Spyware / Malware / Virus Removal

[Closed] need help...HJT posted

13 min read

Looking for the outcome? Ask AI

esseff Topic Starter

Post #1May 3, 2009, 8:07 PM UTC

Was on ibuypower.com and all of a sudden i got tons of pop-ups and i konda knew at that point i was screwed. I started my zone alam plus and it wouldnt start. I kept getting a no disk error. Any help would be appreciated.

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Documents and Settings\Owner\Desktop\cureit.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\RarSFX0\_start.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\RarSFX0\setup.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll
O2 - BHO: (no name) - {1e930f1c-113e-4f87-bc9a-ecab43a8f215} - C:\WINDOWS\system32\raramuge.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CPMcf2eaab6] Rundll32.exe "c:\windows\system32\muhizage.dll",a
O4 - HKLM\..\Run: [cc1d992a] rundll32.exe "C:\WINDOWS\system32\hadatagu.dll",b
O4 - HKLM\..\Run: [merofalori] Rundll32.exe "C:\WINDOWS\system32\buyenayo.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-1634829951-3876798684-2761164870-1011\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Justice')
O4 - HKUS\S-1-5-21-1634829951-3876798684-2761164870-1011\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Justice')
O4 - HKUS\S-1-5-21-1634829951-3876798684-2761164870-1014\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'beka')
O4 - HKUS\S-1-5-21-1634829951-3876798684-2761164870-1015\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe (User 'Kayleigh')
O4 - HKUS\S-1-5-21-1634829951-3876798684-2761164870-1016\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'eli')
O4 - HKUS\S-1-5-21-1634829951-3876798684-2761164870-501\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe (User 'Guest')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - S-1-5-21-1634829951-3876798684-2761164870-1016 Startup: PowerReg Scheduler V3.exe (User 'eli')
O4 - S-1-5-21-1634829951-3876798684-2761164870-1016 User Startup: PowerReg Scheduler V3.exe (User 'eli')
O4 - Startup: BHODemon 2.0.lnk = C:\Program Files\BHODemon 2\BHODemon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/dow…llerControl.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemydsl.verizon.net/sdcCommon…DSL/tgctlcm.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://a1540.g.akamai.net/7/1540/52/200707…ex/qtplugin.cab
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Pet%20Shop%20Hop/Images/stg_drm.ocx
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1EAFB28B-CAA8-47E4-8DEC-968B06FA1D19} (InstallerAX Class) - http://foxmovies.a.content.maven.net/mvms/…installerAX.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {3DCEC959-378A-4922-AD7E-FD5C925D927F} (Disney Online Games ActiveX Control) - http://disney.go.com/pirates/online/testAc…OnlineGames.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {4F5E4276-C120-11D6-A1FD-00508B9D48EA} (dldisplay Class) - http://www.gamehouse.com/ghdlctl.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/097d4f935e0ef5…ip/RdxIE601.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} (CSEQueryObject Object) - http://www.myheritage.com/Genoogle/Compone…EngineQuery.dll
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://us.games2.yimg.com/download.games.y…ctl_0_0_0_2.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125872737687
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX28.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/partner…yle/install.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_a…asyInstallX.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://kiw.imgag.com/imgag/cp/install/crusher-kiwen.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://a.download.toontown.com/sv1.0.38.31/ttinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/4h/pla…0/Installer.exe
O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} (CGameManagerCtrl Object) - https://disney.go.com/games/downloads/gamem…GameManager.cab
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/Puppy%20Luv%20Adventures/Images/armhelper.ocx
O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} (NPX Control) - http://nprotect.roseonlinegame.com/nProtect/Netizen/npx.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…5/installer.exe
O16 - DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} - http://nprotect.roseonlinegame.com/nProtec…Crypt/npkcx.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popc…aploader_v6.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O20 - AppInit_DLLs: C:\Program Files\PremierOpinion\pmai.dll C:\Program Files\PremierOpinion\pmai.dll c:\windows\system32\bakovoti.dll c:\windows\system32\muhizage.dll,C:\WINDOWS\system32\fuledipu.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\muhizage.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\muhizage.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildGames\Game Console - WildGames\GameConsoleService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: npkcmsvc - INCA Internet Co., Ltd. - C:\Nexon\MapleStory\npkcmsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
O24 - Desktop Component 0: (no name) - https://secure.disney.go.com/media/vmk/en_U…bg_gradient.gif

–
End of file - 12354 bytes

oldman960

Post #2May 6, 2009, 5:30 PM UTC

Hi esseff,

Hi , welcome to the forum.

To make cleaning this machine easier

Please do not uninstall/install any programs unless asked to
It is more difficult when files/programs are appearing in/disappearing from the logs.
Please do not run any scans other than those requested
Please follow all instructions in the order posted
All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
Do not attach any logs/reports, etc.. unless specifically requested to do so.
If you have problems with or do not understand the instructions, Please ask before continuing.
Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

Open hijackthis, do a system scan only and checkmark these lines, if present

O2 - BHO: (no name) - {1e930f1c-113e-4f87-bc9a-ecab43a8f215} - C:\WINDOWS\system32\raramuge.dll
O4 - HKLM\..\Run: [CPMcf2eaab6] Rundll32.exe "c:\windows\system32\muhizage.dll",a
O4 - HKLM\..\Run: [cc1d992a] rundll32.exe "C:\WINDOWS\system32\hadatagu.dll",b
O4 - HKLM\..\Run: [merofalori] Rundll32.exe "C:\WINDOWS\system32\buyenayo.dll",s
O4 - S-1-5-21-1634829951-3876798684-2761164870-1016 Startup: PowerReg Scheduler V3.exe (User 'eli')
O4 - S-1-5-21-1634829951-3876798684-2761164870-1016 User Startup: PowerReg Scheduler V3.exe (User 'eli')
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/partner…yle/install.cab
O20 - AppInit_DLLs: C:\Program Files\PremierOpinion\pmai.dll C:\Program Files\PremierOpinion\pmai.dll c:\windows\system32\bakovoti.dll c:\windows\system32\muhizage.dll,C:\WINDOWS\system32\fuledipu.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\muhizage.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\muhizage.dll

Close ALL other windows/browsers and click Fix Checked. Answer Yes if prompted. Close HJT.

Next, Download OTListIt2 to your desktop.

Double click on OTList2.exe
- Under the Custom Scans/Fixes box at the bottom, paste in the following
- Do Not copy the word CODE
- please note the fix starts with the :
```
:OTLI
PRC - C:\Windows\Explorer.EXE (Microsoft Corporation)

:Services

:Reg

:Files
C:\WINDOWS\system32\raramuge.dll
C:\WINDOWS\system32\hadatagu.dll
C:\WINDOWS\system32\buyenayo.dll
C:\WINDOWS\system32\fuledipu.dll
C:\Program Files\PremierOpinion\pmai.dll
c:\windows\system32\bakovoti.dll 
c:\windows\system32\muhizage.dll

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
```
Then click the Run Fix button at the top
- Let the program run unhindered
- Please save the resulting log to your desktop or somewhere you can find it so you can post it in your next reply.
Next

Download and save to your desktop Malwarebytes Anti-Malware

Double Click mbam-setup.exe to install the application.
- Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
- If an update is found, it will download and install the latest version.
- Once the program has loaded, select "Perform Quick Scan", then click Scan.
- The scan may take some time to finish,so please be patient.
- When the scan is complete, click OK, then Show Results to view the results.
- Make sure that everything is checked, and click Remove Selected.
- When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
- The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
- Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Next
- Double click on OTList2.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
- When the window appears, underneath Output at the top change it to Minimal Output
- Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt. These are saved in the same location as OTListIt2.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

Please post back with
- all 3 OTLISIT2 logs
- MBAM log
No need for a Hijackthis log this time.

How is the computer?

Thanks

esseff

Post #3May 7, 2009, 1:06 AM UTC

Here are the 3 OTL logs:

#1:

OTListIt logfile created on: 5/6/2009 5:53:09 PM - Run 1
OTListIt2 by OldTimer - Version 2.0.15.3 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1023.29 Mb Total Physical Memory | 637.40 Mb Available Physical Memory | 62.29% Memory free
2.41 Gb Paging File | 2.14 Gb Available in Paging File | 89.04% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 143.50 Gb Total Space | 52.95 Gb Free Space | 36.90% Space Free | Partition Type: NTFS
Drive D: | 5.53 Gb Total Space | 2.17 Gb Free Space | 39.17% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: B-PLEASE
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\WINDOWS\System32\drivers\CDAC11BA.EXE (Macrovision)
PRC - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
PRC - C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe (Panda Security, S.L.)
PRC - C:\Nexon\MapleStory\npkcmsvc.exe (INCA Internet Co., Ltd.)
PRC - C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe (Stardock Systems, Inc)
PRC - C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation)
PRC - C:\WINDOWS\system32\UAService7.exe ()
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\system32\wscntfy.exe (Microsoft Corporation)
PRC - C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe (Panda Security, S.L.)
PRC - C:\Program Files\BHODemon 2\BHODemon.exe (Definitive Solutions, Inc.)
PRC - C:\Documents and Settings\Owner\Desktop\OTListIt2.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (AntiVirSchedulerService [Auto | Running]) – C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AntiVirService [Auto | Running]) – C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (aspnet_state [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)
SRV - (C-DillaCdaC11BA [Auto | Running]) – C:\WINDOWS\System32\drivers\CDAC11BA.EXE (Macrovision)
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (GameConsoleService [On_Demand | Stopped]) – C:\Program Files\WildGames\Game Console - WildGames\GameConsoleService.exe (WildTangent, Inc.)
SRV - (helpsvc [Auto | Running]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (IDriverT [On_Demand | Stopped]) – C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (Lavasoft Ad-Aware Service [Auto | Stopped]) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (MDM [Auto | Running]) – C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
SRV - (NanoServiceMain [Auto | Running]) – C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe (Panda Security, S.L.)
SRV - (npkcmsvc [Auto | Running]) – C:\Nexon\MapleStory\npkcmsvc.exe (INCA Internet Co., Ltd.)
SRV - (NVSvc [Auto | Running]) – C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation)
SRV - (ose [On_Demand | Stopped]) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (Pml Driver HPZ12 [On_Demand | Stopped]) – C:\WINDOWS\system32\HPZipm12.exe (HP)
SRV - (SNDSrvc [On_Demand | Stopped]) – C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (Symantec Corporation)
SRV - (UserAccess7 [Auto | Running]) – C:\WINDOWS\system32\UAService7.exe ()
SRV - (usnjsvc [On_Demand | Stopped]) – C:\Program Files\Windows Live\Messenger\usnsvc.exe (Microsoft Corporation)
SRV - (WLSetupSvc [On_Demand | Stopped]) – C:\Program Files\Windows Live\installer\WLSetupSvc.exe (Microsoft Corporation)
SRV - (WMPNetworkSvc [On_Demand | Stopped]) – C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (AFS2K [System | Running]) – C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (AgereSoftModem [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\AGRSM.sys (Agere Systems)
DRV - (ALCXSENS [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\ALCXSENS.SYS (Sensaura Ltd)
DRV - (ALCXWDM [On_Demand | Running]) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (avgio [System | Running]) – C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (avgntflt [Auto | Running]) – C:\WINDOWS\system32\DRIVERS\avgntflt.sys (Avira GmbH)
DRV - (avipbb [System | Running]) – C:\WINDOWS\system32\DRIVERS\avipbb.sys (Avira GmbH)
DRV - (CdaC15BA [Auto | Running]) – C:\WINDOWS\System32\drivers\CdaC15BA.SYS (Macrovision Europe Ltd)
DRV - (Cdr4_xp [System | Running]) – C:\WINDOWS\System32\drivers\cdr4_xp.sys (Sonic Solutions)
DRV - (Cdralw2k [System | Running]) – C:\WINDOWS\System32\drivers\cdralw2k.sys (Sonic Solutions)
DRV - (cdudf_xp [System | Running]) – C:\WINDOWS\System32\drivers\Cdudf_xp.sys (Sonic Solutions)
DRV - (DVDVRRdr_xp [System | Running]) – C:\WINDOWS\System32\drivers\DVDVRRdr_xp.sys (Windows ® 2000 DDK provider)
DRV - (dvd_2K [On_Demand | Running]) – C:\WINDOWS\System32\drivers\dvd_2k.sys (Sonic Solutions)
DRV - (EAPPkt [Auto | Running]) – C:\WINDOWS\system32\DRIVERS\EAPPkt.sys (Windows ® 2000 DDK provider)
DRV - (fasttx2k [Boot | Running]) – C:\WINDOWS\System32\DRIVERS\fasttx2k.sys (Promise Technology, Inc.)
DRV - (hamachi_oem [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\gan_adapter.sys (Applied Networking Inc.)
DRV - (HdAudAddService [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\HdAudio.sys (Windows ® Server 2003 DDK provider)
DRV - (HDAudBus [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider)
DRV - (HPZid412 [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\HPZid412.sys (HP)
DRV - (HPZipr12 [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\HPZipr12.sys (HP)
DRV - (HPZius12 [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\HPZius12.sys (HP)
DRV - (ialm [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\ialmnt5.sys (Intel Corporation)
DRV - (L8042Kbd [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\L8042Kbd.sys (Logitech, Inc.)
DRV - (L8042mou [On_Demand | Stopped]) – C:\WINDOWS\System32\Drivers\L8042mou.sys (Logitech, Inc.)
DRV - (Lbd [Boot | Running]) – C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (LHidKe [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\LHidKE.Sys (Logitech, Inc.)
DRV - (LHidUsbK [On_Demand | Running]) – C:\WINDOWS\System32\Drivers\LHidUsbK.Sys (Logitech, Inc.)
DRV - (LMouKE [On_Demand | Running]) – C:\WINDOWS\System32\Drivers\LMouKE.sys (Logitech, Inc.)
DRV - (mmc_2K [On_Demand | Stopped]) – C:\WINDOWS\System32\drivers\mmc_2k.sys (Sonic Solutions)
DRV - (npkcrypt [Auto | Running]) – C:\Nexon\MapleStory\npkcrypt.sys (INCA Internet Co., Ltd.)
DRV - (NPPTNT2 [On_Demand | Stopped]) – C:\WINDOWS\system32\npptNT2.sys (INCA Internet Co., Ltd.)
DRV - (nv [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (Pfc [On_Demand | Running]) – C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
DRV - (Point32 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\point32.sys (Microsoft Corporation)
DRV - (Ps2 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\PS2.sys (Hewlett-Packard Company)
DRV - (PSINAflt [Auto | Running]) – C:\WINDOWS\system32\DRIVERS\PSINAflt.sys (Panda Security, S.L.)
DRV - (PSINFile [Auto | Running]) – C:\WINDOWS\system32\DRIVERS\PSINFile.sys (Panda Security, S.L.)
DRV - (PSINKNC [System | Running]) – C:\WINDOWS\system32\DRIVERS\psinknc.sys (Panda Security, S.L.)
DRV - (PSINProc [Auto | Running]) – C:\WINDOWS\system32\DRIVERS\PSINProc.sys (Panda Security, S.L.)
DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (pwd_2k [System | Running]) – C:\WINDOWS\System32\drivers\Pwd_2k.sys (Sonic Solutions)
DRV - (PxHelp20 [Boot | Running]) – C:\WINDOWS\System32\DRIVERS\PxHelp20.sys (Sonic Solutions)
DRV - (QCDonner [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\OVCD.sys (Microsoft Corporation)
DRV - (rtl8139 [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\R8139n51.SYS (Realtek Semiconductor Corporation )
DRV - (RTLWUSB [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\wg111v2.sys (NETGEAR Inc.)
DRV - (Secdrv [Auto | Running]) – C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (SONYPVU1 [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\SONYPVU1.SYS (Sony Corporation)
DRV - (ssmdrv [System | Running]) – C:\WINDOWS\system32\DRIVERS\ssmdrv.sys (Avira GmbH)
DRV - (SymEvent [On_Demand | Stopped]) – C:\WINDOWS\System32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (SYMREDRV [On_Demand | Stopped]) – C:\WINDOWS\System32\Drivers\SYMREDRV.SYS (Symantec Corporation)
DRV - (SYMTDI [System | Running]) – C:\WINDOWS\System32\Drivers\SYMTDI.SYS (Symantec Corporation)
DRV - (tmcomm [Auto | Running]) – C:\WINDOWS\system32\drivers\tmcomm.sys (Trend Micro Inc.)
DRV - (UDFReadr [System | Running]) – C:\WINDOWS\System32\drivers\Udfreadr.sys (Sonic Solutions)
DRV - (viaagp1 [Boot | Running]) – C:\WINDOWS\System32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.)
DRV - (viagfx [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\vtmini.sys (Copyright © VIA/S3 Graphics, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Data = C3 17 11 E0 B2 A4 AC 29 3E F1 D7 B3 41 B1 C6 E9 F5 FE DE 71 3C 18 BA 0A F9 AA 17 17 FE 78 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?ei=UTF-8&fr;=ytff-msgr&p;="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "www.newsarama.com"
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.071303000004
FF - prefs.js..extensions.enabledItems: {21B08956-4C85-4FAD-B881-FCED4CEC699F}:1.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.5.0.20071211
FF - prefs.js..extensions.enabledItems: {3713a489-0634-4472-8456-dc7abd7eba00}:1.2.2
FF - prefs.js..extensions.enabledItems: {2fbc1200-ad13-11db-abbd-0800200c9a66}:3.0.1
FF - prefs.js..extensions.enabledItems: {7ef7f4d6-947d-11dc-8314-0800200c9a66}:3.0.1
FF - prefs.js..extensions.enabledItems: {5c8bfb7c-9a54-11dc-8314-0800200c9a66}:3.0.2
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.10
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?ei=UTF-8&fr;=ytff-msgr&p;="

FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009/04/28 18:42:50 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009/05/02 18:16:19 | 00,000,000 | —D | M]

[2008/06/18 19:46:34 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Extensions
[2008/06/18 19:46:34 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/05/06 17:40:22 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\31h95b8d.default\extensions
[2008/04/18 22:51:14 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\31h95b8d.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2009/02/19 20:21:45 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\31h95b8d.default\extensions\{2fbc1200-ad13-11db-abbd-0800200c9a66}
[2009/02/19 20:21:17 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\31h95b8d.default\extensions\{3713a489-0634-4472-8456-dc7abd7eba00}
[2009/01/06 11:50:44 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\31h95b8d.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}
[2008/01/13 02:41:20 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\31h95b8d.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009/01/06 11:52:37 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\31h95b8d.default\extensions\{7ef7f4d6-947d-11dc-8314-0800200c9a66}
[2009/03/26 10:59:04 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\31h95b8d.default\extensions\[removed]
[2009/05/06 17:32:37 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions
[2009/05/02 16:43:35 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{21B08956-4C85-4FAD-B881-FCED4CEC699F}
[2009/04/28 18:42:50 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/04/28 18:42:44 | 00,023,032 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/04/28 18:42:44 | 00,134,648 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2009/02/10 04:44:24 | 00,001,394 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
[2009/02/10 04:44:24 | 00,002,193 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2009/02/10 04:44:24 | 00,001,534 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2009/02/10 04:44:24 | 00,002,343 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay.xml
[2009/02/10 04:44:24 | 00,001,706 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\google.xml
[2009/02/10 04:44:24 | 00,001,178 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml

O1 HOSTS File: (22358 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 82.98.231.89 url.adtrgt.com
O1 - Hosts: 82.98.231.89 googleads2.gdoubleclick.net
O1 - Hosts: d.doubleclick.net
O1 - Hosts: 127.0.0.1 ad.preferences.com
O1 - Hosts: 127.0.0.1 ad.washingtonpost.com
O1 - Hosts: 127.0.0.1 adpick.switchboard.com
O1 - Hosts: 127.0.0.1 ads.doubleclick.com
O1 - Hosts: 127.0.0.1 ads.infospace.com
O1 - Hosts: 127.0.0.1 ads.msn.com
O1 - Hosts: 127.0.0.1 ads.switchboard.com
O1 - Hosts: 127.0.0.1 ads.enliven.com
O1 - Hosts: 127.0.0.1 oz.valueclick.com
O1 - Hosts: 127.0.0.1 doubleclick.net
O1 - Hosts: 127.0.0.1 ads.doubleclick.net
O1 - Hosts: 127.0.0.1 ad2.doubleclick.net
O1 - Hosts: 127.0.0.1 ad3.doubleclick.net
O1 - Hosts: 127.0.0.1 ad4.doubleclick.net
O1 - Hosts: 127.0.0.1 ad5.doubleclick.net
O1 - Hosts: 127.0.0.1 ad6.doubleclick.net
O1 - Hosts: 127.0.0.1 ad7.doubleclick.net
O1 - Hosts: 127.0.0.1 ad8.doubleclick.net
O1 - Hosts: 127.0.0.1 ad9.doubleclick.net
O1 - Hosts: 127.0.0.1 ad10.doubleclick.net
O1 - Hosts: 127.0.0.1 ad11.doubleclick.net
O1 - Hosts: 670 more lines…
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll (Yahoo! Inc.)
O2 - BHO: (no name) - {1e930f1c-113e-4f87-bc9a-ecab43a8f215} - C:\WINDOWS\system32\sobaluno.dll File not found
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4E7BD74F-2B8D-469E-9EB4-FE6FA694B13E} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [cc1d992a] rundll32.exe "C:\WINDOWS\system32\kagawike.dll",b File not found
O4 - HKLM..\Run: [merofalori] Rundll32.exe "C:\WINDOWS\system32\bikodina.dll",s File not found
O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup (NVIDIA Corporation)
O4 - HKLM..\Run: [PSUNMain] "C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe" /Traybar (Panda Security, S.L.)
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\BHODemon 2.0.lnk = C:\Program Files\BHODemon 2\BHODemon.exe (Definitive Solutions, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 File not found
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: //@install.mar@ ([]msni in My Computer)
O15 - HKCU\..Trusted Domains: //@mail.mar@ ([]msni in Local intranet)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab (Checkers Class)
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} https://activatemydsl.verizon.net/sdcCommon…DSL/tgctlcm.cab (Support.com Configuration Class)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://a1540.g.akamai.net/7/1540/52/200707…ex/qtplugin.cab (Reg Error: Key error.)
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files/Pet%20Shop%20Hop/Images/stg_drm.ocx (SpinTop DRM Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/get/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1EAFB28B-CAA8-47E4-8DEC-968B06FA1D19} http://foxmovies.a.content.maven.net/mvms/…installerAX.cab (InstallerAX Class)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.macromedia.com/get/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab (Reg Error: Key error.)
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} C:\Program Files\Yahoo!\Common\yinsthelper.dll (YInstStarter Class)
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab (CDownloadCtrl Object)
O16 - DPF: {3DCEC959-378A-4922-AD7E-FD5C925D927F} http://disney.go.com/pirates/online/testAc…OnlineGames.cab (Disney Online Games ActiveX Control)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {4F5E4276-C120-11D6-A1FD-00508B9D48EA} http://www.gamehouse.com/ghdlctl.cab (dldisplay Class)
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} http://software-dl.real.com/097d4f935e0ef5…ip/RdxIE601.cab (RdxIE Class)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} http://www.myheritage.com/Genoogle/Compone…EngineQuery.dll (CSEQueryObject Object)
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} http://us.games2.yimg.com/download.games.y…ctl_0_0_0_2.ocx (ExentInf Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1125872737687 (MUWebControl Class)
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} http://www.nick.com/common/groove/gx/GrooveAX28.cab (Groove Control)
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} http://chat.yahoo.com/cab/yacsui.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab (MessengerStatsClient Class)
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} http://messenger.msn.com/download/MsnMesse…pDownloader.cab (Reg Error: Key error.)
O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} http://www.trendsecure.com/easy_install/_a…asyInstallX.CAB (TSEasyInstallX Control)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} http://kiw.imgag.com/imgag/cp/install/crusher-kiwen.cab (Creative Toolbox Plug-in)
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} http://a.download.toontown.com/sv1.0.38.31/ttinst.cab (Toontown Installer ActiveX Control)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} http://a532.g.akamai.net/f/532/6712/4h/pla…0/Installer.exe (Virtools WebPlayer Class)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Java Plug-in 1.4.2_03)
O16 - DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_03)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} https://disney.go.com/games/downloads/gamem…GameManager.cab (CGameManagerCtrl Object)
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files/Puppy%20Luv%20Adventures/Images/armhelper.ocx (ArmHelper Control)
O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} http://nprotect.roseonlinegame.com/nProtect/Netizen/npx.cab (NPX Control)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flash…ent/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} http://a532.g.akamai.net/f/532/6712/5m/vir…5/installer.exe (Virtools WebPlayer Class)
O16 - DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} http://nprotect.roseonlinegame.com/nProtec…Crypt/npkcx.cab (Reg Error: Key error.)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://download.games.yahoo.com/games/popc…aploader_v6.cab (PopCapLoader Object)
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} http://chat.msn.com/controls/msnchat45.cab (MSN Chat Control 4.5)
O16 - DPF: CabBuilder http://kiw.imgag.com/imgag/kiw/toolbar/dow…llerControl.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\WINDOWS\system32\maveragu.dll) - C:\WINDOWS\system32\maveragu.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O20 - Winlogon\Notify\WB: DllName - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll - C:\Program Files\Stardock\Object Desktop\WindowBlinds\fastload.dll (Stardock)
O21 - SSODL: 0aMCPClient - {F5DF91F9-15E9-416B-A7C3-7519B11ECBFC} - CLSID or File not found.
O24 - Desktop Components:0 () - https://secure.disney.go.com/media/vmk/en_U…bg_gradient.gif
O24 - Desktop Components:1 (My Current Home Page) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/04/21 17:08:59 | 00,000,033 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/28 05:07:38 | 00,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()

========== Files/Folders - Created Within 30 Days ==========

File not found – C:\WINDOWS\System32\juyimebo.dll
File not found – C:\WINDOWS\System32\jokogoni.dll
File not found – C:\WINDOWS\System32\jitabine.dll
File not found – C:\WINDOWS\System32\jekiviku.dll
File not found – C:\WINDOWS\System32\jafiyuji.exe
[2009/05/06 17:43:34 | 00,000,000 | —D | C] – C:\_OTListIt
[2009/05/06 17:41:28 | 00,501,248 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTListIt2.exe
[2009/05/04 17:02:45 | 00,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\Malwarebytes
[2009/05/04 17:02:42 | 00,015,504 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/05/04 17:02:42 | 00,000,704 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/05/04 17:02:40 | 00,038,496 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/05/04 17:02:38 | 00,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2009/05/04 17:02:38 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/05/04 17:01:40 | 02,967,816 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Owner\Desktop\mbam-setup(2).exe
[2009/05/04 16:49:57 | 00,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\Panda Security
[2009/05/04 16:49:21 | 00,000,245 | —- | C] () – C:\WINDOWS\System32\PSUNCpl.dat
[2009/05/04 16:48:50 | 00,000,000 | —D | C] – C:\Program Files\Panda Security
[2009/05/04 16:48:50 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Panda Security
[2009/05/03 11:04:39 | 00,000,660 | —- | C] () – C:\Documents and Settings\Owner\Start Menu\Programs\Startup\BHODemon 2.0.lnk
[2009/05/03 11:04:38 | 00,000,648 | —- | C] () – C:\Documents and Settings\Owner\Desktop\BHODemon 2.0.lnk
[2009/05/03 10:59:45 | 00,001,742 | —- | C] () – C:\Documents and Settings\Owner\Desktop\HijackThis.lnk
[2009/05/03 10:59:44 | 00,000,000 | —D | C] – C:\Program Files\Trend Micro
[2009/05/03 10:47:43 | 19,014,048 | —- | C] () – C:\Documents and Settings\Owner\Desktop\CloudAntivirus.exe
[2009/05/03 10:04:09 | 00,000,000 | —D | C] – C:\VundoFix Backups
[2009/05/02 20:32:04 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
[2009/05/02 19:55:55 | 00,001,715 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Avira AntiVir Control Center.lnk
[2009/05/02 19:55:41 | 00,096,104 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avipbb.sys
[2009/05/02 19:55:41 | 00,055,640 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntflt.sys
[2009/05/02 19:55:41 | 00,045,416 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntdd.sys
[2009/05/02 19:55:41 | 00,022,360 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntmgr.sys
[2009/05/02 19:55:40 | 00,028,376 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\ssmdrv.sys
[2009/05/02 19:55:39 | 00,000,000 | —D | C] – C:\Program Files\Avira
[2009/05/02 19:55:39 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Avira
[2009/05/02 19:47:32 | 00,015,688 | —- | C] () – C:\WINDOWS\System32\lsdelete.exe
[2009/05/02 19:41:11 | 02,967,800 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Owner\Desktop\mbam-setup.exe
[2009/05/02 19:12:50 | 00,064,160 | —- | C] (Lavasoft AB) – C:\WINDOWS\System32\drivers\Lbd.sys
[2009/05/02 19:12:46 | 00,000,472 | —- | C] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2009/05/02 19:09:08 | 00,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
[2009/05/02 19:09:07 | 00,000,875 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2009/05/02 19:08:56 | 00,000,000 | —D | C] – C:\Program Files\Lavasoft
[2009/05/02 19:08:56 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Lavasoft
[2009/05/02 18:39:25 | 00,011,952 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\avgrsstx.dll.install_backup
[2009/05/02 18:38:55 | 00,000,000 | —D | C] – C:\Program Files\AVG
[2009/05/02 18:38:55 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\avg8
[2009/05/02 18:25:12 | 20,404,624 | —- | C] () – C:\Documents and Settings\Owner\Desktop\zaasSetup_70_483_000_en.exe
[2009/05/02 17:02:51 | 00,000,000 | —D | C] – C:\Program Files\MSSOAP
[2009/05/02 17:02:08 | 01,563,008 | —- | C] (Webroot Software, Inc.) – C:\WINDOWS\WRSetup.dll
[2009/05/02 17:00:07 | 00,000,164 | —- | C] () – C:\WINDOWS\install.dat
[2009/05/02 16:58:40 | 00,000,001 | —- | C] () – C:\WINDOWS\System32\uniq.tll
[2009/05/02 16:51:50 | 01,406,509 | -HS- | C] () – C:\WINDOWS\System32\ivebeneh.ini
[2009/05/02 12:21:19 | 00,000,000 | —D | C] – C:\Documents and Settings\Owner\Desktop\justice
[2009/04/26 20:03:07 | 01,829,819 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Megan Fox - more Transformers stills0013.jpg
[2009/04/26 07:15:22 | 00,109,966 | —- | C] () – C:\Documents and Settings\Owner\Desktop\normal_WonderlandEscapeJSCsm.jpg
[2009/04/23 20:15:04 | 00,365,824 | —- | C] (Panda Security, S.L.) – C:\WINDOWS\System32\PSUNCpl.cpl
[2009/04/23 20:15:02 | 00,136,968 | —- | C] (Panda Security, S.L.) – C:\WINDOWS\System32\drivers\PSINAflt.sys
[2009/04/23 20:15:02 | 00,113,928 | —- | C] (Panda Security, S.L.) – C:\WINDOWS\System32\drivers\PSINKNC.sys
[2009/04/23 20:15:02 | 00,098,056 | —- | C] (Panda Security, S.L.) – C:\WINDOWS\System32\drivers\PSINProc.sys
[2009/04/23 20:15:02 | 00,092,552 | —- | C] (Panda Security, S.L.) – C:\WINDOWS\System32\drivers\PSINFile.sys
[2009/04/21 19:01:00 | 00,258,376 | -H– | C] () – C:\Documents and Settings\Owner\Desktop\l_ab46fbfc76d74a149323c7ee1a637866.png
[2009/04/21 18:55:34 | 01,328,616 | —- | C] () – C:\Documents and Settings\Owner\Desktop\soulfiregrace_1024.jpg
[2009/04/17 10:28:51 | 00,212,391 | —- | C] () – C:\Documents and Settings\Owner\Desktop\sg_cv43-cv.jpg
[2009/04/15 07:43:43 | 01,203,922 | —- | C] () – C:\WINDOWS\System32\dllcache\sysmain.sdb
[2009/04/15 07:43:43 | 00,215,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wordpad.exe
[2009/04/15 07:43:43 | 00,002,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpsp4res.dll
[2009/04/15 07:43:21 | 00,284,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pdh.dll
[2009/04/15 07:43:20 | 00,729,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lsasrv.dll
[2009/04/15 07:43:20 | 00,714,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntdll.dll
[2009/04/15 07:43:20 | 00,617,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\advapi32.dll
[2009/04/15 07:43:20 | 00,473,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fastprox.dll
[2009/04/15 07:43:20 | 00,453,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiprvsd.dll
[2009/04/15 07:43:20 | 00,401,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rpcss.dll
[2009/04/15 07:43:20 | 00,227,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiprvse.exe
[2009/04/15 07:43:20 | 00,110,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\services.exe
[2009/04/13 18:36:03 | 00,175,124 | —- | C] () – C:\Documents and Settings\Owner\Desktop\CFHK1_COV_Color_02.jpg
[2009/04/12 20:05:55 | 00,833,020 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Plasmic_Folio_Gif_by_djsmalley.gif
[2009/04/11 09:50:22 | 00,001,009 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Toontown Online.lnk
[2009/04/10 20:48:01 | 00,002,353 | —- | C] () – C:\Documents and Settings\Owner\Desktop\MapleStory.lnk
[2009/04/10 20:38:46 | 00,000,000 | —D | C] – C:\Nexon
[2009/04/10 19:39:15 | 12,317,77808 | —- | C] () – C:\Documents and Settings\Owner\Desktop\MSSetupv68.exe
[2009/04/10 19:38:44 | 00,000,000 | —D | C] – C:\Program Files\Pando Networks
[2009/04/10 19:27:03 | 00,001,691 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Disney's Toontown Online.lnk
[2009/04/10 14:48:20 | 02,868,666 | —- | C] () – C:\Documents and Settings\Owner\Desktop\rawr.bmp
[2009/03/20 15:25:02 | 00,041,808 | —- | C] () – C:\WINDOWS\System32\xfcodec.dll
[2009/02/06 04:52:24 | 00,049,664 | —- | C] () – C:\WINDOWS\System32\maveragu.dll
[2009/02/06 04:51:51 | 00,078,848 | -HS- | C] () – C:\WINDOWS\System32\lehubibe.dll
[2009/02/06 04:51:51 | 00,049,664 | -HS- | C] () – C:\WINDOWS\System32\hakuzoha.dll
[2009/02/05 16:51:30 | 00,081,408 | -HS- | C] () – C:\WINDOWS\System32\korumore.dll
[2008/11/25 21:34:02 | 00,000,262 | —- | C] () – C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2008/10/25 12:37:28 | 00,000,523 | —- | C] () – C:\WINDOWS\TCII.ini
[2008/08/30 06:45:58 | 00,069,632 | R— | C] () – C:\WINDOWS\System32\xmltok.dll
[2008/08/30 06:45:58 | 00,036,864 | R— | C] () – C:\WINDOWS\System32\xmlparse.dll
[2008/07/13 19:47:59 | 00,000,000 | —- | C] () – C:\WINDOWS\PhantomOfVenice.INI
[2008/05/16 14:01:00 | 01,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2008/05/16 14:01:00 | 00,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2008/03/15 16:34:59 | 00,022,016 | —- | C] () – C:\WINDOWS\System32\ODBCSTF.DLL
[2008/01/19 09:35:11 | 00,000,000 | —- | C] () – C:\WINDOWS\PTWebCam.INI
[2007/10/28 12:36:14 | 00,009,728 | —- | C] () – C:\WINDOWS\System32\BASSMOD.dll
[2007/07/25 10:44:34 | 00,000,297 | —- | C] () – C:\WINDOWS\SIERRA.INI
[2007/07/21 13:59:22 | 00,000,000 | —- | C] () – C:\WINDOWS\game.INI
[2007/06/10 11:28:30 | 00,056,832 | —- | C] () – C:\WINDOWS\System32\IYVU9_32.DLL
[2007/02/06 19:34:25 | 00,000,069 | —- | C] () – C:\WINDOWS\SONIC.INI
[2007/01/23 19:13:46 | 00,006,048 | —- | C] () – C:\WINDOWS\System32\MCC16.dll
[2006/06/01 17:22:00 | 01,486,848 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2006/06/01 17:22:00 | 00,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2006/04/23 16:13:08 | 00,000,144 | —- | C] () – C:\WINDOWS\wb.ini
[2005/12/07 15:42:24 | 00,020,480 | —- | C] () – C:\WINDOWS\System32\wbload.dll
[2005/11/07 21:47:24 | 00,684,032 | —- | C] () – C:\WINDOWS\libeay32.dll
[2005/11/07 21:47:24 | 00,155,648 | —- | C] () – C:\WINDOWS\ssleay32.dll
[2005/10/25 12:12:50 | 00,000,097 | —- | C] () – C:\WINDOWS\System32\PICSDK.ini
[2005/10/25 12:07:38 | 00,000,044 | —- | C] () – C:\WINDOWS\EPCX4800.ini
[2005/10/03 09:58:14 | 00,000,072 | —- | C] () – C:\WINDOWS\iltwain.ini
[2005/09/13 08:19:15 | 00,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2005/07/04 09:40:05 | 00,003,082 | —- | C] () – C:\WINDOWS\System32\affv208325p1now.sys
[2005/06/10 19:38:30 | 00,000,033 | —- | C] () – C:\WINDOWS\gunzlauncher.INI
[2005/06/04 16:29:40 | 00,000,032 | —- | C] () – C:\WINDOWS\wininit.ini
[2005/06/01 14:53:06 | 00,008,373 | —- | C] () – C:\WINDOWS\System32\np_kor.ini
[2005/05/20 19:49:20 | 00,000,016 | —- | C] () – C:\WINDOWS\RealityFusion.ini
[2005/05/20 19:45:44 | 00,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll
[2005/05/18 19:32:10 | 00,000,001 | —- | C] () – C:\WINDOWS\System32\au3305adc.dll
[2005/05/18 19:31:58 | 00,000,067 | —- | C] () – C:\WINDOWS\Apollo DVD Copy.INI
[2005/05/11 19:47:33 | 00,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2005/04/29 22:40:30 | 00,012,288 | —- | C] () – C:\WINDOWS\impborl.dll
[2005/04/21 17:04:32 | 00,000,000 | —- | C] () – C:\WINDOWS\SETUP32.INI
[2005/03/22 12:18:26 | 00,000,018 | —- | C] () – C:\WINDOWS\ka.ini
[2005/03/08 14:38:20 | 00,006,808 | —- | C] () – C:\WINDOWS\System32\np_chs.ini
[2005/03/08 11:13:12 | 00,008,626 | —- | C] () – C:\WINDOWS\System32\np_jpn.ini
[2005/03/02 14:55:40 | 00,008,023 | —- | C] () – C:\WINDOWS\System32\np_eng.ini
[2005/02/05 12:57:30 | 00,004,419 | —- | C] () – C:\WINDOWS\hpdj3600.ini
[2005/02/05 12:54:34 | 00,000,414 | —- | C] () – C:\WINDOWS\hpbvspst.ini
[2004/12/07 20:21:10 | 00,065,536 | —- | C] () – C:\WINDOWS\System32\xfire_lsp_10650.dll
[2004/11/27 20:03:22 | 00,000,071 | -HS- | C] () – C:\WINDOWS\System32\SYSDRVVC.SYS
[2004/11/27 20:03:22 | 00,000,061 | —- | C] () – C:\WINDOWS\System32\SYSVCDRV.SYS
[2004/11/24 19:07:16 | 00,006,852 | —- | C] () – C:\WINDOWS\System32\drivers\Vcs.sys
[2004/10/16 00:33:05 | 00,000,016 | —- | C] () – C:\WINDOWS\odbctrap.ini
[2004/10/16 00:30:45 | 00,000,016 | —- | C] () – C:\WINDOWS\backodbc.ini
[2004/09/18 19:03:25 | 00,000,000 | —- | C] () – C:\WINDOWS\iPlayer.INI
[2004/09/12 16:30:11 | 00,000,045 | —- | C] () – C:\WINDOWS\JBLENJKJ.ini
[2004/09/02 18:32:37 | 00,001,889 | —- | C] () – C:\WINDOWS\disney.ini
[2004/09/02 17:25:32 | 00,000,716 | —- | C] () – C:\WINDOWS\hegames.ini
[2004/08/21 22:06:35 | 00,043,520 | —- | C] () – C:\WINDOWS\System32\CmdLineExt03.dll
[2004/08/18 19:53:58 | 00,045,056 | —- | C] () – C:\WINDOWS\System32\xfire_lsp_8742.dll
[2004/05/15 04:32:12 | 00,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/05/12 22:01:17 | 00,028,672 | —- | C] () – C:\WINDOWS\System32\JAWTAccessBridge.dll
[2004/05/12 22:00:51 | 00,086,016 | —- | C] () – C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2004/05/12 22:00:51 | 00,065,536 | —- | C] () – C:\WINDOWS\System32\ProgressTrace.dll
[2004/05/12 21:57:44 | 00,167,936 | —- | C] () – C:\WINDOWS\System32\PCDrJNI_1_1.dll
[2004/05/12 21:42:17 | 00,027,756 | —- | C] () – C:\WINDOWS\System32\CHODDI.SYS
[2004/05/12 21:41:38 | 00,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2004/05/12 20:50:40 | 00,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2004/05/12 20:42:12 | 00,000,889 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2004/05/12 20:02:46 | 00,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2004/05/12 19:54:22 | 01,703,936 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2004/05/12 19:21:01 | 00,299,073 | —- | C] () – C:\WINDOWS\System32\PythonCOM22.dll
[2004/05/12 19:21:01 | 00,065,536 | —- | C] () – C:\WINDOWS\System32\PyWinTypes22.dll
[2004/05/12 19:20:43 | 00,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2004/05/12 18:51:31 | 00,000,802 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/05/12 18:36:11 | 00,000,553 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2004/05/12 18:35:49 | 00,001,123 | —- | C] () – C:\WINDOWS\win.ini
[2004/05/12 18:35:45 | 00,000,227 | —- | C] () – C:\WINDOWS\system.ini
[2003/01/07 15:05:08 | 00,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[1999/08/10 10:02:20 | 00,116,736 | —- | C] () – C:\WINDOWS\System32\LFKODAK.DLL
[1999/08/10 10:02:16 | 00,343,040 | —- | C] () – C:\WINDOWS\System32\lffpx7.dll

========== Files - Modified Within 30 Days ==========

[8 C:\WINDOWS\System32\*.tmp files]
[6 C:\WINDOWS\*.tmp files]
[2009/05/06 18:01:51 | 00,011,168 | -H– | M] () – C:\WINDOWS\System32\wakujiru
[2009/05/06 17:48:13 | 00,183,406 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2009/05/06 17:47:08 | 00,001,230 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/05/06 17:46:27 | 00,000,062 | -HS- | M] () – C:\Documents and Settings\Owner\Local Settings\desktop.ini
[2009/05/06 17:46:20 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/05/06 17:46:15 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/05/06 17:41:28 | 00,501,248 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTListIt2.exe
[2009/05/06 04:52:22 | 00,049,664 | -HS- | M] () – C:\WINDOWS\System32\hakuzoha.dll
[2009/05/06 04:51:54 | 00,022,358 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2009/05/06 04:51:52 | 00,078,848 | -HS- | M] () – C:\WINDOWS\System32\lehubibe.dll
[2009/05/05 16:51:31 | 00,081,408 | -HS- | M] () – C:\WINDOWS\System32\korumore.dll
[2009/05/04 19:12:36 | 00,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2009/05/04 17:53:18 | 00,001,123 | —- | M] () – C:\WINDOWS\win.ini
[2009/05/04 17:53:18 | 00,000,281 | RHS- | M] () – C:\boot.ini
[2009/05/04 17:53:18 | 00,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2009/05/04 17:02:42 | 00,000,704 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/05/04 17:01:43 | 02,967,816 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Owner\Desktop\mbam-setup(2).exe
[2009/05/04 16:49:21 | 00,000,245 | —- | M] () – C:\WINDOWS\System32\PSUNCpl.dat
[2009/05/03 11:04:39 | 00,000,660 | —- | M] () – C:\Documents and Settings\Owner\Start Menu\Programs\Startup\BHODemon 2.0.lnk
[2009/05/03 11:04:38 | 00,000,648 | —- | M] () – C:\Documents and Settings\Owner\Desktop\BHODemon 2.0.lnk
[2009/05/03 10:59:45 | 00,001,742 | —- | M] () – C:\Documents and Settings\Owner\Desktop\HijackThis.lnk
[2009/05/03 10:49:20 | 19,014,048 | —- | M] () – C:\Documents and Settings\Owner\Desktop\CloudAntivirus.exe
[2009/05/02 19:55:55 | 00,001,715 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Avira AntiVir Control Center.lnk
[2009/05/02 19:41:16 | 02,967,800 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Owner\Desktop\mbam-setup.exe
[2009/05/02 19:12:32 | 00,015,688 | —- | M] () – C:\WINDOWS\System32\lsdelete.exe
[2009/05/02 19:12:23 | 00,064,160 | —- | M] (Lavasoft AB) – C:\WINDOWS\System32\drivers\Lbd.sys
[2009/05/02 19:09:07 | 00,000,875 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2009/05/02 18:39:25 | 00,011,952 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\avgrsstx.dll.install_backup
[2009/05/02 18:26:32 | 20,404,624 | —- | M] () – C:\Documents and Settings\Owner\Desktop\zaasSetup_70_483_000_en.exe
[2009/05/02 17:13:45 | 01,406,509 | -HS- | M] () – C:\WINDOWS\System32\ivebeneh.ini
[2009/05/02 17:10:21 | 00,004,212 | -H– | M] () – C:\WINDOWS\System32\zllictbl.dat
[2009/05/02 17:00:10 | 00,000,164 | —- | M] () – C:\WINDOWS\install.dat
[2009/05/02 16:58:40 | 00,000,001 | —- | M] () – C:\WINDOWS\System32\uniq.tll
[2009/04/26 20:03:08 | 01,829,819 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Megan Fox - more Transformers stills0013.jpg
[2009/04/26 18:28:54 | 00,000,570 | —- | M] () – C:\Documents and Settings\Owner\My Documents\My Sharing Folders.lnk
[2009/04/26 07:15:23 | 00,109,966 | —- | M] () – C:\Documents and Settings\Owner\Desktop\normal_WonderlandEscapeJSCsm.jpg
[2009/04/23 20:15:04 | 00,365,824 | —- | M] (Panda Security, S.L.) – C:\WINDOWS\System32\PSUNCpl.cpl
[2009/04/23 20:15:02 | 00,136,968 | —- | M] (Panda Security, S.L.) – C:\WINDOWS\System32\drivers\PSINAflt.sys
[2009/04/23 20:15:02 | 00,113,928 | —- | M] (Panda Security, S.L.) – C:\WINDOWS\System32\drivers\PSINKNC.sys
[2009/04/23 20:15:02 | 00,098,056 | —- | M] (Panda Security, S.L.) – C:\WINDOWS\System32\drivers\PSINProc.sys
[2009/04/23 20:15:02 | 00,092,552 | —- | M] (Panda Security, S.L.) – C:\WINDOWS\System32\drivers\PSINFile.sys
[2009/04/21 19:01:00 | 00,258,376 | -H– | M] () – C:\Documents and Settings\Owner\Desktop\l_ab46fbfc76d74a149323c7ee1a637866.png
[2009/04/21 18:55:35 | 01,328,616 | —- | M] () – C:\Documents and Settings\Owner\Desktop\soulfiregrace_1024.jpg
[2009/04/19 14:34:00 | 00,000,334 | —- | M] () – C:\WINDOWS\tasks\HP DArC Task #Hewlett-Packard#deskjet3600#TH391180TY6B.job
[2009/04/17 18:36:23 | 00,002,353 | —- | M] () – C:\Documents and Settings\Owner\Desktop\MapleStory.lnk
[2009/04/17 10:28:53 | 00,212,391 | —- | M] () – C:\Documents and Settings\Owner\Desktop\sg_cv43-cv.jpg
[2009/04/16 05:16:40 | 00,483,924 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2009/04/16 05:16:40 | 00,410,574 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2009/04/16 05:16:40 | 00,065,044 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2009/04/15 16:06:18 | 00,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2009/04/13 18:36:04 | 00,175,124 | —- | M] () – C:\Documents and Settings\Owner\Desktop\CFHK1_COV_Color_02.jpg
[2009/04/12 20:05:56 | 00,833,020 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Plasmic_Folio_Gif_by_djsmalley.gif
[2009/04/11 09:50:22 | 00,001,009 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Toontown Online.lnk
[2009/04/10 20:25:03 | 12,317,77808 | —- | M] () – C:\Documents and Settings\Owner\Desktop\MSSetupv68.exe
[2009/04/10 19:27:03 | 00,001,691 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Disney's Toontown Online.lnk
[2009/04/10 14:48:21 | 02,868,666 | —- | M] () – C:\Documents and Settings\Owner\Desktop\rawr.bmp
[2009/04/07 11:26:25 | 00,172,544 | -HS- | M] () – C:\Documents and Settings\Owner\Desktop\Thumbs.db

========== Alternate Data Streams ==========

@Alternate Data Stream - 98 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:82D2F22F
@Alternate Data Stream - 98 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:01267597
@Alternate Data Stream - 97 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:726D640A
@Alternate Data Stream - 97 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2E301D62
@Alternate Data Stream - 96 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:38E2864F
@Alternate Data Stream - 94 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1713795
@Alternate Data Stream - 94 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:36E6A05E
@Alternate Data Stream - 156 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:38673444
@Alternate Data Stream - 154 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4F636E25
@Alternate Data Stream - 152 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:61E5F0F7
@Alternate Data Stream - 148 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8A0F20CD
@Alternate Data Stream - 146 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7C017FB1
@Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CA4300C6
@Alternate Data Stream - 132 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8643C5BE
@Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:ECF54A0E
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:404390E0
@Alternate Data Stream - 128 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1D6686D8
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FACB65E7
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6677D85A
@Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9793175D
@Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:786D9A37
@Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6FDE1666
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2B99FE60
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D37966A8
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:99DF1754
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:77721732
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5B4A736C
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5D2892D9
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0065C8FF
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5711EF65
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:55CC8080
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3D69B4B5
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:78D09D71
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:538B96B5
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1247C505
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FC1E9FAB
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F4242C54
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:492679C1
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:36397F39
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4CF61E54
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9DF7E450
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:949483BD
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6468C896
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0AE6CC6C
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8EE28671
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3B3A35EC
@Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CE6885F1
@Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5CBEF5B8
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:98AE08EA
@Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:61A065F2
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F3F95A98
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A7601C61
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8ACBDE06
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:708BB0FA
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:11F7EB8A
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A69F57F3
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5927116F
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:EB42AC3C
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D6EC4C9C
@Alternate Data Stream - 107 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8A628F34
@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F50F1555
@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A468A21E
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CB0EB1DE
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5E1404CE
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3BE7E50E
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B741B2C2
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:052A05A1
@Alternate Data Stream - 101 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:94F67F32
@Alternate Data Stream - 101 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:31D2961C
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:95DE6783
< End of report >

#2

OTListIt Extras logfile created on: 5/6/2009 5:53:09 PM - Run 1
OTListIt2 by OldTimer - Version 2.0.15.3 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1023.29 Mb Total Physical Memory | 637.40 Mb Available Physical Memory | 62.29% Memory free
2.41 Gb Paging File | 2.14 Gb Available in Paging File | 89.04% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 143.50 Gb Total Space | 52.95 Gb Free Space | 36.90% Space Free | Partition Type: NTFS
Drive D: | 5.53 Gb Total Space | 2.17 Gb Free Space | 39.17% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: B-PLEASE
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 1
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
"EnableFirewall" = 1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe:*:enabled:F-Secure Automatic Update File not found
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)
C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger (Microsoft Corporation)
C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone) (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe:*:enabled:F-Secure Automatic Update File not found
C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent ()
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)
C:\Documents and Settings\Owner\Desktop\utorrent.exe:*:Enabled:µTorrent ()
C:\Program Files\the script 2003\mirc.exe:*:Enabled:mIRC File not found
C:\Program Files\Unreal Tournament 3 Demo\Binaries\UT3Demo.exe:*:Enabled:Unreal Tournament 3 Demo File not found
C:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe:*:Enabled:Remote Assistance - Windows Messenger and Voice (Microsoft Corporation)
C:\Program Files\Windows Media Player\wmplayer.exe:*:Enabled:Windows Media Player (Microsoft Corporation)
C:\UT2004Demo\System\UT2004.exe:*:Enabled:UT2004 ()
C:\UT2004\System\UT2004.exe:*:Enabled:UT2004 File not found
C:\Documents and Settings\Emily\Local Settings\Temp\~os43B.tmp\ossproxy.exe:*:Enabled:ossproxy.exe File not found
C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger (Microsoft Corporation)
C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone) (Microsoft Corporation)
X:\Program Files\Croteam\Serious Sam - The Second Encounter\Bin\SeriousSam.exe:*:Enabled:SeriousSam.exe File not found
C:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe ()
C:\Program Files\MySpace\IM\MySpaceIM.exe:*:Enabled:MySpaceIM File not found
C:\WINDOWS\explorer.exe:*:Enabled:Explorer (Microsoft Corporation)
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE:*:Enabled:MDM (Microsoft Corporation)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{12DCDE3D-5C8E-4C5E-A7E4-CEF30F578179}" = Dogz 5
"{14589F05-C658-4594-9429-D437BA688686}" = IntelliMover Data Transfer Demo
"{1A655D51-1423-48A3-B748-8F5A0BE294C8}" = Microsoft Visual J# .NET Redistributable Package 1.1
"{1F7CCFA3-D926-4882-B2A5-A0217ED25597}" = PC-Doctor for Windows
"{22E9CF2B-4063-4dab-A251-93FA46F7DECC}_is1" = Webroot AntiVirus with AntiSpyware
"{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}" = Logitech SetPoint
"{32343DB6-9A52-40C9-87E4-5E7C79791C87}" = MSXML 4.0 SP2 and SOAP Toolkit 3.0
"{3248F0A8-6813-11D6-A77B-00B0D0150030}" = J2SE Runtime Environment 5.0 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{42ABBD6C-422E-4523-B776-2ADD6EEA9C65}" = Panda Cloud Antivirus
"{45B6180B-DCAB-4093-8EE8-6164457517F0}" = Photosmart 140,240,7200,7600,7700,7900 Series
"{4B682CF4-9B41-4297-8B13-968B28B864C6}" = FlatOut Demo
"{4F1CECBC-670F-4DAA-81D6-944B12450917}" = DIGOpt
"{508CE775-4BA4-4748-82DF-FE28DA9F03B0}" = Windows Live Messenger
"{517B8FB2-26EE-43B0-AE1B-07408860AA69}" = DigitImg
"{60758250-C8CF-47EB-8CB6-E0C3B84D8207}" = PSShortcuts
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{7148F0A8-6813-11D6-A77B-00B0D0142030}" = Java 2 Runtime Environment, SE v1.4.2_03
"{7169B8E4-2632-46B1-AA5F-167CB5FE5029}" = Symantec Network Drivers Update
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{764D06D8-D8DE-411E-A1C8-D9E9380F8A84}" = Microsoft Works 7.0
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{86F3A89F-94A4-4D15-99DB-B1BDAD96546C}" = MapleStory
"{8795CBED-55E2-4693-9F14-84EC446935BE}" = SpeechRedist
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{952E20B0-879C-4FAE-8B72-E515E2946AB6}" = Rose Online
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}" = Windows Live installer
"{A99C6296-A311-4D6C-9602-53B4241921D5}" = Roxio Easy Media Creator 7
"{AC76BA86-7AD7-1033-7B44-A70900000002}" = Adobe Reader 7.0.9
"{B376402D-58EA-45EA-BD50-DD924EB67A70}" = HP Memories Disc
"{B508B3F1-A24A-32C0-B310-85786919EF28}" = Microsoft .NET Framework 2.0 Service Pack 1
"{C6A7AF96-4EB1-4AAE-8318-1AB393C64F88}" = Microsoft Plus! Digital Media Edition
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D07643A3-CE41-4286-8C78-EB9C83E76DDB}" = PunkBuster for Battlefield Vietnam
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{DE4997B5-55AD-4878-97A7-C9FA84FE23C7}" = PSUsage
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E0F252A6-DE85-4E93-A93B-DFC3537B3965}" = WG111v2 Configuration Utility
"{E7E254C0-94AA-4B33-AF6D-5276A169A680}" = TONKA Search & Rescue 2
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F7D1D93A-B17A-41F8-9070-0B2A544C6165}" = LEGO Star Wars Demo Disc
"{F843C6A3-224D-4615-94F8-3C461BD9AEA0}" = Jasc Paint Shop Pro 9
"3DGroove" = 3D Groove Playback Engine
"Absolute Uninstaller_is1" = Absolute Uninstaller 1.44
"Ad-Aware" = Ad-Aware
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Agere Systems Soft Modem" = Agere Systems PCI Soft Modem
"AruaROSE" = AruaROSE
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"BackWeb-1940576 Uninstaller" = Compaq Connections
"BHODemon_is1" = BHODemon 2.0.0.23
"Building Cars with Gary Gadget_is1" = Building Cars
"CdaC13Ba" = SafeCast Shared Components
"Disney Toontown Online" = Disney Toontown Online
"Disney's Toontown Online" = Disney's Toontown Online
"Download Manager" = Download Manager 2.3.6
"Feeding Frenzy 2: Shipwreck Showdown" = Feeding Frenzy 2: Shipwreck Showdown
"FLVPlayer" = FLV Player 1.3.3
"G-Force" = G-Force
"HijackThis" = HijackThis 2.0.2
"hp print screen utility" = hp print screen utility
"IconPackager" = IconPackager
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"Jasc Paint Shop Pro 9.01 - (9.0.1.1)" = Jasc Paint Shop Pro 9.01 - (9.0.1.1)
"Jimmy Neutron Boy Genius" = Jimmy Neutron Boy Genius
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Mozilla Firefox (3.0.10)" = Mozilla Firefox (3.0.10)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MultiRes (remove only)" = MultiRes (remove only)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Display Driver" = NVIDIA Display Driver
"NVIDIA Drivers" = NVIDIA Drivers
"ObjectDock" = ObjectDock
"Pajama Sam's no Need to Hide" = Pajama Sam's no Need to Hide
"Panda Cloud Antivirus" = Panda Cloud Antivirus
"Pegasus Test Server - ROSE Online Evolution175" = Pegasus Test Server - ROSE Online Evolution
"PS2" = PS2
"Python 2.2 combined Win32 extensions" = Python 2.2 combined Win32 extensions
"Python 2.2.1" = Python 2.2.1
"Q903235" = Internet Explorer Q903235
"ROSE Online Evolution182" = ROSE Online Evolution
"ST6UNST #1" = R.O.S.E. NA Server Status Ticker
"Super Collapse! from GameHouse" = Super Collapse! from GameHouse
"Superb Display Pictures for Messenger" = Superb Display Pictures for Messenger
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"the script 20034.0" = the script 2003
"Theme Park World" = SimTheme Park
"Tonka Construction 2" = Tonka Construction 2
"UT2004-Demo" = Unreal Tournament 2004 Demo
"Virtual Villagers - The Secret City" = Virtual Villagers - The Secret City (remove only)
"VLC media player" = VideoLAN VLC media player 0.8.6f
"wcmdmgr.exe" = WildTangent Updater
"WGA" = Windows Genuine Advantage Validation Tool
"WildTangent CDA" = WildTangent Web Driver
"WildTangent wildgames Master Uninstall" = WildTangent Games
"Window Washer" = Window Washer
"WindowBlinds" = WindowBlinds
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WinZip" = WinZip
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Xfire" = Xfire (remove only)
"Yahoo! Anti-Spy" = Yahoo! Anti-Spy
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Toolbar" = Yahoo! Toolbar
"YInstHelper" = Yahoo! Install Manager

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"InstallShield_{3266FEA9-98E9-448B-B235-DAC63D4CE781}" = Unreal Tournament 3 Demo
"sevenhearts_761_761" = sevenhearts_761_761

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 5/4/2009 10:18:21 PM | Computer Name = B-PLEASE | Source = Application Hang | ID = 1002
Description = Hanging application taskmgr.exe, version 5.1.2600.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 5/4/2009 10:20:40 PM | Computer Name = B-PLEASE | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.0.3399, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 5/5/2009 6:44:34 AM | Computer Name = B-PLEASE | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.0.3399, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 5/5/2009 8:00:37 PM | Computer Name = B-PLEASE | Source = Application Hang | ID = 1002
Description = Hanging application rundll32.exe, version 5.1.2600.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 5/5/2009 8:00:37 PM | Computer Name = B-PLEASE | Source = Application Hang | ID = 1002
Description = Hanging application rundll32.exe, version 5.1.2600.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 5/5/2009 8:03:07 PM | Computer Name = B-PLEASE | Source = Application Hang | ID = 1002
Description = Hanging application calc.exe, version 5.1.2600.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 5/4/2009 9:10:14 PM | Computer Name = B-PLEASE | Source = Service Control Manager | ID = 7034
Description = The SecuROM User Access Service (V7) service terminated unexpectedly.
It has done this 1 time(s).

Error - 5/4/2009 9:10:24 PM | Computer Name = B-PLEASE | Source = Service Control Manager | ID = 7031
Description = The Print Spooler service terminated unexpectedly. It has done this
1 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 5/4/2009 9:10:31 PM | Computer Name = B-PLEASE | Source = Service Control Manager | ID = 7031
Description = The NanoServiceMain service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 0 milliseconds:
Restart the service.

Error - 5/4/2009 9:10:39 PM | Computer Name = B-PLEASE | Source = Service Control Manager | ID = 7034
Description = The NVIDIA Display Driver Service service terminated unexpectedly.
It has done this 1 time(s).

Error - 5/4/2009 9:10:46 PM | Computer Name = B-PLEASE | Source = Service Control Manager | ID = 7031
Description = The NanoServiceMain service terminated unexpectedly. It has done
this 2 time(s). The following corrective action will be taken in 0 milliseconds:
Restart the service.

Error - 5/4/2009 9:10:51 PM | Computer Name = B-PLEASE | Source = Service Control Manager | ID = 7034
Description = The NanoServiceMain service terminated unexpectedly. It has done
this 3 time(s).

Error - 5/4/2009 9:11:15 PM | Computer Name = B-PLEASE | Source = Service Control Manager | ID = 7034
Description = The Machine Debug Manager service terminated unexpectedly. It has
done this 1 time(s).

Error - 5/4/2009 9:11:32 PM | Computer Name = B-PLEASE | Source = Service Control Manager | ID = 7031
Description = The Print Spooler service terminated unexpectedly. It has done this
2 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 5/4/2009 9:11:40 PM | Computer Name = B-PLEASE | Source = Service Control Manager | ID = 7034
Description = The Application Layer Gateway Service service terminated unexpectedly.
It has done this 1 time(s).

Error - 5/6/2009 8:18:55 AM | Computer Name = B-PLEASE | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
fasttx2k IntelIde viaagp1 ViaIde

< End of report >

esseff

Post #4May 7, 2009, 2:36 AM UTC

Here is the third and the malwarebytes…. #3 ========== OTLISTIT ========== Process Explorer.EXE killed successfully! ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== File\Folder C:\WINDOWS\system32\raramuge.dll not found. File\Folder C:\WINDOWS\system32\hadatagu.dll not found. File\Folder C:\WINDOWS\system32\buyenayo.dll not found. File\Folder C:\WINDOWS\system32\fuledipu.dll not found. File\Folder C:\Program Files\PremierOpinion\pmai.dll not found. File\Folder c:\windows\system32\bakovoti.dll not found. File\Folder c:\windows\system32\muhizage.dll not found. ========== COMMANDS ========== File delete failed. C:\Documents and Settings\Owner\Local Settings\Temp\etilqs_6IOyOZxOFgNMDH5JRQON scheduled to be deleted on reboot. User's Temp folder emptied. User's Internet Explorer cache folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. Network Service Temp folder emptied. Network Service Temporary Internet Files folder emptied. Windows Temp folder emptied. Java cache emptied. Temp folders emptied. Explorer started successfully OTListIt2 by OldTimer - Version 2.0.15.3 log created on 05062009_174334 Files moved on Reboot… File C:\Documents and Settings\Owner\Local Settings\Temp\etilqs_6IOyOZxOFgNMDH5JRQON not found! Registry entries deleted on Reboot… And the malwarebytes: Malwarebytes' Anti-Malware 1.36 Database version: 2075 Windows 5.1.2600 Service Pack 3 5/6/2009 7:35:29 PM mbam-log-2009-05-06 (19-35-29).txt Scan type: Quick Scan Objects scanned: 185327 Time elapsed: 59 minute(s), 42 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 2 Registry Values Infected: 2 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1e930f1c-113e-4f87-bc9a-ecab43a8f215} (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{1e930f1c-113e-4f87-bc9a-ecab43a8f215} (Trojan.Vundo.H) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cc1d992a (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\merofalori (Trojan.Vundo.H) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

oldman960

Post #5May 7, 2009, 7:01 AM UTC

Hi esseff,

You have or at least parts of 3 antivirus programs installed. There is even some AVG and Symantec (Norton) buried in there.

Webroot AntiVirus with AntiSpyware
Panda Cloud Antivirus
Avira AntiVir

Running mutiple antivirus programs does not provide additional protection. Due to conflicts, may even provide less. Please decide on one and uninstall the others. Let me know which one you decided to keep.

Double click on OTList2.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:OTLI
PRC - C:\Windows\Explorer.EXE (Microsoft Corporation)
O1 - Hosts: 82.98.231.89 url.adtrgt.com
O1 - Hosts: 82.98.231.89 googleads2.gdoubleclick.net
O1 - Hosts: d.doubleclick.net
O2 - BHO: (no name) - {1e930f1c-113e-4f87-bc9a-ecab43a8f215} - C:\WINDOWS\system32\sobaluno.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4E7BD74F-2B8D-469E-9EB4-FE6FA694B13E} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - Reg Error: Key error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - Reg Error: Key error. File not found
O4 - HKLM..\Run: [cc1d992a] rundll32.exe "C:\WINDOWS\system32\kagawike.dll",b File not found
O4 - HKLM..\Run: [merofalori] Rundll32.exe "C:\WINDOWS\system32\bikodina.dll",s File not found
O20 - AppInit_DLLs: (C:\WINDOWS\system32\maveragu.dll) - C:\WINDOWS\system32\maveragu.dll ()
[8 C:\WINDOWS\System32\*.tmp files]
[6 C:\WINDOWS\*.tmp files

:Services

:Reg

:Files
C:\WINDOWS\system32\maveragu.dll
C:\WINDOWS\system32\kagawike.dll
C:\WINDOWS\system32\bikodina.dll
C:\WINDOWS\system32\sobaluno.dll
C:\WINDOWS\System32\juyimebo.dll
C:\WINDOWS\System32\jokogoni.dll
C:\WINDOWS\System32\jitabine.dll
C:\WINDOWS\System32\jekiviku.dll
C:\WINDOWS\System32\jafiyuji.exe
C:\WINDOWS\System32\uniq.tll
C:\WINDOWS\System32\ivebeneh.ini
C:\WINDOWS\System32\wakujiru
C:\WINDOWS\System32\lehubibe.dll
C:\WINDOWS\System32\hakuzoha.dll
C:\WINDOWS\System32\korumore.dll
C:\Program Files\PremierOpinion

:Commands
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Next

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please post back with

OTLISIT2 log
combofix log
new HJT log taken after all other steps are completed

How is the computer?

Thanks

esseff

Post #6May 8, 2009, 5:04 PM UTC

I unintstalled the avira anti virus and i had uninstalled the avg quite some time ago. I stayed with the panda for now because i got so mant pop-ups with avira it literally lagged out my comp with pop ups. So here are my logs:

HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:58:44 AM, on 5/8/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (disabled by BHODemon)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [PSUNMain] "C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe" /Traybar
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: BHODemon 2.0.lnk = C:\Program Files\BHODemon 2\BHODemon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/dow…llerControl.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemydsl.verizon.net/sdcCommon…DSL/tgctlcm.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://a1540.g.akamai.net/7/1540/52/200707…ex/qtplugin.cab
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Pet%20Shop%20Hop/Images/stg_drm.ocx
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1EAFB28B-CAA8-47E4-8DEC-968B06FA1D19} (InstallerAX Class) - http://foxmovies.a.content.maven.net/mvms/…installerAX.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3DCEC959-378A-4922-AD7E-FD5C925D927F} (Disney Online Games ActiveX Control) - http://disney.go.com/pirates/online/testAc…OnlineGames.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {4F5E4276-C120-11D6-A1FD-00508B9D48EA} (dldisplay Class) - http://www.gamehouse.com/ghdlctl.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://us.games2.yimg.com/download.games.y…ctl_0_0_0_2.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125872737687
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX28.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_a…asyInstallX.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://kiw.imgag.com/imgag/cp/install/crusher-kiwen.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://a.download.toontown.com/sv1.0.38.31/ttinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/4h/pla…0/Installer.exe
O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} (CGameManagerCtrl Object) - https://disney.go.com/games/downloads/gamem…GameManager.cab
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/Puppy%20Luv%20Adventures/Images/armhelper.ocx
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…5/installer.exe
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildGames\Game Console - WildGames\GameConsoleService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NanoServiceMain - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe
O23 - Service: npkcmsvc - INCA Internet Co., Ltd. - C:\Nexon\MapleStory\npkcmsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
O24 - Desktop Component 0: (no name) - https://secure.disney.go.com/media/vmk/en_U…bg_gradient.gif

–
End of file - 8813 bytes

OTL:

Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret <[8 C:\WINDOWS\System32\*.tmp files]> in the current context!
Error: Unable to interpret <[6 C:\WINDOWS\*.tmp files> in the current context!
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
DllUnregisterServer procedure not found in C:\WINDOWS\system32\maveragu.dll
C:\WINDOWS\system32\maveragu.dll NOT unregistered.
C:\WINDOWS\system32\maveragu.dll moved successfully.
File\Folder C:\WINDOWS\system32\kagawike.dll not found.
File\Folder C:\WINDOWS\system32\bikodina.dll not found.
File\Folder C:\WINDOWS\system32\sobaluno.dll not found.
File\Folder C:\WINDOWS\System32\juyimebo.dll not found.
File\Folder C:\WINDOWS\System32\jokogoni.dll not found.
File\Folder C:\WINDOWS\System32\jitabine.dll not found.
File\Folder C:\WINDOWS\System32\jekiviku.dll not found.
File\Folder C:\WINDOWS\System32\jafiyuji.exe not found.
C:\WINDOWS\System32\uniq.tll moved successfully.
C:\WINDOWS\System32\ivebeneh.ini moved successfully.
C:\WINDOWS\System32\wakujiru moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\System32\lehubibe.dll
C:\WINDOWS\System32\lehubibe.dll NOT unregistered.
C:\WINDOWS\System32\lehubibe.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\System32\hakuzoha.dll
C:\WINDOWS\System32\hakuzoha.dll NOT unregistered.
C:\WINDOWS\System32\hakuzoha.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\System32\korumore.dll
C:\WINDOWS\System32\korumore.dll NOT unregistered.
C:\WINDOWS\System32\korumore.dll moved successfully.
File\Folder C:\Program Files\PremierOpinion not found.
========== COMMANDS ==========
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.
Explorer started successfully

OTListIt2 by OldTimer - Version 2.0.15.3 log created on 05082009_082040

Files moved on Reboot…

Registry entries deleted on Reboot…

COMBO:

ComboFix 09-05-07.A01 - Owner 05/08/2009 8:36.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.642 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: F-Secure Anti-Virus Client Security 5.55-SR1 *On-access scanning enabled* (Updated)
AV: Panda Cloud Antivirus *On-access scanning disabled* (Updated)
AV: Webroot AntiVirus with AntiSpyware *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Owner\Local Settings\Temporary Internet Files\fbk.sts
c:\windows\IE4 Error Log.txt
c:\windows\system32\au3305adc.dll
c:\windows\system32\sabafiru.dll
c:\windows\system32\zanamalo.dll

.
((((((((((((((((((((((((( Files Created from 2009-04-08 to 2009-05-08 )))))))))))))))))))))))))))))))
.

2009-05-07 00:43 . 2009-05-07 00:43 ——– d—–w C:\_OTListIt
2009-05-05 00:02 . 2009-05-05 00:02 ——– d—–w c:\documents and settings\Owner\Application Data\Malwarebytes
2009-05-05 00:02 . 2009-04-06 22:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-05-05 00:02 . 2009-04-06 22:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-05 00:02 . 2009-05-05 00:02 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-05 00:02 . 2009-05-05 00:02 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-05-04 23:49 . 2009-05-04 23:49 ——– d—–w c:\documents and settings\Owner\Application Data\Panda Security
2009-05-04 23:49 . 2009-05-04 23:49 245 —-a-w c:\windows\system32\PSUNCpl.dat
2009-05-04 23:48 . 2009-05-04 23:48 ——– d—–w c:\documents and settings\All Users\Application Data\Panda Security
2009-05-04 23:48 . 2009-05-04 23:48 ——– d—–w c:\program files\Panda Security
2009-05-03 17:59 . 2009-05-03 17:59 ——– d—–w c:\program files\Trend Micro
2009-05-03 17:40 . 2009-05-03 17:55 ——– d—–w c:\documents and settings\Owner\DoctorWeb
2009-05-03 17:04 . 2009-05-03 17:04 ——– d—–w C:\VundoFix Backups
2009-05-03 03:32 . 2009-05-03 03:32 ——– d—–w c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-05-03 02:55 . 2009-03-24 23:08 55640 —-a-w c:\windows\system32\drivers\avgntflt.sys
2009-05-03 02:47 . 2009-05-03 02:12 15688 —-a-w c:\windows\system32\lsdelete.exe
2009-05-03 02:12 . 2009-05-03 02:12 64160 —-a-w c:\windows\system32\drivers\Lbd.sys
2009-05-03 02:09 . 2009-05-03 02:09 ——– dc-h–w c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-05-03 02:08 . 2009-05-03 02:08 ——– d—–w c:\program files\Lavasoft
2009-05-03 02:08 . 2009-05-03 02:08 ——– d—–w c:\documents and settings\All Users\Application Data\Lavasoft
2009-05-03 01:55 . 2009-05-03 01:55 ——– d—–w c:\documents and settings\Owner\Local Settings\Application Data\AnVir
2009-05-03 01:38 . 2009-05-03 02:53 ——– d—–w c:\documents and settings\All Users\Application Data\avg8
2009-05-03 00:02 . 2009-05-03 00:02 ——– d—–w c:\program files\MSSOAP
2009-05-03 00:00 . 2009-05-03 00:00 164 —-a-w c:\windows\install.dat
2009-05-02 23:59 . 2009-05-02 23:59 ——– d—–w c:\windows\system32\config\systemprofile\Application Data\Yahoo!
2009-04-24 03:15 . 2009-04-24 03:15 136968 —-a-w c:\windows\system32\drivers\PSINAflt.sys
2009-04-24 03:15 . 2009-04-24 03:15 92552 —-a-w c:\windows\system32\drivers\PSINFile.sys
2009-04-24 03:15 . 2009-04-24 03:15 113928 —-a-w c:\windows\system32\drivers\PSINKNC.sys
2009-04-24 03:15 . 2009-04-24 03:15 98056 —-a-w c:\windows\system32\drivers\PSINProc.sys
2009-04-15 14:43 . 2008-05-03 11:55 2560 —-a-w c:\windows\system32\xpsp4res.dll
2009-04-15 14:43 . 2008-04-21 12:08 215552 -c–a-w c:\windows\system32\dllcache\wordpad.exe
2009-04-15 14:43 . 2009-03-06 14:22 284160 -c–a-w c:\windows\system32\dllcache\pdh.dll
2009-04-15 14:43 . 2009-02-09 12:10 401408 -c–a-w c:\windows\system32\dllcache\rpcss.dll
2009-04-15 14:43 . 2009-02-06 11:11 110592 -c–a-w c:\windows\system32\dllcache\services.exe
2009-04-15 14:43 . 2009-02-09 12:10 473600 -c–a-w c:\windows\system32\dllcache\fastprox.dll
2009-04-15 14:43 . 2009-02-06 10:10 227840 -c–a-w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 14:43 . 2009-02-09 12:10 453120 -c–a-w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 14:43 . 2009-02-09 12:10 729088 -c–a-w c:\windows\system32\dllcache\lsasrv.dll
2009-04-15 14:43 . 2009-02-09 12:10 617472 -c–a-w c:\windows\system32\dllcache\advapi32.dll
2009-04-15 14:43 . 2009-02-09 12:10 714752 -c–a-w c:\windows\system32\dllcache\ntdll.dll
2009-04-11 03:38 . 2009-04-11 03:38 ——– d—–w C:\Nexon
2009-04-11 02:38 . 2009-05-03 01:16 ——– d—–w c:\program files\Pando Networks

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-08 14:51 . 2008-07-30 01:51 ——– d—–w c:\program files\Download Manager
2009-05-08 14:43 . 2004-11-07 03:28 ——– d—–w c:\program files\Webroot
2009-05-06 16:21 . 2008-10-13 02:00 ——– d—–w c:\program files\AruaROSE
2009-05-04 20:24 . 2005-11-12 19:10 ——– d—–w c:\program files\BHODemon 2
2009-05-03 00:10 . 2004-08-22 04:37 4212 —ha-w c:\windows\system32\zllictbl.dat
2009-05-03 00:03 . 2009-05-03 00:03 775168 —-a-w c:\windows\isRS-000.tmp
2009-04-18 19:13 . 2008-09-27 22:42 ——– d—–w c:\program files\City of Heroes
2009-03-29 22:52 . 2008-12-14 22:31 ——– d—–w c:\program files\Xfire
2009-03-28 22:32 . 2005-03-15 01:25 ——– d—–w c:\program files\Triggersoft
2009-03-20 22:25 . 2009-03-20 22:25 41808 —-a-w c:\windows\system32\xfcodec.dll
2009-03-06 14:22 . 2005-05-12 02:47 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2006-04-28 17:58 826368 —-a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2004-08-04 07:56 78336 —-a-w c:\windows\system32\ieencode.dll
2009-02-09 12:10 . 2005-05-12 02:47 729088 —-a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2005-07-26 04:31 401408 —-a-w c:\windows\system32\rpcss.dll
2009-02-09 12:10 . 2005-05-12 02:47 617472 —-a-w c:\windows\system32\advapi32.dll
2009-02-09 12:10 . 2005-05-12 02:47 714752 —-a-w c:\windows\system32\ntdll.dll
2009-02-09 11:13 . 2005-05-12 02:47 1846784 —-a-w c:\windows\system32\win32k.sys
2004-11-28 03:03 . 2004-11-28 03:03 71 -csha-w c:\windows\system32\SYSDRVVC.SYS
2008-02-03 18:40 . 2007-11-13 18:44 15490080 –sha-w c:\windows\system32\drivers\fidbox.dat
2008-02-03 18:40 . 2007-11-13 18:44 524576 –sha-w c:\windows\system32\drivers\fidbox2.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"PSUNMain"="c:\program files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe" [2009-04-24 353536]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2008-04-14 53760]

c:\documents and settings\Owner\Start Menu\Programs\Startup\
BHODemon 2.0.lnk - c:\program files\BHODemon 2\BHODemon.exe [2005-6-19 946176]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
2001-12-21 06:34 24576 —-a-w c:\progra~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
backup=c:\windows\pss\Adobe Gamma Loader.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Compaq Connections.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Compaq Connections.lnk
backup=c:\windows\pss\Compaq Connections.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^GetRight.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\GetRight.lnk
backup=c:\windows\pss\GetRight.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnk
backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Verizon Online Support Center.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Verizon Online Support Center.lnk
backup=c:\windows\pss\Verizon Online Support Center.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WG111v2 Smart Wizard Wireless Setting.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WG111v2 Smart Wizard Wireless Setting.lnk
backup=c:\windows\pss\WG111v2 Smart Wizard Wireless Setting.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^beka^Start Menu^Programs^Startup^desktop.ini]
path=c:\documents and settings\beka\Start Menu\Programs\Startup\desktop.ini
backup=c:\windows\pss\desktop.iniStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Emily^Start Menu^Programs^Startup^RollerCoaster Tycoon 3 Registration.lnk]
path=c:\documents and settings\Emily\Start Menu\Programs\Startup\RollerCoaster Tycoon 3 Registration.lnk
backup=c:\windows\pss\RollerCoaster Tycoon 3 Registration.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Alienware Dock.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\Alienware Dock.lnk
backup=c:\windows\pss\Alienware Dock.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^BHODemon 2.0.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\BHODemon 2.0.lnk
backup=c:\windows\pss\BHODemon 2.0.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^BoontyBox gamedownloads.com.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\BoontyBox gamedownloads.com.lnk
backup=c:\windows\pss\BoontyBox gamedownloads.com.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Compaq Organize.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\Compaq Organize.lnk
backup=c:\windows\pss\Compaq Organize.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^IMStart.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\IMStart.lnk
backup=c:\windows\pss\IMStart.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^PowerReg Scheduler.exe]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\PowerReg Scheduler.exe
backup=c:\windows\pss\PowerReg Scheduler.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Xfire.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\Xfire.lnk
backup=c:\windows\pss\Xfire.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^ZMatrix.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\ZMatrix.lnk
backup=c:\windows\pss\ZMatrix.lnkStartup

[HKLM\~\startupfolder\^.gtk-bookmarks]
path=\.gtk-bookmarks
backup=c:\windows\pss\.gtk-bookmarksCommon Startup

[HKLM\~\startupfolder\^LuResult.txt]
path=\LuResult.txt
backup=c:\windows\pss\LuResult.txtCommon Startup

[HKLM\~\startupfolder\^ml1.srt]
path=\ml1.srt
backup=c:\windows\pss\ml1.srtCommon Startup

[HKLM\~\startupfolder\^ml2.srt]
path=\ml2.srt
backup=c:\windows\pss\ml2.srtCommon Startup

[HKLM\~\startupfolder\^NTUser.000]
path=\NTUser.000
backup=c:\windows\pss\NTUser.000Common Startup

[HKLM\~\startupfolder\^NTUser.000.LOG]
path=\NTUser.000.LOG
backup=c:\windows\pss\NTUser.000.LOGCommon Startup

[HKLM\~\startupfolder\^NTUser.dat]
path=\ntuser.dat
backup=c:\windows\pss\ntuser.datCommon Startup

[HKLM\~\startupfolder\^ntuser.dat.LOG]
path=\ntuser.dat.LOG
backup=c:\windows\pss\ntuser.dat.LOGCommon Startup

[HKLM\~\startupfolder\^ntuser.ini]
path=\ntuser.ini
backup=c:\windows\pss\ntuser.iniCommon Startup

[HKLM\~\startupfolder\^reglog.txt]
path=\reglog.txt
backup=c:\windows\pss\reglog.txtCommon Startup

[HKLM\~\startupfolder\^tempdiff.txt]
path=\tempdiff.txt
backup=c:\windows\pss\tempdiff.txtCommon Startup

[HKLM\~\startupfolder\^Windows Classic style_BLOCK.WB4]
path=\Windows Classic style_BLOCK.WB4
backup=c:\windows\pss\Windows Classic style_BLOCK.WB4Common Startup

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"NvCplDaemon"=RUNDLL32.EXE c:\windows\System32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\Owner\\Desktop\\utorrent.exe"=
"c:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\helpctr.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\UT2004Demo\\System\\UT2004.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\Common Files\\Microsoft Shared\\VS7DEBUG\\MDM.EXE"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [5/2/2009 7:12 PM 64160]
R1 PSINKNC;PSINKNC;c:\windows\system32\drivers\PSINKNC.sys [4/23/2009 8:15 PM 113928]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [1/25/2009 5:49 PM 66048]
R2 NanoServiceMain;NanoServiceMain;c:\program files\Panda Security\Panda Cloud Antivirus\PSANHost.exe [4/23/2009 8:14 PM 95488]
R2 PSINAflt;PSINAflt;c:\windows\system32\drivers\PSINAflt.sys [4/23/2009 8:15 PM 136968]
R2 PSINFile;PSINFile;c:\windows\system32\drivers\PSINFile.sys [4/23/2009 8:15 PM 92552]
R2 PSINProc;PSINProc;c:\windows\system32\drivers\PSINProc.sys [4/23/2009 8:15 PM 98056]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 12:06 PM 953168]
S3 dump_wmimmc;dump_wmimmc;\??\c:\nexon\MapleStory\GameGuard\dump_wmimmc.sys –> c:\nexon\MapleStory\GameGuard\dump_wmimmc.sys [?]
S3 hamachi_oem;PlayLinc Adapter;c:\windows\system32\drivers\gan_adapter.sys [9/27/2006 5:12 PM 10664]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [1/25/2009 5:49 PM 167808]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys –> c:\windows\system32\drivers\ScreamingBAudio.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2009-05-05 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 02:12]

2009-04-19 c:\windows\Tasks\HP DArC Task 2003-04-08 07:12ewlett-PackardHewlett-Packard Companyeskjet3600—-a-wH391180TY6B.job
- c:\program files\HP\hpcoretech\comp\hpdarc.exe [2003-04-08 19:45]
.
- - - - ORPHANS REMOVED - - - -

BHO-{1e930f1c-113e-4f87-bc9a-ecab43a8f215} - c:\windows\system32\sobaluno.dll
WebBrowser-{6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - (no file)
HKLM-Run-merofalori - c:\windows\system32\bikodina.dll
HKLM-Run-CPMcf2eaab6 - c:\windows\System32\korumore.dll
SafeBoot-WRConsumerService

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.yahoo.com
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=presario&pf=desktop
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {1EAFB28B-CAA8-47E4-8DEC-968B06FA1D19} - hxxp://foxmovies.a.content.maven.net/mvms/vfs/fox/foxmovies/live/install/installerAX.cab
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\31h95b8d.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.newsarama.com
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF - plugin: c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\31h95b8d.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071303000004.dll
FF - plugin: c:\program files\Download Manager\npfpdlm.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npracplug.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDCE08D86A-A41A-410A-943C-13BABB7DC474", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDA9EDC9ED-603A-4F3F-BBEA-59C8853A3236", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID90D10942-D952-4863-9DD6-A2BDBBAD456E", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID0ECEE744-7B69-4912-AB91-AE76D61ECB04", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDF25635B2-1AB9-47B5-88D1-8877B22C86DE", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID27B7F812-4159-45B9-A389-B7A118A58DE4", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDF849DF29-393B-4F8B-99D1-117A70D66FC7", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDBF1E9C3D-637C-4171-BD12-28A7360B879A", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDDE1C0601-7947-4D7F-A6E5-E68BF6BA1E37", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID4EA0DCCE-4D98-4876-9C6A-E5C563D0820A", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID446462BA-2AAD-4C88-BC63-5210E2F31465", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID0862E368-A40E-4E55-83EB-FBC5571BABA4", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDD2A96E3C-FFB3-4D38-9AC3-B127527BEA35", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID4B05B39A-9DDC-4650-A7F8-D5B134E5FFE5", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDC8E2574A-7BCE-4B93-A22E-61831DFD6DB8", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID659796C0-8B5D-48D7-A4EB-7E6874E26274", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID78071AB5-E729-414E-8D02-9C1D034F82E7", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDCC3F71E1-17F3-4C5B-997D-44CA56943197", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDE67D5C78-B2D4-4BA0-8D69-1C7AF4BB08B5", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFC5F3D7A-D321-412C-8A5D-9AD0C8041941", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID6EC5CD16-81BC-4515-9EDD-9265C906F56E", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID67CFB2C5-E491-4395-977B-CD45E4124655", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID73600569-52E6-4760-8BAB-B68202937D98", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDB02EBD42-6885-401A-9389-E089F7DDC872", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDBAE5CB8C-4075-4743-B2E4-78DA8D8CDC64", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID28B07B04-DA99-4FD3-BF27-4972F2B8142B", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID0D53448F-D12B-4102-8CE2-697DAE8D6643", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDE3266A47-A141-47B8-AAA8-5F16FB4F8CCD", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDB33AB7AF-76D7-4B1C-B709-5D6BF9E7B1C7", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID153B7451-0BB5-4B37-95C0-44D89E2F1F2B", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID3BBE8E21-0D3D-4BAA-AC6F-C7BCEF750849", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID9B5B4F2D-A7D9-4329-B0FE-92B301A8CAAD", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDA5C42921-8CD0-4924-97C3-01B5B0610BC6", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID06969252-F90F-4CF2-9074-33772EB64859", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFBF37655-1236-4C0D-96C5-F94E1724841B", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDC1A3F035-B68F-4B2B-9FD5-E36DAAAF26DD", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID368F3685-543E-4812-9FDE-96E097E453FC", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID43969873-56AA-4113-84CB-4AB2AEB9AA31", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDA205DD80-63D4-4E41-B785-26EC3D90B97B", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID068D43E7-7551-4A2F-AE96-4A38A9AD1953", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDF443E9CB-9EEC-456E-8AE7-F3102D5CD47D", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDE36A7B16-645D-4261-BFF8-3A7E69C5F7A5", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID379805E3-E0E2-40DC-B51B-6DC1AE5802AA", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDF6240D69-A06D-44A1-8003-8496CCEF2C53", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID26C3113D-5A71-4F1B-A2CB-BE59E1279DDA", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID92B97F2B-7565-4CE9-9AC7-0598DFD731F8", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID2AA5E7CF-9696-42F0-B76A-8655296EADF2", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID0AAACE0B-ACEF-4781-83F4-BFB52EEC995A", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID0D56FF58-A39D-4E8C-A40B-2E3711251772", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID946121C2-11F1-49DD-A7E3-CF793DE827A4", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDB853303D-1BAB-43F3-9D7D-101D0DA8E7A5", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID9E578247-FE29-4F8C-8202-A24A5688CF2A", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID6D065A8F-FFC0-4A0F-B863-1D724B8C786B", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID4451D291-6940-42CE-9D3C-CA1D4C96549C", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID064B722D-079D-4EBB-B3CF-9FCBF64FFF5D", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID38F8AB0F-5DFB-43D9-889E-8717CC4AB59B", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID4EC68CD1-0EF1-4CB9-9EF1-3D64AB266149", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID44F96B27-CFAD-41E1-83A1-6B28040C3BDE", "AllAccess");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-08 08:51
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1634829951-3876798684-2761164870-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,15"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="c:\\WINDOWS\\system32\\SHELL32.dll,17"
"{208D2C60-3AEA-1069-A2D7-08002B30309D}"="c:\\WINDOWS\\system32\\SHELL32.dll,17"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,22"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,23"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,24"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="c:\\WINDOWS\\system32\\shell32.dll,-175"
"{21EC2020-3AEA-1069-A2DD-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,-137"
"{2227A280-3AEA-1069-A2DE-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,-138"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="c:\\WINDOWS\\system32\\shell32.dll,38"
"AudioCD"="c:\\WINDOWS\\System32\\shell32.dll,40"
"{FBF23B42-E3F0-101B-8488-00AA003E56F8}"="c:\\WINDOWS\\system32\\shell32.dll,220"
"{450D8FBA-AD25-11D0-98A8-0800361B1103}"="c:\\WINDOWS\\system32\\mydocs.dll,0"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="c:\\WINDOWS\\system32\\main.cpl,10"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="c:\\WINDOWS\\system32\\wiashext.dll,0"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="c:\\WINDOWS\\system32\\mstask.dll,-100"
"{88C6C381-2E85-11D0-94DE-444553540000}"="c:\\WINDOWS\\System32\\occache.dll,0"
"{BDEADF00-C265-11d0-BCED-00A0C90AB50F}"="c:\\Program Files\\COMMON~1\\MICROS~1\\WEBFOL~1\\MSONSEXT.DLL,0"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="c:\\WINDOWS\\System32\\shdocvw.dll,-20785"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="c:\\WINDOWS\\System32\\webcheck.dll,0"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="c:\\WINDOWS\\system32\\syncui.dll,0"

[HKEY_USERS\S-1-5-21-1634829951-3876798684-2761164870-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"????????????????????????"=hex:45,dd,ac,b1,bb,02,ec,1c,31,ba,b5,2d,fd,93,af,f8,
c3,22,87,e9,e9,f4,f7,22,22,f7,c3,c3,78,70,22,d0,00,00,00,00,00,00,00,00,00,\
"???n"=hex:db,1e,79,e6,c1,17,24,ca,be,11,0e,0d,f8,c2,27,24,43,74,3c,e7,25,82,
f5,0a,01,29,94,af,5a,4f,0e,98,0b,a2,72,b8,8e,1c,da,51,c6,c5,ac,ca,32,c8,10,\
"?????"=hex:ef,89,0f,2f,a6,ee,78,65,f1,87,81,0f,df,35,54,43
"???n"=hex:e2,46,31,73,03,52,e1,95,99,4d,4a,b7,7e,25,5c,4d,28,98,a6,d7,b9,a0,
46,41,e4,86,5d,b7,ed,11,c1,46,3b,5d,79,2f,1f,c7,dd,4d,b3,42,c9,9b,86,a4,31,\
"???n"=hex:6d,34,4a,0c,4e,fb,2d,e3,73,15,67,1c,d4,19,7d,82,7c,41,f9,42,ba,bd,
93,06,99,ad,e3,44,2b,18,8c,5c,e7,1c,5b,4b,8a,55,67,97,2a,c6,bb,a6,28,94,4a,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(788)
c:\progra~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll

- - - - - - - > 'Explorer.EXE'(2996)
c:\program files\Stardock\Object Desktop\IconPackager\shellext.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\docume~1\Owner\LOCALS~1\Temp\catchme.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Stardock\Object Desktop\WindowBlinds\wbload.exe
c:\combofix\hidec.exe
c:\windows\system32\drwtsn32.exe
c:\windows\system32\dwwin.exe
c:\combofix\Catchme.tmp
.
**************************************************************************
.
Completion time: 2009-05-08 8:58 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-08 15:56

Pre-Run: 56,985,202,688 bytes free
Post-Run: 59,023,519,744 bytes free

396 — E O F — 2009-04-29 23:01

oldman960

Post #7May 9, 2009, 8:22 AM UTC

Hi esseff,

How's the computer?

AV: F-Secure Anti-Virus Client Security 5.55-SR1 *On-access scanning enabled* (Updated)
AV: Panda Cloud Antivirus *On-access scanning disabled* (Updated)
AV: Webroot AntiVirus with AntiSpyware *On-access scanning disabled* (Updated)

Combofix reports you have the above antiviurs programs. One is enough.

You have some very old vulnerable Java installed as well as a bit of Symantec.

Go to http://java.sun.com/javase/downloads/index.jsp
Scroll down to "Java Runtime Environment (JRE) 6 Update 13
Click the download button on the right.

If Information Bar pop-ups up, right-click on it and say it's OK to display the blocked content.

Select the platform (Windows, in your case), mutli language.
Accept the license agreement, click continue.

You do not have to install the Java Web Start ActiveX Control

Scroll down and click on Windows Offline Installation,
Save the file jre-6u13-windows-i586-p.exe to your desktop;

Do not select Run . Do not install it yet.

When the download is complete, close your browser.

Open Control Panel > Add/Remove Programs and uninstall

J2SE Runtime Environment 5.0 Update 3
J2SE Runtime Environment 5.0 Update 6
Java 2 Runtime Environment, SE v1.4.2_03
Symantec Network Drivers Update

Do not uninstall Java TM 6 Update 13 if found!

Reboot your computer.

Double-click on the saved file (jre-6u13-windows-i586-p.exe) to install the update.
Delete the downloaded installation file after completing the above procedure and reboot if not prompted to do so.

Next, clear the java cache

To clear the Java Plug-in cache:

Click Start > Control Panel.
Double-click the Java icon (it looks like a coffee cup) in the control panel.
On the General tab, Click Settings under Temporary Internet Files.
On the Temporary Files Settings screen, Click Delete Files.
check all 3 boxes
Click OK

We will use combofix again, but run it differently.

Please follow all previous instructions regarding security programs.

Open a new Notepad session

Click the Start button, click run
in the run box type notepad
click ok
In the notepad, Click "Format" and be certain that Word Wrap is not checked.
Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

Do Not copy the word CODE

File::
C:\WINDOWS\System32\avgrsstx.dll.install_backup

Folder::
C:\Program Files\AVG
C:\Documents and Settings\All Users\Application Data\avg8
C:\Program Files\Common Files\Symantec Shared

RegLock::
[HKEY_USERS\S-1-5-21-1634829951-3876798684-2761164870-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]

Registry::

In the notepad

Click File, Save as…, and set the Save in to your Desktop
In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
Click save

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

Please post back with

combofix log
new HJT log

esseff

Post #8May 9, 2009, 7:47 PM UTC

Ok before i run your fixes, i have a question…I uninstalled the webroot spsweeper (the anitvirus) and i neber had F-secure, so im confused as to why it says i have it. I do have the panda antivirus. So do i continue with what you want me to do?

oldman960

Post #9May 10, 2009, 3:37 PM UTC

Hi esseff,

Did you ever use an antivirus program or security suite from your internet provider?

Carry on with the instructions then post a new uninstall list along with the other logs.

Please make an uninstall list

Start HijackThis
Click the Config button
Click the Misc Tools button
Click the Open Uninstall Manager button.
Click the Save list button and save it to your desktop.

When you press Save, a notepad will open with the contents. Copy/paste the contents of the notepad file in your next reply.

Thanks

esseff

Post #10May 11, 2009, 12:15 AM UTC

Well my comp is running ok (i think). I uninstalled the avira anti virus and i dont get anymore virus pop-ups BUT when i am browsing and i search for things on google, when i click the link i want i get taken somewhere else. Most of the time to something that is irrelevant to what im looking for and sometimes porn sites. The porn bothers me the most because when i have my kids on the weekend and i dont want them redirected somewhere else. As to your antivirus question…no i dont use my isp's security suite. I used to use zone alarm plus but uninstalled after this mess started because it wouldn't start. Here are the logs you asked for:

HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:04:24 PM, on 5/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (disabled by BHODemon)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll
O4 - HKLM\..\Run: [PSUNMain] "C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe" /Traybar
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/dow…llerControl.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemydsl.verizon.net/sdcCommon…DSL/tgctlcm.cab
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Pet%20Shop%20Hop/Images/stg_drm.ocx
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1EAFB28B-CAA8-47E4-8DEC-968B06FA1D19} (InstallerAX Class) - http://foxmovies.a.content.maven.net/mvms/…installerAX.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125872737687
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_a…asyInstallX.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://kiw.imgag.com/imgag/cp/install/crusher-kiwen.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://a.download.toontown.com/sv1.0.38.31/ttinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/4h/pla…0/Installer.exe
O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} (CGameManagerCtrl Object) - https://disney.go.com/games/downloads/gamem…GameManager.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…5/installer.exe
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildGames\Game Console - WildGames\GameConsoleService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NanoServiceMain - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe
O23 - Service: npkcmsvc - INCA Internet Co., Ltd. - C:\Nexon\MapleStory\npkcmsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (file missing)
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
O24 - Desktop Component 0: (no name) - https://secure.disney.go.com/media/vmk/en_U…bg_gradient.gif

–
End of file - 7835 bytes

COMBO:

ComboFix 09-05-09.05 - Owner 05/10/2009 16:41.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.692 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: F-Secure Anti-Virus Client Security 5.55-SR1 *On-access scanning enabled* (Updated)
AV: Panda Cloud Antivirus *On-access scanning enabled* (Updated)
AV: Webroot AntiVirus with AntiSpyware *On-access scanning disabled* (Updated)

FILE ::
c:\windows\System32\avgrsstx.dll.install_backup
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\avg8
c:\documents and settings\All Users\Application Data\avg8\srmcheck.tmp
c:\program files\Common Files\Symantec Shared
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsys.dll
c:\program files\Common Files\Symantec Shared\Default.rul
c:\program files\Common Files\Symantec Shared\DefUpdateCheck.dll
c:\program files\Common Files\Symantec Shared\IDS\DefUtDcd.dll
c:\program files\Common Files\Symantec Shared\IDS\IDSaux.dll
c:\program files\Common Files\Symantec Shared\IDS\IdsInst.exe
c:\program files\Common Files\Symantec Shared\IDS\Patch25.dll
c:\program files\Common Files\Symantec Shared\IDS\SymIDSLU.dll
c:\program files\Common Files\Symantec Shared\SEVINST.EXE
c:\program files\Common Files\Symantec Shared\SNDInst.exe
c:\program files\Common Files\Symantec Shared\SNDSrvc.exe
c:\program files\Common Files\Symantec Shared\SNDunin.dll
c:\program files\Common Files\Symantec Shared\Validate.dat
c:\windows\System32\avgrsstx.dll.install_backup

.
((((((((((((((((((((((((( Files Created from 2009-04-10 to 2009-05-10 )))))))))))))))))))))))))))))))
.

2009-05-10 23:35 . 2009-05-10 23:34 410984 —-a-w c:\windows\system32\deploytk.dll
2009-05-08 18:10 . 2009-05-08 18:10 ——– d-sh–w c:\documents and settings\Owner\IECompatCache
2009-05-08 18:08 . 2009-05-08 18:08 ——– d-sh–w c:\documents and settings\Owner\PrivacIE
2009-05-08 17:46 . 2009-05-08 17:46 ——– d-sh–w c:\documents and settings\LocalService\IETldCache
2009-05-08 17:46 . 2009-05-08 17:46 ——– d-sh–w c:\documents and settings\Owner\IETldCache
2009-05-08 17:30 . 2009-05-08 17:30 ——– d—–w c:\windows\ie8updates
2009-05-08 17:28 . 2009-04-25 05:30 102400 -c—-w c:\windows\system32\dllcache\iecompat.dll
2009-05-08 17:26 . 2009-05-08 17:28 ——– dc-h–w c:\windows\ie8
2009-05-07 00:43 . 2009-05-07 00:43 ——– d—–w C:\_OTListIt
2009-05-05 00:02 . 2009-05-05 00:02 ——– d—–w c:\documents and settings\Owner\Application Data\Malwarebytes
2009-05-05 00:02 . 2009-04-06 22:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-05-05 00:02 . 2009-04-06 22:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-05 00:02 . 2009-05-05 00:02 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-05 00:02 . 2009-05-05 00:02 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-05-04 23:49 . 2009-05-04 23:49 ——– d—–w c:\documents and settings\Owner\Application Data\Panda Security
2009-05-04 23:49 . 2009-05-04 23:49 245 —-a-w c:\windows\system32\PSUNCpl.dat
2009-05-04 23:48 . 2009-05-04 23:48 ——– d—–w c:\documents and settings\All Users\Application Data\Panda Security
2009-05-04 23:48 . 2009-05-04 23:48 ——– d—–w c:\program files\Panda Security
2009-05-03 17:59 . 2009-05-03 17:59 ——– d—–w c:\program files\Trend Micro
2009-05-03 17:40 . 2009-05-03 17:55 ——– d—–w c:\documents and settings\Owner\DoctorWeb
2009-05-03 17:04 . 2009-05-03 17:04 ——– d—–w C:\VundoFix Backups
2009-05-03 03:32 . 2009-05-03 03:32 ——– d—–w c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-05-03 02:55 . 2009-03-24 23:08 55640 —-a-w c:\windows\system32\drivers\avgntflt.sys
2009-05-03 02:08 . 2009-05-08 17:08 ——– d—–w c:\documents and settings\All Users\Application Data\Lavasoft
2009-05-03 01:55 . 2009-05-03 01:55 ——– d—–w c:\documents and settings\Owner\Local Settings\Application Data\AnVir
2009-05-03 00:02 . 2009-05-03 00:02 ——– d—–w c:\program files\MSSOAP
2009-05-03 00:00 . 2009-05-03 00:00 164 —-a-w c:\windows\install.dat
2009-05-02 23:59 . 2009-05-02 23:59 ——– d—–w c:\windows\system32\config\systemprofile\Application Data\Yahoo!
2009-04-24 03:15 . 2009-04-24 03:15 136968 —-a-w c:\windows\system32\drivers\PSINAflt.sys
2009-04-24 03:15 . 2009-04-24 03:15 92552 —-a-w c:\windows\system32\drivers\PSINFile.sys
2009-04-24 03:15 . 2009-04-24 03:15 113928 —-a-w c:\windows\system32\drivers\PSINKNC.sys
2009-04-24 03:15 . 2009-04-24 03:15 98056 —-a-w c:\windows\system32\drivers\PSINProc.sys
2009-04-15 14:43 . 2008-05-03 11:55 2560 —-a-w c:\windows\system32\xpsp4res.dll
2009-04-15 14:43 . 2008-04-21 12:08 215552 -c–a-w c:\windows\system32\dllcache\wordpad.exe
2009-04-15 14:43 . 2009-03-06 14:22 284160 -c–a-w c:\windows\system32\dllcache\pdh.dll
2009-04-15 14:43 . 2009-02-09 12:10 401408 -c–a-w c:\windows\system32\dllcache\rpcss.dll
2009-04-15 14:43 . 2009-02-06 11:11 110592 -c–a-w c:\windows\system32\dllcache\services.exe
2009-04-15 14:43 . 2009-02-09 12:10 473600 -c–a-w c:\windows\system32\dllcache\fastprox.dll
2009-04-15 14:43 . 2009-02-06 10:10 227840 -c–a-w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 14:43 . 2009-02-09 12:10 453120 -c–a-w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 14:43 . 2009-02-09 12:10 729088 -c–a-w c:\windows\system32\dllcache\lsasrv.dll
2009-04-15 14:43 . 2009-02-09 12:10 617472 -c–a-w c:\windows\system32\dllcache\advapi32.dll
2009-04-15 14:43 . 2009-02-09 12:10 714752 -c–a-w c:\windows\system32\dllcache\ntdll.dll
2009-04-11 03:38 . 2009-04-11 03:38 ——– d—–w C:\Nexon

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-10 23:34 . 2004-05-13 02:35 ——– d—–w c:\program files\Java
2009-05-08 17:07 . 2006-06-18 18:39 ——– d—–w c:\program files\Yahoo! Games
2009-05-08 14:51 . 2008-07-30 01:51 ——– d—–w c:\program files\Download Manager
2009-05-08 14:43 . 2004-11-07 03:28 ——– d—–w c:\program files\Webroot
2009-05-06 16:21 . 2008-10-13 02:00 ——– d—–w c:\program files\AruaROSE
2009-05-04 20:24 . 2005-11-12 19:10 ——– d—–w c:\program files\BHODemon 2
2009-05-03 00:10 . 2004-08-22 04:37 4212 —ha-w c:\windows\system32\zllictbl.dat
2009-05-03 00:03 . 2009-05-03 00:03 775168 —-a-w c:\windows\isRS-000.tmp
2009-04-18 19:13 . 2008-09-27 22:42 ——– d—–w c:\program files\City of Heroes
2009-03-29 22:52 . 2008-12-14 22:31 ——– d—–w c:\program files\Xfire
2009-03-28 22:32 . 2005-03-15 01:25 ——– d—–w c:\program files\Triggersoft
2009-03-20 22:25 . 2009-03-20 22:25 41808 —-a-w c:\windows\system32\xfcodec.dll
2009-03-08 11:34 . 2006-04-28 17:58 914944 —-a-w c:\windows\system32\wininet.dll
2009-03-08 11:34 . 2005-05-12 02:47 43008 —-a-w c:\windows\system32\licmgr10.dll
2009-03-08 11:33 . 2005-05-12 02:47 18944 —-a-w c:\windows\system32\corpol.dll
2009-03-08 11:33 . 2005-05-12 02:47 420352 —-a-w c:\windows\system32\vbscript.dll
2009-03-08 11:32 . 2005-05-12 02:47 72704 —-a-w c:\windows\system32\admparse.dll
2009-03-08 11:32 . 2005-05-12 02:47 71680 —-a-w c:\windows\system32\iesetup.dll
2009-03-08 11:31 . 2005-05-12 02:47 34816 —-a-w c:\windows\system32\imgutil.dll
2009-03-08 11:31 . 2005-05-12 02:47 48128 —-a-w c:\windows\system32\mshtmler.dll
2009-03-08 11:31 . 2005-05-12 02:47 45568 —-a-w c:\windows\system32\mshta.exe
2009-03-08 11:22 . 2004-06-04 21:14 156160 —-a-w c:\windows\system32\msls31.dll
2009-03-06 14:22 . 2005-05-12 02:47 284160 —-a-w c:\windows\system32\pdh.dll
2004-11-28 03:03 . 2004-11-28 03:03 71 -csha-w c:\windows\system32\SYSDRVVC.SYS
2008-02-03 18:40 . 2007-11-13 18:44 15490080 –sha-w c:\windows\system32\drivers\fidbox.dat
2008-02-03 18:40 . 2007-11-13 18:44 524576 –sha-w c:\windows\system32\drivers\fidbox2.dat
.

((((((((((((((((((((((((((((( SnapShot@2009-05-08_15.51.57 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-10 23:35 . 2009-05-10 23:35 16384 c:\windows\temp\Perflib_Perfdata_7f0.dat
+ 2005-05-12 02:49 . 2009-01-08 01:21 26144 c:\windows\system32\spupdsvc.exe
+ 2007-11-26 01:46 . 2009-01-08 01:20 16928 c:\windows\system32\spmsg.dll
+ 2005-05-12 02:47 . 2009-03-08 11:31 46592 c:\windows\system32\pngfilt.dll
- 2006-06-29 15:05 . 2006-06-29 15:05 23552 c:\windows\system32\normaliz.dll
+ 2006-06-29 15:05 . 2009-01-08 01:20 23552 c:\windows\system32\normaliz.dll
+ 2006-06-29 00:59 . 2009-01-08 01:20 24576 c:\windows\system32\nlsdl.dll
- 2006-06-29 00:59 . 2006-06-29 00:59 24576 c:\windows\system32\nlsdl.dll
+ 2005-05-12 02:47 . 2009-03-08 11:31 66560 c:\windows\system32\mshtmled.dll
+ 2006-10-17 18:58 . 2009-03-08 11:31 13312 c:\windows\system32\msfeedssync.exe
+ 2006-11-08 04:03 . 2009-03-08 11:31 55296 c:\windows\system32\msfeedsbs.dll
+ 2005-05-12 02:47 . 2009-03-08 11:33 25600 c:\windows\system32\jsproxy.dll
+ 2005-05-12 02:47 . 2009-03-08 11:32 94720 c:\windows\system32\inseng.dll
+ 2006-11-07 10:26 . 2009-03-08 11:32 36864 c:\windows\system32\ieudinit.exe
+ 2005-05-12 02:47 . 2009-03-08 11:32 55808 c:\windows\system32\iernonce.dll
+ 2006-06-29 15:05 . 2009-01-08 01:20 26112 c:\windows\system32\idndl.dll
- 2006-06-29 15:05 . 2006-06-29 15:05 26112 c:\windows\system32\idndl.dll
+ 2006-10-17 18:58 . 2009-03-08 11:31 59904 c:\windows\system32\icardie.dll
+ 2007-01-04 13:36 . 2009-03-08 11:31 46592 c:\windows\system32\dllcache\pngfilt.dll
+ 2006-10-17 18:28 . 2009-03-08 11:31 48128 c:\windows\system32\dllcache\mshtmler.dll
- 2006-10-17 18:28 . 2006-10-17 18:28 48128 c:\windows\system32\dllcache\mshtmler.dll
+ 2007-01-04 13:36 . 2009-03-08 11:31 66560 c:\windows\system32\dllcache\mshtmled.dll
- 2006-10-17 18:56 . 2006-10-17 18:56 45568 c:\windows\system32\dllcache\mshta.exe
+ 2006-10-17 18:56 . 2009-03-08 11:31 45568 c:\windows\system32\dllcache\mshta.exe
+ 2007-05-09 05:11 . 2009-03-08 11:31 55296 c:\windows\system32\dllcache\msfeedsbs.dll
+ 2005-05-12 02:47 . 2009-03-08 11:34 43008 c:\windows\system32\dllcache\licmgr10.dll
+ 2007-01-04 13:36 . 2009-03-08 11:33 25600 c:\windows\system32\dllcache\jsproxy.dll
+ 2005-05-12 02:47 . 2009-03-08 11:32 94720 c:\windows\system32\dllcache\inseng.dll
+ 2006-10-17 18:57 . 2009-03-08 11:31 34816 c:\windows\system32\dllcache\imgutil.dll
+ 2005-05-12 02:47 . 2009-03-08 11:32 71680 c:\windows\system32\dllcache\iesetup.dll
+ 2006-11-07 10:26 . 2009-03-08 11:32 55808 c:\windows\system32\dllcache\iernonce.dll
+ 2007-08-20 10:04 . 2009-03-08 11:31 59904 c:\windows\system32\dllcache\icardie.dll
+ 2006-10-17 18:44 . 2009-03-08 11:24 68608 c:\windows\system32\dllcache\hmmapi.dll
+ 2009-03-08 11:33 . 2009-03-08 11:33 18944 c:\windows\system32\dllcache\corpol.dll
+ 2005-05-12 02:47 . 2009-03-08 11:32 72704 c:\windows\system32\dllcache\admparse.dll
+ 2009-05-08 17:28 . 2009-03-08 21:23 58464 c:\windows\ie8\spuninst\iecustom.dll
+ 2009-05-08 17:27 . 2009-02-20 18:09 44544 c:\windows\ie8\pngfilt.dll
+ 2009-05-08 17:26 . 2006-10-17 18:28 48128 c:\windows\ie8\mshtmler.dll
+ 2009-05-08 17:26 . 2006-10-17 18:56 45568 c:\windows\ie8\mshta.exe
+ 2009-05-08 17:27 . 2006-10-17 18:58 12288 c:\windows\ie8\msfeedssync.exe
+ 2009-05-08 17:26 . 2009-02-20 18:09 52224 c:\windows\ie8\msfeedsbs.dll
+ 2009-05-08 17:26 . 2006-10-17 19:05 40960 c:\windows\ie8\licmgr10.dll
+ 2009-05-08 17:26 . 2009-02-20 18:09 27648 c:\windows\ie8\jsproxy.dll
+ 2009-05-08 17:26 . 2006-11-07 10:26 92672 c:\windows\ie8\inseng.dll
+ 2009-05-08 17:26 . 2006-10-17 18:57 36352 c:\windows\ie8\imgutil.dll
+ 2009-05-08 17:26 . 2006-11-07 10:26 55296 c:\windows\ie8\iesetup.dll
+ 2009-05-08 17:26 . 2009-02-20 18:09 44544 c:\windows\ie8\iernonce.dll
+ 2009-05-08 17:26 . 2009-02-20 18:09 78336 c:\windows\ie8\ieencode.dll
+ 2009-05-08 17:26 . 2009-02-20 10:20 70656 c:\windows\ie8\ie4uinit.exe
+ 2009-05-08 17:26 . 2009-02-20 18:09 63488 c:\windows\ie8\icardie.dll
+ 2009-05-08 17:26 . 2006-10-17 18:44 60416 c:\windows\ie8\hmmapi.dll
+ 2009-05-08 17:27 . 2008-04-14 00:11 35328 c:\windows\ie8\corpol.dll
+ 2009-05-08 17:26 . 2006-11-07 10:26 71680 c:\windows\ie8\admparse.dll
+ 2009-05-08 17:30 . 2009-03-08 11:35 2048 c:\windows\ie8updates\KB969497-IE8\iecompat.dll
- 2007-03-30 04:00 . 2008-04-14 00:12 121856 c:\windows\system32\xmllite.dll
+ 2007-03-30 04:00 . 2009-01-08 01:21 121856 c:\windows\system32\xmllite.dll
+ 2006-10-17 19:05 . 2009-03-08 11:34 208384 c:\windows\system32\WinFXDocObj.exe
+ 2005-05-12 02:47 . 2009-03-08 11:34 236544 c:\windows\system32\webcheck.dll
+ 2005-05-12 02:47 . 2009-03-08 11:34 105984 c:\windows\system32\url.dll
- 2005-05-12 02:47 . 2009-02-20 18:09 105984 c:\windows\system32\url.dll
+ 2005-05-12 02:47 . 2009-03-08 11:34 109568 c:\windows\system32\occache.dll
+ 2005-05-12 02:47 . 2009-03-08 11:32 611840 c:\windows\system32\mstime.dll
+ 2005-05-12 02:47 . 2009-03-08 11:34 193536 c:\windows\system32\msrating.dll
+ 2006-11-08 04:03 . 2009-03-08 11:32 594432 c:\windows\system32\msfeeds.dll
+ 2009-01-08 01:20 . 2009-01-08 01:20 265720 c:\windows\system32\msdbg2.dll
+ 2006-05-18 05:58 . 2009-03-08 11:33 726528 c:\windows\system32\jscript.dll
+ 2009-05-10 23:35 . 2009-05-10 23:34 148888 c:\windows\system32\javaws.exe
+ 2009-05-10 23:35 . 2009-05-10 23:34 144792 c:\windows\system32\javaw.exe
+ 2009-05-10 23:35 . 2009-05-10 23:34 144792 c:\windows\system32\java.exe
+ 2006-11-08 04:03 . 2009-03-08 11:22 164352 c:\windows\system32\ieui.dll
+ 2006-02-24 21:24 . 2009-03-08 11:31 183808 c:\windows\system32\iepeers.dll
+ 2005-05-12 02:47 . 2009-03-08 21:09 391536 c:\windows\system32\iedkcs32.dll
+ 2006-10-17 18:27 . 2009-03-08 11:11 445952 c:\windows\system32\ieapfltr.dll
+ 2004-06-04 21:13 . 2009-03-08 11:32 163840 c:\windows\system32\ieakui.dll
+ 2005-05-12 02:47 . 2009-03-08 11:33 229376 c:\windows\system32\ieaksie.dll
+ 2005-05-12 02:47 . 2009-03-08 11:33 125952 c:\windows\system32\ieakeng.dll
+ 2005-05-12 02:47 . 2009-03-08 11:32 173056 c:\windows\system32\ie4uinit.exe
+ 2005-09-02 23:35 . 2009-03-08 11:31 216064 c:\windows\system32\dxtrans.dll
+ 2006-04-28 17:57 . 2009-03-08 11:31 348160 c:\windows\system32\dxtmsft.dll
+ 2007-01-04 13:37 . 2009-03-08 11:34 914944 c:\windows\system32\dllcache\wininet.dll
+ 2006-11-08 04:03 . 2009-03-08 11:34 236544 c:\windows\system32\dllcache\webcheck.dll
+ 2006-12-19 18:08 . 2009-03-08 11:33 759296 c:\windows\system32\dllcache\VGX.dll
+ 2008-05-09 10:53 . 2009-03-08 11:33 420352 c:\windows\system32\dllcache\vbscript.dll
+ 2006-10-17 19:05 . 2009-03-08 11:34 105984 c:\windows\system32\dllcache\url.dll
- 2006-10-17 19:05 . 2009-02-20 18:09 105984 c:\windows\system32\dllcache\url.dll
+ 2009-01-08 01:20 . 2009-01-08 01:20 134144 c:\windows\system32\dllcache\sqmapi.dll
+ 2009-01-08 01:20 . 2009-01-08 01:20 474112 c:\windows\system32\dllcache\shlwapi.dll
+ 2006-10-17 19:04 . 2009-03-08 11:34 109568 c:\windows\system32\dllcache\occache.dll
+ 2007-01-04 13:36 . 2009-03-08 11:32 611840 c:\windows\system32\dllcache\mstime.dll
+ 2007-01-04 13:36 . 2009-03-08 11:34 193536 c:\windows\system32\dllcache\msrating.dll
- 2004-06-04 21:14 . 2006-11-08 04:03 156160 c:\windows\system32\dllcache\msls31.dll
+ 2004-06-04 21:14 . 2009-03-08 11:22 156160 c:\windows\system32\dllcache\msls31.dll
+ 2007-05-09 05:11 . 2009-03-08 11:32 594432 c:\windows\system32\dllcache\msfeeds.dll
+ 2008-05-09 10:53 . 2009-03-08 11:33 726528 c:\windows\system32\dllcache\jscript.dll
+ 2006-10-17 19:04 . 2009-03-08 21:09 638816 c:\windows\system32\dllcache\iexplore.exe
+ 2007-01-04 13:36 . 2009-03-08 11:31 183808 c:\windows\system32\dllcache\iepeers.dll
+ 2006-11-07 10:27 . 2009-03-08 21:09 391536 c:\windows\system32\dllcache\iedkcs32.dll
+ 2007-05-09 05:11 . 2009-03-08 11:11 445952 c:\windows\system32\dllcache\ieapfltr.dll
+ 2004-06-04 21:13 . 2009-03-08 11:32 163840 c:\windows\system32\dllcache\ieakui.dll
+ 2006-11-07 10:27 . 2009-03-08 11:33 229376 c:\windows\system32\dllcache\ieaksie.dll
+ 2006-11-07 10:26 . 2009-03-08 11:33 125952 c:\windows\system32\dllcache\ieakeng.dll
+ 2006-11-07 10:26 . 2009-03-08 11:32 173056 c:\windows\system32\dllcache\ie4uinit.exe
+ 2007-01-04 13:36 . 2009-03-08 11:31 216064 c:\windows\system32\dllcache\dxtrans.dll
+ 2007-01-04 13:36 . 2009-03-08 11:31 348160 c:\windows\system32\dllcache\dxtmsft.dll
+ 2006-11-07 10:26 . 2009-03-08 11:32 128512 c:\windows\system32\dllcache\advpack.dll
+ 2005-05-12 02:47 . 2009-03-08 11:32 128512 c:\windows\system32\advpack.dll
+ 2009-05-08 17:30 . 2008-07-09 07:38 382840 c:\windows\ie8updates\KB969497-IE8\spuninst\updspapi.dll
+ 2009-05-08 17:30 . 2008-07-09 07:38 231288 c:\windows\ie8updates\KB969497-IE8\spuninst\spuninst.exe
+ 2009-05-08 17:27 . 2009-03-03 00:18 826368 c:\windows\ie8\wininet.dll
+ 2009-05-08 17:27 . 2006-10-17 19:05 206336 c:\windows\ie8\winfxdocobj.exe
+ 2009-05-08 17:27 . 2009-02-20 18:09 233472 c:\windows\ie8\webcheck.dll
+ 2009-05-08 17:27 . 2007-07-12 23:31 765952 c:\windows\ie8\vgx.dll
+ 2009-05-08 17:27 . 2008-05-09 10:53 430080 c:\windows\ie8\vbscript.dll
+ 2009-05-08 17:27 . 2009-02-20 18:09 105984 c:\windows\ie8\url.dll
+ 2009-05-08 17:28 . 2009-01-08 01:21 382496 c:\windows\ie8\spuninst\updspapi.dll
+ 2009-05-08 17:28 . 2009-01-08 01:20 231456 c:\windows\ie8\spuninst\spuninst.exe
+ 2009-05-08 17:26 . 2006-09-06 23:43 213216 c:\windows\ie8\spuninst.exe
+ 2009-05-08 17:27 . 2009-02-20 18:09 102912 c:\windows\ie8\occache.dll
+ 2009-05-08 17:27 . 2009-02-20 18:09 671232 c:\windows\ie8\mstime.dll
+ 2009-05-08 17:27 . 2009-02-20 18:09 193024 c:\windows\ie8\msrating.dll
+ 2009-05-08 17:26 . 2006-11-08 04:03 156160 c:\windows\ie8\msls31.dll
+ 2009-05-08 17:26 . 2009-02-20 18:09 477696 c:\windows\ie8\mshtmled.dll
+ 2009-05-08 17:26 . 2009-02-20 18:09 459264 c:\windows\ie8\msfeeds.dll
+ 2009-05-08 17:26 . 2008-05-09 10:53 512000 c:\windows\ie8\jscript.dll
+ 2009-05-08 17:26 . 2009-02-28 04:54 636072 c:\windows\ie8\iexplore.exe
+ 2009-05-08 17:27 . 2006-11-08 04:03 180736 c:\windows\ie8\ieui.dll
+ 2009-05-08 17:26 . 2009-02-20 18:09 268288 c:\windows\ie8\iertutil.dll
+ 2009-05-08 17:27 . 2006-11-08 04:03 287744 c:\windows\ie8\ieproxy.dll
+ 2009-05-08 17:26 . 2006-11-08 04:03 191488 c:\windows\ie8\iepeers.dll
+ 2009-05-08 17:26 . 2009-02-20 18:09 385024 c:\windows\ie8\iedkcs32.dll
+ 2009-05-08 17:26 . 2009-02-20 18:09 383488 c:\windows\ie8\ieapfltr.dll
+ 2009-05-08 17:26 . 2009-02-20 05:14 161792 c:\windows\ie8\ieakui.dll
+ 2009-05-08 17:26 . 2009-02-20 18:09 230400 c:\windows\ie8\ieaksie.dll
+ 2009-05-08 17:26 . 2009-02-20 18:09 153088 c:\windows\ie8\ieakeng.dll
+ 2009-05-08 17:26 . 2009-02-20 18:09 214528 c:\windows\ie8\dxtrans.dll
+ 2009-05-08 17:26 . 2009-02-20 18:09 347136 c:\windows\ie8\dxtmsft.dll
+ 2009-05-08 17:26 . 2009-02-20 18:09 124928 c:\windows\ie8\advpack.dll
+ 2006-08-31 03:42 . 2009-03-08 11:34 1206784 c:\windows\system32\urlmon.dll
+ 2006-05-19 22:52 . 2009-03-08 11:41 5937152 c:\windows\system32\mshtml.dll
+ 2006-04-10 20:00 . 2008-03-21 01:06 1480232 c:\windows\system32\LegitCheckControl.dll
+ 2006-10-17 18:57 . 2009-03-08 11:32 1985024 c:\windows\system32\iertutil.dll
+ 2006-09-06 06:01 . 2009-02-07 04:07 3698584 c:\windows\system32\ieapfltr.dat
+ 2007-01-25 12:48 . 2009-03-08 11:34 1206784 c:\windows\system32\dllcache\urlmon.dll
+ 2009-01-08 01:20 . 2009-01-08 01:20 1497088 c:\windows\system32\dllcache\shdocvw.dll
+ 2007-01-04 13:36 . 2009-03-08 11:41 5937152 c:\windows\system32\dllcache\mshtml.dll
+ 2007-05-09 05:11 . 2009-03-08 11:32 1985024 c:\windows\system32\dllcache\iertutil.dll
+ 2007-05-09 05:11 . 2009-02-07 04:07 3698584 c:\windows\system32\dllcache\ieapfltr.dat
+ 2009-01-08 01:20 . 2009-01-08 01:20 1022976 c:\windows\system32\dllcache\browseui.dll
+ 2009-05-08 17:27 . 2009-02-20 18:09 1160192 c:\windows\ie8\urlmon.dll
+ 2009-05-08 17:26 . 2009-02-20 18:09 3595264 c:\windows\ie8\mshtml.dll
+ 2009-05-08 17:26 . 2009-02-20 18:09 6066176 c:\windows\ie8\ieframe.dll
+ 2009-05-08 17:26 . 2008-07-09 14:25 2455488 c:\windows\ie8\ieapfltr.dat
+ 2009-05-08 17:24 . 2009-04-06 14:57 24921544 c:\windows\system32\MRT.exe
+ 2006-11-08 04:03 . 2009-03-08 11:39 11063808 c:\windows\system32\ieframe.dll
+ 2007-05-09 05:11 . 2009-03-08 11:39 11063808 c:\windows\system32\dllcache\ieframe.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PSUNMain"="c:\program files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe" [2009-04-24 353536]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-10 148888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2008-04-14 53760]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
2001-12-21 06:34 24576 —-a-w c:\progra~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
backup=c:\windows\pss\Adobe Gamma Loader.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Compaq Connections.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Compaq Connections.lnk
backup=c:\windows\pss\Compaq Connections.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^GetRight.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\GetRight.lnk
backup=c:\windows\pss\GetRight.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnk
backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Verizon Online Support Center.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Verizon Online Support Center.lnk
backup=c:\windows\pss\Verizon Online Support Center.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WG111v2 Smart Wizard Wireless Setting.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WG111v2 Smart Wizard Wireless Setting.lnk
backup=c:\windows\pss\WG111v2 Smart Wizard Wireless Setting.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^beka^Start Menu^Programs^Startup^desktop.ini]
path=c:\documents and settings\beka\Start Menu\Programs\Startup\desktop.ini
backup=c:\windows\pss\desktop.iniStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Emily^Start Menu^Programs^Startup^RollerCoaster Tycoon 3 Registration.lnk]
path=c:\documents and settings\Emily\Start Menu\Programs\Startup\RollerCoaster Tycoon 3 Registration.lnk
backup=c:\windows\pss\RollerCoaster Tycoon 3 Registration.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Alienware Dock.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\Alienware Dock.lnk
backup=c:\windows\pss\Alienware Dock.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^BHODemon 2.0.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\BHODemon 2.0.lnk
backup=c:\windows\pss\BHODemon 2.0.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^BoontyBox gamedownloads.com.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\BoontyBox gamedownloads.com.lnk
backup=c:\windows\pss\BoontyBox gamedownloads.com.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Compaq Organize.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\Compaq Organize.lnk
backup=c:\windows\pss\Compaq Organize.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^IMStart.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\IMStart.lnk
backup=c:\windows\pss\IMStart.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^PowerReg Scheduler.exe]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\PowerReg Scheduler.exe
backup=c:\windows\pss\PowerReg Scheduler.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Xfire.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\Xfire.lnk
backup=c:\windows\pss\Xfire.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^ZMatrix.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\ZMatrix.lnk
backup=c:\windows\pss\ZMatrix.lnkStartup

[HKLM\~\startupfolder\^.gtk-bookmarks]
path=\.gtk-bookmarks
backup=c:\windows\pss\.gtk-bookmarksCommon Startup

[HKLM\~\startupfolder\^LuResult.txt]
path=\LuResult.txt
backup=c:\windows\pss\LuResult.txtCommon Startup

[HKLM\~\startupfolder\^ml1.srt]
path=\ml1.srt
backup=c:\windows\pss\ml1.srtCommon Startup

[HKLM\~\startupfolder\^ml2.srt]
path=\ml2.srt
backup=c:\windows\pss\ml2.srtCommon Startup

[HKLM\~\startupfolder\^NTUser.000]
path=\NTUser.000
backup=c:\windows\pss\NTUser.000Common Startup

[HKLM\~\startupfolder\^NTUser.000.LOG]
path=\NTUser.000.LOG
backup=c:\windows\pss\NTUser.000.LOGCommon Startup

[HKLM\~\startupfolder\^NTUser.dat]
path=\ntuser.dat
backup=c:\windows\pss\ntuser.datCommon Startup

[HKLM\~\startupfolder\^ntuser.dat.LOG]
path=\ntuser.dat.LOG
backup=c:\windows\pss\ntuser.dat.LOGCommon Startup

[HKLM\~\startupfolder\^ntuser.ini]
path=\ntuser.ini
backup=c:\windows\pss\ntuser.iniCommon Startup

[HKLM\~\startupfolder\^reglog.txt]
path=\reglog.txt
backup=c:\windows\pss\reglog.txtCommon Startup

[HKLM\~\startupfolder\^tempdiff.txt]
path=\tempdiff.txt
backup=c:\windows\pss\tempdiff.txtCommon Startup

[HKLM\~\startupfolder\^Windows Classic style_BLOCK.WB4]
path=\Windows Classic style_BLOCK.WB4
backup=c:\windows\pss\Windows Classic style_BLOCK.WB4Common Startup

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"NvCplDaemon"=RUNDLL32.EXE c:\windows\System32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\Owner\\Desktop\\utorrent.exe"=
"c:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\helpctr.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\UT2004Demo\\System\\UT2004.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\Common Files\\Microsoft Shared\\VS7DEBUG\\MDM.EXE"=

R1 PSINKNC;PSINKNC;c:\windows\system32\drivers\PSINKNC.sys [4/23/2009 8:15 PM 113928]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [1/25/2009 5:49 PM 66048]
R2 PSINAflt;PSINAflt;c:\windows\system32\drivers\PSINAflt.sys [4/23/2009 8:15 PM 136968]
R2 PSINFile;PSINFile;c:\windows\system32\drivers\PSINFile.sys [4/23/2009 8:15 PM 92552]
R2 PSINProc;PSINProc;c:\windows\system32\drivers\PSINProc.sys [4/23/2009 8:15 PM 98056]
S2 NanoServiceMain;NanoServiceMain;c:\program files\Panda Security\Panda Cloud Antivirus\PSANHost.exe [4/23/2009 8:14 PM 95488]
S3 dump_wmimmc;dump_wmimmc;\??\c:\nexon\MapleStory\GameGuard\dump_wmimmc.sys –> c:\nexon\MapleStory\GameGuard\dump_wmimmc.sys [?]
S3 hamachi_oem;PlayLinc Adapter;c:\windows\system32\drivers\gan_adapter.sys [9/27/2006 5:12 PM 10664]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [1/25/2009 5:49 PM 167808]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys –> c:\windows\system32\drivers\ScreamingBAudio.sys [?]

— Other Services/Drivers In Memory —

*NewlyCreated* - JAVAQUICKSTARTERSERVICE

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-04-19 c:\windows\Tasks\HP DArC Task 2003-04-08 07:12ewlett-PackardHewlett-Packard Companyeskjet3600—-a-wH391180TY6B.job
- c:\program files\HP\hpcoretech\comp\hpdarc.exe [2003-04-08 19:45]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=presario&pf=desktop
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {1EAFB28B-CAA8-47E4-8DEC-968B06FA1D19} - hxxp://foxmovies.a.content.maven.net/mvms/vfs/fox/foxmovies/live/install/installerAX.cab
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\31h95b8d.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.newsarama.com
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF - plugin: c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\31h95b8d.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071303000004.dll
FF - plugin: c:\program files\Download Manager\npfpdlm.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npracplug.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDCE08D86A-A41A-410A-943C-13BABB7DC474", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDA9EDC9ED-603A-4F3F-BBEA-59C8853A3236", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID90D10942-D952-4863-9DD6-A2BDBBAD456E", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID0ECEE744-7B69-4912-AB91-AE76D61ECB04", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDF25635B2-1AB9-47B5-88D1-8877B22C86DE", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID27B7F812-4159-45B9-A389-B7A118A58DE4", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDF849DF29-393B-4F8B-99D1-117A70D66FC7", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDBF1E9C3D-637C-4171-BD12-28A7360B879A", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDDE1C0601-7947-4D7F-A6E5-E68BF6BA1E37", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID4EA0DCCE-4D98-4876-9C6A-E5C563D0820A", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID446462BA-2AAD-4C88-BC63-5210E2F31465", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID0862E368-A40E-4E55-83EB-FBC5571BABA4", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDD2A96E3C-FFB3-4D38-9AC3-B127527BEA35", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID4B05B39A-9DDC-4650-A7F8-D5B134E5FFE5", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDC8E2574A-7BCE-4B93-A22E-61831DFD6DB8", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID659796C0-8B5D-48D7-A4EB-7E6874E26274", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID78071AB5-E729-414E-8D02-9C1D034F82E7", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDCC3F71E1-17F3-4C5B-997D-44CA56943197", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDE67D5C78-B2D4-4BA0-8D69-1C7AF4BB08B5", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFC5F3D7A-D321-412C-8A5D-9AD0C8041941", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID6EC5CD16-81BC-4515-9EDD-9265C906F56E", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID67CFB2C5-E491-4395-977B-CD45E4124655", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID73600569-52E6-4760-8BAB-B68202937D98", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDB02EBD42-6885-401A-9389-E089F7DDC872", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDBAE5CB8C-4075-4743-B2E4-78DA8D8CDC64", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID28B07B04-DA99-4FD3-BF27-4972F2B8142B", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID0D53448F-D12B-4102-8CE2-697DAE8D6643", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDE3266A47-A141-47B8-AAA8-5F16FB4F8CCD", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDB33AB7AF-76D7-4B1C-B709-5D6BF9E7B1C7", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID153B7451-0BB5-4B37-95C0-44D89E2F1F2B", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID3BBE8E21-0D3D-4BAA-AC6F-C7BCEF750849", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID9B5B4F2D-A7D9-4329-B0FE-92B301A8CAAD", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDA5C42921-8CD0-4924-97C3-01B5B0610BC6", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID06969252-F90F-4CF2-9074-33772EB64859", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDFBF37655-1236-4C0D-96C5-F94E1724841B", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDC1A3F035-B68F-4B2B-9FD5-E36DAAAF26DD", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID368F3685-543E-4812-9FDE-96E097E453FC", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID43969873-56AA-4113-84CB-4AB2AEB9AA31", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDA205DD80-63D4-4E41-B785-26EC3D90B97B", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID068D43E7-7551-4A2F-AE96-4A38A9AD1953", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDF443E9CB-9EEC-456E-8AE7-F3102D5CD47D", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDE36A7B16-645D-4261-BFF8-3A7E69C5F7A5", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID379805E3-E0E2-40DC-B51B-6DC1AE5802AA", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDF6240D69-A06D-44A1-8003-8496CCEF2C53", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID26C3113D-5A71-4F1B-A2CB-BE59E1279DDA", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID92B97F2B-7565-4CE9-9AC7-0598DFD731F8", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID2AA5E7CF-9696-42F0-B76A-8655296EADF2", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID0AAACE0B-ACEF-4781-83F4-BFB52EEC995A", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID0D56FF58-A39D-4E8C-A40B-2E3711251772", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID946121C2-11F1-49DD-A7E3-CF793DE827A4", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CIDB853303D-1BAB-43F3-9D7D-101D0DA8E7A5", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID9E578247-FE29-4F8C-8202-A24A5688CF2A", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID6D065A8F-FFC0-4A0F-B863-1D724B8C786B", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID4451D291-6940-42CE-9D3C-CA1D4C96549C", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID064B722D-079D-4EBB-B3CF-9FCBF64FFF5D", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID38F8AB0F-5DFB-43D9-889E-8717CC4AB59B", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID4EC68CD1-0EF1-4CB9-9EF1-3D64AB266149", "AllAccess");
c:\program files\Mozilla Firefox\defaults\pref\activex.js - pref("capability.policy.default.ClassID.CID44F96B27-CFAD-41E1-83A1-6B28040C3BDE", "AllAccess");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-10 16:46
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1634829951-3876798684-2761164870-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"????????????????????????"=hex:45,dd,ac,b1,bb,02,ec,1c,31,ba,b5,2d,fd,93,af,f8,
c3,22,87,e9,e9,f4,f7,22,22,f7,c3,c3,78,70,22,d0,00,00,00,00,00,00,00,00,00,\
"???n"=hex:db,1e,79,e6,c1,17,24,ca,be,11,0e,0d,f8,c2,27,24,43,74,3c,e7,25,82,
f5,0a,01,29,94,af,5a,4f,0e,98,0b,a2,72,b8,8e,1c,da,51,c6,c5,ac,ca,32,c8,10,\
"?????"=hex:ef,89,0f,2f,a6,ee,78,65,f1,87,81,0f,df,35,54,43
"???n"=hex:e2,46,31,73,03,52,e1,95,99,4d,4a,b7,7e,25,5c,4d,28,98,a6,d7,b9,a0,
46,41,e4,86,5d,b7,ed,11,c1,46,3b,5d,79,2f,1f,c7,dd,4d,b3,42,c9,9b,86,a4,31,\
"???n"=hex:6d,34,4a,0c,4e,fb,2d,e3,73,15,67,1c,d4,19,7d,82,7c,41,f9,42,ba,bd,
93,06,99,ad,e3,44,2b,18,8c,5c,e7,1c,5b,4b,8a,55,67,97,2a,c6,bb,a6,28,94,4a,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(768)
c:\progra~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
.
Completion time: 2009-05-10 16:48
ComboFix-quarantined-files.txt 2009-05-10 23:48
ComboFix2.txt 2009-05-08 15:58

Pre-Run: 58,529,828,864 bytes free
Post-Run: 58,511,200,256 bytes free

524 — E O F — 2009-04-29 23:01

Uninstall list:

3D Groove Playback Engine
Absolute Uninstaller 1.44
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 7.0.9
Adobe Shockwave Player 11.5
Agere Systems PCI Soft Modem
AruaROSE
BHODemon 2.0.0.23
Building Cars
Compaq Connections
Critical Update for Windows Media Player 11 (KB959772)
Disney Toontown Online
Disney's Toontown Online
Dogz 5
Download Manager 2.3.6
Feeding Frenzy 2: Shipwreck Showdown
FlatOut Demo
FLV Player 1.3.3
G-Force
High Definition Audio Driver Package - KB835221
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Format SDK (KB902344)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
HP Memories Disc
hp print screen utility
IconPackager
IntelliMover Data Transfer Demo
Internet Explorer Q903235
Jasc Paint Shop Pro 9
Jasc Paint Shop Pro 9.01 - (9.0.1.1)
Java™ 6 Update 13
Jimmy Neutron Boy Genius
Logitech SetPoint
Malwarebytes' Anti-Malware
MapleStory
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Data Access Components KB870669
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft Plus! Digital Media Edition
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual J# .NET Redistributable Package 1.1
Microsoft Works 7.0
Mozilla Firefox (3.0.10)
MSXML 4.0 SP2 (KB925672)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 and SOAP Toolkit 3.0
MultiRes (remove only)
NVIDIA Display Driver
NVIDIA Drivers
ObjectDock
Pajama Sam's no Need to Hide
Panda Cloud Antivirus
Panda Cloud Antivirus
PC-Doctor for Windows
Pegasus Test Server - ROSE Online Evolution
Photosmart 140,240,7200,7600,7700,7900 Series
PS2
PunkBuster for Battlefield Vietnam
Python 2.2 combined Win32 extensions
Python 2.2.1
R.O.S.E. NA Server Status Ticker
Rose Online
ROSE Online Evolution
Roxio Easy Media Creator 7
SafeCast Shared Components
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961373)
SimTheme Park
SpeechRedist
Super Collapse! from GameHouse
Superb Display Pictures for Messenger
TeamSpeak 2 RC2
the script 2003
Tonka Construction 2
TONKA Search & Rescue 2
Unreal Tournament 2004 Demo
Update for Windows Internet Explorer 8 (KB969497)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Ventrilo Client
VideoLAN VLC media player 0.8.6f
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
WG111v2 Configuration Utility
WildTangent Games
WildTangent Updater
WildTangent Web Driver
Window Washer
WindowBlinds
Windows Genuine Advantage v1.3.0254.0
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 8
Windows Live installer
Windows Live Messenger
Windows Live OneCare safety scanner
Windows Live Sign-in Assistant
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB890923
Windows XP Service Pack 3
WinRAR archiver
WinZip
Xfire (remove only)
Yahoo! Anti-Spy
Yahoo! Install Manager
Yahoo! Toolbar

oldman960

Post #11May 11, 2009, 8:44 AM UTC

Hi esseff,

I can understand your concern. I'll see what we an do about F-secure.

Open hijackthis, do a system scan only and checkmark these lines, if present

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (file missing)

Close ALL other windows/browsers and click Fix Checked. Answer Yes if prompted. Close HJT.

Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1
Download Mirror #2

Double-click GooredFix.exe to run it.
Select 1. Find Goored (no fix) by typing 1 and pressing Enter.
A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called GooredLog.txt).

Note: Do not run Option #2 yet

Thanks

esseff

Post #12May 11, 2009, 8:38 PM UTC

Here is the log: GooredFix v1.92 by jpshortstuff Log created at 13:37 on 11/05/2009 running Option #1 (Owner) Firefox version 3.0.10 (en-US) =====Suspect Goored Entries===== C:\Program Files\Mozilla Firefox\extensions\{21B08956-4C85-4FAD-B881-FCED4CEC699F} =====Dumping Registry Values===== [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.10\extensions] "Plugins"="C:\Program Files\Mozilla Firefox\plugins" [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.10\extensions] "Components"="C:\Program Files\Mozilla Firefox\components" [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions] "[removed]"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff"

oldman960

Post #13May 11, 2009, 10:01 PM UTC

Hi esseff,

Please double-click GooredFix.exe on your Desktop to run it.

Select "2. Fix Goored" by typing 2 and pressing Enter.
Make sure all instances of Firefox are closed at this point.
Type y at the prompt and press Enter again.
A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called GooredLog.txt).

Note: If you receive a message saying that GooredFix needs your system to be restarted, please close all applications and reboot your system. Please also allow any registry changes that may be prompted by any of your security programs.

Any better?

esseff

Post #14May 12, 2009, 3:16 AM UTC

here is the log: GooredFix v1.92 by jpshortstuff Log created at 20:14 on 11/05/2009 running Option #2 (Owner) Firefox version 3.0.10 (en-US) =====Goored Deletions===== C:\Program Files\Mozilla Firefox\extensions\{21B08956-4C85-4FAD-B881-FCED4CEC699F} ->Backing up folder… Done. ->Emptying folder… Done. ->Deleting folder… Done. =====Dumping Registry Values===== [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.10\extensions] "Plugins"="C:\Program Files\Mozilla Firefox\plugins" [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.10\extensions] "Components"="C:\Program Files\Mozilla Firefox\components" [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions] "[removed]"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff" It didnt ask for a reboot

oldman960

Post #15May 12, 2009, 3:35 AM UTC

Hi esseff, Are you still getting redirected? Thanks

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Closed] need help...HJT posted

✨ Ask AI

Ask AI