:OTL PRC - [2011-10-30 22:15:47 | 000,258,048 | ---- | M] () – C:\Windows\sysdriver32.exe PRC - [2011-08-23 20:20:18 | 000,887,976 | ---- | M] (Ask) – C:\Program Files (x86)\Ask.com\Updater\Updater.exe PRC - [2011-06-29 12:20:24 | 000,743,936 | ---- | M] (Ufasoft) – C:\Windows\ufa\ufa.exe SRV - [2011-10-30 22:15:47 | 000,258,048 | ---- | M] () [Auto | Running] – C:\Windows\sysdriver32.exe – (srvsysdriver32) IE - HKLM…\URLSearchHook: {038cb5c7-48ea-4af9-94e0-a1646542e62b} - C:\Program Files (x86)\ToggleEN\prxtbTog0.dll (Conduit Ltd.) IE - HKLM…\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll (Conduit Ltd.) IE - HKU\S-1-5-21-2054496034-7139357-1245403182-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?l=dis&o=14780 IE - HKU\S-1-5-21-2054496034-7139357-1245403182-1000…\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) IE - HKU\S-1-5-21-2054496034-7139357-1245403182-1000…\URLSearchHook: {038cb5c7-48ea-4af9-94e0-a1646542e62b} - C:\Program Files (x86)\ToggleEN\prxtbTog0.dll (Conduit Ltd.) IE - HKU\S-1-5-21-2054496034-7139357-1245403182-1000…\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll (Conduit Ltd.) FF - prefs.js…browser.search.defaultengine: “Ask.com” FF - prefs.js…browser.search.defaultenginename: “Ask.com” FF - prefs.js…browser.search.defaulturl: “http://search.conduit.com/ResultsExt.aspx?ctid=CT2077543&SearchSource=3&q={searchTerms}” FF - prefs.js…browser.search.order.1: “Ask.com” FF - prefs.js…browser.startup.homepage: “http://www.ask.com/?l=dis&o=14780” FF - prefs.js…extensions.enabledItems: engine@conduit.com:3.2.5.2 FF - prefs.js…extensions.enabledItems: toolbar@ask.com:3.13.1.18107 FF - prefs.js…keyword.URL: “http://websearch.ask.com/redirect?client=ff&src=kw&tb=VD&o=14778&locale=en_US&apn_uid=3EF7F5E2-6954-4F59-B0F2-565A549EB828&apn_ptnrs=VX&apn_sauid=FFEDB0C5-1147-4E66-8019-F1BEADB45A08&apn_dtid=YYYYYYYYPL&&q=” [2011-03-31 07:59:24 | 000,000,000 | —D | M] (Conduit Engine) – C:\Users\OEM\AppData\Roaming\mozilla\Firefox\Profiles\wxm2u61r.default\extensions\engine@conduit.com [2011-08-31 18:05:38 | 000,000,000 | —D | M] (VDownloader Toolbar) – C:\Users\OEM\AppData\Roaming\mozilla\Firefox\Profiles\wxm2u61r.default\extensions\toolbar@ask.com [2011-10-30 21:02:29 | 000,002,571 | ---- | M] () – C:\Users\OEM\AppData\Roaming\Mozilla\Firefox\Profiles\wxm2u61r.default\searchplugins\askcom.xml [2010-10-30 02:04:31 | 000,000,921 | ---- | M] () – C:\Users\OEM\AppData\Roaming\Mozilla\Firefox\Profiles\wxm2u61r.default\searchplugins\conduit.xml O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll File not found O2 - BHO: (ToggleEN Toolbar) - {038cb5c7-48ea-4af9-94e0-a1646542e62b} - C:\Program Files (x86)\ToggleEN\prxtbTog0.dll (Conduit Ltd.) O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.) O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll File not found O2 - BHO: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll (Conduit Ltd.) O2 - BHO: (VDownloader Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3:64bit: - HKLM…\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll File not found O3 - HKLM…\Toolbar: (ToggleEN Toolbar) - {038cb5c7-48ea-4af9-94e0-a1646542e62b} - C:\Program Files (x86)\ToggleEN\prxtbTog0.dll (Conduit Ltd.) O3 - HKLM…\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.) O3 - HKLM…\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll File not found O3 - HKLM…\Toolbar: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll (Conduit Ltd.) O3 - HKLM…\Toolbar: (VDownloader Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKU\S-1-5-21-2054496034-7139357-1245403182-1000…\Toolbar\WebBrowser: (ToggleEN Toolbar) - {038CB5C7-48EA-4AF9-94E0-A1646542E62B} - C:\Program Files (x86)\ToggleEN\prxtbTog0.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-2054496034-7139357-1245403182-1000…\Toolbar\WebBrowser: (uTorrentBar Toolbar) - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-2054496034-7139357-1245403182-1000…\Toolbar\WebBrowser: (VDownloader Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O4 - HKLM…\Run: [1382572.exe] C:\Windows\temp\1382572.exe () O4 - HKLM…\Run: [7130820.exe] C:\Users\OEM\AppData\Local\Temp\7130820.exe () O4 - HKLM…\Run: [855794.exe] C:\Users\OEM\AppData\Local\Temp\855794.exe () O4 - HKLM…\Run: [8653976.exe] C:\Windows\temp\8653976.exe () O4 - HKLM…\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask) O4 - HKLM…\Run: [sysdriver32.exe] C:\Windows\sysdriver32.exe () O4 - HKLM…\Run: [sysdriver32_.exe] C:\Windows\sysdriver32_.exe () O4 - HKLM…\Run: [tray_ico0] C:\Windows\update.tray-2-0\svchost.exe (Cronosoft) O4 - HKLM…\Run: [tray_ico1] C:\Windows\update.tray-7-0\svchost.exe (Cronosoft) O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found O31 - SafeBoot: AlternateShell - services32.exe [2011-10-31 15:55:44 | 000,000,000 | --SD | C] – C:\ComboFix [2011-10-31 15:49:51 | 000,000,000 | —D | C] – C:\Windows\rpcminer [2011-10-31 15:49:51 | 000,000,000 | —D | C] – C:\Windows\phoenix [2011-10-30 22:29:18 | 000,000,000 | -H-D | C] – C:\Windows\update.3 [2011-10-30 22:28:30 | 000,000,000 | -H-D | C] – C:\Windows\update.5.0 [2011-10-30 22:27:40 | 000,000,000 | -H-D | C] – C:\Windows\update.2 [2011-10-30 08:36:13 | 000,000,000 | -H-D | C] – C:\Windows\update.tray-7-0-lnk [2011-10-30 08:36:13 | 000,000,000 | -H-D | C] – C:\Windows\update.tray-7-0 [2011-10-30 08:10:21 | 000,000,000 | —D | C] – C:\Windows\ufa [2011-10-30 07:52:28 | 000,000,000 | —D | C] – C:\Windows\av_ico [2011-10-30 07:51:16 | 000,000,000 | -H-D | C] – C:\Windows\update.tray-2-0-lnk [2011-10-30 07:51:16 | 000,000,000 | -H-D | C] – C:\Windows\update.tray-2-0 [2011-10-31 15:51:05 | 000,000,734 | ---- | M] () – C:\Windows\SysNative\drivers\etc\hîsts [2011-10-31 15:49:50 | 005,589,370 | ---- | M] () – C:\Windows\phoenix.rar [2011-10-31 15:49:50 | 001,075,284 | ---- | M] () – C:\Windows\rpcminer.rar [2011-10-31 15:49:50 | 000,246,272 | ---- | M] () – C:\Windows\unrar.exe [2011-10-31 15:49:50 | 000,182,617 | ---- | M] () – C:\Windows\ufa.rar [2011-10-30 22:29:39 | 000,000,135 | ---- | M] () – C:\Windows\info1 [2011-10-30 22:17:45 | 000,904,792 | ---- | M] () – C:\Windows\geoiplist.rar [2011-10-30 22:17:22 | 000,000,000 | ---- | M] () – C:\Windows\loader2.exe_ok [2011-10-30 22:15:47 | 000,258,048 | ---- | M] () – C:\Windows\sysdriver32_.exe [2011-10-30 22:15:47 | 000,258,048 | ---- | M] () – C:\Windows\sysdriver32.exe [2011-10-30 22:17:46 | 004,636,907 | ---- | C] () – C:\Windows\geoiplist :Files C:\Users\OEM\AppData\Local\Temp*.html :Reg [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot] “AlternateShell”=“cmd.exe” [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] “C:\Windows\update.tray-7-0-lnk\svchost.exe”=- “C:\Windows\update.1\svchost.exe”=- “C:\Windows\update.2\svchost.exe”=- “C:\Windows\update.tray-2-0\svchost.exe”=- “C:\Windows\update.tray-7-0\svchost.exe”=- “C:\Windows\update.tray-7-0-lnk\svchost.exe”=- “C:\Windows\update.1\svchost.exe”=- “C:\Windows\update.2\svchost.exe”=- “C:\Windows\update.tray-2-0\svchost.exe”=- “C:\Windows\update.tray-7-0\svchost.exe”=- :Commands [RESETHOSTS] [emptytemp]