Latest Threads

Loading...
 
  1. Before you start!
    All given instructions in this forum are customized for each help request, the tools used may cause damage if used on a computer with different infections. If you think you have similar issues, please post the appropriate logs in our Malware Removal Assistance forum and wait for help.

    Please be aware that removing Malware is a potentially hazardous undertaking. We will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for us to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and we cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.
    We strongly advise you to backup any personal files and folders before you start.

FBI virus, unable to login using safe boot

Discussion in 'Malware Removal Assistance' started by kar.online, Feb 17, 2013.

Thread Status:
Not open for further replies.
  1. kar.online

    kar.online New Member

    Reputation:
    0
    Joined:
    Feb 17, 2013
    Messages:
    30
    Likes Received:
    0
    Mine is a Toshiba satellite, not sure this helps. anyhow I am worried about my kids photo in this laptop for which I dont have any backup and I need to recover this and I am desperate.
     
  2. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    81
    Hi and welcome to the MalwareTips.com forums!

    I'm Kuttus and I am going to try to assist you with your problem. Please take note of the below:
    • I will start working on your malware issues, this may or may not, solve other issues you have with your machine.
    • The fixes are specific to your problem and should only be used for this issue on this machine!
    • The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear.
    • If you don't know, stop and ask! Don't keep going on.
    • Please reply to this thread. Do not start a new topic.
    • Refrain from running self fixes as this will hinder the malware removal process.
    • It may prove beneficial if you print of the following instructions or save them to notepad as I post them.
    Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.


    Before we start:
    Please be aware that removing malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

    Because of this, I advise you to backup any personal files and folders before you start.
    <hr />
    Can you please try to run a scan with Farbar Recovery Scan Tool. You will need a USB (Flash) pendrive.

    For x32 (x86) bit systems download Farbar Recovery Scan Tooland save it to a flash drive.
    For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

    Plug the flashdrive into the infected PC.

    Enter System Recovery Options.

    To enter System Recovery Options from the Advanced Boot Options:
    • Restart the computer.
    • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
    • Click on Repair your computer menu item.
    • Select US as the keyboard language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account and click Next.
    On the System Recovery Options menu you will get the following options:
    Startup Repair
    System Restore
    Windows Complete PC Restore
    Windows Memory Diagnostic Tool
    Command Prompt

    • Select Command Prompt
    • In the command window type in notepad and press Enter.
    • The notepad opens. Under File menu select Open.
    • Select "Computer" and find your flash drive letter and close the notepad.
    • In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
      Note: Replace letter e with the drive letter of your flash drive.
    • The tool will start to run.
    • When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) in the flash drive. Please copy and paste it to your reply.
     
  3. kar.online

    kar.online New Member

    Reputation:
    0
    Joined:
    Feb 17, 2013
    Messages:
    30
    Likes Received:
    0
    Hi, thanks for the information. Here is the log. One more kind suggestion, guess the above link is broken. Here is the revised link, http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15-02-2013
    Ran by SYSTEM at 17-02-2013 20:30:30
    Running from H:\
    Windows Vista (TM) Home Premium Service Pack 1 (X64) OS Language: English(US)
    The current controlset is ControlSet001

    ==================== Registry (Whitelisted) ===================

    HKLM\...\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide [1584184 2008-01-20] (Microsoft Corporation)
    HKLM\...\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1573160 2008-08-13] (Synaptics, Inc.)
    HKLM\...\Run: [RtHDVCpl] RAVCpl64.exe [x]
    HKLM\...\Run: [Skytel] Skytel.exe [x]
    HKLM\...\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE [431968 2008-02-06] (TOSHIBA Corporation)
    HKLM-x32\...\Run: [NDSTray.exe] NDSTray.exe [x]
    HKLM-x32\...\Run: [cfFncEnabler.exe] cfFncEnabler.exe [x]
    HKLM-x32\...\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [31016 2006-10-27] (Microsoft Corporation)
    HKLM-x32\...\Run: [ccApp] "C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe" [107112 2006-12-07] (Symantec Corporation)
    HKLM-x32\...\Run: [vptray] C:\PROGRA~2\SYMANT~1\VPTray.exe [134808 2006-12-13] (Symantec Corporation)
    HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-11-28] (Apple Inc.)
    HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-24] (Apple Inc.)
    HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\Games-Karthik\iTunesHelper.exe" [152544 2012-12-12] (Apple Inc.)
    HKU\Default\...\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter [2438656 2009-04-10] (Microsoft Corporation)
    HKU\Default\...\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [432640 2008-05-19] (TOSHIBA)
    HKU\Default User\...\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter [2438656 2009-04-10] (Microsoft Corporation)
    HKU\Default User\...\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [432640 2008-05-19] (TOSHIBA)
    HKU\Hikya\...\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
    HKU\Hikya\...\Run: [Google Update] "C:\Users\Hikya\AppData\Local\Google\Update\GoogleUpdate.exe" /c [133104 2008-11-15] (Google Inc.)
    HKU\Hikya\...\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun [18708224 2013-01-08] (Skype Technologies S.A.)
    HKU\Hikya\...\Run: [jxxlryeecvibbrn] C:\ProgramData\jxxlryee.exe [107008 2013-02-09] ()
    HKU\Hikya\...\Run: [mtotuioqo] C:\Users\Hikya\AppData\Roaming\bppclnpvrM [x]
    HKU\Hikya\...\Policies\system: [DisableTaskMgr] 1
    HKLM-x32\...\Winlogon: [Userinit] C:\Windows\SysWOW64\userinit.exe, [25088 2008-01-20] (Microsoft Corporation)
    HKLM\...\Winlogon: [Shell] explorer.exe, C:\Users\Hikya\AppData\Roaming\bppclnpvrM [x ] ()
    Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76

    ==================== Services (Whitelisted) ===================

    2 Basics Service; "C:\Program Files (x86)\Seagate\Basics\Service\SyncServicesBasics.exe" [124280 2007-10-09] (Seagate Technology LLC)
    2 ccEvtMgr; "C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [107624 2006-12-07] (Symantec Corporation)
    2 ccSetMgr; "C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [107624 2006-12-07] (Symantec Corporation)
    2 Crypkey License; crypserv.exe [122880 2008-05-07] (CrypKey (Canada) Ltd.)
    2 Crypkey License; crypserv.exe [69632 2006-02-28] (CrypKey (Canada) Ltd.)
    3 Cwbrxd; C:\Windows\CWBRXD.EXE [65585 2005-06-07] (IBM Corporation)
    2 DefWatch; "C:\Program Files (x86)\Symantec AntiVirus\DefWatch.exe" [30872 2006-12-13] (Symantec Corporation)
    2 gupdate1c9ae3ba4898830; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [133104 2009-03-26] (Google Inc.)
    3 LiveUpdate; "C:\PROGRA~2\Symantec\LIVEUP~1\LUCOMS~1.EXE" [2541248 2006-10-31] (Symantec Corporation)
    3 ServiceLayer; "C:\Program Files (x86)\Common Files\PCSuite\Services\ServiceLayer.exe" [174080 2006-06-05] (Nokia.)
    2 StarWindServiceAE; C:\Program Files (x86)\Games-Karthik\Alcohol 120\StarWind\StarWindServiceAE.exe [275968 2007-05-28] (Rocket Division Software)
    2 Symantec AntiVirus; "C:\Program Files (x86)\Symantec AntiVirus\Rtvscan.exe" [1962136 2006-12-13] (Symantec Corporation)
    2 TNaviSrv; C:\Program Files (x86)\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe [83312 2008-07-18] (TOSHIBA Corporation)
    2 vvdsvc; C:\Windows\SysWow64\nagasoft\vjocx.dll [1685024 2009-03-18] (NanJing Nagasoft Co, LTD.)
    2 Nero BackItUp Scheduler 4.0; C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe [x]

    ==================== Drivers (Whitelisted) =====================

    1 eeCtrl; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-07-31] (Symantec Corporation)
    3 EraserUtilRebootDrv; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2012-07-31] (Symantec Corporation)
    3 hitmanpro36; C:\Windows\System32\Drivers\hitmanpro36.sys [30496 2012-12-06] ()
    3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [114304 2009-10-12] (Huawei Technologies Co., Ltd.)
    2 MySQL; "C:\Program Files (x86)\MySQL\MySQL Server 5.5\bin\mysqld" --defaults-file="C:\Program Files (x86)\MySQL\MySQL Server 5.5\my.ini" MySQL [8919 2012-07-05] ()
    3 NAVENG; \??\C:\PROGRA~3\Symantec\DEFINI~1\VIRUSD~1\20130208.003\ENG64.SYS [126192 2012-12-20] (Symantec Corporation)
    3 NAVEX15; \??\C:\PROGRA~3\Symantec\DEFINI~1\VIRUSD~1\20130208.003\EX64.SYS [2087664 2012-12-20] (Symantec Corporation)
    1 NetworkX; C:\Windows\system32\ckldrv.sys [28664 2008-03-17] ()
    3 Nokia USB Generic; C:\Windows\System32\drivers\nmwcdcx64.sys [12288 2006-05-28] (Nokia)
    3 Nokia USB Modem; C:\Windows\System32\drivers\nmwcdcmx64.sys [17408 2006-05-28] (Nokia)
    3 Nokia USB Phone Parent; C:\Windows\System32\drivers\nmwcdx64.sys [162304 2006-05-28] (Nokia)
    3 Nokia USB Port; C:\Windows\System32\drivers\nmwcdcjx64.sys [17408 2006-05-28] (Nokia)
    0 sptd; C:\Windows\System32\Drivers\sptd.sys [871408 2009-10-02] (Duplex Secure Ltd.)
    1 SRTSP; C:\Windows\System32\Drivers\SRTSP64.SYS [394600 2006-11-22] (Symantec Corporation)
    3 SRTSPL; C:\Windows\System32\Drivers\SRTSPL64.SYS [426392 2006-11-22] (Symantec Corporation)
    1 SRTSPX; C:\Windows\System32\Drivers\SRTSPX64.SYS [30104 2006-11-22] (Symantec Corporation)
    3 SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [156008 2009-09-21] (Symantec Corporation)
    3 u302bus; C:\Windows\System32\Drivers\u302bus.sys [154696 2010-07-29] (MCCI Corporation)
    3 u302mdfl; C:\Windows\System32\Drivers\u302mdfl.sys [19016 2010-07-29] (MCCI Corporation)
    3 u302mdm; C:\Windows\System32\Drivers\u302mdm.sys [175688 2010-07-29] (MCCI Corporation)
    3 u302mgmt; C:\Windows\System32\Drivers\u302mgmt.sys [157256 2010-07-29] (MCCI Corporation)
    3 ztemtusbser; C:\Windows\System32\DRIVERS\CT_ZTEMT_U_USBSER.sys [119040 2008-12-30] (ZTEMT Incorporated)
    3 IpInIp; C:\Windows\System32\DRIVERS\ipinip.sys [x]
    3 NwlnkFlt; C:\Windows\System32\DRIVERS\nwlnkflt.sys [x]
    3 NwlnkFwd; C:\Windows\System32\DRIVERS\nwlnkfwd.sys [x]

    ==================== NetSvcs (Whitelisted) ====================


    ==================== One Month Created Files and Folders ========

    2013-02-17 20:30 - 2013-02-17 20:30 - 00000000 ____D C:\FRST
    2013-02-16 13:41 - 2013-02-16 13:41 - 00000795 ____A C:\Windows\setupact.log
    2013-02-16 13:41 - 2013-02-16 13:41 - 00000000 ____A C:\Windows\setuperr.log
    2013-02-10 20:31 - 2013-02-16 16:09 - 00122512 ____A C:\Users\Hikya\AppData\Roaming\bppclnpvrM.exe
    2013-02-10 20:28 - 2013-02-15 22:25 - 00122512 ____A C:\ProgramData\bppclnpvrM.exe
    2013-02-10 20:20 - 2013-02-10 20:20 - 00000257 ____A C:\Windows\wininit.ini
    2013-02-10 15:31 - 2013-02-16 13:44 - 00017941 ____A C:\Windows\WindowsUpdate.log
    2013-02-09 23:05 - 2013-02-16 15:31 - 00000992 ____A C:\Windows\error.log
    2013-02-09 23:03 - 2013-02-16 15:29 - 00000252 ____A C:\Windows\errord.log
    2013-02-09 23:03 - 2013-02-10 20:25 - 00001726 ____A C:\Windows\PFRO.log
    2013-02-09 22:54 - 2013-02-09 22:54 - 00000000 ____D C:\Users\Hikya\AppData\Roaming\Malwarebytes
    2013-02-09 22:54 - 2013-02-09 22:54 - 00000000 ____D C:\ProgramData\Malwarebytes
    2013-02-09 10:44 - 2013-02-09 10:44 - 00000000 ____D C:\ProgramData\cihtjpwkcmbkitw
    2013-02-09 10:44 - 2013-02-09 10:42 - 00107008 ____A C:\ProgramData\jxxlryee.exe
    2013-02-09 10:42 - 2013-02-09 10:44 - 00108308 ____A C:\ProgramData\bohosuuhibidhgk
    2013-02-04 20:46 - 2013-02-07 19:46 - 00000372 ____A C:\Users\Hikya\Desktop\Texas Address.txt
    2013-02-04 20:45 - 2013-02-04 20:45 - 00000063 ____A C:\Users\Hikya\Documents\Texas Address.txt
    2013-02-04 18:27 - 2013-02-04 18:27 - 00254607 ____A C:\Users\Hikya\Desktop\123
    2013-01-29 12:50 - 2013-01-29 12:51 - 00000000 ___RD C:\Program Files (x86)\Skype

    ==================== One Month Modified Files and Folders =======

    2013-02-17 20:30 - 2013-02-17 20:30 - 00000000 ____D C:\FRST
    2013-02-17 03:01 - 2006-11-02 05:33 - 00000000 ____D C:\Windows\PolicyDefinitions
    2013-02-16 16:09 - 2013-02-10 20:31 - 00122512 ____A C:\Users\Hikya\AppData\Roaming\bppclnpvrM.exe
    2013-02-16 16:09 - 2012-12-06 17:19 - 00122512 ____A C:\Users\Hikya\AppData\Local\bppclnpvrM.exe
    2013-02-16 15:32 - 2009-08-07 05:17 - 00000894 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2013-02-16 15:31 - 2013-02-09 23:05 - 00000992 ____A C:\Windows\error.log
    2013-02-16 15:31 - 2006-11-02 07:22 - 00003616 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
    2013-02-16 15:31 - 2006-11-02 07:22 - 00003616 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
    2013-02-16 15:30 - 2006-11-02 07:42 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
    2013-02-16 15:29 - 2013-02-09 23:03 - 00000252 ____A C:\Windows\errord.log
    2013-02-16 13:44 - 2013-02-10 15:31 - 00017941 ____A C:\Windows\WindowsUpdate.log
    2013-02-16 13:44 - 2009-08-07 05:17 - 00000898 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    2013-02-16 13:41 - 2013-02-16 13:41 - 00000795 ____A C:\Windows\setupact.log
    2013-02-16 13:41 - 2013-02-16 13:41 - 00000000 ____A C:\Windows\setuperr.log
    2013-02-16 13:40 - 2009-08-16 18:47 - 00000908 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-78491554-1894749589-2703256951-1000UA.job
    2013-02-15 22:25 - 2013-02-10 20:28 - 00122512 ____A C:\ProgramData\bppclnpvrM.exe
    2013-02-10 20:25 - 2013-02-09 23:03 - 00001726 ____A C:\Windows\PFRO.log
    2013-02-10 20:20 - 2013-02-10 20:20 - 00000257 ____A C:\Windows\wininit.ini
    2013-02-10 19:29 - 2008-11-14 09:44 - 00001356 ____A C:\Users\Hikya\AppData\Local\d3d9caps.dat
    2013-02-10 18:48 - 2008-11-15 16:32 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
    2013-02-10 18:47 - 2009-08-29 00:46 - 00000000 ____D C:\Program Files (x86)\Games-Karthik
    2013-02-09 22:54 - 2013-02-09 22:54 - 00000000 ____D C:\Users\Hikya\AppData\Roaming\Malwarebytes
    2013-02-09 22:54 - 2013-02-09 22:54 - 00000000 ____D C:\ProgramData\Malwarebytes
    2013-02-09 10:45 - 2008-11-29 10:36 - 00000000 ____D C:\Users\Hikya\AppData\Roaming\Skype
    2013-02-09 10:44 - 2013-02-09 10:44 - 00000000 ____D C:\ProgramData\cihtjpwkcmbkitw
    2013-02-09 10:44 - 2013-02-09 10:42 - 00108308 ____A C:\ProgramData\bohosuuhibidhgk
    2013-02-09 10:42 - 2013-02-09 10:44 - 00107008 ____A C:\ProgramData\jxxlryee.exe
    2013-02-08 21:39 - 2006-11-02 07:42 - 00032584 ____A C:\Windows\Tasks\SCHEDLGU.TXT
    2013-02-07 19:46 - 2013-02-04 20:46 - 00000372 ____A C:\Users\Hikya\Desktop\Texas Address.txt
    2013-02-05 17:05 - 2010-02-17 05:25 - 00000000 ____D C:\Users\Hikya\AppData\Roaming\Mozilla
    2013-02-04 20:45 - 2013-02-04 20:45 - 00000063 ____A C:\Users\Hikya\Documents\Texas Address.txt
    2013-02-04 18:27 - 2013-02-04 18:27 - 00254607 ____A C:\Users\Hikya\Desktop\123
    2013-02-03 22:40 - 2009-08-16 18:47 - 00000856 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-78491554-1894749589-2703256951-1000Core.job
    2013-02-02 13:11 - 2008-11-15 18:01 - 00000000 ____D C:\Karthik
    2013-01-29 12:51 - 2013-01-29 12:50 - 00000000 ___RD C:\Program Files (x86)\Skype
    2013-01-29 12:51 - 2008-11-29 10:23 - 00000000 ____D C:\ProgramData\Skype
    2013-01-27 08:05 - 2009-08-21 03:53 - 00000900 ____A C:\Users\Hikya\Desktop\Notepad.txt
    2013-01-22 22:11 - 2006-11-02 04:46 - 00703516 ____A C:\Windows\System32\PerfStringBackup.INI

    ZeroAccess:
    C:\$Recycle.Bin\S-1-5-21-78491554-1894749589-2703256951-1000\$5fbbc512317b905c33f3cb2547d731ec

    ZeroAccess:
    C:\Users\Hikya\AppData\Local\{5fbbc512-317b-905c-33f3-cb2547d731ec}
    C:\Users\Hikya\AppData\Local\{5fbbc512-317b-905c-33f3-cb2547d731ec}\@
    C:\Users\Hikya\AppData\Local\{5fbbc512-317b-905c-33f3-cb2547d731ec}\L
    C:\Users\Hikya\AppData\Local\{5fbbc512-317b-905c-33f3-cb2547d731ec}\U

    ==================== Known DLLs (Whitelisted) =================


    ==================== Bamital & volsnap Check =================

    C:\Windows\System32\winlogon.exe => MD5 is legit
    C:\Windows\System32\wininit.exe => MD5 is legit
    C:\Windows\SysWOW64\wininit.exe => MD5 is legit
    C:\Windows\explorer.exe => MD5 is legit
    C:\Windows\SysWOW64\explorer.exe => MD5 is legit
    C:\Windows\System32\svchost.exe => MD5 is legit
    C:\Windows\SysWOW64\svchost.exe => MD5 is legit
    C:\Windows\System32\services.exe => MD5 is legit
    C:\Windows\System32\User32.dll => MD5 is legit
    C:\Windows\SysWOW64\User32.dll => MD5 is legit
    C:\Windows\System32\userinit.exe => MD5 is legit
    C:\Windows\SysWOW64\userinit.exe => MD5 is legit
    C:\Windows\System32\Drivers\volsnap.sys
    [2012-12-13 16:57] - [2012-08-21 03:50] - 0267648 ____A (Microsoft Corporation) 582F710097B46140F5A89A19A6573D4B


    ==================== EXE ASSOCIATION =====================

    HKLM\...\.exe: exefile => OK
    HKLM\...\exefile\DefaultIcon: %1 => OK
    HKLM\...\exefile\open\command: "%1" %* => OK

    ==================== Restore Points =========================


    ==================== Memory info ===========================

    Percentage of memory in use: 14%
    Total physical RAM: 3963.07 MB
    Available physical RAM: 3404.99 MB
    Total Pagefile: 3714.57 MB
    Available Pagefile: 3376.2 MB
    Total Virtual: 8192 MB
    Available Virtual: 8191.91 MB

    ==================== Partitions =============================

    1 Drive c: (S3A6747D002) (Fixed) (Total:281.54 GB) (Free:28.26 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
    2 Drive d: () (Fixed) (Total:7.59 GB) (Free:7.53 GB) NTFS
    4 Drive f: (TOSHIBA SYSTEM VOLUME) (Fixed) (Total:1.46 GB) (Free:1.3 GB) NTFS
    6 Drive h: () (Removable) (Total:1.97 GB) (Free:1.97 GB) FAT32
    7 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

    Disk ### Status Size Free Dyn Gpt
    -------- ---------- ------- ------- --- ---
    Disk 0 Online 298 GB 0 B
    Disk 1 No Media 0 B 0 B
    Disk 2 Online 2023 MB 0 B

    Partitions of Disk 0:
    ===============

    Disk ID: 2EDFC607

    Partition ### Type Size Offset
    ------------- ---------------- ------- -------
    Partition 1 OEM 1500 MB 1024 KB
    Partition 2 Primary 282 GB 1501 MB
    Partition 3 Primary 7776 MB 283 GB
    Partition 4 Primary 7675 MB 291 GB

    ==================================================================================

    Disk: 0
    Partition 1
    Type : 27
    Hidden: Yes
    Active: No

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 5 F TOSHIBA SYS NTFS Partition 1500 MB Healthy Hidden

    =========================================================

    Disk: 0
    Partition 2
    Type : 07
    Hidden: No
    Active: Yes

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 1 C S3A6747D002 NTFS Partition 282 GB Healthy

    =========================================================

    Disk: 0
    Partition 3
    Type : 07
    Hidden: No
    Active: No

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 2 D NTFS Partition 7776 MB Healthy

    =========================================================

    Disk: 0
    Partition 4
    Type : 17 (Suspicious Type)
    Hidden: Yes
    Active: No

    There is no volume associated with this partition.

    =========================================================

    Partitions of Disk 2:
    ===============

    Disk ID: 009C7930

    Partition ### Type Size Offset
    ------------- ---------------- ------- -------
    Partition 1 Primary 2022 MB 16 KB

    ==================================================================================

    Disk: 2
    Partition 1
    Type : 0B
    Hidden: No
    Active: Yes

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 4 H FAT32 Removable 2022 MB Healthy

    =========================================================

    Last Boot: 2013-02-10 19:02

    ==================== End Of Log =============================
     
  4. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    81
    Hi Sorry for the later replay was little busy...... Now please download this file and save it to your Flash Drive.
    [attachment=3615]

    Then, boot to system recovery, plug in your flash drive, open FRST and click fix. Post the generated log. Then attempt to boot to normal mode.
     

    Attached Files:

  5. kar.online

    kar.online New Member

    Reputation:
    0
    Joined:
    Feb 17, 2013
    Messages:
    30
    Likes Received:
    0
    Hi once again I thank you for the quick response. Given below the generated log. I tried in normal mode without connecting to the internet and I am able to login but I am suspecting the virus is still there, I could find "Task Manager" is disabled.

    Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 15-02-2013
    Ran by SYSTEM at 2013-02-18 10:10:56 Run:1
    Running from H:\

    ==============================================

    C:\Users\Hikya\AppData\Roaming\bppclnpvrM.exe moved successfully.
    C:\ProgramData\cihtjpwkcmbkitw moved successfully.
    C:\ProgramData\bohosuuhibidhgk moved successfully.
    C:\ProgramData\jxxlryee.exe moved successfully.
    C:\Users\Hikya\AppData\Local\bppclnpvrM.exe moved successfully.
    C:\ProgramData\bppclnpvrM.exe moved successfully.
    C:\Users\Hikya\AppData\Local\d3d9caps.dat moved successfully.
    C:\$Recycle.Bin\S-1-5-21-78491554-1894749589-2703256951-1000\$5fbbc512317b905c33f3cb2547d731ec moved successfully.
    C:\Users\Hikya\AppData\Local\{5fbbc512-317b-905c-33f3-cb2547d731ec} moved successfully.
    C:\Users\Hikya\AppData\Local\{5fbbc512-317b-905c-33f3-cb2547d731ec}\@ not found.
    C:\Users\Hikya\AppData\Local\{5fbbc512-317b-905c-33f3-cb2547d731ec}\L not found.
    C:\Users\Hikya\AppData\Local\{5fbbc512-317b-905c-33f3-cb2547d731ec}\U not found.

    ==== End of Fixlog ====
     
  6. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    81
    Okay Great to hear that the computer is booting Normally now......... :) Try the following steps and send me the log files... There will be some more infections remaining...


    STEP 1: Run a scan with OTL by OldTimer
    <ol><li>Download the OTL utility using the below link :
    <><a title="External link" href="http://oldtimer.geekstogo.com/OTL.exe" rel="nofollow external">OTL DOWNLOAD LINK</a> <em>(This link will automatically download OTL on your computer)</em></></li>
    <li>Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    <img src="http://malwaretips.com/blogs/wp-content/uploads/2012/07/OTL-logo.png" alt="" title="OTL-logo" width="106" height="118" class="alignnone size-full wp-image-3946" /></li>
    <li>When the window appears, <>underneath Output</> at the top change it to <>Minimal Output</>.</li>
    <li>Check the boxes beside <>LOP Check</> and <>Purity Check</>.</li>
    <li>Click the<> Run Scan</> button.
    <img src="http://malwaretips.com/blogs/wp-content/uploads/2012/07/OTL.png" alt="" title="OTL" width="658" height="584" class="alignnone size-full wp-image-3945" /></li>
    <li>When the scan completes, it will open two notepad windows. <>OTL.Txt</> and <>Extras.Txt</>. These are saved in the same location as OTL.
    <>Please post this 2 logs in your first reply.</>.</li></ol>

    Settings You need to Select in OTL
    1. Click the [b]Scan All Users[/b] checkbox.
    2. Change [b]Standard Registry[/b] to [b]All[/b].
    3. Check the boxes beside [b]LOP Check[/b] and [b]Purity Check.[/b]

    <em>Note: If OTL.exe will not run, it may be blocked by malware. Try these alternate versions: <a title="External link" href="http://www.itxassociates.com/OT-Tools/OTL.scr" rel="nofollow external">OTL.scr</a>, or <a title="External link" href="http://oldtimer.geekstogo.com/OTL.com" rel="nofollow external">OTL.com</a>.</em>

    <hr />

    STEP 2: Run Temp File Cleaner by OldTimer
    <ol>
    <li>You can download the TFC utility from the below link
    <a title="External link" href="http://oldtimer.geekstogo.com/TFC.exe" rel="nofollow external"><>TFC DOWNLOAD LINK</></a> <em>(This link will automatically download Temp File Cleaner on your computer)</em></li>
    <li>Please double-click <[b]>TFC.exe</[b]> to run it. (<[b]>Note:</[b]> If you are running on Vista or 7, right-click on the file and choose <[b]>Run As Administrator</[b]>).</li>
    <li>It <[b]>will close all programs</[b]> when run, so make sure you have <[b]>saved all your work</[b]> before you begin.</li>
    <li>Click the <[b]>Start</[b]> button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. <[b]>Let it run uninterrupted to completion</[b]>.</li>
    <li>Once it's finished it should <[b]>reboot your machine</[b]>. If it does not, please <[b]>manually reboot the machine</[b]> yourself to ensure a complete clean.</li>
    </ol>
    <hr />

    [SIZE=4]STEP 3: Repair your Windows Registry from this infection malicious changes.[/SIZE]

    This infection has changed your Windows registry settings so that when you try to start the computer it will load the infections instead of your Windows Desktop.

    [list=1]
    [*] Download the [i][b]WinlogOnFix.reg[/b][/i] file to fix the malicious registry changes from This infection.
    [url=http://malwaretips.com/attachment.php?aid=3172]REGISTRYFIX.REG DOWNLOAD LINK[/url] (This link will automatically download the registry fix called WinlogonFix.reg)
    [*] Double-click on WinlogonFix.reg file to run it. [b]Click “Yes”[/b] for Registry Editor prompt window,then [b]click OK.[/b]
    [/list]
    <hr />[/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b]
     
    Last edited by a moderator: Mar 13, 2014
  7. kar.online

    kar.online New Member

    Reputation:
    0
    Joined:
    Feb 17, 2013
    Messages:
    30
    Likes Received:
    0
    Hi I am able to run th OTL and given below are its entries. I am unable to download the TFC mentioned in step 2 due to some rights issue in my office laptop. So I am trying to seek my friends assistance in downloading it. I have Ccleaner already installed in my machine (installed before the fbi virus impact) will that be ok if I can make use of this to clean the temp files? As I havent completed step 2, step3 is also on hold.


    OTL logfile created on: 18/02/2013 7:15:01 PM - Run 1
    OTL by OldTimer - Version 3.2.69.0 Folder = G:\
    64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
    Internet Explorer (Version = 9.0.8112.16421)
    Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

    3.87 Gb Total Physical Memory | 2.07 Gb Available Physical Memory | 53.45% Memory free
    7.93 Gb Paging File | 6.06 Gb Available in Paging File | 76.32% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
    Drive C: | 281.54 Gb Total Space | 28.25 Gb Free Space | 10.03% Space Free | Partition Type: NTFS
    Drive D: | 7.59 Gb Total Space | 7.53 Gb Free Space | 99.12% Space Free | Partition Type: NTFS
    Drive G: | 1.97 Gb Total Space | 1.97 Gb Free Space | 99.90% Space Free | Partition Type: FAT32

    Computer Name: KARTHIK-RAMYA | User Name: Hikya | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - G:\OTL.exe (OldTimer Tools)
    PRC - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
    PRC - C:\Program Files (x86)\Games-Karthik\iTunesHelper.exe (Apple Inc.)
    PRC - C:\Program Files (x86)\MySQL\MySQL Server 5.5\bin\mysqld.exe ()
    PRC - C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
    PRC - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
    PRC - C:\Program Files (x86)\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation)
    PRC - C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION)
    PRC - C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
    PRC - C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe (TOSHIBA CORPORATION)
    PRC - C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe (TOSHIBA Corporation.)
    PRC - C:\Program Files (x86)\Seagate\Basics\Service\SyncServicesBasics.exe (Seagate Technology LLC)
    PRC - C:\Program Files (x86)\Games-Karthik\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software)
    PRC - C:\Program Files (x86)\Symantec AntiVirus\VPTray.exe (Symantec Corporation)
    PRC - C:\Program Files (x86)\Symantec AntiVirus\Rtvscan.exe (Symantec Corporation)
    PRC - C:\Program Files (x86)\Symantec AntiVirus\DefWatch.exe (Symantec Corporation)
    PRC - C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
    PRC - C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
    PRC - C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)
    PRC - C:\Windows\SysWOW64\Crypserv.exe (CrypKey (Canada) Ltd.)


    ========== Modules (No Company Name) ==========

    MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
    MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()


    ========== Services (SafeList) ==========

    SRV:64bit: - (Crypkey License) -- C:\Windows\SysNative\Crypserv.exe (CrypKey (Canada) Ltd.)
    SRV:64bit: - (SmartFaceVWatchSrv) -- C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatchSrv.exe (Toshiba)
    SRV:64bit: - (TosCoSrv) -- C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
    SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
    SRV:64bit: - (AgereModemAudio) -- C:\Windows\SysNative\agr64svc.exe (Agere Systems)
    SRV:64bit: - (TOSHIBA SMART Log Service) -- C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe (TOSHIBA Corporation)
    SRV:64bit: - (TODDSrv) -- C:\Windows\SysNative\TODDSrv.exe (TOSHIBA Corporation)
    SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
    SRV - (Skype C2C Service) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
    SRV - (MySQL) -- C:\Program Files (x86)\MySQL\MySQL Server 5.5\bin\mysqld.exe ()
    SRV - (TeamViewer7) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
    SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
    SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
    SRV - (vvdsvc) -- C:\Windows\SysWOW64\nagasoft\vjocx.dll (NanJing Nagasoft Co, LTD.)
    SRV - (TNaviSrv) -- C:\Program Files (x86)\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation)
    SRV - (GameConsoleService) -- C:\Program Files (x86)\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe (WildTangent, Inc.)
    SRV - (ConfigFree Service) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
    SRV - (ConfigFree Gadget Service) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe (TOSHIBA Corporation.)
    SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
    SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
    SRV - (Basics Service) -- C:\Program Files (x86)\Seagate\Basics\Service\SyncServicesBasics.exe (Seagate Technology LLC)
    SRV - (StarWindServiceAE) -- C:\Program Files (x86)\Games-Karthik\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software)
    SRV - (Symantec AntiVirus) -- C:\Program Files (x86)\Symantec AntiVirus\Rtvscan.exe (Symantec Corporation)
    SRV - (DefWatch) -- C:\Program Files (x86)\Symantec AntiVirus\DefWatch.exe (Symantec Corporation)
    SRV - (ccSetMgr) -- C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
    SRV - (ccEvtMgr) -- C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
    SRV - (LiveUpdate) -- C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_2.EXE (Symantec Corporation)
    SRV - (UleadBurningHelper) -- C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)
    SRV - (ServiceLayer) -- C:\Program Files (x86)\Common Files\PCSuite\Services\ServiceLayer.exe (Nokia.)
    SRV - (Crypkey License) -- C:\Windows\SysWow64\Crypserv.exe (CrypKey (Canada) Ltd.)
    SRV - (Cwbrxd) -- C:\Windows\cwbrxd.exe (IBM Corporation)


    ========== Driver Services (SafeList) ==========

    DRV:64bit: - (hitmanpro36) -- C:\Windows\SysNative\drivers\hitmanpro36.sys ()
    DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\Drivers\usbaapl64.sys (Apple, Inc.)
    DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys (GEAR Software Inc.)
    DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
    DRV:64bit: - (ssadmdm) -- C:\Windows\SysNative\DRIVERS\ssadmdm.sys (MCCI Corporation)
    DRV:64bit: - (ssadbus) -- C:\Windows\SysNative\DRIVERS\ssadbus.sys (MCCI Corporation)
    DRV:64bit: - (ssadserd) -- C:\Windows\SysNative\DRIVERS\ssadserd.sys (MCCI Corporation)
    DRV:64bit: - (ssadmdfl) -- C:\Windows\SysNative\DRIVERS\ssadmdfl.sys (MCCI Corporation)
    DRV:64bit: - (androidusb) -- C:\Windows\SysNative\Drivers\ssadadb.sys (Google Inc)
    DRV:64bit: - (u302mdm) -- C:\Windows\SysNative\DRIVERS\u302mdm.sys (MCCI Corporation)
    DRV:64bit: - (u302mgmt) -- C:\Windows\SysNative\DRIVERS\u302mgmt.sys (MCCI Corporation)
    DRV:64bit: - (u302bus) -- C:\Windows\SysNative\DRIVERS\u302bus.sys (MCCI Corporation)
    DRV:64bit: - (u302mdfl) -- C:\Windows\SysNative\DRIVERS\u302mdfl.sys (MCCI Corporation)
    DRV:64bit: - (RTL8169) -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys (Realtek )
    DRV:64bit: - (hwusbdev) -- C:\Windows\SysNative\DRIVERS\ewusbdev.sys (Huawei Technologies Co., Ltd.)
    DRV:64bit: - (sptd) -- C:\Windows\SysNative\Drivers\sptd.sys ()
    DRV:64bit: - (WpdUsb) -- C:\Windows\SysNative\DRIVERS\wpdusb.sys (Microsoft Corporation)
    DRV:64bit: - (SymEvent) -- C:\Windows\SysNative\Drivers\SYMEVENT64x86.SYS (Symantec Corporation)
    DRV:64bit: - (hwdatacard) -- C:\Windows\SysNative\DRIVERS\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
    DRV:64bit: - (usb_rndisx) -- C:\Windows\SysNative\DRIVERS\usb8023x.sys (Microsoft Corporation)
    DRV:64bit: - (ztemtusbser) -- C:\Windows\SysNative\DRIVERS\CT_ZTEMT_U_USBSER.sys (ZTEMT Incorporated)
    DRV:64bit: - (NETw5v64) -- C:\Windows\SysNative\DRIVERS\NETw5v64.sys (Intel Corporation)
    DRV:64bit: - (SynTP) -- C:\Windows\SysNative\DRIVERS\SynTP.sys (Synaptics, Inc.)
    DRV:64bit: - (tos_sps64) -- C:\Windows\SysNative\DRIVERS\tos_sps64.sys (TOSHIBA Corporation)
    DRV:64bit: - (igfx) -- C:\Windows\SysNative\DRIVERS\igdkmd64.sys (Intel Corporation)
    DRV:64bit: - (iaStor) -- C:\Windows\SysNative\DRIVERS\iaStor.sys (Intel Corporation)
    DRV:64bit: - (RTSTOR) -- C:\Windows\SysNative\drivers\RTSTOR64.SYS (Realtek Semiconductor Corp.)
    DRV:64bit: - (NetworkX) -- C:\Windows\SysNative\ckldrv.sys ()
    DRV:64bit: - (AgereSoftModem) -- C:\Windows\SysNative\DRIVERS\agrsm64.sys (Agere Systems)
    DRV:64bit: - (UVCFTR) -- C:\Windows\SysNative\Drivers\UVCFTR_S.SYS (Chicony Electronics Co., Ltd.)
    DRV:64bit: - (tdcmdpst) -- C:\Windows\SysNative\DRIVERS\tdcmdpst.sys (TOSHIBA Corporation.)
    DRV:64bit: - (TVALZ) -- C:\Windows\SysNative\DRIVERS\TVALZ_O.SYS (TOSHIBA Corporation)
    DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\Drivers\PxHlpa64.sys (Sonic Solutions)
    DRV:64bit: - (SRTSPL) -- C:\Windows\SysNative\Drivers\SRTSPL64.SYS (Symantec Corporation)
    DRV:64bit: - (SRTSP) -- C:\Windows\SysNative\Drivers\SRTSP64.SYS (Symantec Corporation)
    DRV:64bit: - (SRTSPX) -- C:\Windows\SysNative\Drivers\SRTSPX64.SYS (Symantec Corporation)
    DRV:64bit: - (FwLnk) -- C:\Windows\SysNative\DRIVERS\FwLnk.sys (TOSHIBA Corporation)
    DRV:64bit: - (Nokia USB Phone Parent) -- C:\Windows\SysNative\drivers\nmwcdx64.sys (Nokia)
    DRV:64bit: - (Nokia USB Port) -- C:\Windows\SysNative\drivers\nmwcdcjx64.sys (Nokia)
    DRV:64bit: - (Nokia USB Modem) -- C:\Windows\SysNative\drivers\nmwcdcmx64.sys (Nokia)
    DRV:64bit: - (Nokia USB Generic) -- C:\Windows\SysNative\drivers\nmwcdcx64.sys (Nokia)
    DRV - (NAVEX15) -- C:\ProgramData\Symantec\Definitions\VirusDefs\20130208.003\EX64.SYS (Symantec Corporation)
    DRV - (NAVENG) -- C:\ProgramData\Symantec\Definitions\VirusDefs\20130208.003\ENG64.SYS (Symantec Corporation)
    DRV - (EraserUtilRebootDrv) -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
    DRV - (eeCtrl) -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
    DRV - (SRTSPL) -- C:\Windows\SysWOW64\drivers\srtspl64.sys (Symantec Corporation)
    DRV - (SRTSP) -- C:\Windows\SysWOW64\drivers\srtsp64.sys (Symantec Corporation)
    DRV - (SRTSPX) -- C:\Windows\SysWOW64\drivers\srtspx64.sys (Symantec Corporation)
    DRV - (NetworkX) -- C:\Windows\SysWOW64\Ckldrv.sys ()


    ========== Standard Registry (All) ==========


    ========== Internet Explorer ==========

    IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.shoptoshiba.ca/welcome
    IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
    IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
    IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm
    IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
    IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.shoptoshiba.ca/welcome
    IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {87394793-8317-426A-A380-443282519A7D}
    IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
    IE:64bit: - HKLM\..\SearchScopes\{87394793-8317-426A-A380-443282519A7D}: "URL" = http://www.google.ca/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7TSHC
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://securityresponse.symantec.com/avcenter/fix_homepage/
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://securityresponse.symantec.com/avcenter/fix_homepage/
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://securityresponse.symantec.com/avcenter/fix_homepage/
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage/
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaults/cs/msgr9/*http://www.yahoo.com/ext/search/search.html
    IE - HKLM\..\SearchScopes,DefaultScope = {87394793-8317-426A-A380-443282519A7D}
    IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
    IE - HKLM\..\SearchScopes\{87394793-8317-426A-A380-443282519A7D}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7TSHC


    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage
    IE - HKU\S-1-5-19\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation)

    IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage
    IE - HKU\S-1-5-20\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation)

    IE - HKU\S-1-5-21-78491554-1894749589-2703256951-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = C:\Karthik\Temporary\Download
    IE - HKU\S-1-5-21-78491554-1894749589-2703256951-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
    IE - HKU\S-1-5-21-78491554-1894749589-2703256951-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
    IE - HKU\S-1-5-21-78491554-1894749589-2703256951-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
    IE - HKU\S-1-5-21-78491554-1894749589-2703256951-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
    IE - HKU\S-1-5-21-78491554-1894749589-2703256951-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
    IE - HKU\S-1-5-21-78491554-1894749589-2703256951-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
    IE - HKU\S-1-5-21-78491554-1894749589-2703256951-1000\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation)
    IE - HKU\S-1-5-21-78491554-1894749589-2703256951-1000\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found
    IE - HKU\S-1-5-21-78491554-1894749589-2703256951-1000\..\SearchScopes,DefaultScope = {87394793-8317-426A-A380-443282519A7D}
    IE - HKU\S-1-5-21-78491554-1894749589-2703256951-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
    IE - HKU\S-1-5-21-78491554-1894749589-2703256951-1000\..\SearchScopes\{87394793-8317-426A-A380-443282519A7D}: "URL" = http://www.google.co.in/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLL_en
    IE - HKU\S-1-5-21-78491554-1894749589-2703256951-1000\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?p={searchTerms}
    IE - HKU\S-1-5-21-78491554-1894749589-2703256951-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKU\S-1-5-21-78491554-1894749589-2703256951-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

    ========== FireFox ==========

    FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
    FF - prefs.js..extensions.enabledAddons: {972ce4c6-7e08-4474-a285-3208198ce6fd}:16.0.2
    FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:1.2.1
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}:6.0.19
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
    FF - prefs.js..extensions.enabledItems: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}:5.9
    FF - prefs.js..extensions.enabledItems: OneClickDownload@OneClickDownload.com:1.0
    FF - prefs.js..extensions.enabledItems: plugin@videofiledownload.com:1.5
    FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.28


    FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found
    FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\system32\npDeployJava1.dll File not found
    FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.0: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\Games-Karthik\Mozilla Plugins\npitunes.dll ()
    FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
    FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll File not found
    FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
    FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
    FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\Hikya\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
    FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\Hikya\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
    FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Hikya\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
    FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Hikya\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/09/03 08:33:15 | 000,000,000 | ---D | M]

    [2010/02/20 23:31:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hikya\AppData\Roaming\Mozilla\Extensions
    [2010/02/20 23:31:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hikya\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
    [2012/07/04 23:24:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hikya\AppData\Roaming\Mozilla\Firefox\Profiles\extensions
    [2012/10/23 08:14:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hikya\AppData\Roaming\Mozilla\Firefox\Profiles\ga08p41b.default\extensions
    [2010/05/09 22:33:45 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Hikya\AppData\Roaming\Mozilla\Firefox\Profiles\ga08p41b.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    [2012/10/07 07:01:23 | 000,000,000 | ---D | M] (OneClickDownloader) -- C:\Users\Hikya\AppData\Roaming\Mozilla\Firefox\Profiles\ga08p41b.default\extensions\OneClickDownload@OneClickDownload.com
    [2012/07/04 22:57:59 | 000,000,000 | ---D | M] (VideoFileDownload - Download YouTube Videos) -- C:\Users\Hikya\AppData\Roaming\Mozilla\Firefox\Profiles\ga08p41b.default\extensions\plugin@videofiledownload.com
    [2012/08/30 07:03:39 | 000,199,396 | ---- | M] () (No name found) -- C:\Users\Hikya\AppData\Roaming\Mozilla\Firefox\Profiles\ga08p41b.default\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi

    O1 HOSTS File: ([2006/09/19 03:07:24 | 000,000,761 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
    O1 - Hosts: 127.0.0.1 localhost
    O1 - Hosts: ::1 localhost
    O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
    O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
    O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
    O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
    O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
    O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
    O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No CLSID value found.
    O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found.
    O3 - HKU\S-1-5-21-78491554-1894749589-2703256951-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
    O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
    O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
    O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
    O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Windows\RAVCpl64.exe (Realtek Semiconductor)
    O4:64bit: - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
    O4:64bit: - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
    O4:64bit: - HKLM..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
    O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
    O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
    O4 - HKLM..\Run: [ccApp] C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
    O4 - HKLM..\Run: [cfFncEnabler.exe] cfFncEnabler.exe File not found
    O4 - HKLM..\Run: [GrooveMonitor] C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
    O4 - HKLM..\Run: [iTunesHelper] C:\Program Files (x86)\Games-Karthik\iTunesHelper.exe (Apple Inc.)
    O4 - HKLM..\Run: [NDSTray.exe] NDSTray.exe File not found
    O4 - HKLM..\Run: [QuickTime Task] C:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.)
    O4 - HKLM..\Run: [vptray] C:\Program Files (x86)\Symantec AntiVirus\VPTray.exe (Symantec Corporation)
    O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
    O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
    O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
    O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
    O4 - HKU\S-1-5-21-78491554-1894749589-2703256951-1000..\Run: [Google Update] C:\Users\Hikya\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
    O4 - HKU\S-1-5-21-78491554-1894749589-2703256951-1000..\Run: [jxxlryeecvibbrn] C:\ProgramData\jxxlryee.exe File not found
    O4 - HKU\S-1-5-21-78491554-1894749589-2703256951-1000..\Run: [mtotuioqo] C:\Users\Hikya\AppData\Roaming\bppclnpvrM File not found
    O4 - HKU\S-1-5-21-78491554-1894749589-2703256951-1000..\Run: [Skype] C:\Program Files (x86)\Skype\Phone\Skype.exe (Skype Technologies S.A.)
    O4 - HKU\S-1-5-21-78491554-1894749589-2703256951-1000..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ForceActiveDesktopOn = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: BindDirectlyToPropertySetStorage = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
    O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
    O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRun = 0
    O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NofolderOptions = 0
    O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
    O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
    O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRun = 0
    O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NofolderOptions = 0
    O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
    O7 - HKU\S-1-5-21-78491554-1894749589-2703256951-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
    O7 - HKU\S-1-5-21-78491554-1894749589-2703256951-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRun = 0
    O7 - HKU\S-1-5-21-78491554-1894749589-2703256951-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NofolderOptions = 0
    O7 - HKU\S-1-5-21-78491554-1894749589-2703256951-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
    O7 - HKU\S-1-5-21-78491554-1894749589-2703256951-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
    O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
    O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
    O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
    O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files (x86)\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
    O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
    O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000001 [] - C:\Windows\SysNative\NLAapi.dll (Microsoft Corporation)
    O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000002 [] - C:\Windows\SysNative\napinsp.dll (Microsoft Corporation)
    O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000003 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation)
    O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000004 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation)
    O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
    O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Windows\SysNative\winrnr.dll (Microsoft Corporation)
    O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
    O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
    O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
    O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
    O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
    O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
    O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
    O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
    O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
    O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\SysWOW64\nlaapi.dll (Microsoft Corporation)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\SysWOW64\NapiNSP.dll (Microsoft Corporation)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\SysWOW64\winrnr.dll (Microsoft Corporation)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
    O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
    O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
    O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
    O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
    O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
    O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
    O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
    O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
    O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
    O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
    O1364bit: - gopher Prefix: missing
    O13 - gopher Prefix: missing
    O16 - DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} http://picasaweb.google.ca/s/v/56.39/uploader2.cab (UploadListView Class)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O16 - DPF: {B6648EB8-2460-484F-9255-9654454C4C70} https://ouvpn.us.oracle.com/prx/000/http/localhost/arr_x.cab (ArrVPNAX Control)
    O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {D4003189-95B1-4A2F-9A87-F2B03665960D} http://www.cric7.com/vjocx-en-black.cab (VodClient Control Class)
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.75.75 75.75.76.76
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E148467B-D1C6-47F7-BEC4-9796F4D18F0D}: DhcpNameServer = 75.75.75.75 75.75.76.76
    O18:64bit: - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
    O18:64bit: - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
    O18:64bit: - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysNative\msvidctl.dll (Microsoft Corporation)
    O18:64bit: - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
    O18:64bit: - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
    O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
    O18:64bit: - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
    O18:64bit: - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
    O18:64bit: - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation)
    O18:64bit: - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
    O18:64bit: - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
    O18:64bit: - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
    O18:64bit: - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysNative\inetcomm.dll (Microsoft Corporation)
    O18:64bit: - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
    O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
    O18:64bit: - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation)
    O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
    O18:64bit: - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
    O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
    O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
    O18:64bit: - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysNative\msvidctl.dll (Microsoft Corporation)
    O18:64bit: - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
    O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
    O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
    O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation)
    O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
    O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
    O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
    O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
    O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
    O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation)
    O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
    O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
    O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
    O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysWOW64\inetcomm.dll (Microsoft Corporation)
    O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
    O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files (x86)\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
    O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation)
    O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files (x86)\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
    O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
    O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation)
    O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
    O18:64bit: - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)
    O18:64bit: - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)
    O18:64bit: - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)
    O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
    O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation)
    O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation)
    O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation)
    O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
    O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
    O20:64bit: - HKLM Winlogon: Shell - (C:\Users\Hikya\AppData\Roaming\bppclnpvrM) - File not found
    O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
    O20:64bit: - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\Windows\SysNative\shell32.dll (Microsoft Corporation)
    O20:64bit: - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\Windows\SysNative\sysdm.cpl (Microsoft Corporation)
    O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: UserInit - (C:\Windows\SysWOW64\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\Windows\SysWow64\shell32.dll (Microsoft Corporation)
    O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\Windows\SysWow64\sysdm.cpl (Microsoft Corporation)
    O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
    O20 - Winlogon\Notify\igfxcui: DllName - (Reg Error: Value error.) - Reg Error: Value error. File not found
    O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\SysNative\webcheck.dll (Microsoft Corporation)
    O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\SysWOW64\webcheck.dll (Microsoft Corporation)
    O22:64bit: - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\Windows\SysNative\browseui.dll (Microsoft Corporation)
    O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\Windows\SysWOW64\browseui.dll (Microsoft Corporation)
    O24 - Desktop WallPaper: C:\Users\Hikya\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
    O24 - Desktop BackupWallPaper: C:\Users\Hikya\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
    O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
    O29:64bit: - HKLM SecurityProviders - (credssp.dll) - C:\Windows\SysWow64\credssp.dll (Microsoft Corporation)
    O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\SysWow64\credssp.dll (Microsoft Corporation)
    O30:64bit: - LSA: Authentication Packages - (msv1_0) - C:\Windows\SysNative\msv1_0.dll (Microsoft Corporation)
    O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\SysWow64\msv1_0.dll (Microsoft Corporation)
    O30:64bit: - LSA: Security Packages - (kerberos) - C:\Windows\SysNative\kerberos.dll (Microsoft Corporation)
    O30:64bit: - LSA: Security Packages - (msv1_0) - C:\Windows\SysNative\msv1_0.dll (Microsoft Corporation)
    O30:64bit: - LSA: Security Packages - (schannel) - C:\Windows\SysNative\schannel.dll (Microsoft Corporation)
    O30:64bit: - LSA: Security Packages - (wdigest) - C:\Windows\SysNative\wdigest.dll (Microsoft Corporation)
    O30:64bit: - LSA: Security Packages - (tspkg) - C:\Windows\SysNative\tspkg.dll (Microsoft Corporation)
    O30 - LSA: Security Packages - (kerberos) - C:\Windows\SysWow64\kerberos.dll (Microsoft Corporation)
    O30 - LSA: Security Packages - (msv1_0) - C:\Windows\SysWow64\msv1_0.dll (Microsoft Corporation)
    O30 - LSA: Security Packages - (schannel) - C:\Windows\SysWow64\schannel.dll (Microsoft Corporation)
    O30 - LSA: Security Packages - (wdigest) - C:\Windows\SysWow64\wdigest.dll (Microsoft Corporation)
    O30 - LSA: Security Packages - (tspkg) - C:\Windows\SysWow64\tspkg.dll (Microsoft Corporation)
    O31 - SafeBoot: AlternateShell - cmd.exe
    O32 - HKLM CDRom: AutoRun - 1
    O33 - MountPoints2\{18e36b05-85d1-11df-9b4b-00215d7f7f2c}\Shell\AutoRun\command - "" = F:\System\S-9-2-31-1362473401-1511494837-8365036723-1493\autorun.exe
    O33 - MountPoints2\{18e36b05-85d1-11df-9b4b-00215d7f7f2c}\Shell\open\command - "" = F:\System\S-9-2-31-1362473401-1511494837-8365036723-1493\autorun.exe
    O33 - MountPoints2\{1d2a6a9e-7dda-11e0-a590-00215d7f7f2c}\Shell - "" = AutoRun
    O33 - MountPoints2\{1d2a6a9e-7dda-11e0-a590-00215d7f7f2c}\Shell\AutoRun\command - "" = F:\AutoRun.exe
    O33 - MountPoints2\{20702811-f3c1-11de-81d7-00215d7f7f2c}\Shell\Auto\Command - "" = wscript.exe Rahul'sVirusprotection.vbe
    O33 - MountPoints2\{20702811-f3c1-11de-81d7-00215d7f7f2c}\Shell\AutoRun\command - "" = wscript.exe Rahul'sVirusprotection.vbe
    O33 - MountPoints2\{20702811-f3c1-11de-81d7-00215d7f7f2c}\Shell\Explore\Command - "" = wscript.exe Rahul'sVirusprotection.vbe
    O33 - MountPoints2\{20702811-f3c1-11de-81d7-00215d7f7f2c}\Shell\Find\Command - "" = wscript.exe Rahul'sVirusprotection.vbe
    O33 - MountPoints2\{20702811-f3c1-11de-81d7-00215d7f7f2c}\Shell\Format...\Command - "" = wscript.exe Rahul'sVirusprotection.vbe
    O33 - MountPoints2\{20702811-f3c1-11de-81d7-00215d7f7f2c}\Shell\open\Command - "" = wscript.exe Rahul'sVirusprotection.vbe
    O33 - MountPoints2\{4694c796-7dd5-11e0-ada5-00215d7f7f2c}\Shell - "" = AutoRun
    O33 - MountPoints2\{4694c796-7dd5-11e0-ada5-00215d7f7f2c}\Shell\AutoRun\command - "" = F:\AutoRun.exe
    O33 - MountPoints2\{5e42613a-7b27-11e0-a69e-00215d7f7f2c}\Shell - "" = AutoRun
    O33 - MountPoints2\{5e42613a-7b27-11e0-a69e-00215d7f7f2c}\Shell\AutoRun\command - "" = F:\AutoRun.exe
    O33 - MountPoints2\{5e42615e-7b27-11e0-a69e-00215d7f7f2c}\Shell - "" = AutoRun
    O33 - MountPoints2\{5e42615e-7b27-11e0-a69e-00215d7f7f2c}\Shell\AutoRun\command - "" = F:\AutoRun.exe
    O33 - MountPoints2\{64e17ea0-da55-11e1-ba0a-977999d22f9d}\Shell - "" = AutoRun
    O33 - MountPoints2\{64e17ea0-da55-11e1-ba0a-977999d22f9d}\Shell\AutoRun\command - "" = F:\AutoRun.exe
    O33 - MountPoints2\{8a31ff4e-a790-11e0-af02-00215d7f7f2c}\Shell - "" = AutoRun
    O33 - MountPoints2\{8a31ff4e-a790-11e0-af02-00215d7f7f2c}\Shell\AutoRun\command - "" = F:\Setup.exe /Auto
    O33 - MountPoints2\{9fd60d76-e33e-11de-86a0-001e336c8121}\Shell - "" = AutoRun
    O33 - MountPoints2\{9fd60d76-e33e-11de-86a0-001e336c8121}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
    O33 - MountPoints2\{be618703-b6ab-11dd-984e-001e336c8121}\Shell - "" = Autorun
    O33 - MountPoints2\{be618703-b6ab-11dd-984e-001e336c8121}\Shell\AutoRun\command - "" = SVICHOSSST.exe
    O33 - MountPoints2\{be618703-b6ab-11dd-984e-001e336c8121}\Shell\Open\command - "" = SVICHOSSST.exe
    O33 - MountPoints2\{be618706-b6ab-11dd-984e-001e336c8121}\Shell - "" = AutoRun
    O33 - MountPoints2\{be618706-b6ab-11dd-984e-001e336c8121}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
    O33 - MountPoints2\{c7bb4089-8b09-11df-a301-00215d7f7f2c}\Shell - "" = AutoRun
    O33 - MountPoints2\{c7bb4089-8b09-11df-a301-00215d7f7f2c}\Shell\AutoRun\command - "" = F:\AutoRun.exe
    O33 - MountPoints2\{c7bb40b3-8b09-11df-a301-001e336c8121}\Shell - "" = AutoRun
    O33 - MountPoints2\{c7bb40b3-8b09-11df-a301-001e336c8121}\Shell\AutoRun\command - "" = F:\AutoRun.exe
    O33 - MountPoints2\{c7bb4176-8b09-11df-a301-001e336c8121}\Shell - "" = AutoRun
    O33 - MountPoints2\{c7bb4176-8b09-11df-a301-001e336c8121}\Shell\AutoRun\command - "" = F:\AutoRun.exe
    O33 - MountPoints2\{ce4f70f4-7b75-11de-beee-00215d7f7f2c}\Shell - "" = AutoRun
    O33 - MountPoints2\{ce4f70f4-7b75-11de-beee-00215d7f7f2c}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
    O34 - HKLM BootExecute: (autocheck autochk *)
    O35:64bit: - HKLM\..comfile [open] -- "%1" %*
    O35:64bit: - HKLM\..exefile [open] -- "%1" %*
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
    O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
    O37 - HKLM\...com [@ = comfile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*
    O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
    O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

    ========== Files/Folders - Created Within 30 Days ==========

    [2013/02/18 10:00:17 | 000,000,000 | ---D | C] -- C:\FRST
    [2013/02/10 12:24:58 | 000,000,000 | ---D | C] -- C:\Users\Hikya\AppData\Roaming\Malwarebytes
    [2013/02/10 12:24:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
    [2013/01/30 02:20:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
    [2013/01/30 02:20:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
    [2013/01/30 02:20:35 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
    [3 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
    [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

    ========== Files - Modified Within 30 Days ==========

    [2013/02/18 19:14:11 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
    [2013/02/18 19:10:11 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-78491554-1894749589-2703256951-1000UA.job
    [2013/02/18 18:52:30 | 000,703,516 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
    [2013/02/18 18:52:30 | 000,609,642 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
    [2013/02/18 18:52:30 | 000,109,118 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
    [2013/02/18 18:14:32 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
    [2013/02/18 18:13:37 | 000,003,616 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
    [2013/02/18 18:13:37 | 000,003,616 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
    [2013/02/18 18:13:12 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
    [2013/02/18 12:10:04 | 000,000,856 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-78491554-1894749589-2703256951-1000Core.job
    [2013/02/11 09:50:36 | 000,000,257 | ---- | M] () -- C:\Windows\wininit.ini
    [2013/02/05 07:57:43 | 000,254,607 | ---- | M] () -- C:\Users\Hikya\Desktop\123
    [3 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
    [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2013/02/11 09:50:36 | 000,000,257 | ---- | C] () -- C:\Windows\wininit.ini
    [2013/02/05 07:57:38 | 000,254,607 | ---- | C] () -- C:\Users\Hikya\Desktop\123
    [2012/11/11 01:40:42 | 083,023,306 | ---- | C] () -- C:\ProgramData\0tbpw.pad
    [2011/06/26 20:16:03 | 000,142,099 | ---- | C] () -- C:\Users\Hikya\AppData\Roaming\NMM-MetaData.db
    [2011/03/04 11:07:06 | 000,067,072 | ---- | C] () -- C:\Windows\SysWow64\Gksui16.exe
    [2011/03/02 23:57:44 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
    [2011/03/02 23:57:40 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
    [2011/03/02 23:57:40 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
    [2011/03/02 23:57:40 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
    [2011/03/02 23:57:40 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
    [2009/08/23 18:58:02 | 000,000,233 | ---- | C] () -- C:\Users\Hikya\AppData\Roaming\default.rss
    [2009/05/24 10:42:04 | 000,000,077 | ---- | C] () -- C:\Users\Hikya\Show Desktop.scf
    [2008/12/31 11:22:05 | 000,026,311 | ---- | C] () -- C:\Users\Hikya\AppData\Roaming\UserTile.png
    [2008/11/30 00:07:40 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
    [2008/11/16 06:40:27 | 000,212,480 | ---- | C] () -- C:\Users\Hikya\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2008/11/14 23:13:43 | 000,000,732 | ---- | C] () -- C:\Users\Hikya\AppData\Local\d3d9caps64.dat

    ========== ZeroAccess Check ==========

    [2006/11/02 21:00:40 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

    [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
    "ThreadingModel" = Both
    "" = C:\Users\Hikya\AppData\Local\{5fbbc512-317b-905c-33f3-cb2547d731ec}\n.

    [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

    [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

    [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
    "" = C:\Windows\SysNative\shell32.dll -- [2012/06/08 23:29:03 | 012,899,840 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Apartment

    [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
    "" = %SystemRoot%\system32\shell32.dll -- [2012/06/08 23:17:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Apartment

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
    "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/04/11 12:41:14 | 000,891,392 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Free

    [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
    "" = %systemroot%\system32\wbem\fastprox.dll -- [2009/04/11 11:58:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Free

    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
    "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2008/01/21 08:20:58 | 000,513,024 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Both

    [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

    ========== LOP Check ==========

    [2011/06/26 20:07:55 | 000,000,000 | ---D | M] -- C:\Users\Hikya\AppData\Roaming\Datalayer
    [2009/09/09 04:54:45 | 000,000,000 | ---D | M] -- C:\Users\Hikya\AppData\Roaming\FreeCall
    [2012/07/29 20:52:03 | 000,000,000 | ---D | M] -- C:\Users\Hikya\AppData\Roaming\MySQL
    [2011/03/27 10:30:28 | 000,000,000 | ---D | M] -- C:\Users\Hikya\AppData\Roaming\Nokia
    [2011/06/26 19:10:47 | 000,000,000 | ---D | M] -- C:\Users\Hikya\AppData\Roaming\Nokia Multimedia Player
    [2009/10/04 20:28:23 | 000,000,000 | ---D | M] -- C:\Users\Hikya\AppData\Roaming\Nonoh
    [2011/05/16 21:25:54 | 000,000,000 | ---D | M] -- C:\Users\Hikya\AppData\Roaming\Notepad++
    [2012/04/10 16:34:51 | 000,000,000 | ---D | M] -- C:\Users\Hikya\AppData\Roaming\Opera
    [2010/07/28 07:05:53 | 000,000,000 | ---D | M] -- C:\Users\Hikya\AppData\Roaming\PC Suite
    [2008/12/31 11:22:05 | 000,000,000 | ---D | M] -- C:\Users\Hikya\AppData\Roaming\PeerNetworking
    [2011/11/13 11:57:34 | 000,000,000 | ---D | M] -- C:\Users\Hikya\AppData\Roaming\Rovio
    [2012/02/17 06:22:25 | 000,000,000 | ---D | M] -- C:\Users\Hikya\AppData\Roaming\Samsung
    [2012/07/06 08:49:59 | 000,000,000 | ---D | M] -- C:\Users\Hikya\AppData\Roaming\Subversion
    [2012/07/05 08:59:57 | 000,000,000 | ---D | M] -- C:\Users\Hikya\AppData\Roaming\TeamViewer
    [2009/01/20 09:45:53 | 000,000,000 | ---D | M] -- C:\Users\Hikya\AppData\Roaming\toshiba
    [2008/12/04 10:39:00 | 000,000,000 | ---D | M] -- C:\Users\Hikya\AppData\Roaming\Ulead Systems
    [2009/01/21 11:00:20 | 000,000,000 | ---D | M] -- C:\Users\Hikya\AppData\Roaming\WildTangent
    [2011/07/12 21:21:49 | 000,000,000 | ---D | M] -- C:\Users\Hikya\AppData\Roaming\ZTEEVDO
    [2011/07/12 21:21:49 | 000,000,000 | ---D | M] -- C:\Users\Hikya\AppData\Roaming\ZTE_CDMA_1X

    ========== Purity Check ==========



    ========== Alternate Data Streams ==========

    @Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:0CE7F3C9

    < End of report >








    OTL Extras logfile created on: 18/02/2013 7:15:01 PM - Run 1
    OTL by OldTimer - Version 3.2.69.0 Folder = G:\
    64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
    Internet Explorer (Version = 9.0.8112.16421)
    Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

    3.87 Gb Total Physical Memory | 2.07 Gb Available Physical Memory | 53.45% Memory free
    7.93 Gb Paging File | 6.06 Gb Available in Paging File | 76.32% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
    Drive C: | 281.54 Gb Total Space | 28.25 Gb Free Space | 10.03% Space Free | Partition Type: NTFS
    Drive D: | 7.59 Gb Total Space | 7.53 Gb Free Space | 99.12% Space Free | Partition Type: NTFS
    Drive G: | 1.97 Gb Total Space | 1.97 Gb Free Space | 99.90% Space Free | Partition Type: FAT32

    Computer Name: KARTHIK-RAMYA | User Name: Hikya | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (All) ==========


    ========== File Associations ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .chm[@ = chm.file] -- C:\Windows\hh.exe (Microsoft Corporation)
    .cpl[@ = cplfile] -- C:\Windows\SysNative\control.exe (Microsoft Corporation)
    .hlp[@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
    .hta[@ = htafile] -- C:\Windows\SysWOW64\mshta.exe (Microsoft Corporation)
    .html[@ = Opera.HTML] -- Reg Error: Key error. File not found
    .inf[@ = inffile] -- C:\Windows\SysNative\NOTEPAD.EXE (Microsoft Corporation)
    .ini[@ = inifile] -- C:\Windows\SysNative\NOTEPAD.EXE (Microsoft Corporation)
    .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
    .js[@ = JSFile] -- C:\Windows\SysNative\WScript.exe (Microsoft Corporation)
    .jse[@ = JSEFile] -- C:\Windows\SysNative\WScript.exe (Microsoft Corporation)
    .reg[@ = regfile] -- C:\Windows\regedit.exe (Microsoft Corporation)
    .txt[@ = txtfile] -- C:\Windows\SysNative\NOTEPAD.EXE (Microsoft Corporation)
    .vbe[@ = VBEFile] -- C:\Windows\SysNative\WScript.exe (Microsoft Corporation)
    .vbs[@ = VBSFile] -- C:\Windows\SysNative\WScript.exe (Microsoft Corporation)
    .wsf[@ = WSFFile] -- C:\Windows\SysNative\WScript.exe (Microsoft Corporation)
    .wsh[@ = WSHFile] -- C:\Windows\SysNative\WScript.exe (Microsoft Corporation)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .bat [@ = batfile] -- "%1" %*
    .chm [@ = chm.file] -- C:\Windows\hh.exe (Microsoft Corporation)
    .cmd [@ = cmdfile] -- "%1" %*
    .com [@ = comfile] -- "%1" %*
    .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
    .exe [@ = exefile] -- "%1" %*
    .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
    .hta [@ = htafile] -- C:\Windows\SysWOW64\mshta.exe (Microsoft Corporation)
    .html [@ = Opera.HTML] -- Reg Error: Key error. File not found
    .inf [@ = inffile] -- C:\Windows\SysWow64\NOTEPAD.EXE (Microsoft Corporation)
    .ini [@ = inifile] -- C:\Windows\SysWow64\NOTEPAD.EXE (Microsoft Corporation)
    .url [@ = InternetShortcut] -- C:\Windows\SysWOW64\rundll32.exe (Microsoft Corporation)
    .js [@ = JSFile] -- C:\Windows\SysWOW64\WScript.exe (Microsoft Corporation)
    .jse [@ = JSEFile] -- C:\Windows\SysWOW64\WScript.exe (Microsoft Corporation)
    .pif [@ = piffile] -- "%1" %*
    .reg [@ = regfile] -- C:\Windows\SysWow64\regedit.exe (Microsoft Cor
     
  8. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    81
    Sure you can use the CCleaner on your computer... Please try to do the step 2 and 3 also.... I will check the above logs from step 1 and let you know.......
     
  9. kar.online

    kar.online New Member

    Reputation:
    0
    Joined:
    Feb 17, 2013
    Messages:
    30
    Likes Received:
    0
    Hi

    I had successfully performed steps 2 and 3 by using the softwares given by you. I would like to highlight that I havent tried logging in safe mode or connect to the internet till now, as I havent performed full system scan. also I am unable to open the task manager as the right click option or cntrl+alt+del option is showing taskmanager in disable mode.

    Regards
    Karthik g
     
  10. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    81
    Okay No need to worry about the Task Manager... We can fix it... :) Internet also....... :p
    Try to login to safe mode and check if you are able to access the Internet in safe mode with networking... To fix the issue with Task Manager follow this step........



    STEP 1: Run the below OTL fix
    <ol><li>Start <>OTL.exe</></li>
    <li>Copy/paste the following text written <>inside of the code box</> into the <>Custom Scans/Fixes</> box located at the bottom of OTL. Sine you are not able to access Internet in the infected computer copy this code into a text file and save it to the flash drive. Then transfer it to the infected computer.
    Code:
    
    :OTL
    [2010/02/20 23:31:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hikya\AppData\Roaming\Mozilla\Extensions
    [2010/02/20 23:31:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hikya\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
    [2012/07/04 23:24:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hikya\AppData\Roaming\Mozilla\Firefox\Profiles\extensions
    [2012/10/23 08:14:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Hikya\AppData\Roaming\Mozilla\Firefox\Profiles\ga08p41b.default\extensi​ons
    [2012/08/30 07:03:39 | 000,199,396 | ---- | M] () (No name found) -- C:\Users\Hikya\AppData\Roaming\Mozilla\Firefox\Profiles\ga08p41b.default\extensi​ons\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi
    O4 - HKU\S-1-5-21-78491554-1894749589-2703256951-1000..\Run: [jxxlryeecvibbrn] C:\ProgramData\jxxlryee.exe File not found
    O4 - HKU\S-1-5-21-78491554-1894749589-2703256951-1000..\Run: [mtotuioqo] C:\Users\Hikya\AppData\Roaming\bppclnpvrM File not found
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
    O7 - HKU\S-1-5-21-78491554-1894749589-2703256951-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
    O20:64bit: - HKLM Winlogon: Shell - (C:\Users\Hikya\AppData\Roaming\bppclnpvrM) - File not found
    [2008/11/16 06:40:27 | 000,212,480 | ---- | C] () -- C:\Users\Hikya\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2008/12/31 11:22:05 | 000,026,311 | ---- | C] () -- C:\Users\Hikya\AppData\Roaming\UserTile.png
    [2008/11/30 00:07:40 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
    [2008/11/14 23:13:43 | 000,000,732 | ---- | C] () -- C:\Users\Hikya\AppData\Local\d3d9caps64.dat
    
    
    :commands
    [emptytemp]
    [reboot]
    
    
    <>NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system</></li>
    <li>Then click the <>Run Fix</> button at the top</li>
    <li>Let the program run unhindered, reboot when it is done</li>
    <li>Attach the new log produced by OTL (C:\_OTL)</li>
    </ol>

    <hr />
     
    Last edited by a moderator: Mar 13, 2014
  11. kar.online

    kar.online New Member

    Reputation:
    0
    Joined:
    Feb 17, 2013
    Messages:
    30
    Likes Received:
    0
    Hi

    Executed the above steps. I am able to connect to the internet in safe mode with networking. Havent tried it yet in normal mode. Now I am able to access the Task manager. Curious to know whether I could run the full system scan. Given below the log.

    All processes killed
    ========== OTL ==========
    C:\Users\Hikya\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} folder moved successfully.
    C:\Users\Hikya\AppData\Roaming\Mozilla\Extensions folder moved successfully.
    Folder C:\Users\Hikya\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\ not found.
    C:\Users\Hikya\AppData\Roaming\Mozilla\Firefox\Profiles\extensions folder moved successfully.
    Folder C:\Users\Hikya\AppData\Roaming\Mozilla\Firefox\Profiles\ga08p41b.default\extensi​​ons\ not found.
    File C:\Users\Hikya\AppData\Roaming\Mozilla\Firefox\Profiles\ga08p41b.default\extensi​​ons\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi not found.
    Registry value HKEY_USERS\S-1-5-21-78491554-1894749589-2703256951-1000\Software\Microsoft\Windows\CurrentVersion\Run\\jxxlryeecvibbrn deleted successfully.
    Registry value HKEY_USERS\S-1-5-21-78491554-1894749589-2703256951-1000\Software\Microsoft\Windows\CurrentVersion\Run\\mtotuioqo deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
    Registry value HKEY_USERS\S-1-5-21-78491554-1894749589-2703256951-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableTaskMgr deleted successfully.
    64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Users\Hikya\AppData\Roaming\bppclnpvrM deleted successfully.
    C:\Users\Hikya\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini moved successfully.
    C:\Users\Hikya\AppData\Roaming\UserTile.png moved successfully.
    C:\ProgramData\ezsidmv.dat moved successfully.
    C:\Users\Hikya\AppData\Local\d3d9caps64.dat moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: AppData

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Hikya
    ->Temp folder emptied: 32307 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Public

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32 (64bit) .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 0 bytes
    %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.69.0 log created on 02192013_090241

    Files\Folders moved on Reboot...

    PendingFileRenameOperations files...

    Registry entries deleted on Reboot...
     
  12. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    81
    Okay let's fix the issue with the Internet now... When you try to access the internet in normal mode what you are getting? Try to run the full scan...

    What is the antivirus program you are using on your computer?

    Run this following 2 tools in Normal mode.....

    STEP 1: Run the Complete Internet Repair utility.
    <ol><li>Download <a title="External link" href="http://www.datum-forensics.com/down/comintrep.exe" rel="nofollow external" rel="nofollow">Complete Internet Repair utility</a>to your desktop</li>
    <li>Unzip all the files to their own folder on the desktop</li>
    <li>Within the folder double click <>CIntRep</></li>
    <li>Select the following items,then press the GO button.
    <ul><li>Reset Interent Protocol (TCP/IP)</li>
    <li>Repair Winsock (Reset Catalog)</li>
    <li>Renew Internet Connection</li>
    <li>Flush DNS Resolver Cache</li>
    <li>Reset Windows Firewall Configuration</li>
    <li>Reset the default hosts fie</li></ul>
    </li>
    </ol>
    <hr />


    STEP 2: Run the MiniToolBox to Repair Internet Problems

    Please download MiniToolBox save it to your desktop and run it.

    Place a check in the following boxes:

    • [​IMG]
    • Flush DNS
    • Report IE Proxy Settings
    • Reset IE Proxy Settings
    • Report FF Proxy Settings
    • Reset FF Proxy Settings
    • List content of Hosts
    • List IP configuration
    • List Winsock Entries
    • List last 10 Event Viewer log
    • List Installed Programs
    • List Devices
    • List Users, Partitions and Memory size.
    • List Minidump Files
    Close your browsers and click Go. Post the Result.txt located in the same directory as the tool.
     
    Last edited by a moderator: Mar 13, 2014
  13. kar.online

    kar.online New Member

    Reputation:
    0
    Joined:
    Feb 17, 2013
    Messages:
    30
    Likes Received:
    0
    Hi

    Unable to perform step1 as executing the link indicates "download does not exist" So though I had downloaded the exe file mentioned in second step I am holding on till further updates from your end. Also I am not trusting symantec anymore, so can you please suggest any. I found Kaspersky 90 days pack in the giveaway section, should I try with that?

    REgards
    Karthik G
     
  14. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    81
    Try the Step 2.... Which version of Symantec are you using?
     
  15. kar.online

    kar.online New Member

    Reputation:
    0
    Joined:
    Feb 17, 2013
    Messages:
    30
    Likes Received:
    0
    Hi

    Let me execute step2, I have Symantec Antivirus 10.2
     
  16. kar.online

    kar.online New Member

    Reputation:
    0
    Joined:
    Feb 17, 2013
    Messages:
    30
    Likes Received:
    0
    Hi

    Executing Step 2 resulted in the below log. Meanwhile I am updating my existing symantec AV and scanning my machine.

    MiniToolBox by Farbar Version:10-01-2013
    Ran by Hikya (administrator) on 20-02-2013 at 08:50:47
    Running from "C:\Users\Hikya\Desktop"
    Windows Vista (TM) Home Premium Service Pack 2 (X64)
    Boot Mode: Normal
    ***************************************************************************

    ========================= Flush DNS: ===================================

    Windows IP Configuration

    Successfully flushed the DNS Resolver Cache.

    ========================= IE Proxy Settings: ==============================

    Proxy is not enabled.
    No Proxy Server is set.

    "Reset IE Proxy Settings": IE Proxy Settings were reset.

    ========================= FF Proxy Settings: ==============================


    "Reset FF Proxy Settings": Firefox Proxy settings were reset.

    ========================= Hosts content: =================================

    ::1 localhost

    127.0.0.1 localhost

    ========================= IP Configuration: ================================

    Intel(R) WiFi Link 5100 AGN = Wireless Network Connection (Connected)
    Realtek PCIe FE Family Controller = Local Area Connection (Media disconnected)


    # ----------------------------------
    # IPv4 Configuration
    # ----------------------------------
    pushd interface ipv4

    reset
    set global icmpredirects=enabled


    popd
    # End of IPv4 configuration



    Windows IP Configuration

    Host Name . . . . . . . . . . . . : Karthik-Ramya
    Primary Dns Suffix . . . . . . . :
    Node Type . . . . . . . . . . . . : Broadcast
    IP Routing Enabled. . . . . . . . : No
    WINS Proxy Enabled. . . . . . . . : No

    Wireless LAN adapter Wireless Network Connection:

    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : Intel(R) WiFi Link 5100 AGN
    Physical Address. . . . . . . . . : 00-21-5D-7F-7F-2C
    DHCP Enabled. . . . . . . . . . . : Yes
    Autoconfiguration Enabled . . . . : Yes
    Link-local IPv6 Address . . . . . : fe80::5dc:78f6:584c:2281%11(Preferred)
    IPv4 Address. . . . . . . . . . . : 192.168.0.113(Preferred)
    Subnet Mask . . . . . . . . . . . : 255.255.255.0
    Lease Obtained. . . . . . . . . . : February-20-13 7:37:41 AM
    Lease Expires . . . . . . . . . . : February-21-13 7:37:30 AM
    Default Gateway . . . . . . . . . : 192.168.0.1
    DHCP Server . . . . . . . . . . . : 192.168.0.1
    DHCPv6 IAID . . . . . . . . . . . : 268443997
    DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-10-B0-BF-46-00-1E-33-6C-81-21
    DNS Servers . . . . . . . . . . . : 75.75.75.75
    75.75.76.76
    NetBIOS over Tcpip. . . . . . . . : Enabled

    Ethernet adapter Local Area Connection:

    Media State . . . . . . . . . . . : Media disconnected
    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : Realtek PCIe FE Family Controller
    Physical Address. . . . . . . . . : 00-1E-33-6C-81-21
    DHCP Enabled. . . . . . . . . . . : Yes
    Autoconfiguration Enabled . . . . : Yes

    Tunnel adapter Local Area Connection* 6:

    Media State . . . . . . . . . . . : Media disconnected
    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : isatap.{2E4D4195-1737-4AD5-9C8A-8EF22C42F487}
    Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
    DHCP Enabled. . . . . . . . . . . : No
    Autoconfiguration Enabled . . . . : Yes

    Tunnel adapter Local Area Connection* 7:

    Media State . . . . . . . . . . . : Media disconnected
    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : isatap.{E148467B-D1C6-47F7-BEC4-9796F4D18F0D}
    Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
    DHCP Enabled. . . . . . . . . . . : No
    Autoconfiguration Enabled . . . . : Yes

    Tunnel adapter Local Area Connection* 11:

    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
    Physical Address. . . . . . . . . : 02-00-54-55-4E-01
    DHCP Enabled. . . . . . . . . . . : No
    Autoconfiguration Enabled . . . . : Yes
    IPv6 Address. . . . . . . . . . . : 2001:0:9d38:6ab8:45b:3e91:3f57:ff8e(Preferred)
    Link-local IPv6 Address . . . . . : fe80::45b:3e91:3f57:ff8e%12(Preferred)
    Default Gateway . . . . . . . . . : ::
    NetBIOS over Tcpip. . . . . . . . : Disabled

    Tunnel adapter Local Area Connection* 12:

    Media State . . . . . . . . . . . : Media disconnected
    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : isatap.{8ECE630E-7C92-554A-421C-E5572E7E6A98}
    Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
    DHCP Enabled. . . . . . . . . . . : No
    Autoconfiguration Enabled . . . . : Yes

    Tunnel adapter Local Area Connection* 13:

    Media State . . . . . . . . . . . : Media disconnected
    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : isatap.{8ECE630E-7C92-554A-421C-E5572E7E6A98}
    Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
    DHCP Enabled. . . . . . . . . . . : No
    Autoconfiguration Enabled . . . . : Yes

    Tunnel adapter Local Area Connection* 15:

    Media State . . . . . . . . . . . : Media disconnected
    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : 6TO4 Adapter
    Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
    DHCP Enabled. . . . . . . . . . . : No
    Autoconfiguration Enabled . . . . : Yes

    Tunnel adapter Local Area Connection* 21:

    Media State . . . . . . . . . . . : Media disconnected
    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : isatap.{8ECE630E-7C92-554A-421C-E5572E7E6A98}
    Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
    DHCP Enabled. . . . . . . . . . . : No
    Autoconfiguration Enabled . . . . : Yes

    Tunnel adapter Local Area Connection* 26:

    Media State . . . . . . . . . . . : Media disconnected
    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : isatap.{FB514F7C-AC2A-412A-A80C-B96C995610F5}
    Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
    DHCP Enabled. . . . . . . . . . . : No
    Autoconfiguration Enabled . . . . : Yes

    Tunnel adapter Local Area Connection* 29:

    Media State . . . . . . . . . . . : Media disconnected
    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : isatap.{E148467B-D1C6-47F7-BEC4-9796F4D18F0D}
    Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
    DHCP Enabled. . . . . . . . . . . : No
    Autoconfiguration Enabled . . . . : Yes
    Server: cdns01.comcast.net
    Address: 75.75.75.75

    Name: google.com
    Addresses: 2607:f8b0:4009:803::1002
    74.125.225.71
    74.125.225.65
    74.125.225.68
    74.125.225.78
    74.125.225.70
    74.125.225.72
    74.125.225.64
    74.125.225.73
    74.125.225.67
    74.125.225.69
    74.125.225.66



    Pinging google.com [74.125.225.41] with 32 bytes of data:

    Reply from 74.125.225.41: bytes=32 time=23ms TTL=55

    Reply from 74.125.225.41: bytes=32 time=59ms TTL=55



    Ping statistics for 74.125.225.41:

    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

    Approximate round trip times in milli-seconds:

    Minimum = 23ms, Maximum = 59ms, Average = 41ms

    DNS request timed out.
    timeout was 2 seconds.
    Server: UnKnown
    Address: 75.75.75.75

    Name: yahoo.com
    Addresses: 98.139.183.24
    98.138.253.109
    206.190.36.45



    Pinging yahoo.com [206.190.36.45] with 32 bytes of data:

    Reply from 206.190.36.45: bytes=32 time=206ms TTL=50

    Reply from 206.190.36.45: bytes=32 time=89ms TTL=50



    Ping statistics for 206.190.36.45:

    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

    Approximate round trip times in milli-seconds:

    Minimum = 89ms, Maximum = 206ms, Average = 147ms



    Pinging 127.0.0.1 with 32 bytes of data:

    Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

    Reply from 127.0.0.1: bytes=32 time<1ms TTL=128



    Ping statistics for 127.0.0.1:

    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

    Approximate round trip times in milli-seconds:

    Minimum = 0ms, Maximum = 0ms, Average = 0ms

    ===========================================================================
    Interface List
    11 ...00 21 5d 7f 7f 2c ...... Intel(R) WiFi Link 5100 AGN
    10 ...00 1e 33 6c 81 21 ...... Realtek PCIe FE Family Controller
    1 ........................... Software Loopback Interface 1
    32 ...00 00 00 00 00 00 00 e0 isatap.{2E4D4195-1737-4AD5-9C8A-8EF22C42F487}
    31 ...00 00 00 00 00 00 00 e0 isatap.{E148467B-D1C6-47F7-BEC4-9796F4D18F0D}
    12 ...02 00 54 55 4e 01 ...... Teredo Tunneling Pseudo-Interface
    14 ...00 00 00 00 00 00 00 e0 isatap.{8ECE630E-7C92-554A-421C-E5572E7E6A98}
    15 ...00 00 00 00 00 00 00 e0 isatap.{8ECE630E-7C92-554A-421C-E5572E7E6A98}
    16 ...00 00 00 00 00 00 00 e0 6TO4 Adapter
    23 ...00 00 00 00 00 00 00 e0 isatap.{8ECE630E-7C92-554A-421C-E5572E7E6A98}
    27 ...00 00 00 00 00 00 00 e0 isatap.{FB514F7C-AC2A-412A-A80C-B96C995610F5}
    33 ...00 00 00 00 00 00 00 e0 isatap.{E148467B-D1C6-47F7-BEC4-9796F4D18F0D}
    ===========================================================================

    IPv4 Route Table
    ===========================================================================
    Active Routes:
    Network Destination Netmask Gateway Interface Metric
    0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.113 30
    127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
    127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
    127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
    192.168.0.0 255.255.255.0 On-link 192.168.0.113 286
    192.168.0.113 255.255.255.255 On-link 192.168.0.113 286
    192.168.0.255 255.255.255.255 On-link 192.168.0.113 286
    224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
    224.0.0.0 240.0.0.0 On-link 192.168.0.113 286
    255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
    255.255.255.255 255.255.255.255 On-link 192.168.0.113 286
    ===========================================================================
    Persistent Routes:
    None

    IPv6 Route Table
    ===========================================================================
    Active Routes:
    If Metric Network Destination Gateway
    12 18 ::/0 On-link
    1 306 ::1/128 On-link
    12 18 2001::/32 On-link
    12 266 2001:0:9d38:6ab8:45b:3e91:3f57:ff8e/128
    On-link
    11 286 fe80::/64 On-link
    12 266 fe80::/64 On-link
    12 266 fe80::45b:3e91:3f57:ff8e/128
    On-link
    11 286 fe80::5dc:78f6:584c:2281/128
    On-link
    1 306 ff00::/8 On-link
    12 266 ff00::/8 On-link
    11 286 ff00::/8 On-link
    ===========================================================================
    Persistent Routes:
    None
    ========================= Winsock entries =====================================

    Catalog5 01 C:\Windows\SysWOW64\NLAapi.dll [48128] (Microsoft Corporation)
    Catalog5 02 C:\Windows\SysWOW64\napinsp.dll [50176] (Microsoft Corporation)
    Catalog5 03 C:\Windows\SysWOW64\pnrpnsp.dll [62464] (Microsoft Corporation)
    Catalog5 04 C:\Windows\SysWOW64\pnrpnsp.dll [62464] (Microsoft Corporation)
    Catalog5 05 C:\Windows\SysWOW64\mswsock.dll [223232] (Microsoft Corporation)
    Catalog5 06 C:\Windows\SysWOW64\winrnr.dll [19968] (Microsoft Corporation)
    Catalog5 07 C:\Program Files (x86)\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
    Catalog9 01 C:\Windows\SysWOW64\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 02 C:\Windows\SysWOW64\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 03 C:\Windows\SysWOW64\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 04 C:\Windows\SysWOW64\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 05 C:\Windows\SysWOW64\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 06 C:\Windows\SysWOW64\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 07 C:\Windows\SysWOW64\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 08 C:\Windows\SysWOW64\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 09 C:\Windows\SysWOW64\mswsock.dll [223232] (Microsoft Corporation)
    Catalog9 10 C:\Windows\SysWOW64\mswsock.dll [223232] (Microsoft Corporation)
    x64-Catalog5 01 C:\Windows\System32\NLAapi.dll [61440] (Microsoft Corporation)
    x64-Catalog5 02 C:\Windows\System32\napinsp.dll [62976] (Microsoft Corporation)
    x64-Catalog5 03 C:\Windows\System32\pnrpnsp.dll [78848] (Microsoft Corporation)
    x64-Catalog5 04 C:\Windows\System32\pnrpnsp.dll [78848] (Microsoft Corporation)
    x64-Catalog5 05 C:\Windows\System32\mswsock.dll [304128] (Microsoft Corporation)
    x64-Catalog5 06 C:\Windows\System32\winrnr.dll [27648] (Microsoft Corporation)
    x64-Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [132968] (Apple Inc.)
    x64-Catalog9 01 C:\Windows\System32\mswsock.dll [304128] (Microsoft Corporation)
    x64-Catalog9 02 C:\Windows\System32\mswsock.dll [304128] (Microsoft Corporation)
    x64-Catalog9 03 C:\Windows\System32\mswsock.dll [304128] (Microsoft Corporation)
    x64-Catalog9 04 C:\Windows\System32\mswsock.dll [304128] (Microsoft Corporation)
    x64-Catalog9 05 C:\Windows\System32\mswsock.dll [304128] (Microsoft Corporation)
    x64-Catalog9 06 C:\Windows\System32\mswsock.dll [304128] (Microsoft Corporation)
    x64-Catalog9 07 C:\Windows\System32\mswsock.dll [304128] (Microsoft Corporation)
    x64-Catalog9 08 C:\Windows\System32\mswsock.dll [304128] (Microsoft Corporation)
    x64-Catalog9 09 C:\Windows\System32\mswsock.dll [304128] (Microsoft Corporation)
    x64-Catalog9 10 C:\Windows\System32\mswsock.dll [304128] (Microsoft Corporation)

    ========================= Event log errors: ===============================

    Application errors:
    ==================
    Error: (02/20/2013 07:40:09 AM) (Source: .NET Runtime Optimization Service) (User: )
    Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Service reached limit of transient errors. Will shut down. Last error returned from Service Manager: 0x8000ffff.

    Error: (02/19/2013 10:23:33 AM) (Source: EventSystem) (User: )
    Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c

    Error: (02/19/2013 10:12:51 AM) (Source: EventSystem) (User: )
    Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c

    Error: (02/19/2013 09:14:46 AM) (Source: EventSystem) (User: )
    Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c

    Error: (02/19/2013 09:07:18 AM) (Source: .NET Runtime Optimization Service) (User: )
    Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Service reached limit of transient errors. Will shut down. Last error returned from Service Manager: 0x8000ffff.

    Error: (02/19/2013 05:11:19 AM) (Source: .NET Runtime Optimization Service) (User: )
    Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Service reached limit of transient errors. Will shut down. Last error returned from Service Manager: 0x8000ffff.

    Error: (02/19/2013 05:03:08 AM) (Source: .NET Runtime Optimization Service) (User: )
    Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Service reached limit of transient errors. Will shut down. Last error returned from Service Manager: 0x8000ffff.

    Error: (02/18/2013 06:16:05 PM) (Source: .NET Runtime Optimization Service) (User: )
    Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Service reached limit of transient errors. Will shut down. Last error returned from Service Manager: 0x8000ffff.

    Error: (02/18/2013 00:11:16 PM) (Source: .NET Runtime Optimization Service) (User: )
    Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Service reached limit of transient errors. Will shut down. Last error returned from Service Manager: 0x8000ffff.

    Error: (02/18/2013 10:18:33 AM) (Source: Windows Search Service) (User: )
    Description: The entry <C:\USERS\HIKYA\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\LOW\CONTENT.IE5\SSR3FTH3> in the hash map cannot be updated.

    Context: Application, SystemIndex Catalog


    Details:
    A device attached to the system is not functioning. (0x8007001f)


    System errors:
    =============
    Error: (02/20/2013 07:38:38 AM) (Source: Service Control Manager) (User: )
    Description: Nero BackItUp Scheduler 4.0%%2

    Error: (02/19/2013 10:23:49 AM) (Source: Service Control Manager) (User: )
    Description: eeCtrl
    NetworkX
    spldr
    SRTSP
    SRTSPX
    Wanarpv6

    Error: (02/19/2013 10:23:49 AM) (Source: Service Control Manager) (User: )
    Description: Computer BrowserServer%%1068

    Error: (02/19/2013 10:23:39 AM) (Source: DCOM) (User: )
    Description: 1084WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}

    Error: (02/19/2013 10:23:35 AM) (Source: DCOM) (User: )
    Description: 1068fdPHost{145B4335-FE2A-4927-A040-7C35AD3180EF}

    Error: (02/19/2013 10:23:33 AM) (Source: DCOM) (User: )
    Description: 1084EventSystem{1BE1F766-5536-11D1-B726-00C04FB926AF}

    Error: (02/19/2013 10:23:25 AM) (Source: DCOM) (User: )
    Description: 1084ShellHWDetection{DD522ACC-F821-461A-A407-50B198B896DC}

    Error: (02/19/2013 10:14:30 AM) (Source: DCOM) (User: )
    Description: 1084WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

    Error: (02/19/2013 10:13:07 AM) (Source: Service Control Manager) (User: )
    Description: eeCtrl
    NetworkX
    spldr
    SRTSP
    SRTSPX
    Wanarpv6

    Error: (02/19/2013 10:13:07 AM) (Source: Service Control Manager) (User: )
    Description: Computer BrowserServer%%1068


    Microsoft Office Sessions:
    =========================
    Error: (06/12/2010 11:42:44 AM) (Source: Microsoft Office 12 Sessions)(User: )
    Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 278 seconds with 120 seconds of active time. This session ended with a crash.

    Error: (06/19/2009 11:09:41 AM) (Source: Microsoft Office 12 Sessions)(User: )
    Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 10175 seconds with 420 seconds of active time. This session ended with a crash.


    CodeIntegrity Errors:
    ===================================
    Date: 2013-02-11 07:25:35.766
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_0fbe86f737e6a8d6\tcpip.sys because the set of per-page image hashes could not be found on the system.

    Date: 2013-02-11 07:25:34.893
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_0fbe86f737e6a8d6\tcpip.sys because the set of per-page image hashes could not be found on the system.

    Date: 2013-02-11 07:25:33.910
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_0fbe86f737e6a8d6\tcpip.sys because the set of per-page image hashes could not be found on the system.

    Date: 2013-02-11 07:25:33.036
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_0fbe86f737e6a8d6\tcpip.sys because the set of per-page image hashes could not be found on the system.

    Date: 2013-02-11 07:25:32.147
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_0fbe86f737e6a8d6\tcpip.sys because the set of per-page image hashes could not be found on the system.

    Date: 2013-02-11 07:25:31.273
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_0fbe86f737e6a8d6\tcpip.sys because the set of per-page image hashes could not be found on the system.

    Date: 2013-02-11 07:25:30.337
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_0fabe61737f42f96\tcpip.sys because the set of per-page image hashes could not be found on the system.

    Date: 2013-02-11 07:25:29.479
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_0fabe61737f42f96\tcpip.sys because the set of per-page image hashes could not be found on the system.

    Date: 2013-02-11 07:25:28.512
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_0fabe61737f42f96\tcpip.sys because the set of per-page image hashes could not be found on the system.

    Date: 2013-02-11 07:25:27.639
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_0fabe61737f42f96\tcpip.sys because the set of per-page image hashes could not be found on the system.


    =========================== Installed Programs ============================

    Apple Mobile Device Support (Version: 6.0.1.3)
    Bonjour (Version: 3.0.0.10)
    cwbin64a (Version: 05.04.0000)
    Google Talk (remove only)
    Intel(R) Graphics Media Accelerator Driver
    Intel® Matrix Storage Manager
    iTunes (Version: 11.0.1.12)
    Java SE Development Kit 7 Update 5 (64-bit) (Version: 1.7.0.50)
    Java(TM) 7 Update 5 (64-bit) (Version: 7.0.50)
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
    Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
    Microsoft Office Office 64-bit Components 2007 (Version: 12.0.4518.1014)
    Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.4518.1014)
    Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.4518.1014)
    Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
    Nokia Phone Browser 64-bit (Version: 6.81.13.0)
    PC Connectivity Solution 64-bit components (Version: 6.23.9.0)
    SAMSUNG USB Driver for Mobile Phones (Version: 1.3.2250.0)
    Symantec AntiVirus Win64 (Version: 10.2.298.0)
    Synaptics Pointing Device Driver (Version: 11.2.4.0)
    TOSHIBA Disc Creator (Version: 2.0.1.3 for x64)
    TOSHIBA Extended Tiles for Windows Mobility Center (Version: 1.01.00)
    TOSHIBA Face Recognition (Version: 2.0.2.64)
    TOSHIBA Recovery Disc Creator (Version: 2.0.0.2 for x64)
    TOSHIBA Software Modem (Version: 2.1.87 (SM2187ALS04))
    TOSHIBA Value Added Package (Version: 1.1.24.64)
    Windows Driver Package - TOSHIBA (FwLnk) System (11/19/2006 1.0.0.3) (Version: 11/19/2006 1.0.0.3)

    ========================= Devices: ================================

    Name: 6TO4 Adapter
    Description: Microsoft 6to4 Adapter
    Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
    Manufacturer: Microsoft
    Service: tunnel
    Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
    Resolution: Update the driver

    Name: Microsoft 6to4 Adapter #3
    Description: Microsoft 6to4 Adapter
    Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
    Manufacturer: Microsoft
    Service: tunnel
    Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
    Resolution: Update the driver

    Name: isatap.{8ECE630E-7C92-554A-421C-E5572E7E6A98}
    Description: Microsoft ISATAP Adapter
    Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
    Manufacturer: Microsoft
    Service: tunnel
    Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
    Resolution: Update the driver


    ========================= Memory info: ===================================

    Percentage of memory in use: 48%
    Total physical RAM: 3963.07 MB
    Available physical RAM: 2048.49 MB
    Total Pagefile: 8119.42 MB
    Available Pagefile: 6142.85 MB
    Total Virtual: 4095.88 MB
    Available Virtual: 3993.64 MB

    ========================= Partitions: =====================================

    1 Drive c: (S3A6747D002) (Fixed) (Total:281.54 GB) (Free:28.24 GB) NTFS
    2 Drive d: () (Fixed) (Total:7.59 GB) (Free:7.53 GB) NTFS
    4 Drive g: () (Removable) (Total:1.97 GB) (Free:1.6 GB) FAT32

    ========================= Users: ========================================

    User accounts for \\KARTHIK-RAMYA

    Administrator Guest Hikya

    ========================= Minidump Files ==================================

    No minidump file found

    ========================= Restore Points ==================================


    **** End of log ****
     
  17. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    81
    Hi Karthik,

    Do you try this in Safe mode or in Normal mode?
     
  18. kar.online

    kar.online New Member

    Reputation:
    0
    Joined:
    Feb 17, 2013
    Messages:
    30
    Likes Received:
    0
    Hi

    I did this in normal mode. Also I did ran a full system scan in normal mode after updating my Symantec AV and it deteceted two Trojan.Gen which was already quarantined by FRST. File name of it is jxxlryee.exe, not sure whether this could help.

    Opened the IE in normal mode and open google and did some searches in it and so for so good.

    Regards
    Karthik G
     
  19. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    81
    Okay Cool.. :)

    STEP 1: Run a scan with ESET Online Scanner
    <ol>
    <li>Download ESET Online Scanner utility from the below link
    <><a title="External link" href="http://download.eset.com/special/eos/esetsmartinstaller_enu.exe" rel="nofollow">ESET ONLINE SCANNER DOWNLOAD LINK</a></> <em>(This link will automatically download ESET Online Scanner on your computer.)</em></li>
    <li>Double click on the Eset installer program (esetsmartinstaller_enu.exe).</li>
    <li>Check <>Yes, I accept the Terms of Use</></li>
    <li>Click the <>Start</> button.</li>
    <li>Check <>Scan archives</></li>
    <li>Push the <>Start</> button.</li>
    <li>ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.</li>
    <li>When the scan completes, push <>List of found threats</></li>
    <li>Push <>Export to Text file </> and save the file to your desktop using a unique name, such as <>ESET Scan</>. Include the contents of this report in your next reply.Note - when ESET doesn't find any threats, no report will be created.</li>
    <li>Push the <>back</> button.</li>
    <li>Push <>Finish</></li>
    </ol>
    <hr />

    You should be able to run both scans while in Normal mode...
    [SIZE=4]STEP 2: Run a scan with Malwarebytes Anti-Malware in Chamelon mode[/SIZE]

    <ol>
    <li>Download <[b]>Malwarebytes Chameleon from <a title="External link" href="http://downloads.malwarebytes.org/file/chameleon" rel="nofollow external">here</a> </[b]>and extract it to a folder in a convenient location</li>
    <li>Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.</li>
    <li>If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window <em><[b]>Note:</[b]> Do not attempt to open <[b]>mbam-killer</[b]> as that is not a Chameleon executable and serves a different purpose)</em></li>
    <li>Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for yo</li>
    <li>Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click <[b]>OK</[b]> when it says that the database was updated successful</li>
    <li>Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan</li>
    <li>Upon completion of the scan, if anything has been detected, click on <[b]>Show Result</[b]></li>
    <li>Have Malwarebytes Anti-Malware remove any threats that are detected and click <[b]>Yes</[b]> if prompted to reboot your computer to allow the removal process to complete</li>
    <li>After your computer restarts, open <[b]>Malwarebytes Anti-Malware</[b]> and perform a Full System scan to verify that there are no remaining threats</li>
    Please add both logs in your next reply.
    </ol>

    <hr />[/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b][/b]
     
    Last edited by a moderator: Mar 13, 2014
  20. kar.online

    kar.online New Member

    Reputation:
    0
    Joined:
    Feb 17, 2013
    Messages:
    30
    Likes Received:
    0
    Hi

    Here is the log:

    ESET SCAN
    ------------
     

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads: virus unable
Forum Title Date
Malware Removal Assistance Virus Encrypted Files, dllhost.exe take over, unable to down load Farbar Tool Saturday at 1:00 PM
Troubleshooting Software - Questions and Help! Unable to install Kaspersky AntiVirus 2014 May 7, 2014
Malware Removal Assistance Is virus completely removed? Unable to delete folder Nov 21, 2013
Malware Removal Assistance fake police virus removal has left PC unable to reboot or use safe mode Oct 6, 2013
Malware Removal Assistance Virus infection [Probably Alureon] Unable to boot May 27, 2012

Thread Status:
Not open for further replies.
MalwareTips.com is an independent website.All trademarks mentioned on this page are the property of their respective owners.