# Google Redirect Malware



## kottonk1ng (Aug 4, 2010)

Anytime I click a search result from google, I'm redirected to a variety of spam sites (ie. wantangel.com).

Malware Bytes, SBS&D, and AVG all find nothing, except a few times I've plugged my phone in (T-mobile HD2) it says that autorun.inf (I could be wrong on the exact file name) has been detected as a virus and moved to the vault. 

I've attached my hijack this log.


Thank you very much in advance!


----------



## Rorschach112 (Oct 12, 2008)

*Please read carefully and follow these steps.* 

Download *TDSSKiller* and save it to your Desktop.
Extract its contents to your desktop.
Once extracted, open the TDSSKiller folder and doubleclick on *TDSSKiller.exe* to run the application, then on *Start Scan.*










If an infected file is detected, the default action will be *Cure*, click on *Continue.*










If a suspicious file is detected, the default action will be *Skip*, click on *Continue.*










It may ask you to reboot the computer to complete the process. Click on *Reboot Now*.










If no reboot is require, click on *Report*. A log file should appear. Please copy and paste the contents of that file here.
If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "*TDSSKiller.[Version]_[Date]_[Time]_log.txt*". Please copy and paste the contents of that file here.


----------



## kottonk1ng (Aug 4, 2010)

Here you go!

Again, I truly appreciate all of your continued help and support!


2010/08/05 10:20:19.0093 TDSS rootkit removing tool 2.4.1.0 Aug 4 2010 15:06:41
2010/08/05 10:20:19.0093 ================================================================================
2010/08/05 10:20:19.0093 SystemInfo:
2010/08/05 10:20:19.0093 
2010/08/05 10:20:19.0093 OS Version: 5.1.2600 ServicePack: 3.0
2010/08/05 10:20:19.0093 Product type: Workstation
2010/08/05 10:20:19.0093 ComputerName: JOE
2010/08/05 10:20:19.0093 UserName: Joe Calderone
2010/08/05 10:20:19.0093 Windows directory: C:\WINDOWS
2010/08/05 10:20:19.0093 System windows directory: C:\WINDOWS
2010/08/05 10:20:19.0093 Processor architecture: Intel x86
2010/08/05 10:20:19.0093 Number of processors: 2
2010/08/05 10:20:19.0093 Page size: 0x1000
2010/08/05 10:20:19.0093 Boot type: Normal boot
2010/08/05 10:20:19.0093 ================================================================================
2010/08/05 10:20:20.0078 Initialize success
2010/08/05 10:20:27.0062 ================================================================================
2010/08/05 10:20:27.0062 Scan started
2010/08/05 10:20:27.0062 Mode: Manual;
2010/08/05 10:20:27.0062 ================================================================================
2010/08/05 10:20:32.0046 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2010/08/05 10:20:32.0203 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
2010/08/05 10:20:32.0296 ACRUSBTM (45b952a3ed567264acff89e46f65331d) C:\WINDOWS\system32\drivers\ACRUSBTM.SYS
2010/08/05 10:20:32.0406 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2010/08/05 10:20:32.0578 AFD (a10e52c5f7c0330b4473bd7992ab3995) C:\WINDOWS\System32\drivers\afd.sys
2010/08/05 10:20:32.0578 Suspicious file (Forged): C:\WINDOWS\System32\drivers\afd.sys. Real md5: a10e52c5f7c0330b4473bd7992ab3995, Fake md5: 7e775010ef291da96ad17ca4b17137d7
2010/08/05 10:20:32.0578 AFD - detected Rootkit.Win32.TDSS.tdl3 (0)
2010/08/05 10:20:32.0796 Ambfilt (f6af59d6eee5e1c304f7f73706ad11d8) C:\WINDOWS\system32\drivers\Ambfilt.sys
2010/08/05 10:20:33.0203 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2010/08/05 10:20:33.0234 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2010/08/05 10:20:33.0281 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2010/08/05 10:20:33.0406 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2010/08/05 10:20:33.0500 AvgLdx86 (b8c187439d27aba430dd69fdcf1fa657) C:\WINDOWS\System32\Drivers\avgldx86.sys
2010/08/05 10:20:33.0562 AvgMfx86 (53b3f979930a786a614d29cafe99f645) C:\WINDOWS\System32\Drivers\avgmfx86.sys
2010/08/05 10:20:33.0687 AvgTdiX (22e3b793c3e61720f03d3a22351af410) C:\WINDOWS\System32\Drivers\avgtdix.sys
2010/08/05 10:20:33.0765 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2010/08/05 10:20:33.0890 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2010/08/05 10:20:33.0953 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2010/08/05 10:20:34.0015 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2010/08/05 10:20:34.0140 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2010/08/05 10:20:34.0187 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2010/08/05 10:20:34.0296 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
2010/08/05 10:20:34.0406 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
2010/08/05 10:20:34.0531 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2010/08/05 10:20:34.0625 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2010/08/05 10:20:34.0765 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2010/08/05 10:20:34.0828 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2010/08/05 10:20:34.0875 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2010/08/05 10:20:34.0968 DOSMEMIO (8a4cb9438571814b128b6dc30d698064) C:\WINDOWS\system32\MEMIO.SYS
2010/08/05 10:20:35.0125 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2010/08/05 10:20:35.0234 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2010/08/05 10:20:35.0437 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
2010/08/05 10:20:35.0468 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2010/08/05 10:20:35.0546 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2010/08/05 10:20:35.0640 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
2010/08/05 10:20:35.0718 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2010/08/05 10:20:35.0828 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2010/08/05 10:20:35.0890 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
2010/08/05 10:20:36.0015 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2010/08/05 10:20:36.0125 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2010/08/05 10:20:36.0250 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2010/08/05 10:20:36.0468 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2010/08/05 10:20:36.0734 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2010/08/05 10:20:37.0000 ialm (48846b31be5a4fa662ccfde7a1ba86b9) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
2010/08/05 10:20:37.0968 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2010/08/05 10:20:38.0765 IntcAzAudAddService (0cacdcbbc8e6f11e2865c47bfc509848) C:\WINDOWS\system32\drivers\RtkHDAud.sys
2010/08/05 10:20:39.0484 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2010/08/05 10:20:39.0718 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2010/08/05 10:20:39.0781 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2010/08/05 10:20:39.0828 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2010/08/05 10:20:40.0031 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2010/08/05 10:20:40.0234 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2010/08/05 10:20:40.0375 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2010/08/05 10:20:40.0562 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2010/08/05 10:20:40.0718 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2010/08/05 10:20:40.0984 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2010/08/05 10:20:41.0187 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2010/08/05 10:20:41.0296 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2010/08/05 10:20:41.0734 LVMVDrv (0dd5b8af4917a2821047450195c511b3) C:\WINDOWS\system32\DRIVERS\LVMVDrv.sys
2010/08/05 10:20:42.0218 LVUSBSta (be5e104be263921d6842c555db6a5c23) C:\WINDOWS\system32\DRIVERS\LVUSBSta.sys
2010/08/05 10:20:42.0359 ManyCam (c6d085c7045200143528136a43a65fde) C:\WINDOWS\system32\DRIVERS\ManyCam.sys
2010/08/05 10:20:42.0609 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2010/08/05 10:20:42.0734 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2010/08/05 10:20:42.0843 Monfilt (9fa7207d1b1adead88ae8eed9cdbbaa5) C:\WINDOWS\system32\drivers\Monfilt.sys
2010/08/05 10:20:42.0984 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2010/08/05 10:20:43.0031 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2010/08/05 10:20:43.0078 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2010/08/05 10:20:43.0125 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2010/08/05 10:20:43.0265 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2010/08/05 10:20:43.0437 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2010/08/05 10:20:43.0500 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2010/08/05 10:20:43.0546 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2010/08/05 10:20:43.0671 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2010/08/05 10:20:43.0734 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2010/08/05 10:20:43.0796 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
2010/08/05 10:20:43.0890 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2010/08/05 10:20:43.0968 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2010/08/05 10:20:44.0093 NDIS (8716356e49a665bdc7b114725b60a456) C:\WINDOWS\system32\drivers\NDIS.sys
2010/08/05 10:20:44.0156 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2010/08/05 10:20:44.0281 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2010/08/05 10:20:44.0328 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2010/08/05 10:20:44.0375 NdisWan (5526cfebb619f7f763bd6a2e1b618078) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2010/08/05 10:20:44.0546 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys
2010/08/05 10:20:44.0703 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2010/08/05 10:20:44.0859 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2010/08/05 10:20:45.0031 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2010/08/05 10:20:45.0234 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2010/08/05 10:20:45.0515 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2010/08/05 10:20:45.0625 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2010/08/05 10:20:45.0828 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2010/08/05 10:20:45.0921 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys
2010/08/05 10:20:46.0031 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2010/08/05 10:20:46.0109 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2010/08/05 10:20:46.0281 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2010/08/05 10:20:46.0375 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2010/08/05 10:20:46.0500 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
2010/08/05 10:20:47.0093 PID_PEPI (0da6c5e0c8da6cebe52daacfe7ae9de6) C:\WINDOWS\system32\DRIVERS\LV302V32.SYS
2010/08/05 10:20:47.0328 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2010/08/05 10:20:47.0390 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2010/08/05 10:20:47.0453 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2010/08/05 10:20:47.0671 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2010/08/05 10:20:47.0953 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2010/08/05 10:20:48.0250 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2010/08/05 10:20:48.0343 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2010/08/05 10:20:48.0468 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2010/08/05 10:20:48.0625 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2010/08/05 10:20:48.0765 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2010/08/05 10:20:48.0953 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2010/08/05 10:20:49.0140 RTL819xp (175653909255b04a3a354155c7c5c665) C:\WINDOWS\system32\DRIVERS\rtl819xp.sys
2010/08/05 10:20:49.0421 RTLE8023xp (cb9310a5a910648d359c99a857e22a54) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
2010/08/05 10:20:49.0609 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2010/08/05 10:20:49.0671 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys
2010/08/05 10:20:49.0812 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2010/08/05 10:20:49.0921 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2010/08/05 10:20:50.0109 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2010/08/05 10:20:50.0203 sptd (cdddec541bc3c96f91ecb48759673505) C:\WINDOWS\system32\Drivers\sptd.sys
2010/08/05 10:20:50.0531 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505
2010/08/05 10:20:50.0546 sptd - detected Locked file (1)
2010/08/05 10:20:50.0703 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2010/08/05 10:20:50.0843 Srv (89220b427890aa1dffd1a02648ae51c3) C:\WINDOWS\system32\DRIVERS\srv.sys
2010/08/05 10:20:51.0000 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2010/08/05 10:20:51.0093 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2010/08/05 10:20:51.0203 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2010/08/05 10:20:51.0437 SynTP (ea447f6db6115e8a32352f9faffa824d) C:\WINDOWS\system32\DRIVERS\SynTP.sys
2010/08/05 10:20:51.0671 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2010/08/05 10:20:51.0953 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2010/08/05 10:20:52.0140 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2010/08/05 10:20:52.0187 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2010/08/05 10:20:52.0406 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2010/08/05 10:20:52.0500 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2010/08/05 10:20:52.0750 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2010/08/05 10:20:52.0828 USBAAPL (4b8a9c16b6d9258ed99c512aecb8c555) C:\WINDOWS\system32\Drivers\usbaapl.sys
2010/08/05 10:20:53.0046 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
2010/08/05 10:20:53.0093 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2010/08/05 10:20:53.0171 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2010/08/05 10:20:53.0296 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2010/08/05 10:20:53.0531 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2010/08/05 10:20:53.0687 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2010/08/05 10:20:53.0843 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2010/08/05 10:20:54.0187 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2010/08/05 10:20:54.0515 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
2010/08/05 10:20:54.0703 usb_rndisx (b6cc50279d6cd28e090a5d33244adc9a) C:\WINDOWS\system32\DRIVERS\usb8023x.sys
2010/08/05 10:20:54.0796 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2010/08/05 10:20:55.0312 VMC33F (c365e0b920b2233001210ec9c324aedc) C:\WINDOWS\system32\Drivers\VMC33F.sys
2010/08/05 10:20:55.0718 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2010/08/05 10:20:56.0062 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2010/08/05 10:20:56.0359 wceusbsh (46a247f6617526afe38b6f12f5512120) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
2010/08/05 10:20:56.0687 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2010/08/05 10:20:57.0125 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
2010/08/05 10:20:57.0421 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2010/08/05 10:20:57.0468 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2010/08/05 10:20:57.0656 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2010/08/05 10:20:57.0765 ================================================================================
2010/08/05 10:20:57.0765 Scan finished
2010/08/05 10:20:57.0765 ================================================================================
2010/08/05 10:20:57.0796 Detected object count: 2
2010/08/05 10:21:24.0406 AFD (a10e52c5f7c0330b4473bd7992ab3995) C:\WINDOWS\System32\drivers\afd.sys
2010/08/05 10:21:24.0406 Suspicious file (Forged): C:\WINDOWS\System32\drivers\afd.sys. Real md5: a10e52c5f7c0330b4473bd7992ab3995, Fake md5: 7e775010ef291da96ad17ca4b17137d7
2010/08/05 10:21:26.0078 Backup copy found, using it..
2010/08/05 10:21:26.0359 C:\WINDOWS\System32\drivers\afd.sys - will be cured after reboot
2010/08/05 10:21:26.0359 Rootkit.Win32.TDSS.tdl3(AFD) - User select action: Cure
2010/08/05 10:21:26.0359 Locked file(sptd) - User select action: Skip
2010/08/05 10:21:32.0437 Deinitialize success


----------



## Rorschach112 (Oct 12, 2008)

any redirects ?


----------



## kottonk1ng (Aug 4, 2010)

No redirects, but anytime I plug my cellphone in via USB it comes up from AVG that autorun.inf has been infected and won't clear.


----------



## Rorschach112 (Oct 12, 2008)

Download *Flash_Disinfector.exe * from *here* and save it to your desktop. 

 Double-click *Flash_Disinfector.exe* to run it and follow any prompts that may appear.
 The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
 Wait until it has finished scanning and then exit the program.
 Reboot your computer when done.

*Note*: _Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you run it. Don't delete this folder...it will help protect your drives from future infection._

Download *OTL* to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Under the Custom Scan box paste this in

*netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32 
%SYSTEMDRIVE%\*.*
%systemroot%\system32\Spool\prtprocs\w32x86\*.*
%systemroot%\*. /mp /s
%systemroot%\System32\config\*.sav 
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.exe
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg 
%systemroot%\*.jpg 
%systemroot%\*.png 
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Update\*.*
CREATERESTOREPOINT
%PROGRAMFILES%\*.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
set /c
*

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. *OTL.Txt* and *Extras.Txt*. These are saved in the same location as OTL.
Please copy *(Edit->Select All, Edit->Copy)* the contents of these files, one at a time


----------



## kottonk1ng (Aug 4, 2010)

I apologize for the delay in my response. It was a loooong weekend. 

I ran the first scan, and noticed it indeed created that folder. The second scan (OTL) only opened/saved OTL.txt and not the extras.txt. I will post below the OTL.txt file. Was I supposed to have my flash drive (my phone) plugged in during the OTL scan? I did not...


----------



## kottonk1ng (Aug 4, 2010)

OTL logfile created on: 8/10/2010 12:57:59 PM - Run 2
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Joe Calderone\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,014.00 Mb Total Physical Memory | 534.00 Mb Available Physical Memory | 53.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 117.05 Gb Total Space | 8.11 Gb Free Space | 6.93% Space Free | Partition Type: NTFS
Drive D: | 25.00 Gb Total Space | 0.15 Gb Free Space | 0.61% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JOE
Current User Name: Joe Calderone
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/08/10 12:36:44 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Joe Calderone\Desktop\OTL.exe
PRC - [2010/07/21 09:10:05 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgemc.exe
PRC - [2010/07/15 15:07:20 | 002,065,760 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exe
PRC - [2010/07/15 15:07:16 | 000,515,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe
PRC - [2010/07/15 15:07:15 | 000,620,896 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe
PRC - [2010/07/15 15:07:11 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe
PRC - [2010/07/15 15:05:40 | 000,723,296 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe
PRC - [2010/07/15 15:05:33 | 001,101,152 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe
PRC - [2010/06/10 21:03:08 | 000,144,176 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/02/25 16:11:04 | 000,856,064 | ---- | M] () -- C:\Program Files\TVersity\Media Server\MediaServer.exe
PRC - [2008/04/14 07:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

========== Modules (SafeList) ==========

MOD - [2010/08/10 12:36:44 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Joe Calderone\Desktop\OTL.exe
MOD - [2008/04/14 07:00:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus(R)
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010/07/21 09:10:05 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgemc.exe -- (avg9emc)
SRV - [2010/07/15 15:07:11 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
SRV - [2010/06/10 21:03:08 | 000,144,176 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/02/25 16:11:04 | 000,856,064 | ---- | M] () [Auto | Running] -- C:\Program Files\TVersity\Media Server\MediaServer.exe -- (TVersityMediaServer)
SRV - [2007/10/19 13:21:16 | 000,141,848 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe -- (LVSrvLauncher)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\PeerGuardian2\pgfilter.sys -- (pgfilter)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\PeerBlock\pbfilter.sys -- (pbfilter)
DRV - [2010/07/15 15:07:19 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX)
DRV - [2010/07/15 15:05:41 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86)
DRV - [2010/06/03 08:50:09 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86)
DRV - [2010/03/02 18:52:14 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2009/07/28 18:55:00 | 000,143,360 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2009/07/01 04:50:00 | 000,237,952 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VMC33F.sys -- (VMC33F)
DRV - [2009/05/23 01:37:50 | 005,082,624 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2009/05/08 03:36:26 | 000,517,504 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rtl819xp.sys -- (RTL819xp) Realtek RTL8190\RTL8192E 802.11n Wireless LAN (Mini-)
DRV - [2008/08/28 13:18:14 | 000,224,736 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP)
DRV - [2008/08/05 22:10:12 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)
DRV - [2008/04/14 07:00:00 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2008/04/14 00:15:14 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2008/02/15 15:12:06 | 005,854,752 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\igxpmp32.sys -- (ialm)
DRV - [2008/01/14 05:06:32 | 000,021,632 | ---- | M] (ManyCam LLC.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ManyCam.sys -- (ManyCam)
DRV - [2007/10/11 21:00:42 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2007/10/11 18:59:02 | 002,142,488 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LVMVdrv.sys -- (LVMVDrv)
DRV - [2007/08/02 11:35:46 | 000,028,672 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ACRUSBTM.SYS -- (ACRUSBTM)
DRV - [2007/05/09 21:47:00 | 001,276,832 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2006/01/04 17:41:48 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)
DRV - [2005/10/26 23:18:05 | 000,004,300 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\MEMIO.SYS -- (DOSMEMIO)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com/ig|http://www.facebook.com/"
FF - prefs.js..extensions.enabledItems: [email protected]:2.0
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: [email protected]:1.0.176.0
FF - prefs.js..extensions.enabledItems: {1CE11043-9A15-4207-A565-0C94C42D590D}:11.3.7.0

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/07/21 09:11:25 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/28 21:57:45 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/26 14:02:33 | 000,000,000 | ---D | M]

[2010/04/07 03:06:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Joe Calderone\Application Data\Mozilla\Extensions
[2009/11/14 18:59:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Joe Calderone\Application Data\Mozilla\Extensions\[email protected]
[2010/07/27 18:41:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Joe Calderone\Application Data\Mozilla\Firefox\Profiles\oxdki706.default\extensions
[2009/11/15 16:46:03 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Joe Calderone\Application Data\Mozilla\Firefox\Profiles\oxdki706.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/11/14 01:41:36 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Documents and Settings\Joe Calderone\Application Data\Mozilla\Firefox\Profiles\oxdki706.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2010/02/18 22:01:38 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Documents and Settings\Joe Calderone\Application Data\Mozilla\Firefox\Profiles\oxdki706.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010/01/10 19:56:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Joe Calderone\Application Data\Mozilla\Firefox\Profiles\oxdki706.default\extensions\[email protected]
[2010/03/23 01:19:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Joe Calderone\Application Data\Mozilla\Firefox\Profiles\oxdki706.default\extensions\[email protected]
[2010/07/27 16:59:14 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/07/27 16:25:49 | 000,000,000 | ---D | M] (Adobe Flash Plugin) -- C:\Program Files\Mozilla Firefox\extensions\{1CE11043-9A15-4207-A565-0C94C42D590D}
[2010/07/19 22:02:07 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/07/08 19:42:30 | 000,036,864 | ---- | M] (Homestead Technologies, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\nphssb.dll

O1 HOSTS File: ([2010/06/10 02:09:30 | 000,403,666 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 13964 more lines...
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Internet Explorer Plugin) - {7922062A-BFDC-4708-9211-F91AAB7D60C7} - C:\WINDOWS\System32\pavwx.dll (Microsoft Corporation)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: jgyo0w = C:\DOCUME~1\JOECAL~1\LOCALS~1\Temp\19aqp.exe File not found
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 36
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = FF FF FF FF [binary data]
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {C32FE9F1-A857-48B0-B7BF-065B5792F28D} http://69.66.205.246/activex/decoder/intel_mpeg4_dec.cab (CAxMP4Dec Class)
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab (Java Plug-in 1.5.0)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} http://69.66.205.246/activex/AMC.cab (AxisMediaControlEmb Class)
O16 - DPF: Microsoft XML Parser for Java file:///C:/WINDOWS/Java/classes/xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.176.11
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Joe Calderone\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Joe Calderone\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/08/10 21:52:51 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2010/08/10 12:37:39 | 000,000,000 | RHSD | M] - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010/08/10 12:37:39 | 000,000,000 | RHSD | M] - D:\autorun.inf -- [ NTFS ]
O33 - MountPoints2\{8503ebc2-a4a8-11de-9def-0026b6003b75}\Shell - "" = AutoRun
O33 - MountPoints2\{8503ebc2-a4a8-11de-9def-0026b6003b75}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{8503ebc2-a4a8-11de-9def-0026b6003b75}\Shell\AutoRun\command - "" = D:\LaunchU3.exe -- File not found
O33 - MountPoints2\{a32ecf10-1931-11df-947e-0026b6003b75}\Shell\AutoRun\command - "" = F:\wd_windows_tools\WDSetup.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

MsConfig - StartUpReg: *ACQTMOUSE* - hkey= - key= - C:\Program Files\Tech\Tilt Mouse Software\4.1\ACQTMAPP.exe ()
MsConfig - StartUpReg: *Adobe ARM* - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: *Adobe Reader Speed Launcher* - hkey= - key= - C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: *ctfmon.exe* - hkey= - key= - File not found
MsConfig - StartUpReg: *Google Update* - hkey= - key= - C:\Documents and Settings\Joe Calderone\Local Settings\Application Data\Google\Update\GoogleUpdate.exe (Google Inc.)
MsConfig - StartUpReg: *Kmetologoce* - hkey= - key= - C:\WINDOWS\WMVAub.DLL File not found
MsConfig - StartUpReg: *RTHDCPL* - hkey= - key= - C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 2
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2

SafeBootMin: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: klmdb.sys - Driver
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: klmdb.sys - Driver
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {8405C2C5-CF8C-4ED4-A8DE-61926AA39EC0} - rundll32 pavwx.dll,laspi
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.UnInstall.PerUser
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - rundll32.exe C:\WINDOWS\system32\Setup\FxsOcm.dll,XP_UninstallProvider
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} - 
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error.
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: msacm.vorbis - C:\WINDOWS\System32\vorbis.acm (HMS http://hp.vector.co.jp/authors/VA012897/)
Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 90 Days ==========

[2010/08/10 12:37:39 | 000,000,000 | RHSD | C] -- C:\autorun.inf
[2010/08/10 12:36:23 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Joe Calderone\Desktop\OTL.exe
[2010/08/05 10:17:35 | 001,196,368 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Joe Calderone\Desktop\TDSSKiller.exe
[2010/08/04 18:49:44 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2010/08/01 21:14:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/08/01 21:13:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/07/27 16:28:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Joe Calderone\Local Settings\Application Data\yvhhpryjs
[2010/07/27 16:25:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Joe Calderone\Application Data\235C68AE7B00A8A4EFDC0A3674EA7625
[2010/07/27 15:04:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Joe Calderone\Application Data\FileZilla
[2010/07/23 16:20:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Joe Calderone\Desktop\BBC
[2010/07/21 10:57:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Joe Calderone\My Documents\The Prep Room
[2010/07/19 22:01:16 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2010/07/18 15:15:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Joe Calderone\Desktop\Mike's
[2010/07/15 15:07:16 | 000,012,536 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2010/07/14 23:18:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Joe Calderone\Application Data\vlc
[2010/07/14 18:44:05 | 000,000,000 | ---D | C] -- C:\49e91b6c6bf4d8f3dd3c
[2010/07/08 19:46:24 | 000,036,864 | ---- | C] (Homestead Technologies, Inc.) -- C:\nphssb.dll
[2010/07/08 19:46:23 | 000,184,320 | ---- | C] (Homestead Technologies, Inc.) -- C:\WINDOWS\System32\OESICore.dll
[2010/07/08 19:46:23 | 000,045,056 | ---- | C] (Homestead Technologies, Inc.) -- C:\WINDOWS\System32\HSSICore.dll
[2010/07/08 19:46:23 | 000,040,960 | ---- | C] (Homestead Technologies) -- C:\WINDOWS\System32\HS_live.ocx
[2010/07/08 19:32:21 | 000,000,000 | ---D | C] -- C:\Program Files\Intuit
[2010/06/20 19:56:30 | 000,281,088 | ---- | C] (Cinematronics) -- C:\WINDOWS\System32\dllcache\pinball.exe
[2010/06/19 03:57:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Joe Calderone\fontconfig
[2010/06/19 00:53:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Joe Calderone\Application Data\Adobe
[2010/06/18 12:44:37 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2010/06/18 12:37:13 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2010/06/18 12:30:05 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2010/06/15 20:59:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/06/15 20:53:50 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2010/05/27 01:08:00 | 000,000,000 | ---D | C] -- C:\Program Files\Lame for Audacity
[2010/05/27 01:07:32 | 000,000,000 | ---D | C] -- C:\Program Files\Audacity
[2010/05/26 23:41:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Joe Calderone\Desktop\BLESTeNATION - Best of BLESTe UNOFFICIAL
[2010/05/25 21:45:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Yahoo!
[2010/05/17 15:00:27 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2010/05/12 18:50:59 | 000,000,000 | ---D | C] -- C:\Temp
[2010/05/12 18:49:27 | 000,000,000 | ---D | C] -- C:\Program Files\Mp4ForHD
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/08/10 12:53:36 | 000,001,278 | ---- | M] () -- C:\WINDOWS\System32\tversity.cookies
[2010/08/10 12:53:01 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/08/10 12:52:57 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/08/10 12:52:54 | 1063,636,992 | -HS- | M] () -- C:\hiberfil.sys
[2010/08/10 12:50:02 | 010,747,904 | ---- | M] () -- C:\Documents and Settings\Joe Calderone\ntuser.dat
[2010/08/10 12:50:02 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Joe Calderone\ntuser.ini
[2010/08/10 12:49:54 | 004,832,902 | -H-- | M] () -- C:\Documents and Settings\Joe Calderone\Local Settings\Application Data\IconCache.db
[2010/08/10 12:36:44 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Joe Calderone\Desktop\OTL.exe
[2010/08/10 12:36:01 | 000,132,597 | ---- | M] () -- C:\Documents and Settings\Joe Calderone\Desktop\Flash_Disinfector.exe
[2010/08/10 12:27:01 | 000,001,010 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2136500912-1439893187-2055801645-1005UA.job
[2010/08/10 11:10:26 | 063,212,602 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/08/09 23:27:01 | 000,000,958 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2136500912-1439893187-2055801645-1005Core.job
[2010/08/09 19:54:01 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/08/05 14:22:02 | 000,234,368 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/08/05 10:42:20 | 000,052,808 | ---- | M] () -- C:\Documents and Settings\Joe Calderone\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/08/04 18:50:25 | 000,002,463 | ---- | M] () -- C:\Documents and Settings\Joe Calderone\Desktop\HiJackThis.lnk
[2010/08/04 15:07:42 | 001,196,368 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Joe Calderone\Desktop\TDSSKiller.exe
[2010/08/03 16:26:12 | 000,000,531 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/08/03 16:26:12 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/08/03 16:26:12 | 000,000,211 | RHS- | M] () -- C:\boot.ini
[2010/08/02 16:21:41 | 000,098,304 | ---- | M] () -- C:\WINDOWS\System32\klgd.bmp
[2010/08/02 16:21:41 | 000,037,458 | ---- | M] () -- C:\WINDOWS\System32\vtpkt
[2010/08/01 21:01:23 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/07/27 16:28:37 | 000,050,298 | ---- | M] () -- C:\WINDOWS\igeteriwedokez.dll
[2010/07/27 16:28:08 | 000,363,520 | ---- | M] () -- C:\Documents and Settings\Joe Calderone\Desktop\rkill.com
[2010/07/27 15:06:15 | 000,002,890 | ---- | M] () -- C:\Documents and Settings\Joe Calderone\welcome.html
[2010/07/15 15:07:19 | 000,243,024 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgtdix.sys
[2010/07/15 15:07:16 | 000,012,536 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgrsstx.dll
[2010/07/15 15:05:41 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgldx86.sys
[2010/07/14 20:43:17 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/07/12 10:15:54 | 000,510,834 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/07/12 10:15:54 | 000,434,266 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/07/12 10:15:54 | 000,068,386 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/07/08 19:42:30 | 000,036,864 | ---- | M] (Homestead Technologies, Inc.) -- C:\nphssb.dll
[2010/07/08 19:42:30 | 000,000,247 | ---- | M] () -- C:\nphssb.xpt
[2010/07/08 19:42:11 | 000,184,320 | ---- | M] (Homestead Technologies, Inc.) -- C:\WINDOWS\System32\OESICore.dll
[2010/07/08 19:42:10 | 000,045,056 | ---- | M] (Homestead Technologies, Inc.) -- C:\WINDOWS\System32\HSSICore.dll
[2010/07/08 19:42:10 | 000,040,960 | ---- | M] (Homestead Technologies) -- C:\WINDOWS\System32\HS_live.ocx
[2010/07/08 19:32:28 | 000,098,136 | ---- | M] () -- C:\WINDOWS\gzip.exe
[2010/07/02 15:18:59 | 000,011,504 | ---- | M] () -- C:\Documents and Settings\Joe Calderone\My Documents\LetterTemplateResume.docx
[2010/07/02 08:24:16 | 000,264,233 | ---- | M] () -- C:\Documents and Settings\Joe Calderone\My Documents\Doc1.docx
[2010/07/01 21:13:34 | 000,021,499 | ---- | M] () -- C:\Documents and Settings\Joe Calderone\My Documents\Joseph A.docx
[2010/06/23 21:29:10 | 000,046,644 | ---- | M] () -- C:\Documents and Settings\Joe Calderone\Desktop\Pledge.docx
[2010/06/23 21:22:02 | 000,023,220 | ---- | M] () -- C:\Documents and Settings\Joe Calderone\Desktop\Doc2.docx
[2010/06/20 19:56:48 | 000,000,800 | ---- | M] () -- C:\Documents and Settings\Joe Calderone\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2010/06/20 19:56:20 | 000,000,057 | ---- | M] () -- C:\WINDOWS\System32\mapisvc.inf
[2010/06/19 03:51:32 | 000,156,160 | ---- | M] () -- C:\Documents and Settings\Joe Calderone\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/15 13:15:42 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\UMDF\Msft_User_WpdMtpDr_01_00_00.Wdf
[2010/06/13 20:07:39 | 000,000,926 | ---- | M] () -- C:\Documents and Settings\Joe Calderone\Desktop\mpTrim PRO.lnk
[2010/06/10 02:09:30 | 000,403,666 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.msn
[2010/06/10 02:09:30 | 000,403,666 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/06/03 08:50:09 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgmfx86.sys
[2010/05/27 01:07:35 | 000,000,630 | ---- | M] () -- C:\Documents and Settings\Joe Calderone\Desktop\Audacity.lnk
[2010/05/20 19:17:48 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/05/12 18:49:50 | 000,000,684 | ---- | M] () -- C:\Documents and Settings\Joe Calderone\Desktop\Mp4ForHD.lnk
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/08/10 12:36:02 | 000,132,597 | ---- | C] () -- C:\Documents and Settings\Joe Calderone\Desktop\Flash_Disinfector.exe
[2010/08/04 18:49:44 | 000,002,463 | ---- | C] () -- C:\Documents and Settings\Joe Calderone\Desktop\HiJackThis.lnk
[2010/08/02 16:21:41 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\klgd.bmp
[2010/08/02 16:21:41 | 000,037,458 | ---- | C] () -- C:\WINDOWS\System32\vtpkt
[2010/07/27 18:38:57 | 1063,636,992 | -HS- | C] () -- C:\hiberfil.sys
[2010/07/27 16:28:36 | 000,050,298 | ---- | C] () -- C:\WINDOWS\igeteriwedokez.dll
[2010/07/27 16:28:08 | 000,363,520 | ---- | C] () -- C:\Documents and Settings\Joe Calderone\Desktop\rkill.com
[2010/07/27 15:06:14 | 000,002,890 | ---- | C] () -- C:\Documents and Settings\Joe Calderone\welcome.html
[2010/07/08 19:46:24 | 000,000,247 | ---- | C] () -- C:\nphssb.xpt
[2010/07/08 19:45:31 | 000,007,315 | ---- | C] () -- C:\WINDOWS\System32\javasup.vxd
[2010/07/08 19:45:31 | 000,006,550 | ---- | C] () -- C:\WINDOWS\jautoexp.dat
[2010/07/08 19:45:16 | 000,000,113 | ---- | C] () -- C:\WINDOWS\System32\zonedon.reg
[2010/07/08 19:45:16 | 000,000,113 | ---- | C] () -- C:\WINDOWS\System32\zonedoff.reg
[2010/07/08 19:42:07 | 000,098,136 | ---- | C] () -- C:\WINDOWS\gzip.exe
[2010/07/02 15:18:59 | 000,011,504 | ---- | C] () -- C:\Documents and Settings\Joe Calderone\My Documents\LetterTemplateResume.docx
[2010/07/02 08:24:13 | 000,264,233 | ---- | C] () -- C:\Documents and Settings\Joe Calderone\My Documents\Doc1.docx
[2010/07/01 18:52:10 | 000,021,499 | ---- | C] () -- C:\Documents and Settings\Joe Calderone\My Documents\Joseph A.docx
[2010/06/23 21:22:01 | 000,023,220 | ---- | C] () -- C:\Documents and Settings\Joe Calderone\Desktop\Doc2.docx
[2010/06/23 20:35:38 | 000,046,644 | ---- | C] () -- C:\Documents and Settings\Joe Calderone\Desktop\Pledge.docx
[2010/06/20 19:56:48 | 000,000,800 | ---- | C] () -- C:\Documents and Settings\Joe Calderone\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2010/06/20 19:56:32 | 000,093,702 | ---- | C] () -- C:\WINDOWS\System32\subrange.uce
[2010/06/20 19:56:32 | 000,065,978 | ---- | C] () -- C:\WINDOWS\Soap Bubbles.bmp
[2010/06/20 19:56:32 | 000,065,954 | ---- | C] () -- C:\WINDOWS\Prairie Wind.bmp
[2010/06/20 19:56:32 | 000,065,832 | ---- | C] () -- C:\WINDOWS\Santa Fe Stucco.bmp
[2010/06/20 19:56:32 | 000,060,458 | ---- | C] () -- C:\WINDOWS\System32\ideograf.uce
[2010/06/20 19:56:32 | 000,026,680 | ---- | C] () -- C:\WINDOWS\River Sumida.bmp
[2010/06/20 19:56:32 | 000,026,582 | ---- | C] () -- C:\WINDOWS\Greenstone.bmp
[2010/06/20 19:56:32 | 000,017,362 | ---- | C] () -- C:\WINDOWS\Rhododendron.bmp
[2010/06/20 19:56:32 | 000,017,336 | ---- | C] () -- C:\WINDOWS\Gone Fishing.bmp
[2010/06/20 19:56:32 | 000,017,062 | ---- | C] () -- C:\WINDOWS\Coffee Bean.bmp
[2010/06/20 19:56:32 | 000,016,740 | ---- | C] () -- C:\WINDOWS\System32\shiftjis.uce
[2010/06/20 19:56:32 | 000,016,730 | ---- | C] () -- C:\WINDOWS\FeatherTexture.bmp
[2010/06/20 19:56:32 | 000,012,876 | ---- | C] () -- C:\WINDOWS\System32\korean.uce
[2010/06/20 19:56:32 | 000,009,522 | ---- | C] () -- C:\WINDOWS\Zapotec.bmp
[2010/06/20 19:56:32 | 000,008,484 | ---- | C] () -- C:\WINDOWS\System32\kanji_2.uce
[2010/06/20 19:56:32 | 000,006,948 | ---- | C] () -- C:\WINDOWS\System32\kanji_1.uce
[2010/06/20 19:56:32 | 000,001,272 | ---- | C] () -- C:\WINDOWS\Blue Lace 16.bmp
[2010/06/20 19:56:31 | 000,024,006 | ---- | C] () -- C:\WINDOWS\System32\gb2312.uce
[2010/06/20 19:56:31 | 000,022,984 | ---- | C] () -- C:\WINDOWS\System32\bopomofo.uce
[2010/06/13 21:37:29 | 000,000,057 | ---- | C] () -- C:\WINDOWS\System32\mapisvc.inf
[2010/06/13 20:07:39 | 000,000,926 | ---- | C] () -- C:\Documents and Settings\Joe Calderone\Desktop\mpTrim PRO.lnk
[2010/05/27 01:07:35 | 000,000,630 | ---- | C] () -- C:\Documents and Settings\Joe Calderone\Desktop\Audacity.lnk
[2010/05/12 18:49:50 | 000,000,684 | ---- | C] () -- C:\Documents and Settings\Joe Calderone\Desktop\Mp4ForHD.lnk
[2010/04/05 13:50:22 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\drivers\ACRUSBTM.SYS
[2010/03/02 18:52:13 | 000,691,696 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2010/01/26 16:25:57 | 000,000,055 | ---- | C] () -- C:\WINDOWS\System32\swfDShare.dll
[2010/01/23 18:26:29 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2010/01/23 18:26:29 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2009/11/14 06:46:40 | 000,001,520 | ---- | C] () -- C:\WINDOWS\System32\Joe Calderone_KBD.ini
[2009/09/18 18:13:59 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2009/08/10 22:05:17 | 000,001,522 | ---- | C] () -- C:\WINDOWS\System32\MagicKBD.INI
[2009/08/10 22:05:17 | 000,001,520 | ---- | C] () -- C:\WINDOWS\System32\Owner_KBD.ini
[2009/08/10 22:00:08 | 000,000,002 | ---- | C] () -- C:\WINDOWS\HotFixList.ini
[2009/08/10 21:59:28 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll
[2009/08/10 21:59:06 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4926.dll
[2009/08/10 21:56:43 | 000,004,300 | ---- | C] () -- C:\WINDOWS\System32\MEMIO.SYS
[2009/08/10 21:24:45 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2007/05/09 20:35:54 | 000,057,126 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2001/05/24 05:38:38 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\HPNVRRes.dll
[2000/04/14 17:50:02 | 000,343,040 | ---- | C] () -- C:\WINDOWS\System32\Lffpx7.dll
[1998/06/11 15:08:06 | 000,095,232 | ---- | C] () -- C:\WINDOWS\System32\Lfkodak.dll

========== LOP Check ==========

[2009/11/14 02:15:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AIM
[2009/11/13 22:03:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2010/03/02 18:51:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
[2010/02/10 19:16:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Native Instruments
[2010/05/09 16:06:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2009/08/10 22:17:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SAMSUNG
[2009/11/14 07:48:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Temp
[2009/11/14 13:35:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinClon
[2009/08/10 21:59:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WLAN
[2010/02/10 19:17:34 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{2ED18044-7049-4E7A-A58D-4017348FCDB7}
[2010/06/15 21:01:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/11/16 19:33:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2010/02/10 19:14:38 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{902029B2-957E-4066-85FA-30DA31731718}
[2010/02/10 19:16:16 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{A215474F-E448-48A8-97F1-14D1C09A4235}
[2010/02/10 19:15:01 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{C59C4281-5384-43B2-9E48-2FA6F8967AB1}
[2010/07/27 16:46:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Joe Calderone\Application Data\235C68AE7B00A8A4EFDC0A3674EA7625
[2009/11/14 02:16:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Joe Calderone\Application Data\acccore
[2010/01/20 01:07:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Joe Calderone\Application Data\AnvSoft
[2010/04/06 14:02:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Joe Calderone\Application Data\com.prezi.PreziDesktop
[2010/03/02 18:56:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Joe Calderone\Application Data\DAEMON Tools Lite
[2010/07/27 15:11:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Joe Calderone\Application Data\FileZilla
[2010/05/06 22:28:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Joe Calderone\Application Data\GetRightToGo
[2010/01/05 12:31:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Joe Calderone\Application Data\iPhoneRingToneMaker
[2010/08/09 19:01:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Joe Calderone\Application Data\LimeWire
[2010/03/28 22:11:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Joe Calderone\Application Data\ManyCam
[2009/12/02 01:22:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Joe Calderone\Application Data\NavNet Solutions
[2010/05/09 16:05:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Joe Calderone\Application Data\NCH Swift Sound
[2010/01/04 14:10:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Joe Calderone\Application Data\SharePod
[2010/08/10 12:40:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Joe Calderone\Application Data\uTorrent

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/05/12 20:30:47 | 000,001,846 | ---- | M] () -- C:\ASLog.txt
[2009/08/10 21:52:51 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2010/08/03 16:26:12 | 000,000,211 | RHS- | M] () -- C:\boot.ini
[2009/08/10 21:52:51 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2010/08/10 12:52:54 | 1063,636,992 | -HS- | M] () -- C:\hiberfil.sys
[2009/08/10 21:52:51 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/03/28 23:56:39 | 000,000,861 | -H-- | M] () -- C:\IPH.PH
[2010/01/04 14:24:38 | 011,944,286 | ---- | M] () -- C:\ituneslib.itl
[2010/07/02 08:23:00 | 000,000,000 | ---- | M] () -- C:\Log.txt
[2010/05/14 17:43:39 | 000,000,109 | ---- | M] () -- C:\mbam-error.txt
[2009/08/10 21:52:51 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2010/07/08 19:42:30 | 000,036,864 | ---- | M] (Homestead Technologies, Inc.) -- C:\nphssb.dll
[2010/07/08 19:42:30 | 000,000,247 | ---- | M] () -- C:\nphssb.xpt
[2008/04/14 07:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/04/14 07:00:00 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2010/08/10 12:52:53 | 1598,029,824 | -HS- | M] () -- C:\pagefile.sys
[2010/08/05 10:18:02 | 000,000,385 | ---- | M] () -- C:\rkill.log
[2009/12/29 18:04:32 | 000,000,091 | ---- | M] () -- C:\setup.log
[2010/08/05 10:21:32 | 000,039,608 | ---- | M] () -- C:\TDSSKiller.2.4.1.0_05.08.2010_10.20.19_log.txt
[2010/08/09 00:32:02 | 000,038,082 | ---- | M] () -- C:\TDSSKiller.2.4.1.0_09.08.2010_00.31.32_log.txt
[2010/08/09 15:25:18 | 000,038,082 | ---- | M] () -- C:\TDSSKiller.2.4.1.0_09.08.2010_15.24.40_log.txt
[2010/01/02 14:22:14 | 000,002,230 | ---- | M] () -- C:\xPos.txt

< %systemroot%\system32\Spool\prtprocs\w32x86\*.* >
[2008/07/06 07:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2007/10/20 19:21:50 | 000,278,016 | ---- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp5mu.dll
[2006/10/26 21:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll
[2008/07/06 05:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2009/08/10 14:43:37 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2009/08/10 14:43:37 | 001,064,960 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2009/08/10 14:43:37 | 000,897,024 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.com >
[2006/06/29 15:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont
[2006/04/18 16:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 15:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 16:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont

< %systemroot%\Fonts\*.exe >

< %systemroot%\Fonts\*.ini >
[2009/08/10 21:52:15 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %APPDATA%\Microsoft\*.* >
[2009/11/23 00:20:00 | 000,001,674 | -H-- | M] () -- C:\Documents and Settings\Joe Calderone\Application Data\Microsoft\LastFlashConfig.WFC

< %PROGRAMFILES%\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Update\*.* >

< %PROGRAMFILES%\*. >
[2009/11/14 13:32:03 | 000,000,000 | ---D | M] -- C:\Program Files\7-Zip
[2009/12/06 14:38:02 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
[2010/03/28 23:55:44 | 000,000,000 | ---D | M] -- C:\Program Files\AIM
[2010/01/20 01:07:24 | 000,000,000 | ---D | M] -- C:\Program Files\AnvSoft
[2010/06/15 20:53:51 | 000,000,000 | ---D | M] -- C:\Program Files\Apple Software Update
[2009/11/14 13:51:14 | 000,000,000 | ---D | M] -- C:\Program Files\ASIO4ALL v2
[2009/08/10 21:59:46 | 000,000,000 | ---D | M] -- C:\Program Files\Atheros WLAN Client
[2010/05/27 01:07:34 | 000,000,000 | ---D | M] -- C:\Program Files\Audacity
[2009/11/13 22:03:42 | 000,000,000 | ---D | M] -- C:\Program Files\AVG
[2010/05/06 20:31:37 | 000,000,000 | ---D | M] -- C:\Program Files\Axis Communications
[2010/06/18 12:30:07 | 000,000,000 | ---D | M] -- C:\Program Files\Bonjour
[2010/08/08 15:18:04 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
[2009/11/14 06:49:52 | 000,000,000 | ---D | M] -- C:\Program Files\CyberLink
[2010/03/02 18:54:12 | 000,000,000 | ---D | M] -- C:\Program Files\DAEMON Tools Lite
[2009/12/14 23:37:03 | 000,000,000 | ---D | M] -- C:\Program Files\DivX
[2010/04/05 17:07:35 | 000,000,000 | ---D | M] -- C:\Program Files\ffdshow
[2009/12/29 18:03:56 | 000,000,000 | ---D | M] -- C:\Program Files\Hewlett-Packard
[2010/01/02 15:07:53 | 000,000,000 | ---D | M] -- C:\Program Files\HP
[2009/11/14 13:51:21 | 000,000,000 | ---D | M] -- C:\Program Files\Image-Line
[2009/11/14 13:38:12 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
[2009/08/10 21:57:15 | 000,000,000 | ---D | M] -- C:\Program Files\Intel
[2010/06/11 03:21:07 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
[2010/07/08 19:32:21 | 000,000,000 | ---D | M] -- C:\Program Files\Intuit
[2010/06/18 12:44:37 | 000,000,000 | ---D | M] -- C:\Program Files\iPod
[2010/06/18 12:45:49 | 000,000,000 | ---D | M] -- C:\Program Files\iTunes
[2009/11/14 18:48:50 | 000,000,000 | ---D | M] -- C:\Program Files\Java
[2010/05/27 01:08:00 | 000,000,000 | ---D | M] -- C:\Program Files\Lame for Audacity
[2009/11/14 17:09:50 | 000,000,000 | ---D | M] -- C:\Program Files\LimeWire
[2010/05/14 17:43:36 | 000,000,000 | ---D | M] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/03/28 22:11:47 | 000,000,000 | ---D | M] -- C:\Program Files\ManyCam 2.4
[2009/12/16 20:02:50 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft
[2010/05/05 13:33:36 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft ActiveSync
[2009/08/10 21:53:03 | 000,000,000 | ---D | M] -- C:\Program Files\microsoft frontpage
[2009/08/10 22:10:41 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Office
[2009/08/10 22:17:12 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Office Activation Assistant for Netbooks
[2010/06/04 14:54:22 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Silverlight
[2009/12/17 22:29:11 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Works
[2010/03/11 15:13:33 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
[2010/07/27 16:57:26 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
[2010/05/13 23:54:48 | 000,000,000 | ---D | M] -- C:\Program Files\Mp4ForHD
[2009/08/10 23:00:22 | 000,000,000 | ---D | M] -- C:\Program Files\MSBuild
[2009/08/10 21:49:26 | 000,000,000 | ---D | M] -- C:\Program Files\MSN Gaming Zone
[2009/08/10 23:20:39 | 000,000,000 | ---D | M] -- C:\Program Files\MSXML 4.0
[2010/02/10 19:16:37 | 000,000,000 | ---D | M] -- C:\Program Files\Native Instruments
[2010/05/25 18:03:30 | 000,000,000 | ---D | M] -- C:\Program Files\NavNet
[2009/08/10 21:50:54 | 000,000,000 | ---D | M] -- C:\Program Files\NetMeeting
[2010/05/11 20:27:17 | 000,000,000 | ---D | M] -- C:\Program Files\Outlook Express
[2009/11/14 13:49:21 | 000,000,000 | ---D | M] -- C:\Program Files\Outsim
[2009/12/06 23:15:36 | 000,000,000 | ---D | M] -- C:\Program Files\PhotoshopPortable
[2010/04/13 10:43:37 | 000,000,000 | ---D | M] -- C:\Program Files\PreziDesktop3
[2010/06/18 12:38:07 | 000,000,000 | ---D | M] -- C:\Program Files\QuickTime
[2009/08/10 21:59:27 | 000,000,000 | ---D | M] -- C:\Program Files\Realtek
[2009/08/10 22:00:48 | 000,000,000 | ---D | M] -- C:\Program Files\REALTEK Wireless LAN Software
[2009/08/10 22:59:57 | 000,000,000 | ---D | M] -- C:\Program Files\Reference Assemblies
[2009/11/14 13:38:12 | 000,000,000 | ---D | M] -- C:\Program Files\Samsung
[2009/11/15 14:49:11 | 000,000,000 | R--D | M] -- C:\Program Files\Skype
[2009/11/30 10:49:39 | 000,000,000 | ---D | M] -- C:\Program Files\Spybot - Search & Destroy
[2009/08/10 22:01:50 | 000,000,000 | ---D | M] -- C:\Program Files\Synaptics
[2010/04/05 13:49:58 | 000,000,000 | ---D | M] -- C:\Program Files\Tech
[2010/08/04 18:49:44 | 000,000,000 | ---D | M] -- C:\Program Files\Trend Micro
[2010/01/12 18:31:26 | 000,000,000 | ---D | M] -- C:\Program Files\TVersity
[2010/04/05 17:07:36 | 000,000,000 | ---D | M] -- C:\Program Files\TVersity Codec Pack
[2009/08/10 21:56:48 | 000,000,000 | -H-D | M] -- C:\Program Files\Uninstall Information
[2010/05/17 15:00:22 | 000,000,000 | ---D | M] -- C:\Program Files\uTorrent
[2009/11/15 15:45:54 | 000,000,000 | ---D | M] -- C:\Program Files\VideoLAN
[2009/08/10 22:00:57 | 000,000,000 | ---D | M] -- C:\Program Files\Vimicro Corporation
[2009/11/23 21:06:24 | 000,000,000 | ---D | M] -- C:\Program Files\VS Revo Group
[2009/11/14 13:50:55 | 000,000,000 | ---D | M] -- C:\Program Files\VstPlugins
[2009/11/13 16:52:24 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Live
[2009/12/16 20:02:26 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Live SkyDrive
[2009/11/14 21:06:48 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Connect 2
[2009/11/14 21:06:46 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Player
[2010/06/20 19:56:36 | 000,000,000 | ---D | M] -- C:\Program Files\Windows NT
[2009/08/10 21:51:13 | 000,000,000 | -H-D | M] -- C:\Program Files\WindowsUpdate
[2009/08/10 21:53:03 | 000,000,000 | ---D | M] -- C:\Program Files\xerox
[2010/05/25 21:45:50 | 000,000,000 | ---D | M] -- C:\Program Files\Yahoo!

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< set /c >
ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Joe Calderone\Application Data
asl.log=Destination=file;OnFirstLog=command,environment
CLASSPATH=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=JOE
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Joe Calderone
LOGONSERVER=\\JOE
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\QuickTime\QTSystem\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 28 Stepping 2, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=1c02
ProgramFiles=C:\Program Files
PROMPT=$P$G
QTJAVA=C:\Program Files\Java\jre6\lib\ext\QTJava.zip
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\JOECAL~1\LOCALS~1\Temp
TMP=C:\DOCUME~1\JOECAL~1\LOCALS~1\Temp
USERDOMAIN=JOE
USERNAME=Joe Calderone
USERPROFILE=C:\Documents and Settings\Joe Calderone
windir=C:\WINDOWS
< End of report >


----------



## Rorschach112 (Oct 12, 2008)

Run OTL

Under the *Custom Scans/Fixes* box at the bottom, paste in the following


```
:OTL
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: jgyo0w =-
O32 - AutoRun File - [2010/08/10 12:37:39 | 000,000,000 | RHSD | M] - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010/08/10 12:37:39 | 000,000,000 | RHSD | M] - D:\autorun.inf -- [ NTFS ]
O33 - MountPoints2\{8503ebc2-a4a8-11de-9def-0026b6003b75}\Shell - "" = AutoRun
O33 - MountPoints2\{8503ebc2-a4a8-11de-9def-0026b6003b75}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{8503ebc2-a4a8-11de-9def-0026b6003b75}\Shell\AutoRun\command - "" = D:\LaunchU3.exe -- File not found
O33 - MountPoints2\{a32ecf10-1931-11df-947e-0026b6003b75}\Shell\AutoRun\command - "" = F:\wd_windows_tools\WDSetup.exe -- File not found
MsConfig - StartUpReg: Kmetologoce - hkey= - key= - C:\WINDOWS\WMVAub.DLL File not found
[2010/07/27 16:28:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Joe Calderone\Local Settings\Application Data\yvhhpryjs
[2010/07/27 16:28:37 | 000,050,298 | ---- | M] () -- C:\WINDOWS\igeteriwedokez.dll
[2010/08/02 16:21:41 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\klgd.bmp
[2010/08/02 16:21:41 | 000,037,458 | ---- | C] () -- C:\WINDOWS\System32\vtpkt

:Services

:Reg

:Files
ipconfig /flushdns /c

:Commands
[purity]
[resethosts]
[emptytemp]
[EMPTYFLASH]
[CREATERESTOREPOINT]
[Reboot]
```

Then click the *Run Fix* button at the top
Let the program run unhindered, reboot the PC when it is done

Download *TFC* to your desktop

Open the file and close any other windows.
It *will close all programs itself* when run, make sure to let it run uninterrupted.
Click the Start button to begin the process. The program should not take long to finish its job
Once its finished it should *reboot your machine*, if not, do this yourself to ensure a complete clean

Please download Malwarebytes' Anti-Malware from *Here*

Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to *Update Malwarebytes' Anti-Malware* and *Launch Malwarebytes' Anti-Malware*, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "*Perform Quick Scan*", then click *Scan*. 
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that *everything is checked*, and click *Remove Selected*.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.
Extra Note:
*If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.*

Go to *Kaspersky website* and perform an online antivirus scan.


Read through the requirements and privacy statement and click on *Accept* button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click *Run*.
When the downloads have finished, click on *Settings*.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the *Save* button:
Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Mail databases

Click on *My Computer* under *Scan*.
Once the scan is complete, it will display the results. Click on *View Scan Report*.
You will see a list of infected items there. Click on *Save Report As...*.
Save this report to a convenient place. Change the *Files of type* to *Text file (.txt)* before clicking on the *Save* button. Then post it here.


----------

