[Resolved] malware

Hi Essexboy,

Thank you for picking this up for me.
I rewrote this and saved it for future reference, and anyone else that wants to learn about this.

(L) = license required to clean

Status

Name

Threat Identified

(L) THREAT

c:\hp\recovery\wizard\swr_wizard.exe

High Risk Worm

(L) THREAT

\??\C:\Documents and settings\All Users\Start Menu\Progra…

infected entry [swr_…

(L) THREAT

\??\C:\hp\recovery\links\Software Repair Wizard Inc

infected entry [swr_…

(L) THREAT

\??\C:\hp\recovery\links\recovery.Ink

infected entry

(L) THREAT

\??\C:\hp\recovery\wizard\SWRW.Ink

infected entry [swr_…

Then of course there is a button down here that says "Run Cleanup".

When I hit the run cleanup button, it takes me to a page where I can purchase their product. Nice little scam, ugh?
These fine people are so intent on selling you their fine software, they will infect your machine.
Then, out of the kindness of their hearts, they will sell you their product so you can be rid of the terrible things they put on it.

Here is the copy of the log you requested, sir :


OTScanIt2 logfile created on: 4/25/2009 1:44:02 PM - Run 1
OTScanIt2 by OldTimer - Version 1.0.14.0 Folder = C:\Documents and Settings\Compaq_Owner\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

702.48 Mb Total Physical Memory | 377.70 Mb Available Physical Memory | 53.77% Memory free
1.77 Gb Paging File | 1.46 Gb Available in Paging File | 82.12% Paging File free
Paging file location(s): C:\pagefile.sys 1152 2304;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 68.02 Gb Total Space | 62.38 Gb Free Space | 91.71% Space Free | Partition Type: NTFS
Drive D: | 6.50 Gb Total Space | 1.83 Gb Free Space | 28.21% Space Free | Partition Type: FAT32
Drive E: | 1.08 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: YOUR-27E1513D96
Current User Name: Compaq_Owner
Logged in as Administrator.

Current Boot Mode: Normal



My apologies for not attaching it as you requested, but the place below where I would normally attach an item appears to be missing from my page. :wacko:

OK can you upload to Mediafire and post the sharing link as I need the entire log

Essexboy, I cannot get the page to load. The load bar gets about half way loaded, then appears to time out on me.

Essexboy, I uninstalled the application with Revo Uninstaller.

Essexboy,

will this work for you?

OTScanIt2 logfile created on: 4/25/2009 3:52:35 PM - Run 3
OTScanIt2 by OldTimer - Version 1.0.14.0	 Folder = C:\Documents and Settings\Compaq_Owner\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
702.48 Mb Total Physical Memory | 423.68 Mb Available Physical Memory | 60.31% Memory free
1.77 Gb Paging File | 1.49 Gb Available in Paging File | 83.99% Paging File free
Paging file location(s): C:\pagefile.sys 1152 2304;
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 68.02 Gb Total Space | 62.35 Gb Free Space | 91.66% Space Free | Partition Type: NTFS
Drive D: | 6.50 Gb Total Space | 1.83 Gb Free Space | 28.21% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: YOUR-27E1513D96
Current User Name: Compaq_Owner
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Whitelist: On
File Age = 30 Days
 
[Processes - Safe List]
a2service.exe -> %ProgramFiles%\a-squared Free\a2service.exe -> [2009/02/25 19:18:14 | 00,425,080 | —- | M] (Emsi Software GmbH)
alcxmntr.exe -> %SystemRoot%\ALCXMNTR.EXE -> [2004/09/07 15:47:52 | 00,057,344 | —- | M] (Realtek Semiconductor Corp.)
ashdisp.exe -> %ProgramFiles%\Alwil Software\Avast4\ashDisp.exe -> [2009/02/05 16:08:45 | 00,081,000 | —- | M] (ALWIL Software)
ashserv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashServ.exe -> [2009/02/05 16:08:40 | 00,138,680 | —- | M] (ALWIL Software)
aswupdsv.exe -> %ProgramFiles%\Alwil Software\Avast4\aswUpdSv.exe -> [2009/02/05 16:01:25 | 00,018,752 | —- | M] (ALWIL Software)
ati2evxx.exe -> %SystemRoot%\system32\Ati2evxx.exe -> [2005/06/08 00:38:32 | 00,376,832 | —- | M] (ATI Technologies Inc.)
ati2evxx.exe -> %SystemRoot%\system32\Ati2evxx.exe -> [2005/06/08 00:38:32 | 00,376,832 | —- | M] (ATI Technologies Inc.)
atiptaxx.exe -> %ProgramFiles%\ATI Technologies\ATI Control Panel\atiptaxx.exe -> [2005/06/08 06:05:00 | 00,344,064 | —- | M] (ATI Technologies, Inc.)
explorer.exe -> %SystemRoot%\Explorer.EXE -> [2007/06/13 05:23:07 | 01,033,216 | —- | M] (Microsoft Corporation)
hpsysdrv.exe -> %SystemRoot%\system\hpsysdrv.exe -> [1998/05/07 11:04:38 | 00,052,736 | —- | M] (Hewlett-Packard Company)
jqs.exe -> %ProgramFiles%\Java\jre6\bin\jqs.exe -> [2009/03/31 19:23:45 | 00,152,984 | —- | M] (Sun Microsystems, Inc.)
mdm.exe -> %CommonProgramFiles%\Microsoft Shared\VS7DEBUG\MDM.EXE -> [2003/06/20 08:25:00 | 00,322,120 | —- | M] (Microsoft Corporation)
oacat.exe -> %ProgramFiles%\Tall Emu\Online Armor\oacat.exe -> [2009/02/13 11:29:26 | 00,495,304 | —- | M] (Tall Emu)
otscanit2.exe -> %UserProfile%\Desktop\OTScanIt2.exe -> [2009/04/11 16:32:52 | 00,494,080 | —- | M] (OldTimer Tools)
wdfmgr.exe -> %SystemRoot%\system32\wdfmgr.exe -> [2004/08/11 10:45:04 | 00,038,912 | —- | M] (Microsoft Corporation)
wscntfy.exe -> %SystemRoot%\system32\wscntfy.exe -> [2004/08/04 07:00:00 | 00,013,824 | —- | M] (Microsoft Corporation)
 
[Win32 Services - Safe List]
(a2free) a-squared Free Service [Win32_Own | Auto | Running] -> %ProgramFiles%\a-squared Free\a2service.exe -> [2009/02/25 19:18:14 | 00,425,080 | —- | M] (Emsi Software GmbH)
(aspnet_state) ASP.NET State Service [Win32_Own | On_Demand | Stopped] -> %SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe -> [2004/07/15 10:49:26 | 00,032,768 | —- | M] (Microsoft Corporation)
(aswUpdSv) avast! iAVS4 Control Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Alwil Software\Avast4\aswUpdSv.exe -> [2009/02/05 16:01:25 | 00,018,752 | —- | M] (ALWIL Software)
(Ati HotKey Poller) Ati HotKey Poller [Win32_Own | Auto | Running] -> %SystemRoot%\system32\Ati2evxx.exe -> [2005/06/08 00:38:32 | 00,376,832 | —- | M] (ATI Technologies Inc.)
(avast! Antivirus) avast! Antivirus [Win32_Own | Auto | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashServ.exe -> [2009/02/05 16:08:40 | 00,138,680 | —- | M] (ALWIL Software)
(avast! Mail Scanner) avast! Mail Scanner [Win32_Own | On_Demand | Stopped] -> %ProgramFiles%\Alwil Software\Avast4\ashMaiSv.exe -> [2009/02/05 16:08:26 | 00,254,040 | —- | M] (ALWIL Software)
(avast! Web Scanner) avast! Web Scanner [Win32_Own | On_Demand | Stopped] -> %ProgramFiles%\Alwil Software\Avast4\ashWebSv.exe -> [2009/02/05 16:06:04 | 00,352,920 | —- | M] (ALWIL Software)
(helpsvc) Help and Support [Win32_Shared | Auto | Running] -> %SystemRoot%\PCHealth\HelpCtr\Binaries\pchsvc.dll -> [2004/08/04 07:00:00 | 00,038,912 | —- | M] (Microsoft Corporation)
(IDriverT) InstallDriver Table Manager [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\InstallShield\Driver\1050\Intel 32\IDriverT.exe -> [2004/10/22 12:24:18 | 00,073,728 | —- | M] (Macrovision Corporation)
(JavaQuickStarterService) Java Quick Starter [Win32_Own | Auto | Running] -> %ProgramFiles%\Java\jre6\bin\jqs.exe -> [2009/03/31 19:23:45 | 00,152,984 | —- | M] (Sun Microsystems, Inc.)
(MDM) Machine Debug Manager [Win32_Own | Auto | Running] -> %CommonProgramFiles%\Microsoft Shared\VS7DEBUG\MDM.EXE -> [2003/06/20 08:25:00 | 00,322,120 | —- | M] (Microsoft Corporation)
(OAcat) Online Armor Helper Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Tall Emu\Online Armor\oacat.exe -> [2009/02/13 11:29:26 | 00,495,304 | —- | M] (Tall Emu)
(SvcOnlineArmor) Online Armor [Win32_Own | Auto | Stopped] -> %ProgramFiles%\Tall Emu\Online Armor\oasrv.exe -> [2009/02/13 11:29:20 | 03,093,704 | —- | M] (Tall Emu)
(UMWdf) Windows User Mode Driver Framework [Win32_Own | Auto | Running] -> %SystemRoot%\system32\wdfmgr.exe -> [2004/08/11 10:45:04 | 00,038,912 | —- | M] (Microsoft Corporation)
 
[Driver Services - Safe List]
(Aavmker4) avast! Asynchronous Virus Monitor [Kernel | System | Running] -> %SystemRoot%\System32\drivers\aavmker4.sys -> [2009/02/05 16:05:11 | 00,026,944 | —- | M] (ALWIL Software)
(ALCXWDM) Service for Realtek AC97 Audio (WDM) [Kernel | On_Demand | Running] -> %SystemRoot%\system32\drivers\ALCXWDM.SYS -> [2005/04/20 13:00:56 | 02,317,696 | —- | M] (Realtek Semiconductor Corp.)
(AmdK8) AMD Processor Driver [Kernel | System | Running] -> %SystemRoot%\system32\DRIVERS\AmdK8.sys -> [2005/03/09 16:53:00 | 00,036,352 | —- | M] (Advanced Micro Devices)
(aswFsBlk) aswFsBlk [File_System | Auto | Running] -> %SystemRoot%\system32\DRIVERS\aswFsBlk.sys -> [2009/02/05 16:07:12 | 00,020,560 | —- | M] (ALWIL Software)
(aswMon2) avast! Standard Shield Support [File_System | Auto | Running] -> %SystemRoot%\System32\drivers\aswmon2.sys -> [2009/02/05 16:08:10 | 00,094,032 | —- | M] (ALWIL Software)
(aswRdr) aswRdr [Kernel | On_Demand | Running] -> %SystemRoot%\System32\drivers\aswRdr.sys -> [2009/02/05 16:06:10 | 00,023,152 | —- | M] (ALWIL Software)
(aswSP) avast! Self Protection [Kernel | System | Running] -> %SystemRoot%\System32\drivers\aswSP.sys -> [2009/02/05 16:07:23 | 00,114,768 | —- | M] (ALWIL Software)
(aswTdi) avast! Network Shield Support [Kernel | System | Running] -> %SystemRoot%\System32\drivers\aswTdi.sys -> [2009/02/05 16:06:20 | 00,051,376 | —- | M] (ALWIL Software)
(ati2mtag) ati2mtag [Kernel | On_Demand | Running] -> %SystemRoot%\system32\DRIVERS\ati2mtag.sys -> [2005/06/08 00:44:36 | 01,235,968 | —- | M] (ATI Technologies Inc.)
(bb-run) Promise driver accelerator [Kernel | Boot | Running] -> %SystemRoot%\system32\DRIVERS\bb-run.sys -> [2003/11/05 17:45:12 | 00,017,408 | —- | M] (Promise Technology, Inc.)
(ftsata2) ftsata2 [Kernel | Boot | Running] -> %SystemRoot%\system32\DRIVERS\ftsata2.sys -> [2005/04/14 23:12:12 | 00,175,616 | —- | M] (Promise Technology, Inc.)
(HCF_MSFT) HCF_MSFT [Kernel | On_Demand | Running] -> %SystemRoot%\system32\DRIVERS\HCF_MSFT.sys -> [2001/08/17 16:28:02 | 00,907,456 | —- | M] (Conexant)
(iaStor) Intel RAID Controller [Kernel | Boot | Running] -> %SystemRoot%\system32\DRIVERS\iaStor.sys -> [2005/03/09 20:09:18 | 00,870,912 | —- | M] (Intel Corporation)
(OADevice) OADriver [Kernel | System | Running] -> %SystemRoot%\system32\drivers\OADriver.sys -> [2009/02/13 10:59:12 | 00,190,664 | —- | M] (Tall Emu)
(OAmon) OAmon [Kernel | System | Running] -> %SystemRoot%\system32\drivers\OAmon.sys -> [2009/02/13 10:59:26 | 00,029,384 | —- | M] (Tall Emu)
(OAnet) OAnet [Kernel | System | Running] -> %SystemRoot%\system32\drivers\OAnet.sys -> [2009/02/13 11:29:52 | 00,028,872 | —- | M] (Tall Emu Pty Ltd)
(Ptilink) Direct Parallel Link Driver [Kernel | On_Demand | Running] -> %SystemRoot%\system32\DRIVERS\ptilink.sys -> [2004/08/04 07:00:00 | 00,017,792 | —- | M] (Parallel Technologies, Inc.)
(RTL8023xp) Realtek 10/100/1000 NIC Family all in one NDIS XP Driver [Kernel | On_Demand | Stopped] -> %SystemRoot%\system32\DRIVERS\Rtlnicxp.sys -> [2005/03/04 13:10:26 | 00,074,496 | —- | M] (Realtek Semiconductor Corporation						   )
(rtl8139) Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver [Kernel | On_Demand | Stopped] -> %SystemRoot%\system32\DRIVERS\RTL8139.SYS -> [2004/08/04 00:31:34 | 00,020,992 | —- | M] (Realtek Semiconductor Corporation)
(Secdrv) Secdrv [Kernel | On_Demand | Stopped] -> %SystemRoot%\system32\DRIVERS\secdrv.sys -> [2007/11/13 05:25:53 | 00,020,480 | —- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
 
[Registry - Safe List]
< Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Page_URL" -> http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser -> 
HKEY_LOCAL_MACHINE\: Main\\"Default_Search_URL" -> http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser -> 
HKEY_LOCAL_MACHINE\: Main\\"Local Page" -> %SystemRoot%\system32\blank.htm -> 
HKEY_LOCAL_MACHINE\: Main\\"Search Page" -> http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser -> 
HKEY_LOCAL_MACHINE\: Main\\"Start Page" -> http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser -> 
HKEY_LOCAL_MACHINE\: Search\\"CustomizeSearch" -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm -> 
HKEY_LOCAL_MACHINE\: Search\\"SearchAssistant" -> http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser -> 
< Internet Explorer Settings [HKEY_USERS\.DEFAULT\] > -> -> 
HKEY_USERS\.DEFAULT\: Main\\"Default_Page_URL" -> http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser -> 
HKEY_USERS\.DEFAULT\: Main\\"Default_Search_URL" -> http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser -> 
HKEY_USERS\.DEFAULT\: Main\\"Search Page" -> http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser -> 
HKEY_USERS\.DEFAULT\: Main\\"Start Page" -> http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser -> 
HKEY_USERS\.DEFAULT\: SearchURL\\"" ->  -> 
HKEY_USERS\.DEFAULT\: SearchURL\\"provider" ->  -> 
HKEY_USERS\.DEFAULT\: "ProxyEnable" -> 0 -> 
< Internet Explorer Settings [HKEY_USERS\S-1-5-18\] > -> -> 
HKEY_USERS\S-1-5-18\: Main\\"Default_Page_URL" -> http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser -> 
HKEY_USERS\S-1-5-18\: Main\\"Default_Search_URL" -> http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser -> 
HKEY_USERS\S-1-5-18\: Main\\"Search Page" -> http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser -> 
HKEY_USERS\S-1-5-18\: Main\\"Start Page" -> http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser -> 
HKEY_USERS\S-1-5-18\: SearchURL\\"" ->  -> 
HKEY_USERS\S-1-5-18\: SearchURL\\"provider" ->  -> 
HKEY_USERS\S-1-5-18\: "ProxyEnable" -> 0 -> 
< Internet Explorer Settings [HKEY_USERS\S-1-5-19\] > -> -> 
< Internet Explorer Settings [HKEY_USERS\S-1-5-20\] > -> -> 
< Internet Explorer Settings [HKEY_USERS\S-1-5-21-2365619619-2033096897-2952368886-1009\] > -> -> 
HKEY_USERS\S-1-5-21-2365619619-2033096897-2952368886-1009\: Main\\"Default_Page_URL" -> http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser -> 
HKEY_USERS\S-1-5-21-2365619619-2033096897-2952368886-1009\: Main\\"Default_Search_URL" -> http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser -> 
HKEY_USERS\S-1-5-21-2365619619-2033096897-2952368886-1009\: Main\\"Local Page" -> C:\WINDOWS\system32\blank.htm -> 
HKEY_USERS\S-1-5-21-2365619619-2033096897-2952368886-1009\: Main\\"Page_Transitions" -> Reg Error: Invalid data type. -> 
HKEY_USERS\S-1-5-21-2365619619-2033096897-2952368886-1009\: Main\\"Search Page" -> http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser -> 
HKEY_USERS\S-1-5-21-2365619619-2033096897-2952368886-1009\: Main\\"Start Page" -> http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=presario&pf=desktop&parm1=seconduser -> 
HKEY_USERS\S-1-5-21-2365619619-2033096897-2952368886-1009\: SearchURL\\"" -> http://www.google.com/keyword/%s -> 
HKEY_USERS\S-1-5-21-2365619619-2033096897-2952368886-1009\: SearchURL\\"provider" -> gogl -> 
HKEY_USERS\S-1-5-21-2365619619-2033096897-2952368886-1009\: "ProxyEnable" -> 0 -> 
< FireFox Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla
HKLM\software\mozilla\Firefox\extensions ->  -> 
HKLM\software\mozilla\Firefox\extensions\\[removed] -> %ProgramFiles%\JAVA\JRE6\LIB\DEPLOY\JQS\FF [C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF] -> [2009/03/31 19:23:48 | 00,000,000 | —D | M]
HKLM\software\mozilla\Mozilla Firefox 3.0.9\extensions ->  -> 
HKLM\software\mozilla\Mozilla Firefox 3.0.9\extensions\\Components -> %ProgramFiles%\MOZILLA FIREFOX\COMPONENTS [C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS] -> [2009/04/22 15:48:05 | 00,000,000 | —D | M]
HKLM\software\mozilla\Mozilla Firefox 3.0.9\extensions\\Plugins -> %ProgramFiles%\MOZILLA FIREFOX\PLUGINS [C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS] -> [2009/04/22 15:48:05 | 00,000,000 | —D | M]
< FireFox Extensions [User Folders] > -> 
 -> C:\Documents and Settings\Compaq_Owner\Application Data\mozilla\Extensions -> [2009/03/31 20:01:59 | 00,000,813 | —- | M] ()
 -> C:\Documents and Settings\Compaq_Owner\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} -> [2009/03/31 20:01:59 | 00,000,813 | —- | M] ()
 -> C:\Documents and Settings\Compaq_Owner\Application Data\mozilla\Firefox\Profiles\[removed]\extensions -> [2009/04/22 15:48:32 | 00,096,857 | —- | M] ()
 -> C:\Documents and Settings\Compaq_Owner\Application Data\mozilla\Firefox\Profiles\[removed]\extensions\{27c60876-b5c9-4335-b4f3-52b26782220c} -> [2009/04/22 15:48:32 | 00,096,857 | —- | M] ()
 -> C:\Documents and Settings\Compaq_Owner\Application Data\mozilla\Firefox\Profiles\[removed]\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670} -> [2009/04/22 15:48:32 | 00,096,857 | —- | M] ()
 -> C:\Documents and Settings\Compaq_Owner\Application Data\mozilla\Firefox\Profiles\[removed]\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} -> [2009/04/22 15:48:32 | 00,096,857 | —- | M] ()
 -> C:\Documents and Settings\Compaq_Owner\Application Data\mozilla\Firefox\Profiles\[removed]\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3} -> [2009/04/22 15:48:32 | 00,096,857 | —- | M] ()
 -> C:\Documents and Settings\Compaq_Owner\Application Data\mozilla\Firefox\Profiles\[removed]\extensions\[removed] -> [2009/04/22 15:48:32 | 00,096,857 | —- | M] ()
< FireFox Extensions [Program Folders] > -> 
 -> C:\PROGRAM FILES\MOZILLA FIREFOX\extensions -> [2009/04/22 15:48:05 | 09,758,200 | —- | M] (Mozilla Foundation)
 -> C:\PROGRAM FILES\MOZILLA FIREFOX\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} -> [2009/04/22 15:48:05 | 09,758,200 | —- | M] (Mozilla Foundation)
 -> C:\PROGRAM FILES\MOZILLA FIREFOX\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} -> [2009/04/22 15:48:05 | 09,758,200 | —- | M] (Mozilla Foundation)
< FireFox Components [Program Folders] > -> 
C:\PROGRAM FILES\MOZILLA FIREFOX\components\ -> C:\PROGRAM FILES\MOZILLA FIREFOX\components -> [2009/04/22 15:48:05 | 00,000,000 | —D | M]
browserdirprovider.dll -> C:\PROGRAM FILES\MOZILLA FIREFOX\components\browserdirprovider.dll -> [2009/04/22 15:47:58 | 00,023,032 | —- | M] (Mozilla Foundation)
brwsrcmp.dll -> C:\PROGRAM FILES\MOZILLA FIREFOX\components\brwsrcmp.dll -> [2009/04/22 15:47:58 | 00,134,648 | —- | M] (Mozilla Foundation)
< FireFox Plugins [Program Folders] > -> 
C:\PROGRAM FILES\MOZILLA FIREFOX\plugins\ -> C:\PROGRAM FILES\MOZILLA FIREFOX\plugins -> [2009/04/22 15:48:05 | 00,000,000 | —D | M]
npdeploytk.dll -> C:\PROGRAM FILES\MOZILLA FIREFOX\plugins\npdeploytk.dll -> [2009/03/31 19:23:46 | 00,410,984 | —- | M] (Sun Microsystems, Inc.)
npnul32.dll -> C:\PROGRAM FILES\MOZILLA FIREFOX\plugins\npnul32.dll -> [2009/04/22 15:48:00 | 00,065,528 | —- | M] (mozilla.org)
npqtplugin.dll -> C:\PROGRAM FILES\MOZILLA FIREFOX\plugins\npqtplugin.dll -> [2009/04/03 12:55:26 | 00,143,360 | —- | M] (Apple Inc.)
npqtplugin2.dll -> C:\PROGRAM FILES\MOZILLA FIREFOX\plugins\npqtplugin2.dll -> [2009/04/03 12:55:26 | 00,143,360 | —- | M] (Apple Inc.)
npqtplugin3.dll -> C:\PROGRAM FILES\MOZILLA FIREFOX\plugins\npqtplugin3.dll -> [2009/04/03 12:55:26 | 00,143,360 | —- | M] (Apple Inc.)
QuickTimePlugin.class -> C:\PROGRAM FILES\MOZILLA FIREFOX\plugins\QuickTimePlugin.cla -> [2009/04/03 12:55:26 | 00,004,208 | —- | M] ()
< FireFox SearchPlugins [Program Folders] > -> 
C:\PROGRAM FILES\MOZILLA FIREFOX\searchplugins\ -> C:\PROGRAM FILES\MOZILLA FIREFOX\searchplugins -> [2009/03/31 20:19:20 | 00,000,000 | —D | M]
amazondotcom.xml -> C:\PROGRAM FILES\MOZILLA FIREFOX\searchplugins\amazondotcom.xml -> [2009/03/26 13:56:22 | 00,001,394 | —- | M] ()
answers.xml -> C:\PROGRAM FILES\MOZILLA FIREFOX\searchplugins\answers.xml -> [2009/03/26 13:56:22 | 00,002,193 | —- | M] ()
creativecommons.xml -> C:\PROGRAM FILES\MOZILLA FIREFOX\searchplugins\creativecommons.xml -> [2009/03/26 13:56:22 | 00,001,534 | —- | M] ()
eBay.xml -> C:\PROGRAM FILES\MOZILLA FIREFOX\searchplugins\eBay.xml -> [2009/03/26 13:56:22 | 00,002,343 | —- | M] ()
google.xml -> C:\PROGRAM FILES\MOZILLA FIREFOX\searchplugins\google.xml -> [2009/03/26 13:56:22 | 00,001,706 | —- | M] ()
wikipedia.xml -> C:\PROGRAM FILES\MOZILLA FIREFOX\searchplugins\wikipedia.xml -> [2009/03/26 13:56:22 | 00,001,178 | —- | M] ()
yahoo.xml -> C:\PROGRAM FILES\MOZILLA FIREFOX\searchplugins\yahoo.xml -> [2009/03/26 13:56:22 | 00,000,792 | —- | M] ()
< HOSTS File > (305173 bytes and 10553 lines) -> C:\WINDOWS\System32\drivers\etc\Hosts -> 
First 25 entries…
Reset Hosts
127.0.0.1	   localhost
127.0.0.1 010402.com
127.0.0.1 00hq.com
127.0.0.1 008k.com
127.0.0.1 008i.com
127.0.0.1 007guard.com
127.0.0.1	www.007guard.com
127.0.0.1	www.008k.com
127.0.0.1	www.00hq.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com
127.0.0.1	www.0scan.com
127.0.0.1	0scan.com
127.0.0.1	www.1000gratisproben.com
127.0.0.1	1000gratisproben.com
127.0.0.1	www.1001namen.com
127.0.0.1	1001namen.com
127.0.0.1	100888290cs.com
127.0.0.1	www.100888290cs.com
127.0.0.1	100sexlinks.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	10sek.com
127.0.0.1	www.10sek.com
127.0.0.1	www.1-2005-search.com
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ -> 
{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [Spybot-S&D IE Protection] -> [2009/01/26 16:31:02 | 01,879,896 | —- | M] (Safer Networking Limited)
{DBC80044-A445-435b-BC74-9C25C1C588A9} [HKLM] -> %ProgramFiles%\Java\jre6\bin\jp2ssv.dll [Java™ Plug-In 2 SSV Helper] -> [2009/03/31 19:23:45 | 00,035,840 | —- | M] (Sun Microsystems, Inc.)
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} [HKLM] -> %ProgramFiles%\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [JQSIEStartDetectorImpl Class] -> [2009/03/31 19:23:48 | 00,073,728 | —- | M] (Sun Microsystems, Inc.)
< Internet Explorer ToolBars [HKEY_USERS\S-1-5-21-2365619619-2033096897-2952368886-1009\] > -> HKEY_USERS\S-1-5-21-2365619619-2033096897-2952368886-1009\Software\Microsoft\Internet Explorer\Toolbar\ -> 
ShellBrowser\\"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found
WebBrowser\\"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 
"@OnlineArmor GUI" -> %ProgramFiles%\Tall Emu\Online Armor\oaui.exe ["C:\Program Files\Tall Emu\Online Armor\oaui.exe"] -> [2009/02/13 11:29:02 | 02,042,568 | —- | M] (Tall Emu)
"avast!" -> %ProgramFiles%\Alwil Software\Avast4\ashDisp.exe [C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe] -> [2009/02/05 16:08:45 | 00,081,000 | —- | M] (ALWIL Software)
"HPBootOp" -> %ProgramFiles%\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe ["C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run] -> [2005/02/26 00:34:02 | 00,245,760 | —- | M] (Hewlett-Packard Company)
"LSBWatcher" -> %SystemDrive%\hp\drivers\hplsbwatcher\lsburnwatcher.exe [c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe] -> [2005/05/10 19:50:42 | 00,253,952 | —- | M] (Hewlett-Packard Company)
"QuickTime Task" -> %ProgramFiles%\QuickTime\QTTask.exe ["C:\Program Files\QuickTime\QTTask.exe" -atboottime] -> [2009/01/05 16:18:48 | 00,413,696 | —- | M] (Apple Inc.)
"SunJavaUpdateSched" -> %ProgramFiles%\Java\jre6\bin\jusched.exe ["C:\Program Files\Java\jre6\bin\jusched.exe"] -> [2009/03/31 19:23:45 | 00,148,888 | —- | M] (Sun Microsystems, Inc.)
< All Users Startup Folder > -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup -> 
< Compaq_Owner Startup Folder > -> C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Startup -> 
< Default User Startup Folder > -> C:\Documents and Settings\Default User\Start Menu\Programs\Startup -> 
< CurrentVersion Policy Settings - Explorer [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"HonorAutoRunSetting" ->  [1] -> File not found
< CurrentVersion Policy Settings - System [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
\\"dontdisplaylastusername" ->  [0] -> File not found
\\"legalnoticecaption" ->  [] -> File not found
\\"legalnoticetext" ->  [] -> File not found
\\"shutdownwithoutlogon" ->  [1] -> File not found
\\"undockwithoutlogon" ->  [1] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" ->  [145] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" ->  [145] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-19] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" ->  [145] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-20] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" ->  [145] -> File not found
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-21-2365619619-2033096897-2952368886-1009] > -> HKEY_USERS\S-1-5-21-2365619619-2033096897-2952368886-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 
HKEY_USERS\S-1-5-21-2365619619-2033096897-2952368886-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
\\"NoDriveTypeAutoRun" ->  [145] -> File not found
< Internet Explorer Menu Extensions [HKEY_USERS\S-1-5-21-2365619619-2033096897-2952368886-1009\] > -> HKEY_USERS\S-1-5-21-2365619619-2033096897-2952368886-1009\Software\Microsoft\Internet Explorer\MenuExt\ -> 
E&xport to Microsoft Excel -> %SystemDrive%\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE [res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000] -> File not found
< Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ -> 
{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}:{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [Menu: Spybot - Search & Destroy Configuration] -> [2009/01/26 16:31:02 | 01,879,896 | —- | M] (Safer Networking Limited)
{E2D4D26B-0180-43a4-B05F-462D6D54C789}:C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm [HKLM] -> %SystemRoot%\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm [Button: Connection Help] -> [2005/08/08 17:59:15 | 00,000,735 | —- | M] ()
{E2D4D26B-0180-43a4-B05F-462D6D54C789}:C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm [HKLM] -> %SystemRoot%\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm [Menu: Connection Help] -> [2005/08/08 17:59:15 | 00,000,735 | —- | M] ()
{FB5F1910-F110-11d2-BB9E-00C04F795683}:Exec [HKLM] -> %ProgramFiles%\Messenger\msmsgs.exe [Button: Messenger] -> [2004/10/13 18:24:37 | 01,694,208 | —- | M] (Microsoft Corporation)
{FB5F1910-F110-11d2-BB9E-00C04F795683}:Exec [HKLM] -> %ProgramFiles%\Messenger\msmsgs.exe [Menu: Windows Messenger] -> [2004/10/13 18:24:37 | 01,694,208 | —- | M] (Microsoft Corporation)
< Internet Explorer Extensions [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Extensions\ -> 
CmdMapping\\"{08B0E5C0-4FCB-11CF-AAA5-00401C608501}" [HKLM] ->  [Reg Error: Value error.] -> File not found
CmdMapping\\"{92780B25-18CC-41C8-B9BE-3C9C571A8263}" [HKLM] ->  [Reg Error: Key error.] -> File not found
CmdMapping\\"{E2D4D26B-0180-43a4-B05F-462D6D54C789}" [HKLM] ->  [Connection Help] -> File not found
CmdMapping\\"{FB5F1910-F110-11d2-BB9E-00C04F795683}" [HKLM] -> %ProgramFiles%\Messenger\msmsgs.exe [Messenger] -> [2004/10/13 18:24:37 | 01,694,208 | —- | M] (Microsoft Corporation)
< Internet Explorer Extensions [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Extensions\ -> 
CmdMapping\\"{08B0E5C0-4FCB-11CF-AAA5-00401C608501}" [HKLM] ->  [Reg Error: Value error.] -> File not found
CmdMapping\\"{92780B25-18CC-41C8-B9BE-3C9C571A8263}" [HKLM] ->  [Reg Error: Key error.] -> File not found
CmdMapping\\"{E2D4D26B-0180-43a4-B05F-462D6D54C789}" [HKLM] ->  [Connection Help] -> File not found
CmdMapping\\"{FB5F1910-F110-11d2-BB9E-00C04F795683}" [HKLM] -> %ProgramFiles%\Messenger\msmsgs.exe [Messenger] -> [2004/10/13 18:24:37 | 01,694,208 | —- | M] (Microsoft Corporation)
< Internet Explorer Extensions [HKEY_USERS\S-1-5-21-2365619619-2033096897-2952368886-1009\] > -> HKEY_USERS\S-1-5-21-2365619619-2033096897-2952368886-1009\Software\Microsoft\Internet Explorer\Extensions\ -> 
CmdMapping\\"{08B0E5C0-4FCB-11CF-AAA5-00401C608501}" [HKLM] ->  [Reg Error: Value error.] -> File not found
CmdMapping\\"{92780B25-18CC-41C8-B9BE-3C9C571A8263}" [HKLM] ->  [Reg Error: Key error.] -> File not found
CmdMapping\\"{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}" [HKLM] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [Spybot - Search & Destroy Configuration] -> [2009/01/26 16:31:02 | 01,879,896 | —- | M] (Safer Networking Limited)
CmdMapping\\"{E2D4D26B-0180-43a4-B05F-462D6D54C789}" [HKLM] ->  [Connection Help] -> File not found
CmdMapping\\"{FB5F1910-F110-11d2-BB9E-00C04F795683}" [HKLM] -> %ProgramFiles%\Messenger\msmsgs.exe [Messenger] -> [2004/10/13 18:24:37 | 01,694,208 | —- | M] (Microsoft Corporation)
< Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ -> 
PluginsPageFriendlyName -> Microsoft ActiveX Gallery -> 
PluginsPage -> http://activex.microsoft.com/controls/find.asp?ext=%s&mime=%s -> 
< Default Prefix > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
"" -> http://
< Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 5482 domain(s) found. -> 
50 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 36 range(s) found. -> 
< Trusted Sites Domains [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 5481 domain(s) found. -> 
49 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 36 range(s) found. -> 
< Trusted Sites Domains [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 5481 domain(s) found. -> 
49 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 36 range(s) found. -> 
< Trusted Sites Domains [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 
< Trusted Sites Ranges [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Trusted Sites Domains [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 
< Trusted Sites Ranges [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 
< Trusted Sites Domains [HKEY_USERS\S-1-5-21-2365619619-2033096897-2952368886-1009\] > -> HKEY_USERS\S-1-5-21-2365619619-2033096897-2952368886-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 
HKEY_USERS\S-1-5-21-2365619619-2033096897-2952368886-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 9010 domain(s) found. -> 
56 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_USERS\S-1-5-21-2365619619-2033096897-2952368886-1009\] > -> HKEY_USERS\S-1-5-21-2365619619-2033096897-2952368886-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 
HKEY_USERS\S-1-5-21-2365619619-2033096897-2952368886-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 36 range(s) found. -> 
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ -> 
{6414512B-B978-451D-A0D8-FCFDF33E833C} [HKLM] -> http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1238590400890 [WUWebControl Class] -> 
{8AD9C840-044E-11D1-B3E9-00805F499D93} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab [Java Plug-in 1.6.0_13] -> 
{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} [HKLM] -> http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab [Reg Error: Key error.] -> 
{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab [Java Plug-in 1.6.0_13] -> 
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [HKLM] -> http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab [Java Plug-in 1.6.0_13] -> 
< DNS Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ -> 
{66CBCB45-696C-4803-8304-9B66944D5FCC} ->	(1394 Net Adapter) -> 
{B79CD0E0-7DB7-4724-A9D0-ED3179536593} ->	(HP EN1207D-TX PCI 10/100 Fast Ethernet Adapter) -> 
{D2221C8F-51EE-429A-AFCF-0AE35C136CAE} ->	(Realtek RTL8139/810x Family Fast Ethernet NIC) -> 
< Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> 
*Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> 
Explorer.exe -> %SystemRoot%\Explorer.exe -> [2007/06/13 05:23:07 | 01,033,216 | —- | M] (Microsoft Corporation)
*MultiFile Done* -> -> 
< Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ -> 
AtiExtEvent -> %SystemRoot%\system32\Ati2evxx.dll -> [2005/06/08 00:39:38 | 00,046,080 | —- | M] (ATI Technologies Inc.)
< Domain Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List -> 
"%ProgramFiles%\iTunes\iTunes.exe" -> C:\Program Files\iTunes\iTunes.exe [%ProgramFiles%\iTunes\iTunes.exe:*:enabled:iTunes] -> File not found
"%windir%\system32\sessmgr.exe" -> C:\WINDOWS\system32\sessmgr.exe [%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019] -> [2004/08/04 07:00:00 | 00,140,800 | —- | M] (Microsoft Corporation)
< Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List -> 
"%windir%\system32\sessmgr.exe" -> C:\WINDOWS\system32\sessmgr.exe [%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019] -> [2004/08/04 07:00:00 | 00,140,800 | —- | M] (Microsoft Corporation)
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -> C:\Program Files\EarthLink TotalAccess\TaskPanl.exe [C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink] -> File not found
< SafeBoot AlternateShell [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot -> 
"AlternateShell" -> cmd.exe -> 
< CDROM Autorun Setting [HKEY_LOCAL_MACHINE]> -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom ->
"AutoRun" -> 1 -> 
"DisplayName" -> CD-ROM Driver -> 
"ImagePath" -> %SystemRoot%\system32\DRIVERS\cdrom.sys [system32\DRIVERS\cdrom.sys] -> [2004/08/04 07:00:00 | 00,049,536 | —- | M] (Microsoft Corporation)
< Drives with AutoRun files > ->  -> 
C:\AUTOEXEC.BAT [] -> %SystemDrive%\AUTOEXEC.BAT [ NTFS ] -> [2005/06/25 00:32:00 | 00,000,000 | —- | M] ()
D:\AUTOEXEC.BAT [] -> D:\AUTOEXEC.BAT [ FAT32 ] -> [2001/07/28 07:07:38 | 00,000,000 | -HS- | M] ()
< MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 -> 
\{2d435b36-e506-11d9-9b78-e6b009352ae7}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2d435b36-e506-11d9-9b78-e6b009352ae7}\Shell
\{2d435b36-e506-11d9-9b78-e6b009352ae7}\Shell\\"" ->  [AutoRun] -> File not found
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2d435b36-e506-11d9-9b78-e6b009352ae7}\Shell\AutoRun
\{2d435b36-e506-11d9-9b78-e6b009352ae7}\Shell\AutoRun\\"" ->  [Auto&Play] -> File not found
 
[Registry - Additional Scans - Safe List]
< EventViewer Logs - Last 10 Errors > -> Event Information -> Description
Application [ Error ] 4/3/2009 1:32:04 AM Computer Name = YOUR-27E1513D96 | Source = Application Error | ID = 1000 -> Description = Faulting application psi.exe, version 1.0.0.4, faulting module psi.exe, version 1.0.0.4, fault address 0x0000d814.
Application [ Error ] 4/3/2009 1:32:07 AM Computer Name = YOUR-27E1513D96 | Source = Application Error | ID = 1000 -> Description = Faulting application psi.exe, version 1.0.0.4, faulting module ntdll.dll, version 5.1.2600.2180, fault address 0x00043345.
Application [ Error ] 4/7/2009 6:35:33 PM Computer Name = YOUR-27E1513D96 | Source = Application Error | ID = 1005 -> Description = Windows cannot access the file E:\autorun.exe for one of the following reasons:   there is a problem with the network connection, the disk that the file is stored on, or the storage   drivers installed on this computer; or the disk is missing.   Windows closed the program CPI Module because of this error.	Program: CPI Module  File: E:\autorun.exe	The error value is listed in the Additional Data section.  User Action  1. Open the file again.   This situation might be a temporary problem that corrects itself when the program runs again.  2.   If the file still cannot be accessed and   - It is on the network,   your network administrator should verify that there is not a problem with the network and that the server can be contacted.   - It is on a removable disk, for example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the computer.  3. Check and repair the file system by running CHKDSK. To run CHKDSK, click Start, click Run, type CMD, and then click OK. At the command prompt, type CHKDSK /F, and then press ENTER.  4. If the problem persists, restore the file from a backup copy.  5. Determine whether other files on the same disk can be opened. If not, the disk might be damaged. If it is a hard disk, contact your administrator or computer hardware vendor for   further assistance.  Additional Data  Error value: C000009C  Disk type: 5
Application [ Error ] 4/7/2009 6:35:50 PM Computer Name = YOUR-27E1513D96 | Source = Application Error | ID = 1000 -> Description = Faulting application autorun.exe, version 5.0.1.3453, faulting module autorun.exe, version 5.0.1.3453, fault address 0x000038c6.
System [ Error ] 4/23/2009 3:22:36 PM Computer Name = YOUR-27E1513D96 | Source = Service Control Manager | ID = 7001 -> Description = The Computer Browser service depends on the Workstation service which failed to start because of the following error:   %%1066
System [ Error ] 4/23/2009 3:22:36 PM Computer Name = YOUR-27E1513D96 | Source = Service Control Manager | ID = 7023 -> Description = The Server service terminated with the following error:   %%5
System [ Error ] 4/25/2009 12:35:26 PM Computer Name = YOUR-27E1513D96 | Source = Service Control Manager | ID = 7006 -> Description = The ScRegSetValueExW call failed for ImagePath with the following error:   %%5
System [ Error ] 4/25/2009 4:13:52 PM Computer Name = YOUR-27E1513D96 | Source = Workstation | ID = 5727 -> Description = Could not load Rdbss device driver.
System [ Error ] 4/25/2009 4:13:52 PM Computer Name = YOUR-27E1513D96 | Source = Workstation | ID = 5727 -> Description = Could not load RDR device driver.
System [ Error ] 4/25/2009 4:13:55 PM Computer Name = YOUR-27E1513D96 | Source = Service Control Manager | ID = 7024 -> Description = The Workstation service terminated with service-specific error 2250 (0x8CA).
System [ Error ] 4/25/2009 4:13:55 PM Computer Name = YOUR-27E1513D96 | Source = Service Control Manager | ID = 7000 -> Description = The WebDav Client Redirector service failed to start due to the following error:   %%5
System [ Error ] 4/25/2009 4:13:55 PM Computer Name = YOUR-27E1513D96 | Source = Service Control Manager | ID = 7001 -> Description = The WebClient service depends on the WebDav Client Redirector service which failed to start because of the following error:   %%5
System [ Error ] 4/25/2009 4:13:55 PM Computer Name = YOUR-27E1513D96 | Source = Service Control Manager | ID = 7001 -> Description = The Computer Browser service depends on the Workstation service which failed to start because of the following error:   %%1066
System [ Error ] 4/25/2009 4:13:55 PM Computer Name = YOUR-27E1513D96 | Source = Service Control Manager | ID = 7023 -> Description = The Server service terminated with the following error:   %%5
 
[Files/Folders - Created Within 30 Days]
1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> 
Recent -> %UserProfile%\Recent -> [2009/04/25 15:48:13 | 00,000,000 | RH-D | C]
OTScanIt2 -> %UserProfile%\Desktop\OTScanIt2 -> [2009/04/25 13:38:29 | 00,000,000 | —D | C]
OTScanIt2.exe -> %UserProfile%\Desktop\OTScanIt2.exe -> [2009/04/25 12:53:33 | 00,494,080 | —- | C] (OldTimer Tools)
runprevxcsi.exe -> %UserProfile%\Desktop\runprevxcsi.exe -> [2009/04/25 11:25:27 | 00,866,360 | —- | C] (Prevx)
Revo Uninstaller.lnk -> %UserProfile%\Desktop\Revo Uninstaller.lnk -> [2009/04/24 21:12:06 | 00,000,925 | —- | C] ()
VS Revo Group -> %ProgramFiles%\VS Revo Group -> [2009/04/24 21:12:05 | 00,000,000 | —D | C]
White Board -> %UserProfile%\Desktop\White Board -> [2009/04/24 19:37:00 | 00,000,000 | —D | C]
playfuldolphin_3122094 dir -> %SystemRoot%\System32\playfuldolphin_3122094 dir -> [2009/04/23 23:25:41 | 00,000,000 | —D | C]
a-squared Free.lnk -> %AllUsersProfile%\Desktop\a-squared Free.lnk -> [2009/04/22 17:05:59 | 00,000,656 | —- | C] ()
a-squared Free -> %UserProfile%\My Documents\a-squared Free -> [2009/04/22 17:05:47 | 00,000,000 | —D | C]
a-squared Free -> %ProgramFiles%\a-squared Free -> [2009/04/22 17:05:47 | 00,000,000 | —D | C]
Sun -> %SystemRoot%\Sun -> [2009/04/22 00:54:54 | 00,000,000 | —D | C]
nsreg.dat -> %SystemRoot%\nsreg.dat -> [2009/04/19 23:31:57 | 00,000,000 | —- | C] ()
iMacros -> %UserProfile%\My Documents\iMacros -> [2009/04/19 15:35:44 | 00,000,000 | —D | C]
WTT Tools -> %UserProfile%\Desktop\WTT Tools -> [2009/04/16 07:06:24 | 00,000,000 | —D | C]
what the tech -> %UserProfile%\Desktop\what the tech -> [2009/04/16 06:01:17 | 00,000,000 | —D | C]
Microsoft Picture It! Express 2001.lnk -> %AllUsersProfile%\Desktop\Microsoft Picture It! Express 2001.lnk -> [2009/04/07 17:39:55 | 00,001,557 | —- | C] ()
Microsoft Picture It! PhotoPub -> %ProgramFiles%\Microsoft Picture It! PhotoPub -> [2009/04/07 17:22:09 | 00,000,000 | —D | C]
My Videos -> %AllUsersProfile%\Documents\My Videos -> [2009/04/07 13:18:30 | 00,000,000 | R–D | C]
Unused Icons -> %UserProfile%\Desktop\Unused Icons -> [2009/04/05 15:02:56 | 00,000,000 | —D | C]
Minidump -> %SystemRoot%\Minidump -> [2009/04/03 21:37:56 | 00,000,000 | —D | C]
QuickTime -> %ProgramFiles%\QuickTime -> [2009/04/03 04:33:40 | 00,000,000 | —D | C]
Apple Computer -> %AllUsersProfile%\Application Data\Apple Computer -> [2009/04/03 04:33:29 | 00,000,000 | —D | C]
HPQ -> %AppData%\HPQ -> [2009/04/02 22:19:31 | 00,000,000 | —D | C]
pss -> %SystemRoot%\pss -> [2009/04/02 14:56:33 | 00,000,000 | —D | C]
Macromedia -> %AppData%\Macromedia -> [2009/04/02 14:40:08 | 00,000,000 | —D | C]
Adobe -> %AppData%\Adobe -> [2009/04/02 14:40:07 | 00,000,000 | —D | C]
Thumbs.db -> %SystemRoot%\Thumbs.db -> [2009/04/02 05:47:01 | 00,007,168 | -HS- | C] ()
ntoskrnl.exe -> %SystemRoot%\System32\dllcache\ntoskrnl.exe -> [2009/04/01 15:23:40 | 02,180,352 | —- | C] (Microsoft Corporation)
ntkrnlmp.exe -> %SystemRoot%\System32\dllcache\ntkrnlmp.exe -> [2009/04/01 15:23:40 | 02,136,064 | —- | C] (Microsoft Corporation)
ntkrnlpa.exe -> %SystemRoot%\System32\dllcache\ntkrnlpa.exe -> [2009/04/01 15:23:39 | 02,057,728 | —- | C] (Microsoft Corporation)
ntkrpamp.exe -> %SystemRoot%\System32\dllcache\ntkrpamp.exe -> [2009/04/01 15:23:39 | 02,015,744 | —- | C] (Microsoft Corporation)
xpsp3res.dll -> %SystemRoot%\System32\xpsp3res.dll -> [2009/04/01 14:50:06 | 00,351,744 | —- | C] (Microsoft Corporation)
bthport.sys -> %SystemRoot%\System32\drivers\bthport.sys -> [2009/04/01 14:21:50 | 00,272,128 | —- | C] (Microsoft Corporation)
bthport.sys -> %SystemRoot%\System32\dllcache\bthport.sys -> [2009/04/01 14:21:50 | 00,272,128 | —- | C] (Microsoft Corporation)
mrxsmb.sys -> %SystemRoot%\System32\dllcache\mrxsmb.sys -> [2009/04/01 13:34:27 | 00,453,632 | —- | C] (Microsoft Corporation)
MRT.exe -> %SystemRoot%\System32\MRT.exe -> [2009/04/01 10:12:36 | 24,768,960 | —- | C] (Microsoft Corporation)
Windows Genuine Advantage -> %AllUsersProfile%\Application Data\Windows Genuine Advantage -> [2009/04/01 09:10:41 | 00,000,000 | —D | C]
PreInstall -> %SystemRoot%\System32\PreInstall -> [2009/04/01 08:55:03 | 00,000,000 | —D | C]
wups2.dll -> %SystemRoot%\System32\wups2.dll -> [2009/04/01 08:06:53 | 00,043,544 | —- | C] (Microsoft Corporation)
wucltui.dll.mui -> %SystemRoot%\System32\wucltui.dll.mui -> [2009/04/01 08:06:53 | 00,031,768 | —- | C] (Microsoft Corporation)
wuaueng.dll.mui -> %SystemRoot%\System32\wuaueng.dll.mui -> [2009/04/01 08:06:52 | 00,018,456 | —- | C] (Microsoft Corporation)
wuaucpl.cpl.mui -> %SystemRoot%\System32\wuaucpl.cpl.mui -> [2009/04/01 08:06:51 | 00,023,576 | —- | C] (Microsoft Corporation)
wuapi.dll.mui -> %SystemRoot%\System32\wuapi.dll.mui -> [2009/04/01 08:06:51 | 00,023,576 | —- | C] (Microsoft Corporation)
SoftwareDistribution -> %SystemRoot%\System32\SoftwareDistribution -> [2009/04/01 08:06:51 | 00,000,000 | —D | C]
Shortcut to Security Center.lnk -> %UserProfile%\Desktop\Shortcut to Security Center.lnk -> [2009/04/01 08:00:29 | 00,000,246 | —- | C] ()
UserData -> %UserProfile%\UserData -> [2009/04/01 07:50:27 | 00,000,000 | –SD | C]
DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> %UserProfile%\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> [2009/04/01 06:42:44 | 00,006,656 | —- | C] ()
Online Armor.lnk -> %UserProfile%\Desktop\Online Armor.lnk -> [2009/04/01 01:38:17 | 00,001,737 | —- | C] ()
FullTiltPoker.NET -> %UserProfile%\Local Settings\Application Data\FullTiltPoker.NET -> [2009/03/31 22:01:43 | 00,000,000 | —D | C]
TEMP -> %AllUsersProfile%\Application Data\TEMP -> [2009/03/31 21:12:03 | 00,000,000 | —D | C]
SpywareBlaster.lnk -> %UserProfile%\Desktop\SpywareBlaster.lnk -> [2009/03/31 21:11:39 | 00,000,698 | —- | C] ()
SpywareBlaster -> %ProgramFiles%\SpywareBlaster -> [2009/03/31 21:11:37 | 00,000,000 | —D | C]
HijackThis.lnk -> %UserProfile%\Desktop\HijackThis.lnk -> [2009/03/31 21:09:52 | 00,001,742 | —- | C] ()
Trend Micro -> %ProgramFiles%\Trend Micro -> [2009/03/31 21:09:52 | 00,000,000 | —D | C]
Mozilla -> %UserProfile%\Local Settings\Application Data\Mozilla -> [2009/03/31 20:47:07 | 00,000,000 | —D | C]
Mozilla Firefox.lnk -> %AllUsersProfile%\Desktop\Mozilla Firefox.lnk -> [2009/03/31 20:19:22 | 00,001,610 | —- | C] ()
Mozilla Firefox -> %ProgramFiles%\Mozilla Firefox -> [2009/03/31 20:19:17 | 00,000,000 | —D | C]
CCleaner.lnk -> %UserProfile%\Desktop\CCleaner.lnk -> [2009/03/31 20:17:17 | 00,001,556 | —- | C] ()
CCleaner -> %ProgramFiles%\CCleaner -> [2009/03/31 20:17:15 | 00,000,000 | —D | C]
OnlineArmor -> %AppData%\OnlineArmor -> [2009/03/31 20:12:01 | 00,000,000 | —D | C]
OnlineArmor -> %AllUsersProfile%\Application Data\OnlineArmor -> [2009/03/31 20:12:01 | 00,000,000 | —D | C]
OAmon.sys -> %SystemRoot%\System32\drivers\OAmon.sys -> [2009/03/31 20:11:45 | 00,029,384 | —- | C] (Tall Emu)
OAnet.sys -> %SystemRoot%\System32\drivers\OAnet.sys -> [2009/03/31 20:11:45 | 00,028,872 | —- | C] (Tall Emu Pty Ltd)
OADriver.sys -> %SystemRoot%\System32\drivers\OADriver.sys -> [2009/03/31 20:11:44 | 00,190,664 | —- | C] (Tall Emu)
Tall Emu -> %ProgramFiles%\Tall Emu -> [2009/03/31 20:11:34 | 00,000,000 | —D | C]
OnlineArmor -> %SystemDrive%\OnlineArmor -> [2009/03/31 20:10:03 | 00,000,000 | —D | C]
avast! Antivirus.lnk -> %AllUsersProfile%\Desktop\avast! Antivirus.lnk -> [2009/03/31 20:08:34 | 00,001,717 | —- | C] ()
aswTdi.sys -> %SystemRoot%\System32\drivers\aswTdi.sys -> [2009/03/31 20:08:33 | 00,051,376 | —- | C] (ALWIL Software)
aswRdr.sys -> %SystemRoot%\System32\drivers\aswRdr.sys -> [2009/03/31 20:08:33 | 00,023,152 | —- | C] (ALWIL Software)
aavmker4.sys -> %SystemRoot%\System32\drivers\aavmker4.sys -> [2009/03/31 20:08:32 | 00,026,944 | —- | C] (ALWIL Software)
AvastSS.scr -> %SystemRoot%\System32\AvastSS.scr -> [2009/03/31 20:08:30 | 00,097,480 | —- | C] (ALWIL Software)
aswSP.sys -> %SystemRoot%\System32\drivers\aswSP.sys -> [2009/03/31 20:08:29 | 00,114,768 | —- | C] (ALWIL Software)
aswFsBlk.sys -> %SystemRoot%\System32\drivers\aswFsBlk.sys -> [2009/03/31 20:08:29 | 00,020,560 | —- | C] (ALWIL Software)
aswmon2.sys -> %SystemRoot%\System32\drivers\aswmon2.sys -> [2009/03/31 20:08:28 | 00,094,032 | —- | C] (ALWIL Software)
aswmon.sys -> %SystemRoot%\System32\drivers\aswmon.sys -> [2009/03/31 20:08:28 | 00,093,296 | —- | C] (ALWIL Software)
aswBoot.exe -> %SystemRoot%\System32\aswBoot.exe -> [2009/03/31 20:08:12 | 01,256,296 | —- | C] (ALWIL Software)
actskin4.ocx -> %SystemRoot%\System32\actskin4.ocx -> [2009/03/31 20:08:12 | 00,380,928 | —- | C] ()
Alwil Software -> %ProgramFiles%\Alwil Software -> [2009/03/31 20:08:09 | 00,000,000 | —D | C]
mozregistry.dat -> %SystemRoot%\mozregistry.dat -> [2009/03/31 20:01:59 | 00,000,335 | —- | C] ()
Thunderbird -> %AppData%\Thunderbird -> [2009/03/31 20:01:59 | 00,000,000 | —D | C]
Qualcomm -> %ProgramFiles%\Qualcomm -> [2009/03/31 20:01:59 | 00,000,000 | —D | C]
Netscape -> %ProgramFiles%\Netscape -> [2009/03/31 20:01:59 | 00,000,000 | —D | C]
Mozilla -> %AppData%\Mozilla -> [2009/03/31 20:01:59 | 00,000,000 | —D | C]
High Forest Net.lnk -> %UserProfile%\Desktop\High Forest Net.lnk -> [2009/03/31 20:01:58 | 00,000,590 | —- | C] ()
rnaph.dll -> %SystemRoot%\System32\rnaph.dll -> [2009/03/31 20:01:40 | 00,009,728 | —- | C] (Microsoft Corporation)
Full Tilt Poker.Net.lnk -> %AllUsersProfile%\Desktop\Full Tilt Poker.Net.lnk -> [2009/03/31 20:00:33 | 00,001,525 | —- | C] ()
Full Tilt Poker.Net -> %ProgramFiles%\Full Tilt Poker.Net -> [2009/03/31 20:00:33 | 00,000,000 | —D | C]
RECYCLER -> %SystemDrive%\RECYCLER -> [2009/03/31 19:57:18 | 00,000,000 | -HSD | C]
GDIPFONTCACHEV1.DAT -> %UserProfile%\Local Settings\Application Data\GDIPFONTCACHEV1.DAT -> [2009/03/31 19:47:43 | 00,034,216 | —- | C] ()
Sun -> %AppData%\Sun -> [2009/03/31 19:40:22 | 00,000,000 | —D | C]
Spybot - Search & Destroy.lnk -> %UserProfile%\Desktop\Spybot - Search & Destroy.lnk -> [2009/03/31 19:38:21 | 00,000,941 | —- | C] ()
Spybot - Search & Destroy -> %ProgramFiles%\Spybot - Search & Destroy -> [2009/03/31 19:38:06 | 00,000,000 | —D | C]
Spybot - Search & Destroy -> %AllUsersProfile%\Application Data\Spybot - Search & Destroy -> [2009/03/31 19:38:06 | 00,000,000 | —D | C]
Foxit Software -> %ProgramFiles%\Foxit Software -> [2009/03/31 19:36:44 | 00,000,000 | —D | C]
Malwarebytes -> %AppData%\Malwarebytes -> [2009/03/31 19:27:58 | 00,000,000 | —D | C]
mbam.sys -> %SystemRoot%\System32\drivers\mbam.sys -> [2009/03/31 19:27:54 | 00,015,504 | —- | C] (Malwarebytes Corporation)
Malwarebytes' Anti-Malware.lnk -> %AllUsersProfile%\Desktop\Malwarebytes' Anti-Malware.lnk -> [2009/03/31 19:27:54 | 00,000,704 | —- | C] ()
mbamswissarmy.sys -> %SystemRoot%\System32\drivers\mbamswissarmy.sys -> [2009/03/31 19:27:51 | 00,038,496 | —- | C] (Malwarebytes Corporation)
Malwarebytes -> %AllUsersProfile%\Application Data\Malwarebytes -> [2009/03/31 19:27:49 | 00,000,000 | —D | C]
Malwarebytes' Anti-Malware -> %ProgramFiles%\Malwarebytes' Anti-Malware -> [2009/03/31 19:27:48 | 00,000,000 | —D | C]
Java -> %ProgramFiles%\Java -> [2009/03/31 19:23:36 | 00,000,000 | —D | C]
BOOT.BAK -> %SystemDrive%\BOOT.BAK -> [2009/03/31 16:49:08 | 00,000,213 | RHS- | C] ()
cmldr -> %SystemDrive%\cmldr -> [2009/03/31 16:49:05 | 00,260,272 | RHS- | C] ()
cmdcons -> %SystemDrive%\cmdcons -> [2009/03/31 16:49:01 | 00,000,000 | RHSD | C]
setup.pss -> %SystemRoot%\setup.pss -> [2009/03/31 16:48:56 | 00,000,000 | —D | C]
Shortcut to Add or Remove Programs.lnk -> %UserProfile%\Desktop\Shortcut to Add or Remove Programs.lnk -> [2009/03/31 16:36:29 | 00,000,241 | —- | C] ()
wmpns.dll -> %SystemRoot%\System32\wmpns.dll -> [2009/03/31 16:28:50 | 00,221,184 | —- | C] (Microsoft Corporation)
hiberfil.sys -> %SystemDrive%\hiberfil.sys -> [2009/03/31 16:28:40 | 73,667,7888 | -HS- | C] ()
103C_HP_CPC_ED861AA-ABA SR1603WM NA540_YC_0Pres_QCNH536_E54NAheRED2_48_IAmberine M_SASUSTek Computer INC._V1.03_B3.07_T050729_WXH2_L409_M223_J80_7AMD_8Sempron_91.79_#051113_N10EC813
9_Z14F11034_G10025954.MRK -> %SystemRoot%\System32\drivers\103C_HP_CPC_ED861AA-ABA SR1603WM NA540_YC_0Pres_QCNH536_E54NAheRED2_48_IAmberine M_SASUSTek Computer INC._V1.03_B3.07_T050729_WXH2_L409_M223_J80_7AMD_8Sempron_91.79_#051113_N10EC813
9_Z14F11034_G10025954.MRK -> [2009/03/31 16:28:40 | 00,001,857 | RHS- | C] ()
desktop.ini -> %AppData%\desktop.ini -> [2009/03/31 16:18:20 | 00,000,062 | -HS- | C] ()
IconCache.db -> %UserProfile%\Local Settings\Application Data\IconCache.db -> [2009/03/31 16:18:18 | 04,311,832 | -H– | C] ()
desktop.ini -> %UserProfile%\My Documents\desktop.ini -> [2009/03/31 16:18:18 | 00,000,083 | -HS- | C] ()
desktop.ini -> %UserProfile%\Start Menu\Programs\Startup\desktop.ini -> [2009/03/31 16:18:15 | 00,000,084 | -HS- | C] ()
Cookies -> %UserProfile%\Cookies -> [2009/03/31 16:18:15 | 00,000,000 | –SD | C]
My Videos -> %UserProfile%\My Documents\My Videos -> [2009/03/31 16:18:15 | 00,000,000 | R–D | C]
My Pictures -> %UserProfile%\My Documents\My Pictures -> [2009/03/31 16:18:15 | 00,000,000 | R–D | C]
My Music -> %UserProfile%\My Documents\My Music -> [2009/03/31 16:18:15 | 00,000,000 | R–D | C]
My Documents -> %UserProfile%\My Documents -> [2009/03/31 16:18:15 | 00,000,000 | R–D | C]
Favorites -> %UserProfile%\Favorites -> [2009/03/31 16:18:15 | 00,000,000 | R–D | C]
Local Settings -> %UserProfile%\Local Settings -> [2009/03/31 16:18:15 | 00,000,000 | -H-D | C]
Symantec -> %AppData%\Symantec -> [2009/03/31 16:18:15 | 00,000,000 | —D | C]
SendTo -> %UserProfile%\SendTo -> [2009/03/31 16:18:15 | 00,000,000 | —D | C]
SampleView -> %AppData%\SampleView -> [2009/03/31 16:18:15 | 00,000,000 | —D | C]
Real -> %AppData%\Real -> [2009/03/31 16:18:15 | 00,000,000 | —D | C]
PrintHood -> %UserProfile%\PrintHood -> [2009/03/31 16:18:15 | 00,000,000 | —D | C]
NetHood -> %UserProfile%\NetHood -> [2009/03/31 16:18:15 | 00,000,000 | —D | C]
Microsoft -> %UserProfile%\Local Settings\Application Data\Microsoft -> [2009/03/31 16:18:15 | 00,000,000 | —D | C]
Microsoft -> %AppData%\Microsoft -> [2009/03/31 16:18:15 | 00,000,000 | —D | C]
Intuit -> %AppData%\Intuit -> [2009/03/31 16:18:15 | 00,000,000 | —D | C]
Identities -> %AppData%\Identities -> [2009/03/31 16:18:15 | 00,000,000 | —D | C]
Google -> %UserProfile%\Local Settings\Application Data\Google -> [2009/03/31 16:18:15 | 00,000,000 | —D | C]
Desktop -> %UserProfile%\Desktop -> [2009/03/31 16:18:15 | 00,000,000 | —D | C]
ApplicationHistory -> %UserProfile%\Local Settings\Application Data\ApplicationHistory -> [2009/03/31 16:18:15 | 00,000,000 | —D | C]
Application Data -> %AppData% -> [2009/03/31 16:18:15 | 00,000,000 | —D | C]
Apple Computer -> %UserProfile%\Local Settings\Application Data\Apple Computer -> [2009/03/31 16:18:15 | 00,000,000 | —D | C]
Apple Computer -> %AppData%\Apple Computer -> [2009/03/31 16:18:15 | 00,000,000 | —D | C]
{3248F0A6-6813-11D6-A77B-00B0D0150000} -> %UserProfile%\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150000} -> [2009/03/31 16:18:15 | 00,000,000 | —D | C]
NTUSER.DAT -> %UserProfile%\NTUSER.DAT -> [2009/03/31 16:18:14 | 04,980,736 | -H– | C] ()
ntuser.ini -> %UserProfile%\ntuser.ini -> [2009/03/31 16:18:14 | 00,000,178 | -HS- | C] ()
WINDOWS -> %UserProfile%\WINDOWS -> [2009/03/31 16:18:14 | 00,000,000 | —D | C]
Templates -> %UserProfile%\Templates -> [2009/03/31 16:18:14 | 00,000,000 | —D | C]
Start Menu -> %UserProfile%\Start Menu -> [2009/03/31 16:18:14 | 00,000,000 | —D | C]
NTUSER.DAT -> %AllUsersProfile%\NTUSER.DAT -> [2009/03/31 16:17:11 | 00,262,144 | —- | C] ()
Prefetch -> %SystemRoot%\Prefetch -> [2009/03/31 16:14:30 | 00,000,000 | —D | C]
System Volume Information -> %SystemDrive%\System Volume Information -> [2009/03/31 16:05:56 | 00,000,000 | -HSD | C]
hpsysdrv.dat -> %SystemRoot%\System\hpsysdrv.dat -> [2009/03/31 16:01:47 | 00,000,246 | —- | C] ()
I386 -> %SystemRoot%\I386 -> [2009/03/31 15:59:46 | 00,000,000 | —D | C]
assembly -> %SystemRoot%\assembly -> [2009/03/31 15:50:49 | 00,000,000 | R-SD | C]
smscfg.ini -> %SystemRoot%\smscfg.ini -> [2005/08/08 18:27:27 | 00,000,061 | —- | C] ()
CHODDI.SYS -> %SystemRoot%\System32\CHODDI.SYS -> [2005/08/08 17:55:18 | 00,012,992 | —- | C] ()
hpreg.dll -> %SystemRoot%\System32\hpreg.dll -> [2005/08/08 17:55:10 | 00,045,056 | —- | C] ()
ODBC.INI -> %SystemRoot%\ODBC.INI -> [2005/08/08 17:48:07 | 00,000,376 | —- | C] ()
WININIT.INI -> %SystemRoot%\WININIT.INI -> [2005/08/08 17:36:06 | 00,000,067 | —- | C] ()
fxsperf.ini -> %SystemRoot%\System32\fxsperf.ini -> [2005/08/08 17:30:56 | 00,001,793 | —- | C] ()
orun32.ini -> %SystemRoot%\orun32.ini -> [2005/08/08 17:15:38 | 00,000,780 | —- | C] ()
bcbmm.dll -> %SystemRoot%\System32\bcbmm.dll -> [2005/08/08 17:10:53 | 00,016,896 | —- | C] ()
win.ini -> %SystemRoot%\win.ini -> [2005/06/25 00:32:00 | 00,000,491 | —- | C] ()
system.ini -> %SystemRoot%\system.ini -> [2005/06/24 17:26:26 | 00,000,227 | —- | C] ()
ieencode.dll -> %SystemRoot%\System32\ieencode.dll -> [2004/08/04 07:00:00 | 00,081,920 | —- | C] ()
oeminfo.ini -> %SystemRoot%\System32\oeminfo.ini -> [2004/06/16 00:38:02 | 00,000,592 | —- | C] ()
 
[Files/Folders - Modified Within 30 Days]
1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> 
hpsysdrv.dat -> %SystemRoot%\System\hpsysdrv.dat -> [2009/04/25 15:14:37 | 00,000,246 | —- | M] ()
Perflib_Perfdata_7b4.dat -> %SystemRoot%\Temp\Perflib_Perfdata_7b4.dat -> [2009/04/25 15:13:55 | 00,016,384 | —- | M] ()
Perflib_Perfdata_58c.dat -> %SystemRoot%\Temp\Perflib_Perfdata_58c.dat -> [2009/04/25 15:13:51 | 00,016,384 | —- | M] ()
SA.DAT -> %SystemRoot%\tasks\SA.DAT -> [2009/04/25 15:13:46 | 00,000,006 | -H– | M] ()
bootstat.dat -> %SystemRoot%\bootstat.dat -> [2009/04/25 15:13:37 | 00,002,048 | –S- | M] ()
hiberfil.sys -> %SystemDrive%\hiberfil.sys -> [2009/04/25 15:13:35 | 73,667,7888 | -HS- | M] ()
NTUSER.DAT -> %UserProfile%\NTUSER.DAT -> [2009/04/25 15:12:28 | 04,980,736 | -H– | M] ()
ntuser.ini -> %UserProfile%\ntuser.ini -> [2009/04/25 15:12:28 | 00,000,178 | -HS- | M] ()
HOSTS -> %SystemRoot%\System32\drivers\etc\HOSTS -> [2009/04/25 15:11:21 | 00,305,173 | R— | M] ()
WININIT.INI -> %SystemRoot%\WININIT.INI -> [2009/04/25 11:31:44 | 00,000,067 | —- | M] ()
runprevxcsi.exe -> %UserProfile%\Desktop\runprevxcsi.exe -> [2009/04/25 11:30:53 | 00,866,360 | —- | M] (Prevx)
Thumbs.db -> %SystemRoot%\Thumbs.db -> [2009/04/25 06:02:31 | 00,007,168 | -HS- | M] ()
Revo Uninstaller.lnk -> %UserProfile%\Desktop\Revo Uninstaller.lnk -> [2009/04/24 21:12:06 | 00,000,925 | —- | M] ()
win.ini -> %SystemRoot%\win.ini -> [2009/04/22 20:19:37 | 00,000,491 | —- | M] ()
boot.ini -> %SystemDrive%\boot.ini -> [2009/04/22 20:19:37 | 00,000,281 | RHS- | M] ()
system.ini -> %SystemRoot%\system.ini -> [2009/04/22 20:19:37 | 00,000,227 | —- | M] ()
a-squared Free.lnk -> %AllUsersProfile%\Desktop\a-squared Free.lnk -> [2009/04/22 17:05:59 | 00,000,656 | —- | M] ()
nsreg.dat -> %SystemRoot%\nsreg.dat -> [2009/04/19 23:31:57 | 00,000,000 | —- | M] ()
hosts.idx -> %SystemRoot%\System32\drivers\etc\hosts.idx -> [2009/04/17 12:27:43 | 00,128,412 | —- | M] ()
hosts.20090417-122832.backup -> %SystemRoot%\System32\drivers\etc\hosts.20090417-122832.backup -> [2009/04/17 12:27:29 | 00,305,173 | R— | M] ()
hosts.20090417-122729.backup -> %SystemRoot%\System32\drivers\etc\hosts.20090417-122729.backup -> [2009/04/14 21:28:05 | 00,312,232 | R— | M] ()
hosts.20090414-212805.backup -> %SystemRoot%\System32\drivers\etc\hosts.20090414-212805.backup -> [2009/04/14 21:23:48 | 00,304,232 | R— | M] ()
OTScanIt2.exe -> %UserProfile%\Desktop\OTScanIt2.exe -> [2009/04/11 16:32:52 | 00,494,080 | —- | M] (OldTimer Tools)
SpywareBlaster.lnk -> %UserProfile%\Desktop\SpywareBlaster.lnk -> [2009/04/10 16:34:58 | 00,000,698 | —- | M] ()
GDIPFONTCACHEV1.DAT -> %UserProfile%\Local Settings\Application Data\GDIPFONTCACHEV1.DAT -> [2009/04/09 03:33:32 | 00,034,216 | —- | M] ()
hosts.20090409-042657.backup -> %SystemRoot%\System32\drivers\etc\hosts.20090409-042657.backup -> [2009/04/09 00:25:35 | 00,304,232 | R— | M] ()
hosts.20090409-002333.backup -> %SystemRoot%\System32\drivers\etc\hosts.20090409-002333.backup -> [2009/04/09 00:21:32 | 00,312,232 | R— | M] ()
FNTCACHE.DAT -> %SystemRoot%\System32\FNTCACHE.DAT -> [2009/04/08 17:27:53 | 00,157,160 | —- | M] ()
Microsoft Picture It! Express 2001.lnk -> %AllUsersProfile%\Desktop\Microsoft Picture It! Express 2001.lnk -> [2009/04/07 17:39:55 | 00,001,557 | —- | M] ()
mbamswissarmy.sys -> %SystemRoot%\System32\drivers\mbamswissarmy.sys -> [2009/04/06 15:32:54 | 00,038,496 | —- | M] (Malwarebytes Corporation)
mbam.sys -> %SystemRoot%\System32\drivers\mbam.sys -> [2009/04/06 15:32:46 | 00,015,504 | —- | M] (Malwarebytes Corporation)
wpa.dbl -> %SystemRoot%\System32\wpa.dbl -> [2009/04/04 17:02:19 | 00,001,158 | —- | M] ()
qmgr1.dat -> %AllUsersProfile%\Application Data\Microsoft\Network\Downloader\qmgr1.dat -> [2009/04/02 13:55:14 | 00,004,617 | —- | M] ()
qmgr0.dat -> %AllUsersProfile%\Application Data\Microsoft\Network\Downloader\qmgr0.dat -> [2009/04/02 13:55:14 | 00,004,232 | —- | M] ()
hosts.20090409-002132.backup -> %SystemRoot%\System32\drivers\etc\hosts.20090409-002132.backup -> [2009/04/01 22:48:00 | 00,304,232 | R— | M] ()
hosts.20090401-224800.backup -> %SystemRoot%\System32\drivers\etc\hosts.20090401-224800.backup -> [2009/04/01 22:05:18 | 00,000,840 | R— | M] ()
perfh009.dat -> %SystemRoot%\System32\perfh009.dat -> [2009/04/01 19:37:06 | 00,382,022 | —- | M] ()
perfc009.dat -> %SystemRoot%\System32\perfc009.dat -> [2009/04/01 19:37:06 | 00,053,640 | —- | M] ()
PerfStringBackup.INI -> %SystemRoot%\System32\PerfStringBackup.INI -> [2009/04/01 19:37:05 | 00,441,626 | —- | M] ()
Shortcut to Security Center.lnk -> %UserProfile%\Desktop\Shortcut to Security Center.lnk -> [2009/04/01 08:00:29 | 00,000,246 | —- | M] ()
DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> %UserProfile%\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini -> [2009/04/01 06:43:13 | 00,006,656 | —- | M] ()
Online Armor.lnk -> %UserProfile%\Desktop\Online Armor.lnk -> [2009/04/01 01:38:17 | 00,001,737 | —- | M] ()
hosts.20090401-063330.backup -> %SystemRoot%\System32\drivers\etc\hosts.20090401-063330.backup -> [2009/04/01 01:37:12 | 00,001,526 | —- | M] ()
hosts.20090401-003003.backup -> %SystemRoot%\System32\drivers\etc\hosts.20090401-003003.backup -> [2009/04/01 01:25:28 | 00,303,844 | R— | M] ()
HijackThis.lnk -> %UserProfile%\Desktop\HijackThis.lnk -> [2009/03/31 21:09:53 | 00,001,742 | —- | M] ()
Mozilla Firefox.lnk -> %AllUsersProfile%\Desktop\Mozilla Firefox.lnk -> [2009/03/31 20:19:22 | 00,001,610 | —- | M] ()
CCleaner.lnk -> %UserProfile%\Desktop\CCleaner.lnk -> [2009/03/31 20:17:17 | 00,001,556 | —- | M] ()
avast! Antivirus.lnk -> %AllUsersProfile%\Desktop\avast! Antivirus.lnk -> [2009/03/31 20:08:34 | 00,001,717 | —- | M] ()
CONFIG.NT -> %SystemRoot%\System32\CONFIG.NT -> [2009/03/31 20:08:29 | 00,002,626 | —- | M] ()
mozregistry.dat -> %SystemRoot%\mozregistry.dat -> [2009/03/31 20:01:59 | 00,000,335 | —- | M] ()
High Forest Net.lnk -> %UserProfile%\Desktop\High Forest Net.lnk -> [2009/03/31 20:01:58 | 00,000,590 | —- | M] ()
rnaph.dll -> %SystemRoot%\System32\rnaph.dll -> [2009/03/31 20:01:40 | 00,009,728 | —- | M] (Microsoft Corporation)
Full Tilt Poker.Net.lnk -> %AllUsersProfile%\Desktop\Full Tilt Poker.Net.lnk -> [2009/03/31 20:00:33 | 00,001,525 | —- | M] ()
Spybot - Search & Destroy.lnk -> %UserProfile%\Desktop\Spybot - Search & Destroy.lnk -> [2009/03/31 19:38:21 | 00,000,941 | —- | M] ()
Malwarebytes' Anti-Malware.lnk -> %AllUsersProfile%\Desktop\Malwarebytes' Anti-Malware.lnk -> [2009/03/31 19:27:54 | 00,000,704 | —- | M] ()
Shortcut to Add or Remove Programs.lnk -> %UserProfile%\Desktop\Shortcut to Add or Remove Programs.lnk -> [2009/03/31 16:36:29 | 00,000,241 | —- | M] ()
desktop.ini -> %UserProfile%\My Documents\desktop.ini -> [2009/03/31 16:28:55 | 00,000,083 | -HS- | M] ()
103C_HP_CPC_ED861AA-ABA SR1603WM NA540_YC_0Pres_QCNH536_E54NAheRED2_48_IAmberine M_SASUSTek Computer INC._V1.03_B3.07_T050729_WXH2_L409_M223_J80_7AMD_8Sempron_91.79_#051113_N10EC813
9_Z14F11034_G10025954.MRK -> %SystemRoot%\System32\drivers\103C_HP_CPC_ED861AA-ABA SR1603WM NA540_YC_0Pres_QCNH536_E54NAheRED2_48_IAmberine M_SASUSTek Computer INC._V1.03_B3.07_T050729_WXH2_L409_M223_J80_7AMD_8Sempron_91.79_#051113_N10EC813
9_Z14F11034_G10025954.MRK -> [2009/03/31 16:28:45 | 00,001,857 | RHS- | M] ()
$winnt$.inf -> %SystemRoot%\System32\$winnt$.inf -> [2009/03/31 16:17:19 | 00,001,063 | —- | M] ()
NTUSER.DAT -> %AllUsersProfile%\NTUSER.DAT -> [2009/03/31 16:17:12 | 00,262,144 | —- | M] ()
BOOT.BAK -> %SystemDrive%\BOOT.BAK -> [2009/03/31 16:16:38 | 00,000,213 | RHS- | M] ()
 
[File - Purity Scan]
 
[CatchMe Rootkit Scan by GMER]
Rootkit scan error - could not find scan log
Rootkit scan error - could not find scan log
 
 
[Alternate Data Streams]
@Alternate Data Stream - 0 bytes -> %SystemRoot%\Thumbs.db:encryptable
@Alternate Data Stream - 125 bytes -> %AllUsersProfile%\Application Data\TEMP:5C321E34
< End of report >

Looks like Revo got most of it I must remember that for next time

Start OTScanit. Copy/Paste the information in the quotebox below into the pane where it says "Paste fix here" and then click the Run Fix button.

[Files/Folders - Created Within 30 Days]
NY -> runprevxcsi.exe -> %UserProfile%\Desktop\runprevxcsi.exe
[Files/Folders - Modified Within 30 Days]
NY -> runprevxcsi.exe -> %UserProfile%\Desktop\runprevxcsi.exe
[Empty Temp Folders]

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix.

I will review the information when it comes back in.

Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.

Essexboy,

Note for ya:
There was only one file left over after I used Revo. I did a search of my pc for "prevxsci" and found the file in my prefetch data, and deleted it. That was before I ran the OTS scan.

Here is the log file you requested, and thanks!

[Files/Folders - Created Within 30 Days]
File C:\Documents and Settings\Compaq_Owner\Desktop\runprevxcsi.exe not found!
[Files/Folders - Modified Within 30 Days]
File C:\Documents and Settings\Compaq_Owner\Desktop\runprevxcsi.exe not found!
[Empty Temp Folders]
File delete failed. C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\etilqs_AbRpbPo4cL9Kif5hMDqb scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\Compaq_Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_58c.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_7b4.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\[removed]\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\[removed]\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\[removed]\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\[removed]\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\[removed]\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\[removed]\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
RecycleBin -> emptied.
< End of fix log >
OTScanIt2 by OldTimer - Version 1.0.14.0 fix logfile created on 04252009_165012

Files moved on Reboot…
File C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\etilqs_AbRpbPo4cL9Kif5hMDqb not found!
File C:\WINDOWS\temp\_avast4_\Webshlock.txt not found!
C:\WINDOWS\temp\Perflib_Perfdata_58c.dat moved successfully.
File C:\WINDOWS\temp\Perflib_Perfdata_7b4.dat not found!
C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\[removed]\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\[removed]\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\[removed]\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\[removed]\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\[removed]\urlclassifier3.sqlite moved successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\[removed]\XUL.mfl moved successfully.

Registry entries deleted on Reboot…

Aside from not being able to get the MediaFire to load up on my browser, I haven't noticed any differences in the loading speed of the pages here at the forum. Trinity ( my wife ) is having the exact same problem connecting there, and she is on a clean computer.

Essexboy, Oh, and…. Guess what? I just connected to the Mediafire site, lol. Must have been a server problem of some sort.

Yep I had problems yesterday as well and I put that down to server problems

For info before you try programmes out always set a restore point first so that you can go back if you do not like it

Now the best part of the day —– Your log now appears clean

A good workman always cleans up after himself so..Run OTListit and hit the cleanup button. It will remove all the programmes we have used plus itself.

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View Tab.
• Under the Hidden files and folders heading select Do not show hidden files and folders.
• Click Yes to confirm.
• Click OK.

XP
Now to get you off to a good start we will clean your restore points so that all the bad stuff is gone for good. Then if you need to restore at some stage you will be clean. There are several ways to reset your restore points, but this is my method:

• Select Start > All Programs > Accessories > System tools > System Restore.
• On the dialogue box that appears select Create a Restore Point
• Click NEXT
• Enter a name e.g. Clean
• Click CREATE

You now have a clean restore point, to get rid of the bad ones:

• Select Start > All Programs > Accessories > System tools > Disk Cleanup.
• In the Drop down box that appears select your main drive e.g. C
• Click OK
• The System will do some calculation and the display a dialogue box with TABS
• Select the More Options Tab.
• At the bottom will be a system restore box with a CLEANUP button click this
• Accept the Warning and select OK again, the program will close and you are done

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

• SpywareBlaster to help prevent spyware from installing in the first place.
• SuperAntispyware Run weekly to keep your system clean

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit

• Secunia Software inspector To check your programme update status
• Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?
Keep safe

Thanks loads,

Essexboy. Thanks for the "good workman" clean up tip with the otlistit. That is now burnt in my brain.

I can use the otlistit as one of my regular clean up tools even if I don't use it the way you used it on me, right?

Keeping in mind of course, only if I have used one or two "possibly destructive" tools that are still left on the users desktop.

I realize I wouldn't need it for cleaning up any of the "over the counter" tools.

Your method of cleaning restore points is exactly the same as mine The Spyware Blaster I already had, but thank you.
I realize you had no way of knowing whether or not I had it.

Yesterday, as soon as I noticed I was infected, I used the "Systems Snap Shot," and the "Hosts Safe" options of my Spyware Blaster to restore my important browser and system settings and hosts files to their previous state. That is also
another circumstance that aided me in the my decision that there was probably just a server problem with Mediafire.

Thank you very much for the Super Anti Spyware . That's one I haven't yet heard of. But from the looks of it, I have just
downloaded and installed it, it will be a very nice addition to my spyware arsenal.

I'm thinking about possibly using the Revo Uninstaller as a regular cleaning tool in my administration. My IP, who is a very good friend of mine and very wise, recommended the tool to me just a day before I got the infection. From what I've learned so far of it,
it seems like it does a better job than simply removing programs from add and remove, because it not only removes the
bad programs that are listed in your add and remove programs from your computer, but it also cleans up any lose files and fragments left behind that simply using add and remove programs does not. What do you think about this?

Once again Essexboy, thank you so much for all you have done here
I look forward to seeing you in the classroom, gonna update my new toy and head on over to the PL, see ya there

Thanks loads,

Essexboy. Thanks for the "good workman" clean up tip with the otlistit. That is now burnt in my brain.

I can use the otlistit as one of my regular clean up tools even if I don't use it the way you used it on me, right?

Keeping in mind of course, only if I have used one or two "possibly destructive" tools that are still left on the users desktop.

I realize I wouldn't need it for cleaning up any of the "over the counter" tools.

Your method of cleaning restore points is exactly the same as mine The Spyware Blaster I already had, but thank you.
I realize you had no way of knowing whether or not I had it.

Yesterday, as soon as I noticed I was infected, I used the "Systems Snap Shot," and the "Hosts Safe" options of my Spyware Blaster to restore my important browser and system settings and hosts files to their previous state. That is also
another circumstance that aided me in the my decision that there was probably just a server problem with Mediafire.

Thank you very much for the Super Anti Spyware . That's one I haven't yet heard of. But from the looks of it, I have just
downloaded and installed it, it will be a very nice addition to my spyware arsenal.

I'm thinking about possibly using the Revo Uninstaller as a regular cleaning tool in my administration. My IP, who is a very good friend of mine and very wise, recommended the tool to me just a day before I got the infection. From what I've learned so far of it,
it seems like it does a better job than simply removing programs from add and remove, because it not only removes the
bad programs that are listed in your add and remove programs from your computer, but it also cleans up any lose files and fragments left behind that simply using add and remove programs does not. What do you think about this?

Once again Essexboy, thank you so much for all you have done here
I look forward to seeing you in the classroom, gonna update my new toy and head on over to the PL, see ya there

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.