Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie
Hi there,
There is an issue with role permissions that is being worked on at the moment.
If you are having trouble with access or permissions on regional forums please post here to get access: https://www.boards.ie/discussion/2058365403/you-do-not-have-permission-for-that#latest
There is an issue with role permissions that is being worked on at the moment.
If you are having trouble with access or permissions on regional forums please post here to get access: https://www.boards.ie/discussion/2058365403/you-do-not-have-permission-for-that#latest
Desktop replaced by IE failed page
-
19-09-2012 8:33pmHi! Just wondering if anyone knew how to solve this- when I turn on my computer, explorer/the desktop doesnt show up. All that comes up is internet explorer page that has failed to load, scaled to the size of the screen. anyone know any way to get rid of this and let me get back to using my computer?0
Comments
-
Probably malware
Download OTL to your Desktop- Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
- Click the Quick Scan button. Do not change any settings. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files here
0 -
OTL logfile created on: 9/19/2012 8:45:12 PM - Run 1
OTL by OldTimer - Version 3.2.64.0 Folder = G:\
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Ireland | Language: ENI | Date Format: dd/MM/yyyy
2.93 Gb Total Physical Memory | 2.23 Gb Available Physical Memory | 75.98% Memory free
5.86 Gb Paging File | 5.20 Gb Available in Paging File | 88.58% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 225.33 Gb Total Space | 15.46 Gb Free Space | 6.86% Space Free | Partition Type: NTFS
Drive | 225.33 Gb Total Space | 2.95 Gb Free Space | 1.31% Space Free | Partition Type: NTFS
Drive G: | 7.21 Gb Total Space | 2.51 Gb Free Space | 34.81% Space Free | Partition Type: FAT32
Computer Name: DAVID | User Name: davidmcardle | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2012/09/19 20:43:36 | 000,600,064 | ---- | M] (OldTimer Tools) -- G:\OTL.exe
PRC - [2012/03/26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2011/06/24 05:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010/11/20 13:17:00 | 000,302,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cmd.exe
PRC - [2009/07/14 02:14:21 | 000,497,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\HelpPane.exe
========== Modules (No Company Name) ==========
========== Services (SafeList) ==========
SRV - [2012/09/07 17:19:52 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/07/29 11:23:14 | 000,188,760 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Web Assistant\ExtensionUpdaterService.exe -- (Web Assistant Updater)
SRV - [2012/07/13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/03/26 17:03:40 | 000,214,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2012/03/26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012/03/22 14:44:12 | 000,086,528 | ---- | M] (Freemake) [Auto | Stopped] -- C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe -- (Freemake Improver)
SRV - [2011/11/09 12:36:18 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2009/07/14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009/03/04 12:25:12 | 000,621,056 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | System | Stopped] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{6CA74C80-FDCB-4813-A5E8-3CACBB033029}\MpKsl1ed88323.sys -- (MpKsl1ed88323)
DRV - [2012/03/20 20:44:12 | 000,074,112 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2012/01/04 15:28:36 | 000,016,128 | ---- | M] (Windows (R) Win 7 DDK provider) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\gtkdrv.sys -- (TrojanKillerDriver)
DRV - [2011/11/15 20:04:15 | 000,239,168 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2011/08/17 10:56:32 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2011/08/17 10:56:30 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2011/08/17 10:56:26 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2011/08/17 10:56:22 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2011/08/05 12:02:46 | 002,203,648 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2010/11/20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 10:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/07/01 01:47:34 | 000,015,656 | ---- | M] (Windows (R) 2003 DDK 3790 provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rtport.sys -- (rtport)
DRV - [2009/09/28 10:22:00 | 000,315,392 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\yk62x86.sys -- (yukonw7)
DRV - [2009/07/14 00:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009/07/10 14:44:52 | 000,122,880 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService)
DRV - [2009/04/09 06:23:02 | 000,130,424 | ---- | M] (McAfee, Inc.) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\Mpfp.sys -- (MPFP)
DRV - [2008/08/26 11:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3106777
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.eircom.net/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ie.msn.com/?rd=1&ucc=IE&dcc=IE&opt=0
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0F 84 2A 88 2B 25 CD 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {CFF4DB9B-135F-47c0-9269-B4C6572FD61A}
IE - HKCU\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://mystart.incredibar.com/mb174/?search={searchTerms}&loc=IB_DS&a=6OyLrUMWn3&i=26
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "MyStart Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://mystart.incredibar.com/mb174?a=6OyLrUMWn3&i=26"
FF - prefs.js..keyword.URL: "http://mystart.incredibar.com/mb174/?loc=IB_DS&a=6OyLrUMWn3&&i=26&search="
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\davidmcardle\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\ [2011/12/07 00:35:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fmconverter@gmail.com: C:\Program Files\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\ [2012/03/23 17:48:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox [2012/08/19 00:39:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/09/07 17:19:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
[2011/11/16 01:59:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\davidmcardle\AppData\Roaming\Mozilla\Extensions
[2012/08/19 20:14:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\davidmcardle\AppData\Roaming\Mozilla\Firefox\Profiles\edasn8de.default\extensions
[2012/07/25 21:17:15 | 000,000,000 | ---D | M] (fluschipranie) -- C:\Users\davidmcardle\AppData\Roaming\Mozilla\Firefox\Profiles\edasn8de.default\extensions\jid0-Dg47y8CbssHh7EDdmKEYB6phtn0@jetpack
[2012/08/19 00:38:25 | 000,002,203 | ---- | M] () -- C:\Users\davidmcardle\AppData\Roaming\Mozilla\Firefox\Profiles\edasn8de.default\searchplugins\MyStart Search.xml
[2012/09/07 17:18:48 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/09/07 17:19:54 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/06/20 15:32:16 | 000,001,525 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2012/08/29 01:07:28 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/06/20 15:32:16 | 000,000,935 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2012/06/20 15:32:16 | 000,001,166 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2012/08/29 01:07:28 | 000,002,253 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml
[2012/06/20 15:32:16 | 000,001,121 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml
========== Chrome ==========
CHR - homepage: http://www.google.com
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: http://www.google.com
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.89\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.89\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.89\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\davidmcardle\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Freemake np-plugin for google chrome (Enabled) = C:\Users\davidmcardle\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbolfgndggfhhpbnkgnpjkfhinclbigj\1.0.0_0\npFreemake.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Facebook Video Calling Plugin (Enabled) = C:\Users\davidmcardle\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - Extension: YouTube = C:\Users\davidmcardle\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\davidmcardle\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Web Assistant = C:\Users\davidmcardle\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.474_0\
CHR - Extension: Freemake Video Converter = C:\Users\davidmcardle\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbolfgndggfhhpbnkgnpjkfhinclbigj\1.0.0_0\
CHR - Extension: Gmail = C:\Users\davidmcardle\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
O1 HOSTS File: ([2009/06/10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Web Assistant) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\Web Assistant\Extension32.dll ()
O2 - BHO: (Incredibar.com Helper Object) - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - C:\Program Files\Incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll (Montera Technologeis LTD)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (no name) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Program Files\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll (Montera Technologeis LTD)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [draqhnqomdfazkb] C:\ProgramData\draqhnqo.exe ()
O4 - HKCU..\Run: [Facebook Update] C:\Users\davidmcardle\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKCU..\Run: [SDP] C:\Program Files\FilesFrog Update Checker\update_checker.exe (Somoto)
O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O18 - Protocol\Handler\dssrequest - No CLSID value found
O18 - Protocol\Handler\sacore - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O31 - SafeBoot: UseAlternatShell - 1
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{4f374c21-0fb3-11e1-8d68-002454aa53da}\Shell - "" = AutoRun
O33 - MountPoints2\{4f374c21-0fb3-11e1-8d68-002454aa53da}\Shell\AutoRun\command - "" = F:\autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2012/09/19 19:32:11 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Local\{F665D6FF-8382-4A7A-BD98-649F3D021A4D}
[2012/09/18 19:53:33 | 000,000,000 | ---D | C] -- C:\ProgramData\ieasticcmektkck
[2012/09/17 23:11:33 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Local\{EEEE435C-18CB-410C-8DF0-6C9D255932C5}
[2012/09/17 18:41:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GridinSoft Trojan Killer
[2012/09/17 18:41:52 | 000,000,000 | ---D | C] -- C:\Program Files\GridinSoft Trojan Killer
[2012/09/16 16:50:27 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Local\{4EE6E839-F0B7-481C-BF54-895179DF7DAA}
[2012/09/14 12:49:16 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Local\{07B725FD-537D-4905-A427-F137CDE83B1C}
[2012/09/14 00:59:01 | 000,000,000 | -HSD | C] -- C:\found.001
[2012/09/13 14:36:49 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Roaming\Malwarebytes
[2012/09/13 14:36:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/09/13 14:36:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/09/13 14:36:40 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys
[2012/09/13 14:36:40 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/09/13 14:19:25 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Local\{5FA01C92-B401-45F2-97DB-0E06D8F2E2DF}
[2012/09/12 11:17:58 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Local\{14B6E08A-0DCB-4142-8636-CB0C6BBEE6D2}
[2012/09/11 21:51:23 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Local\{288AFF81-86FE-43DA-A4AD-14E39D4577A4}
[2012/09/10 16:30:43 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Local\{E9F68768-3972-4C89-B8D2-E6EF2808F63B}
[2012/09/08 16:06:32 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Local\{F0D04C73-8636-406C-A4E7-3F4B18831E61}
[2012/09/07 17:18:48 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2012/09/07 15:11:20 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Local\{2EF3F2E0-7B6B-4D1F-AC4A-EE6C510E5F0B}
[2012/09/07 02:35:04 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Local\{A09F2EC5-0308-492A-942E-6DE42F764CD2}
[2012/09/06 00:55:40 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Local\{09ADFD4F-3B14-43F7-ADF1-8EF9958E313E}
[2012/09/05 12:58:35 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Local\{F8647378-DE99-4B1E-8D24-B751618BA319}
[2012/09/04 16:57:19 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Local\{7DCB04A6-41C9-4F95-A0A3-D7519E91C72A}
[2012/09/03 19:21:07 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\Documents\888poker
[2012/09/03 19:21:06 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2012/09/03 19:21:06 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\888poker
[2012/09/03 19:21:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\888poker
[2012/09/03 19:20:13 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Roaming\PacificPoker
[2012/09/03 19:19:40 | 000,000,000 | ---D | C] -- C:\Program Files\PacificPoker
[2012/09/03 18:50:51 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Local\{8239F5E6-6ADF-4F20-96F4-6713DEE36253}
[2012/09/02 09:19:42 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Local\{149C7F3E-7AA0-4EDB-BF0D-63916B8AEB03}
[2012/09/01 10:34:46 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Local\{E01EB4C8-BEF7-4807-A948-B845A5302A78}
[2012/08/30 10:59:43 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Local\{7DD68F09-6940-4D02-AB83-53E6766E222B}
[2012/08/27 19:05:14 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Roaming\dvdcss
[2012/08/24 21:39:44 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Local\{7835AFA2-0901-4EC1-8A0F-E67363A9E8D4}
[2012/08/24 20:13:09 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Local\{B7800880-FB33-4A38-8500-4B2781E086DA}
[2012/08/23 23:02:28 | 000,000,000 | ---D | C] -- C:\Users\davidmcardle\AppData\Local\{7D97B701-2B40-438F-9D0D-CCED0F989FEC}
[2012/08/23 13:28:37 | 000,000,000 | ---D | C] -- C:\Program Files\Valve
[2012/08/23 13:28:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\my company name
[1 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ]
[1 C:\Users\davidmcardle\Desktop\*.tmp files -> C:\Users\davidmcardle\Desktop\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012/09/19 20:47:54 | 000,634,406 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2012/09/19 20:47:54 | 000,115,298 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2012/09/19 20:42:03 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012/09/19 20:42:00 | 2362,920,960 | -HS- | M] () -- C:\hiberfil.sys
[2012/09/19 20:20:10 | 000,000,886 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/09/19 20:20:00 | 000,000,882 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/09/19 19:39:27 | 000,014,736 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/09/19 19:39:27 | 000,014,736 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/09/18 21:44:48 | 000,001,101 | ---- | M] () -- C:\Users\Public\Desktop\Trojan Killer.lnk
[2012/09/18 19:53:33 | 000,073,400 | ---- | M] () -- C:\ProgramData\jukzwbarytnknxu
[2012/09/18 19:53:14 | 000,080,384 | ---- | M] () -- C:\ProgramData\draqhnqo.exe
[2012/09/18 19:53:14 | 000,080,384 | ---- | M] () -- C:\Users\davidmcardle\0.622516929710058.exe
[2012/09/18 18:56:01 | 000,000,956 | ---- | M] () -- C:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000UA.job
[2012/09/18 18:01:32 | 000,065,874 | ---- | M] () -- C:\Users\davidmcardle\Desktop\favourite-soap-collyoaks.jpg
[2012/09/18 17:57:32 | 000,000,043 | ---- | M] () -- C:\Users\davidmcardle\Desktop\qm.gif
[2012/09/18 17:55:54 | 000,057,130 | ---- | M] () -- C:\Users\davidmcardle\Desktop\407332_10150542468358124_961010011_n.jpg
[2012/09/17 21:56:00 | 000,000,934 | ---- | M] () -- C:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000Core.job
[2012/09/17 20:36:10 | 687,250,402 | ---- | M] () -- C:\Users\davidmcardle\Desktop\Part2.avi
[2012/09/17 16:30:00 | 000,000,044 | ---- | M] () -- C:\Users\davidmcardle\AppData\Roaming\msconfig.ini
[2012/09/15 10:28:14 | 000,000,368 | ---- | M] () -- C:\windows\tasks\McDefragTask.job
[2012/09/13 14:38:23 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/09/07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys
[2012/09/03 19:21:06 | 000,002,009 | ---- | M] () -- C:\Users\davidmcardle\Application Data\Microsoft\Internet Explorer\Quick Launch\888poker.lnk
[2012/09/03 19:21:06 | 000,001,991 | ---- | M] () -- C:\Users\davidmcardle\Desktop\888poker.lnk
[2012/09/01 23:32:45 | 000,051,979 | ---- | M] () -- C:\Users\davidmcardle\Desktop\x284114_10150324440825450_3589757_n.jpg
[2012/09/01 01:00:00 | 000,000,348 | ---- | M] () -- C:\windows\tasks\McQcTask.job
[2012/08/31 01:10:52 | 000,000,412 | ---- | M] () -- C:\Users\davidmcardle\AppData\Roaming\wklnhst.dat
[2012/08/23 13:28:37 | 000,001,622 | ---- | M] () -- C:\Users\Public\Desktop\Counter-Strike 1.6.lnk
[2012/08/22 12:02:46 | 000,068,722 | ---- | M] () -- C:\Users\davidmcardle\Desktop\joes walk 3.jpg
[2012/08/22 12:01:09 | 000,033,670 | ---- | M] () -- C:\Users\davidmcardle\Desktop\Joes Walk.jpg
[2012/08/22 12:00:38 | 000,054,019 | ---- | M] () -- C:\Users\davidmcardle\Desktop\Joes Walk 2.jpg
[1 C:\Users\davidmcardle\Desktop\*.tmp files -> C:\Users\davidmcardle\Desktop\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012/09/18 19:53:29 | 000,080,384 | ---- | C] () -- C:\ProgramData\draqhnqo.exe
[2012/09/18 19:53:15 | 000,073,400 | ---- | C] () -- C:\ProgramData\jukzwbarytnknxu
[2012/09/18 19:53:05 | 000,080,384 | ---- | C] () -- C:\Users\davidmcardle\0.622516929710058.exe
[2012/09/18 18:01:31 | 000,065,874 | ---- | C] () -- C:\Users\davidmcardle\Desktop\favourite-soap-collyoaks.jpg
[2012/09/18 17:57:30 | 000,000,043 | ---- | C] () -- C:\Users\davidmcardle\Desktop\qm.gif
[2012/09/18 17:55:52 | 000,057,130 | ---- | C] () -- C:\Users\davidmcardle\Desktop\407332_10150542468358124_961010011_n.jpg
[2012/09/17 20:56:56 | 687,250,402 | ---- | C] () -- C:\Users\davidmcardle\Desktop\Part2.avi
[2012/09/17 18:41:57 | 000,001,101 | ---- | C] () -- C:\Users\Public\Desktop\Trojan Killer.lnk
[2012/09/17 15:51:08 | 000,000,044 | ---- | C] () -- C:\Users\davidmcardle\AppData\Roaming\msconfig.ini
[2012/09/13 14:36:42 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/09/03 19:21:06 | 000,002,009 | ---- | C] () -- C:\Users\davidmcardle\Application Data\Microsoft\Internet Explorer\Quick Launch\888poker.lnk
[2012/09/03 19:21:06 | 000,001,991 | ---- | C] () -- C:\Users\davidmcardle\Desktop\888poker.lnk
[2012/09/01 23:32:43 | 000,051,979 | ---- | C] () -- C:\Users\davidmcardle\Desktop\x284114_10150324440825450_3589757_n.jpg
[2012/08/23 13:28:37 | 000,001,622 | ---- | C] () -- C:\Users\Public\Desktop\Counter-Strike 1.6.lnk
[2012/08/22 12:03:10 | 000,068,722 | ---- | C] () -- C:\Users\davidmcardle\Desktop\joes walk 3.jpg
[2012/08/22 12:01:58 | 000,054,019 | ---- | C] () -- C:\Users\davidmcardle\Desktop\Joes Walk 2.jpg
[2012/08/22 12:01:38 | 000,033,670 | ---- | C] () -- C:\Users\davidmcardle\Desktop\Joes Walk.jpg
[2012/08/04 10:58:20 | 000,000,376 | ---- | C] () -- C:\windows\ODBC.INI
[2012/07/03 16:14:15 | 000,000,412 | ---- | C] () -- C:\Users\davidmcardle\AppData\Roaming\wklnhst.dat
[2012/01/30 21:40:41 | 000,149,376 | -H-- | C] () -- C:\windows\System32\mlfcache.dat
[2012/01/11 09:35:20 | 000,126,976 | ---- | C] () -- C:\Users\davidmcardle\AppData\Roaming\msconfig.dat
[2011/02/11 20:10:52 | 000,439,308 | ---- | C] () -- C:\windows\System32\igcompkrng500.bin
[2011/02/11 20:10:50 | 000,982,240 | ---- | C] () -- C:\windows\System32\igkrng500.bin
[2011/02/11 20:10:50 | 000,092,356 | ---- | C] () -- C:\windows\System32\igfcg500m.bin
[2011/02/11 19:40:40 | 000,004,096 | ---- | C] ( ) -- C:\windows\System32\IGFXDEVLib.dll
[2011/02/11 19:38:44 | 000,000,151 | ---- | C] () -- C:\windows\System32\GfxUI.exe.config
[2010/09/24 17:59:28 | 000,131,368 | ---- | C] () -- C:\ProgramData\FullRemove.exe
[2010/09/24 11:13:58 | 000,000,002 | ---- | C] () -- C:\windows\HotFixList.ini
========== ZeroAccess Check ==========
[2009/07/14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini
========== LOP Check ==========
[2011/12/20 19:07:17 | 000,000,000 | ---D | M] -- C:\Users\davidmcardle\AppData\Roaming\Astroburn Pro
[2012/01/27 19:49:14 | 000,000,000 | ---D | M] -- C:\Users\davidmcardle\AppData\Roaming\DAEMON Tools Lite
[2011/12/07 08:39:52 | 000,000,000 | ---D | M] -- C:\Users\davidmcardle\AppData\Roaming\HandBrake
[2011/12/07 00:39:04 | 000,000,000 | ---D | M] -- C:\Users\davidmcardle\AppData\Roaming\Nokia
[2012/02/18 19:08:24 | 000,000,000 | ---D | M] -- C:\Users\davidmcardle\AppData\Roaming\OpenOffice.org
[2012/09/03 19:22:50 | 000,000,000 | ---D | M] -- C:\Users\davidmcardle\AppData\Roaming\PacificPoker
[2011/12/07 00:38:35 | 000,000,000 | ---D | M] -- C:\Users\davidmcardle\AppData\Roaming\PC Suite
[2012/02/20 11:54:19 | 000,000,000 | ---D | M] -- C:\Users\davidmcardle\AppData\Roaming\redsn0w
[2012/02/20 01:22:31 | 000,000,000 | ---D | M] -- C:\Users\davidmcardle\AppData\Roaming\SystemRequirementsLab
[2012/07/03 16:14:17 | 000,000,000 | ---D | M] -- C:\Users\davidmcardle\AppData\Roaming\Template
[2012/09/19 20:36:31 | 000,000,000 | ---D | M] -- C:\Users\davidmcardle\AppData\Roaming\uTorrent
[2012/07/30 23:57:12 | 000,000,000 | ---D | M] -- C:\Users\davidmcardle\AppData\Roaming\Windows Live Writer
========== Purity Check ==========
< End of report >0 -
yeah malware present
open OTL copy and paste this in the custom scan/fixes box
:OTL
O4 - HKCU..\Run: [draqhnqomdfazkb] C:\ProgramData\draqhnqo.exe ()
O33 - MountPoints2\{4f374c21-0fb3-11e1-8d68-002454aa53da}\Shell - "" = AutoRun
O33 - MountPoints2\{4f374c21-0fb3-11e1-8d68-002454aa53da}\Shell\AutoRun\command - "" = F:\autorun.exe
[2012/09/18 19:53:33 | 000,000,000 | ---D | C] -- C:\ProgramData\ieasticcmektkck
[2012/09/18 19:53:33 | 000,073,400 | ---- | M] () -- C:\ProgramData\jukzwbarytnknxu
[2012/09/18 19:53:14 | 000,080,384 | ---- | M] () -- C:\ProgramData\draqhnqo.exe
[2012/09/18 19:53:14 | 000,080,384 | ---- | M] () -- C:\Users\davidmcardle\0.622516929710058.exe
[2012/09/18 19:53:29 | 000,080,384 | ---- | C] () -- C:\ProgramData\draqhnqo.exe
[2012/09/18 19:53:15 | 000,073,400 | ---- | C] () -- C:\ProgramData\jukzwbarytnknxu
[2012/09/18 19:53:05 | 000,080,384 | ---- | C] () -- C:\Users\davidmcardle\0.622516929710058.exe
:Commands
[PURITY]
[EMPTYTEMP]
[EMPTYFLASH]
[RESETHOSTS]
[EMPTYJAVA]
[CREATERESTOREPOINT]
[Reboot]
:Files
ipconfig /flushdns /c
click run fix post the log it gives you.
then update mbam run a quick scan post that log0 -
All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\draqhnqomdfazkb deleted successfully.
C:\ProgramData\draqhnqo.exe moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4f374c21-0fb3-11e1-8d68-002454aa53da}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4f374c21-0fb3-11e1-8d68-002454aa53da}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4f374c21-0fb3-11e1-8d68-002454aa53da}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4f374c21-0fb3-11e1-8d68-002454aa53da}\ not found.
File F:\autorun.exe not found.
C:\ProgramData\ieasticcmektkck folder moved successfully.
C:\ProgramData\jukzwbarytnknxu moved successfully.
File C:\ProgramData\draqhnqo.exe not found.
C:\Users\davidmcardle\0.622516929710058.exe moved successfully.
File C:\ProgramData\draqhnqo.exe not found.
File C:\ProgramData\jukzwbarytnknxu not found.
File C:\Users\davidmcardle\0.622516929710058.exe not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: davidmcardle
->Temp folder emptied: 2403815630 bytes
->Temporary Internet Files folder emptied: 19268890 bytes
->Java cache emptied: 325846 bytes
->FireFox cache emptied: 124486170 bytes
->Google Chrome cache emptied: 34034032 bytes
->Flash cache emptied: 17899 bytes
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Public
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 86407880 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 526998 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 741 bytes
RecycleBin emptied: 345026439 bytes
Total Files Cleaned = 2,874.00 mb
[EMPTYFLASH]
User: All Users
User: davidmcardle
->Flash cache emptied: 0 bytes
User: Default
User: Default User
User: Public
Total Flash Files Cleaned = 0.00 mb
C:\windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
[EMPTYJAVA]
User: All Users
User: davidmcardle
->Java cache emptied: 0 bytes
User: Default
User: Default User
User: Public
Total Java Files Cleaned = 0.00 mb
Unable to start System Restore Service. Error code 1084
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Could not flush the DNS Resolver Cache: Function failed during execution.
G:\cmd.bat deleted successfully.
G:\cmd.txt deleted successfully.
OTL by OldTimer - Version 3.2.64.0 log created on 09192012_220223
Files\Folders moved on Reboot...
PendingFileRenameOperations files...
Registry entries deleted on Reboot...0
Advertisement