Jump to content

Build Theme!
  •  
  • Infected?

WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. :D Join 93081 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!


Photo

Trojan/Virus Redirect Problems


  • This topic is locked This topic is locked
19 replies to this topic

#1 ike001

ike001

    Authentic Member

  • Authentic Member
  • PipPip
  • 36 posts

Posted 11 July 2011 - 06:22 AM

Hi,

Right after bootup, my Avast Antivirus warns that I have a trojan,

C:\Program Files\Internet Explorer\IExplorer.exe

Avast says "Malicious URL blocked" however, Avast doesn't get rid of it.


Also, after the Avast warning, Win XP Pro does not show my Desktop icons.

However, I am able to browse the web via Internet Explorer.


But when clicking upon web sites via a search engine, I get redirected to strange web sites.

But when typing in a URL directly into Internet Explorer, I go to where I want to go without
being redirected.




Also, for some reason, I need to unhook my internal D Drive in order to boot Windows XP up.

If I keep my internal slave drive hooked up, the computer keeps telling me to "Start Windows Normally,"
"Start in Safemode," etc, and whatever selection I choose, takes me back to the computer telling me
"Start Windows Normally," "Start in Safemode," etc.




I ran OTL. It got interupted twice. Once when Avast warned about the trojan, and again when the
"Network Diagnostics for Windows XP" box popped up out of nowhere.





Here is the content of "OTL.txt":

OTL logfile created on: 7/11/2011 1:48:39 AM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Application Files
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.94 Gb Total Physical Memory | 1.43 Gb Available Physical Memory | 73.74% Memory free
2.07 Gb Paging File | 1.71 Gb Available in Paging File | 82.80% Paging File free
Paging file location(s): C:\pagefile.sys 288 576 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 93.16 Gb Total Space | 24.66 Gb Free Space | 26.47% Space Free | Partition Type: NTFS

Computer Name: BUD | User Name: Ike | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Application Files\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
PRC - c:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
PRC - C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe (WDC)
PRC - C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe (WDC)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe ()
PRC - C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe (ScanSoft, Inc.)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe (HP)
PRC - C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe ()
PRC - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe (American Power Conversion Corporation)
PRC - C:\WINDOWS\system32\VTTrayp.exe (S3 Graphics Co., Ltd.)
PRC - C:\WINDOWS\system32\VTTimer.exe (S3 Graphics, Inc.)
PRC - C:\WINDOWS\system32\HPZipm12.exe (HP)


========== Modules (SafeList) ==========

MOD - C:\Application Files\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Alwil Software\Avast5\snxhk.dll (AVAST Software)
MOD - c:\Program Files\McAfee\SiteAdvisor\sahook.dll (McAfee, Inc.)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\ScanSoft\OmniPageSE4.0\OpHookSE4.dll (ScanSoft, Inc.)


========== Win32 Services (SafeList) ==========

SRV - (HidServ) -- File not found
SRV - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (nosGetPlusHelper) getPlus® -- C:\Program Files\NOS\bin\getPlus_Helper_3004.dll (NOS Microsystems Ltd.)
SRV - (vsmon) -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
SRV - (McAfee SiteAdvisor Service) -- c:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
SRV - (getPlusHelper) getPlus® -- C:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (WDBtnMgrSvc.exe) -- C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe (WDC)
SRV - (W3SVC) -- C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (IISADMIN) -- C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV - (ColdFusion MX 7 Application Server) -- C:\CFusionMX7\runtime\bin\jrunsvc.exe (Macromedia Inc.)
SRV - (APC UPS Service) -- C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe (American Power Conversion Corporation)
SRV - (ColdFusion MX 7 Search Server) -- C:\CFusionMX7\verity\k2\_nti40\bin\k2admin.exe (Verity, Inc.)
SRV - (Pml Driver HPZ12) -- C:\WINDOWS\system32\HPZipm12.exe (HP)
SRV - (MySql) -- C:/mysql/bin/mysqld-nt.exe ()
SRV - (ColdFusion MX 7 ODBC Server) -- C:\CFusionMX7\db\slserver54\bin\swstrtr.exe ()
SRV - (ColdFusion MX 7 ODBC Agent) -- C:\CFusionMX7\db\slserver54\bin\swagent.exe ()
SRV - (MSSQLServer) -- C:\MSSQL7\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (SQLServerAgent) -- C:\MSSQL7\Binn\sqlagent.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (aswSnx) -- C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) -- C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) -- C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) -- C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswRdr) -- C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (Aavmker4) -- C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (aswFsBlk) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (vsdatant) -- C:\WINDOWS\system32\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (ggsemc) -- C:\WINDOWS\system32\drivers\ggsemc.sys (Sony Ericsson Mobile Communications)
DRV - (ggflt) -- C:\WINDOWS\system32\drivers\ggflt.sys (Sony Ericsson Mobile Communications)
DRV - (WDC_SAM) -- C:\WINDOWS\system32\drivers\wdcsam.sys (Western Digital Technologies)
DRV - (a016obex) -- C:\WINDOWS\system32\drivers\a016obex.sys (MCCI Corporation)
DRV - (a016mdm) -- C:\WINDOWS\system32\drivers\a016mdm.sys (MCCI Corporation)
DRV - (a016mgmt) Sony Ericsson Device A016 USB WMC Device Management Drivers (WDM) -- C:\WINDOWS\system32\drivers\a016mgmt.sys (MCCI Corporation)
DRV - (a016mdfl) -- C:\WINDOWS\system32\drivers\a016mdfl.sys (MCCI Corporation)
DRV - (a016bus) Sony Ericsson Device A016 driver (WDM) -- C:\WINDOWS\system32\drivers\a016bus.sys (MCCI Corporation)
DRV - (s115mgmt) Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM) -- C:\WINDOWS\system32\drivers\s115mgmt.sys (MCCI Corporation)
DRV - (s115obex) -- C:\WINDOWS\system32\drivers\s115obex.sys (MCCI Corporation)
DRV - (s115mdm) -- C:\WINDOWS\system32\drivers\s115mdm.sys (MCCI Corporation)
DRV - (s115mdfl) -- C:\WINDOWS\system32\drivers\s115mdfl.sys (MCCI Corporation)
DRV - (s115bus) Sony Ericsson Device 115 driver (WDM) -- C:\WINDOWS\system32\drivers\s115bus.sys (MCCI Corporation)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (ALCXSENS) -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS (Sensaura)
DRV - (RTL8023) -- C:\WINDOWS\system32\drivers\Rtlnic51.sys (Realtek Semiconductor Corporation )
DRV - (rtl8139) Realtek RTL8139(A/B/C) -- C:\WINDOWS\system32\drivers\rtl8139.sys (Realtek Semiconductor Corporation)
DRV - (HSFHWBS2) -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) -- C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
DRV - (USBCM) -- C:\WINDOWS\system32\drivers\Sacm2A.sys ( )
DRV - (viaagp1) -- C:\WINDOWS\System32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.)
DRV - (crlscsi) -- C:\WINDOWS\System32\drivers\crlscsi.sys (Corel Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Secure Search"
FF - prefs.js..browser.search.selectedEngine: "Secure Search"
FF - prefs.js..browser.startup.homepage: "D:\\Data Files\\Work Files\\WebsiteFiles\\HomePage\\Home.htm"
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20090920.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..keyword.URL: "http://search.yahoo....h?fr=mcafee&p="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nosltd.com/getPlus+®,version=1.6.2.102: C:\Program Files\NOS\bin\np_gp.dll (NOS Microsystems Ltd.)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2536: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2594: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1698: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2011/06/01 15:43:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/06/05 22:59:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/11 23:25:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape 7.1\Extensions\\Components: c:\Application Files\Internet\NewsReaders\Netscape\Components [2009/03/30 20:41:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape 7.1\Extensions\\Plugins: c:\Application Files\Internet\NewsReaders\Netscape\Plugins [2011/06/10 15:06:03 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Netscape 7.1\Extensions\\Components: c:\Application Files\Internet\NewsReaders\Netscape\Components [2009/03/30 20:41:58 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Netscape 7.1\Extensions\\Plugins: c:\Application Files\Internet\NewsReaders\Netscape\Plugins [2011/06/10 15:06:03 | 000,000,000 | ---D | M]

[2009/11/21 15:24:03 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Ike\Application Data\Mozilla\Extensions
[2009/11/21 15:24:03 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Ike\Application Data\Mozilla\Extensions\mozswing@mozswing.org
[2011/03/07 10:33:55 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Ike\Application Data\Mozilla\Firefox\Profiles\xaac7lao.default\extensions
[2009/07/23 21:07:16 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Ike\Application Data\Mozilla\Firefox\Profiles\xaac7lao.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/11/13 20:05:07 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Documents and Settings\Ike\Application Data\Mozilla\Firefox\Profiles\xaac7lao.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011/06/10 15:06:05 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/04/15 18:43:04 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/08 00:29:18 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/11/09 04:40:41 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/01/12 19:02:23 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/03/08 00:36:01 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/06/10 15:06:06 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2010/04/08 14:07:01 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/06/01 15:43:33 | 000,000,000 | ---D | M] (McAfee SiteAdvisor) -- C:\PROGRAM FILES\MCAFEE\SITEADVISOR
[2008/06/17 20:43:04 | 000,086,016 | ---- | M] (Coupons, Inc.) -- C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll
[2011/05/04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/11/26 09:55:52 | 000,002,024 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\McSiteAdvisor.xml

O1 HOSTS File: ([2009/04/16 22:12:49 | 000,304,466 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 10509 more lines...
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Anonymizer 2005 Toolbar) - {DB264E15-F83B-4603-BFC1-4EA7E3204686} - C:\Program Files\Anonymizer\Anon2005\AnonIEBar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Anonymizer 2005 Toolbar) - {DB264E15-F83B-4603-BFC1-4EA7E3204686} - C:\Program Files\Anonymizer\Anon2005\AnonIEBar.dll ()
O4 - HKLM..\Run: [ACD mPower Tools] File not found
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Google Quick Search Box] C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe (Google Inc.)
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe (HP)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [ScanSoft OmniPage SE 4.0-reminder] C:\Program Files\ScanSoft\OmniPageSE4.0\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [VTTimer] C:\WINDOWS\System32\VTTimer.exe (S3 Graphics, Inc.)
O4 - HKLM..\Run: [VTTrayp] C:\WINDOWS\System32\VTTrayp.exe (S3 Graphics Co., Ltd.)
O4 - HKLM..\Run: [WD Drive Manager] C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe (WDC)
O4 - HKLM..\Run: [WrtMon.exe] C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe ()
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [JUaDAjhRvP] File not found
O4 - Startup: C:\Documents and Settings\Ike\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra Button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - Reg Error: Value error. File not found
O16 - DPF: {01010200-5E80-11D8-9E86-0007E96C65AE} http://supportcenter...ad/tgctlins.cab (SupportSoft Installer)
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} http://supportcenter...oad/tgctlcm.cab (Support.com Configuration Class)
O16 - DPF: {106E49CF-797A-11D2-81A2-00E02C015623} http://www.alternati...-ie/alttiff.cab (AlternaTIFF ActiveX)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.micr...heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} http://us.chat1.yimg...v45/yacscom.cab (Yahoo! Audio Conferencing)
O16 - DPF: {3253344D-0000-0010-8000-00AA00389B71} http://codecs.micros...386/mpg4sax.cab (Reg Error: Key error.)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.micros...ntent/opuc3.cab (Office Update Installation Engine)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.micros...b?1135806761620 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.micros...b?1135807830562 (MUWebControl Class)
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} http://chat.yahoo.com/cab/yacsui.cab (Yahoo! Audio UI1)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} http://acs.pandasoft...free/asinst.cab (ActiveScan Installer Class)
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} Reg Error: Key error. (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.m...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (get_atlcom Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 24.25.227.55 209.18.47.61 24.25.227.53
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {EDB0E980-90BD-11D4-8599-0008C7D3B6F8} - C:\Program Files\Qualcomm\Eudora\EuShlExt.dll (Qualcomm Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/12/28 11:41:55 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.g723 - g723.acm File not found
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivXNetworks, Inc.)
Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
Drivers32: vidc.I263 - C:\WINDOWS\System32\i263_32.drv (Intel Corporation)
Drivers32: vidc.I420 - C:\WINDOWS\System32\i420vfw.dll (www.helixcommunity.org)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: VIDC.IV41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.LEAD - C:\WINDOWS\System32\LCodcCMP.dll (LEAD Technologies, Inc.)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\yv12vfw.dll (www.helixcommunity.org)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/07/10 18:40:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ike\Local Settings\Application Data\PCHealth
[2011/07/08 09:58:33 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Ike\Recent
[2011/06/30 20:06:18 | 000,441,176 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2011/06/22 00:12:55 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\ZoneAlarm
[2011/06/22 00:12:50 | 000,104,448 | ---- | C] (Check Point Software Technologies LTD) -- C:\WINDOWS\System32\zlcommdb.dll
[2011/06/22 00:12:50 | 000,069,120 | ---- | C] (Check Point Software Technologies LTD) -- C:\WINDOWS\System32\zlcomm.dll
[2011/06/15 15:32:15 | 000,105,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mup.sys
[2007/06/28 23:58:15 | 000,015,429 | R--- | C] ( ) -- C:\WINDOWS\System32\drivers\Sacm2A.sys
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/07/11 01:41:07 | 000,000,330 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/07/11 01:38:56 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/07/11 01:38:27 | 000,000,236 | ---- | M] () -- C:\WINDOWS\tasks\OGALogon.job
[2011/07/11 01:37:52 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/07/11 01:37:51 | 2078,855,168 | -HS- | M] () -- C:\hiberfil.sys
[2011/07/11 00:02:49 | 000,004,096 | ---- | M] () -- C:\Documents and Settings\Ike\My Documents\Downloaded.db3
[2011/07/10 23:56:02 | 000,049,152 | ---- | M] () -- C:\Documents and Settings\Ike\My Documents\Downloads.db3
[2011/07/10 14:48:20 | 000,002,707 | ---- | M] () -- C:\WINDOWS\SOLFIRE4.INI
[2011/07/07 12:10:51 | 000,001,005 | ---- | M] () -- C:\WINDOWS\ORACLE.INI
[2011/07/04 20:30:01 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/06/30 20:06:17 | 000,002,626 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2011/06/29 01:45:26 | 000,492,562 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/06/29 01:45:26 | 000,085,594 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/06/29 01:19:07 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/06/25 22:49:29 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/06/25 06:10:46 | 000,052,224 | ---- | M] () -- C:\Documents and Settings\Ike\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/06/22 00:12:56 | 000,004,212 | -H-- | M] () -- C:\WINDOWS\System32\zllictbl.dat
[2011/06/22 00:12:52 | 000,420,889 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/12/17 02:52:39 | 000,009,322 | ---- | C] () -- C:\Documents and Settings\Ike\Application Data\Comma Separated Values (Windows).EML
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | ---- | C] () -- C:\WINDOWS\System32\OGAEXEC.exe
[2009/08/01 08:34:32 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009/08/01 07:05:26 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2009/01/13 19:40:13 | 000,800,800 | -HS- | C] () -- C:\WINDOWS\System32\drivers\fidbox.dat
[2008/07/09 22:11:10 | 000,796,048 | ---- | C] () -- C:\WINDOWS\System32\libeay32_0.9.6l.dll
[2008/06/22 02:25:02 | 000,000,022 | ---- | C] () -- C:\WINDOWS\WSAGE.INI
[2008/05/31 20:26:26 | 000,001,005 | ---- | C] () -- C:\WINDOWS\ORACLE.INI
[2008/05/26 09:48:37 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2008/01/16 13:55:43 | 000,011,776 | ---- | C] () -- C:\WINDOWS\System32\ZPORT4AS.dll
[2007/10/24 12:52:27 | 000,010,593 | ---- | C] () -- C:\WINDOWS\CSTBox.INI
[2007/10/24 11:51:08 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\IPPCPUID.DLL
[2007/10/24 11:49:30 | 000,011,776 | ---- | C] () -- C:\WINDOWS\System32\pmsbfn32.dll
[2007/10/24 11:47:39 | 000,000,416 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2007/09/07 03:23:53 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2007/06/28 23:58:15 | 000,135,168 | R--- | C] () -- C:\WINDOWS\UNDPX2A.exe
[2007/06/28 23:58:15 | 000,053,693 | R--- | C] () -- C:\WINDOWS\UNDPX2A.sys
[2007/02/11 05:45:46 | 000,037,888 | ---- | C] () -- C:\WINDOWS\System32\insrepim.exe
[2007/01/01 02:13:36 | 000,000,228 | ---- | C] () -- C:\WINDOWS\NumerUna.INI
[2006/09/30 18:51:49 | 000,000,757 | ---- | C] () -- C:\WINDOWS\TOC4.INI
[2006/09/02 06:22:16 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\Iyvu9_32.dll
[2006/07/26 03:46:17 | 000,000,001 | ---- | C] () -- C:\WINDOWS\gamin.dll
[2006/04/12 02:42:13 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\cfinfdtc16.dll
[2006/04/12 02:42:13 | 000,045,568 | ---- | C] () -- C:\WINDOWS\System32\cftrn16.dll
[2006/04/12 02:42:13 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\cfwnsck.dll
[2006/04/12 02:42:13 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\cfnwlink.dll
[2006/04/12 02:42:13 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\cfmsnmp.dll
[2006/04/12 02:42:12 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\cfbtr16s.dll
[2006/04/12 02:42:12 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\cfidp16s.dll
[2006/04/12 02:37:41 | 000,000,323 | ---- | C] () -- C:\WINDOWS\CFML.INI
[2006/04/12 02:37:22 | 000,000,059 | ---- | C] () -- C:\WINDOWS\AllState.ini
[2006/04/09 21:49:23 | 000,000,459 | ---- | C] () -- C:\WINDOWS\my.ini
[2006/04/09 20:24:52 | 000,038,576 | ---- | C] () -- C:\WINDOWS\System32\w3ctrs.ini
[2006/04/09 20:24:52 | 000,010,225 | ---- | C] () -- C:\WINDOWS\System32\axperf.ini
[2006/04/09 20:24:48 | 000,011,435 | ---- | C] () -- C:\WINDOWS\System32\infoctrs.ini
[2006/03/25 11:25:00 | 000,000,022 | ---- | C] () -- C:\WINDOWS\System32\w_madriver.dll
[2006/01/07 03:49:05 | 000,012,499 | ---- | C] () -- C:\WINDOWS\System32\Seagate.bin
[2006/01/04 11:26:32 | 000,095,440 | ---- | C] () -- C:\WINDOWS\NSUninst.exe
[2006/01/04 11:26:10 | 000,095,440 | ---- | C] () -- C:\WINDOWS\GREUninstall.exe
[2006/01/04 11:10:44 | 000,001,178 | ---- | C] () -- C:\Documents and Settings\Ike\Application Data\Image Zone Express.msf
[2006/01/02 07:37:26 | 000,000,036 | ---- | C] () -- C:\WINDOWS\ezmacros.INI
[2006/01/02 07:37:11 | 000,000,522 | ---- | C] () -- C:\WINDOWS\unezmac.ini
[2006/01/01 21:49:00 | 000,077,824 | R--- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2006/01/01 21:42:42 | 000,081,136 | ---- | C] () -- C:\WINDOWS\HPHins08.dat
[2006/01/01 21:42:42 | 000,004,011 | ---- | C] () -- C:\WINDOWS\hphmdl08.dat
[2006/01/01 06:46:06 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\EONSYS.DLL
[2005/12/31 09:18:23 | 000,070,144 | ---- | C] () -- C:\WINDOWS\unlite2.exe
[2005/12/31 09:18:09 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\wddx_com.dll
[2005/12/31 09:17:56 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\xmltok.dll
[2005/12/31 09:17:56 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\xmlparse.dll
[2005/12/31 09:17:55 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\cfmsg.dll
[2005/12/31 04:52:32 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Ike\Application Data\Unsent Messages
[2005/12/31 04:52:32 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Ike\Application Data\Trash
[2005/12/31 04:52:32 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Ike\Application Data\Templates
[2005/12/31 04:52:32 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Ike\Application Data\Sent
[2005/12/31 04:52:32 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Ike\Application Data\Drafts
[2005/12/30 06:40:05 | 000,000,000 | ---- | C] () -- C:\WINDOWS\longfile.INI
[2005/12/29 21:43:33 | 000,014,452 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2005/12/29 21:42:21 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2005/12/28 20:26:13 | 000,009,533 | ---- | C] () -- C:\WINDOWS\hpdj6122.ini
[2005/12/28 20:14:02 | 000,002,707 | ---- | C] () -- C:\WINDOWS\SOLFIRE4.INI
[2005/12/28 20:04:00 | 000,054,850 | ---- | C] () -- C:\WINDOWS\SFINST.EXE
[2005/12/28 20:00:38 | 000,000,161 | ---- | C] () -- C:\WINDOWS\ACSATLAS.INI
[2005/12/28 19:41:38 | 000,035,153 | ---- | C] () -- C:\WINDOWS\SETUP1.EXE
[2005/12/28 17:31:20 | 000,000,169 | ---- | C] () -- C:\WINDOWS\RtlRack.ini
[2005/12/28 17:29:05 | 000,052,224 | ---- | C] () -- C:\Documents and Settings\Ike\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/12/28 17:15:57 | 000,001,101 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/12/28 16:43:01 | 000,004,212 | -H-- | C] () -- C:\WINDOWS\System32\zllictbl.dat
[2005/12/28 12:56:19 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2005/12/28 12:03:54 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini
[2005/12/28 12:03:53 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2005/12/28 12:03:51 | 000,040,448 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2005/12/28 11:51:43 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2005/12/28 11:44:28 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2005/12/28 11:39:07 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2005/12/28 01:31:29 | 000,004,327 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2005/12/28 01:30:23 | 000,279,600 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2003/03/31 02:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2003/03/31 02:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2003/03/31 02:00:00 | 000,492,562 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2003/03/31 02:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2003/03/31 02:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2003/03/31 02:00:00 | 000,085,594 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2003/03/31 02:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2003/03/31 02:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2003/03/31 02:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2003/03/31 02:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2003/03/31 02:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2009/05/16 12:58:05 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\ACD Systems
[2010/07/29 14:08:17 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2008/12/23 15:06:08 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\BVRP Software
[2008/01/16 07:25:10 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Grisoft
[2008/07/09 05:39:54 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\MailFrontier
[2008/11/30 14:29:02 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Memeo
[2008/12/01 04:02:28 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\MemeoCommon
[2007/10/24 11:47:28 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft
[2008/12/23 02:32:35 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Sony
[2009/08/01 10:12:17 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2007/01/13 23:16:37 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/03/30 20:46:34 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2009/05/16 13:04:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ike\Application Data\ACD Systems
[2010/06/08 23:07:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ike\Application Data\AnvSoft
[2007/10/24 12:11:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ike\Application Data\Canon
[2008/01/05 04:36:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ike\Application Data\FrostWire
[2005/12/30 10:27:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ike\Application Data\funkitron
[2009/05/20 22:21:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ike\Application Data\GrabPro
[2008/01/16 07:28:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ike\Application Data\Grisoft
[2006/01/01 22:37:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ike\Application Data\Image Zone Express
[2005/12/29 17:27:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ike\Application Data\Leadertech
[2011/03/13 21:10:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ike\Application Data\MailWasher
[2009/11/26 15:19:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ike\Application Data\Newsbin
[2007/10/24 16:00:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ike\Application Data\NewSoft
[2010/02/20 18:47:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ike\Application Data\Opera
[2010/05/01 11:34:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ike\Application Data\Orbit
[2005/12/28 18:41:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ike\Application Data\Qualcomm
[2007/10/24 11:47:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ike\Application Data\ScanSoft
[2008/12/23 15:50:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ike\Application Data\Sony
[2008/12/23 02:22:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ike\Application Data\Sony Setup
[2008/12/16 14:04:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ike\Application Data\Teleca
[2007/01/13 23:16:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ike\Application Data\Viewpoint
[2008/12/01 04:01:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ike\Application Data\WD
[2010/06/08 22:31:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ike\Application Data\Xilisoft Corporation
[2011/07/11 01:41:07 | 000,000,330 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2011/07/11 01:38:27 | 000,000,236 | ---- | M] () -- C:\WINDOWS\Tasks\OGALogon.job
[2009/05/13 04:18:13 | 000,000,230 | ---- | M] () -- C:\WINDOWS\Tasks\Ozzy Ozbourne - Crazy Train.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/01/13 08:02:58 | 000,011,395 | ---- | M] () -- C:\2009-1-13 - hijackthis.log
[2007/06/11 07:11:43 | 000,374,032 | ---- | M] () -- C:\ACF3758.zip
[2005/12/28 11:41:55 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2008/12/20 12:08:44 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2009/08/04 18:28:19 | 000,000,281 | -HS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | ---- | M] () -- C:\cmldr
[2007/05/13 21:48:41 | 295,043,048 | ---- | M] (Zero G) -- C:\coldfusion-702-win.exe
[2005/12/28 11:41:55 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2004/04/04 19:55:35 | 000,003,872 | ---- | M] () -- C:\cvv1.gif
[2009/07/23 21:39:42 | 007,024,337 | ---- | M] () -- C:\Daves.flv
[2007/06/04 22:46:03 | 001,524,871 | ---- | M] () -- C:\easybio_setup.exe
[2007/03/16 05:55:53 | 000,000,269 | ---- | M] () -- C:\executive.log
[2011/07/11 01:37:51 | 2078,855,168 | -HS- | M] () -- C:\hiberfil.sys
[2009/04/01 22:34:34 | 000,011,590 | ---- | M] () -- C:\hijackthis.log
[2009/07/23 21:41:00 | 013,712,566 | ---- | M] () -- C:\Holly.flv
[2005/12/28 11:41:55 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2009/01/13 18:27:22 | 000,002,986 | ---- | M] () -- C:\Kas - C Drive - Eudora Directory.html
[2009/01/17 05:12:12 | 000,003,043 | ---- | M] () -- C:\Kas - C Drive.html
[2009/01/13 19:12:52 | 000,002,888 | ---- | M] () -- C:\Kas - K Drive - Backup Directory Look Again.html
[2009/01/13 18:37:34 | 000,002,897 | ---- | M] () -- C:\Kas - K Drive - Backup Directory.html
[2009/01/13 19:01:52 | 000,002,893 | ---- | M] () -- C:\Kas - K Drive - Old-E-Drive Directory.html
[2009/01/13 18:11:22 | 000,002,955 | ---- | M] () -- C:\Kas L Drive.html
[2009/01/13 06:45:57 | 000,029,102 | ---- | M] () -- C:\Kas.gif
[2009/01/12 06:32:54 | 000,016,016 | ---- | M] () -- C:\Kasp.gif
[2007/07/17 05:23:30 | 000,157,988 | ---- | M] () -- C:\LylaCaptcha_v1Beta.zip
[2009/04/01 23:13:14 | 000,003,566 | ---- | M] () -- C:\mbam-log-2009-04-01 (23-11-56).txt
[2009/01/12 05:20:40 | 000,020,872 | ---- | M] () -- C:\Modify - ComboFix.txt
[2005/12/28 11:41:55 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2005/12/28 13:04:06 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/09/03 09:19:34 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2008/09/07 03:50:15 | 133,227,519 | ---- | M] () -- C:\OOo_2.4.1_Win32Intel_install_wJRE_en-US.exe
[2011/07/11 01:37:50 | 301,989,888 | -HS- | M] () -- C:\pagefile.sys
[2009/01/12 06:11:24 | 000,000,833 | ---- | M] () -- C:\Post This - mbam-log-2009-01-12 (06-06-59).txt
[2009/05/24 22:15:37 | 000,000,022 | -H-- | M] () -- C:\qpmd8378.bin
[2007/09/21 17:39:39 | 000,000,000 | ---- | M] () -- C:\t100
[2007/09/21 17:39:51 | 000,000,000 | ---- | M] () -- C:\t100.1
[2007/12/19 14:43:21 | 000,000,000 | ---- | M] () -- C:\t10g
[2007/12/19 14:43:35 | 000,000,000 | ---- | M] () -- C:\t10g.1
[2008/07/10 15:40:46 | 000,000,000 | ---- | M] () -- C:\t10o
[2008/07/10 15:40:59 | 000,000,000 | ---- | M] () -- C:\t10o.1
[2008/10/17 04:53:18 | 000,000,000 | ---- | M] () -- C:\t110
[2008/10/17 04:53:27 | 000,000,000 | ---- | M] () -- C:\t110.1
[2008/04/28 11:38:06 | 000,000,000 | ---- | M] () -- C:\t114
[2008/04/28 11:38:14 | 000,000,000 | ---- | M] () -- C:\t114.1
[2007/12/20 11:12:37 | 000,000,000 | ---- | M] () -- C:\t120
[2007/12/20 11:12:51 | 000,000,000 | ---- | M] () -- C:\t120.1
[2008/09/06 02:06:34 | 000,000,000 | ---- | M] () -- C:\t120.2
[2008/09/06 02:06:45 | 000,000,000 | ---- | M] () -- C:\t120.3
[2007/12/10 06:56:31 | 000,000,000 | ---- | M] () -- C:\t124
[2007/12/10 06:56:43 | 000,000,000 | ---- | M] () -- C:\t124.1
[2007/12/14 08:13:14 | 000,000,000 | ---- | M] () -- C:\t124.2
[2007/12/14 08:13:29 | 000,000,000 | ---- | M] () -- C:\t124.3
[2007/12/11 04:02:09 | 000,000,000 | ---- | M] () -- C:\t128
[2007/12/11 04:02:23 | 000,000,000 | ---- | M] () -- C:\t128.1
[2008/03/09 05:09:52 | 000,000,000 | ---- | M] () -- C:\t12g
[2008/03/09 09:53:02 | 000,000,320 | ---- | M] () -- C:\t12g.1
[2008/03/10 12:48:04 | 000,000,000 | ---- | M] () -- C:\t12g.2
[2008/03/10 12:48:11 | 000,000,000 | ---- | M] () -- C:\t12g.3
[2007/12/24 05:00:33 | 000,000,000 | ---- | M] () -- C:\t12k
[2007/12/24 05:00:47 | 000,000,000 | ---- | M] () -- C:\t12k.1
[2008/05/10 17:57:48 | 000,000,000 | ---- | M] () -- C:\t138
[2008/05/10 17:57:52 | 000,000,000 | ---- | M] () -- C:\t138.1
[2008/09/11 07:32:46 | 000,000,000 | ---- | M] () -- C:\t14g
[2008/09/11 07:33:02 | 000,000,000 | ---- | M] () -- C:\t14g.1
[2007/07/05 20:41:11 | 000,000,000 | ---- | M] () -- C:\t15s
[2007/07/05 21:48:51 | 000,000,094 | ---- | M] () -- C:\t15s.1
[2008/09/02 06:57:46 | 000,000,000 | ---- | M] () -- C:\t16k
[2008/09/02 06:57:56 | 000,000,000 | ---- | M] () -- C:\t16k.1
[2008/07/12 20:19:39 | 000,000,000 | ---- | M] () -- C:\t17k
[2008/07/12 20:19:49 | 000,000,000 | ---- | M] () -- C:\t17k.1
[2008/06/11 10:26:04 | 000,000,000 | ---- | M] () -- C:\t198
[2008/06/11 10:26:11 | 000,000,000 | ---- | M] () -- C:\t198.1
[2008/06/11 11:04:07 | 000,000,000 | ---- | M] () -- C:\t1b8
[2008/06/11 11:04:10 | 000,000,000 | ---- | M] () -- C:\t1b8.1
[2008/05/16 00:23:08 | 000,000,000 | ---- | M] () -- C:\t1ck
[2008/05/16 00:23:14 | 000,000,000 | ---- | M] () -- C:\t1ck.1
[2007/07/23 13:52:23 | 000,000,000 | ---- | M] () -- C:\t1f8
[2007/07/23 13:52:34 | 000,000,000 | ---- | M] () -- C:\t1f8.1
[2007/07/16 13:19:03 | 000,000,000 | ---- | M] () -- C:\t1fg
[2007/07/16 13:19:13 | 000,000,000 | ---- | M] () -- C:\t1fg.1
[2007/07/18 03:07:17 | 000,000,000 | ---- | M] () -- C:\t1fk
[2007/07/18 03:07:27 | 000,000,000 | ---- | M] () -- C:\t1fk.1
[2007/07/19 22:46:03 | 000,000,000 | ---- | M] () -- C:\t1g4
[2007/07/19 22:46:13 | 000,000,000 | ---- | M] () -- C:\t1g4.1
[2007/07/24 11:05:36 | 000,000,000 | ---- | M] () -- C:\t1gc
[2007/07/24 11:05:46 | 000,000,000 | ---- | M] () -- C:\t1gc.1
[2007/07/22 01:25:39 | 000,000,000 | ---- | M] () -- C:\t1gg
[2007/07/22 01:25:50 | 000,000,000 | ---- | M] () -- C:\t1gg.1
[2007/07/15 04:04:25 | 000,000,000 | ---- | M] () -- C:\t1gk
[2007/07/15 04:04:35 | 000,000,000 | ---- | M] () -- C:\t1gk.1
[2008/09/22 17:48:12 | 000,000,000 | ---- | M] () -- C:\t1h4
[2008/09/22 17:48:20 | 000,000,000 | ---- | M] () -- C:\t1h4.1
[2007/07/16 08:58:56 | 000,000,000 | ---- | M] () -- C:\t1h8
[2007/07/16 08:59:06 | 000,000,000 | ---- | M] () -- C:\t1h8.1
[2007/07/21 11:16:28 | 000,000,000 | ---- | M] () -- C:\t1jo
[2007/07/21 11:16:37 | 000,000,000 | ---- | M] () -- C:\t1jo.1
[2007/10/11 22:50:04 | 000,000,000 | ---- | M] () -- C:\t1m4
[2007/10/11 22:50:17 | 000,000,000 | ---- | M] () -- C:\t1m4.1
[2008/10/09 19:58:08 | 000,000,000 | ---- | M] () -- C:\t1ng
[2008/10/09 19:58:18 | 000,000,000 | ---- | M] () -- C:\t1ng.1
[2008/10/12 02:13:15 | 000,000,000 | ---- | M] () -- C:\t1ng.2
[2008/10/12 02:13:21 | 000,000,000 | ---- | M] () -- C:\t1ng.3
[2008/08/15 15:39:30 | 000,000,000 | ---- | M] () -- C:\t1nk
[2008/08/15 15:39:50 | 000,000,000 | ---- | M] () -- C:\t1nk.1
[2008/08/21 02:52:38 | 000,000,000 | ---- | M] () -- C:\t1nk.2
[2008/08/21 02:52:49 | 000,000,000 | ---- | M] () -- C:\t1nk.3
[2008/10/06 01:38:55 | 000,000,000 | ---- | M] () -- C:\t1nk.4
[2008/10/06 01:38:58 | 000,000,000 | ---- | M] () -- C:\t1nk.5
[2008/10/13 03:10:57 | 000,000,000 | ---- | M] () -- C:\t1nk.6
[2008/10/13 03:11:06 | 000,000,000 | ---- | M] () -- C:\t1nk.7
[2008/08/03 15:08:23 | 000,000,000 | ---- | M] () -- C:\t1no
[2008/08/03 15:08:37 | 000,000,000 | ---- | M] () -- C:\t1no.1
[2008/08/08 11:47:49 | 000,000,000 | ---- | M] () -- C:\t1no.2
[2008/08/08 11:48:00 | 000,000,000 | ---- | M] () -- C:\t1no.3
[2008/08/22 23:23:16 | 000,000,000 | ---- | M] () -- C:\t1no.4
[2008/08/22 23:23:28 | 000,000,000 | ---- | M] () -- C:\t1no.5
[2008/08/04 14:45:58 | 000,000,000 | ---- | M] () -- C:\t1ns
[2008/08/04 14:46:25 | 000,000,000 | ---- | M] () -- C:\t1ns.1
[2008/08/26 00:17:29 | 000,000,000 | ---- | M] () -- C:\t1ns.2
[2008/08/26 00:17:42 | 000,000,000 | ---- | M] () -- C:\t1ns.3
[2008/09/25 16:47:47 | 000,000,000 | ---- | M] () -- C:\t1ns.4
[2008/09/25 16:47:55 | 000,000,000 | ---- | M] () -- C:\t1ns.5
[2008/10/11 23:27:30 | 000,000,000 | ---- | M] () -- C:\t1ns.6
[2008/10/11 23:27:37 | 000,000,000 | ---- | M] () -- C:\t1ns.7
[2008/08/06 13:40:48 | 000,000,000 | ---- | M] () -- C:\t1o0
[2008/08/06 13:41:06 | 000,001,923 | ---- | M] () -- C:\t1o0.1
[2008/08/12 15:38:28 | 000,000,000 | ---- | M] () -- C:\t1o0.2
[2008/08/12 15:38:37 | 000,000,000 | ---- | M] () -- C:\t1o0.3
[2008/08/13 18:18:23 | 000,000,000 | ---- | M] () -- C:\t1o4
[2008/08/13 18:18:36 | 000,000,000 | ---- | M] () -- C:\t1o4.1
[2008/08/07 17:37:57 | 000,000,000 | ---- | M] () -- C:\t1o8
[2008/08/07 17:38:11 | 000,001,925 | ---- | M] () -- C:\t1o8.1
[2008/09/26 18:52:16 | 000,000,000 | ---- | M] () -- C:\t1o8.2
[2008/09/26 18:52:31 | 000,000,000 | ---- | M] () -- C:\t1o8.3
[2008/08/30 02:32:13 | 000,000,000 | ---- | M] () -- C:\t1oc
[2008/08/30 02:32:26 | 000,000,000 | ---- | M] () -- C:\t1oc.1
[2007/07/19 07:17:39 | 000,000,000 | ---- | M] () -- C:\t1ok
[2007/07/19 07:17:49 | 000,000,000 | ---- | M] () -- C:\t1ok.1
[2008/09/23 17:32:49 | 000,000,000 | ---- | M] () -- C:\t1ok.2
[2008/09/23 17:32:56 | 000,000,000 | ---- | M] () -- C:\t1ok.3
[2008/09/14 09:40:12 | 000,000,000 | ---- | M] () -- C:\t1os
[2008/09/14 09:40:21 | 000,000,000 | ---- | M] () -- C:\t1os.1
[2008/08/04 17:37:43 | 000,000,000 | ---- | M] () -- C:\t1p0
[2008/08/04 17:37:57 | 000,000,000 | ---- | M] () -- C:\t1p0.1
[2008/09/24 20:05:09 | 000,000,000 | ---- | M] () -- C:\t1p0.2
[2008/09/24 20:05:15 | 000,000,000 | ---- | M] () -- C:\t1p0.3
[2008/07/12 00:35:42 | 000,000,000 | ---- | M] () -- C:\t1p8
[2008/07/12 00:35:49 | 000,000,000 | ---- | M] () -- C:\t1p8.1
[2008/07/23 23:44:34 | 000,000,000 | ---- | M] () -- C:\t1p8.2
[2008/07/23 23:44:47 | 000,000,000 | ---- | M] () -- C:\t1p8.3
[2008/07/25 00:39:12 | 000,000,000 | ---- | M] () -- C:\t1p8.4
[2008/07/25 00:39:23 | 000,000,000 | ---- | M] () -- C:\t1p8.5
[2008/07/27 02:01:36 | 000,000,000 | ---- | M] () -- C:\t1p8.6
[2008/07/27 02:01:45 | 000,000,000 | ---- | M] () -- C:\t1p8.7
[2008/07/19 05:32:21 | 000,000,000 | ---- | M] () -- C:\t1pc
[2008/07/19 05:32:27 | 000,000,000 | ---- | M] () -- C:\t1pc.1
[2008/08/01 02:56:36 | 000,000,000 | ---- | M] () -- C:\t1pg
[2008/08/01 02:57:04 | 000,000,000 | ---- | M] () -- C:\t1pg.1
[2008/07/22 10:42:34 | 000,000,000 | ---- | M] () -- C:\t1pk
[2008/07/22 10:42:47 | 000,000,000 | ---- | M] () -- C:\t1pk.1
[2008/09/07 21:30:00 | 000,000,000 | ---- | M] () -- C:\t1pk.2
[2008/09/07 21:30:10 | 000,000,000 | ---- | M] () -- C:\t1pk.3
[2008/09/27 19:44:01 | 000,000,000 | ---- | M] () -- C:\t1pk.4
[2008/09/27 19:44:07 | 000,000,000 | ---- | M] () -- C:\t1pk.5
[2008/10/03 21:14:31 | 000,000,000 | ---- | M] () -- C:\t1pk.6
[2008/10/03 21:14:37 | 000,000,000 | ---- | M] () -- C:\t1pk.7
[2008/07/31 03:36:37 | 000,000,000 | ---- | M] () -- C:\t1po
[2008/07/31 03:36:48 | 000,000,000 | ---- | M] () -- C:\t1po.1
[2008/09/01 01:57:26 | 000,000,000 | ---- | M] () -- C:\t1po.2
[2008/09/01 01:57:32 | 000,000,000 | ---- | M] () -- C:\t1po.3
[2008/09/05 02:37:01 | 000,000,000 | ---- | M] () -- C:\t1po.4
[2008/09/05 02:37:12 | 000,000,000 | ---- | M] () -- C:\t1po.5
[2008/10/15 21:23:53 | 000,000,000 | ---- | M] () -- C:\t1po.6
[2008/10/15 21:24:00 | 000,000,000 | ---- | M] () -- C:\t1po.7
[2008/09/19 17:51:09 | 000,000,000 | ---- | M] () -- C:\t1ps
[2008/09/19 17:51:16 | 000,000,000 | ---- | M] () -- C:\t1ps.1
[2008/09/17 14:18:24 | 000,000,000 | ---- | M] () -- C:\t1q0
[2008/09/17 14:18:34 | 000,000,000 | ---- | M] () -- C:\t1q0.1
[2008/09/30 19:42:11 | 000,000,000 | ---- | M] () -- C:\t1q4
[2008/09/30 19:42:17 | 000,000,000 | ---- | M] () -- C:\t1q4.1
[2008/10/01 19:41:12 | 000,000,000 | ---- | M] () -- C:\t1q4.2
[2008/10/01 19:41:18 | 000,000,000 | ---- | M] () -- C:\t1q4.3
[2008/09/03 11:38:47 | 000,000,000 | ---- | M] () -- C:\t1qk
[2008/09/03 11:38:57 | 000,000,000 | ---- | M] () -- C:\t1qk.1
[2008/07/30 11:40:47 | 000,000,000 | ---- | M] () -- C:\t1qo
[2008/07/30 11:40:53 | 000,000,000 | ---- | M] () -- C:\t1qo.1
[2008/10/04 21:06:31 | 000,000,000 | ---- | M] () -- C:\t1qo.2
[2008/10/04 21:06:53 | 000,000,000 | ---- | M] () -- C:\t1qo.3
[2008/10/07 21:29:20 | 000,000,000 | ---- | M] () -- C:\t1qo.4
[2008/10/07 21:29:27 | 000,000,000 | ---- | M] () -- C:\t1qo.5
[2008/10/09 00:16:17 | 000,000,000 | ---- | M] () -- C:\t1qo.6
[2008/10/09 00:16:24 | 000,000,000 | ---- | M] () -- C:\t1qo.7
[2008/06/21 16:17:07 | 000,000,000 | ---- | M] () -- C:\t1r0
[2008/06/21 16:17:15 | 000,000,000 | ---- | M] () -- C:\t1r0.1
[2008/07/17 19:45:15 | 000,000,000 | ---- | M] () -- C:\t1r0.2
[2008/07/17 19:45:22 | 000,000,000 | ---- | M] () -- C:\t1r0.3
[2008/07/30 06:35:16 | 000,000,000 | ---- | M] () -- C:\t1r0.4
[2008/07/30 06:35:22 | 000,000,000 | ---- | M] () -- C:\t1r0.5
[2008/09/07 11:55:20 | 000,000,000 | ---- | M] () -- C:\t1r0.6
[2008/09/07 11:55:30 | 000,000,000 | ---- | M] () -- C:\t1r0.7
[2008/10/19 02:09:36 | 000,000,000 | ---- | M] () -- C:\t1r4
[2008/10/19 02:09:42 | 000,000,000 | ---- | M] () -- C:\t1r4.1
[2008/07/16 14:27:38 | 000,000,000 | ---- | M] () -- C:\t1r8
[2008/07/16 14:27:45 | 000,000,000 | ---- | M] () -- C:\t1r8.1
[2008/07/20 23:04:49 | 000,000,000 | ---- | M] () -- C:\t1r8.2
[2008/07/20 23:04:55 | 000,001,229 | ---- | M] () -- C:\t1r8.3
[2008/07/26 03:07:31 | 000,000,000 | ---- | M] () -- C:\t1r8.4
[2008/07/26 03:07:38 | 000,000,000 | ---- | M] () -- C:\t1r8.5
[2008/04/29 12:21:16 | 000,000,000 | ---- | M] () -- C:\t1ro
[2008/04/29 12:21:24 | 000,000,000 | ---- | M] () -- C:\t1ro.1
[2008/07/03 21:51:07 | 000,000,000 | ---- | M] () -- C:\t1ro.2
[2008/07/03 21:51:14 | 000,000,000 | ---- | M] () -- C:\t1ro.3
[2008/07/10 23:23:30 | 000,000,000 | ---- | M] () -- C:\t1ro.4
[2008/07/10 23:23:37 | 000,000,000 | ---- | M] () -- C:\t1ro.5
[2006/04/18 20:07:33 | 000,000,000 | ---- | M] () -- C:\t1rs
[2006/04/18 21:24:43 | 000,000,313 | ---- | M] () -- C:\t1rs.1
[2006/06/05 00:18:41 | 000,000,000 | ---- | M] () -- C:\t1s0
[2006/06/05 00:18:44 | 000,000,000 | ---- | M] () -- C:\t1s0.1
[2008/04/22 13:52:13 | 000,000,000 | ---- | M] () -- C:\t1s0.2
[2008/04/22 13:52:24 | 000,000,000 | ---- | M] () -- C:\t1s0.3
[2008/04/24 00:06:04 | 000,000,000 | ---- | M] () -- C:\t1s0.4
[2008/04/24 00:06:12 | 000,000,000 | ---- | M] () -- C:\t1s0.5
[2008/05/01 21:37:47 | 000,000,000 | ---- | M] () -- C:\t1s0.6
[2008/05/01 21:37:56 | 000,000,000 | ---- | M] () -- C:\t1s0.7
[2008/04/30 22:13:35 | 000,000,000 | ---- | M] () -- C:\t1s4
[2008/04/30 22:13:53 | 000,000,000 | ---- | M] () -- C:\t1s4.1
[2008/04/21 18:07:41 | 000,000,000 | ---- | M] () -- C:\t1s8
[2008/04/21 18:07:51 | 000,000,000 | ---- | M] () -- C:\t1s8.1
[2008/04/25 01:13:54 | 000,000,000 | ---- | M] () -- C:\t1s8.2
[2008/04/25 01:14:04 | 000,000,000 | ---- | M] () -- C:\t1s8.3
[2008/04/30 14:06:49 | 000,000,000 | ---- | M] () -- C:\t1s8.4
[2008/04/30 14:07:02 | 000,000,000 | ---- | M] () -- C:\t1s8.5
[2008/05/02 15:20:06 | 000,000,000 | ---- | M] () -- C:\t1s8.6
[2008/05/02 15:20:14 | 000,000,000 | ---- | M] () -- C:\t1s8.7
[2008/06/09 21:36:34 | 000,000,000 | ---- | M] () -- C:\t1s8.8
[2008/06/09 21:36:42 | 000,000,000 | ---- | M] () -- C:\t1s8.9
[2008/07/02 13:11:01 | 000,000,000 | ---- | M] () -- C:\t1s8.a
[2008/07/02 13:11:07 | 000,000,000 | ---- | M] () -- C:\t1s8.b
[2008/04/26 14:30:10 | 000,000,000 | ---- | M] () -- C:\t1sc
[2008/04/26 14:30:18 | 000,000,000 | ---- | M] () -- C:\t1sc.1
[2008/05/04 16:16:44 | 000,000,000 | ---- | M] () -- C:\t1sc.2
[2008/05/04 16:16:52 | 000,000,000 | ---- | M] () -- C:\t1sc.3
[2008/05/05 16:29:37 | 000,000,000 | ---- | M] () -- C:\t1sc.4
[2008/05/05 16:29:45 | 000,000,000 | ---- | M] () -- C:\t1sc.5
[2008/05/08 18:34:35 | 000,000,000 | ---- | M] () -- C:\t1sc.6
[2008/05/08 18:34:43 | 000,000,000 | ---- | M] () -- C:\t1sc.7
[2008/05/16 23:09:29 | 000,000,000 | ---- | M] () -- C:\t1sc.8
[2008/05/16 23:09:42 | 000,000,000 | ---- | M] () -- C:\t1sc.9
[2008/05/03 18:42:59 | 000,000,000 | ---- | M] () -- C:\t1sg
[2008/05/03 18:43:08 | 000,000,000 | ---- | M] () -- C:\t1sg.1
[2008/07/09 03:12:21 | 000,000,000 | ---- | M] () -- C:\t1sg.2
[2008/07/09 03:12:27 | 000,000,000 | ---- | M] () -- C:\t1sg.3
[2006/06/04 16:26:56 | 000,000,000 | ---- | M] () -- C:\t1sk
[2006/06/04 16:26:59 | 000,000,000 | ---- | M] () -- C:\t1sk.1
[2008/05/25 22:31:42 | 000,000,000 | ---- | M] () -- C:\t1sk.2
[2008/05/25 22:31:50 | 000,000,000 | ---- | M] () -- C:\t1sk.3
[2008/05/27 13:33:51 | 000,000,000 | ---- | M] () -- C:\t1ss
[2008/05/27 13:33:59 | 000,000,000 | ---- | M] () -- C:\t1ss.1
[2008/07/09 01:23:20 | 000,000,000 | ---- | M] () -- C:\t1ss.2
[2008/07/09 01:23:30 | 000,000,000 | ---- | M] () -- C:\t1ss.3
[2006/09/16 10:01:28 | 000,000,000 | ---- | M] () -- C:\t1t4
[2006/09/16 10:01:32 | 000,000,000 | ---- | M] () -- C:\t1t4.1
[2008/05/12 06:51:30 | 000,000,000 | ---- | M] () -- C:\t1t8
[2008/05/12 06:51:38 | 000,000,000 | ---- | M] () -- C:\t1t8.1
[2008/07/01 17:41:18 | 000,000,000 | ---- | M] () -- C:\t1t8.2
[2008/07/01 17:41:26 | 000,000,000 | ---- | M] () -- C:\t1t8.3
[2008/06/09 02:58:23 | 000,000,000 | ---- | M] () -- C:\t1to
[2008/06/09 02:58:31 | 000,000,000 | ---- | M] () -- C:\t1to.1
[2008/07/08 20:26:17 | 000,000,000 | ---- | M] () -- C:\t1ts
[2008/07/08 20:26:25 | 000,000,000 | ---- | M] () -- C:\t1ts.1
[2008/05/07 15:32:13 | 000,000,000 | ---- | M] () -- C:\t1u0
[2008/05/07 15:32:21 | 000,000,000 | ---- | M] () -- C:\t1u0.1
[2008/06/03 18:27:12 | 000,000,000 | ---- | M] () -- C:\t1u8
[2008/06/03 18:27:19 | 000,000,000 | ---- | M] () -- C:\t1u8.1
[2009/05/24 22:15:19 | 000,000,000 | ---- | M] () -- C:\t1uc
[2009/05/24 22:15:25 | 000,000,000 | ---- | M] () -- C:\t1uc.1
[2008/08/24 20:15:45 | 000,000,000 | ---- | M] () -- C:\t1v8
[2008/08/24 20:16:13 | 000,000,000 | ---- | M] () -- C:\t1v8.1
[2008/10/14 06:37:36 | 000,000,000 | ---- | M] () -- C:\t1v8.2
[2008/10/14 06:37:44 | 000,000,000 | ---- | M] () -- C:\t1v8.3
[2008/09/10 01:21:25 | 000,000,000 | ---- | M] () -- C:\t1vk
[2008/09/10 01:21:35 | 000,000,000 | ---- | M] () -- C:\t1vk.1
[2008/10/10 22:25:11 | 000,000,000 | ---- | M] () -- C:\t1vo
[2008/10/10 22:25:25 | 000,000,000 | ---- | M] () -- C:\t1vo.1
[2008/10/18 02:57:41 | 000,000,000 | ---- | M] () -- C:\t20c
[2008/10/18 02:57:49 | 000,000,000 | ---- | M] () -- C:\t20c.1
[2008/07/13 02:39:23 | 000,000,000 | ---- | M] () -- C:\t21g
[2008/07/13 02:39:30 | 000,000,000 | ---- | M] () -- C:\t21g.1
[2008/05/22 02:46:43 | 000,000,000 | ---- | M] () -- C:\t22k
[2008/05/22 02:46:45 | 000,000,000 | ---- | M] () -- C:\t22k.1
[2008/09/17 17:02:17 | 000,000,000 | ---- | M] () -- C:\t258
[2008/09/17 17:02:30 | 000,000,000 | ---- | M] () -- C:\t258.1
[2008/06/30 14:15:01 | 000,000,000 | ---- | M] () -- C:\t2s4
[2008/06/30 14:15:18 | 000,000,000 | ---- | M] () -- C:\t2s4.1
[2007/05/21 19:21:44 | 000,000,000 | ---- | M] () -- C:\t3k
[2007/05/21 19:21:52 | 000,000,000 | ---- | M] () -- C:\t3k.1
[2007/07/27 21:50:42 | 000,000,000 | ---- | M] () -- C:\t3k.2
[2007/07/27 21:50:51 | 000,000,000 | ---- | M] () -- C:\t3k.3
[2008/08/27 03:58:34 | 000,000,000 | ---- | M] () -- C:\t3k.4
[2008/08/27 03:58:46 | 000,000,000 | ---- | M] () -- C:\t3k.5
[2008/01/21 16:03:46 | 000,000,000 | ---- | M] () -- C:\t3s
[2008/01/21 16:03:53 | 000,000,000 | ---- | M] () -- C:\t3s.1
[2007/05/20 23:04:40 | 000,000,000 | ---- | M] () -- C:\t54
[2007/05/20 23:04:48 | 000,000,000 | ---- | M] () -- C:\t54.1
[2008/03/28 13:52:42 | 000,000,000 | ---- | M] () -- C:\t54.2
[2008/03/28 13:53:03 | 000,000,000 | ---- | M] () -- C:\t54.3
[2008/03/29 05:32:48 | 000,000,000 | ---- | M] () -- C:\t5k
[2008/03/29 05:33:08 | 000,000,000 | ---- | M] () -- C:\t5k.1
[2008/03/29 12:42:29 | 000,000,000 | ---- | M] () -- C:\t60
[2008/03/29 12:42:48 | 000,000,000 | ---- | M] () -- C:\t60.1
[2008/03/29 14:29:26 | 000,000,000 | ---- | M] () -- C:\t68
[2008/03/29 14:29:48 | 000,000,000 | ---- | M] () -- C:\t68.1
[2008/03/18 15:59:38 | 000,000,000 | ---- | M] () -- C:\t6k
[2008/03/18 16:00:01 | 000,000,000 | ---- | M] () -- C:\t6k.1
[2007/06/11 10:22:33 | 000,000,000 | ---- | M] () -- C:\t6o
[2007/06/11 10:22:43 | 000,000,000 | ---- | M] () -- C:\t6o.1
[2007/06/19 12:50:22 | 000,000,000 | ---- | M] () -- C:\t6o.2
[2007/06/19 12:50:31 | 000,000,000 | ---- | M] () -- C:\t6o.3
[2008/02/29 22:26:23 | 000,000,000 | ---- | M] () -- C:\t6o.4
[2008/03/01 00:51:42 | 000,001,659 | ---- | M] () -- C:\t6o.5
[2008/03/18 18:16:09 | 000,000,000 | ---- | M] () -- C:\t6o.6
[2008/03/18 18:16:28 | 000,000,000 | ---- | M] () -- C:\t6o.7
[2008/03/19 14:38:48 | 000,000,000 | ---- | M] () -- C:\t6o.8
[2008/03/19 14:39:04 | 000,000,000 | ---- | M] () -- C:\t6o.9
[2007/06/22 23:05:57 | 000,000,000 | ---- | M] () -- C:\t70
[2007/06/22 23:06:07 | 000,000,000 | ---- | M] () -- C:\t70.1
[2008/03/27 20:02:21 | 000,000,000 | ---- | M] () -- C:\t70.2
[2008/03/27 20:02:41 | 000,000,000 | ---- | M] () -- C:\t70.3
[2008/04/02 03:57:17 | 000,000,000 | ---- | M] () -- C:\t74
[2008/04/02 03:57:29 | 000,000,000 | ---- | M] () -- C:\t74.1
[2008/03/07 17:36:14 | 000,000,000 | ---- | M] () -- C:\t78
[2008/03/07 17:36:33 | 000,000,000 | ---- | M] () -- C:\t78.1
[2008/03/02 04:36:33 | 000,000,000 | ---- | M] () -- C:\t7c
[2008/03/02 04:36:56 | 000,000,000 | ---- | M] () -- C:\t7c.1
[2008/03/23 11:52:33 | 000,000,000 | ---- | M] () -- C:\t7c.2
[2008/03/23 11:52:51 | 000,000,000 | ---- | M] () -- C:\t7c.3
[2007/05/19 09:10:04 | 000,000,000 | ---- | M] () -- C:\t7g
[2007/05/19 09:10:13 | 000,000,000 | ---- | M] () -- C:\t7g.1
[2007/06/06 06:10:59 | 000,000,000 | ---- | M] () -- C:\t7g.2
[2007/06/06 06:11:07 | 000,000,000 | ---- | M] () -- C:\t7g.3
[2008/03/12 00:19:00 | 000,000,000 | ---- | M] () -- C:\t7g.4
[2008/03/12 00:19:10 | 000,000,000 | ---- | M] () -- C:\t7g.5
[2008/03/24 02:33:54 | 000,000,000 | ---- | M] () -- C:\t7g.6
[2008/03/24 02:34:06 | 000,000,000 | ---- | M] () -- C:\t7g.7
[2007/05/20 00:07:29 | 000,000,000 | ---- | M] () -- C:\t7k
[2007/05/20 00:07:37 | 000,000,000 | ---- | M] () -- C:\t7k.1
[2008/02/28 00:41:43 | 000,000,000 | ---- | M] () -- C:\t7k.2
[2008/02/28 06:59:03 | 000,000,400 | ---- | M] () -- C:\t7k.3
[2008/03/27 10:51:09 | 000,000,000 | ---- | M] () -- C:\t7k.4
[2008/03/27 10:51:24 | 000,000,000 | ---- | M] () -- C:\t7k.5
[2007/05/22 01:01:43 | 000,000,000 | ---- | M] () -- C:\t7o
[2007/05/22 01:01:52 | 000,000,000 | ---- | M] () -- C:\t7o.1
[2007/06/07 21:21:39 | 000,000,000 | ---- | M] () -- C:\t7o.2
[2007/06/07 21:21:49 | 000,000,000 | ---- | M] () -- C:\t7o.3
[2008/02/07 08:32:16 | 000,000,000 | ---- | M] () -- C:\t7o.4
[2008/02/07 08:32:20 | 000,000,000 | ---- | M] () -- C:\t7o.5
[2007/06/02 23:23:08 | 000,000,000 | ---- | M] () -- C:\t7s
[2007/06/02 23:23:17 | 000,000,000 | ---- | M] () -- C:\t7s.1
[2007/06/05 20:43:24 | 000,000,000 | ---- | M] () -- C:\t80
[2007/06/05 20:43:34 | 000,000,000 | ---- | M] () -- C:\t80.1
[2007/06/18 09:49:49 | 000,000,000 | ---- | M] () -- C:\t80.2
[2007/06/18 09:49:59 | 000,000,000 | ---- | M] () -- C:\t80.3
[2008/02/27 01:55:27 | 000,000,000 | ---- | M] () -- C:\t80.4
[2008/02/27 01:55:44 | 000,000,000 | ---- | M] () -- C:\t80.5
[2008/03/01 06:41:17 | 000,000,000 | ---- | M] () -- C:\t84
[2008/03/01 06:41:42 | 000,000,000 | ---- | M] () -- C:\t84.1
[2008/03/01 08:22:34 | 000,000,000 | ---- | M] () -- C:\t84.2
[2008/03/01 08:22:55 | 000,000,000 | ---- | M] () -- C:\t84.3
[2008/03/23 14:47:23 | 000,000,000 | ---- | M] () -- C:\t84.4
[2008/03/23 14:47:37 | 000,000,000 | ---- | M] () -- C:\t84.5
[2008/03/26 11:37:07 | 000,000,000 | ---- | M] () -- C:\t84.6
[2008/03/26 11:37:10 | 000,000,000 | ---- | M] () -- C:\t84.7
[2008/04/07 21:00:35 | 000,000,000 | ---- | M] () -- C:\t84.8
[2008/04/07 21:00:38 | 000,000,000 | ---- | M] () -- C:\t84.9
[2008/02/25 23:17:33 | 000,000,000 | ---- | M] () -- C:\t8c
[2008/02/25 23:17:59 | 000,000,000 | ---- | M] () -- C:\t8c.1
[2008/03/13 07:14:22 | 000,000,000 | ---- | M] () -- C:\t8c.2
[2008/03/13 07:14:34 | 000,000,000 | ---- | M] () -- C:\t8c.3
[2008/03/21 13:39:05 | 000,000,000 | ---- | M] () -- C:\t8c.4
[2008/03/21 13:39:23 | 000,000,000 | ---- | M] () -- C:\t8c.5
[2008/02/27 01:22:35 | 000,000,000 | ---- | M] () -- C:\t8g
[2008/02/27 01:22:57 | 000,000,000 | ---- | M] () -- C:\t8g.1
[2008/03/04 17:45:38 | 000,000,000 | ---- | M] () -- C:\t8g.2
[2008/03/04 17:45:59 | 000,000,000 | ---- | M] () -- C:\t8g.3
[2008/04/08 05:17:09 | 000,000,000 | ---- | M] () -- C:\t8g.4
[2008/04/08 05:17:28 | 000,000,000 | ---- | M] () -- C:\t8g.5
[2008/04/15 20:51:14 | 000,000,000 | ---- | M] () -- C:\t8g.6
[2008/04/15 20:51:22 | 000,000,000 | ---- | M] () -- C:\t8g.7
[2008/03/13 04:16:27 | 000,000,000 | ---- | M] () -- C:\t8k
[2008/03/13 04:16:40 | 000,000,000 | ---- | M] () -- C:\t8k.1
[2008/03/19 02:01:50 | 000,000,000 | ---- | M] () -- C:\t8k.2
[2008/03/19 02:02:10 | 000,000,000 | ---- | M] () -- C:\t8k.3
[2008/04/17 04:27:20 | 000,000,000 | ---- | M] () -- C:\t8k.4
[2008/04/17 04:27:27 | 000,000,000 | ---- | M] () -- C:\t8k.5
[2008/03/17 09:24:50 | 000,000,000 | ---- | M] () -- C:\t8o
[2008/03/17 09:25:10 | 000,000,000 | ---- | M] () -- C:\t8o.1
[2008/03/03 01:00:34 | 000,000,000 | ---- | M] () -- C:\t8s
[2008/03/03 01:00:55 | 000,000,000 | ---- | M] () -- C:\t8s.1
[2008/03/11 06:39:35 | 000,000,000 | ---- | M] () -- C:\t8s.2
[2008/03/11 06:39:43 | 000,000,000 | ---- | M] () -- C:\t8s.3
[2008/03/21 05:43:24 | 000,000,000 | ---- | M] () -- C:\t8s.4
[2008/03/21 05:43:46 | 000,000,000 | ---- | M] () -- C:\t8s.5
[2008/04/19 22:31:59 | 000,000,000 | ---- | M] () -- C:\t8s.6
[2008/04/19 22:32:05 | 000,000,000 | ---- | M] () -- C:\t8s.7
[2008/02/29 13:32:27 | 000,000,000 | ---- | M] () -- C:\t90
[2008/02/29 13:32:50 | 000,000,000 | ---- | M] () -- C:\t90.1
[2008/03/01 15:47:48 | 000,000,000 | ---- | M] () -- C:\t90.2
[2008/03/01 15:48:06 | 000,000,000 | ---- | M] () -- C:\t90.3
[2008/03/16 09:37:13 | 000,000,000 | ---- | M] () -- C:\t90.4
[2008/03/16 09:37:31 | 000,000,000 | ---- | M] () -- C:\t90.5
[2008/04/15 02:39:44 | 000,000,000 | ---- | M] () -- C:\t90.6
[2008/04/15 02:39:55 | 000,000,000 | ---- | M] () -- C:\t90.7
[2008/03/05 22:32:43 | 000,000,000 | ---- | M] () -- C:\t94
[2008/03/05 22:33:06 | 000,000,000 | ---- | M] () -- C:\t94.1
[2008/07/18 01:47:37 | 000,000,000 | ---- | M] () -- C:\ta4
[2008/07/18 01:47:55 | 000,000,000 | ---- | M] () -- C:\ta4.1
[2007/12/06 19:49:46 | 000,000,000 | ---- | M] () -- C:\tac
[2007/12/06 19:50:00 | 000,000,000 | ---- | M] () -- C:\tac.1
[2007/06/02 19:34:45 | 000,000,000 | ---- | M] () -- C:\tag
[2007/06/02 19:34:53 | 000,000,000 | ---- | M] () -- C:\tag.1
[2007/06/23 22:12:47 | 000,000,000 | ---- | M] () -- C:\tag.2
[2007/06/23 22:12:57 | 000,000,000 | ---- | M] () -- C:\tag.3
[2008/04/14 18:23:56 | 000,000,000 | ---- | M] () -- C:\tao
[2008/04/14 18:24:06 | 000,000,000 | ---- | M] () -- C:\tao.1
[2008/04/16 18:39:53 | 000,000,000 | ---- | M] () -- C:\tao.2
[2008/04/16 18:40:02 | 000,000,000 | ---- | M] () -- C:\tao.3
[2008/02/24 17:38:00 | 000,000,000 | ---- | M] () -- C:\tas
[2008/02/24 17:38:06 | 000,000,000 | ---- | M] () -- C:\tas.1
[2008/03/06 09:30:09 | 000,000,000 | ---- | M] () -- C:\tas.2
[2008/03/06 09:30:31 | 000,000,000 | ---- | M] () -- C:\tas.3
[2008/04/05 14:49:55 | 000,000,000 | ---- | M] () -- C:\tas.4
[2008/04/05 14:49:58 | 000,000,000 | ---- | M] () -- C:\tas.5
[2008/04/10 12:08:29 | 000,000,000 | ---- | M] () -- C:\tas.6
[2008/04/10 12:08:37 | 000,000,000 | ---- | M] () -- C:\tas.7
[2008/04/13 17:44:42 | 000,000,000 | ---- | M] () -- C:\tas.8
[2008/04/13 17:44:45 | 000,000,000 | ---- | M] () -- C:\tas.9
[2007/06/12 06:36:10 | 000,000,000 | ---- | M] () -- C:\tb4
[2007/06/12 06:36:20 | 000,000,000 | ---- | M] () -- C:\tb4.1
[2008/04/20 01:08:45 | 000,000,000 | ---- | M] () -- C:\tb4.2
[2008/04/20 01:09:14 | 000,000,000 | ---- | M] () -- C:\tb4.3
[2008/04/26 02:50:41 | 000,000,000 | ---- | M] () -- C:\tb4.4
[2008/04/26 02:50:48 | 000,000,000 | ---- | M] () -- C:\tb4.5
[2008/02/27 16:37:09 | 000,000,000 | ---- | M] () -- C:\tb8
[2008/02/27 16:37:25 | 000,000,000 | ---- | M] () -- C:\tb8.1
[2008/04/16 05:31:25 | 000,000,000 | ---- | M] () -- C:\tb8.2
[2008/04/16 05:31:33 | 000,000,000 | ---- | M] () -- C:\tb8.3
[2008/03/14 09:42:31 | 000,000,000 | ---- | M] () -- C:\tbc
[2008/03/14 09:42:40 | 000,000,000 | ---- | M] () -- C:\tbc.1
[2008/04/20 00:48:27 | 000,000,000 | ---- | M] () -- C:\tbg
[2008/04/20 00:48:32 | 000,000,000 | ---- | M] () -- C:\tbg.1
[2008/04/19 21:12:41 | 000,000,000 | ---- | M] () -- C:\tbk
[2008/04/19 21:12:47 | 000,000,000 | ---- | M] () -- C:\tbk.1
[2008/04/20 16:33:20 | 000,000,000 | ---- | M] () -- C:\tbo
[2008/04/20 16:33:25 | 000,000,000 | ---- | M] () -- C:\tbo.1
[2008/04/18 08:13:23 | 000,000,000 | ---- | M] () -- C:\tc0
[2008/04/18 08:13:38 | 000,000,000 | ---- | M] () -- C:\tc0.1
[2008/04/19 12:18:20 | 000,000,000 | ---- | M] () -- C:\tc0.2
[2008/04/19 12:18:28 | 000,000,000 | ---- | M] () -- C:\tc0.3
[2008/03/14 14:47:40 | 000,000,000 | ---- | M] () -- C:\tc4
[2008/03/14 14:47:58 | 000,000,000 | ---- | M] () -- C:\tc4.1
[2008/04/18 02:50:05 | 000,000,000 | ---- | M] () -- C:\tc4.2
[2008/04/18 03:04:37 | 000,000,317 | ---- | M] () -- C:\tc4.3
[2008/04/18 07:38:17 | 000,000,000 | ---- | M] () -- C:\tc4.4
[2008/04/18 07:38:29 | 000,000,000 | ---- | M] () -- C:\tc4.5
[2007/08/04 17:52:21 | 000,000,000 | ---- | M] () -- C:\tcc
[2007/08/04 17:52:31 | 000,000,000 | ---- | M] () -- C:\tcc.1
[2007/08/10 22:51:43 | 000,000,000 | ---- | M] () -- C:\tcg
[2007/08/10 22:51:53 | 000,000,000 | ---- | M] () -- C:\tcg.1
[2008/04/03 13:44:18 | 000,000,000 | ---- | M] () -- C:\tcg.2
[2008/04/03 13:44:26 | 000,000,000 | ---- | M] () -- C:\tcg.3
[2007/08/09 12:11:52 | 000,000,000 | ---- | M] () -- C:\tck
[2007/08/09 12:12:02 | 000,000,866 | ---- | M] () -- C:\tck.1
[2008/04/10 19:11:22 | 000,000,000 | ---- | M] () -- C:\tcs
[2008/04/10 19:11:29 | 000,000,000 | ---- | M] () -- C:\tcs.1
[2007/10/13 00:15:31 | 000,000,000 | ---- | M] () -- C:\td4
[2007/10/13 00:15:45 | 000,000,000 | ---- | M] () -- C:\td4.1
[2007/05/30 22:09:46 | 000,000,000 | ---- | M] () -- C:\td8
[2007/05/30 22:09:54 | 000,000,000 | ---- | M] () -- C:\td8.1
[2008/04/07 00:38:52 | 000,000,000 | ---- | M] () -- C:\td8.2
[2008/04/07 00:38:59 | 000,000,000 | ---- | M] () -- C:\td8.3
[2008/04/08 16:44:47 | 000,000,000 | ---- | M] () -- C:\td8.4
[2008/04/08 16:44:55 | 000,000,000 | ---- | M] () -- C:\td8.5
[2007/08/02 21:37:58 | 000,000,000 | ---- | M] () -- C:\tdc
[2007/08/02 21:38:07 | 000,000,000 | ---- | M] () -- C:\tdc.1
[2007/08/05 13:08:36 | 000,000,000 | ---- | M] () -- C:\tdc.2
[2007/08/05 13:08:45 | 000,000,000 | ---- | M] () -- C:\tdc.3
[2007/08/06 20:48:40 | 000,000,000 | ---- | M] () -- C:\tdc.4
[2007/08/06 20:48:50 | 000,000,000 | ---- | M] () -- C:\tdc.5
[2007/11/29 17:40:21 | 000,000,000 | ---- | M] () -- C:\tdc.6
[2007/11/29 17:40:35 | 000,000,000 | ---- | M] () -- C:\tdc.7
[2007/08/01 12:51:10 | 000,000,000 | ---- | M] () -- C:\tdg
[2007/08/01 12:51:20 | 000,000,000 | ---- | M] () -- C:\tdg.1
[2007/08/13 11:27:27 | 000,000,000 | ---- | M] () -- C:\tdg.2
[2007/08/13 12:12:55 | 000,000,389 | ---- | M] () -- C:\tdg.3
[2007/08/08 01:42:05 | 000,000,000 | ---- | M] () -- C:\tdk
[2007/08/08 01:42:15 | 000,000,000 | ---- | M] () -- C:\tdk.1
[2007/11/24 16:07:13 | 000,000,000 | ---- | M] () -- C:\tdk.2
[2007/11/24 16:07:27 | 000,000,000 | ---- | M] () -- C:\tdk.3
[2008/04/12 05:38:54 | 000,000,000 | ---- | M] () -- C:\tdk.4
[2008/04/12 05:39:02 | 000,000,000 | ---- | M] () -- C:\tdk.5
[2008/04/09 01:44:55 | 000,000,000 | ---- | M] () -- C:\tds
[2008/04/09 01:45:03 | 000,000,000 | ---- | M] () -- C:\tds.1
[2007/12/23 01:24:20 | 000,000,000 | ---- | M] () -- C:\te4
[2007/12/23 01:24:34 | 000,000,000 | ---- | M] () -- C:\te4.1
[2007/10/15 23:07:47 | 000,000,000 | ---- | M] () -- C:\te8
[2007/10/15 23:08:02 | 000,000,000 | ---- | M] () -- C:\te8.1
[2008/02/23 23:05:30 | 000,000,000 | ---- | M] () -- C:\te8.2
[2008/02/23 23:05:37 | 000,000,000 | ---- | M] () -- C:\te8.3
[2008/03/25 18:57:31 | 000,000,000 | ---- | M] () -- C:\te8.4
[2008/03/25 18:57:38 | 000,000,000 | ---- | M] () -- C:\te8.5
[2008/04/13 04:39:11 | 000,000,000 | ---- | M] () -- C:\tec
[2008/04/13 04:39:19 | 000,000,000 | ---- | M] () -- C:\tec.1
[2007/12/25 09:16:25 | 000,000,000 | ---- | M] () -- C:\teg
[2007/12/25 09:16:40 | 000,000,000 | ---- | M] () -- C:\teg.1
[2007/05/23 01:11:59 | 000,000,000 | ---- | M] () -- C:\tf0
[2007/05/23 01:12:08 | 000,000,000 | ---- | M] () -- C:\tf0.1
[2007/05/27 20:04:51 | 000,000,000 | ---- | M] () -- C:\tf0.2
[2007/05/27 20:04:59 | 000,000,000 | ---- | M] () -- C:\tf0.3
[2007/06/17 14:01:19 | 000,000,000 | ---- | M] () -- C:\tf0.4
[2007/06/17 14:01:29 | 000,000,000 | ---- | M] () -- C:\tf0.5
[2007/06/10 22:53:02 | 000,000,000 | ---- | M] () -- C:\tf4
[2007/06/10 22:53:11 | 000,000,000 | ---- | M] () -- C:\tf4.1
[2007/06/12 10:58:39 | 000,000,000 | ---- | M] () -- C:\tf4.2
[2007/06/12 10:58:48 | 000,000,000 | ---- | M] () -- C:\tf4.3
[2007/06/14 09:47:34 | 000,000,000 | ---- | M] () -- C:\tf4.4
[2007/06/14 09:47:44 | 000,000,000 | ---- | M] () -- C:\tf4.5
[2007/06/16 10:48:35 | 000,000,000 | ---- | M] () -- C:\tf4.6
[2007/06/16 10:48:44 | 000,000,000 | ---- | M] () -- C:\tf4.7
[2007/06/04 09:12:48 | 000,000,000 | ---- | M] () -- C:\tf8
[2007/06/04 09:12:56 | 000,000,000 | ---- | M] () -- C:\tf8.1
[2007/06/18 17:04:30 | 000,000,000 | ---- | M] () -- C:\tf8.2
[2007/06/18 17:04:40 | 000,000,000 | ---- | M] () -- C:\tf8.3
[2007/12/28 06:13:10 | 000,000,000 | ---- | M] () -- C:\tf8.4
[2007/12/28 06:13:21 | 000,000,000 | ---- | M] () -- C:\tf8.5
[2008/09/12 20:18:38 | 000,000,000 | ---- | M] () -- C:\tf8.6
[2008/09/12 20:18:49 | 000,000,000 | ---- | M] () -- C:\tf8.7
[2007/06/03 18:01:31 | 000,000,000 | ---- | M] () -- C:\tfc
[2007/06/03 18:01:40 | 000,000,000 | ---- | M] () -- C:\tfc.1
[2007/06/10 12:51:09 | 000,000,000 | ---- | M] () -- C:\tfc.2
[2007/06/10 12:51:19 | 000,000,000 | ---- | M] () -- C:\tfc.3
[2007/05/31 02:24:25 | 000,000,000 | ---- | M] () -- C:\tfg
[2007/05/31 02:24:33 | 000,000,000 | ---- | M] () -- C:\tfg.1
[2007/06/08 01:22:33 | 000,000,000 | ---- | M] () -- C:\tfk
[2007/06/08 01:22:43 | 000,000,000 | ---- | M] () -- C:\tfk.1
[2007/06/17 17:24:09 | 000,000,000 | ---- | M] () -- C:\tfo
[2007/06/17 17:24:18 | 000,000,000 | ---- | M] () -- C:\tfo.1
[2007/10/10 01:34:21 | 000,000,000 | ---- | M] () -- C:\tg4
[2007/10/10 01:34:36 | 000,000,000 | ---- | M] () -- C:\tg4.1
[2007/12/12 01:21:58 | 000,000,000 | ---- | M] () -- C:\tg4.2
[2007/12/12 01:22:11 | 000,000,000 | ---- | M] () -- C:\tg4.3
[2008/08/16 19:54:13 | 000,000,000 | ---- | M] () -- C:\tg4.4
[2008/08/16 19:54:29 | 000,000,000 | ---- | M] () -- C:\tg4.5
[2007/12/03 15:31:28 | 000,000,000 | ---- | M] () -- C:\tgg
[2007/12/03 15:31:41 | 000,000,000 | ---- | M] () -- C:\tgg.1
[2008/08/28 23:39:42 | 000,000,000 | ---- | M] () -- C:\tgo
[2008/08/28 23:39:58 | 000,000,000 | ---- | M] () -- C:\tgo.1
[2008/01/19 18:13:26 | 000,000,000 | ---- | M] () -- C:\tgs
[2008/01/19 18:13:33 | 000,000,000 | ---- | M] () -- C:\tgs.1
[2008/08/08 10:51:40 | 000,000,000 | ---- | M] () -- C:\th4
[2008/08/08 10:52:02 | 000,000,000 | ---- | M] () -- C:\th4.1
[2007/11/29 10:57:50 | 000,015,360 | -HS- | M] () -- C:\Thumbs.db
[2008/04/23 16:21:46 | 000,000,000 | ---- | M] () -- C:\ti0
[2008/04/23 16:22:01 | 000,000,000 | ---- | M] () -- C:\ti0.1
[2007/12/15 16:42:51 | 000,000,000 | ---- | M] () -- C:\tis
[2007/12/15 16:43:05 | 000,000,000 | ---- | M] () -- C:\tis.1
[2008/08/13 17:59:38 | 000,000,000 | ---- | M] () -- C:\tj0
[2008/08/13 18:00:03 | 000,000,000 | ---- | M] () -- C:\tj0.1
[2008/08/11 15:58:46 | 000,000,000 | ---- | M] () -- C:\tj4
[2008/08/11 15:59:02 | 000,000,000 | ---- | M] () -- C:\tj4.1
[2007/12/13 06:48:25 | 000,000,000 | ---- | M] () -- C:\tk4
[2007/12/13 06:48:40 | 000,000,000 | ---- | M] () -- C:\tk4.1
[2007/11/29 14:37:07 | 000,000,000 | ---- | M] () -- C:\tls
[2007/11/29 14:37:21 | 000,000,000 | ---- | M] () -- C:\tls.1
[2008/03/10 08:04:12 | 000,000,000 | ---- | M] () -- C:\tm0
[2008/03/10 08:04:18 | 000,000,000 | ---- | M] () -- C:\tm0.1
[2007/12/20 21:43:51 | 000,000,000 | ---- | M] () -- C:\tms
[2007/12/20 21:44:05 | 000,000,000 | ---- | M] () -- C:\tms.1
[2007/08/05 13:03:46 | 000,000,000 | ---- | M] () -- C:\tn0
[2007/08/05 13:03:57 | 000,000,000 | ---- | M] () -- C:\tn0.1
[2007/12/25 09:30:39 | 000,000,000 | ---- | M] () -- C:\tnc
[2007/12/25 09:30:53 | 000,000,000 | ---- | M] () -- C:\tnc.1
[2008/02/22 15:36:10 | 000,000,000 | ---- | M] () -- C:\tno
[2008/02/22 15:36:17 | 000,000,000 | ---- | M] () -- C:\tno.1
[2008/10/12 19:40:26 | 000,000,000 | ---- | M] () -- C:\tno.2
[2008/10/12 19:40:43 | 000,000,000 | ---- | M] () -- C:\tno.3
[2008/08/21 19:22:52 | 000,000,000 | ---- | M] () -- C:\to4
[2008/08/21 19:23:06 | 000,000,000 | ---- | M] () -- C:\to4.1
[2008/01/08 08:56:15 | 000,000,000 | ---- | M] () -- C:\tqk
[2008/01/08 08:56:27 | 000,000,000 | ---- | M] () -- C:\tqk.1
[2007/05/15 18:10:56 | 000,000,000 | ---- | M] () -- C:\trs
[2007/05/15 18:11:07 | 000,000,000 | ---- | M] () -- C:\trs.1
[2007/08/07 21:30:03 | 000,000,000 | ---- | M] () -- C:\tu4
[2007/08/07 21:30:12 | 000,000,000 | ---- | M] () -- C:\tu4.1
[2007/10/10 13:44:09 | 000,000,000 | ---- | M] () -- C:\tu4.2
[2007/10/10 15:53:19 | 000,000,323 | ---- | M] () -- C:\tu4.3
[2007/09/14 09:12:01 | 000,000,000 | ---- | M] () -- C:\tug
[2007/09/14 09:12:14 | 000,000,000 | ---- | M] () -- C:\tug.1
[2007/09/12 05:02:18 | 000,000,000 | ---- | M] () -- C:\tuk
[2007/09/12 05:02:30 | 000,000,000 | ---- | M] () -- C:\tuk.1
[2007/08/15 19:38:12 | 000,000,000 | ---- | M] () -- C:\tuo
[2007/08/15 19:38:22 | 000,000,000 | ---- | M] () -- C:\tuo.1
[2007/11/12 23:48:41 | 000,000,000 | ---- | M] () -- C:\tuo.2
[2007/11/12 23:48:56 | 000,000,000 | ---- | M] () -- C:\tuo.3
[2007/10/16 23:41:35 | 000,000,000 | ---- | M] () -- C:\tvk
[2007/10/16 23:41:50 | 000,000,000 | ---- | M] () -- C:\tvk.1
[2007/09/21 10:11:12 | 000,000,000 | ---- | M] () -- C:\tvo
[2007/09/21 10:11:25 | 000,000,000 | ---- | M] () -- C:\tvo.1
[2007/09/19 21:25:39 | 000,000,000 | ---- | M] () -- C:\tvs
[2007/09/19 21:25:51 | 000,000,000 | ---- | M] () -- C:\tvs.1
[2011/06/18 00:48:39 | 000,070,894 | ---- | M] () -- C:\winzip.log

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2005/12/28 11:41:33 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 02:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2005/05/05 08:48:54 | 000,067,072 | ---- | M] (Hewlett-Packard Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp3xu.dll
[2007/04/09 13:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 00:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011/05/10 02:10:59 | 000,040,112 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2005/12/28 01:29:31 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2005/12/28 01:29:31 | 000,626,688 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2005/12/28 01:29:31 | 000,434,176 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >

< %USERPROFILE%\Desktop\*.exe >
[2008/01/16 07:39:16 | 000,050,688 | ---- | M] (Atribune.org) -- C:\Documents and Settings\Ike\Desktop\ATF-Cleaner.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-07-08 19:35:26

========== Alternate Data Streams ==========

@Alternate Data Stream - 141 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:76C85903
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34

< End of report >












Here is the content of "Extras.txt":

OTL Extras logfile created on: 7/11/2011 1:48:39 AM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Application Files
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.94 Gb Total Physical Memory | 1.43 Gb Available Physical Memory | 73.74% Memory free
2.07 Gb Paging File | 1.71 Gb Available in Paging File | 82.80% Paging File free
Paging file location(s): C:\pagefile.sys 288 576 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 93.16 Gb Total Space | 24.66 Gb Free Space | 26.47% Space Free | Partition Type: NTFS

Computer Name: BUD | User Name: Ike | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = Opera.HTML] -- Reg Error: Key error. File not found
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
http [open] -- "C:\Application Files\Internet\Browsers\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Application Files\Internet\Browsers\Opera\Opera.exe" "%1" (Opera Software)
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [ACDBrowse] -- "C:\APPLIC~1\MULTIM~1\Graphics\IMAGEV~1\ACDSYS~1\ACDSee\ACDSee.exe" "%1" (ACD Systems, Ltd.)
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Enqueue] -- "C:\Application Files\Multimedia\Audio\Mp3Players\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Application Files\Multimedia\Audio\Mp3Players\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Application Files\Internet\FileRetrievers\LimeWire\LimeWire.exe" = C:\Application Files\Internet\FileRetrievers\LimeWire\LimeWire.exe:*:Disabled:LimeWire
"C:\Program Files\SmartFTP Client 2.0\SmartFTP.exe" = C:\Program Files\SmartFTP Client 2.0\SmartFTP.exe:*:Enabled:SmartFTP Client 2.0 -- (SmartFTP GmbH)
"C:\Program Files\Sony Ericsson\Sony Ericsson Media Manager\MediaManager.exe" = C:\Program Files\Sony Ericsson\Sony Ericsson Media Manager\MediaManager.exe:*:Enabled:Sony Ericsson Media Manager 1.2 -- (Sony Creative Software Inc.)
"C:\Application Files\Internet\NewsReaders\NewsBin\nbpro.exe" = C:\Application Files\Internet\NewsReaders\NewsBin\nbpro.exe:*:Enabled:NewsBin Pro -- (CMCEI)
"C:\Application Files\Internet\Browsers\Opera\opera.exe" = C:\Application Files\Internet\Browsers\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"C:\WINDOWS\system32\ZoneLabs\vsmon.exe" = C:\WINDOWS\system32\ZoneLabs\vsmon.exe:*:Enabled:vsmon -- (Check Point Software Technologies LTD)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0611BD4E-4FE4-4a62-B0C0-18A4CC463428}" = CP_Package_Variety1
"{09984AEC-6B9F-4ca7-B78D-CB44D4771DA3}" = Destinations
"{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}" = WD Diagnostics
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ4802" = CanoScan LiDE 600F
"{15EE79F4-4ED1-4267-9B0F-351009325D7D}" = HP Software Update
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1C139D7D-9FEA-468d-A9C8-2A6E3BDE564A}" = CP_Package_Variety3
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216019FF}" = Java™ 6 Update 26
"{29042B1C-0713-4575-B7CA-5C8E7B0899D4}" = MyODBC 3.51.8
"{2CADCEAB-D5DA-44D6-B5FC-7DEE87AB3C0C}" = Unload
"{2CD2C0DB-81C3-416B-9FA6-589B9235359B}" = OpenOffice.org 2.4
"{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 4.006.00
"{30C19FF2-7FBA-4d09-B9DE-1659977F64F6}" = TrayApp
"{3248F0A8-6813-11D6-A77B-00B0D0160040}" = Java™ 6 Update 4
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{33D6CC28-9F75-4d1b-A11D-98895B3A3729}" = HP Photosmart 330,380,420,470,7800,8000,8200 Series
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}" = McAfee SiteAdvisor
"{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}" = Google Earth
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}" = Adobe® Photoshop® Album Starter Edition 3.0
"{56F8AFC3-FA98-4ff1-9673-8A026CBF85BE}" = WebReg
"{5A0C892E-FD1C-4203-941E-0956AED20A6A}" = APC PowerChute Personal Edition
"{619B8475-0F48-41B7-A370-5147F7092989}" = Virtual Earth 3D (Beta)
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6E7D29CB-E3D9-4ef2-B4DC-ECF1C0C45ECC}" = PS470
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{755EC5E3-FD51-46bd-A57F-7A2D56FBF061}" = PSTAPlugin
"{769A295C-DCF4-41d6-AFBA-7D9394B23AFE}" = PSPrinters08
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{85309D89-7BE9-4094-BB17-24999C6118FC}" = ArcSoft PhotoStudio 5.5
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8BBF6DFD-0AD9-43A7-9FBD-BF065E3866AF}" = URGE
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{94FB906A-CF42-4128-A509-D353026A607E}" = REALTEK Gigabit and Fast Ethernet NIC Driver
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9EB1504E-FD95-4BCD-8E93-B4039F59C469}" = Sony Ericsson Media Manager 1.2
"{A040AC77-C1AA-4CC9-8931-9F648AF178F6}" = VC 9.0 Runtime
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A3455242-DAE0-4523-8242-FD82706ABF4B}" = CameraDrivers
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-A70500000002}" = Adobe Reader 7.0.5
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B824B5C9-849F-4b9e-9EA7-6FD8CD8116DA}" = CP_Package_Variety2
"{B996AE66-10DB-4ac5-B151-E8B4BFBC42FC}" = BufferChm
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C169D3BB-9A27-43F5-9979-09A0D65FE95C}" = SmartFTP Client 2.0
"{C1E693A4-B1D5-4DCD-B68D-2087835B7184}" = ScanSoft OmniPage SE 4.0
"{CAAB0192-5704-469F-A0BE-2D842D70E93B}_is1" = Sothink FLV Player
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2D6B9EB-C6DC-4DAA-B4DE-BB7D9735E7DA}" = Presto! PageManager 7.15.14
"{DE076BC1-42A1-4C8C-BFCD-C1BC48531762}" = Anonymizer 2005
"{E1F4FB82-3EA6-46B6-A18A-9B3A62DA393E}" = hp deskjet 6122
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E3F90083-80D4-4b5a-87C7-E97E12F5516D}" = HPProductAssistant
"{E934E2A2-BE3B-4C1A-A3D9-753FFB2B38B4}" = WD Drive Manager (x86)
"{EA103B64-C0E4-4C0E-A506-751590E1653D}" = SolutionCenter
"{ECDBCAF5-BC83-4E03-86EB-552E7D53A94F}_is1" = AML Power Video Converter 1.2
"{F4C2E5F5-2970-45f4-ABD3-C180C4D961C4}" = Status
"{F86B6D9F-FA9A-4164-A66A-EAFF7C067272}_is1" = Sothink Video Encoder for Adobe Flash
"{F87BD397-DE42-4679-A91B-30E9E531711B}" = Eudora
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FE64AE29-0883-4C70-8388-DC026019C900}" = HP Image Zone Express
"7-Zip" = 7-Zip 4.57
"AC3Filter" = AC3Filter (remove only)
"ACDSee Trial Version" = ACDSee Trial Version
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Any Video Converter_is1" = Any Video Converter 3.0.5
"avast" = avast! Free Antivirus
"BearShare" = BearShare
"BearShare Acceleration Patch_is1" = BearShare Acceleration Patch 4.5
"Canon CanoScan LiDE 600F User Registration" = Canon CanoScan LiDE 600F User Registration
"CanoScan Toolbox 5.0" = Canon CanoScan Toolbox 5.0
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200014F1" = SoftV92 Data Fax Modem with SmartCP
"CodInstl" = Intel A/V Codecs V2.0
"Corel Applications" = Corel Applications
"Coupon Printer for Windows4.0" = Coupon Printer for Windows
"Desktop Weather by The Weather Channel" = Desktop Weather by The Weather Channel
"DivX Pro Codec Adware" = DivX Pro Codec Adware
"ERUNT_is1" = ERUNT 1.1j
"Eusing Free Registry Cleaner" = Eusing Free Registry Cleaner
"FastStone Image Viewer" = FastStone Image Viewer 2.8
"ffdshow_is1" = ffdshow [rev 1723] [2007-12-24]
"FLV Player" = FLV Player 2.0 (build 25)
"hp deskjet 6122 series_Driver" = hp deskjet 6122 series
"HP Imaging Device Functions" = HP Imaging Device Functions 5.3
"hp print screen utility" = hp print screen utility
"HP Solution Center & Imaging Support Tools" = HP Solution Center & Imaging Support Tools 5.3
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"IrfanView" = IrfanView (remove only)
"MailWasher_is1" = MailWasher
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MasterSplitter" = MasterSplitter Program
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft SQL Server 7.0" = Microsoft SQL Server 7.0
"Move Networks Player_is1" = Move Networks Player for Internet Explorer
"Mozilla Firefox (3.0.10)" = Mozilla Firefox (3.0.10)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MySQL Servers and Clients 4.0.20d" = MySQL Servers and Clients 4.0.20d
"MySQL-Front_is1" = MySQL-Front 3.1
"Netscape (7.1)" = Netscape (7.1)
"NetTracker 7.5 Lite" = NetTracker 7.5 Lite
"NewsBin5" = NewsBin Pro
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Numerology Calculator_is1" = Numerology Calculator
"oggcodecs" = oggcodecs 0.71.0946
"Opera" = Opera
"Panda ActiveScan" = Panda ActiveScan
"PartyPoker" = PartyPoker
"Poker Superstars Deluxe" = Poker Superstars Deluxe (remove only)
"PokerStars.net" = PokerStars.net
"QuickPar" = QuickPar 0.9
"RealPlayer 6.0" = RealPlayer
"Rhythm & Bio" = Rhythm & Bio
"Riva FLV Encoder 2.0_is1" = Riva FLV Encoder 2.0
"SmartFTP Client 2.0 Setup Files" = SmartFTP Client 2.0 Setup Files (remove only)
"SUPER ©" = SUPER © Version 2009.bld.36 (June 10, 2009)
"TopStyle Lite (Version 2)" = TopStyle Lite (Version 2)
"Uninstall Macromedia ColdFusion MX 7" = Macromedia ColdFusion MX 7
"VIA/S3G UniChrome Family Win2K/XP Display" = VIA/S3G Display Driver
"ViewpointMediaPlayer" = Viewpoint Media Player (Remove Only)
"VLC media player" = VLC media player 1.0.5
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"WebSTAR DPC2100 Uninstall" = Scientific-Atlanta WebSTAR 2000 series Cable Modem
"WIC" = Windows Imaging Component
"Winamp" = Winamp (Remove Only)
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WinZip" = WinZip
"WMA To MP3 Converter" = WMA To MP3 Converter
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Xenu_is1" = Xenu's Link Sleuth
"ZoneAlarm" = ZoneAlarm

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"ColdFusion Studio 4.5" = ColdFusion Studio 4.5
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer

========== Last 10 Event Log Errors ==========

[ Antivirus Events ]
Error - 4/7/2008 12:21:16 AM | Computer Name = BUD | Source = avast! | ID = 33554522
Description =

Error - 4/7/2008 5:44:41 AM | Computer Name = BUD | Source = avast! | ID = 33554522
Description =

Error - 4/7/2008 6:40:39 AM | Computer Name = BUD | Source = avast! | ID = 33554522
Description =

Error - 7/8/2008 8:01:50 PM | Computer Name = BUD | Source = avast! | ID = 33554522
Description =

Error - 7/11/2008 10:06:48 PM | Computer Name = BUD | Source = avast! | ID = 33554522
Description =

Error - 7/12/2008 9:30:07 PM | Computer Name = BUD | Source = avast! | ID = 33554522
Description =

Error - 7/15/2008 7:46:57 AM | Computer Name = BUD | Source = avast! | ID = 33554522
Description =

Error - 7/15/2008 8:35:25 PM | Computer Name = BUD | Source = avast! | ID = 33554522
Description =

Error - 8/3/2008 11:10:44 PM | Computer Name = BUD | Source = avast! | ID = 33554522
Description =

Error - 8/13/2008 10:42:20 PM | Computer Name = BUD | Source = avast! | ID = 33554522
Description =

[ Application Events ]
Error - 7/1/2011 5:59:47 PM | Computer Name = BUD | Source = Application Error | ID = 1000
Description = Faulting application dllhost.exe, version 5.1.2600.5512, faulting
module ntdll.dll, version 5.1.2600.6055, fault address 0x00019af2.

Error - 7/2/2011 8:03:39 AM | Computer Name = BUD | Source = Application Error | ID = 1000
Description = Faulting application dllhost.exe, version 5.1.2600.5512, faulting
module ntdll.dll, version 5.1.2600.6055, fault address 0x00019af2.

Error - 7/2/2011 11:51:47 AM | Computer Name = BUD | Source = Application Error | ID = 1000
Description = Faulting application dllhost.exe, version 5.1.2600.5512, faulting
module ntdll.dll, version 5.1.2600.6055, fault address 0x00019af2.

Error - 7/2/2011 11:55:42 AM | Computer Name = BUD | Source = Application Error | ID = 1000
Description = Faulting application dllhost.exe, version 5.1.2600.5512, faulting
module msvcrt.dll, version 7.0.2600.5512, fault address 0x00037fd4.

Error - 7/3/2011 8:29:07 AM | Computer Name = BUD | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 8024402c, P2 endsearch, P3 search, P4 1.1.1593.0,
P5 mpsigdwn.dll, P6 1.1.1593.0, P7 windows defender, P8 NIL, P9 NIL, P10 NIL.

Error - 7/3/2011 9:38:45 AM | Computer Name = BUD | Source = Application Error | ID = 1000
Description = Faulting application dllhost.exe, version 5.1.2600.5512, faulting
module ntdll.dll, version 5.1.2600.6055, fault address 0x00019af2.

Error - 7/5/2011 4:37:39 PM | Computer Name = BUD | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 8024402c, P2 endsearch, P3 search, P4 1.1.1593.0,
P5 mpsigdwn.dll, P6 1.1.1593.0, P7 windows defender, P8 NIL, P9 NIL, P10 NIL.

Error - 7/7/2011 6:07:55 PM | Computer Name = BUD | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 8024402c, P2 endsearch, P3 search, P4 1.1.1593.0,
P5 mpsigdwn.dll, P6 1.1.1593.0, P7 windows defender, P8 NIL, P9 NIL, P10 NIL.

Error - 7/10/2011 8:49:06 PM | Computer Name = BUD | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 8024402c, P2 endsearch, P3 search, P4 1.1.1593.0,
P5 mpsigdwn.dll, P6 1.1.1593.0, P7 windows defender, P8 NIL, P9 NIL, P10 NIL.

Error - 7/11/2011 12:40:13 AM | Computer Name = BUD | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 8024402c, P2 endsearch, P3 search, P4 1.1.1593.0,
P5 mpsigdwn.dll, P6 1.1.1593.0, P7 windows defender, P8 NIL, P9 NIL, P10 NIL.

[ System Events ]
Error - 7/11/2011 4:27:33 AM | Computer Name = BUD | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service upnphost with
arguments "" in order to run the server: {204810B9-73B2-11D4-BF42-00B0D0118B56}

Error - 7/11/2011 5:36:47 AM | Computer Name = BUD | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service IISADMIN with
arguments "" in order to run the server: {A9E69610-B80D-11D0-B9B9-00A0C922E750}

Error - 7/11/2011 5:37:11 AM | Computer Name = BUD | Source = Service Control Manager | ID = 7001
Description = The World Wide Web Publishing service depends on the IIS Admin service
which failed to start because of the following error: %%1058

Error - 7/11/2011 5:46:28 AM | Computer Name = BUD | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service IISADMIN with
arguments "" in order to run the server: {A9E69610-B80D-11D0-B9B9-00A0C922E750}

Error - 7/11/2011 5:46:35 AM | Computer Name = BUD | Source = Service Control Manager | ID = 7001
Description = The World Wide Web Publishing service depends on the IIS Admin service
which failed to start because of the following error: %%1058

Error - 7/11/2011 5:52:44 AM | Computer Name = BUD | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service IISADMIN with
arguments "" in order to run the server: {A9E69610-B80D-11D0-B9B9-00A0C922E750}

Error - 7/11/2011 5:53:08 AM | Computer Name = BUD | Source = Service Control Manager | ID = 7001
Description = The World Wide Web Publishing service depends on the IIS Admin service
which failed to start because of the following error: %%1058

Error - 7/11/2011 7:38:36 AM | Computer Name = BUD | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service IISADMIN with
arguments "" in order to run the server: {A9E69610-B80D-11D0-B9B9-00A0C922E750}

Error - 7/11/2011 7:38:51 AM | Computer Name = BUD | Source = Service Control Manager | ID = 7001
Description = The World Wide Web Publishing service depends on the IIS Admin service
which failed to start because of the following error: %%1058

Error - 7/11/2011 7:52:04 AM | Computer Name = BUD | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service IISADMIN with
arguments "" in order to run the server: {A9E69610-B80D-11D0-B9B9-00A0C922E750}


< End of report >

    Advertisements

Register to Remove


#2 Tomk

Tomk

    Beguilement Monitor

  • Global Moderator
  • 20,451 posts

Posted 13 July 2011 - 02:15 PM

Hi ike001,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

Double click on OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
  • Do Not copy the word CODE
  • please note the fix starts with the :
:Processes

:OTL
FF - prefs.js..browser.search.defaultenginename: "Secure Search"
FF - prefs.js..browser.search.selectedEngine: "Secure Search"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
2010/04/15 18:43:04 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/08 00:29:18 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/11/09 04:40:41 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/01/12 19:02:23 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/03/08 00:36:01 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
O4 - HKLM..\Run: [ACD mPower Tools] File not found
O4 - HKCU..\Run: [JUaDAjhRvP] File not found
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra Button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - Reg Error: Value error. File not found
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
[2007/09/21 17:39:39 | 000,000,000 | ---- | M] () -- C:\t100
[2007/09/21 17:39:51 | 000,000,000 | ---- | M] () -- C:\t100.1
[2007/12/19 14:43:21 | 000,000,000 | ---- | M] () -- C:\t10g
[2007/12/19 14:43:35 | 000,000,000 | ---- | M] () -- C:\t10g.1
[2008/07/10 15:40:46 | 000,000,000 | ---- | M] () -- C:\t10o
[2008/07/10 15:40:59 | 000,000,000 | ---- | M] () -- C:\t10o.1
[2008/10/17 04:53:18 | 000,000,000 | ---- | M] () -- C:\t110
[2008/10/17 04:53:27 | 000,000,000 | ---- | M] () -- C:\t110.1
[2008/04/28 11:38:06 | 000,000,000 | ---- | M] () -- C:\t114
[2008/04/28 11:38:14 | 000,000,000 | ---- | M] () -- C:\t114.1
[2007/12/20 11:12:37 | 000,000,000 | ---- | M] () -- C:\t120
[2007/12/20 11:12:51 | 000,000,000 | ---- | M] () -- C:\t120.1
[2008/09/06 02:06:34 | 000,000,000 | ---- | M] () -- C:\t120.2
[2008/09/06 02:06:45 | 000,000,000 | ---- | M] () -- C:\t120.3
[2007/12/10 06:56:31 | 000,000,000 | ---- | M] () -- C:\t124
[2007/12/10 06:56:43 | 000,000,000 | ---- | M] () -- C:\t124.1
[2007/12/14 08:13:14 | 000,000,000 | ---- | M] () -- C:\t124.2
[2007/12/14 08:13:29 | 000,000,000 | ---- | M] () -- C:\t124.3
[2007/12/11 04:02:09 | 000,000,000 | ---- | M] () -- C:\t128
[2007/12/11 04:02:23 | 000,000,000 | ---- | M] () -- C:\t128.1
[2008/03/09 05:09:52 | 000,000,000 | ---- | M] () -- C:\t12g
[2008/03/10 12:48:04 | 000,000,000 | ---- | M] () -- C:\t12g.2
[2008/03/10 12:48:11 | 000,000,000 | ---- | M] () -- C:\t12g.3
[2007/12/24 05:00:33 | 000,000,000 | ---- | M] () -- C:\t12k
[2007/12/24 05:00:47 | 000,000,000 | ---- | M] () -- C:\t12k.1
[2008/05/10 17:57:48 | 000,000,000 | ---- | M] () -- C:\t138
[2008/05/10 17:57:52 | 000,000,000 | ---- | M] () -- C:\t138.1
[2008/09/11 07:32:46 | 000,000,000 | ---- | M] () -- C:\t14g
[2008/09/11 07:33:02 | 000,000,000 | ---- | M] () -- C:\t14g.1
[2007/07/05 20:41:11 | 000,000,000 | ---- | M] () -- C:\t15s
[2008/09/02 06:57:46 | 000,000,000 | ---- | M] () -- C:\t16k
[2008/09/02 06:57:56 | 000,000,000 | ---- | M] () -- C:\t16k.1
[2008/07/12 20:19:39 | 000,000,000 | ---- | M] () -- C:\t17k
[2008/07/12 20:19:49 | 000,000,000 | ---- | M] () -- C:\t17k.1
[2008/06/11 10:26:04 | 000,000,000 | ---- | M] () -- C:\t198
[2008/06/11 10:26:11 | 000,000,000 | ---- | M] () -- C:\t198.1
[2008/06/11 11:04:07 | 000,000,000 | ---- | M] () -- C:\t1b8
[2008/06/11 11:04:10 | 000,000,000 | ---- | M] () -- C:\t1b8.1
[2008/05/16 00:23:08 | 000,000,000 | ---- | M] () -- C:\t1ck
[2008/05/16 00:23:14 | 000,000,000 | ---- | M] () -- C:\t1ck.1
[2007/07/23 13:52:23 | 000,000,000 | ---- | M] () -- C:\t1f8
[2007/07/23 13:52:34 | 000,000,000 | ---- | M] () -- C:\t1f8.1
[2007/07/16 13:19:03 | 000,000,000 | ---- | M] () -- C:\t1fg
[2007/07/16 13:19:13 | 000,000,000 | ---- | M] () -- C:\t1fg.1
[2007/07/18 03:07:17 | 000,000,000 | ---- | M] () -- C:\t1fk
[2007/07/18 03:07:27 | 000,000,000 | ---- | M] () -- C:\t1fk.1
[2007/07/19 22:46:03 | 000,000,000 | ---- | M] () -- C:\t1g4
[2007/07/19 22:46:13 | 000,000,000 | ---- | M] () -- C:\t1g4.1
[2007/07/24 11:05:36 | 000,000,000 | ---- | M] () -- C:\t1gc
[2007/07/24 11:05:46 | 000,000,000 | ---- | M] () -- C:\t1gc.1
[2007/07/22 01:25:39 | 000,000,000 | ---- | M] () -- C:\t1gg
[2007/07/22 01:25:50 | 000,000,000 | ---- | M] () -- C:\t1gg.1
[2007/07/15 04:04:25 | 000,000,000 | ---- | M] () -- C:\t1gk
[2007/07/15 04:04:35 | 000,000,000 | ---- | M] () -- C:\t1gk.1
[2008/09/22 17:48:12 | 000,000,000 | ---- | M] () -- C:\t1h4
[2008/09/22 17:48:20 | 000,000,000 | ---- | M] () -- C:\t1h4.1
[2007/07/16 08:58:56 | 000,000,000 | ---- | M] () -- C:\t1h8
[2007/07/16 08:59:06 | 000,000,000 | ---- | M] () -- C:\t1h8.1
[2007/07/21 11:16:28 | 000,000,000 | ---- | M] () -- C:\t1jo
[2007/07/21 11:16:37 | 000,000,000 | ---- | M] () -- C:\t1jo.1
[2007/10/11 22:50:04 | 000,000,000 | ---- | M] () -- C:\t1m4
[2007/10/11 22:50:17 | 000,000,000 | ---- | M] () -- C:\t1m4.1
[2008/10/09 19:58:08 | 000,000,000 | ---- | M] () -- C:\t1ng
[2008/10/09 19:58:18 | 000,000,000 | ---- | M] () -- C:\t1ng.1
[2008/10/12 02:13:15 | 000,000,000 | ---- | M] () -- C:\t1ng.2
[2008/10/12 02:13:21 | 000,000,000 | ---- | M] () -- C:\t1ng.3
[2008/08/15 15:39:30 | 000,000,000 | ---- | M] () -- C:\t1nk
[2008/08/15 15:39:50 | 000,000,000 | ---- | M] () -- C:\t1nk.1
[2008/08/21 02:52:38 | 000,000,000 | ---- | M] () -- C:\t1nk.2
[2008/08/21 02:52:49 | 000,000,000 | ---- | M] () -- C:\t1nk.3
[2008/10/06 01:38:55 | 000,000,000 | ---- | M] () -- C:\t1nk.4
[2008/10/06 01:38:58 | 000,000,000 | ---- | M] () -- C:\t1nk.5
[2008/10/13 03:10:57 | 000,000,000 | ---- | M] () -- C:\t1nk.6
[2008/10/13 03:11:06 | 000,000,000 | ---- | M] () -- C:\t1nk.7
[2008/08/03 15:08:23 | 000,000,000 | ---- | M] () -- C:\t1no
[2008/08/03 15:08:37 | 000,000,000 | ---- | M] () -- C:\t1no.1
[2008/08/08 11:47:49 | 000,000,000 | ---- | M] () -- C:\t1no.2
[2008/08/08 11:48:00 | 000,000,000 | ---- | M] () -- C:\t1no.3
[2008/08/22 23:23:16 | 000,000,000 | ---- | M] () -- C:\t1no.4
[2008/08/22 23:23:28 | 000,000,000 | ---- | M] () -- C:\t1no.5
[2008/08/04 14:45:58 | 000,000,000 | ---- | M] () -- C:\t1ns
[2008/08/04 14:46:25 | 000,000,000 | ---- | M] () -- C:\t1ns.1
[2008/08/26 00:17:29 | 000,000,000 | ---- | M] () -- C:\t1ns.2
[2008/08/26 00:17:42 | 000,000,000 | ---- | M] () -- C:\t1ns.3
[2008/09/25 16:47:47 | 000,000,000 | ---- | M] () -- C:\t1ns.4
[2008/09/25 16:47:55 | 000,000,000 | ---- | M] () -- C:\t1ns.5
[2008/10/11 23:27:30 | 000,000,000 | ---- | M] () -- C:\t1ns.6
[2008/10/11 23:27:37 | 000,000,000 | ---- | M] () -- C:\t1ns.7
[2008/08/06 13:40:48 | 000,000,000 | ---- | M] () -- C:\t1o0
[2008/08/12 15:38:28 | 000,000,000 | ---- | M] () -- C:\t1o0.2
[2008/08/12 15:38:37 | 000,000,000 | ---- | M] () -- C:\t1o0.3
[2008/08/13 18:18:23 | 000,000,000 | ---- | M] () -- C:\t1o4
[2008/08/13 18:18:36 | 000,000,000 | ---- | M] () -- C:\t1o4.1
[2008/08/07 17:37:57 | 000,000,000 | ---- | M] () -- C:\t1o8
[2008/09/26 18:52:16 | 000,000,000 | ---- | M] () -- C:\t1o8.2
[2008/09/26 18:52:31 | 000,000,000 | ---- | M] () -- C:\t1o8.3
[2008/08/30 02:32:13 | 000,000,000 | ---- | M] () -- C:\t1oc
[2008/08/30 02:32:26 | 000,000,000 | ---- | M] () -- C:\t1oc.1
[2007/07/19 07:17:39 | 000,000,000 | ---- | M] () -- C:\t1ok
[2007/07/19 07:17:49 | 000,000,000 | ---- | M] () -- C:\t1ok.1
[2008/09/23 17:32:49 | 000,000,000 | ---- | M] () -- C:\t1ok.2
[2008/09/23 17:32:56 | 000,000,000 | ---- | M] () -- C:\t1ok.3
[2008/09/14 09:40:12 | 000,000,000 | ---- | M] () -- C:\t1os
[2008/09/14 09:40:21 | 000,000,000 | ---- | M] () -- C:\t1os.1
[2008/08/04 17:37:43 | 000,000,000 | ---- | M] () -- C:\t1p0
[2008/08/04 17:37:57 | 000,000,000 | ---- | M] () -- C:\t1p0.1
[2008/09/24 20:05:09 | 000,000,000 | ---- | M] () -- C:\t1p0.2
[2008/09/24 20:05:15 | 000,000,000 | ---- | M] () -- C:\t1p0.3
[2008/07/12 00:35:42 | 000,000,000 | ---- | M] () -- C:\t1p8
[2008/07/12 00:35:49 | 000,000,000 | ---- | M] () -- C:\t1p8.1
[2008/07/23 23:44:34 | 000,000,000 | ---- | M] () -- C:\t1p8.2
[2008/07/23 23:44:47 | 000,000,000 | ---- | M] () -- C:\t1p8.3
[2008/07/25 00:39:12 | 000,000,000 | ---- | M] () -- C:\t1p8.4
[2008/07/25 00:39:23 | 000,000,000 | ---- | M] () -- C:\t1p8.5
[2008/07/27 02:01:36 | 000,000,000 | ---- | M] () -- C:\t1p8.6
[2008/07/27 02:01:45 | 000,000,000 | ---- | M] () -- C:\t1p8.7
[2008/07/19 05:32:21 | 000,000,000 | ---- | M] () -- C:\t1pc
[2008/07/19 05:32:27 | 000,000,000 | ---- | M] () -- C:\t1pc.1
[2008/08/01 02:56:36 | 000,000,000 | ---- | M] () -- C:\t1pg
[2008/08/01 02:57:04 | 000,000,000 | ---- | M] () -- C:\t1pg.1
[2008/07/22 10:42:34 | 000,000,000 | ---- | M] () -- C:\t1pk
[2008/07/22 10:42:47 | 000,000,000 | ---- | M] () -- C:\t1pk.1
[2008/09/07 21:30:00 | 000,000,000 | ---- | M] () -- C:\t1pk.2
[2008/09/07 21:30:10 | 000,000,000 | ---- | M] () -- C:\t1pk.3
[2008/09/27 19:44:01 | 000,000,000 | ---- | M] () -- C:\t1pk.4
[2008/09/27 19:44:07 | 000,000,000 | ---- | M] () -- C:\t1pk.5
[2008/10/03 21:14:31 | 000,000,000 | ---- | M] () -- C:\t1pk.6
[2008/10/03 21:14:37 | 000,000,000 | ---- | M] () -- C:\t1pk.7
[2008/07/31 03:36:37 | 000,000,000 | ---- | M] () -- C:\t1po
[2008/07/31 03:36:48 | 000,000,000 | ---- | M] () -- C:\t1po.1
[2008/09/01 01:57:26 | 000,000,000 | ---- | M] () -- C:\t1po.2
[2008/09/01 01:57:32 | 000,000,000 | ---- | M] () -- C:\t1po.3
[2008/09/05 02:37:01 | 000,000,000 | ---- | M] () -- C:\t1po.4
[2008/09/05 02:37:12 | 000,000,000 | ---- | M] () -- C:\t1po.5
[2008/10/15 21:23:53 | 000,000,000 | ---- | M] () -- C:\t1po.6
[2008/10/15 21:24:00 | 000,000,000 | ---- | M] () -- C:\t1po.7
[2008/09/19 17:51:09 | 000,000,000 | ---- | M] () -- C:\t1ps
[2008/09/19 17:51:16 | 000,000,000 | ---- | M] () -- C:\t1ps.1
[2008/09/17 14:18:24 | 000,000,000 | ---- | M] () -- C:\t1q0
[2008/09/17 14:18:34 | 000,000,000 | ---- | M] () -- C:\t1q0.1
[2008/09/30 19:42:11 | 000,000,000 | ---- | M] () -- C:\t1q4
[2008/09/30 19:42:17 | 000,000,000 | ---- | M] () -- C:\t1q4.1
[2008/10/01 19:41:12 | 000,000,000 | ---- | M] () -- C:\t1q4.2
[2008/10/01 19:41:18 | 000,000,000 | ---- | M] () -- C:\t1q4.3
[2008/09/03 11:38:47 | 000,000,000 | ---- | M] () -- C:\t1qk
[2008/09/03 11:38:57 | 000,000,000 | ---- | M] () -- C:\t1qk.1
[2008/07/30 11:40:47 | 000,000,000 | ---- | M] () -- C:\t1qo
[2008/07/30 11:40:53 | 000,000,000 | ---- | M] () -- C:\t1qo.1
[2008/10/04 21:06:31 | 000,000,000 | ---- | M] () -- C:\t1qo.2
[2008/10/04 21:06:53 | 000,000,000 | ---- | M] () -- C:\t1qo.3
[2008/10/07 21:29:20 | 000,000,000 | ---- | M] () -- C:\t1qo.4
[2008/10/07 21:29:27 | 000,000,000 | ---- | M] () -- C:\t1qo.5
[2008/10/09 00:16:17 | 000,000,000 | ---- | M] () -- C:\t1qo.6
[2008/10/09 00:16:24 | 000,000,000 | ---- | M] () -- C:\t1qo.7
[2008/06/21 16:17:07 | 000,000,000 | ---- | M] () -- C:\t1r0
[2008/06/21 16:17:15 | 000,000,000 | ---- | M] () -- C:\t1r0.1
[2008/07/17 19:45:15 | 000,000,000 | ---- | M] () -- C:\t1r0.2
[2008/07/17 19:45:22 | 000,000,000 | ---- | M] () -- C:\t1r0.3
[2008/07/30 06:35:16 | 000,000,000 | ---- | M] () -- C:\t1r0.4
[2008/07/30 06:35:22 | 000,000,000 | ---- | M] () -- C:\t1r0.5
[2008/09/07 11:55:20 | 000,000,000 | ---- | M] () -- C:\t1r0.6
[2008/09/07 11:55:30 | 000,000,000 | ---- | M] () -- C:\t1r0.7
[2008/10/19 02:09:36 | 000,000,000 | ---- | M] () -- C:\t1r4
[2008/10/19 02:09:42 | 000,000,000 | ---- | M] () -- C:\t1r4.1
[2008/07/16 14:27:38 | 000,000,000 | ---- | M] () -- C:\t1r8
[2008/07/16 14:27:45 | 000,000,000 | ---- | M] () -- C:\t1r8.1
[2008/07/20 23:04:49 | 000,000,000 | ---- | M] () -- C:\t1r8.2
[2008/07/26 03:07:31 | 000,000,000 | ---- | M] () -- C:\t1r8.4
[2008/07/26 03:07:38 | 000,000,000 | ---- | M] () -- C:\t1r8.5
[2008/04/29 12:21:16 | 000,000,000 | ---- | M] () -- C:\t1ro
[2008/04/29 12:21:24 | 000,000,000 | ---- | M] () -- C:\t1ro.1
[2008/07/03 21:51:07 | 000,000,000 | ---- | M] () -- C:\t1ro.2
[2008/07/03 21:51:14 | 000,000,000 | ---- | M] () -- C:\t1ro.3
[2008/07/10 23:23:30 | 000,000,000 | ---- | M] () -- C:\t1ro.4
[2008/07/10 23:23:37 | 000,000,000 | ---- | M] () -- C:\t1ro.5
[2006/04/18 20:07:33 | 000,000,000 | ---- | M] () -- C:\t1rs
[2006/06/05 00:18:41 | 000,000,000 | ---- | M] () -- C:\t1s0
[2006/06/05 00:18:44 | 000,000,000 | ---- | M] () -- C:\t1s0.1
[2008/04/22 13:52:13 | 000,000,000 | ---- | M] () -- C:\t1s0.2
[2008/04/22 13:52:24 | 000,000,000 | ---- | M] () -- C:\t1s0.3
[2008/04/24 00:06:04 | 000,000,000 | ---- | M] () -- C:\t1s0.4
[2008/04/24 00:06:12 | 000,000,000 | ---- | M] () -- C:\t1s0.5
[2008/05/01 21:37:47 | 000,000,000 | ---- | M] () -- C:\t1s0.6
[2008/05/01 21:37:56 | 000,000,000 | ---- | M] () -- C:\t1s0.7
[2008/04/30 22:13:35 | 000,000,000 | ---- | M] () -- C:\t1s4
[2008/04/30 22:13:53 | 000,000,000 | ---- | M] () -- C:\t1s4.1
[2008/04/21 18:07:41 | 000,000,000 | ---- | M] () -- C:\t1s8
[2008/04/21 18:07:51 | 000,000,000 | ---- | M] () -- C:\t1s8.1
[2008/04/25 01:13:54 | 000,000,000 | ---- | M] () -- C:\t1s8.2
[2008/04/25 01:14:04 | 000,000,000 | ---- | M] () -- C:\t1s8.3
[2008/04/30 14:06:49 | 000,000,000 | ---- | M] () -- C:\t1s8.4
[2008/04/30 14:07:02 | 000,000,000 | ---- | M] () -- C:\t1s8.5
[2008/05/02 15:20:06 | 000,000,000 | ---- | M] () -- C:\t1s8.6
[2008/05/02 15:20:14 | 000,000,000 | ---- | M] () -- C:\t1s8.7
[2008/06/09 21:36:34 | 000,000,000 | ---- | M] () -- C:\t1s8.8
[2008/06/09 21:36:42 | 000,000,000 | ---- | M] () -- C:\t1s8.9
[2008/07/02 13:11:01 | 000,000,000 | ---- | M] () -- C:\t1s8.a
[2008/07/02 13:11:07 | 000,000,000 | ---- | M] () -- C:\t1s8.b
[2008/04/26 14:30:10 | 000,000,000 | ---- | M] () -- C:\t1sc
[2008/04/26 14:30:18 | 000,000,000 | ---- | M] () -- C:\t1sc.1
[2008/05/04 16:16:44 | 000,000,000 | ---- | M] () -- C:\t1sc.2
[2008/05/04 16:16:52 | 000,000,000 | ---- | M] () -- C:\t1sc.3
[2008/05/05 16:29:37 | 000,000,000 | ---- | M] () -- C:\t1sc.4
[2008/05/05 16:29:45 | 000,000,000 | ---- | M] () -- C:\t1sc.5
[2008/05/08 18:34:35 | 000,000,000 | ---- | M] () -- C:\t1sc.6
[2008/05/08 18:34:43 | 000,000,000 | ---- | M] () -- C:\t1sc.7
[2008/05/16 23:09:29 | 000,000,000 | ---- | M] () -- C:\t1sc.8
[2008/05/16 23:09:42 | 000,000,000 | ---- | M] () -- C:\t1sc.9
[2008/05/03 18:42:59 | 000,000,000 | ---- | M] () -- C:\t1sg
[2008/05/03 18:43:08 | 000,000,000 | ---- | M] () -- C:\t1sg.1
[2008/07/09 03:12:21 | 000,000,000 | ---- | M] () -- C:\t1sg.2
[2008/07/09 03:12:27 | 000,000,000 | ---- | M] () -- C:\t1sg.3
[2006/06/04 16:26:56 | 000,000,000 | ---- | M] () -- C:\t1sk
[2006/06/04 16:26:59 | 000,000,000 | ---- | M] () -- C:\t1sk.1
[2008/05/25 22:31:42 | 000,000,000 | ---- | M] () -- C:\t1sk.2
[2008/05/25 22:31:50 | 000,000,000 | ---- | M] () -- C:\t1sk.3
[2008/05/27 13:33:51 | 000,000,000 | ---- | M] () -- C:\t1ss
[2008/05/27 13:33:59 | 000,000,000 | ---- | M] () -- C:\t1ss.1
[2008/07/09 01:23:20 | 000,000,000 | ---- | M] () -- C:\t1ss.2
[2008/07/09 01:23:30 | 000,000,000 | ---- | M] () -- C:\t1ss.3
[2006/09/16 10:01:28 | 000,000,000 | ---- | M] () -- C:\t1t4
[2006/09/16 10:01:32 | 000,000,000 | ---- | M] () -- C:\t1t4.1
[2008/05/12 06:51:30 | 000,000,000 | ---- | M] () -- C:\t1t8
[2008/05/12 06:51:38 | 000,000,000 | ---- | M] () -- C:\t1t8.1
[2008/07/01 17:41:18 | 000,000,000 | ---- | M] () -- C:\t1t8.2
[2008/07/01 17:41:26 | 000,000,000 | ---- | M] () -- C:\t1t8.3
[2008/06/09 02:58:23 | 000,000,000 | ---- | M] () -- C:\t1to
[2008/06/09 02:58:31 | 000,000,000 | ---- | M] () -- C:\t1to.1
[2008/07/08 20:26:17 | 000,000,000 | ---- | M] () -- C:\t1ts
[2008/07/08 20:26:25 | 000,000,000 | ---- | M] () -- C:\t1ts.1
[2008/05/07 15:32:13 | 000,000,000 | ---- | M] () -- C:\t1u0
[2008/05/07 15:32:21 | 000,000,000 | ---- | M] () -- C:\t1u0.1
[2008/06/03 18:27:12 | 000,000,000 | ---- | M] () -- C:\t1u8
[2008/06/03 18:27:19 | 000,000,000 | ---- | M] () -- C:\t1u8.1
[2009/05/24 22:15:19 | 000,000,000 | ---- | M] () -- C:\t1uc
[2009/05/24 22:15:25 | 000,000,000 | ---- | M] () -- C:\t1uc.1
[2008/08/24 20:15:45 | 000,000,000 | ---- | M] () -- C:\t1v8
[2008/08/24 20:16:13 | 000,000,000 | ---- | M] () -- C:\t1v8.1
[2008/10/14 06:37:36 | 000,000,000 | ---- | M] () -- C:\t1v8.2
[2008/10/14 06:37:44 | 000,000,000 | ---- | M] () -- C:\t1v8.3
[2008/09/10 01:21:25 | 000,000,000 | ---- | M] () -- C:\t1vk
[2008/09/10 01:21:35 | 000,000,000 | ---- | M] () -- C:\t1vk.1
[2008/10/10 22:25:11 | 000,000,000 | ---- | M] () -- C:\t1vo
[2008/10/10 22:25:25 | 000,000,000 | ---- | M] () -- C:\t1vo.1
[2008/10/18 02:57:41 | 000,000,000 | ---- | M] () -- C:\t20c
[2008/10/18 02:57:49 | 000,000,000 | ---- | M] () -- C:\t20c.1
[2008/07/13 02:39:23 | 000,000,000 | ---- | M] () -- C:\t21g
[2008/07/13 02:39:30 | 000,000,000 | ---- | M] () -- C:\t21g.1
[2008/05/22 02:46:43 | 000,000,000 | ---- | M] () -- C:\t22k
[2008/05/22 02:46:45 | 000,000,000 | ---- | M] () -- C:\t22k.1
[2008/09/17 17:02:17 | 000,000,000 | ---- | M] () -- C:\t258
[2008/09/17 17:02:30 | 000,000,000 | ---- | M] () -- C:\t258.1
[2008/06/30 14:15:01 | 000,000,000 | ---- | M] () -- C:\t2s4
[2008/06/30 14:15:18 | 000,000,000 | ---- | M] () -- C:\t2s4.1
[2007/05/21 19:21:44 | 000,000,000 | ---- | M] () -- C:\t3k
[2007/05/21 19:21:52 | 000,000,000 | ---- | M] () -- C:\t3k.1
[2007/07/27 21:50:42 | 000,000,000 | ---- | M] () -- C:\t3k.2
[2007/07/27 21:50:51 | 000,000,000 | ---- | M] () -- C:\t3k.3
[2008/08/27 03:58:34 | 000,000,000 | ---- | M] () -- C:\t3k.4
[2008/08/27 03:58:46 | 000,000,000 | ---- | M] () -- C:\t3k.5
[2008/01/21 16:03:46 | 000,000,000 | ---- | M] () -- C:\t3s
[2008/01/21 16:03:53 | 000,000,000 | ---- | M] () -- C:\t3s.1
[2007/05/20 23:04:40 | 000,000,000 | ---- | M] () -- C:\t54
[2007/05/20 23:04:48 | 000,000,000 | ---- | M] () -- C:\t54.1
[2008/03/28 13:52:42 | 000,000,000 | ---- | M] () -- C:\t54.2
[2008/03/28 13:53:03 | 000,000,000 | ---- | M] () -- C:\t54.3
[2008/03/29 05:32:48 | 000,000,000 | ---- | M] () -- C:\t5k
[2008/03/29 05:33:08 | 000,000,000 | ---- | M] () -- C:\t5k.1
[2008/03/29 12:42:29 | 000,000,000 | ---- | M] () -- C:\t60
[2008/03/29 12:42:48 | 000,000,000 | ---- | M] () -- C:\t60.1
[2008/03/29 14:29:26 | 000,000,000 | ---- | M] () -- C:\t68
[2008/03/29 14:29:48 | 000,000,000 | ---- | M] () -- C:\t68.1
[2008/03/18 15:59:38 | 000,000,000 | ---- | M] () -- C:\t6k
[2008/03/18 16:00:01 | 000,000,000 | ---- | M] () -- C:\t6k.1
[2007/06/11 10:22:33 | 000,000,000 | ---- | M] () -- C:\t6o
[2007/06/11 10:22:43 | 000,000,000 | ---- | M] () -- C:\t6o.1
[2007/06/19 12:50:22 | 000,000,000 | ---- | M] () -- C:\t6o.2
[2007/06/19 12:50:31 | 000,000,000 | ---- | M] () -- C:\t6o.3
[2008/02/29 22:26:23 | 000,000,000 | ---- | M] () -- C:\t6o.4
[2008/03/18 18:16:09 | 000,000,000 | ---- | M] () -- C:\t6o.6
[2008/03/18 18:16:28 | 000,000,000 | ---- | M] () -- C:\t6o.7
[2008/03/19 14:38:48 | 000,000,000 | ---- | M] () -- C:\t6o.8
[2008/03/19 14:39:04 | 000,000,000 | ---- | M] () -- C:\t6o.9
[2007/06/22 23:05:57 | 000,000,000 | ---- | M] () -- C:\t70
[2007/06/22 23:06:07 | 000,000,000 | ---- | M] () -- C:\t70.1
[2008/03/27 20:02:21 | 000,000,000 | ---- | M] () -- C:\t70.2
[2008/03/27 20:02:41 | 000,000,000 | ---- | M] () -- C:\t70.3
[2008/04/02 03:57:17 | 000,000,000 | ---- | M] () -- C:\t74
[2008/04/02 03:57:29 | 000,000,000 | ---- | M] () -- C:\t74.1
[2008/03/07 17:36:14 | 000,000,000 | ---- | M] () -- C:\t78
[2008/03/07 17:36:33 | 000,000,000 | ---- | M] () -- C:\t78.1
[2008/03/02 04:36:33 | 000,000,000 | ---- | M] () -- C:\t7c
[2008/03/02 04:36:56 | 000,000,000 | ---- | M] () -- C:\t7c.1
[2008/03/23 11:52:33 | 000,000,000 | ---- | M] () -- C:\t7c.2
[2008/03/23 11:52:51 | 000,000,000 | ---- | M] () -- C:\t7c.3
[2007/05/19 09:10:04 | 000,000,000 | ---- | M] () -- C:\t7g
[2007/05/19 09:10:13 | 000,000,000 | ---- | M] () -- C:\t7g.1
[2007/06/06 06:10:59 | 000,000,000 | ---- | M] () -- C:\t7g.2
[2007/06/06 06:11:07 | 000,000,000 | ---- | M] () -- C:\t7g.3
[2008/03/12 00:19:00 | 000,000,000 | ---- | M] () -- C:\t7g.4
[2008/03/12 00:19:10 | 000,000,000 | ---- | M] () -- C:\t7g.5
[2008/03/24 02:33:54 | 000,000,000 | ---- | M] () -- C:\t7g.6
[2008/03/24 02:34:06 | 000,000,000 | ---- | M] () -- C:\t7g.7
[2007/05/20 00:07:29 | 000,000,000 | ---- | M] () -- C:\t7k
[2007/05/20 00:07:37 | 000,000,000 | ---- | M] () -- C:\t7k.1
[2008/02/28 00:41:43 | 000,000,000 | ---- | M] () -- C:\t7k.2
[2008/03/27 10:51:09 | 000,000,000 | ---- | M] () -- C:\t7k.4
[2008/03/27 10:51:24 | 000,000,000 | ---- | M] () -- C:\t7k.5
[2007/05/22 01:01:43 | 000,000,000 | ---- | M] () -- C:\t7o
[2007/05/22 01:01:52 | 000,000,000 | ---- | M] () -- C:\t7o.1
[2007/06/07 21:21:39 | 000,000,000 | ---- | M] () -- C:\t7o.2
[2007/06/07 21:21:49 | 000,000,000 | ---- | M] () -- C:\t7o.3
[2008/02/07 08:32:16 | 000,000,000 | ---- | M] () -- C:\t7o.4
[2008/02/07 08:32:20 | 000,000,000 | ---- | M] () -- C:\t7o.5
[2007/06/02 23:23:08 | 000,000,000 | ---- | M] () -- C:\t7s
[2007/06/02 23:23:17 | 000,000,000 | ---- | M] () -- C:\t7s.1
[2007/06/05 20:43:24 | 000,000,000 | ---- | M] () -- C:\t80
[2007/06/05 20:43:34 | 000,000,000 | ---- | M] () -- C:\t80.1
[2007/06/18 09:49:49 | 000,000,000 | ---- | M] () -- C:\t80.2
[2007/06/18 09:49:59 | 000,000,000 | ---- | M] () -- C:\t80.3
[2008/02/27 01:55:27 | 000,000,000 | ---- | M] () -- C:\t80.4
[2008/02/27 01:55:44 | 000,000,000 | ---- | M] () -- C:\t80.5
[2008/03/01 06:41:17 | 000,000,000 | ---- | M] () -- C:\t84
[2008/03/01 06:41:42 | 000,000,000 | ---- | M] () -- C:\t84.1
[2008/03/01 08:22:34 | 000,000,000 | ---- | M] () -- C:\t84.2
[2008/03/01 08:22:55 | 000,000,000 | ---- | M] () -- C:\t84.3
[2008/03/23 14:47:23 | 000,000,000 | ---- | M] () -- C:\t84.4
[2008/03/23 14:47:37 | 000,000,000 | ---- | M] () -- C:\t84.5
[2008/03/26 11:37:07 | 000,000,000 | ---- | M] () -- C:\t84.6
[2008/03/26 11:37:10 | 000,000,000 | ---- | M] () -- C:\t84.7
[2008/04/07 21:00:35 | 000,000,000 | ---- | M] () -- C:\t84.8
[2008/04/07 21:00:38 | 000,000,000 | ---- | M] () -- C:\t84.9
[2008/02/25 23:17:33 | 000,000,000 | ---- | M] () -- C:\t8c
[2008/02/25 23:17:59 | 000,000,000 | ---- | M] () -- C:\t8c.1
[2008/03/13 07:14:22 | 000,000,000 | ---- | M] () -- C:\t8c.2
[2008/03/13 07:14:34 | 000,000,000 | ---- | M] () -- C:\t8c.3
[2008/03/21 13:39:05 | 000,000,000 | ---- | M] () -- C:\t8c.4
[2008/03/21 13:39:23 | 000,000,000 | ---- | M] () -- C:\t8c.5
[2008/02/27 01:22:35 | 000,000,000 | ---- | M] () -- C:\t8g
[2008/02/27 01:22:57 | 000,000,000 | ---- | M] () -- C:\t8g.1
[2008/03/04 17:45:38 | 000,000,000 | ---- | M] () -- C:\t8g.2
[2008/03/04 17:45:59 | 000,000,000 | ---- | M] () -- C:\t8g.3
[2008/04/08 05:17:09 | 000,000,000 | ---- | M] () -- C:\t8g.4
[2008/04/08 05:17:28 | 000,000,000 | ---- | M] () -- C:\t8g.5
[2008/04/15 20:51:14 | 000,000,000 | ---- | M] () -- C:\t8g.6
[2008/04/15 20:51:22 | 000,000,000 | ---- | M] () -- C:\t8g.7
[2008/03/13 04:16:27 | 000,000,000 | ---- | M] () -- C:\t8k
[2008/03/13 04:16:40 | 000,000,000 | ---- | M] () -- C:\t8k.1
[2008/03/19 02:01:50 | 000,000,000 | ---- | M] () -- C:\t8k.2
[2008/03/19 02:02:10 | 000,000,000 | ---- | M] () -- C:\t8k.3
[2008/04/17 04:27:20 | 000,000,000 | ---- | M] () -- C:\t8k.4
[2008/04/17 04:27:27 | 000,000,000 | ---- | M] () -- C:\t8k.5
[2008/03/17 09:24:50 | 000,000,000 | ---- | M] () -- C:\t8o
[2008/03/17 09:25:10 | 000,000,000 | ---- | M] () -- C:\t8o.1
[2008/03/03 01:00:34 | 000,000,000 | ---- | M] () -- C:\t8s
[2008/03/03 01:00:55 | 000,000,000 | ---- | M] () -- C:\t8s.1
[2008/03/11 06:39:35 | 000,000,000 | ---- | M] () -- C:\t8s.2
[2008/03/11 06:39:43 | 000,000,000 | ---- | M] () -- C:\t8s.3
[2008/03/21 05:43:24 | 000,000,000 | ---- | M] () -- C:\t8s.4
[2008/03/21 05:43:46 | 000,000,000 | ---- | M] () -- C:\t8s.5
[2008/04/19 22:31:59 | 000,000,000 | ---- | M] () -- C:\t8s.6
[2008/04/19 22:32:05 | 000,000,000 | ---- | M] () -- C:\t8s.7
[2008/02/29 13:32:27 | 000,000,000 | ---- | M] () -- C:\t90
[2008/02/29 13:32:50 | 000,000,000 | ---- | M] () -- C:\t90.1
[2008/03/01 15:47:48 | 000,000,000 | ---- | M] () -- C:\t90.2
[2008/03/01 15:48:06 | 000,000,000 | ---- | M] () -- C:\t90.3
[2008/03/16 09:37:13 | 000,000,000 | ---- | M] () -- C:\t90.4
[2008/03/16 09:37:31 | 000,000,000 | ---- | M] () -- C:\t90.5
[2008/04/15 02:39:44 | 000,000,000 | ---- | M] () -- C:\t90.6
[2008/04/15 02:39:55 | 000,000,000 | ---- | M] () -- C:\t90.7
[2008/03/05 22:32:43 | 000,000,000 | ---- | M] () -- C:\t94
[2008/03/05 22:33:06 | 000,000,000 | ---- | M] () -- C:\t94.1
[2008/07/18 01:47:37 | 000,000,000 | ---- | M] () -- C:\ta4
[2008/07/18 01:47:55 | 000,000,000 | ---- | M] () -- C:\ta4.1
[2007/12/06 19:49:46 | 000,000,000 | ---- | M] () -- C:\tac
[2007/12/06 19:50:00 | 000,000,000 | ---- | M] () -- C:\tac.1
[2007/06/02 19:34:45 | 000,000,000 | ---- | M] () -- C:\tag
[2007/06/02 19:34:53 | 000,000,000 | ---- | M] () -- C:\tag.1
[2007/06/23 22:12:47 | 000,000,000 | ---- | M] () -- C:\tag.2
[2007/06/23 22:12:57 | 000,000,000 | ---- | M] () -- C:\tag.3
[2008/04/14 18:23:56 | 000,000,000 | ---- | M] () -- C:\tao
[2008/04/14 18:24:06 | 000,000,000 | ---- | M] () -- C:\tao.1
[2008/04/16 18:39:53 | 000,000,000 | ---- | M] () -- C:\tao.2
[2008/04/16 18:40:02 | 000,000,000 | ---- | M] () -- C:\tao.3
[2008/02/24 17:38:00 | 000,000,000 | ---- | M] () -- C:\tas
[2008/02/24 17:38:06 | 000,000,000 | ---- | M] () -- C:\tas.1
[2008/03/06 09:30:09 | 000,000,000 | ---- | M] () -- C:\tas.2
[2008/03/06 09:30:31 | 000,000,000 | ---- | M] () -- C:\tas.3
[2008/04/05 14:49:55 | 000,000,000 | ---- | M] () -- C:\tas.4
[2008/04/05 14:49:58 | 000,000,000 | ---- | M] () -- C:\tas.5
[2008/04/10 12:08:29 | 000,000,000 | ---- | M] () -- C:\tas.6
[2008/04/10 12:08:37 | 000,000,000 | ---- | M] () -- C:\tas.7
[2008/04/13 17:44:42 | 000,000,000 | ---- | M] () -- C:\tas.8
[2008/04/13 17:44:45 | 000,000,000 | ---- | M] () -- C:\tas.9
[2007/06/12 06:36:10 | 000,000,000 | ---- | M] () -- C:\tb4
[2007/06/12 06:36:20 | 000,000,000 | ---- | M] () -- C:\tb4.1
[2008/04/20 01:08:45 | 000,000,000 | ---- | M] () -- C:\tb4.2
[2008/04/20 01:09:14 | 000,000,000 | ---- | M] () -- C:\tb4.3
[2008/04/26 02:50:41 | 000,000,000 | ---- | M] () -- C:\tb4.4
[2008/04/26 02:50:48 | 000,000,000 | ---- | M] () -- C:\tb4.5
[2008/02/27 16:37:09 | 000,000,000 | ---- | M] () -- C:\tb8
[2008/02/27 16:37:25 | 000,000,000 | ---- | M] () -- C:\tb8.1
[2008/04/16 05:31:25 | 000,000,000 | ---- | M] () -- C:\tb8.2
[2008/04/16 05:31:33 | 000,000,000 | ---- | M] () -- C:\tb8.3
[2008/03/14 09:42:31 | 000,000,000 | ---- | M] () -- C:\tbc
[2008/03/14 09:42:40 | 000,000,000 | ---- | M] () -- C:\tbc.1
[2008/04/20 00:48:27 | 000,000,000 | ---- | M] () -- C:\tbg
[2008/04/20 00:48:32 | 000,000,000 | ---- | M] () -- C:\tbg.1
[2008/04/19 21:12:41 | 000,000,000 | ---- | M] () -- C:\tbk
[2008/04/19 21:12:47 | 000,000,000 | ---- | M] () -- C:\tbk.1
[2008/04/20 16:33:20 | 000,000,000 | ---- | M] () -- C:\tbo
[2008/04/20 16:33:25 | 000,000,000 | ---- | M] () -- C:\tbo.1
[2008/04/18 08:13:23 | 000,000,000 | ---- | M] () -- C:\tc0
[2008/04/18 08:13:38 | 000,000,000 | ---- | M] () -- C:\tc0.1
[2008/04/19 12:18:20 | 000,000,000 | ---- | M] () -- C:\tc0.2
[2008/04/19 12:18:28 | 000,000,000 | ---- | M] () -- C:\tc0.3
[2008/03/14 14:47:40 | 000,000,000 | ---- | M] () -- C:\tc4
[2008/03/14 14:47:58 | 000,000,000 | ---- | M] () -- C:\tc4.1
[2008/04/18 02:50:05 | 000,000,000 | ---- | M] () -- C:\tc4.2
[2008/04/18 07:38:17 | 000,000,000 | ---- | M] () -- C:\tc4.4
[2008/04/18 07:38:29 | 000,000,000 | ---- | M] () -- C:\tc4.5
[2007/08/04 17:52:21 | 000,000,000 | ---- | M] () -- C:\tcc
[2007/08/04 17:52:31 | 000,000,000 | ---- | M] () -- C:\tcc.1
[2007/08/10 22:51:43 | 000,000,000 | ---- | M] () -- C:\tcg
[2007/08/10 22:51:53 | 000,000,000 | ---- | M] () -- C:\tcg.1
[2008/04/03 13:44:18 | 000,000,000 | ---- | M] () -- C:\tcg.2
[2008/04/03 13:44:26 | 000,000,000 | ---- | M] () -- C:\tcg.3
[2007/08/09 12:11:52 | 000,000,000 | ---- | M] () -- C:\tck
[2008/04/10 19:11:22 | 000,000,000 | ---- | M] () -- C:\tcs
[2008/04/10 19:11:29 | 000,000,000 | ---- | M] () -- C:\tcs.1
[2007/10/13 00:15:31 | 000,000,000 | ---- | M] () -- C:\td4
[2007/10/13 00:15:45 | 000,000,000 | ---- | M] () -- C:\td4.1
[2007/05/30 22:09:46 | 000,000,000 | ---- | M] () -- C:\td8
[2007/05/30 22:09:54 | 000,000,000 | ---- | M] () -- C:\td8.1
[2008/04/07 00:38:52 | 000,000,000 | ---- | M] () -- C:\td8.2
[2008/04/07 00:38:59 | 000,000,000 | ---- | M] () -- C:\td8.3
[2008/04/08 16:44:47 | 000,000,000 | ---- | M] () -- C:\td8.4
[2008/04/08 16:44:55 | 000,000,000 | ---- | M] () -- C:\td8.5
[2007/08/02 21:37:58 | 000,000,000 | ---- | M] () -- C:\tdc
[2007/08/02 21:38:07 | 000,000,000 | ---- | M] () -- C:\tdc.1
[2007/08/05 13:08:36 | 000,000,000 | ---- | M] () -- C:\tdc.2
[2007/08/05 13:08:45 | 000,000,000 | ---- | M] () -- C:\tdc.3
[2007/08/06 20:48:40 | 000,000,000 | ---- | M] () -- C:\tdc.4
[2007/08/06 20:48:50 | 000,000,000 | ---- | M] () -- C:\tdc.5
[2007/11/29 17:40:21 | 000,000,000 | ---- | M] () -- C:\tdc.6
[2007/11/29 17:40:35 | 000,000,000 | ---- | M] () -- C:\tdc.7
[2007/08/01 12:51:10 | 000,000,000 | ---- | M] () -- C:\tdg
[2007/08/01 12:51:20 | 000,000,000 | ---- | M] () -- C:\tdg.1
[2007/08/13 11:27:27 | 000,000,000 | ---- | M] () -- C:\tdg.2
[2007/08/08 01:42:05 | 000,000,000 | ---- | M] () -- C:\tdk
[2007/08/08 01:42:15 | 000,000,000 | ---- | M] () -- C:\tdk.1
[2007/11/24 16:07:13 | 000,000,000 | ---- | M] () -- C:\tdk.2
[2007/11/24 16:07:27 | 000,000,000 | ---- | M] () -- C:\tdk.3
[2008/04/12 05:38:54 | 000,000,000 | ---- | M] () -- C:\tdk.4
[2008/04/12 05:39:02 | 000,000,000 | ---- | M] () -- C:\tdk.5
[2008/04/09 01:44:55 | 000,000,000 | ---- | M] () -- C:\tds
[2008/04/09 01:45:03 | 000,000,000 | ---- | M] () -- C:\tds.1
[2007/12/23 01:24:20 | 000,000,000 | ---- | M] () -- C:\te4
[2007/12/23 01:24:34 | 000,000,000 | ---- | M] () -- C:\te4.1
[2007/10/15 23:07:47 | 000,000,000 | ---- | M] () -- C:\te8
[2007/10/15 23:08:02 | 000,000,000 | ---- | M] () -- C:\te8.1
[2008/02/23 23:05:30 | 000,000,000 | ---- | M] () -- C:\te8.2
[2008/02/23 23:05:37 | 000,000,000 | ---- | M] () -- C:\te8.3
[2008/03/25 18:57:31 | 000,000,000 | ---- | M] () -- C:\te8.4
[2008/03/25 18:57:38 | 000,000,000 | ---- | M] () -- C:\te8.5
[2008/04/13 04:39:11 | 000,000,000 | ---- | M] () -- C:\tec
[2008/04/13 04:39:19 | 000,000,000 | ---- | M] () -- C:\tec.1
[2007/12/25 09:16:25 | 000,000,000 | ---- | M] () -- C:\teg
[2007/12/25 09:16:40 | 000,000,000 | ---- | M] () -- C:\teg.1
[2007/05/23 01:11:59 | 000,000,000 | ---- | M] () -- C:\tf0
[2007/05/23 01:12:08 | 000,000,000 | ---- | M] () -- C:\tf0.1
[2007/05/27 20:04:51 | 000,000,000 | ---- | M] () -- C:\tf0.2
[2007/05/27 20:04:59 | 000,000,000 | ---- | M] () -- C:\tf0.3
[2007/06/17 14:01:19 | 000,000,000 | ---- | M] () -- C:\tf0.4
[2007/06/17 14:01:29 | 000,000,000 | ---- | M] () -- C:\tf0.5
[2007/06/10 22:53:02 | 000,000,000 | ---- | M] () -- C:\tf4
[2007/06/10 22:53:11 | 000,000,000 | ---- | M] () -- C:\tf4.1
[2007/06/12 10:58:39 | 000,000,000 | ---- | M] () -- C:\tf4.2
[2007/06/12 10:58:48 | 000,000,000 | ---- | M] () -- C:\tf4.3
[2007/06/14 09:47:34 | 000,000,000 | ---- | M] () -- C:\tf4.4
[2007/06/14 09:47:44 | 000,000,000 | ---- | M] () -- C:\tf4.5
[2007/06/16 10:48:35 | 000,000,000 | ---- | M] () -- C:\tf4.6
[2007/06/16 10:48:44 | 000,000,000 | ---- | M] () -- C:\tf4.7
[2007/06/04 09:12:48 | 000,000,000 | ---- | M] () -- C:\tf8
[2007/06/04 09:12:56 | 000,000,000 | ---- | M] () -- C:\tf8.1
[2007/06/18 17:04:30 | 000,000,000 | ---- | M] () -- C:\tf8.2
[2007/06/18 17:04:40 | 000,000,000 | ---- | M] () -- C:\tf8.3
[2007/12/28 06:13:10 | 000,000,000 | ---- | M] () -- C:\tf8.4
[2007/12/28 06:13:21 | 000,000,000 | ---- | M] () -- C:\tf8.5
[2008/09/12 20:18:38 | 000,000,000 | ---- | M] () -- C:\tf8.6
[2008/09/12 20:18:49 | 000,000,000 | ---- | M] () -- C:\tf8.7
[2007/06/03 18:01:31 | 000,000,000 | ---- | M] () -- C:\tfc
[2007/06/03 18:01:40 | 000,000,000 | ---- | M] () -- C:\tfc.1
[2007/06/10 12:51:09 | 000,000,000 | ---- | M] () -- C:\tfc.2
[2007/06/10 12:51:19 | 000,000,000 | ---- | M] () -- C:\tfc.3
[2007/05/31 02:24:25 | 000,000,000 | ---- | M] () -- C:\tfg
[2007/05/31 02:24:33 | 000,000,000 | ---- | M] () -- C:\tfg.1
[2007/06/08 01:22:33 | 000,000,000 | ---- | M] () -- C:\tfk
[2007/06/08 01:22:43 | 000,000,000 | ---- | M] () -- C:\tfk.1
[2007/06/17 17:24:09 | 000,000,000 | ---- | M] () -- C:\tfo
[2007/06/17 17:24:18 | 000,000,000 | ---- | M] () -- C:\tfo.1
[2007/10/10 01:34:21 | 000,000,000 | ---- | M] () -- C:\tg4
[2007/10/10 01:34:36 | 000,000,000 | ---- | M] () -- C:\tg4.1
[2007/12/12 01:21:58 | 000,000,000 | ---- | M] () -- C:\tg4.2
[2007/12/12 01:22:11 | 000,000,000 | ---- | M] () -- C:\tg4.3
[2008/08/16 19:54:13 | 000,000,000 | ---- | M] () -- C:\tg4.4
[2008/08/16 19:54:29 | 000,000,000 | ---- | M] () -- C:\tg4.5
[2007/12/03 15:31:28 | 000,000,000 | ---- | M] () -- C:\tgg
[2007/12/03 15:31:41 | 000,000,000 | ---- | M] () -- C:\tgg.1
[2008/08/28 23:39:42 | 000,000,000 | ---- | M] () -- C:\tgo
[2008/08/28 23:39:58 | 000,000,000 | ---- | M] () -- C:\tgo.1
[2008/01/19 18:13:26 | 000,000,000 | ---- | M] () -- C:\tgs
[2008/01/19 18:13:33 | 000,000,000 | ---- | M] () -- C:\tgs.1
[2008/08/08 10:51:40 | 000,000,000 | ---- | M] () -- C:\th4
[2008/08/08 10:52:02 | 000,000,000 | ---- | M] () -- C:\th4.1
[2008/04/23 16:21:46 | 000,000,000 | ---- | M] () -- C:\ti0
[2008/04/23 16:22:01 | 000,000,000 | ---- | M] () -- C:\ti0.1
[2007/12/15 16:42:51 | 000,000,000 | ---- | M] () -- C:\tis
[2007/12/15 16:43:05 | 000,000,000 | ---- | M] () -- C:\tis.1
[2008/08/13 17:59:38 | 000,000,000 | ---- | M] () -- C:\tj0
[2008/08/13 18:00:03 | 000,000,000 | ---- | M] () -- C:\tj0.1
[2008/08/11 15:58:46 | 000,000,000 | ---- | M] () -- C:\tj4
[2008/08/11 15:59:02 | 000,000,000 | ---- | M] () -- C:\tj4.1
[2007/12/13 06:48:25 | 000,000,000 | ---- | M] () -- C:\tk4
[2007/12/13 06:48:40 | 000,000,000 | ---- | M] () -- C:\tk4.1
[2007/11/29 14:37:07 | 000,000,000 | ---- | M] () -- C:\tls
[2007/11/29 14:37:21 | 000,000,000 | ---- | M] () -- C:\tls.1
[2008/03/10 08:04:12 | 000,000,000 | ---- | M] () -- C:\tm0
[2008/03/10 08:04:18 | 000,000,000 | ---- | M] () -- C:\tm0.1
[2007/12/20 21:43:51 | 000,000,000 | ---- | M] () -- C:\tms
[2007/12/20 21:44:05 | 000,000,000 | ---- | M] () -- C:\tms.1
[2007/08/05 13:03:46 | 000,000,000 | ---- | M] () -- C:\tn0
[2007/08/05 13:03:57 | 000,000,000 | ---- | M] () -- C:\tn0.1
[2007/12/25 09:30:39 | 000,000,000 | ---- | M] () -- C:\tnc
[2007/12/25 09:30:53 | 000,000,000 | ---- | M] () -- C:\tnc.1
[2008/02/22 15:36:10 | 000,000,000 | ---- | M] () -- C:\tno
[2008/02/22 15:36:17 | 000,000,000 | ---- | M] () -- C:\tno.1
[2008/10/12 19:40:26 | 000,000,000 | ---- | M] () -- C:\tno.2
[2008/10/12 19:40:43 | 000,000,000 | ---- | M] () -- C:\tno.3
[2008/08/21 19:22:52 | 000,000,000 | ---- | M] () -- C:\to4
[2008/08/21 19:23:06 | 000,000,000 | ---- | M] () -- C:\to4.1
[2008/01/08 08:56:15 | 000,000,000 | ---- | M] () -- C:\tqk
[2008/01/08 08:56:27 | 000,000,000 | ---- | M] () -- C:\tqk.1
[2007/05/15 18:10:56 | 000,000,000 | ---- | M] () -- C:\trs
[2007/05/15 18:11:07 | 000,000,000 | ---- | M] () -- C:\trs.1
[2007/08/07 21:30:03 | 000,000,000 | ---- | M] () -- C:\tu4
[2007/08/07 21:30:12 | 000,000,000 | ---- | M] () -- C:\tu4.1
[2007/10/10 13:44:09 | 000,000,000 | ---- | M] () -- C:\tu4.2
[2007/09/14 09:12:01 | 000,000,000 | ---- | M] () -- C:\tug
[2007/09/14 09:12:14 | 000,000,000 | ---- | M] () -- C:\tug.1
[2007/09/12 05:02:18 | 000,000,000 | ---- | M] () -- C:\tuk
[2007/09/12 05:02:30 | 000,000,000 | ---- | M] () -- C:\tuk.1
[2007/08/15 19:38:12 | 000,000,000 | ---- | M] () -- C:\tuo
[2007/08/15 19:38:22 | 000,000,000 | ---- | M] () -- C:\tuo.1
[2007/11/12 23:48:41 | 000,000,000 | ---- | M] () -- C:\tuo.2
[2007/11/12 23:48:56 | 000,000,000 | ---- | M] () -- C:\tuo.3
[2007/10/16 23:41:35 | 000,000,000 | ---- | M] () -- C:\tvk
[2007/10/16 23:41:50 | 000,000,000 | ---- | M] () -- C:\tvk.1
[2007/09/21 10:11:12 | 000,000,000 | ---- | M] () -- C:\tvo
[2007/09/21 10:11:25 | 000,000,000 | ---- | M] () -- C:\tvo.1
[2007/09/19 21:25:39 | 000,000,000 | ---- | M] () -- C:\tvs
[2007/09/19 21:25:51 | 000,000,000 | ---- | M] () -- C:\tvs.1
@Alternate Data Stream - 141 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:76C85903
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34


:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
  • Let the program run unhindered
  • Please save the resulting log to be posted in your next reply.
  • Reboot your computer
Please post the OTL log.
Tomk
------------------------------------------------------------
Microsoft MVP 2010-2014
 

#3 ike001

ike001

    Authentic Member

  • Authentic Member
  • PipPip
  • 36 posts

Posted 13 July 2011 - 03:34 PM

Hello TomK, Thank you for responding to my post. I think I may have messed things up. Prior to logging on, Avast asked me to update the Avast program. Unfortunately I did. Soon after, rather than Avast blocking the "Program Files\Internet Explorer\IExplore.exe" file, Avast began blocking this URL instead "Program Files\Alwil Software\Avast5\AvastSVC.exe" I ran OTL soon after. Now both Avast warnings of the Malicious URL still appear ("AvastSVC.exe" and "IExplorer.exe"), and the icons on my desktop still do not appear. Here are the results of running OTL: All processes killed ========== PROCESSES ========== ========== OTL ========== Prefs.js: "Secure Search" removed from browser.search.defaultenginename Prefs.js: "Secure Search" removed from browser.search.selectedEngine Prefs.js: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 removed from extensions.enabledItems Prefs.js: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 removed from extensions.enabledItems Prefs.js: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 removed from extensions.enabledItems Prefs.js: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 removed from extensions.enabledItems C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\zh-TW folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\zh-CN folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\sv-SE folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\ko-KR folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\ja-JP folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\it-IT folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\fr-FR folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\es-ES folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\en-US folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale\de-DE folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\locale folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\content\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome\content folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}\chrome folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\zh-TW folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\zh-CN folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\sv-SE folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\ko-KR folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\ja-JP folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\it-IT folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\fr-FR folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\es-ES folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\en-US folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale\de-DE folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\locale folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\content\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome\content folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\chrome folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\zh-TW folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\zh-CN folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\sv-SE folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\ko-KR folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\ja-JP folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\it-IT folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\fr-FR folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\es-ES folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\en-US folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale\de-DE folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\locale folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\content\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome\content folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\chrome folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\zh-TW folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\zh-CN folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\sv-SE folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\ko-KR folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\ja-JP folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\it-IT folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\fr-FR folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\es-ES folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\en-US folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale\de-DE folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\locale folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\content\ffjcext folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome\content folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\chrome folder moved successfully. C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} folder moved successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ACD mPower Tools deleted successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\JUaDAjhRvP deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ not found. C:\Program Files\PartyGaming\PartyPoker\RunApp.exe moved successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ not found. File C:\Program Files\PartyGaming\PartyPoker\RunApp.exe not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{F4430FE8-2638-42e5-B849-800749B94EED}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4430FE8-2638-42e5-B849-800749B94EED}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{F4430FE8-2638-42e5-B849-800749B94EED}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4430FE8-2638-42e5-B849-800749B94EED}\ not found. Starting removal of ActiveX control {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\ not found. Starting removal of ActiveX control {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found. Starting removal of ActiveX control {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found. Starting removal of ActiveX control {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\DownloadInformation\\INF . Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\ not found. Starting removal of ActiveX control {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\DownloadInformation\\INF . Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\ not found. Starting removal of ActiveX control {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\DownloadInformation\\INF . Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\ not found. C:\t100 moved successfully. C:\t100.1 moved successfully. C:\t10g moved successfully. C:\t10g.1 moved successfully. C:\t10o moved successfully. C:\t10o.1 moved successfully. C:\t110 moved successfully. C:\t110.1 moved successfully. C:\t114 moved successfully. C:\t114.1 moved successfully. C:\t120 moved successfully. C:\t120.1 moved successfully. C:\t120.2 moved successfully. C:\t120.3 moved successfully. C:\t124 moved successfully. C:\t124.1 moved successfully. C:\t124.2 moved successfully. C:\t124.3 moved successfully. C:\t128 moved successfully. C:\t128.1 moved successfully. C:\t12g moved successfully. C:\t12g.2 moved successfully. C:\t12g.3 moved successfully. C:\t12k moved successfully. C:\t12k.1 moved successfully. C:\t138 moved successfully. C:\t138.1 moved successfully. C:\t14g moved successfully. C:\t14g.1 moved successfully. C:\t15s moved successfully. C:\t16k moved successfully. C:\t16k.1 moved successfully. C:\t17k moved successfully. C:\t17k.1 moved successfully. C:\t198 moved successfully. C:\t198.1 moved successfully. C:\t1b8 moved successfully. C:\t1b8.1 moved successfully. C:\t1ck moved successfully. C:\t1ck.1 moved successfully. C:\t1f8 moved successfully. C:\t1f8.1 moved successfully. C:\t1fg moved successfully. C:\t1fg.1 moved successfully. C:\t1fk moved successfully. C:\t1fk.1 moved successfully. C:\t1g4 moved successfully. C:\t1g4.1 moved successfully. C:\t1gc moved successfully. C:\t1gc.1 moved successfully. C:\t1gg moved successfully. C:\t1gg.1 moved successfully. C:\t1gk moved successfully. C:\t1gk.1 moved successfully. C:\t1h4 moved successfully. C:\t1h4.1 moved successfully. C:\t1h8 moved successfully. C:\t1h8.1 moved successfully. C:\t1jo moved successfully. C:\t1jo.1 moved successfully. C:\t1m4 moved successfully. C:\t1m4.1 moved successfully. C:\t1ng moved successfully. C:\t1ng.1 moved successfully. C:\t1ng.2 moved successfully. C:\t1ng.3 moved successfully. C:\t1nk moved successfully. C:\t1nk.1 moved successfully. C:\t1nk.2 moved successfully. C:\t1nk.3 moved successfully. C:\t1nk.4 moved successfully. C:\t1nk.5 moved successfully. C:\t1nk.6 moved successfully. C:\t1nk.7 moved successfully. C:\t1no moved successfully. C:\t1no.1 moved successfully. C:\t1no.2 moved successfully. C:\t1no.3 moved successfully. C:\t1no.4 moved successfully. C:\t1no.5 moved successfully. C:\t1ns moved successfully. C:\t1ns.1 moved successfully. C:\t1ns.2 moved successfully. C:\t1ns.3 moved successfully. C:\t1ns.4 moved successfully. C:\t1ns.5 moved successfully. C:\t1ns.6 moved successfully. C:\t1ns.7 moved successfully. C:\t1o0 moved successfully. C:\t1o0.2 moved successfully. C:\t1o0.3 moved successfully. C:\t1o4 moved successfully. C:\t1o4.1 moved successfully. C:\t1o8 moved successfully. C:\t1o8.2 moved successfully. C:\t1o8.3 moved successfully. C:\t1oc moved successfully. C:\t1oc.1 moved successfully. C:\t1ok moved successfully. C:\t1ok.1 moved successfully. C:\t1ok.2 moved successfully. C:\t1ok.3 moved successfully. C:\t1os moved successfully. C:\t1os.1 moved successfully. C:\t1p0 moved successfully. C:\t1p0.1 moved successfully. C:\t1p0.2 moved successfully. C:\t1p0.3 moved successfully. C:\t1p8 moved successfully. C:\t1p8.1 moved successfully. C:\t1p8.2 moved successfully. C:\t1p8.3 moved successfully. C:\t1p8.4 moved successfully. C:\t1p8.5 moved successfully. C:\t1p8.6 moved successfully. C:\t1p8.7 moved successfully. C:\t1pc moved successfully. C:\t1pc.1 moved successfully. C:\t1pg moved successfully. C:\t1pg.1 moved successfully. C:\t1pk moved successfully. C:\t1pk.1 moved successfully. C:\t1pk.2 moved successfully. C:\t1pk.3 moved successfully. C:\t1pk.4 moved successfully. C:\t1pk.5 moved successfully. C:\t1pk.6 moved successfully. C:\t1pk.7 moved successfully. C:\t1po moved successfully. C:\t1po.1 moved successfully. C:\t1po.2 moved successfully. C:\t1po.3 moved successfully. C:\t1po.4 moved successfully. C:\t1po.5 moved successfully. C:\t1po.6 moved successfully. C:\t1po.7 moved successfully. C:\t1ps moved successfully. C:\t1ps.1 moved successfully. C:\t1q0 moved successfully. C:\t1q0.1 moved successfully. C:\t1q4 moved successfully. C:\t1q4.1 moved successfully. C:\t1q4.2 moved successfully. C:\t1q4.3 moved successfully. C:\t1qk moved successfully. C:\t1qk.1 moved successfully. C:\t1qo moved successfully. C:\t1qo.1 moved successfully. C:\t1qo.2 moved successfully. C:\t1qo.3 moved successfully. C:\t1qo.4 moved successfully. C:\t1qo.5 moved successfully. C:\t1qo.6 moved successfully. C:\t1qo.7 moved successfully. C:\t1r0 moved successfully. C:\t1r0.1 moved successfully. C:\t1r0.2 moved successfully. C:\t1r0.3 moved successfully. C:\t1r0.4 moved successfully. C:\t1r0.5 moved successfully. C:\t1r0.6 moved successfully. C:\t1r0.7 moved successfully. C:\t1r4 moved successfully. C:\t1r4.1 moved successfully. C:\t1r8 moved successfully. C:\t1r8.1 moved successfully. C:\t1r8.2 moved successfully. C:\t1r8.4 moved successfully. C:\t1r8.5 moved successfully. C:\t1ro moved successfully. C:\t1ro.1 moved successfully. C:\t1ro.2 moved successfully. C:\t1ro.3 moved successfully. C:\t1ro.4 moved successfully. C:\t1ro.5 moved successfully. C:\t1rs moved successfully. C:\t1s0 moved successfully. C:\t1s0.1 moved successfully. C:\t1s0.2 moved successfully. C:\t1s0.3 moved successfully. C:\t1s0.4 moved successfully. C:\t1s0.5 moved successfully. C:\t1s0.6 moved successfully. C:\t1s0.7 moved successfully. C:\t1s4 moved successfully. C:\t1s4.1 moved successfully. C:\t1s8 moved successfully. C:\t1s8.1 moved successfully. C:\t1s8.2 moved successfully. C:\t1s8.3 moved successfully. C:\t1s8.4 moved successfully. C:\t1s8.5 moved successfully. C:\t1s8.6 moved successfully. C:\t1s8.7 moved successfully. C:\t1s8.8 moved successfully. C:\t1s8.9 moved successfully. C:\t1s8.a moved successfully. C:\t1s8.b moved successfully. C:\t1sc moved successfully. C:\t1sc.1 moved successfully. C:\t1sc.2 moved successfully. C:\t1sc.3 moved successfully. C:\t1sc.4 moved successfully. C:\t1sc.5 moved successfully. C:\t1sc.6 moved successfully. C:\t1sc.7 moved successfully. C:\t1sc.8 moved successfully. C:\t1sc.9 moved successfully. C:\t1sg moved successfully. C:\t1sg.1 moved successfully. C:\t1sg.2 moved successfully. C:\t1sg.3 moved successfully. C:\t1sk moved successfully. C:\t1sk.1 moved successfully. C:\t1sk.2 moved successfully. C:\t1sk.3 moved successfully. C:\t1ss moved successfully. C:\t1ss.1 moved successfully. C:\t1ss.2 moved successfully. C:\t1ss.3 moved successfully. C:\t1t4 moved successfully. C:\t1t4.1 moved successfully. C:\t1t8 moved successfully. C:\t1t8.1 moved successfully. C:\t1t8.2 moved successfully. C:\t1t8.3 moved successfully. C:\t1to moved successfully. C:\t1to.1 moved successfully. C:\t1ts moved successfully. C:\t1ts.1 moved successfully. C:\t1u0 moved successfully. C:\t1u0.1 moved successfully. C:\t1u8 moved successfully. C:\t1u8.1 moved successfully. C:\t1uc moved successfully. C:\t1uc.1 moved successfully. C:\t1v8 moved successfully. C:\t1v8.1 moved successfully. C:\t1v8.2 moved successfully. C:\t1v8.3 moved successfully. C:\t1vk moved successfully. C:\t1vk.1 moved successfully. C:\t1vo moved successfully. C:\t1vo.1 moved successfully. C:\t20c moved successfully. C:\t20c.1 moved successfully. C:\t21g moved successfully. C:\t21g.1 moved successfully. C:\t22k moved successfully. C:\t22k.1 moved successfully. C:\t258 moved successfully. C:\t258.1 moved successfully. C:\t2s4 moved successfully. C:\t2s4.1 moved successfully. C:\t3k moved successfully. C:\t3k.1 moved successfully. C:\t3k.2 moved successfully. C:\t3k.3 moved successfully. C:\t3k.4 moved successfully. C:\t3k.5 moved successfully. C:\t3s moved successfully. C:\t3s.1 moved successfully. C:\t54 moved successfully. C:\t54.1 moved successfully. C:\t54.2 moved successfully. C:\t54.3 moved successfully. C:\t5k moved successfully. C:\t5k.1 moved successfully. C:\t60 moved successfully. C:\t60.1 moved successfully. C:\t68 moved successfully. C:\t68.1 moved successfully. C:\t6k moved successfully. C:\t6k.1 moved successfully. C:\t6o moved successfully. C:\t6o.1 moved successfully. C:\t6o.2 moved successfully. C:\t6o.3 moved successfully. C:\t6o.4 moved successfully. C:\t6o.6 moved successfully. C:\t6o.7 moved successfully. C:\t6o.8 moved successfully. C:\t6o.9 moved successfully. C:\t70 moved successfully. C:\t70.1 moved successfully. C:\t70.2 moved successfully. C:\t70.3 moved successfully. C:\t74 moved successfully. C:\t74.1 moved successfully. C:\t78 moved successfully. C:\t78.1 moved successfully. C:\t7c moved successfully. C:\t7c.1 moved successfully. C:\t7c.2 moved successfully. C:\t7c.3 moved successfully. C:\t7g moved successfully. C:\t7g.1 moved successfully. C:\t7g.2 moved successfully. C:\t7g.3 moved successfully. C:\t7g.4 moved successfully. C:\t7g.5 moved successfully. C:\t7g.6 moved successfully. C:\t7g.7 moved successfully. C:\t7k moved successfully. C:\t7k.1 moved successfully. C:\t7k.2 moved successfully. C:\t7k.4 moved successfully. C:\t7k.5 moved successfully. C:\t7o moved successfully. C:\t7o.1 moved successfully. C:\t7o.2 moved successfully. C:\t7o.3 moved successfully. C:\t7o.4 moved successfully. C:\t7o.5 moved successfully. C:\t7s moved successfully. C:\t7s.1 moved successfully. C:\t80 moved successfully. C:\t80.1 moved successfully. C:\t80.2 moved successfully. C:\t80.3 moved successfully. C:\t80.4 moved successfully. C:\t80.5 moved successfully. C:\t84 moved successfully. C:\t84.1 moved successfully. C:\t84.2 moved successfully. C:\t84.3 moved successfully. C:\t84.4 moved successfully. C:\t84.5 moved successfully. C:\t84.6 moved successfully. C:\t84.7 moved successfully. C:\t84.8 moved successfully. C:\t84.9 moved successfully. C:\t8c moved successfully. C:\t8c.1 moved successfully. C:\t8c.2 moved successfully. C:\t8c.3 moved successfully. C:\t8c.4 moved successfully. C:\t8c.5 moved successfully. C:\t8g moved successfully. C:\t8g.1 moved successfully. C:\t8g.2 moved successfully. C:\t8g.3 moved successfully. C:\t8g.4 moved successfully. C:\t8g.5 moved successfully. C:\t8g.6 moved successfully. C:\t8g.7 moved successfully. C:\t8k moved successfully. C:\t8k.1 moved successfully. C:\t8k.2 moved successfully. C:\t8k.3 moved successfully. C:\t8k.4 moved successfully. C:\t8k.5 moved successfully. C:\t8o moved successfully. C:\t8o.1 moved successfully. C:\t8s moved successfully. C:\t8s.1 moved successfully. C:\t8s.2 moved successfully. C:\t8s.3 moved successfully. C:\t8s.4 moved successfully. C:\t8s.5 moved successfully. C:\t8s.6 moved successfully. C:\t8s.7 moved successfully. C:\t90 moved successfully. C:\t90.1 moved successfully. C:\t90.2 moved successfully. C:\t90.3 moved successfully. C:\t90.4 moved successfully. C:\t90.5 moved successfully. C:\t90.6 moved successfully. C:\t90.7 moved successfully. C:\t94 moved successfully. C:\t94.1 moved successfully. C:\ta4 moved successfully. C:\ta4.1 moved successfully. C:\tac moved successfully. C:\tac.1 moved successfully. C:\tag moved successfully. C:\tag.1 moved successfully. C:\tag.2 moved successfully. C:\tag.3 moved successfully. C:\tao moved successfully. C:\tao.1 moved successfully. C:\tao.2 moved successfully. C:\tao.3 moved successfully. C:\tas moved successfully. C:\tas.1 moved successfully. C:\tas.2 moved successfully. C:\tas.3 moved successfully. C:\tas.4 moved successfully. C:\tas.5 moved successfully. C:\tas.6 moved successfully. C:\tas.7 moved successfully. C:\tas.8 moved successfully. C:\tas.9 moved successfully. C:\tb4 moved successfully. C:\tb4.1 moved successfully. C:\tb4.2 moved successfully. C:\tb4.3 moved successfully. C:\tb4.4 moved successfully. C:\tb4.5 moved successfully. C:\tb8 moved successfully. C:\tb8.1 moved successfully. C:\tb8.2 moved successfully. C:\tb8.3 moved successfully. C:\tbc moved successfully. C:\tbc.1 moved successfully. C:\tbg moved successfully. C:\tbg.1 moved successfully. C:\tbk moved successfully. C:\tbk.1 moved successfully. C:\tbo moved successfully. C:\tbo.1 moved successfully. C:\tc0 moved successfully. C:\tc0.1 moved successfully. C:\tc0.2 moved successfully. C:\tc0.3 moved successfully. C:\tc4 moved successfully. C:\tc4.1 moved successfully. C:\tc4.2 moved successfully. C:\tc4.4 moved successfully. C:\tc4.5 moved successfully. C:\tcc moved successfully. C:\tcc.1 moved successfully. C:\tcg moved successfully. C:\tcg.1 moved successfully. C:\tcg.2 moved successfully. C:\tcg.3 moved successfully. C:\tck moved successfully. C:\tcs moved successfully. C:\tcs.1 moved successfully. C:\td4 moved successfully. C:\td4.1 moved successfully. C:\td8 moved successfully. C:\td8.1 moved successfully. C:\td8.2 moved successfully. C:\td8.3 moved successfully. C:\td8.4 moved successfully. C:\td8.5 moved successfully. C:\tdc moved successfully. C:\tdc.1 moved successfully. C:\tdc.2 moved successfully. C:\tdc.3 moved successfully. C:\tdc.4 moved successfully. C:\tdc.5 moved successfully. C:\tdc.6 moved successfully. C:\tdc.7 moved successfully. C:\tdg moved successfully. C:\tdg.1 moved successfully. C:\tdg.2 moved successfully. C:\tdk moved successfully. C:\tdk.1 moved successfully. C:\tdk.2 moved successfully. C:\tdk.3 moved successfully. C:\tdk.4 moved successfully. C:\tdk.5 moved successfully. C:\tds moved successfully. C:\tds.1 moved successfully. C:\te4 moved successfully. C:\te4.1 moved successfully. C:\te8 moved successfully. C:\te8.1 moved successfully. C:\te8.2 moved successfully. C:\te8.3 moved successfully. C:\te8.4 moved successfully. C:\te8.5 moved successfully. C:\tec moved successfully. C:\tec.1 moved successfully. C:\teg moved successfully. C:\teg.1 moved successfully. C:\tf0 moved successfully. C:\tf0.1 moved successfully. C:\tf0.2 moved successfully. C:\tf0.3 moved successfully. C:\tf0.4 moved successfully. C:\tf0.5 moved successfully. C:\tf4 moved successfully. C:\tf4.1 moved successfully. C:\tf4.2 moved successfully. C:\tf4.3 moved successfully. C:\tf4.4 moved successfully. C:\tf4.5 moved successfully. C:\tf4.6 moved successfully. C:\tf4.7 moved successfully. C:\tf8 moved successfully. C:\tf8.1 moved successfully. C:\tf8.2 moved successfully. C:\tf8.3 moved successfully. C:\tf8.4 moved successfully. C:\tf8.5 moved successfully. C:\tf8.6 moved successfully. C:\tf8.7 moved successfully. C:\tfc moved successfully. C:\tfc.1 moved successfully. C:\tfc.2 moved successfully. C:\tfc.3 moved successfully. C:\tfg moved successfully. C:\tfg.1 moved successfully. C:\tfk moved successfully. C:\tfk.1 moved successfully. C:\tfo moved successfully. C:\tfo.1 moved successfully. C:\tg4 moved successfully. C:\tg4.1 moved successfully. C:\tg4.2 moved successfully. C:\tg4.3 moved successfully. C:\tg4.4 moved successfully. C:\tg4.5 moved successfully. C:\tgg moved successfully. C:\tgg.1 moved successfully. C:\tgo moved successfully. C:\tgo.1 moved successfully. C:\tgs moved successfully. C:\tgs.1 moved successfully. C:\th4 moved successfully. C:\th4.1 moved successfully. C:\ti0 moved successfully. C:\ti0.1 moved successfully. C:\tis moved successfully. C:\tis.1 moved successfully. C:\tj0 moved successfully. C:\tj0.1 moved successfully. C:\tj4 moved successfully. C:\tj4.1 moved successfully. C:\tk4 moved successfully. C:\tk4.1 moved successfully. C:\tls moved successfully. C:\tls.1 moved successfully. C:\tm0 moved successfully. C:\tm0.1 moved successfully. C:\tms moved successfully. C:\tms.1 moved successfully. C:\tn0 moved successfully. C:\tn0.1 moved successfully. C:\tnc moved successfully. C:\tnc.1 moved successfully. C:\tno moved successfully. C:\tno.1 moved successfully. C:\tno.2 moved successfully. C:\tno.3 moved successfully. C:\to4 moved successfully. C:\to4.1 moved successfully. C:\tqk moved successfully. C:\tqk.1 moved successfully. C:\trs moved successfully. C:\trs.1 moved successfully. C:\tu4 moved successfully. C:\tu4.1 moved successfully. C:\tu4.2 moved successfully. C:\tug moved successfully. C:\tug.1 moved successfully. C:\tuk moved successfully. C:\tuk.1 moved successfully. C:\tuo moved successfully. C:\tuo.1 moved successfully. C:\tuo.2 moved successfully. C:\tuo.3 moved successfully. C:\tvk moved successfully. C:\tvk.1 moved successfully. C:\tvo moved successfully. C:\tvo.1 moved successfully. C:\tvs moved successfully. C:\tvs.1 moved successfully. ADS C:\Documents and Settings\All Users\Application Data\TEMP:76C85903 deleted successfully. ADS C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34 deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 65748 bytes ->Temporary Internet Files folder emptied: 111826 bytes ->Flash cache emptied: 564 bytes User: NetworkService ->Temp folder emptied: 2149084 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Ike ->Temp folder emptied: 3953936856 bytes ->Temporary Internet Files folder emptied: 419296465 bytes ->Java cache emptied: 5839928 bytes ->FireFox cache emptied: 58433718 bytes ->Opera cache emptied: 0 bytes ->Flash cache emptied: 1718402 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 1138887 bytes %systemroot%\System32 .tmp files removed: 3148305 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 65345619 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 12905280 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 4,315.00 mb OTL by OldTimer - Version 3.2.26.1 log created on 07132011_110321 Files\Folders moved on Reboot... C:\Documents and Settings\Ike\Local Settings\Temp\~DFC69D.tmp moved successfully. C:\Documents and Settings\Ike\Local Settings\Temp\~DFEC7D.tmp moved successfully. C:\Documents and Settings\Ike\Local Settings\Temporary Internet Files\Content.IE5\M9YVFMPN\index[3].htm moved successfully. C:\Documents and Settings\Ike\Local Settings\Temporary Internet Files\Content.IE5\K7CU0B4Z\iframe[1].htm moved successfully. C:\Documents and Settings\Ike\Local Settings\Temporary Internet Files\Content.IE5\JFMKKHTV\like[3].htm moved successfully. C:\Documents and Settings\Ike\Local Settings\Temporary Internet Files\AntiPhishing\A0AB7674-8D67-4F4D-B5E1-96FAEADFB79D.dat moved successfully. File\Folder C:\WINDOWS\temp\_avast_\Webshlock.txt not found! File\Folder C:\WINDOWS\temp\hsperfdata_SYSTEM\1772 not found! File\Folder C:\WINDOWS\temp\ZLT01e03.TMP not found! Registry entries deleted on Reboot...

Edited by ike001, 13 July 2011 - 03:37 PM.


#4 Tomk

Tomk

    Beguilement Monitor

  • Global Moderator
  • 20,451 posts

Posted 13 July 2011 - 06:47 PM

ike001,

Give this a try:

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link --> http://forums.whatth...ams_t96260.html

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


Posted Image



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.


Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Tomk
------------------------------------------------------------
Microsoft MVP 2010-2014
 

#5 ike001

ike001

    Authentic Member

  • Authentic Member
  • PipPip
  • 36 posts

Posted 14 July 2011 - 12:51 AM

Hello TomK,

After running ComboFix, my Desktop icons appeared for the first time since the Trojan/Virus.

However, the redirect Virus still exists.


One thing I should mention: the second time I ran OTL, Windows XP wanted to do an update. I did not let it,
and shut down my computer without updating.

When I received the alert email that you responded to my post, I went to WhatTheTech.com but it was unavailable
for 15 minutes due to maintenance (that's what it said).

During that time, some kind of Win32 services on my computer said that it failed. When shutting down the computer,
the computer did an update of Windows XP without my permission. I could not control that. I ran ComboFix thereafter.



Here is the ComboFix log:


ComboFix 11-07-13.04 - Ike 07/13/2011 19:23:01.5.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1982.1419 [GMT -10:00]
Running from: c:\documents and settings\Ike\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Firewall *Disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\ACD Systems\ACDSee\ImageDB.ddf
c:\documents and settings\Ike\WINDOWS
C:\Thumbs.db
c:\windows\My.ini
.
.
((((((((((((((((((((((((( Files Created from 2011-06-14 to 2011-07-14 )))))))))))))))))))))))))))))))
.
.
2011-07-13 21:03 . 2011-07-13 21:03 -------- d-----w- C:\_OTL
2011-07-13 20:44 . 2011-06-07 15:55 7074640 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{F74D882A-5A7B-4891-8657-35E7FCB80A15}\mpengine.dll
2011-07-11 04:40 . 2011-07-11 04:40 -------- d-----w- c:\documents and settings\Ike\Local Settings\Application Data\PCHealth
2011-07-01 06:06 . 2011-07-04 11:36 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-06-22 10:12 . 2011-03-18 11:24 69120 ----a-w- c:\windows\system32\zlcomm.dll
2011-06-22 10:12 . 2011-03-18 11:24 104448 ----a-w- c:\windows\system32\zlcommdb.dll
2011-06-16 01:32 . 2011-04-21 13:37 105472 -c----w- c:\windows\system32\dllcache\mup.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-04 11:43 . 2010-07-30 00:09 40112 ----a-w- c:\windows\avastSS.scr
2011-07-04 11:43 . 2005-12-29 03:14 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-07-04 11:36 . 2008-04-05 14:12 309848 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-07-04 11:35 . 2005-12-29 04:10 43608 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-07-04 11:35 . 2005-12-29 04:10 102616 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-07-04 11:35 . 2005-12-29 04:10 96344 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-07-04 11:32 . 2005-12-29 03:14 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-07-04 11:32 . 2005-12-29 04:10 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-07-04 11:32 . 2008-04-05 14:12 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-06-26 08:49 . 2011-05-13 02:10 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-07 15:55 . 2009-01-11 14:50 7074640 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2011-06-02 14:02 . 2003-03-31 12:00 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-05-25 05:14 . 2009-10-02 23:13 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-05-04 14:52 . 2010-04-16 04:43 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-05-04 12:25 . 2008-01-16 16:24 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-05-02 15:31 . 2005-12-28 21:39 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25 . 2003-03-31 12:00 151552 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19 . 2003-03-31 12:00 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-26 11:07 . 2003-03-31 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2011-04-26 11:07 . 2003-03-31 12:00 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-04-25 15:51 . 2005-10-21 22:51 832512 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 15:51 . 2004-08-04 07:56 78336 ----a-w- c:\windows\system32\ieencode.dll
2011-04-25 15:51 . 2003-03-31 12:00 1830912 ----a-w- c:\windows\system32\inetcpl.cpl
2011-04-25 15:51 . 2003-03-31 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2011-04-25 12:01 . 2004-08-04 05:59 389120 ----a-w- c:\windows\system32\html.iec
2011-04-21 13:37 . 2003-03-31 12:00 105472 ----a-w- c:\windows\system32\drivers\mup.sys
2006-05-03 09:06 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 10:47 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 12:30 216064 --sh--r- c:\windows\system32\nbDX.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 122512 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" [2005-03-08 53248]
"VTTrayp"="VTtrayp.exe" [2005-08-04 163840]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb06.exe" [2008-01-16 188416]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2008-01-16 185896]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2008-01-16 75304]
"WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2008-01-16 20480]
"ScanSoft OmniPage SE 4.0-reminder"="c:\program files\ScanSoft\OmniPageSE4.0\Ereg\Ereg.exe" [2008-01-16 1410600]
"WD Drive Manager"="c:\program files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe" [2008-05-17 430080]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-06-15 68592]
"QuickTime Task"="c:\application files\multimedia\video\quicktime\qttask.exe" [2009-01-06 413696]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2011-03-18 1043968]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-23 39264]
.
c:\documents and settings\Ike\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "c:\program files\Qualcomm\Eudora\EuShlExt.dll" [2006-08-18 86016]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk]
backup=c:\windows\pss\Service Manager.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Ike^Start Menu^Programs^Startup^WinMySQLadmin.lnk]
backup=c:\windows\pss\WinMySQLadmin.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2005-06-07 09:46 57344 ----a-w- c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-05-12 09:12 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD08]
2005-06-01 16:35 49152 ----a-w- c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-01-06 02:18 413696 ----a-w- c:\application files\Multimedia\Video\quicktime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-04-07 05:27 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ColdFusion Management Service"=2 (0x2)
"ColdFusion Management Repository"=2 (0x2)
"ColdFusion Graphing Server"=2 (0x2)
"Cold Fusion RDS"=2 (0x2)
"Cold Fusion Executive"=2 (0x2)
"Cold Fusion Application Server"=2 (0x2)
"ClusterCATS Service"=2 (0x2)
"SQLServerAgent"=3 (0x3)
"MSSQLServer"=3 (0x3)
"gusvc"=3 (0x3)
"IISADMIN"=2 (0x2)
"ColdFusion MX 7 Search Server"=2 (0x2)
"ColdFusion MX 7 ODBC Server"=2 (0x2)
"ColdFusion MX 7 ODBC Agent"=2 (0x2)
"ColdFusion MX 7 Application Server"=2 (0x2)
"MySql"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\SmartFTP Client 2.0\\SmartFTP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=
"c:\\Application Files\\Internet\\NewsReaders\\NewsBin\\nbpro.exe"=
"c:\\Application Files\\Internet\\Browsers\\Opera\\opera.exe"=
"c:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"=
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [6/30/2011 8:06 PM 441176]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [4/5/2008 4:12 AM 309848]
R1 crlscsi;crlscsi;c:\windows\system32\drivers\crlscsi.sys [12/30/2005 6:36 AM 6144]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [4/5/2008 4:12 AM 19544]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\SITEAD~1\mcsacore.exe [11/28/2009 6:14 AM 88176]
R2 WDBtnMgrSvc.exe;WD Drive Manager Service;c:\program files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe [5/16/2008 5:12 PM 102400]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [12/13/2008 12:21 PM 10976]
S3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [3/31/2003 2:00 AM 14336]
S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\drivers\s115bus.sys [12/13/2008 12:46 PM 83208]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\drivers\s115mdfl.sys [12/13/2008 12:46 PM 15112]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\drivers\s115mdm.sys [12/13/2008 12:46 PM 108680]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s115mgmt.sys [12/13/2008 12:47 PM 100488]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\system32\drivers\s115obex.sys [12/13/2008 12:47 PM 98568]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [6/16/2008 2:09 PM 11520]
S4 ColdFusion MX 7 Application Server;ColdFusion MX 7 Application Server;c:\cfusionmx7\runtime\bin\jrunsvc.exe [5/14/2007 6:32 AM 61440]
S4 ColdFusion MX 7 ODBC Agent;ColdFusion MX 7 ODBC Agent;c:\cfusionmx7\db\slserver54\bin\swagent.exe "ColdFusion MX 7 ODBC Agent" --> c:\cfusionmx7\db\slserver54\bin\swagent.exe ColdFusion MX 7 ODBC Agent [?]
S4 ColdFusion MX 7 ODBC Server;ColdFusion MX 7 ODBC Server;c:\cfusionmx7\db\slserver54\bin\swstrtr.exe "ColdFusion MX 7 ODBC Server" --> c:\cfusionmx7\db\slserver54\bin\swstrtr.exe ColdFusion MX 7 ODBC Server [?]
S4 ColdFusion MX 7 Search Server;ColdFusion MX 7 Search Server;c:\cfusionmx7\verity\k2\_nti40\bin\k2admin.exe [5/14/2007 6:31 AM 2732608]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 22:34]
.
2011-07-14 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 05:20]
.
2011-07-14 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-04 01:07]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {01010200-5E80-11D8-9E86-0007E96C65AE} - hxxp://supportcenter.rr.com/sdccommon/download/tgctlins.cab
FF - ProfilePath - c:\documents and settings\Ike\Application Data\Mozilla\Firefox\Profiles\xaac7lao.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - d:\\Data Files\\Work Files\\WebsiteFiles\\HomePage\\Home.htm
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p=
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: McAfee SiteAdvisor: {B7082FAA-CB62-4872-9106-E42DD88EDE45} - c:\program files\McAfee\SiteAdvisor
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-13 19:58
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MySql]
"ImagePath"="C:/mysql/bin/mysqld-nt.exe"
.
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MySql]
"ImagePath"="C:/mysql/bin/mysqld-nt.exe"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\.application\bootstrap]
@DACL=(02 0000)
@="bootstrap.application.1"
.
Completion time: 2011-07-13 20:17:32
ComboFix-quarantined-files.txt 2011-07-14 06:17
.
Pre-Run: 32,056,803,328 bytes free
Post-Run: 32,036,491,264 bytes free
.
Current=3 Default=3 Failed=2 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 9612B8386414F5C0DB7E2947952DCAB2

Edited by ike001, 14 July 2011 - 12:55 AM.


#6 Tomk

Tomk

    Beguilement Monitor

  • Global Moderator
  • 20,451 posts

Posted 14 July 2011 - 12:03 PM

Where are you getting redirected to?
Tomk
------------------------------------------------------------
Microsoft MVP 2010-2014
 

#7 ike001

ike001

    Authentic Member

  • Authentic Member
  • PipPip
  • 36 posts

Posted 14 July 2011 - 03:37 PM

Hello TomK,


Here is what happens:

1. To test things out, I do a search using Google for "WhattheTech."

2. Google returns search results.

3. I click on the link to "forums.whatthetech.com"

4. I get redirected to some URL for a split second, then ultimately redirected to:

http://findjittery.o.....eA11CXUFcA1o=


and it shows a blank page. I'm not clear if it's Avast producing the blank page to protect my computer.



5. Avast gives me that URL blocked message about:

Program Files\Internet Explorer\IExplorer.exe



Further, just a while ago, Avast gave me a message saying:
--------------------------------------------------------------------------------------------------------
A suspicious hidden object (rootkit) has been detected on your system.
This may be a sign of malware infection. It is recommended to remove
the object immediately.


ROOTKIT INFORMATION

Filename Rootkit name

MBR\\.\PHYSICALDRIVE0 Rootkit: hidden boot sector


Actions to take

Delete Now
--------------------------------------------------------------------------------------------------------

So I delete the thing.

Then Avast asks me to finish the cleanup process by running a boot-time scan/
restarting the computer.

So I do the boot-time scan, and it deleted one file. But it couldn't delete another.
So I just ended the boot-time scan.


When my computer booted up again, I got that same Avast message about
"A suspicious hidden object (rootkit) has been detected on your system. "



Anyway, that's what's going on.

And thanks for helping me with this.

Ike

Edited by ike001, 14 July 2011 - 03:41 PM.


#8 Tomk

Tomk

    Beguilement Monitor

  • Global Moderator
  • 20,451 posts

Posted 14 July 2011 - 03:52 PM

ike001,

Let's use an Avast tool to get a little more information.

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
Posted Image

On completion of the scan click save log, save it to your desktop and post in your next reply
Posted Image
Tomk
------------------------------------------------------------
Microsoft MVP 2010-2014
 

#9 ike001

ike001

    Authentic Member

  • Authentic Member
  • PipPip
  • 36 posts

Posted 14 July 2011 - 05:52 PM

Hello TomK, The scan just completed and here is the log: aswMBR version 0.9.7.747 Copyright© 2011 AVAST Software Run date: 2011-07-14 12:22:26 ----------------------------- 12:22:26.859 OS Version: Windows 5.1.2600 Service Pack 3 12:22:26.859 Number of processors: 1 586 0x1C00 12:22:26.859 ComputerName: BUD UserName: 12:22:27.968 Initialize success 12:22:28.218 AVAST engine defs: 11071401 12:24:13.234 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-12 12:24:13.234 Disk 0 Vendor: ST3100011A 3.02 Size: 95396MB BusType: 3 12:24:15.250 Disk 0 MBR read successfully 12:24:15.250 Disk 0 MBR scan 12:24:15.250 Disk 0 MBR:Alureon-I [Rtk] 12:24:15.250 Disk 0 TDL4@MBR code has been found 12:24:15.250 Disk 0 Windows XP default MBR code found via API 12:24:15.265 Disk 0 MBR hidden 12:24:15.265 Disk 0 MBR [TDL4] **ROOTKIT** 12:24:15.265 Disk 0 trace - called modules: 12:24:15.265 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8a9f3f16]<< 12:24:15.281 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8aa1bab8] 12:24:15.281 3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\00000061[0x8a9d49e8] 12:24:15.281 5 ACPI.sys[b9f7f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-12[0x8aa1cd98] 12:24:15.296 \Driver\atapi[0x8aa0a428] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0x8a9f3f16 12:24:15.859 AVAST engine scan C:\WINDOWS 13:07:02.812 AVAST engine scan C:\Documents and Settings\Ike 13:31:13.203 AVAST engine scan C:\Documents and Settings\All Users 13:37:00.609 Scan finished successfully 13:44:53.546 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Ike\Desktop\MBR.dat" 13:44:53.578 The log file has been saved successfully to "C:\Documents and Settings\Ike\Desktop\aswMBR.txt"

#10 Tomk

Tomk

    Beguilement Monitor

  • Global Moderator
  • 20,451 posts

Posted 14 July 2011 - 06:14 PM

Re-Run aswMBR

Click Scan

On completion of the scan

Click the Fix Button

Posted Image


Save the log as before and post in your next reply
Tomk
------------------------------------------------------------
Microsoft MVP 2010-2014
 

    Advertisements

Register to Remove


#11 ike001

ike001

    Authentic Member

  • Authentic Member
  • PipPip
  • 36 posts

Posted 14 July 2011 - 10:14 PM

Hello TomK, The virus appears to be gone (i.e. I did a search via Google for "WhatTheTech," clicked on the link, did not get redirected, and did not get that Malicous URL blocked message.) - so Thank you TomK! I appreciate it! Here is the log: aswMBR version 0.9.7.747 Copyright© 2011 AVAST Software Run date: 2011-07-14 14:31:07 ----------------------------- 14:31:07.234 OS Version: Windows 5.1.2600 Service Pack 3 14:31:07.234 Number of processors: 1 586 0x1C00 14:31:07.234 ComputerName: BUD UserName: 14:31:07.640 Initialize success 14:31:07.703 AVAST engine defs: 11071401 14:31:17.687 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-12 14:31:17.687 Disk 0 Vendor: ST3100011A 3.02 Size: 95396MB BusType: 3 14:31:19.718 Disk 0 MBR read successfully 14:31:19.718 Disk 0 MBR scan 14:31:19.734 Disk 0 MBR:Alureon-I [Rtk] 14:31:19.734 Disk 0 TDL4@MBR code has been found 14:31:19.734 Disk 0 Windows XP default MBR code found via API 14:31:19.750 Disk 0 MBR hidden 14:31:19.750 Disk 0 MBR [TDL4] **ROOTKIT** 14:31:19.750 Disk 0 trace - called modules: 14:31:19.750 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8a9f3f16]<< 14:31:19.750 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8aa1bab8] 14:31:19.765 3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\00000061[0x8a9d49e8] 14:31:19.781 5 ACPI.sys[b9f7f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-12[0x8aa1cd98] 14:31:19.796 \Driver\atapi[0x8aa0a428] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0x8a9f3f16 14:31:20.062 AVAST engine scan C:\WINDOWS 15:05:42.515 AVAST engine scan C:\Documents and Settings\Ike 15:25:42.406 AVAST engine scan C:\Documents and Settings\All Users 15:31:01.906 Scan finished successfully 16:49:29.812 Disk 0 MBR read successfully 16:49:29.812 Disk 0 MBR:Alureon-I [Rtk] 16:49:29.812 Disk 0 TDL4@MBR code has been found 16:49:29.828 Disk 0 fixing MBR ... 16:49:39.875 Disk 0 MBR restored successfully 16:49:39.890 Verifying disinfection 16:49:54.046 Infection fixed successfully - please reboot ASAP 16:51:04.859 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Ike\Desktop\MBR.dat" 16:51:04.859 The log file has been saved successfully to "C:\Documents and Settings\Ike\Desktop\aswMBR-last.txt"

#12 Tomk

Tomk

    Beguilement Monitor

  • Global Moderator
  • 20,451 posts

Posted 15 July 2011 - 10:30 AM

ike001,

Let's tidy up a little.

COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    Firefox::
    FF - ProfilePath - c:\documents and settings\Ike\Application Data\Mozilla\Firefox\Profiles\xaac7lao.default\
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    Posted Image
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Then

Let's get an online scan:

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

  • Please go here then click on: Posted Image

    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

  • Select the option YES, I accept the Terms of Use then click on: Posted Image
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: Posted Image
  • The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on: Posted Image
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!
Tomk
------------------------------------------------------------
Microsoft MVP 2010-2014
 

#13 ike001

ike001

    Authentic Member

  • Authentic Member
  • PipPip
  • 36 posts

Posted 15 July 2011 - 05:25 PM

Hello TomK,

At the very below is the ComboFix log. I will do the online scan now.

As a side note, my computer is running faster, so thank you again!



Here is the log:

ComboFix 11-07-15.02 - Ike 07/15/2011 12:44:32.6.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1982.1446 [GMT -10:00]
Running from: c:\documents and settings\Ike\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Ike\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Firewall *Enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\install.rdf
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\install.rdf
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\install.rdf
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}\install.rdf
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\install.rdf
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\install.rdf
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\install.rdf
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}\install.rdf
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\install.rdf
.
.
((((((((((((((((((((((((( Files Created from 2011-06-15 to 2011-07-15 )))))))))))))))))))))))))))))))
.
.
2011-07-15 22:33 . 2011-06-07 15:55 7074640 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{83734249-B3B3-453B-8FDC-5A8C8B290D22}\mpengine.dll
2011-07-15 06:14 . 2003-06-26 02:05 266360 ----a-w- c:\windows\system32\TweakUI.exe
2011-07-13 21:03 . 2011-07-13 21:03 -------- d-----w- C:\_OTL
2011-07-11 04:40 . 2011-07-11 04:40 -------- d-----w- c:\documents and settings\Ike\Local Settings\Application Data\PCHealth
2011-07-01 06:06 . 2011-07-04 11:36 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-06-22 10:12 . 2011-03-18 11:24 69120 ----a-w- c:\windows\system32\zlcomm.dll
2011-06-22 10:12 . 2011-03-18 11:24 104448 ----a-w- c:\windows\system32\zlcommdb.dll
2011-06-16 01:32 . 2011-04-21 13:37 105472 -c----w- c:\windows\system32\dllcache\mup.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-04 11:43 . 2010-07-30 00:09 40112 ----a-w- c:\windows\avastSS.scr
2011-07-04 11:43 . 2005-12-29 03:14 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-07-04 11:36 . 2008-04-05 14:12 309848 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-07-04 11:35 . 2005-12-29 04:10 43608 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-07-04 11:35 . 2005-12-29 04:10 102616 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-07-04 11:35 . 2005-12-29 04:10 96344 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-07-04 11:32 . 2005-12-29 03:14 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-07-04 11:32 . 2005-12-29 04:10 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-07-04 11:32 . 2008-04-05 14:12 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-06-26 08:49 . 2011-05-13 02:10 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-07 15:55 . 2009-01-11 14:50 7074640 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2011-06-02 14:02 . 2003-03-31 12:00 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-05-25 05:14 . 2009-10-02 23:13 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-05-04 14:52 . 2010-04-16 04:43 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-05-04 12:25 . 2008-01-16 16:24 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-05-02 15:31 . 2005-12-28 21:39 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25 . 2003-03-31 12:00 151552 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19 . 2003-03-31 12:00 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-26 11:07 . 2003-03-31 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2011-04-26 11:07 . 2003-03-31 12:00 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-04-25 15:51 . 2005-10-21 22:51 832512 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 15:51 . 2004-08-04 07:56 78336 ----a-w- c:\windows\system32\ieencode.dll
2011-04-25 15:51 . 2003-03-31 12:00 1830912 ----a-w- c:\windows\system32\inetcpl.cpl
2011-04-25 15:51 . 2003-03-31 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2011-04-25 12:01 . 2004-08-04 05:59 389120 ----a-w- c:\windows\system32\html.iec
2011-04-21 13:37 . 2003-03-31 12:00 105472 ----a-w- c:\windows\system32\drivers\mup.sys
2006-05-03 09:06 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 10:47 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 12:30 216064 --sh--r- c:\windows\system32\nbDX.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-07-14_05.59.17 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-07-15 22:28 . 2011-07-15 22:28 16384 c:\windows\TEMP\Perflib_Perfdata_3ac.dat
+ 2011-07-15 13:18 . 2011-07-15 13:18 339968 c:\windows\erdnt\AutoBackup\7-15-2011\Users\00000002\UsrClass.dat
+ 2011-07-15 13:18 . 2005-10-20 22:02 163328 c:\windows\erdnt\AutoBackup\7-15-2011\ERDNT.EXE
+ 2011-07-14 19:51 . 2011-07-14 19:51 339968 c:\windows\erdnt\AutoBackup\7-14-2011\Users\00000002\UsrClass.dat
+ 2011-07-14 19:51 . 2005-10-20 22:02 163328 c:\windows\erdnt\AutoBackup\7-14-2011\ERDNT.EXE
+ 2011-07-15 13:18 . 2011-07-15 13:18 21708800 c:\windows\erdnt\AutoBackup\7-15-2011\Users\00000001\NTUSER.DAT
+ 2011-07-14 19:51 . 2011-07-14 19:51 21708800 c:\windows\erdnt\AutoBackup\7-14-2011\Users\00000001\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 122512 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" [2005-03-08 53248]
"VTTrayp"="VTtrayp.exe" [2005-08-04 163840]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb06.exe" [2008-01-16 188416]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2008-01-16 185896]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2008-01-16 75304]
"WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2008-01-16 20480]
"ScanSoft OmniPage SE 4.0-reminder"="c:\program files\ScanSoft\OmniPageSE4.0\Ereg\Ereg.exe" [2008-01-16 1410600]
"WD Drive Manager"="c:\program files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe" [2008-05-17 430080]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-06-15 68592]
"QuickTime Task"="c:\application files\multimedia\video\quicktime\qttask.exe" [2009-01-06 413696]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2011-03-18 1043968]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-23 39264]
.
c:\documents and settings\Ike\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "c:\program files\Qualcomm\Eudora\EuShlExt.dll" [2006-08-18 86016]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk]
backup=c:\windows\pss\Service Manager.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Ike^Start Menu^Programs^Startup^WinMySQLadmin.lnk]
backup=c:\windows\pss\WinMySQLadmin.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2005-06-07 09:46 57344 ----a-w- c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-05-12 09:12 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD08]
2005-06-01 16:35 49152 ----a-w- c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-01-06 02:18 413696 ----a-w- c:\application files\Multimedia\Video\quicktime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-04-07 05:27 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ColdFusion Management Service"=2 (0x2)
"ColdFusion Management Repository"=2 (0x2)
"ColdFusion Graphing Server"=2 (0x2)
"Cold Fusion RDS"=2 (0x2)
"Cold Fusion Executive"=2 (0x2)
"Cold Fusion Application Server"=2 (0x2)
"ClusterCATS Service"=2 (0x2)
"SQLServerAgent"=3 (0x3)
"MSSQLServer"=3 (0x3)
"gusvc"=3 (0x3)
"IISADMIN"=2 (0x2)
"ColdFusion MX 7 Search Server"=2 (0x2)
"ColdFusion MX 7 ODBC Server"=2 (0x2)
"ColdFusion MX 7 ODBC Agent"=2 (0x2)
"ColdFusion MX 7 Application Server"=2 (0x2)
"MySql"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\SmartFTP Client 2.0\\SmartFTP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=
"c:\\Application Files\\Internet\\NewsReaders\\NewsBin\\nbpro.exe"=
"c:\\Application Files\\Internet\\Browsers\\Opera\\opera.exe"=
"c:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"=
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [6/30/2011 8:06 PM 441176]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [4/5/2008 4:12 AM 309848]
R1 crlscsi;crlscsi;c:\windows\system32\drivers\crlscsi.sys [12/30/2005 6:36 AM 6144]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [4/5/2008 4:12 AM 19544]
R2 WDBtnMgrSvc.exe;WD Drive Manager Service;c:\program files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe [5/16/2008 5:12 PM 102400]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\SITEAD~1\mcsacore.exe [11/28/2009 6:14 AM 88176]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [12/13/2008 12:21 PM 10976]
S3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [3/31/2003 2:00 AM 14336]
S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\drivers\s115bus.sys [12/13/2008 12:46 PM 83208]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\drivers\s115mdfl.sys [12/13/2008 12:46 PM 15112]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\drivers\s115mdm.sys [12/13/2008 12:46 PM 108680]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s115mgmt.sys [12/13/2008 12:47 PM 100488]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\system32\drivers\s115obex.sys [12/13/2008 12:47 PM 98568]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [6/16/2008 2:09 PM 11520]
S4 ColdFusion MX 7 Application Server;ColdFusion MX 7 Application Server;c:\cfusionmx7\runtime\bin\jrunsvc.exe [5/14/2007 6:32 AM 61440]
S4 ColdFusion MX 7 ODBC Agent;ColdFusion MX 7 ODBC Agent;c:\cfusionmx7\db\slserver54\bin\swagent.exe "ColdFusion MX 7 ODBC Agent" --> c:\cfusionmx7\db\slserver54\bin\swagent.exe ColdFusion MX 7 ODBC Agent [?]
S4 ColdFusion MX 7 ODBC Server;ColdFusion MX 7 ODBC Server;c:\cfusionmx7\db\slserver54\bin\swstrtr.exe "ColdFusion MX 7 ODBC Server" --> c:\cfusionmx7\db\slserver54\bin\swstrtr.exe ColdFusion MX 7 ODBC Server [?]
S4 ColdFusion MX 7 Search Server;ColdFusion MX 7 Search Server;c:\cfusionmx7\verity\k2\_nti40\bin\k2admin.exe [5/14/2007 6:31 AM 2732608]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 22:34]
.
2011-07-15 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 05:20]
.
2011-07-15 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-04 01:07]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 24.25.227.55 209.18.47.61 24.25.227.53
DPF: {01010200-5E80-11D8-9E86-0007E96C65AE} - hxxp://supportcenter.rr.com/sdccommon/download/tgctlins.cab
FF - ProfilePath - c:\documents and settings\Ike\Application Data\Mozilla\Firefox\Profiles\xaac7lao.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - d:\\Data Files\\Work Files\\WebsiteFiles\\HomePage\\Home.htm
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p=
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: McAfee SiteAdvisor: {B7082FAA-CB62-4872-9106-E42DD88EDE45} - c:\program files\McAfee\SiteAdvisor
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-15 13:02
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MySql]
"ImagePath"="C:/mysql/bin/mysqld-nt.exe"
.
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MySql]
"ImagePath"="C:/mysql/bin/mysqld-nt.exe"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\.application\bootstrap]
@DACL=(02 0000)
@="bootstrap.application.1"
.
Completion time: 2011-07-15 13:08:31
ComboFix-quarantined-files.txt 2011-07-15 23:08
ComboFix2.txt 2011-07-14 06:22
.
Pre-Run: 31,719,002,112 bytes free
Post-Run: 31,630,569,472 bytes free
.
Current=3 Default=3 Failed=2 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - EDE34CB2AEA8CC405163A72C087FADC1

#14 ike001

ike001

    Authentic Member

  • Authentic Member
  • PipPip
  • 36 posts

Posted 15 July 2011 - 10:17 PM

Hello TomK, If you need me to run the online scanner again, I will. After the scan ended, I took down these notes: ----------------------------------------------------------- Scan Results Threats found! Scanned Files: 322,441 Infected Files: 9 Cleaned Files: 0 Total Scan Time: 03:00:57 Scan status: Finished C:\Documents and Settings\Ike\Desktop\System Tools\VundoFix\process.exe Win32/PrcView application D:\Data Files\Software Downloads\Internet\FileRetrievers\FrostWire\frostwire-4.13.4.windows.exe a variant of Win32/AdInstaller application D:\Data Files\Software Downloads\Utilities\Converters\WMA Converter\Setup_FreeConverter.exe Win32/Adware.Toolbar.Dealio application D:\Data Files\Software Downloads\Utilities\Firewall\ZoneAlarm\2008-07-09-Fix\zlsSetup_70_483_000_en.exe a variant of Win32/AdInstaller application D:\Data Files\Software Downloads\Utilities\Firewall\ZoneAlarm\Build_70_462_000\zlsSetup_70_462_000_en.exe a variant of Win32/AdInstaller application D:\Data Files\Software Downloads\Utilities\_Remore Virus Stuff 1-10-2009\SD Fix\SDFix.exe Win32/PrcView application D:\Old Computer Files\_Drive-E\OldOldDrive\OldD\Internet\Eudora4.3.1\Downloads\heat.exe probably a variant of Win32/Agent.DAPGUXD trojan D:\Old Computer Files\_Drive-E\OldOldDrive\OldF\Zipped\Internet\Winsocks\Trumpet32\twsk30d.zip Win16/Flooder.ICMP.ICMPBomb.A trojan D:\Old Computer Files\_Drive-E\Software Downloads\MediaEditing\FlashMXServer1.5\Flash5Cra.zip probably a variant of Win32/Agent.NJOBVXP trojan ----------------------------------------------------------- I then took a look at the log file. The bottom part of the log file was very similar to above. But I forgot to save the log file before uninstalling. Which is why I say, I can run the scanner again, if you need me to. My question is, may I go ahead and delete the files listed above? Thank you, Ike

Edited by ike001, 15 July 2011 - 10:18 PM.


#15 Tomk

Tomk

    Beguilement Monitor

  • Global Moderator
  • 20,451 posts

Posted 15 July 2011 - 10:27 PM

ike001,

The information you provided is sufficient.

Mostly everything there is "old" infections. Stuff not seen often anymore. Your D: drive must be backups?

COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    File::
    C:\Documents and Settings\Ike\Desktop\System Tools\VundoFix\process.exe 
    D:\Data Files\Software Downloads\Utilities\Converters\WMA Converter\Setup_FreeConverter.exe
    D:\Data Files\Software Downloads\Utilities\Firewall\ZoneAlarm\2008-07-09-Fix\zlsSetup_70_483_000_en.exe 
    D:\Data Files\Software Downloads\Utilities\Firewall\ZoneAlarm\Build_70_462_000\zlsSetup_70_462_000_en.exe
    D:\Old Computer Files\_Drive-E\OldOldDrive\OldD\Internet\Eudora4.3.1\Downloads\heat.exe
    D:\Old Computer Files\_Drive-E\OldOldDrive\OldF\Zipped\Internet\Winsocks\Trumpet32\twsk30d.zip
    D:\Old Computer Files\_Drive-E\Software Downloads\MediaEditing\FlashMXServer1.5\Flash5Cra.zip
    
    Folder::
    D:\Data Files\Software Downloads\Utilities\_Remore Virus Stuff 1-10-2009
    D:\Data Files\Software Downloads\Internet\FileRetrievers\FrostWire
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    Posted Image
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Tomk
------------------------------------------------------------
Microsoft MVP 2010-2014
 

Related Topics



0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users