers\aswFW.sys [7/13/2012 9:59 PM 113776]
R1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [7/13/2012 9:58 PM 18544]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [7/13/2012 9:39 PM 721000]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [7/13/2012 9:39 PM 353688]
R1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\drivers\mwlPSDFilter.sys [12/4/2008 8:34 PM 17840]
R1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\drivers\mwlPSDNserv.sys [12/4/2008 8:34 PM 15280]
R1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\drivers\mwlPSDVDisk.sys [12/4/2008 8:34 PM 58800]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [7/13/2012 9:39 PM 21256]
R2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [7/13/2012 9:58 PM 133912]
R2 FBDiskOptimizer;FBDiskOptimizer;c:\program files\FixBee\FBDefragSrv.exe [3/25/2012 4:26 PM 608568]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [12/30/2009 4:13 PM 10384]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [7/14/2012 12:13 AM 655944]
R2 MotoConnect Service;MotoConnect Service;c:\program files\Motorola\MotoConnectService\MotoConnectService.exe [7/2/2011 12:06 PM 91392]
R2 MWLService;MyWinLocker Service;c:\program files\EgisTec\MyWinLocker 3\x86\MWLService.exe [5/15/2009 1:03 AM 305448]
R3 acfva;acfva;c:\windows\system32\drivers\ACFVA32.sys [12/30/2009 4:29 PM 86656]
R3 dgcfltr;DGC Filter Driver;c:\windows\system32\drivers\ACFDCP32.sys [12/30/2009 4:29 PM 28928]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [7/14/2012 12:13 AM 22344]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [8/12/2009 8:45 PM 46752]
R3 NWUSBModem_000;Novatel Wireless USB Modem Driver (vGEN);c:\windows\system32\drivers\nwusbmdm_000.sys [7/8/2010 10:52 AM 176384]
R3 NWUSBPort_000;Novatel Wireless USB Status Port Driver (vGEN);c:\windows\system32\drivers\nwusbser_000.sys [7/8/2010 10:52 AM 176384]
R3 NWUSBPort2_000;Novatel Wireless USB Status2 Port Driver (vGEN);c:\windows\system32\drivers\nwusbser2_000.sys [7/8/2010 10:52 AM 176384]
S2 gupdate1ca97438fe2dfb6;Google Update Service (gupdate1ca97438fe2dfb6);c:\program files\Google\Update\GoogleUpdate.exe [1/17/2010 2:06 AM 133104]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [4/17/2012 10:03 AM 250056]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [1/3/2012 1:41 AM 1684736]
S3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\drivers\motfilt.sys [7/2/2011 12:06 PM 6016]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/17/2010 2:06 AM 133104]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [7/2/2011 12:06 PM 19712]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [7/2/2011 12:06 PM 8320]
S3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\drivers\Motousbnet.sys [7/2/2011 12:06 PM 24960]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [7/2/2011 12:06 PM 23936]
S3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\drivers\motusbdevice.sys [7/2/2011 12:06 PM 6656]
S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [7/8/2010 10:52 AM 20480]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [4/14/2010 8:29 PM 32408]
S3 SWDUMon;SWDUMon;c:\windows\system32\drivers\SWDUMon.sys [9/27/2011 11:24 AM 12984]
S3 WLAN(WLAN);XPC 802.11b/g Wireless Kit Driver(WLAN);c:\windows\system32\drivers\ZD1211U.sys [8/16/2005 2:50 PM 278016]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-15 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-17 02:37]
.
2012-07-16 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2012-07-14 16:21]
.
2012-07-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-17 07:05]
.
2012-07-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-17 07:05]
.
2012-07-16 c:\windows\Tasks\ProgramUpdateCheck.job
- c:\program files\File Type Assistant\tsassist.exe [2012-04-22 03:19]
.
2012-07-16 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-135449575-224621903-1653462319-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 23:21]
.
2012-07-11 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-135449575-224621903-1653462319-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 23:21]
.
2012-07-16 c:\windows\Tasks\User_Feed_Synchronization-{7A2BE865-5DA3-44CC-A762-3D5D0312B742}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 09:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=0&o=xph&d=1209&m=aspire_r1600
uSearchURL,(Default) = hxxp://my.netzero.net/s/search?r=minisearch
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
TCP: Interfaces\{C9A07EC2-8A3E-489C-A24C-5670482D9736}: NameServer = 69.78.235.35 69.78.96.14
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2012-07-15 21:14
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1076)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
c:\windows\system32\COMRes.dll
.
- - - - - - - > 'explorer.exe'(1720)
c:\windows\system32\WININET.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\program files\EgisTec\MyWinLocker 3\x86\psdprotect.dll
c:\program files\EgisTec\MyWinLocker 3\x86\sysenv.dll
c:\program files\EgisTec\MyWinLocker 3\x86\XmlLite.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\RTHDCPL.EXE
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\program files\Motorola\MotoConnectService\MotoConnect.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
.
**************************************************************************
.
Completion time: 2012-07-15 21:19:18 - machine was rebooted
ComboFix-quarantined-files.txt 2012-07-16 02:19
ComboFix2.txt 2012-07-11 03:45
ComboFix3.txt 2012-07-11 00:43
ComboFix4.txt 2012-07-10 21:03
ComboFix5.txt 2012-07-16 01:25
.
Pre-Run: 118,269,464,576 bytes free
Post-Run: 118,405,726,208 bytes free
.
- - End Of File - - BC8BE1A9E159030A6D0159DD5EB1FB6A


----------



## Ried

:banghead: We'll have to use Avenger again to get rid of those remnant Avira drivers. Unbelievable - this shouldn't be this difficult. When Avira installed, something sure went horribly wrong.

Open Notepad and copy/paste the text in the quotebox below into Notepad 



> Drivers to delete:
> ssmdrv
> avipbb
> avgntflt
> avkmgr
> 
> Files to delete:
> c:\windows\system32\drivers\avkmgr.sys
> c:\windows\system32\drivers\avipbb.sys
> c:\windows\system32\drivers\avgntflt.sys
> C:\WINDOWS\system32\drivers\ssmdrv.sys


Open the Avenger folder and start The Avenger program by clicking on its icon.

 Right click on the window under *Input script here:*, and select Paste.
 You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V]), or click on the third button under the menu to paste it from the clipboard.
 Click on *Execute*
 Answer "*Yes*" twice when prompted.
4. *The Avenger will automatically do the following*:
It will *Restart your computer*. ( In cases where the code to execute contains "*Drivers to Delete*" or "*Drivers to Disable*", The Avenger will actually *restart your system twice.*)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. **This log file will be located at***C:\avenger.txt*
 The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to *C:\avenger\backup.zip*.
5. Please post the content of *c:\avenger.txt* into your reply

How is the machine behaving?


----------



## jenn_needs_help

its still slower than it was. and sometimes my start menu and desktop icons dissappear when i leave it idle for a little while i will run avenger in the morning and post


----------



## jenn_needs_help

Logfile of The Avenger Version 2.0, (c) by Swandog46
Swandog46's Public Anti-Malware Tools
Platform: Windows XP
*******************
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
Rootkit scan active.
No rootkits found!

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\ssmdrv" not found!
Deletion of driver "ssmdrv" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\avipbb" not found!
Deletion of driver "avipbb" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\avgntflt" not found!
Deletion of driver "avgntflt" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\avkmgr" not found!
Deletion of driver "avkmgr" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
File "c:\windows\system32\drivers\avkmgr.sys" deleted successfully.
File "c:\windows\system32\drivers\avipbb.sys" deleted successfully.
File "c:\windows\system32\drivers\avgntflt.sys" deleted successfully.
File "C:\WINDOWS\system32\drivers\ssmdrv.sys" deleted successfully.
Completed script processing.
*******************
Finished! Terminate.


----------



## Ried

Let's run an online scan to search for any remnants that may be lurking. Please go to *here* to run the online scannner from ESET.
 Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to *YES, I accept the Terms of Use.*
Click *Start*
When asked, allow the activex control to install
Click *Start*
Make sure that the option *Remove found threats* is *unticked*


Click on *Advanced Settings* and ensure these options are ticked:
*Scan for potentially unwanted applications*
*Scan for potentially unsafe applications*
*Enable Anti-Stealth Technology*

Click *Scan*
Wait for the scan to finish
If any threats were found, click the *'List of found threats' *, then click* Export to text file...*. 
Save it to your desktop, then please copy and paste that log as a reply to this topic.


----------



## jenn_needs_help

C:\Documents and Settings\Command Central\.frostwire5\updates\frostwire-5.3.6.windows.exe Win32/OpenCandy application
C:\Documents and Settings\Command Central\My Documents\PopularScreenSavers.exe Win32/AdInstaller application
C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe a variant of Win32/Toolbar.Widgi application
C:\Program Files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll a variant of Win32/Toolbar.Widgi application
C:\Program Files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.10 a variant of Win32/Toolbar.Widgi application
C:\Program Files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.11 a variant of Win32/Toolbar.Widgi application
C:\Program Files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.12 a variant of Win32/Toolbar.Widgi application
C:\Program Files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.13 a variant of Win32/Toolbar.Widgi application
C:\Program Files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.14 a variant of Win32/Toolbar.Widgi application
C:\Program Files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.5 a variant of Win32/Toolbar.Widgi application
C:\Program Files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.6 a variant of Win32/Toolbar.Widgi application
C:\Program Files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.7 a variant of Win32/Toolbar.Widgi application
C:\Program Files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.8 a variant of Win32/Toolbar.Widgi application
C:\Program Files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.9 a variant of Win32/Toolbar.Widgi application
C:\Program Files\YouTube Downloader Toolbar\IE\6.0\youtubedownloaderToolbarIE.dll a variant of Win32/Toolbar.Widgi application
C:\Qoobox\Quarantine\C\Program Files\IMESHA~1\MediaBar\Datamngr\BrowserConnection.dll.vir Win32/Toolbar.SearchSuite application
C:\Qoobox\Quarantine\C\Program Files\IMESHA~1\MediaBar\Datamngr\datamngr.dll.vir Win32/Toolbar.SearchSuite application
C:\Qoobox\Quarantine\C\Program Files\IMESHA~1\MediaBar\Datamngr\datamngrUI.exe.vir a variant of Win32/Toolbar.SearchSuite application
C:\Qoobox\Quarantine\C\Program Files\IMESHA~1\MediaBar\Datamngr\DnsBHO.dll.vir Win32/Toolbar.SearchSuite application
C:\Qoobox\Quarantine\C\Program Files\IMESHA~1\MediaBar\Datamngr\IEBHO.dll.vir Win32/Toolbar.SearchSuite application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL.vir Win32/Toolbar.MyWebSearch application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL.vir Win32/FunWeb application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL.vir Win32/FunWeb application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL.vir Win32/Toolbar.MyWebSearch.B application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL.vir Win32/Toolbar.MyWebSearch application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL.vir Win32/Toolbar.MyWebSearch application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL.vir Win32/FunWeb application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL.vir Win32/Toolbar.MyWebSearch.D application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL.vir Win32/Toolbar.MyWebSearch application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE.vir Win32/FunWeb application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL.vir Win32/Toolbar.MyWebSearch.P application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL.vir Win32/FunWeb application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL.vir Win32/Toolbar.MyWebSearch.P application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3TPINST.DLL.vir Win32/Toolbar.MyWebSearch.I application
C:\Qoobox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL.vir.vir Win32/Toolbar.MyWebSearch application
C:\Qoobox\Quarantine\C\WINDOWS\system32\SysWoW32\@i1281349791v6.vir a variant of WMA/TrojanDownloader.GetCodec.gen trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\SysWoW32\@i1281349791v7.vir a variant of WMA/TrojanDownloader.GetCodec.gen trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\SysWoW32\_i1281349791v6.vir a variant of WMA/TrojanDownloader.GetCodec.gen trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\SysWoW32\_i1281349791v7.vir a variant of WMA/TrojanDownloader.GetCodec.gen trojan
Operating memory a variant of Win32/Toolbar.Widgi application


----------



## Ried

Most of those detections are backups that were made during the course of this fix. We'll clear those when we're through.

Using Windows Explorer, delete the following files and folders:

C:\Documents and Settings\Command Central\*.frostwire5*
C:\Documents and Settings\Command Central\My Documents\*PopularScreenSavers.exe*
C:\Program Files\Common Files\*Spigot*

How is the machine behaving?


----------



## jenn_needs_help

its just acting slow. doing pretty much what i want it too. i couldnt delete that last file it said access was denied


----------



## Ried

See if you can boot into Safe Mode now, and delete it from there.


----------



## jenn_needs_help

I still cant boot into safe mode. when i go to start menu and try to shutdown or restart. its not wanting to do that either.


----------



## Ried

Open *notepad* and copy/paste the text in the code box below into it:



> Folder::
> C:\Documents and Settings\Command Central\.frostwire5
> C:\Program Files\Common Files\Spigot
> File::
> C:\Documents and Settings\Command Central\My Documents\PopularScreenSavers.exe
> Reboot::


Save this as *"CFScript.txt"*, and as Type: All Files (*.*)
in the same location as ComboFix.exe

***************************************************

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

***************************************************












Refering to the picture above, drag CFScript into ComboFix.exe. *If ComboFix alerts that an update is available, please allow it to do so. *


When finished, post the ComboFix.txt


----------



## jenn_needs_help

ComboFix 12-07-21.01 - Command Central 07/23/2012 9:46.7.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.895.219 [GMT -5:00]
Running from: E:\ComboFix.exe
Command switches used :: E:\CFScript.txt
AV: avast! Internet Security *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: avast! Internet Security *Disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
FILE ::
"c:\documents and settings\Command Central\My Documents\PopularScreenSavers.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Common Files\Spigot
c:\program files\Common Files\Spigot\GC\coupons_2.0.crx
c:\program files\Common Files\Spigot\GC\ErrorAssistant_1.0.crx
c:\program files\Common Files\Spigot\Search Settings\baidu_ff.xml
c:\program files\Common Files\Spigot\Search Settings\baidu_ie.xml
c:\program files\Common Files\Spigot\Search Settings\config.ini
c:\program files\Common Files\Spigot\Search Settings\Lang\res1031.ini
c:\program files\Common Files\Spigot\Search Settings\Lang\res1033.ini
c:\program files\Common Files\Spigot\Search Settings\Lang\res1034.ini
c:\program files\Common Files\Spigot\Search Settings\Lang\res1036.ini
c:\program files\Common Files\Spigot\Search Settings\Lang\res1040.ini
c:\program files\Common Files\Spigot\Search Settings\SearchSettings.exe
c:\program files\Common Files\Spigot\Search Settings\wth.dll
c:\program files\Common Files\Spigot\Search Settings\yahoo_ff.xml
c:\program files\Common Files\Spigot\Search Settings\yahoo_ie.xml
c:\program files\Common Files\Spigot\Search Settings\yandex_ff.xml
c:\program files\Common Files\Spigot\Search Settings\yandex_ie.xml
c:\program files\Common Files\Spigot\wtxpcom\chrome.manifest
c:\program files\Common Files\Spigot\wtxpcom\chrome\content\listener.js
c:\program files\Common Files\Spigot\wtxpcom\chrome\content\listener.xul
c:\program files\Common Files\Spigot\wtxpcom\chrome\content\shared.jsm
c:\program files\Common Files\Spigot\wtxpcom\components\chrome.manifest
c:\program files\Common Files\Spigot\wtxpcom\components\IFBHOHelperWidgiToolbar.xpt
c:\program files\Common Files\Spigot\wtxpcom\components\IFBHOWidgiToolbar.xpt
c:\program files\Common Files\Spigot\wtxpcom\components\install.rdf
c:\program files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll
c:\program files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.10
c:\program files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.11
c:\program files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.12
c:\program files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.13
c:\program files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.14
c:\program files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.5
c:\program files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.6
c:\program files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.7
c:\program files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.8
c:\program files\Common Files\Spigot\wtxpcom\components\WidgiToolbarFF.dll.9
c:\program files\Common Files\Spigot\wtxpcom\install.rdf
.
c:\windows\system32\drivers\i8042prt.sys . . . is missing!!
.
.
((((((((((((((((((((((((( Files Created from 2012-06-23 to 2012-07-23 )))))))))))))))))))))))))))))))
.
.
2012-07-17 04:04 . 2012-07-17 04:04 -------- d-----w- c:\program files\Hewlett-Packard
2012-07-16 23:42 . 2012-07-16 23:42 -------- d-----w- c:\program files\ESET
2012-07-16 17:37 . 2012-07-16 17:37 -------- d-----w- c:\documents and settings\Command Central\Application Data\Search Settings
2012-07-16 17:37 . 2012-07-16 17:37 -------- d-----w- c:\program files\Application Updater
2012-07-16 17:37 . 2012-07-16 17:37 -------- d-----w- c:\program files\YouTube Downloader Toolbar
2012-07-16 17:33 . 2012-07-16 17:33 -------- d-----w- c:\documents and settings\All Users\Application Data\YTD Video Downloader
2012-07-14 05:26 . 2012-07-14 05:26 -------- d-----w- c:\documents and settings\Command Central\Application Data\Malwarebytes
2012-07-14 05:13 . 2012-07-14 05:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2012-07-14 05:13 . 2012-07-14 05:34 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-07-14 05:13 . 2012-07-03 18:46 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-14 02:59 . 2012-07-03 16:21 113776 ----a-w- c:\windows\system32\drivers\aswFW.sys
2012-07-14 02:58 . 2012-07-03 16:21 202928 ----a-w- c:\windows\system32\drivers\aswNdis2.sys
2012-07-14 02:58 . 2012-07-03 16:21 18544 ----a-w- c:\windows\system32\drivers\aswKbd.sys
2012-07-14 02:58 . 2012-06-27 20:33 12112 ----a-w- c:\windows\system32\drivers\aswNdis.sys
2012-07-14 02:39 . 2012-07-03 16:21 353688 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-07-14 02:39 . 2012-07-03 16:21 21256 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-07-14 02:39 . 2012-07-03 16:21 54232 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-07-14 02:39 . 2012-07-03 16:21 721000 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-07-14 02:39 . 2012-07-03 16:21 35928 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-07-14 02:39 . 2012-07-03 16:21 97608 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2012-07-14 02:39 . 2012-07-03 16:21 89624 ----a-w- c:\windows\system32\drivers\aswmon.sys
2012-07-14 02:39 . 2012-07-03 16:21 25256 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2012-07-14 02:38 . 2012-07-03 16:21 41224 ----a-w- c:\windows\avastSS.scr
2012-07-14 02:38 . 2012-07-03 16:21 227648 ----a-w- c:\windows\system32\aswBoot.exe
2012-07-12 14:24 . 2012-07-12 14:24 -------- d-----w- c:\program files\Unlocker
2012-07-12 03:23 . 2012-07-12 03:20 85504 ----a-w- c:\program files\Inherit.exe
2012-07-09 04:51 . 2012-07-09 04:51 -------- d-----w- c:\documents and settings\Command Central\Local Settings\Application Data\VS Revo Group
2012-07-09 04:47 . 2012-07-09 04:47 -------- d-----w- c:\program files\VS Revo Group
2012-07-06 03:59 . 2012-07-06 03:59 -------- d-----w- c:\program files\ISO Image Burner
2012-07-05 18:59 . 2012-07-14 02:38 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software
2012-06-24 17:42 . 2012-06-24 17:42 477240 ----a-w- c:\windows\system32\drivers\sptd.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-14 02:37 . 2012-04-17 15:03 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-07-14 02:37 . 2012-01-02 09:32 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-15 21:39 . 2012-06-21 21:55 169744 ----a-w- c:\windows\system32\ztvunrar36.dll
2012-06-15 21:35 . 2012-06-21 21:55 185616 ----a-w- c:\windows\system32\ztvunrar39.dll
2012-06-15 21:33 . 2012-06-21 21:55 605968 ----a-w- c:\windows\system32\ztv7z.dll
2012-06-15 21:33 . 2012-06-21 21:55 77072 ----a-w- c:\windows\system32\ztvcabinet.dll
2012-06-13 13:19 . 2009-08-13 01:44 1866112 ----a-w- c:\windows\system32\win32k.sys
2012-06-05 15:50 . 2009-08-13 01:44 1372672 ----a-w- c:\windows\system32\msxml6.dll
2012-06-05 15:50 . 2009-08-13 01:44 1172480 ----a-w- c:\windows\system32\msxml3.dll
2012-06-04 04:32 . 2009-08-13 01:44 152576 ----a-w- c:\windows\system32\schannel.dll
2012-06-02 20:19 . 2009-08-07 01:24 22040 ----a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 20:19 . 2009-08-13 00:58 329240 ----a-w- c:\windows\system32\wucltui.dll
2012-06-02 20:19 . 2009-08-13 00:58 210968 ----a-w- c:\windows\system32\wuweb.dll
2012-06-02 20:19 . 2009-08-13 00:58 219160 ----a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 20:19 . 2009-08-07 01:24 15384 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 20:19 . 2009-08-13 01:44 97304 ----a-w- c:\windows\system32\cdm.dll
2012-06-02 20:19 . 2009-08-13 00:58 35864 ----a-w- c:\windows\system32\wups.dll
2012-06-02 20:19 . 2009-08-13 00:58 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 20:19 . 2009-08-07 01:24 45080 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 20:19 . 2009-08-07 01:24 15384 ----a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 20:19 . 2009-08-07 01:24 17944 ----a-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 20:19 . 2009-08-13 00:58 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 20:19 . 2009-08-13 00:58 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-05-31 13:22 . 2009-08-13 01:44 599040 ----a-w- c:\windows\system32\crypt32.dll
2012-05-16 15:08 . 2009-08-13 01:44 916992 ----a-w- c:\windows\system32\wininet.dll
2012-05-11 14:42 . 2009-08-13 01:44 43520 ------w- c:\windows\system32\licmgr10.dll
2012-05-11 14:42 . 2009-08-13 01:44 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-05-11 11:38 . 2009-08-13 01:44 385024 ------w- c:\windows\system32\html.iec
2012-05-04 13:16 . 2008-04-14 00:54 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-04 12:32 . 2008-04-14 00:01 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-02 13:46 . 2009-08-13 00:57 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2010-02-17 11:59 203776 -csha-w- c:\windows\system32\unrar.exe
.
.
((((((((((((((((((((((((((((( [email protected]_19.13.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-07-23 15:06 . 2012-07-23 15:06 16384 c:\windows\Temp\Perflib_Perfdata_d4.dat
+ 2012-07-14 01:50 . 2012-06-02 20:19 45080 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.6.7600.256\wups2.dll
+ 2012-07-14 01:50 . 2012-06-02 20:19 35864 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.6.7600.256\wups.dll
+ 2009-08-13 01:44 . 2012-07-23 15:11 68588 c:\windows\system32\perfc009.dat
- 2009-08-13 01:44 . 2012-07-10 19:16 68588 c:\windows\system32\perfc009.dat
+ 2009-08-13 00:58 . 2012-06-02 20:19 35864 c:\windows\system32\dllcache\wups.dll
+ 2009-08-13 00:58 . 2012-06-02 20:19 53784 c:\windows\system32\dllcache\wuauclt.exe
+ 2009-08-13 01:44 . 2012-06-02 20:19 97304 c:\windows\system32\dllcache\cdm.dll
+ 2012-07-14 21:31 . 2012-07-14 21:31 22016 c:\windows\Installer\5105a7.msi
+ 2012-07-17 04:04 . 2012-07-17 04:04 10134 c:\windows\Installer\{6F340107-F9AA-47C6-B54C-C3A19F11553F}\ARPPRODUCTICON.exe
+ 2012-07-16 17:37 . 2012-07-16 17:37 53248 c:\windows\Installer\{590E3295-A11B-4C9F-9F88-399397EE393D}\ARPPRODUCTICON.exe
+ 2012-07-17 04:04 . 2012-07-17 04:04 36920 c:\windows\assembly\GAC_MSIL\HP.ActiveCheckLocalMode.SessionManager\1.1.0.0__87cc6405259abc0f\HP.ActiveCheckLocalMode.SessionManager.dll
+ 2012-07-17 04:04 . 2012-07-17 04:04 32312 c:\windows\assembly\GAC_MSIL\HP.ActiveCheckLocalMode.ServiceFacade\1.1.0.0__87cc6405259abc0f\HP.ActiveCheckLocalMode.ServiceFacade.dll
+ 2008-03-04 08:17 . 2008-03-04 08:17 655872 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30304.0_x-ww_003f2b36\msvcr90.dll
+ 2008-03-04 08:17 . 2008-03-04 08:17 572928 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30304.0_x-ww_003f2b36\msvcp90.dll
+ 2008-03-04 02:52 . 2008-03-04 02:52 225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30304.0_x-ww_003f2b36\msvcm90.dll
- 2009-08-13 01:44 . 2012-07-10 19:16 434494 c:\windows\system32\perfh009.dat
+ 2009-08-13 01:44 . 2012-07-23 15:11 434494 c:\windows\system32\perfh009.dat
+ 2012-07-14 02:37 . 2012-07-14 02:37 686280 c:\windows\system32\Macromed\Flash\FlashUtil32_11_3_300_265_ActiveX.exe
+ 2012-07-14 02:37 . 2012-07-14 02:37 465096 c:\windows\system32\Macromed\Flash\FlashUtil32_11_3_300_265_ActiveX.dll
+ 2012-04-17 15:03 . 2012-07-14 02:37 250056 c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
+ 2009-08-12 17:54 . 2012-07-14 15:11 249496 c:\windows\system32\FNTCACHE.DAT
- 2009-08-12 17:54 . 2012-06-14 15:41 249496 c:\windows\system32\FNTCACHE.DAT
+ 2009-08-13 00:58 . 2012-06-02 20:19 210968 c:\windows\system32\dllcache\wuweb.dll
+ 2009-08-13 00:58 . 2012-06-02 20:19 329240 c:\windows\system32\dllcache\wucltui.dll
+ 2009-08-13 00:58 . 2012-06-02 20:19 577048 c:\windows\system32\dllcache\wuapi.dll
+ 2009-08-13 01:44 . 2012-06-04 04:32 152576 c:\windows\system32\dllcache\schannel.dll
+ 2009-08-13 00:58 . 2012-05-28 18:16 536576 c:\windows\system32\dllcache\msado15.dll
- 2009-08-13 00:58 . 2010-11-09 14:52 536576 c:\windows\system32\dllcache\msado15.dll
+ 2012-07-17 04:04 . 2012-07-17 04:04 457216 c:\windows\Installer\196031a.msi
+ 2009-08-13 01:44 . 2012-06-08 14:26 8462848 c:\windows\system32\shell32.dll
+ 2009-08-13 00:58 . 2012-06-02 20:19 1933848 c:\windows\system32\dllcache\wuaueng.dll
+ 2009-08-13 01:44 . 2012-06-13 13:19 1866112 c:\windows\system32\dllcache\win32k.sys
+ 2009-08-13 01:44 . 2012-06-08 14:26 8462848 c:\windows\system32\dllcache\shell32.dll
- 2009-08-13 01:44 . 2009-07-31 16:05 1372672 c:\windows\system32\dllcache\msxml6.dll
+ 2009-08-13 01:44 . 2012-06-05 15:50 1372672 c:\windows\system32\dllcache\msxml6.dll
+ 2009-08-13 01:44 . 2012-06-05 15:50 1172480 c:\windows\system32\dllcache\msxml3.dll
- 2009-08-13 01:44 . 2010-06-14 07:41 1172480 c:\windows\system32\dllcache\msxml3.dll
+ 2012-07-16 17:37 . 2012-07-16 17:37 1374720 c:\windows\Installer\358202b.msi
+ 2012-07-17 04:04 . 2012-07-17 04:04 2527232 c:\windows\Installer\196031f.msi
+ 2010-01-07 09:59 . 2012-07-14 13:06 57442464 c:\windows\system32\MRT.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-07-03 16:21 121528 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-05-15 06:02 120104 ----a-w- c:\program files\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2009-05-24 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-05-24 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-05-24 13758464]
"EgisTecLiveUpdate"="c:\program files\EgisTec Egis Software Update\EgisUpdate.exe" [2009-05-14 199464]
"mwlDaemon"="c:\program files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-05-15 345384]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-10-17 91432]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"LGODDFU"="c:\program files\lg_fwupdate\fwupdate.exe" [2007-02-26 249856]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-04-22 55824]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"RTHDCPL"="RTHDCPL.EXE" [2009-05-21 17881600]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2012-05-29 296056]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-07-03 4273976]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-12-30 813584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-05-26 23:47 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\Bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
"c:\\Program Files\\File Type Assistant\\tsassist.exe"=
"c:\\Program Files\\AVAST Software\\Avast\\AvastUI.exe"=
.
R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [7/13/2012 9:58 PM 12112]
R0 aswNdis2;avast! Firewall Core Firewall Service;c:\windows\system32\drivers\aswNdis2.sys [7/13/2012 9:58 PM 202928]
R0 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys --> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]
R1 aswFW;avast! TDI Firewall driver;c:\windows\system32\drivers\aswFW.sys [7/13/2012 9:59 PM 113776]
R1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [7/13/2012 9:58 PM 18544]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [7/13/2012 9:39 PM 721000]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [7/13/2012 9:39 PM 353688]
R1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\drivers\mwlPSDFilter.sys [12/4/2008 8:34 PM 17840]
R1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\drivers\mwlPSDNserv.sys [12/4/2008 8:34 PM 15280]
R1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\drivers\mwlPSDVDisk.sys [12/4/2008 8:34 PM 58800]
R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [6/27/2012 5:01 PM 791488]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [7/13/2012 9:39 PM 21256]
R2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [7/13/2012 9:58 PM 133912]
R2 FBDiskOptimizer;FBDiskOptimizer;c:\program files\FixBee\FBDefragSrv.exe [3/25/2012 4:26 PM 608568]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [12/30/2009 4:13 PM 10384]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [7/14/2012 12:13 AM 655944]
R2 MotoConnect Service;MotoConnect Service;c:\program files\Motorola\MotoConnectService\MotoConnectService.exe [7/2/2011 12:06 PM 91392]
R2 MWLService;MyWinLocker Service;c:\program files\EgisTec\MyWinLocker 3\x86\MWLService.exe [5/15/2009 1:03 AM 305448]
R3 acfva;acfva;c:\windows\system32\drivers\ACFVA32.sys [12/30/2009 4:29 PM 86656]
R3 dgcfltr;DGC Filter Driver;c:\windows\system32\drivers\ACFDCP32.sys [12/30/2009 4:29 PM 28928]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [7/14/2012 12:13 AM 22344]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [8/12/2009 8:45 PM 46752]
R3 NWUSBModem_000;Novatel Wireless USB Modem Driver (vGEN);c:\windows\system32\drivers\nwusbmdm_000.sys [7/8/2010 10:52 AM 176384]
R3 NWUSBPort_000;Novatel Wireless USB Status Port Driver (vGEN);c:\windows\system32\drivers\nwusbser_000.sys [7/8/2010 10:52 AM 176384]
R3 NWUSBPort2_000;Novatel Wireless USB Status2 Port Driver (vGEN);c:\windows\system32\drivers\nwusbser2_000.sys [7/8/2010 10:52 AM 176384]
S2 gupdate1ca97438fe2dfb6;Google Update Service (gupdate1ca97438fe2dfb6);c:\program files\Google\Update\GoogleUpdate.exe [1/17/2010 2:06 AM 133104]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [4/17/2012 10:03 AM 250056]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [1/3/2012 1:41 AM 1684736]
S3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\drivers\motfilt.sys [7/2/2011 12:06 PM 6016]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/17/2010 2:06 AM 133104]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [7/2/2011 12:06 PM 19712]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [7/2/2011 12:06 PM 8320]
S3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\drivers\Motousbnet.sys [7/2/2011 12:06 PM 24960]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [7/2/2011 12:06 PM 23936]
S3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\drivers\motusbdevice.sys [7/2/2011 12:06 PM 6656]
S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [7/8/2010 10:52 AM 20480]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [4/14/2010 8:29 PM 32408]
S3 SWDUMon;SWDUMon;c:\windows\system32\drivers\SWDUMon.sys [9/27/2011 11:24 AM 12984]
S3 WLAN(WLAN);XPC 802.11b/g Wireless Kit Driver(WLAN);c:\windows\system32\drivers\ZD1211U.sys [8/16/2005 2:50 PM 278016]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-17 02:37]
.
2012-07-23 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2012-07-14 16:21]
.
2012-07-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-17 07:05]
.
2012-07-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-17 07:05]
.
2012-07-23 c:\windows\Tasks\ProgramUpdateCheck.job
- c:\program files\File Type Assistant\tsassist.exe [2012-04-22 03:19]
.
2012-07-23 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-135449575-224621903-1653462319-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 23:21]
.
2012-07-22 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-135449575-224621903-1653462319-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-04-30 23:21]
.
2012-07-23 c:\windows\Tasks\User_Feed_Synchronization-{7A2BE865-5DA3-44CC-A762-3D5D0312B742}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 09:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=0&o=xph&d=1209&m=aspire_r1600
uSearchURL,(Default) = hxxp://my.netzero.net/s/search?r=minisearch
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-SearchSettings - c:\program files\Common Files\Spigot\Search Settings\SearchSettings.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2012-07-23 10:09
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1076)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
.
- - - - - - - > 'explorer.exe'(2868)
c:\windows\system32\WININET.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\program files\EgisTec\MyWinLocker 3\x86\psdprotect.dll
c:\program files\EgisTec\MyWinLocker 3\x86\sysenv.dll
c:\program files\EgisTec\MyWinLocker 3\x86\XmlLite.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\RTHDCPL.EXE
c:\program files\Motorola\MotoConnectService\MotoConnect.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
.
**************************************************************************
.
Completion time: 2012-07-23 10:15:10 - machine was rebooted
ComboFix-quarantined-files.txt 2012-07-23 15:15
ComboFix2.txt 2012-07-16 02:19
ComboFix3.txt 2012-07-11 03:45
ComboFix4.txt 2012-07-11 00:43
ComboFix5.txt 2012-07-23 14:38
.
Pre-Run: 117,341,380,608 bytes free
Post-Run: 117,586,092,032 bytes free
.
- - End Of File - - 4A40EB693EE0F4E68DA1489B3FFD8630


----------



## jenn_needs_help

Anything else you can think of? it shut down just fine last time i tried. but its still freezing and loading very slow. compared to what it was


----------



## Ried

This is tough. Avira really messed with your Operating System. It never should have taken such extreme measures to remove that folder, those drivers and services. The fact it also caused your Rpc shutdown errors tells me that whatever happened during that initial install, it corrupted Windows.

Let's just be sure there's no other malware on this machine. Download TDSSKiller.exe and save it to your desktop
Execute TDSSKiller.exe by doubleclicking on it.
Press *Start Scan*

If Malicious objects are found, *do NOT *select * Cure*. *Change the action to Skip*, and save the log.

Once complete, a log will be produced at the root drive which is typically C:\ ,for example, C:\TDSSKiller.<version_date_time>log.txt

Please post the contents of that log in your next reply.


----------



## jenn_needs_help

i ran the tdss killer. and no threats were found.


----------



## Ried

Then I'm afraid your best course of action is to format and reinstall Windows. Since you can't access bios to change boot order, I would recommend contacting Acer and ask them if they have a set of recovery discs you can obtain from them.


----------

