trojanDownload:Win32/Renos.JM Solved

Question

Hello,
Everything is in the title, Windows Defender has been detecting this since yesterday, and when I delete everything, it keeps coming back. If anyone knows the solution, I am open to suggestions. Thank you!

Configuration: PC Compaq Presario V6000 Windows Vista Internet Explorer 7.0

Anonymous user · Answer

Hello ;

• Download UsbFix to your Desktop:

(!) Plug in your external data sources to your PC (USB drive, external hard drive, etc...) that may have been infected without opening them.

• Double click on UsbFix.exe located on your desktop.

• From the main menu, choose the option " F " for French and hit [enter].

• In the second menu, choose the option " 2 " (Removal) and hit [enter].

• Your desktop will disappear and the PC will restart.

• Upon reboot, UsbFix will scan your PC; let the tool work.

• Then post the UsbFix.txt report that will appear with the desktop.

• Note: The UsbFix.txt report is saved at the root of the disk. (C:\UsbFix.txt)

( CTRL+A to select all, CTRL+C to copy, and CTRL+V to paste )

Note: "Process.exe", a component of the tool, is detected by some antivirus software (AntiVir, Dr.Web, Kaspersky Anti-Virus) as a RiskTool.
It is not a virus, but a utility designed to terminate processes.
In the wrong hands, this utility could stop security software (Antivirus, Firewall...) hence the alert from these antivirus programs.

• Tutorial: http://pagesperso-orange.fr/NosTools/tuto_usbfix3.html
• Home: http://pagesperso-orange.fr/NosTools/usbfix.html

--
@+

elodu21 · Answer

Sorry, I E had to restart, my question may seem silly but if I don't have a USB storage device is it necessary to do that?

Anonymous user · Answer

yes, go ahead, no worries. -- @+

elodu21 · Answer

Re, I followed the procedure with UsbFix, the PC shuts down normally but upon restart the scan does not start.

Anonymous user · Answer

We will do it differently

• Download Malwarebytes' Anti-Malware (MBAM) to your desktop.
• Double-click the downloaded file to start the installation process.
• In the Update tab, click on the Check for Updates button: if the firewall asks for permission for MBAM to connect to the Internet, allow it.
• Once the update is complete, go to the Scan tab.
• Select Run a Quick Scan.
• Click on Scan. The scan will start.
• At the end of the scan, a message will appear:

"The scan has completed normally. Click on 'Show Results' to view all objects found."

• Click OK to continue. If MBAM found nothing, it will also let you know.
• Close your browsers.
• If malware was detected, click on Show Results.
• Select all (or leave checked) and click on Remove Selected, MBAM will destroy infected files and registry keys and place a copy in quarantine.
• MBAM will open Notepad and copy the scan report there. Copy and paste this report into your next response.

--
@+

elodu21 · Answer

I performed a scan with MBAM yesterday, I'm posting the report:   Malwarebytes' Anti-Malware 1.44 Database version: 3645 Windows 6.0.6001 Service Pack 1 Internet Explorer 7.0.6001.18000  27/01/2010 20:45:11 mbam-log-2010-01-27 (20-45-11).txt  Search type: Full scan (C:\|D:\|) Items examined: 321610 Elapsed time: 3 hour(s), 13 minute(s), 15 second(s)  Infected memory process(es): 1 Infected memory module(s): 0 Infected Registry key(s): 54 Infected Registry value(s): 5 Infected Registry data item(s): 0 Infected folder(s): 16 Infected file(s): 47  Infected memory process(es): C:\Users\christel\lsass.exe (Trojan.Agent) -> Unloaded process successfully.  Infected memory module(s): (No harmful item detected)  Infected Registry key(s): HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8bdd5d9-080c-448e-b868-db856c6be8ca} (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\fstcqrvc (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{b8bdd5d9-080c-448e-b868-db856c6be8ca} (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\coresrv.coreservices (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\coresrv.coreservices.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\coresrv.lfgax (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\coresrv.lfgax.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hbmain.commband (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hbmain.commband.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hbr.hbmain (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hbr.hbmain.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hostie.bho (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hostie.bho.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hostol.mailanim (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hostol.mailanim.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hostol.webmailsend (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hostol.webmailsend.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\instie.hbinstobj (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\instie.hbinstobj.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\oberontb.band (Adware.Gamesbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{ad76633e-e50d-4844-9e7f-4dfbc7c18467} (Adware.Gamesbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{daa37aad-f156-4c2c-ac48-3c22ef92ae2f} (Adware.Gamesbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{ec1a2105-5621-440f-987d-27ef428131d9} (Adware.Gamesbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{cb0d163c-e9f4-4236-9496-0597e24b23a5} (Adware.Gamesbar) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{cb0d163c-e9f4-4236-9496-0597e24b23a5} (Adware.Gamesbar) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cb0d163c-e9f4-4236-9496-0597e24b23a5} (Adware.Gamesbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\oberontb.band.1 (Adware.Gamesbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\srv.coreservices (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\srv.coreservices.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT	oolbar.htmlmenuui (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT	oolbar.htmlmenuui.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT	oolbar.toolbarctl (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT	oolbar.toolbarctl.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bkpbvbar (Trojan.Vundo.H) -> Delete on reboot. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b8bdd5d9-080c-448e-b868-db856c6be8ca} (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\BMIMZMHMFM (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hotbarax.userprofiles (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hotbarax.userprofiles.1 (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\hotbarsa (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\IGB (Rogue.Residue) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.TryMedia) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\IGB (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WebMediaPlayer.exe (Adware.EGDAccess) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live-Player (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\WebMediaPlayer (Rogue.WebMedia) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.  Infected Registry value(s): HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\znsfjgc (Trojan.Agent.H) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsa shellu (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bmimzmhmfm (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\losalamos (Trojan.FakeAlert) -> Quarantined and deleted successfully.  Infected Registry data item(s): (No harmful item detected)  Infected folder(s): C:\ProgramData\2ACA5CC3-0F83-453D-A079-1076FE1A8B65 (Adware.Seekmo) -> Quarantined and deleted successfully. C:\Program Files\InternetGameBox (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\InternetGameBoxesources (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\InternetGameBoxesources\favorites (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\InternetGameBox\skins (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\WebMediaPlayer (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\WebMediaPlayeresources (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\WebMediaPlayer\skins (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\WebMediaPlayer\updates (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Users\christel\AppData\Roaming\Hotbar (Adware.Hotbar) -> Delete on reboot. C:\ProgramData\HotbarSA (Adware.Hotbar) -> Quarantined and deleted successfully. C:\Users\christel\AppData\Roaming\WeatherDPA (Adware.Hotbar) -> Quarantined and deleted successfully. C:\Users\christel\AppData\Roaming\WeatherDPA\Weather (Adware.Hotbar) -> Quarantined and deleted successfully. C:\Users\christel\AppData\Roaming\WeatherDPA\Weather\WeatherDPA (Adware.Hotbar) -> Quarantined and deleted successfully. C:\Users\christel\AppData\Roaming\WeatherDPA\Weather\WeatherDPA\Weather_XML (Adware.Hotbar) -> Quarantined and deleted successfully. C:\Users\christel\AppData\Roaming\WeatherDPA\Weather\Weather_XML (Adware.Hotbar) -> Quarantined and deleted successfully.  Infected file(s): c:\Windows\System32\fmuaqej.dll (Trojan.Vundo.H) -> Delete on reboot. c:\Users\christel\AppData\Local\znsfjgc.exe (Trojan.Agent.H) -> Quarantined and deleted successfully. C:\Users\christel\lsass.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\Program Files\GamesBar\oberontb.dll (Adware.Gamesbar) -> Delete on reboot. C:\Users\christel\AppData\Local\Temp\Php.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\Program Files\InternetGameBox\Terms of Service.url (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\InternetGameBox\Privacy.url (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\InternetGameBox\InternetGameBox.exe (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\InternetGameBox\language (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\InternetGameBox\Website.url (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\InternetGameBoxesources\WaitOff.html (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\InternetGameBoxesources\WaitOn.html (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\InternetGameBoxesources\configv2_en.xml (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\InternetGameBoxesources\configv2_es.xml (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\InternetGameBoxesources\configv2_fr.xml (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\InternetGameBoxesources\favorites\defaultv2.swf (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\InternetGameBox\skins\skinv2.skn (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\WebMediaPlayer\Terms of Service.url (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\WebMediaPlayer\Privacy.url (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\WebMediaPlayer\sqlite3.dll (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\WebMediaPlayer\WebMediaPlayer.exe (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\WebMediaPlayer\Website.url (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\WebMediaPlayeresources\languages_v2.xml (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\WebMediaPlayeresources\webmedias (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\WebMediaPlayeresources\wmp_translation_file.xml (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Program Files\WebMediaPlayer\skins\classic.skn (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\ProgramData\HotbarSA\HotbarSA.dat (Adware.Hotbar) -> Quarantined and deleted successfully. C:\ProgramData\HotbarSA\HotbarSAAbout.mht (Adware.Hotbar) -> Quarantined and deleted successfully. C:\ProgramData\HotbarSA\HotbarSAau.dat (Adware.Hotbar) -> Quarantined and deleted successfully. C:\ProgramData\HotbarSA\HotbarSAEULA.mht (Adware.Hotbar) -> Quarantined and deleted successfully. C:\ProgramData\HotbarSA\HotbarSA_kyf.dat (Adware.Hotbar) -> Quarantined and deleted successfully. C:\ProgramData\HotbarSA\HotbarSA_kyf_update.dat (Adware.Hotbar) -> Quarantined and deleted successfully. C:\Users\christel\AppData\Roaming\WeatherDPA\Weather\log.txt (Adware.Hotbar) -> Quarantined and deleted successfully. C:\Users\christel\AppData\Roaming\WeatherDPA\Weather\WeatherStartup.xml (Adware.Hotbar) -> Quarantined and deleted successfully. C:\Users\christel\AppData\Roaming\WeatherDPA\Weather\WeatherDPA\ACItems (Adware.Hotbar) -> Quarantined and deleted successfully. C:\Users\christel\AppData\Roaming\WeatherDPA\Weather\WeatherDPA\WeatherPreferences (Adware.Hotbar) -> Quarantined and deleted successfully. C:\Users\christel\AppData\Roaming\WeatherDPA\Weather\WeatherDPA\Weather_XML\Display (Adware.Hotbar) -> Quarantined and deleted successfully. C:\Users\christel\AppData\Roaming\WeatherDPA\Weather\WeatherDPA\Weather_XML\Loading (Adware.Hotbar) -> Quarantined and deleted successfully. C:\Users\christel\AppData\Roaming\WeatherDPA\Weather\WeatherDPA\Weather_XML\screen1 (Adware.Hotbar) -> Quarantined and deleted successfully. C:\Users\christel\AppData\Roaming\WeatherDPA\Weather\WeatherDPA\Weather_XML\Version (Adware.Hotbar) -> Quarantined and deleted successfully. C:\Windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Windows\System32
vs2.inf (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Users\christel\iexplore.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\Users\christel\Local Settings\Application Data\znsfjgc_nav.dat (Adware.NaviPromo) -> Quarantined and deleted successfully. C:\Users\christel\Local Settings\Application Data\znsfjgc_navps.dat (Adware.NaviPromo) -> Quarantined and deleted successfully. C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully.

Anonymous user · Answer

Reopen Malwarebytes, go to quarantine and delete everything.

#####

• Download Random's System Information Tool (RSIT) (by random/random) to your Desktop.
• Double-click on RSIT.exe to launch the program.
• Click Continue on the Disclaimer screen.
• If the HijackThis tool (updated version) is not present or not detected on the computer, RSIT will download it (allow access in your firewall if prompted) and you will need to accept the license.
• Once the scan is complete, two text files will open. Post the content of log.txt (the one displayed on the screen) as well as info.txt (which you will see in the taskbar).

Note: reports are saved in the folder C:\rsit.
--
@+

elodu21 · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by christel at 2010-01-29 00:46:33
Microsoft® Windows Vista™ Home Basic Edition Service Pack 1
System drive C: has 37 GB (34%) free of 109 GB
Total RAM: 1013 MB (22% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:46:46, on 29/01/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Users\christel\AppData\Local\Temp\Phr.exe
C:\Windows\system32\ctfmon.exe
C:\Windows\system32\sdclt.exe
C:\Windows\explorer.exe
C:\Program Files\Boonty\BoontyBox\BoontyBox.exe
C:\Program Files\D-Jix\D-Jix Media\D-Jix Media.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\christel\Desktop\RSIT.exe
C:\Program Files\trend micro\christel.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: SFR Navigation Helper - {0F6E720A-1A6B-40E1-A294-1D4D19F156C8} - C:\Program Files\SFR\Kit\SFRNavErrorHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: P2P Energy Toolbar - {2bae58c2-79f9-45d1-a286-81f911301c3a} - C:\Program Files\P2P_Energy\tbP2P_.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Sign-in Assistant Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: P2P Energy Toolbar - {2bae58c2-79f9-45d1-a286-81f911301c3a} - C:\Program Files\P2P_Energy\tbP2P_.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [VMSnap5] C:\Windows\VMSnap5.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [FixCamera] C:\Windows\FixCamera.exe
O4 - HKLM\..\Run: [tsnp325] C:\Windows\tsnp325.exe
O4 - HKLM\..\Run: [snp325] C:\Windows\vsnp325.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [BEWINTERNET-FR-DMGP-V2SessionManager] "C:\Program Files\Orange\IEWInternet\SessionManager\SessionManager.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [paejio] C:\Users\christel\paejio.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O4 - Startup: BoontyBox NRJ.lnk = C:\Program Files\Boonty\BoontyBox\BoontyBox.exe
O4 - Startup: D-Jix Media.lnk = C:\Program Files\D-Jix\D-Jix Media\D-Jix Media.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: Direct Add - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Direct Add in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O13 - Gopher Prefix:
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Licensing NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Update Service (gupdate1c9a96b6d67e510) (gupdate1c9a96b6d67e510) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 9320 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Google Software Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\User_Feed_Synchronization-{159DFC3B-5CE0-4277-835F-953B43C25013}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
&Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2007-10-19 817936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}]
SFR Navigation Helper - C:\Program Files\SFR\Kit\SFRNavErrorHelper.dll [2009-10-15 165184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2bae58c2-79f9-45d1-a286-81f911301c3a}]
P2P Energy Toolbar - C:\Program Files\P2P_Energy\tbP2P_.dll [2007-12-10 1510424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2009-12-03 329312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2009-05-19 137600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Assistant Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - c:\program files\google\googletoolbar2.dll [2007-07-06 2436160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll [2009-11-26 764912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-11-07 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar2.dll [2007-07-06 2436160]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2007-10-19 817936]
{2bae58c2-79f9-45d1-a286-81f911301c3a} - P2P Energy Toolbar - C:\Program Files\P2P_Energy\tbP2P_.dll [2007-12-10 1510424]
{21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-11-15 815104]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2006-11-06 98304]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2006-11-06 106496]
"Persistence"=C:\Windows\system32\igfxpers.exe [2006-11-06 81920]
"QPService"=C:\Program Files\HP\QuickPlay\QPService.exe [2006-12-02 167936]
"QlbCtrl"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2006-11-06 159744]
"HP Health Check Scheduler"=C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2006-12-04 46704]
"WAWifiMessage"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [2006-10-18 317152]
"hpWirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2006-10-18 472800]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-11-07 149280]
"VMSnap5"=C:\Windows\VMSnap5.EXE [2006-06-28 49152]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2007-10-24 286720]
"FixCamera"=C:\Windows\FixCamera.exe [2007-02-12 20480]
"tsnp325"=C:\Windows\tsnp325.exe [2006-10-10 270336]
"snp325"=C:\Windows\vsnp325.exe [2006-10-10 827392]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000]
"BrMfcWnd"=C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2006-11-24 622592]
"ControlCenter3"=C:\Program Files\Brother\ControlCenter3\brctrcen.exe [2006-07-19 65536]
"BEWINTERNET-FR-DMGP-V2SessionManager"=C:\Program Files\Orange\IEWInternet\SessionManager\SessionManager.exe []
"HP Software Update"=C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [2008-12-08 54576]
""= []
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2009-12-03 198160]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"=C:\Windows\SMINST\launcher.exe [2006-11-07 44128]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-01-19 1233920]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2007-08-30 68856]
"MsnMsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-07-26 3883856]
"BitTorrent DNA"=C:\Program Files\DNA\btdna.exe [2010-01-28 323392]
"PC Suite Tray"=C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe [2009-06-25 1414144]
"paejio"=C:\Users\christel\paejio.exe [2010-01-27 69632]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE

C:\Users\christel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
BoontyBox NRJ.lnk - C:\Program Files\Boonty\BoontyBox\BoontyBox.exe
D-Jix Media.lnk - C:\Program Files\D-Jix\D-Jix Media\D-Jix Media.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2006-11-06 212992]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=128
"NoDriveTypeAutoRun"=128
"HonorAutoRunSetting"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2010-01-29 00:34:15 ----RASHD---- C:\autorun.inf
2010-01-29 00:23:46 ----A---- C:\UsbFix.txt
2010-01-29 00:19:36 ----D---- C:\UsbFix
2010-01-28 21:42:54 ----D---- C:\Program Files\My Downloaded Games
2010-01-28 21:42:54 ----D---- C:\Program Files\BoontyGames
2010-01-28 21:37:37 ----D---- C:\Ad-Remover
2010-01-28 21:24:00 ----A---- C:\Windows\WORDPAD.INI
2010-01-28 21:14:29 ----D---- C:\Program Files\trend micro
2010-01-28 21:14:20 ----D---- C:\rsit
2010-01-27 17:25:51 ----D---- C:\Users\christel\AppData\Roaming\Malwarebytes
2010-01-27 17:25:29 ----D---- C:\ProgramData\Malwarebytes
2010-01-27 17:25:27 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-01-27 15:50:58 ----A---- C:\Windows\ntbtlog.txt
2010-01-27 14:52:54 ----D---- C:\Program Files\SFR
2010-01-22 18:09:05 ----A---- C:\Windows\system32\mshtml.dll
2010-01-22 18:09:02 ----A---- C:\Windows\system32\occache.dll
2010-01-22 18:08:58 ----A---- C:\Windows\system32\wininet.dll
2010-01-22 18:08:55 ----A---- C:\Windows\system32\urlmon.dll
2010-01-22 18:08:47 ----A---- C:\Windows\system32\ieframe.dll
2010-01-22 18:08:45 ----A---- C:\Windows\system32\ieapfltr.dll
2010-01-22 18:08:43 ----A---- C:\Windows\system32\iertutil.dll
2010-01-22 18:08:41 ----A---- C:\Windows\system32\iedkcs32.dll
2010-01-22 18:08:39 ----A---- C:\Windows\system32\msfeeds.dll
2010-01-22 18:08:37 ----A---- C:\Windows\system32\iepeers.dll
2010-01-22 18:08:35 ----A---- C:\Windows\system32\ieaksie.dll
2010-01-22 18:08:29 ----A---- C:\Windows\system32\ieUnatt.exe
2010-01-22 18:08:27 ----A---- C:\Windows\system32\ieencode.dll
2010-01-22 18:08:26 ----A---- C:\Windows\system32\mstime.dll
2010-01-22 18:08:23 ----A---- C:\Windows\system32\jsproxy.dll
2010-01-13 10:28:24 ----A---- C:\Windows\system32\t2embed.dll
2010-01-13 10:28:24 ----A---- C:\Windows\system32\fontsub.dll

======List of files/folders modified in the last 1 months======

2010-01-29 00:46:44 ----D---- C:\Windows\Prefetch
2010-01-29 00:43:10 ----D---- C:\Windows\Temp
2010-01-29 00:34:11 ----SD---- C:\Windows\Downloaded Program Files
2010-01-29 00:31:19 ----SHD---- C:\$RECYCLE.BIN
2010-01-29 00:27:02 ----D---- C:\Windows\Tasks
2010-01-29 00:21:34 ----D---- C:\Users\christel\AppData\Roaming\DNA
2010-01-29 00:07:09 ----D---- C:\Program Files\DNA
2010-01-29 00:02:11 ----SHD---- C:\Windows\Installer
2010-01-28 23:59:36 ----HD---- C:\ProgramData
2010-01-28 23:53:40 ----RD---- C:\Program Files
2010-01-28 23:32:19 ----D---- C:\Windows\system32\Tasks
2010-01-28 21:24:00 ----D---- C:\Windows
2010-01-28 18:49:25 ----D---- C:\Windows\Minidump
2010-01-28 18:21:20 ----D---- C:\ProgramData\Google Updater
2010-01-28 18:17:20 ----D---- C:\Windows\system32\catroot2
2010-01-28 09:07:36 ----D---- C:\Windows\System32
2010-01-28 09:07:36 ----D---- C:\Windows\AppPatch
2010-01-28 09:07:34 ----D---- C:\Windows\system32\drivers
2010-01-27 20:57:27 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-01-27 20:57:26 ----D---- C:\Windows\inf
2010-01-27 17:02:00 ----D---- C:\Program Files\Real
2010-01-27 14:56:09 ----SHD---- C:\System Volume Information
2010-01-23 11:29:49 ----D---- C:\Program Files\Internet Explorer
2010-01-23 10:08:26 ----D---- C:\Windows\winsxs
2010-01-22 18:00:52 ----D---- C:\Windows\system32\catroot
2010-01-20 15:48:52 ----D---- C:\Program Files\Microsoft Silverlight
2010-01-14 11:12:06 ----N----

Anonymous user · Answer

• Download Ad-remover (from C_XX) to your desktop:

! Log out and close all running applications (including the browser)!

• Double click on Ad-remover.exe on your desktop to launch the tool.

• In the main menu, choose the option "S" and press [enter].

• The scan will start, let the tool work and do not touch anything...

--> Post the report that appears at the end.

( The report is also saved under C:\Ad-report-SCAN.log )
( CTRL+A to select all, CTRL+C to copy and CTRL+V to paste )

Note: "Process.exe", a component of the tool, is detected by some antivirus programs:
(AntiVir, Dr.Web, Kaspersky Anti-Virus) as a RiskTool.
It is not a virus, but a utility intended to end processes.
In the wrong hands, this utility could stop security software (Antivirus, Firewall...) hence the alert issued by these antivirus programs.

• Tutorial: http://pagesperso-orange.fr/NosTools/tuto_ad_r2.html
--
@+

elodu21 · Answer

.======= AD-REMOVER REPORT 1.1.4.6_I | WINDOWS XP/VISTA/7 ONLY ======= . Updated by C_XX on 28.01.2010 at 18:26 Contact: AdRemover.contact@gmail.com Website: http://pagesperso-orange.fr/NosTools/ad_remover.html . Run at: 21:52:55, 28/01/2010 | Normal Mode | Option: SCAN Executed from: C:\Ad-Remover\ Operating System: Microsoft® Windows Vista™ HomeBasic Service Pack 2 v6.0.6001 Computer Name: PC-DE-CHRISTEL | Current User: christel . ============== ITEM(S) FOUND ============== .  C:\Users\christel\AppData\Roaming\Mozilla\FireFox\Profiles	s52l1vh.default\searchplugins\ask.xml C:\Windows\Installer\{59971D79-8111-42C2-9E40-883A0C277E78} C:\Program Files\Mozilla FireFox\Components\AskHPRFF.js C:\Program Files\Mozilla FireFox\Components\AskSearch.js C:\Users\christel\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\InternetGameBox C:\Users\christel\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Live-Player C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\GamesBar C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Hotbar C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\InternetGameBox C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Live-Player C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\WebMediaPlayer C:\Program Files\AskBarDis C:\Program Files\GamesBar C:\Program Files\Live-Player C:\Program Files\SweetIM C:\Users\christel\AppData\Roaming\live-player C:\Users\christel\AppData\LocalLow\Hotbar C:\Users\christel\AppData\LocalLow\SweetIM C:\ProgramData\GamesBar C:\ProgramData\SweetIM C:\Windows\Installer\15a51114.msi C:\Windows\Installer\15a5111a.msi C:\Users\christel\Desktop\My Shortcuts\Live-Player.lnk C:\Users\christel\Desktop\My Shortcuts\SweetImSetup.exe C:\Users\christel\AppData\Local\dkpwywqdp_navtmp.dat C:\Users\christel\AppData\Local\kiycmso.bat . HKCU\software\appdatalow\AskBarDis HKCU\software\appdatalow\software\Hotbar HKCU\software\GamesBar HKCU\software\Live-Player HKCU\software\microsoft\internet explorer\searchscopes\{CF739809-1C6C-47C0-85B9-569DBB141420} HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{3041d03e-fd4b-44e0-b742-2d9b88305f98} HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{3041D03E-FD4B-44E0-B742-2D9B88305F98} HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{EEE6C35B-6118-11DC-9C72-001320C79847} HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{EEE6C35B-6118-11DC-9C72-001320C79847} HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847} HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847} HKCU\software\SweetIM HKLM\software\AskBarDis HKLM\software\classes\AskIBar.PopSwatterBarButton HKLM\software\classes\AskIBar.PopSwatterBarButton.1 HKLM\software\classes\AskIBar.PopSwatterSettingsControl HKLM\software\classes\AskIBar.PopSwatterSettingsControl.1 HKLM\software\classes\AskToolBar.SettingsPlugin HKLM\software\classes\AskToolBar.SettingsPlugin.1 HKLM\Software\Classes\CLSID\{0702a2b6-13aa-4090-9e01-bcdc85dd933f} HKLM\Software\Classes\CLSID\{08993A7C-E764-4172-9627-BFB5EA6897B2} HKLM\Software\Classes\CLSID\{128A6C66-AC6A-4617-8268-AB7F47B7215E} HKLM\Software\Classes\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed} HKLM\Software\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98} HKLM\Software\Classes\CLSID\{571715D7-3395-4DF0-B43C-784836209E60} HKLM\Software\Classes\CLSID\{622fd888-4e91-4d68-84d4-7262fd0811bf} HKLM\Software\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A} HKLM\Software\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064} HKLM\Software\Classes\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b} HKLM\Software\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847} HKLM\Software\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847} HKLM\Software\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847} HKLM\Software\Classes\Interface\{4634804A-F0B0-4A74-A550-FC0EEF8A4362} HKLM\Software\Classes\Interface\{4C07EA4F-5F52-4222-B170-4CD9ED33BAEA} HKLM\Software\Classes\Interface\{C44FEFF4-EF0C-4CF7-83D0-92B4266A32B9} HKLM\Software\Classes\Interface\{F131923C-381D-4E4C-A472-4A17118FD742} HKLM\software\classes\MediaPlayer.GraphicsUtils HKLM\software\classes\MediaPlayer.GraphicsUtils.1 HKLM\software\classes\MgMediaPlayer.GifAnimator HKLM\software\classes\MgMediaPlayer.GifAnimator.1 HKLM\software\classes\SWEETIE.IEToolbar HKLM\software\classes\SWEETIE.IEToolbar.1 HKLM\software\classes\SWEETIE.SWEETIE HKLM\software\classes\SWEETIE.SWEETIE.3 HKLM\software\classes\SweetIM_URLSearchHook.ToolbarURLSearchHook HKLM\software\classes\SweetIM_URLSearchHook.ToolbarURLSearchHook.1 HKLM\software\classes\Toolbar3.SWEETIE HKLM\software\classes\Toolbar3.SWEETIE.1 HKLM\Software\Classes\TypeLib\{4B1C1E16-6B34-430E-B074-5928ECA4C150} HKLM\Software\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19} HKLM\Software\Classes\TypeLib\{D2E5FA06-DCC7-46F9-BEFF-BFD06F69B9B2} HKLM\Software\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847} HKLM\Software\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847} HKLM\software\GamesBar HKLM\software\GamesBarSetup HKLM\software\Live-Player HKLM\software\microsoft\internet explorer\searchscopes\{EEE6C360-6118-11DC-9C72-001320C79847} HKLM\Software\Microsoft\Internet Explorer\Toolbar\{3041D03E-FD4B-44E0-B742-2D9B88305F98} HKLM\Software\Microsoft\Internet Explorer\Toolbar\{3041d03e-fd4b-44e0-b742-2d9b88305F98} HKLM\Software\Microsoft\Internet Explorer\Toolbar\{EEE6C35B-6118-11DC-9C72-001320C79847} HKLM\Software\Microsoft\Internet Explorer\Toolbar\{EEE6C35B-6118-11DC-9C72-001320C79847} HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\OBget.exe HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed} HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35B-6118-11DC-9C72-001320C79847} HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\02F47BF73B948514FAACADD8CBBDF37D HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\080D9F5E1E95FEE4794CE438E635239E HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\1E264E0A5959A1C46BA9175A878B12EA HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\2E6768B6932D112438F047C54D180635 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\351716A953E21214898904032EAE2E81 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A189D17A469616C4688D23E192996267 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9 HKLM\Software\Microsoft\Windows\CurrentVersion\Run\SweetIM HKLM\software\microsoft\windows\currentversion\uninstall\Ask Toolbar_is1 HKLM\software\microsoft\windows\currentversion\uninstall\GamesBar HKLM\Software\Mozilla\Firefox\Extensions\Hotbar@Hotbar.com HKLM\software\SweetIM HKU\s-1-5-21-3998010976-912583937-2554579818-1000\software\appdatalow\AskBarDis HKU\s-1-5-21-3998010976-912583937-2554579818-1000\software\appdatalow\software\Hotbar HKU\s-1-5-21-3998010976-912583937-2554579818-1000\software\GamesBar HKU\s-1-5-21-3998010976-912583937-2554579818-1000\software\Live-Player HKU\s-1-5-21-3998010976-912583937-2554579818-1000\software\SweetIM . ============== Additional Scan ============== . . * Mozilla FireFox Version 2.0.0.20 [fr] * .  Profile Name: ts52l1vh.default (christel) . (christel, prefs.js) Browser.download.lastDir, C:\Users\christel\Pictures (christel, prefs.js) Browser.search.defaultenginename, Search the web (christel, prefs.js) Browser.search.defaulturl, hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch (christel, prefs.js) Browser.search.selectedEngine, Google (christel, prefs.js) Browser.startup.homepage, hxxp://fr.msn.com/ (christel, prefs.js) Keyword.URL, hxxp://redirecterror.sfr.fr/?q= . (christel, prefs.js) FOUND - CommunityToolbar.SearchFromAddressBarSavedUrl, hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101761&gct=&gc=1&q= . (christel, prefs.js) FOUND - Extensions.snipit.chromeURL, hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101761&gct=&gc=1&q={searchTerms}&crm=1 (christel, prefs.js) FOUND - Extensions.snipit.history_query, effacer%20ask%20de%20la%20page%20d%20aceuil=ASKURL=hxxp://www.ask.com/web?q=effacer%20ask%20de%20la%20page%20d%20aceuil&qsrc=2871&o=101761&l=dis||effacer%20ask%20de%20la%20page%20d%20aceuil=ASKURL=//www.ask.com/web?q=effacer%20ask%20de%20la%20page%20d%20aceuil&qsrc=2871&o=101761&l=dis||effacer%20ask%20de%20la%20page%20d%20aceuil=ASKURL=//www.ask.com/web?q=effacer%20ask%20de%20la%20page%20d%20aceuil&qsrc=2871&o=101761&l=dis||effacer%20ask%20de%20la%20page%20d%20aceuil=ASKURL=//www.ask.com/web?q=effacer%20ask%20de%20la%20page%20d%20aceuil&qsrc=2871&o=101761&l=dis||effacer%20ask%20de%20la%20page%20d%20aceuil=ASKURL=//www.ask.com/web?q=effacer%20ask%20de%20la%20page%20d%20aceuil&qsrc=2871&o=101761&l=dis . .(christel, user.js) Keyword.URL, hxxp://redirecterror.sfr.fr/?q= . . * Internet Explorer Version 7.0.6001.18000 * . [HKEY_CURRENT_USER\..\Internet Explorer\Main] . Do404Search: 01000000 Local Page: C:\Windows\system32\blank.htm Show_ToolBar: yes Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896 Enable Browser Extensions: yes Start Page: hxxp://www.sfr.fr/kit/adsl/ . [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main] . Start Page: hxxp://home.sweetim.com Default_Page_URL: hxxp://fr.yahoo.com Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896 Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896 Delete_Temp_Files_On_Exit: yes Local Page: %SystemRoot%\system32\blank.htm . [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS] . Tabs: res://ieframe.dll/tabswelcome.htm . =================================== . 518 Bytes - C:\Ad-Report-SCAN[1].log 15105 Bytes - C:\Ad-Report-SCAN[2].log . 2180 Files - C:\Users\christel\AppData\Local\Temp 54 Files - C:\Windows\Temp 129 Files - C:\Windows\Prefetch . 4 Files - C:\Ad-Remover\BACKUP 0 Files - C:\Ad-Remover\QUARANTINE . Finished at: 22:33:28 | 28/01/2010 - SCAN[2] . ============== E.O.F ============== .

Anonymous user · Answer

Re Christelle, please follow up on the ad remover and choose option L, and post the report please. -- @+

elodu21 · Answer

```
======= AD-REMOVER REPORT 1.1.4.6_I | WINDOWS ONLY XP/VISTA/7 ======= . Updated by C_XX on 28.01.2010 at 18:26 Contact: AdRemover.contact@gmail.com Website: http://pagesperso-orange.fr/NosTools/ad_remover.html . Started at: 23:32:18, 28/01/2010 | Normal Mode | Option: CLEAN Executed from: C:\Ad-Remover\ Operating System: Microsoft® Windows Vista™ HomeBasic Service Pack 2 v6.0.6001 PC Name: PC-DE-CHRISTEL | Current User: christel . ============== NEUTRALIZED ELEMENT(S) ============== .  C:\Users\christel\AppData\Roaming\Mozilla\FireFox\Profiles	s52l1vh.default\searchplugins\ask.xml C:\Windows\Installer\{59971D79-8111-42C2-9E40-883A0C277E78} C:\Program Files\Mozilla FireFox\Components\AskHPRFF.js C:\Program Files\Mozilla FireFox\Components\AskSearch.js C:\Users\christel\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\InternetGameBox C:\Users\christel\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Live-Player C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\GamesBar C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Hotbar C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\InternetGameBox C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Live-Player C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\WebMediaPlayer C:\Program Files\AskBarDis C:\Program Files\GamesBar C:\Program Files\Live-Player C:\Program Files\SweetIM C:\Users\christel\AppData\Roaming\live-player C:\Users\christel\AppData\LocalLow\Hotbar C:\Users\christel\AppData\LocalLow\SweetIM C:\ProgramData\GamesBar C:\ProgramData\SweetIM C:\Windows\Installer\15a51114.msi C:\Windows\Installer\15a5111a.msi C:\Users\christel\Desktop\My shortcuts\Live-Player.lnk C:\Users\christel\Desktop\My shortcuts\SweetImSetup.exe C:\Users\christel\AppData\Local\dkpwywqdp_navtmp.dat C:\Users\christel\AppData\Local\kiycmso.bat  (!) -- Temporary files deleted.  . HKCU\software\appdatalow\AskBarDis HKCU\software\appdatalow\software\Hotbar HKCU\software\GamesBar HKCU\software\Live-Player HKCU\software\microsoft\internet explorer\searchscopes\{CF739809-1C6C-47C0-85B9-569DBB141420} HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{3041d03e-fd4b-44e0-b742-2d9b88305f98} HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{EEE6C35B-6118-11DC-9C72-001320C79847} HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847} HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847} HKCU\software\SweetIM HKLM\software\AskBarDis HKLM\software\classes\AskIBar.PopSwatterBarButton HKLM\software\classes\AskIBar.PopSwatterBarButton.1 HKLM\software\classes\AskIBar.PopSwatterSettingsControl HKLM\software\classes\AskIBar.PopSwatterSettingsControl.1 HKLM\software\classes\AskToolBar.SettingsPlugin HKLM\software\classes\AskToolBar.SettingsPlugin.1 HKLM\Software\Classes\CLSID\{0702a2b6-13aa-4090-9e01-bcdc85dd933f} HKLM\Software\Classes\CLSID\{08993A7C-E764-4172-9627-BFB5EA6897B2} HKLM\Software\Classes\CLSID\{128A6C66-AC6A-4617-8268-AB7F47B7215E} HKLM\Software\Classes\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed} HKLM\Software\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98} HKLM\Software\Classes\CLSID\{571715D7-3395-4DF0-B43C-784836209E60} HKLM\Software\Classes\CLSID\{622fd888-4e91-4d68-84d4-7262fd0811bf} HKLM\Software\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A} HKLM\Software\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064} HKLM\Software\Classes\CLSID\{b0de3308-5d5a-470d-81b9-634fc078393b} HKLM\Software\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847} HKLM\Software\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847} HKLM\Software\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847} HKLM\Software\Classes\Interface\{4634804A-F0B0-4A74-A550-FC0EEF8A4362} HKLM\Software\Classes\Interface\{4C07EA4F-5F52-4222-B170-4CD9ED33BAEA} HKLM\Software\Classes\Interface\{C44FEFF4-EF0C-4CF7-83D0-92B4266A32B9} HKLM\Software\Classes\Interface\{F131923C-381D-4E4C-A472-4A17118FD742} HKLM\software\classes\MediaPlayer.GraphicsUtils HKLM\software\classes\MediaPlayer.GraphicsUtils.1 HKLM\software\classes\MgMediaPlayer.GifAnimator HKLM\software\classes\MgMediaPlayer.GifAnimator.1 HKLM\software\classes\SWEETIE.IEToolbar HKLM\software\classes\SWEETIE.IEToolbar.1 HKLM\software\classes\SWEETIE.SWEETIE HKLM\software\classes\SWEETIE.SWEETIE.3 HKLM\software\classes\SweetIM_URLSearchHook.ToolbarURLSearchHook HKLM\software\classes\SweetIM_URLSearchHook.ToolbarURLSearchHook.1 HKLM\software\classes\Toolbar3.SWEETIE HKLM\software\classes\Toolbar3.SWEETIE.1 HKLM\Software\Classes\TypeLib\{4B1C1E16-6B34-430E-B074-5928ECA4C150} HKLM\Software\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19} HKLM\Software\Classes\TypeLib\{D2E5FA06-DCC7-46F9-BEFF-BFD06F69B9B2} HKLM\Software\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847} HKLM\Software\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847} HKLM\software\GamesBar HKLM\software\GamesBarSetup HKLM\software\Live-Player HKLM\software\microsoft\internet explorer\searchscopes\{EEE6C360-6118-11DC-9C72-001320C79847} HKLM\Software\Microsoft\Internet Explorer\Toolbar\{3041d03e-fd4b-44e0-b742-2d9b88305f98} HKLM\Software\Microsoft\Internet Explorer\Toolbar\{EEE6C35B-6118-11DC-9C72-001320C79847} HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\OBget.exe HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed} HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35B-6118-11DC-9C72-001320C79847} HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\02F47BF73B948514FAACADD8CBBDF37D HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\080D9F5E1E95FEE4794CE438E635239E HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\1E264E0A5959A1C46BA9175A878B12EA HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\2E6768B6932D112438F047C54D180635 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\351716A953E21214898904032EAE2E81 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\4318DF19719275242801CBE292063A4C HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A189D17A469616C4688D23E192996267 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0 HKLM\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9 HKLM\Software\Microsoft\Windows\CurrentVersion\Run\SweetIM HKLM\software\microsoft\windows\currentversion\uninstall\Ask Toolbar_is1 HKLM\software\microsoft\windows\currentversion\uninstall\GamesBar HKLM\Software\Mozilla\Firefox\Extensions\Hotbar@Hotbar.com HKLM\software\SweetIM . ============== Additional Scan ============== . . * Mozilla FireFox Version 2.0.0.20 [fr] * .  Profile Name: ts52l1vh.default (christel) . (christel, prefs.js) Browser.download.lastDir, C:\Users\christel\Pictures (christel, prefs.js) Browser.search.defaultenginename, Search the web (christel, prefs.js) Browser.search.defaulturl, hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch (christel, prefs.js) Browser.search.selectedEngine, Google (christel, prefs.js) Browser.startup.homepage, hxxp://fr.msn.com/ (christel, prefs.js) Keyword.URL, hxxp://redirecterror.sfr.fr/?q= . (christel, prefs.js) DELETE - CommunityToolbar.SearchFromAddressBarSavedUrl, hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101761&gct=&gc=1&q= (christel, prefs.js) DELETE - Extensions.snipit.chromeURL, hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101761&gct=&gc=1&q={searchTerms}&crm=1 (christel, prefs.js) DELETE - Extensions.snipit.history_query, delete%20ask%20from%20the%20home%20page=ASKURL=hxxp://www.ask.com/web?q=delete%20ask%20from%20the%20home%20page&qsrc=2871&o=101761&l=dis||delete%20ask%20from%20the%20home%20page=ASKURL=//www.ask.com/web?q=delete%20ask%20from%20the%20home%20page&qsrc=2871&o=101761&l=dis||delete%20ask%20from%20the%20home%20page=ASKURL=//www.ask.com/web?q=delete%20ask%20from%20the%20home%20page&qsrc=2871&o=101761&l=dis||delete%20ask%20from%20the%20home%20page=ASKURL=//www.ask.com/web?q=delete%20ask%20from%20the%20home%20page&qsrc=2871&o=101761&l=dis||delete%20ask%20from%20the%20home%20page=ASKURL=//www.ask.com/web?q=delete%20ask%20from%20the%20home%20page&qsrc=2871&o=101761&l=dis . (christel, user.js) Keyword.URL, hxxp://redirecterror.sfr.fr/?q= . . * Internet Explorer Version 7.0.6001.18000 * . [HKEY_CURRENT_USER\..\Internet Explorer\Main] . Do404Search: 01000000 Local Page: C:\Windows\system32\blank.htm Show_ToolBar: yes Enable Browser Extensions: yes Start Page: hxxp://fr.msn.com/ Default_search_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch Default_page_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896 . [HKEY_LOCAL_MACHINE\..\Internet Explorer\Main] . Start Page: hxxp://fr.msn.com/ Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch Delete_Temp_Files_On_Exit: yes Local Page: %SystemRoot%\system32\blank.htm Search bar: hxxp://search.msn.com/spbasic.htm . [HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS] . Tabs: res://ieframe.dll/tabswelcome.htm . =================================== . 523 Bytes - C:\Ad-Report-CLEAN[1].log 523 Bytes - C:\Ad-Report-CLEAN[2].log 14716 Bytes - C:\Ad-Report-CLEAN[3].log 518 Bytes - C:\Ad-Report-SCAN[1].log 15449 Bytes - C:\Ad-Report-SCAN[2].log . 1981 File(s) - C:\Users\christel\AppData\Local\Temp 49 File(s) - C:\Windows\Temp 0 File(s) - C:\Windows\Prefetch . 25 File(s) - C:\Ad-Remover\BACKUP 640 File(s) - C:\Ad-Remover\QUARANTINE . End at: 0:05:50 | 29/01/2010 - CLEAN[3] . ============== E.O.F ============== .
```

Anonymous user · Answer

Re Elodie, well done ;)

Delete usbfix.exe

Then:

Disable UAC Vista:

http://pagesperso-orange.fr/nostools/uac_vista.html and restart

######### Then:

• Download UsbFix to your Desktop:

(!) Connect your external data sources to your PC (USB stick, external hard drive, etc...) that may have been infected without opening them.

• Double click on UsbFix.exe present on your desktop.

• In the main menu choose the option " F " for French and hit [enter].

• In the second menu choose the option " 2 " (Deletion) and hit [enter]

• Your desktop will disappear and the PC will restart.

• Upon restarting, UsbFix will scan your PC, let the tool work.

• Then post the UsbFix.txt report that will appear with the desktop.

• Note: The UsbFix.txt report is saved at the root of the drive. (C:\UsbFix.txt)

( CTRL+A to select all, CTRL+C to copy and CTRL+V to paste )

Note: "Process.exe", a component of the tool, is detected by some antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) as a RiskTool.
It is not a virus but a utility meant to terminate processes.
In the wrong hands, this utility could stop security software (Antivirus, Firewall...) hence the alert issued by these antivirus programs.

• Tutorial: http://pagesperso-orange.fr/NosTools/tuto_usbfix3.html
• Home: http://pagesperso-orange.fr/NosTools/usbfix.html

--
@+

elodu21 · Answer

I don't understand why I have to uninstall UsbFix to reinstall it afterwards???

Anonymous user · Answer

Because a new update is available .. -- @+

elodu21 · Answer

############################## | UsbFix V6.081 |

User : christel (Administrators) # PC-DE-CHRISTEL
Update on 28/01/2010 by El Desaparecido , C_XX & Chimay8
Start at: 00:24:11 | 29/01/2010
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com

Genuine Intel(R) CPU T2060 @ 1.60GHz
Microsoft® Windows Vista™ Home Basic Edition (6.0.6001 32-bit) # Service Pack 1
Internet Explorer 7.0.6001.18000
Windows Firewall Status : Enabled

C:\ -> Local fixed disk # 106.89 Go (36.16 Go free) # NTFS
D:\ -> Local fixed disk # 4.89 Go (4.1 Go free) [PRESARIO_RP] # NTFS
E:\ -> CD-ROM drive

############################## | Active processes |

C:\Windows\System32\smss.exe 424
C:\Windows\system32\csrss.exe 512
C:\Windows\system32\wininit.exe 556
C:\Windows\system32\csrss.exe 564
C:\Windows\system32\services.exe 600
C:\Windows\system32\lsass.exe 612
C:\Windows\system32\lsm.exe 620
C:\Windows\system32\winlogon.exe 648
C:\Windows\system32\svchost.exe 808
C:\Windows\system32\svchost.exe 892
C:\Windows\System32\svchost.exe 932
C:\Windows\System32\svchost.exe 1024
C:\Windows\System32\svchost.exe 1100
C:\Windows\system32\svchost.exe 1132
C:\Windows\system32\SLsvc.exe 1256
C:\Windows\system32\svchost.exe 1296
C:\Windows\system32\svchost.exe 1444
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 1604
C:\Program Files\Alwil Software\Avast4\ashServ.exe 1628
C:\Windows\system32\Dwm.exe 1756
C:\Windows\Explorer.EXE 1764
C:\Windows\system32\runonce.exe 1820
C:\Windows\System32\spoolsv.exe 196
C:\Windows\system32\taskeng.exe 276
C:\Windows\system32\svchost.exe 444
C:\Windows\system32\taskeng.exe 824
C:\Users\christel\AppData\Local\Temp\Phr.exe 1428
C:\Windows\system32\svchost.exe 248
C:\Program Files\Google\Update\GoogleUpdate.exe 1816
C:\Program Files\Common Files\LightScribe\LSSrvc.exe 2084
C:\Windows\system32\svchost.exe 2224
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 2288
C:\Windows\system32\svchost.exe 2340
C:\Windows\System32\svchost.exe 2384
C:\Windows\system32\SearchIndexer.exe 2456
C:\Windows\system32\DRIVERS\xaudio.exe 2516
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe 2540
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe 2844
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe 2872
C:\Windows\System32\alg.exe 2956
C:\Windows\system32\wbem\wmiprvse.exe 3160
C:\Windows\system32\WerCon.exe 3328

################## | Infectious elements |

Deleted! C:\Windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
Deleted! C:\Users\christel\AppData\Local\Temp\Phq.exe
Deleted! C:\Users\christel\AppData\Local\Temp\Phr.exe
Deleted! C:\Users\christel\AppData\Local\Temp\a.dat
Deleted! C:\Users\christel\AppData\Local\Temp\sshnas21.dll
Deleted! C:\$Recycle.Bin\S-1-5-21-3998010976-912583937-2554579818-1000
Deleted! C:\$Recycle.Bin\S-1-5-21-4193549221-1683869985-1229017860-500
Deleted! D:\$Recycle.Bin\S-1-5-21-3998010976-912583937-2554579818-1000

################## | Registry |

Deleted! [HKCU\SOFTWARE\BMIMZMHMFM]
Deleted! [HKCU\SOFTWARE\XML]
Deleted! [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BMIMZMHMFM"

################## | Mountpoints2 |

Deleted! HKCU\...\Explorer\MountPoints2\F\Shell\AutoRun\Command
Deleted! HKCU\...\Explorer\MountPoints2\{05b3a120-c8fe-11de-bab0-001636f11967}\Shell\Auto\Command
Deleted! HKCU\...\Explorer\MountPoints2\{0ca05c08-5d35-11dc-bad8-001636f11967}\Shell\Auto\Command
Deleted! HKCU\...\Explorer\MountPoints2\{0e183233-8337-11de-afcd-001636f11967}\Shell\Auto\Command
Deleted! HKCU\...\Explorer\MountPoints2\{191cce40-c0b1-11de-8d54-001636f11967}\Shell\AutoRun\Command
Deleted! HKCU\...\Explorer\MountPoints2\{1de71cd7-c0c1-11de-b99f-001636f11967}\Shell\AutoRun\Command
Deleted! HKCU\...\Explorer\MountPoints2\{1de71ce9-c0c1-11de-b99f-001636f11967}\Shell\AutoRun\Command
Deleted! HKCU\...\Explorer\MountPoints2\{2de4f7a0-d4db-11de-986f-001636f11967}\Shell\Auto\Command
Deleted! HKCU\...\Explorer\MountPoints2\{2f3e5c91-25cc-11dc-92ad-001636f11967}\Shell\Auto\Command
Deleted! HKCU\...\Explorer\MountPoints2\{31ef6ae8-ec7b-11de-af70-001636f11967}\Shell\Auto\Command
Deleted! HKCU\...\Explorer\MountPoints2\{31ef6b13-ec7b-11de-af70-001636f11967}\Shell\Auto\Command
Deleted! HKCU\...\Explorer\MountPoints2\{3e4a5efa-c387-11de-a9bf-001636f11967}\Shell\Auto\Command
Deleted! HKCU\...\Explorer\MountPoints2\{3e4a5f00-c387-11de-b99f-001636f11967}\Shell\Auto\Command
Deleted! HKCU\...\Explorer\MountPoints2\{4b9719e1-a741-11de-b7e7-001636f11967}\Shell\Auto\Command
Deleted! HKCU\...\Explorer\MountPoints2\{4b9719e6-a741-11de-b7e7-001636f11967}\Shell\AutoRun\Command
Deleted! HKCU\...\Explorer\MountPoints2\{5a93c4bd-92bb-11dc-a08b-001636f11967}\Shell\Auto\Command
Deleted! HKCU\...\Explorer\MountPoints2\{84467817-6d39-11dd-9d0f-001636f11967}\Shell\Auto\Command
Deleted! HKCU\...\Explorer\MountPoints2\{922452c9-cd4c-11de-8a22-001636f11967}\Shell\AutoRun\Command
Deleted! HKCU\...\Explorer\MountPoints2\{a6fd73c2-c985-11dd-8c75-c362ff84581b}\Shell\Auto\Command
Deleted! HKCU\...\Explorer\MountPoints2\{a799f613-f5ee-11de-ae8e-001636f11967}\Shell\Auto\Command
Deleted! HKCU\...\Explorer\MountPoints2\{c29a9878-0a30-11dd-8bf7-001636f11967}\Shell\Auto\Command
Deleted! HKCU\...\Explorer\MountPoints2\{c41d9a66-d718-11dd-bb88-c2db6323540f}\Shell\Auto\Command
Deleted! HKCU\...\Explorer\MountPoints2\{fd6da77b-ebc5-11de-b3f2-001636f11967}\Shell\Auto\Command

################## | Listing of present files |

[22/07/2009 07:05|--a------|7242] C:\0x040c.ini
[22/07/2009 07:06|--a------|37888] C:\1036.MST
[28/01/2010 23:24|--a------|523] C:\Ad-Report-CLEAN[1].log
[28/01/2010 23:26|--a------|523] C:\Ad-Report-CLEAN[2].log
[29/01/2010 00:05|--a------|15149] C:\Ad-Report-CLEAN[3].log
[28/01/2010 21:48|--a------|518] C:\Ad-Report-SCAN[1].log
[28/01/2010 22:33|--a------|15449] C:\Ad-Report-SCAN[2].log
[18/09/2006 22:43|--a------|24] C:\autoexec.bat
[02/12/2007 11:16|--a------|90] C:\bcmwl6.log
[19/01/2008 08:45|-rahs----|333203] C:\bootmgr
[18/09/2006 22:43|--a------|10] C:\config.sys
[?|?|?] C:\hiberfil.sys
[01/07/2007 17:07|-rahs----|0] C:\IO.SYS
[01/07/2007 17:07|-rahs----|0] C:\MSDOS.SYS
[?|?|?] C:\pagefile.sys
[11/08/2008 14:57|--a------|159] C:\Setup.log
[29/01/2010 00:34|--a------|6480] C:\UsbFix.txt
[11/10/2007 13:18|--a------|16777216] D:\Top Trumps - Dogs and Dinosaurs.nds
[11/10/2007 13:26|--a------|16777216] D:\Top Trumps - Horror and Predators.nds
[15/09/2008 19:22|--a------|16777216] D:\Touch Detective.nds
[18/05/2007 12:54|--a------|16777216] D:\Touch the Dead.nds
[14/11/2007 13:39|--a------|33554432] D:\Tous Ambidextres.nds
[27/04/2006 08:59|--a------|33554432] D:\Trauma Center - Under The Knife.nds
[05/06/2007 11:25|--a------|16777216] D:\Trioncube.nds
[13/11/2007 14:35|--a------|67108864] D:\Ultimate Mortal Kombat.nds
[29/05/2007 13:17|--a------|8388608] D:\Uno - Skip-Bo - Uno Free Fall.nds
[12/04/2007 07:34|--a------|8388608] D:\Uno 52.nds
[02/02/2007 15:02|--a------|16777216] D:\Vegas Casino High 5.nds
[03/03/2006 20:47|--a------|67108864] D:\Viewtiful Joe - Double Trouble.nds
[30/05/2007 18:21|--a------|67108864] D:\Wario - Master of Disguise.nds
[16/07/2007 13:32|--a------|33554432] D:\WarioWare - Touched!.nds
[29/03/2007 15:37|--a------|8388608] D:\Wiffle Ball.nds
[06/12/2006 08:36|--a------|16777216] D:\Winx Club - La Quˆte Du Codex.nds
[09/11/2007 22:37|--a------|29925716] D:\Worms - Open Warfare 2.nds
[22/03/2006 08:07|--a------|16777216] D:\Worms - Open Warfare.nds
[26/05/2006 12:07|--a------|67108864] D:\X-Men - The Official Game.nds
[16/07/2007 13:31|--a------|16777216] D:\Yoshi Touch & Go.nds
[29/11/2006 18:14|--a------|33554432] D:\Yoshi's Island DS.nds
[19/04/2007 07:44|--a------|16777216] D:\Zendoku.nds
[16/07/2007 13:43|--a------|8388608] D:\Zoo Keeper.nds
[06/11/2007 14:23|--a------|33554432] D:\Zo‚ Cr‚atrice De Mode.nds

################## | Vaccination |

# C:\autorun.inf -> Folder created by UsbFix.
# D:\autorun.inf -> Folder created by UsbFix.

Anonymous user · Answer

Nickel Elodie ;)  How's the PC... better?  Do another Rsit scan and post log.txt and we'll finish. -- @+

elodu21 · Answer

Apparently everything is fine, everything is working correctly. I'm doing the scan and I'll post the report right away.

elodu21 · Answer

Logfile of random's system information tool 1.06 (written by random/random) Run by christel at 2010-01-29 00:46:33 Microsoft® Windows Vista™ Home Basic Edition Service Pack 1 System drive C: has 37 GB (34%) free of 109 GB Total RAM: 1013 MB (22% free)  Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 00:46:46, on 29/01/2010 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18385) Boot mode: Normal  Running processes: C:\Windows\system32\Dwm.exe C:\Windows\system32	askeng.exe C:\Users\christel\AppData\Local\Temp\Phr.exe C:\Windows\system32\ctfmon.exe C:\Windows\system32\sdclt.exe C:\Windows\explorer.exe C:\Program Files\Boonty\BoontyBox\BoontyBox.exe C:\Program Files\D-Jix\D-Jix Media\D-Jix Media.exe C:\Windows\system32\wuauclt.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Windows\system32\SearchFilterHost.exe C:\Users\christel\Desktop\RSIT.exe C:\Program Files	rend micro\christel.exe  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: SFR Navigation Helper - {0F6E720A-1A6B-40E1-A294-1D4D19F156C8} - C:\Program Files\SFR\Kit\SFRNavErrorHelper.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: P2P Energy Toolbar - {2bae58c2-79f9-45d1-a286-81f911301c3a} - C:\Program Files\P2P_Energy	bP2P_.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll O2 - BHO: Windows Live Sign-in Assistant Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: P2P Energy Toolbar - {2bae58c2-79f9-45d1-a286-81f911301c3a} - C:\Program Files\P2P_Energy	bP2P_.dll O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe" O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [VMSnap5] C:\Windows\VMSnap5.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [FixCamera] C:\Windows\FixCamera.exe O4 - HKLM\..\Run: [tsnp325] C:\Windows	snp325.exe O4 - HKLM\..\Run: [snp325] C:\Windows\vsnp325.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun O4 - HKLM\..\Run: [BEWINTERNET-FR-DMGP-V2SessionManager] "C:\Program Files\Orange\IEWInternet\SessionManager\SessionManager.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe" -osboot O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray O4 - HKCU\..\Run: [paejio] C:\Users\christel\paejio.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user') O4 - Startup: BoontyBox NRJ.lnk = C:\Program Files\Boonty\BoontyBox\BoontyBox.exe O4 - Startup: D-Jix Media.lnk = C:\Program Files\D-Jix\D-Jix Media\D-Jix Media.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O9 - Extra button: Direct Add - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Direct Add in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O13 - Gopher Prefix: O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Symantec Licensing NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: Google Update Service (gupdate1c9a96b6d67e510) (gupdate1c9a96b6d67e510) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe  -- End of file - 9320 bytes  ======Scheduled tasks folder======  C:\Windows	asks\Google Software Updater.job C:\Windows	asks\GoogleUpdateTaskMachineCore.job C:\Windows	asks\GoogleUpdateTaskMachineUA.job C:\Windows	asks\User_Feed_Synchronization-{159DFC3B-5CE0-4277-835F-953B43C25013}.job  ======Registry dump======  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}] &Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2007-10-19 817936]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}] SFR Navigation Helper - C:\Program Files\SFR\Kit\SFRNavErrorHelper.dll [2009-10-15 165184]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2bae58c2-79f9-45d1-a286-81f911301c3a}] P2P Energy Toolbar - C:\Program Files\P2P_Energy	bP2P_.dll [2007-12-10 1510424]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}] RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll [2009-12-03 329312]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}] Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2009-05-19 137600]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] Windows Live Sign-in Assistant Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}] Google Toolbar Helper - c:\program files\google\googletoolbar2.dll [2007-07-06 2436160]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}] Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll [2009-11-26 764912]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-11-07 41760]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}] Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar2.dll [2007-07-06 2436160] {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2007-10-19 817936] {2bae58c2-79f9-45d1-a286-81f911301c3a} - P2P Energy Toolbar - C:\Program Files\P2P_Energy	bP2P_.dll [2007-12-10 1510424] {21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184] "SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-11-15 815104] "IgfxTray"=C:\Windows\system32\igfxtray.exe [2006-11-06 98304] "HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2006-11-06 106496] "Persistence"=C:\Windows\system32\igfxpers.exe [2006-11-06 81920] "QPService"=C:\Program Files\HP\QuickPlay\QPService.exe [2006-12-02 167936] "QlbCtrl"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2006-11-06 159744] "HP Health Check Scheduler"=C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2006-12-04 46704] "WAWifiMessage"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [2006-10-18 317152] "hpWirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2006-10-18 472800] "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-11-07 149280] "VMSnap5"=C:\Windows\VMSnap5.EXE [2006-06-28 49152] "QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2007-10-24 286720] "FixCamera"=C:\Windows\FixCamera.exe [2007-02-12 20480] "tsnp325"=C:\Windows	snp325.exe [2006-10-10 270336] "snp325"=C:\Windows\vsnp325.exe [2006-10-10 827392] "avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000] "BrMfcWnd"=C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2006-11-24 622592] "ControlCenter3"=C:\Program Files\Brother\ControlCenter3\brctrcen.exe [2006-07-19 65536] "BEWINTERNET-FR-DMGP-V2SessionManager"=C:\Program Files\Orange\IEWInternet\SessionManager\SessionManager.exe [] "HP Software Update"=C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [2008-12-08 54576] ""= [] "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696] "Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288] "TkBellExe"=C:\Program Files\Common Files\Real\Update_OBealsched.exe [2009-12-03 198160]  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Launcher"=C:\Windows\SMINST\launcher.exe [2006-11-07 44128]  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-01-19 1233920] "swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2007-08-30 68856] "MsnMsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-07-26 3883856] "BitTorrent DNA"=C:\Program Files\DNA\btdna.exe [2010-01-28 323392] "PC Suite Tray"=C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe [2009-06-25 1414144] "paejio"=C:\Users\christel\paejio.exe [2010-01-27 69632]  C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE  C:\Users\christel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup BoontyBox NRJ.lnk - C:\Program Files\Boonty\BoontyBox\BoontyBox.exe D-Jix Media.lnk - C:\Program Files\D-Jix\D-Jix Media\D-Jix Media.exe  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] C:\Windows\system32\igfxdev.dll [2006-11-06 212992]  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "EnableLUA"=0 "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "EnableUIADesktopToggle"=0  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveAutoRun"=128 "NoDriveTypeAutoRun"=128 "HonorAutoRunSetting"=0  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveAutoRun"= "NoDriveTypeAutoRun"= "HonorAutoRunSetting"=  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]  ======List of files/folders created in the last 1 months======  2010-01-29 00:34:15 ----RASHD---- C:\autorun.inf 2010-01-29 00:23:46 ----A---- C:\UsbFix.txt 2010-01-29 00:19:36 ----D---- C:\UsbFix 2010-01-28 21:42:54 ----D---- C:\Program Files\My Downloaded Games 2010-01-28 21:42:54 ----D---- C:\Program Files\BoontyGames 2010-01-28 21:37:37 ----D---- C:\Ad-Remover 2010-01-28 21:24:00 ----A---- C:\Windows\WORDPAD.INI 2010-01-28 21:14:29 ----D---- C:\Program Files	rend micro 2010-01-28 21:14:20 ----D---- C:sit 2010-01-27 17:25:51 ----D---- C:\Users\christel\AppData\Roaming\Malwarebytes 2010-01-27 17:25:29 ----D---- C:\ProgramData\Malwarebytes 2010-01-27 17:25:27 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2010-01-27 15:50:58 ----A---- C:\Windows
tbtlog.txt 2010-01-27 14:52:54 ----D---- C:\Program Files\SFR 2010-01-22 18:09:05 ----A---- C:\Windows\system32\mshtml.dll 2010-01-22 18:09:02 ----A---- C:\Windows\system32\occache.dll 2010-01-22 18:08:58 ----A---- C:\Windows\system32\wininet.dll 2010-01-22 18:08:55 ----A---- C:\Windows\system32\urlmon.dll 2010-01-22 18:08:47 ----A---- C:\Windows\system32\ieframe.dll 2010-01-22 18:08:45 ----A---- C:\Windows\system32\ieapfltr.dll 2010-01-22 18:08:43 ----A---- C:\Windows\system32\iertutil.dll 2010-01-22 18:08:41 ----A---- C:\Windows\system32\iedkcs32.dll 2010-01-22 18:08:39 ----A---- C:\Windows\system32\msfeeds.dll 2010-01-22 18:08:37 ----A---- C:\Windows\system32\iepeers.dll 2010-01-22 18:08:35 ----A---- C:\Windows\system32\ieaksie.dll 2010-01-22 18:08:29 ----A---- C:\Windows\system32\ieUnatt.exe 2010-01-22 18:08:27 ----A---- C:\Windows\system32\ieencode.dll 2010-01-22 18:08:26 ----A---- C:\Windows\system32\mstime.dll 2010-01-22 18:08:23 ----A---- C:\Windows\system32\jsproxy.dll 2010-01-13 10:28:24 ----A---- C:\Windows\system32	2embed.dll 2010-01-13 10:28:24 ----A---- C:\Windows\system32\fontsub.dll  ======List of files/folders modified in the last 1 months======  2010-01-29 00:46:44 ----D---- C:\Windows\Prefetch 2010-01-29 00:43:10 ----D---- C:\Windows\Temp 2010-01-29 00:34:11 ----SD---- C:\Windows\Downloaded Program Files 2010-01-29 00:31:19 ----SHD---- C:\$RECYCLE.BIN 2010-01-29 00:27:02 ----D---- C:\Windows\Tasks 2010-01-29 00:21:34 ----D---- C:\Users\christel\AppData\Roaming\DNA 2010-01-29 00:07:09 ----D---- C:\Program Files\DNA 2010-01-29 00:02:11 ----SHD---- C:\Windows\Installer 2010-01-28 23:59:36 ----HD---- C:\ProgramData 2010-01-28 23:53:40 ----RD---- C:\Program Files 2010-01-28 23:32:19 ----D---- C:\Windows\system32\Tasks 2010-01-28 21:24:00 ----D---- C:\Windows 2010-01-28 18:49:25 ----D---- C:\Windows\Minidump 2010-01-28 18:21:20 ----D---- C:\ProgramData\Google Updater 2010-01-28 18:17:20 ----D---- C:\Windows\system32\catroot2 2010-01-28 09:07:36 ----D---- C:\Windows\System32 2010-01-28 09:07:36 ----D---- C:\Windows\AppPatch 2010-01-28 09:07:34 ----D---- C:\Windows\system32\drivers 2010-01-27 20:57:27 ----A---- C:\Windows\system32\PerfStringBackup.INI 2010-01-27 20:57:26 ----D---- C:\Windows\inf 2010-01-27 17:02:00 ----D---- C:\Program Files\Real 2010-01-27 14:56:09 ----SHD---- C:\System Volume Information 2010-01-23 11:29:49 ----D---- C:\Program Files\Internet Explorer 2010-01-23 10:08:26 ----D---- C:\Windows\winsxs 2010-01-22 18:00:52 ----D---- C:\Windows\system32\catroot 2010-01-20 15:48:52 ----D---- C:\Program Files\Microsoft Silverlight 2010-01-14 11:12:06 ----N----

Anonymous user · Answer

Re,

A piece of junk has passed through ...

#####

• Download OTM (OldTimer) to your Desktop.
• Right-click on OTM.exe and choose Run as administrator.
• Copy (Ctrl+C) the following text below:

:processes
explorer.exe

:services
ZTEusbnmea
ZTEusbser6k

:files
C:\Users\christel\paejio.exe

:reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"paejio"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"BEWINTERNET-FR-DMGP-V2SessionManager"=-

:commands
[purity]
[emptytemp]
[reboot]

• Paste (Ctrl+V) the previously copied text into the Paste Instructions for Items to be Moved box.
• Now click on the MoveIt! button and then close OTM.

---> If a file or folder cannot be deleted immediately, the software will ask you to restart.
Accept by clicking YES.

• Post the report located in this folder: C:\_OTM\MovedFiles\
---> The report name corresponds to the time of its creation: date_time.log

+ a new RSIT report: log.txt please.

--
@+

elodu21 · Answer

Little problem with OTM that freezes as soon as I click on move it!

Anonymous user · Answer

re disable UAC before:  http://pagesperso-orange.fr/nostools/uac_vista.html -- @+

elodu21 · Answer

OTM is still not working, it blocks the computer, forced to restart every time. Otherwise, for the RSIT report here it is:  Logfile of random's system information tool 1.06 (written by random/random) Run by christel at 2010-01-29 01:25:58 Microsoft® Windows Vista™ Basic Home Edition Service Pack 1 System drive C: has 37 GB (34%) free of 109 GB Total RAM: 1013 MB (23% free)  Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 01:26:22, on 29/01/2010 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18385) Boot mode: Normal  Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32	askeng.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\HP\QuickPlay\QPService.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\QuickTime\qttask.exe C:\Windows\FixCamera.exe C:\Windows	snp325.exe C:\Windows\vsnp325.exe C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe C:\Program Files\HP\HP Software Update\hpwuschd2.exe C:\Program Files\Common Files\Real\Update_OBealsched.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\DNA\btdna.exe C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe C:\Program Files\Boonty\BoontyBox\BoontyBox.exe C:\Program Files\D-Jix\D-Jix Media\D-Jix Media.exe C:\Program Files\Brother\ControlCenter3\brccMCtl.exe C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\Users\christel\Desktop\RSIT.exe C:\Program Files	rend micro\christel.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\wuauclt.exe  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: SFR Navigation Help - {0F6E720A-1A6B-40E1-A294-1D4D19F156C8} - C:\Program Files\SFR\Kit\SFRNavErrorHelper.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: P2P Energy Toolbar - {2bae58c2-79f9-45d1-a286-81f911301c3a} - C:\Program Files\P2P_Energy	bP2P_.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll O2 - BHO: Windows Live Sign-In Assistant Help Program - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: P2P Energy Toolbar - {2bae58c2-79f9-45d1-a286-81f911301c3a} - C:\Program Files\P2P_Energy	bP2P_.dll O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe" O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [VMSnap5] C:\Windows\VMSnap5.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [FixCamera] C:\Windows\FixCamera.exe O4 - HKLM\..\Run: [tsnp325] C:\Windows	snp325.exe O4 - HKLM\..\Run: [snp325] C:\Windows\vsnp325.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe" -osboot O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray O4 - HKCU\..\Run: [paejio] C:\Users\christel\paejio.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user') O4 - Startup: BoontyBox NRJ.lnk = C:\Program Files\Boonty\BoontyBox\BoontyBox.exe O4 - Startup: D-Jix Media.lnk = C:\Program Files\D-Jix\D-Jix Media\D-Jix Media.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O9 - Extra button: Direct Add - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menu item: &Direct Add in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O13 - Gopher Prefix: O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: Google Update Service (gupdate1c9a96b6d67e510) (gupdate1c9a96b6d67e510) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe  -- End of file - 10228 bytes  ======Scheduled tasks folder======  C:\Windows	asks\Google Software Updater.job C:\Windows	asks\GoogleUpdateTaskMachineCore.job C:\Windows	asks\GoogleUpdateTaskMachineUA.job C:\Windows	asks\User_Feed_Synchronization-{159DFC3B-5CE0-4277-835F-953B43C25013}.job  ======Registry dump======  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}] &Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2007-10-19 817936]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}] SFR Navigation Help Object - C:\Program Files\SFR\Kit\SFRNavErrorHelper.dll [2009-10-15 165184]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2bae58c2-79f9-45d1-a286-81f911301c3a}] P2P Energy Toolbar - C:\Program Files\P2P_Energy	bP2P_.dll [2007-12-10 1510424]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}] RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll [2009-12-03 329312]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}] Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2009-05-19 137600]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] Windows Live Sign-In Assistant Help Program - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}] Google Toolbar Helper - c:\program files\google\googletoolbar2.dll [2007-07-06 2436160]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}] Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll [2009-11-26 764912]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-11-07 41760]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}] Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar2.dll [2007-07-06 2436160] {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2007-10-19 817936] {2bae58c2-79f9-45d1-a286-81f911301c3a} - P2P Energy Toolbar - C:\Program Files\P2P_Energy	bP2P_.dll [2007-12-10 1510424] {21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904]  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184] "SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-11-15 815104] "IgfxTray"=C:\Windows\system32\igfxtray.exe [2006-11-06 98304] "HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2006-11-06 106496] "Persistence"=C:\Windows\system32\igfxpers.exe [2006-11-06 81920] "QPService"=C:\Program Files\HP\QuickPlay\QPService.exe [2006-12-02 167936] "QlbCtrl"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2006-11-06 159744] "HP Health Check Scheduler"=C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2006-12-04 46704] "WAWifiMessage"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [2006-10-18 317152] "hpWirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2006-10-18 472800] "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-11-07 149280] "VMSnap5"=C:\Windows\VMSnap5.EXE [2006-06-28 49152] "QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2007-10-24 286720] "FixCamera"=C:\Windows\FixCamera.exe [2007-02-12 20480] "tsnp325"=C:\Windows	snp325.exe [2006-10-10 270336] "snp325"=C:\Windows\vsnp325.exe [2006-10-10 827392] "avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000] "BrMfcWnd"=C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2006-11-24 622592] "ControlCenter3"=C:\Program Files\Brother\ControlCenter3\brctrcen.exe [2006-07-19 65536] "HP Software Update"=C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [2008-12-08 54576] ""= [] "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696] "Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288] "TkBellExe"=C:\Program Files\Common Files\Real\Update_OBealsched.exe [2009-12-03 198160]  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] C:\Windows\system32\igfxdev.dll [2006-11-06 212992]  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "EnableLUA"=0 "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "EnableUIADesktopToggle"=0  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveAutoRun"=128 "NoDriveTypeAutoRun"=128 "HonorAutoRunSetting"=0  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveAutoRun"= "NoDriveTypeAutoRun"= "HonorAutoRunSetting"=  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]  ======List of files/folders created in the last 1 month======  2010-01-29 00:54:43 ----D---- C:\_OTM 2010-01-29 00:34:15 ----RASHD---- C:\autorun.inf 2010-01-29 00:23:46 ----A---- C:\UsbFix.txt 2010-01-29 00:19:36 ----D---- C:\UsbFix 2010-01-28 21:42:54 ----D---- C:\Program Files\My Downloaded Games 2010-01-28 21:42:54 ----D---- C:\Program Files\BoontyGames 2010-01-28 21:37:37 ----D---- C:\Ad-Remover 2010-01-28 21:24:00 ----A---- C:\Windows\WORDPAD.INI 2010-01-28 21:14:29 ----D---- C:\Program Files	rend micro 2010-01-28 21:14:20 ----D---- C:sit 2010-01-27 17:25:51 ----D---- C:\Users\christel\AppData\Roaming\Malwarebytes 2010-01-27 17:25:29 ----D---- C:\ProgramData\Malwarebytes 2010-01-27 17:25:27 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2010-01-27 15:50:58 ----A---- C:\Windows
tbtlog.txt 2010-01-27 14:52:54 ----D---- C:\Program Files\SFR 2010-01-22 18:09:05 ----A---- C:\Windows\system32\mshtml.dll 2010-01-22 18:09:02 ----A---- C:\Windows\system32\occache.dll 2010-01-22 18:08:58 ----A---- C:\Windows\system32\wininet.dll 2010-01-22 18:08:55 ----A---- C:\Windows\system32\urlmon.dll 2010-01-22 18:08:47 ----A---- C:\Windows\system32\ieframe.dll 2010-01-22 18:08:45 ----A---- C:\Windows\system32\ieapfltr.dll 2010-01-22 18:08:43 ----A---- C:\Windows\system32\iertutil.dll 2010-01-22 18:08:41 ----A---- C:\Windows\system32\iedkcs32.dll 2010-01-22 18:08:39 ----A---- C:\Windows\system32\msfeeds.dll 2010-01-22 18:08:37 ----A---- C:\Windows\system32\iepeers.dll 2010-01-22 18:08:35 ----A---- C:\Windows\system32\ieaksie.dll 2010-01-22 18:08:29 ----A---- C:\Windows\system32\ieUnatt.exe 2010-01-22 18:08:27 ----A---- C:\Windows\system32\ieencode.dll 2010-01-22 18:08:26 ----A---- C:\Windows\system32\mstime.dll 2010-01-22 18:08:23 ----A---- C:\Windows\system32\jsproxy.dll 2010-01-13 10:28:24 ----A---- C:\Windows\system32	2embed.dll 2010-01-13 10:28:24 ----A---- C:\Windows\system32\fontsub.dll  ======List of files/folders modified in the last 1 month======  2010-01-29 01:26:23 ----D---- C:\Windows\Temp 2010-01-29 01:23:39 ----D---- C:\Windows\Tasks 2010-01-29 01:21:31 ----D---- C:\Windows\Prefetch 2010-01-29 01:20:37 ----D---- C:\Users\christel\AppData\Roaming\DNA 2010-01-29 01:20:37 ----D---- C:\Program Files\DNA 2010-01-29 00:34:11 ----SD---- C:\Windows\Downloaded Program Files 2010-01-29 00:31:19 ----SHD---- C:\$RECYCLE.BIN 2010-01-29 00:02:11 ----SHD---- C:\Windows\Installer 2010-01-28 23:59:36 ----HD---- C:\ProgramData 2010-01-28 23:53:40 ----RD---- C:\Program Files

Anonymous user · Answer

Hello Cristel  Go to this file: C:\Program Files	rend micro\christel.exe  Right-click on it and choose Run as administrator.  Then select Do a system scan only.  In the list, check this line:  O4 - HKCU\..\Run: [paejio] C:\Users\christel\paejio.exe  Check it and click on Fix Checked.  ######  • Download ToolsCleaner2 to your Desktop. • Right-click on ToolsCleaner2.exe and choose Run as administrator. • Click on Search and let the scan run. • Click on Delete to finish. • If you wish, you can use the Optional Options. • Click on Exit to get the report. • Post the report (TCleaner.txt) located at the root of your hard drive (C:\).  -- Catch you later!

elodu21 · Answer

Hi,  The line you asked me to uncheck no longer appears in the latest scan   O4 - HKCU\..\Run: [paejio] C:\Users\christel\paejio.exe

Anonymous user · Answer

ok then pass toolcleaner and it's done -- @+

elodu21 · Answer

Thank you for your help, my PC works perfectly.

Anonymous user · Answer

You're welcome Christel  Have a good weekend. -- See you later.

TrojanDownload:Win32/Renos.JM

28 answers

No sound for sms arrival

How to store and retrieve emails received on iphone and i

Impossible internet connections

E.tre456.worm.windows

Cursor issue on word doc

How to activate my facebook account deactivate

Driving at 110 km/h on the highway: fuel economy and safety gains

Canon pixma printer not detected via livebox 7

Windows security

Samsung smart switch app