[Resolved] Hijacked proxy port 7171 fixed; still pop-ups

I landed here through a Google forum. Done all the steps as described in this thread:
http://forums.whatthetech.com/Internet_add…ck_t103090.html

Looks like the hijacking of port 7171 is disabled but I still have pop-ups appear that I don't ask for.

I have run the as described in post #4 additional tests with OTList2.exe.
Here are my results; please supply additional help:

————————–

Logfile after reboot

========== OTLISTIT ==========
Process Explorer.EXE killed successfully!
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\DisableRegedit not found.
========== FILES ==========
File\Folder C:\WINDOWS\system32\winsys16_061230.dll C:\WINDOWS\system32\sdra64.exe not found.
File\Folder C:\WINDOWS\system32\pavuppad.exe not found.
File\Folder C:\WINDOWS\system32\218538\218538.dll not found.
File\Folder C:\magks32.dll not found.
File\Folder C:\Program Files\Common\_helper.dll not found.
C:\windows\ld08.exe moved successfully.
File\Folder c:\windows\pp06.exe not found.
File\Folder C:\WINDOWS\system32\dsound3dd.dll not found.
========== COMMANDS ==========
File delete failed. C:\Documents and Settings\Eppo Clappo\Local Settings\Temp\Perflib_Perfdata_174.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Eppo Clappo\Local Settings\Temp\~DF491A.tmp scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Eppo Clappo\Local Settings\Temp\~DF98F7.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_128.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\ZLT04c51.TMP scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.
Explorer started successfully

OTListIt2 by OldTimer - Version 2.0.15.8 log created on 05182009_210326

Files moved on Reboot…
File C:\Documents and Settings\Eppo Clappo\Local Settings\Temp\Perflib_Perfdata_174.dat not found!
C:\Documents and Settings\Eppo Clappo\Local Settings\Temp\~DF491A.tmp moved successfully.
C:\Documents and Settings\Eppo Clappo\Local Settings\Temp\~DF98F7.tmp moved successfully.
File C:\WINDOWS\temp\Perflib_Perfdata_128.dat not found!
C:\WINDOWS\temp\ZLT04c51.TMP moved successfully.

Registry entries deleted on Reboot…

———————————

Extras.txt

OTListIt Extras logfile created on: 18-5-2009 21:12:21 - Run 1
OTListIt2 by OldTimer - Version 2.0.15.8 Folder = C:\Documents and Settings\Eppo Clappo\Desktop
Windows XP Professional Edition Service Pack 3, v.5755 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000413 | Country: Netherlands | Language: NLD | Date Format: d-M-yyyy

959,23 Mb Total Physical Memory | 426,13 Mb Available Physical Memory | 44,42% Memory free
2,26 Gb Paging File | 1,71 Gb Available in Paging File | 75,61% Paging File free
Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74,52 Gb Total Space | 19,26 Gb Free Space | 25,84% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 38,24 Gb Total Space | 1,23 Gb Free Space | 3,21% Space Free | Partition Type: NTFS
Drive F: | 38,45 Gb Total Space | 1,22 Gb Free Space | 3,16% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: AFM-788F5526B53
Current User Name: Eppo Clappo
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
"DisableUnicastResponsesToMulticastBroadcast" = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
"DisableUnicastResponsesToMulticastBroadcast" = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
"80:TCP" = 80:TCP:*:Enabled:SYS32DLL
"7171:TCP" = 7171:TCP:*:Enabled:SYS32DLL

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)
"C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe" = [String data over 1000 bytes]
C:\Program Files\VoipBuster.com\VoipBuster\VoipBuster.exe:*:Enabled:VoipBuster (VoipBuster)
C:\Program Files\Java\jre6\launch4j-tmp\JDownloader.exe:*:Enabled:Java™ Platform SE binary (Sun Microsystems, Inc.)
C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent (BitTorrent, Inc.)
C:\Program Files\WebDrive\webdrive.exe:*:Enabled:WebDrive Application (South River Technologies, LLC)
C:\Program Files\WebDrive\wdService.exe:*:Enabled:WebDrive Service (South River Technologies, LLC)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{0542231F-2010-4C7B-9169-EC0C0CB9F371}" = Sun xVM VirtualBox
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java™ 6 Update 13
"{2BA00471-0328-3743-93BD-FA813353A783}" = Microsoft .NET Framework 3.0 Service Pack 1
"{2FC099BD-AC9B-33EB-809C-D332E1B27C40}" = Microsoft .NET Framework 3.5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3F3733A5-8322-454D-A638-3B74E1C83752}" = Gadget Installer
"{4448ABF6-786D-4C3D-A49D-7BB237E6DD17}" = Foxit PDF IFilter
"{55A29068-F2CE-456C-9148-C869879E2357}" = TuneUp Utilities 2009
"{657A9065-8C7F-4CE9-B284-1631FBA13F46}" = Jazler TV
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 SP1 Redistributable
"{79E0927E-6347-495F-83C1-92B0AB252B07}" = The Humans
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-008A-0409-0000-0000000FF1CE}" = Microsoft Office 2007 Recent Documents Gadget
"{9431A631-BFCC-488F-AD74-364A943D4529}" = Microsoft Web Services Enhancements 1.0 SP1
"{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 3.81
"{98A64C75-BFD6-4212-8746-8BADC7ABA79E}" = Virtual CD v9
"{A040AC77-C1AA-4CC9-8931-9F648AF178F6}" = VC 9.0 Runtime
"{B508B3F1-A24A-32C0-B310-85786919EF28}" = Microsoft .NET Framework 2.0 Service Pack 1
"{BB05D173-9681-4812-A7FA-BD4042A3DA00}" = Alky for Applications (Windows XP)
"{C151CE54-E7EA-4804-854B-F515368B0798}" = Athlon 64 Processor Driver
"{C15C9BC4-B329-4C4E-B2E6-2D47CEB3DC54}_is1" = Turtix v1.2
"{C9B26742-06BE-3B75-B1DE-7B91B5956A04}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30304
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D17D8B97-F937-432F-88BD-382727D34441}" = EuropeMapleStory
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft Web Services Enhancements 3.0
"{E4B7BD2F-FC41-490F-965D-15D93F4FE1A2}" = OpenOffice.org 3.0
"{E63E34A7-E552-412B-9E40-FD6FC5227ABA}" = Uniblue RegistryBooster 2009
"{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}" = Styler
"{F08E87FD-F62B-4BAC-A2D6-A94755653F30}" = WebDrive
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F3CA9611-CD42-4562-ADAB-A554CF8E17F1}" = Microsoft Web Services Enhancements 2.0 SP3
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"100 Happy Money 3 Screen Saver_is1" = 100 Happy Money Screen Saver 3.14
"7-Zip" = 7-Zip 4.57
"Ad-Aware" = Ad-Aware
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AhnLab Online Security" = AhnLab Online Security
"Alt.Binz" = Alt.Binz 0.25.0
"Amazing Adventures Special Edition Bundle SDR" = Amazing Adventures Special Edition Bundle SDR
"Ask Toolbar_is1" = Foxit Toolbar
"BootSkin" = BootSkin
"CCleaner" = CCleaner (remove only)
"CPLBonus" = Kels' CPL Bonus Pack!
"Driver Checker_is1" = Driver Checker v2.7.3
"Eusing Free Registry Cleaner" = Eusing Free Registry Cleaner
"FormatFactory" = FormatFactory 1.85
"Foxit PDF Editor" = Foxit PDF Editor
"Foxit Reader" = Foxit Reader
"HashTab" = HashTab 2.0.8
"HijackThis" = HijackThis 1.99.1
"Hunt Virus Utilities" = Hunt Virus Utilities
"IconPackager" = IconPackager
"IrfanView" = IrfanView (remove only)
"Juice" = Juice 2.2
"KLiteCodecPack_is1" = K-Lite Codec Pack 3.9.0 Standard
"LClock" = LClock
"Microsoft .NET Framework 3.5" = Microsoft .NET Framework 3.5
"Mozilla Firefox (3.0.10)" = Mozilla Firefox (3.0.10)
"NVIDIA Drivers" = NVIDIA Drivers
"PowerCmd_is1" = PowerCmd 1.9
"RocketDock_is1" = RocketDock 1.3.5
"Stylizer" = Stylizer
"SystemRequirementsLab" = System Requirements Lab
"TeamViewer 4" = TeamViewer 4
"Uniblue RegistryBooster 2009" = Uniblue RegistryBooster 2009
"Unlocker" = Unlocker 1.8.7
"uTorrent Ultra Accelerator" = uTorrent Ultra Accelerator
"VoipBuster_is1" = VoipBuster
"Winamp" = Winamp
"WinDjView" = WinDjView 1.0.1
"WindowBlinds" = WindowBlinds
"Windows Sidebar" = Windows Sidebar
"WinRAR archiver" = WinRAR archiver
"WirelessMon_is1" = WirelessMon V3.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"Zinio Reader" = Zinio Reader
"ZoneAlarm Security Suite" = ZoneAlarm Security Suite

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 23-4-2009 12:18:13 | Computer Name = AFM-788F5526B53 | Source = Application Error | ID = 1000
Description = Faulting application firefox.exe, version 1.9.0.3372, faulting module
hpycxhsq.dll, version 0.0.0.0, fault address 0x0000e37f.

Error - 23-4-2009 12:18:24 | Computer Name = AFM-788F5526B53 | Source = Application Error | ID = 1001
Description = Fault bucket 546220926.

Error - 26-4-2009 4:33:05 | Computer Name = AFM-788F5526B53 | Source = WmiAdapter | ID = 4099
Description = Open of service failed.

Error - 26-4-2009 4:35:28 | Computer Name = AFM-788F5526B53 | Source = WmiAdapter | ID = 4099
Description = Open of service failed.

Error - 26-4-2009 6:01:18 | Computer Name = AFM-788F5526B53 | Source = Application Error | ID = 1000
Description = Faulting application hddlifepro.exe, version 3.1.0.157, faulting module
hddlifepro.exe, version 3.1.0.157, fault address 0x000b9b40.

Error - 26-4-2009 6:05:59 | Computer Name = AFM-788F5526B53 | Source = Application Error | ID = 1001
Description = Fault bucket 658664232.

Error - 27-4-2009 1:06:22 | Computer Name = AFM-788F5526B53 | Source = Application Error | ID = 1000
Description = Faulting application hddlifepro.exe, version 3.1.0.157, faulting module
hddlifepro.exe, version 3.1.0.157, fault address 0x000b9b40.

Error - 1-5-2009 13:33:19 | Computer Name = AFM-788F5526B53 | Source = Lavasoft Ad-Aware Service | ID = 0
Description =

Error - 9-5-2009 0:39:19 | Computer Name = AFM-788F5526B53 | Source = Application Error | ID = 1000
Description = Faulting application firefox.exe, version 1.9.0.3399, faulting module
xul.dll, version 1.9.0.3399, fault address 0x004c4a7c.

Error - 9-5-2009 0:39:50 | Computer Name = AFM-788F5526B53 | Source = Application Error | ID = 1001
Description = Fault bucket 551383921.

[ System Events ]
Error - 3-5-2009 6:26:02 | Computer Name = AFM-788F5526B53 | Source = Tcpip | ID = 4199
Description = The system detected an address conflict for IP address 192.168.1.35
with the system having network hardware address 00:1D:D9:21:25:70. Network operations
on this system may be disrupted as a result.

Error - 3-5-2009 6:26:02 | Computer Name = AFM-788F5526B53 | Source = Tcpip | ID = 4199
Description = The system detected an address conflict for IP address 192.168.1.35
with the system having network hardware address 00:1D:D9:21:25:70. Network operations
on this system may be disrupted as a result.

Error - 3-5-2009 6:26:02 | Computer Name = AFM-788F5526B53 | Source = Tcpip | ID = 4199
Description = The system detected an address conflict for IP address 192.168.1.35
with the system having network hardware address 00:1D:D9:21:25:70. Network operations
on this system may be disrupted as a result.

Error - 3-5-2009 6:26:03 | Computer Name = AFM-788F5526B53 | Source = Tcpip | ID = 4199
Description = The system detected an address conflict for IP address 192.168.1.35
with the system having network hardware address 00:1D:D9:21:25:70. Network operations
on this system may be disrupted as a result.

Error - 3-5-2009 6:26:07 | Computer Name = AFM-788F5526B53 | Source = Tcpip | ID = 4199
Description = The system detected an address conflict for IP address 192.168.1.35
with the system having network hardware address 00:1D:D9:21:25:70. Network operations
on this system may be disrupted as a result.

Error - 3-5-2009 6:26:07 | Computer Name = AFM-788F5526B53 | Source = Tcpip | ID = 4199
Description = The system detected an address conflict for IP address 192.168.1.35
with the system having network hardware address 00:1D:D9:21:25:70. Network operations
on this system may be disrupted as a result.

Error - 3-5-2009 6:32:46 | Computer Name = AFM-788F5526B53 | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.35 for the Network Card with network
address 00805A51D545 has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

Error - 3-5-2009 7:32:22 | Computer Name = AFM-788F5526B53 | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.35 for the Network Card with network
address 00805A51D545 has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

Error - 3-5-2009 12:33:50 | Computer Name = AFM-788F5526B53 | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service wuauserv with
arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error - 3-5-2009 16:47:45 | Computer Name = AFM-788F5526B53 | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.35 for the Network Card with network
address 00805A51D545 has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).


< End of report >

———————————————–

OTListIt.txt

OTListIt logfile created on: 18-5-2009 21:12:21 - Run 1
OTListIt2 by OldTimer - Version 2.0.15.8 Folder = C:\Documents and Settings\Eppo Clappo\Desktop
Windows XP Professional Edition Service Pack 3, v.5755 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000413 | Country: Netherlands | Language: NLD | Date Format: d-M-yyyy

959,23 Mb Total Physical Memory | 426,13 Mb Available Physical Memory | 44,42% Memory free
2,26 Gb Paging File | 1,71 Gb Available in Paging File | 75,61% Paging File free
Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74,52 Gb Total Space | 19,26 Gb Free Space | 25,84% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 38,24 Gb Total Space | 1,23 Gb Free Space | 3,21% Space Free | Partition Type: NTFS
Drive F: | 38,45 Gb Total Space | 1,22 Gb Free Space | 3,16% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: AFM-788F5526B53
Current User Name: Eppo Clappo
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe (Kaspersky Lab.)
PRC - C:\Program Files\Internet Explorer\Iexplore.exe (Microsoft Corporation)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation)
PRC - C:\WINDOWS\system32\pctspk.exe (PCtel, Inc.)
PRC - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\WINDOWS\System32\TUProgSt.exe (TuneUp Software)
PRC - C:\Program Files\Virtual CD v9\System\VC9SecS.exe (H+H Software GmbH)
PRC - C:\Program Files\TeamViewer\Version4\TeamViewer.exe (TeamViewer GmbH)
PRC - C:\Program Files\WebDrive\wdService.exe (South River Technologies, LLC)
PRC - C:\WINDOWS\system32\wbem\unsecapp.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\wbem\wmiprvse.exe (Microsoft Corporation)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
PRC - C:\WINDOWS\notepad.exe (Microsoft Corporation)
PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
PRC - C:\Program Files\Winamp\winampa.exe ()
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\Virtual CD v9\System\VC9Play.exe (H+H Software GmbH)
PRC - C:\Program Files\RocketDock\RocketDock.exe ()
PRC - C:\Program Files\LClock\lclock.exe ()
PRC - C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Program Files\VoipBuster.com\VoipBuster\VoipBuster.exe (VoipBuster)
PRC - C:\Program Files\TuneUp Utilities 2009\MemOptimizer.exe (TuneUp Software GmbH)
PRC - C:\WINDOWS\system32\SYS32DLL.exe ()
PRC - C:\Program Files\Styler\Styler.exe (ta2027)
PRC - C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Program Files\Virtual CD v9\System\VC9Tray.exe (H+H Software GmbH)
PRC - C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe (SonicWALL, Inc.)
PRC - C:\Documents and Settings\Eppo Clappo\Desktop\OTListIt2.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (aspnet_state [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (FontCache3.0.0.0 [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation)
SRV - (helpsvc [On_Demand | Stopped]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (idsvc [Unknown | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation)
SRV - (JavaQuickStarterService [Auto | Running]) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (Lavasoft Ad-Aware Service [Auto | Running]) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (NetTcpPortSharing [Disabled | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation)
SRV - (NVSvc [Auto | Running]) – C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation)
SRV - (Pctspk [Auto | Running]) – C:\WINDOWS\system32\pctspk.exe (PCtel, Inc.)
SRV - (TeamViewer4 [Auto | Running]) – C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (TuneUp.Defrag [On_Demand | Stopped]) – C:\WINDOWS\System32\TuneUpDefragService.exe (TuneUp Software)
SRV - (TuneUp.ProgramStatisticsSvc [Auto | Running]) – C:\WINDOWS\System32\TUProgSt.exe (TuneUp Software)
SRV - (UxTuneUp [Auto | Running]) – C:\WINDOWS\System32\uxtuneup.dll (TuneUp Software)
SRV - (VC9SecS [Auto | Running]) – C:\Program Files\Virtual CD v9\System\VC9SecS.exe (H+H Software GmbH)
SRV - (vsmon [Auto | Running]) – C:\WINDOWS\system32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
SRV - (WebDriveService [Auto | Running]) – C:\Program Files\WebDrive\wdService.exe (South River Technologies, LLC)
SRV - (WMPNetworkSvc [On_Demand | Stopped]) – C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (ALCXWDM [On_Demand | Running]) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (AmdK8 [System | Running]) – C:\WINDOWS\system32\DRIVERS\AmdK8.sys (Advanced Micro Devices)
DRV - (gameenum [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\gameenum.sys (Microsoft Corporation)
DRV - (Hardlock [Auto | Running]) – C:\WINDOWS\system32\drivers\hardlock.sys (Aladdin Knowledge Systems Ltd.)
DRV - (Haspnt [Auto | Running]) – C:\WINDOWS\system32\drivers\Haspnt.sys (Aladdin Knowledge Systems)
DRV - (HH9Help.sys [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\HH9Help.sys (H+H Software GmbH)
DRV - (KLIF [System | Running]) – C:\WINDOWS\system32\DRIVERS\klif.sys (Kaspersky Lab)
DRV - (Lbd [Boot | Running]) – C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (Mkd2kfNt [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\Mkd2kfNt.sys (AhnLab, Inc.)
DRV - (Mkd2Nadr [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\Mkd2Nadr.sys (AhnLab, Inc.)
DRV - (nv [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (nvatabus [Boot | Running]) – C:\WINDOWS\System32\drivers\nvatabus.sys (NVIDIA Corporation)
DRV - (NVENETFD [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\NVENETFD.sys (NVIDIA Corporation)
DRV - (nvnetbus [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\nvnetbus.sys (NVIDIA Corporation)
DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (Ptserlp [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\ptserlp.sys (PCTEL, INC.)
DRV - (PxHelp20 [Boot | Running]) – C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (rt2870 [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\rt2870.sys (Ralink Technology, Corp.)
DRV - (Secdrv [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (srescan [Boot | Running]) – C:\WINDOWS\system32\ZoneLabs\srescan.sys (Check Point Software Technologies LTD)
DRV - (usbaudio [On_Demand | Stopped]) – C:\WINDOWS\system32\drivers\usbaudio.sys (Microsoft Corporation)
DRV - (vdrv9000 [System | Running]) – C:\WINDOWS\system32\DRIVERS\vdrv9000.sys (H+H Software GmbH)
DRV - (Vmodem [Boot | Running]) – C:\WINDOWS\system32\DRIVERS\vmodem.sys (PCTEL, INC.)
DRV - (Vpctcom [Boot | Running]) – C:\WINDOWS\system32\DRIVERS\vpctcom.sys (PCtel, Inc.)
DRV - (vsdatant [System | Running]) – C:\WINDOWS\System32\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (Vvoice [Boot | Running]) – C:\WINDOWS\system32\DRIVERS\vvoice.sys (PCtel, Inc.)
DRV - (WebDriveFSD [Auto | Running]) – C:\Program Files\WebDrive\wdfsd.sys ()

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.nl/ig"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {58F239B5-D23B-47bd-B833-3619428FDC92}:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:3.1.0
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.10


FF - HKLM\software\mozilla\Firefox\extensions\\[removed]: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009-04-19 22:14:17 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009-04-29 12:43:29 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009-04-29 12:43:29 | 00,000,000 | —D | M]

[2009-04-16 19:53:02 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\mozilla\Extensions
[2009-04-16 19:53:02 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009-05-18 17:27:52 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\mozilla\Firefox\Profiles\g7sudb8n.default\extensions
[2009-04-16 19:57:47 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\mozilla\Firefox\Profiles\g7sudb8n.default\extensions\{58F239B5-D23B-47bd-B833-3619428FDC92}
[2009-05-03 07:20:12 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\mozilla\Firefox\Profiles\g7sudb8n.default\extensions\[removed]
[2009-05-18 17:27:52 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions
[2009-04-29 12:43:29 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009-04-16 21:28:23 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
[2009-04-19 22:14:43 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
[2009-04-29 12:43:24 | 00,023,032 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009-04-29 12:43:24 | 00,134,648 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2008-02-08 11:12:30 | 00,001,890 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bolcom-nl.xml
[2008-04-16 06:08:20 | 00,001,706 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\google.xml
[2008-02-11 23:02:16 | 00,004,558 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\marktplaats-nl.xml
[2007-11-09 11:17:02 | 00,001,111 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\vandale-nl.xml
[2008-03-18 13:19:22 | 00,001,049 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\wikipedia-nl.xml
[2007-11-09 11:17:02 | 00,000,802 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-nl.xml

O1 HOSTS File: (734 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {0F1E423B-E6A4-49B9-825C-F9A7BEF3A5DB} - C:\WINDOWS\system32\vtUklIbB.dll ()
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (790151 Class) - {22186AA4-E2A6-45E8-BF4F-5C103C0458B0} - C:\WINDOWS\system32\790151\790151.dll ()
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O2 - BHO: (no name) - {edf2d686-9f11-480a-a937-d7a2d1ba75e6} - C:\WINDOWS\system32\xzamal.dll ()
O3 - HKLM\..\Toolbar: (StylerToolBar) - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll (StyleFantasist)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O4 - HKLM..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
O4 - HKLM..\Run: [BootSkin Startup Jobs] "C:\PROGRA~1\Stardock\WINCUS~1\BootSkin\BootSkin.exe" /StartupJobs ()
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] nwiz.exe /install File not found
O4 - HKLM..\Run: [SoundMan] SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [VC9Player] C:\Program Files\Virtual CD v9\System\VC9Play.exe (H+H Software GmbH)
O4 - HKLM..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" ()
O4 - HKLM..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [LClock] C:\Program Files\LClock\lclock.exe ()
O4 - HKCU..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe" ()
O4 - HKCU..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (Microsoft Corporation)
O4 - HKCU..\Run: [SYS32DLL] SYS32DLL ()
O4 - HKCU..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2009\MemOptimizer.exe" autostart (TuneUp Software GmbH)
O4 - HKCU..\Run: [VoipBuster] "C:\Program Files\VoipBuster.com\VoipBuster\VoipBuster.exe" -nosplash -minimized (VoipBuster)
O4 - Startup: C:\Documents and Settings\Eppo Clappo\Start Menu\Programs\Startup\Styler.lnk = C:\Documents and Settings\Eppo Clappo\Application Data\Microsoft\Installer\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\_585b207a.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\awtUnkij: DllName - awtUnkij.dll - File not found
O20 - Winlogon\Notify\WBSrv: DllName - C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll - C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll (Stardock Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O28 - HKLM ShellExecuteHooks: {5f754a53-bcc1-4c7b-b3a0-4c77fb31e16c} - C:\WINDOWS\system32\xzamal.dll ()
O30 - LSA: Authentication Packages - (C:\WINDOWS\system32\vtUklIbB) - C:\WINDOWS\system32\vtUklIbB.dll ()
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009-04-16 17:49:46 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - * [2009-05-18 21:09:39 | 00,000,000 | —D | M]
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()

========== Files/Folders - Created Within 30 Days ==========

[2 C:\WINDOWS\System32\*.tmp files]
[21 C:\WINDOWS\*.tmp files]
[2009-05-18 21:03:26 | 00,000,000 | —D | C] – C:\_OTListIt
[2009-05-18 20:59:40 | 00,501,248 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Eppo Clappo\Desktop\OTListIt2.exe
[2009-05-18 20:25:17 | 00,000,000 | —D | C] – C:\Documents and Settings\Eppo Clappo\Desktop\GooredFixBackups
[2009-05-18 20:22:15 | 00,094,208 | —- | C] () – C:\Documents and Settings\Eppo Clappo\Desktop\GooredFix.exe
[2009-05-18 19:50:56 | 00,000,000 | —D | C] – C:\Documents and Settings\Eppo Clappo\Application Data\Uniblue
[2009-05-18 19:50:44 | 00,000,830 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\RegistryBooster.lnk
[2009-05-18 19:50:44 | 00,000,000 | —D | C] – C:\Program Files\Uniblue
[2009-05-18 19:50:25 | 00,000,000 | -H-D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
[2009-05-18 19:49:53 | 01,678,384 | —- | C] (Uniblue Systems ) – C:\Documents and Settings\Eppo Clappo\Desktop\registryboosterplc.exe
[2009-05-18 19:44:32 | 06,841,223 | —- | C] () – C:\Documents and Settings\Eppo Clappo\Desktop\Fedde Le Grand - Scared Of Me (Radio Edit).mp3
[2009-05-18 19:44:09 | 07,355,311 | —- | C] () – C:\Documents and Settings\Eppo Clappo\Desktop\Paul van Dijk - For An Angel (Radio Edit).mp3
[2009-05-18 19:43:49 | 07,560,114 | —- | C] () – C:\Documents and Settings\Eppo Clappo\Desktop\Richard Durand - Always The Sun (Radio Edit).mp3
[2009-05-18 19:40:31 | 00,016,384 | —- | C] () – C:\WINDOWS\System32\SYS32DLL.exe
[2009-05-18 17:13:39 | 00,000,000 | —- | C] () – C:\WINDOWS\st_1242667035.exe
[2009-05-18 17:13:38 | 00,000,000 | —- | C] () – C:\WINDOWS\st_1242673797.exe
[2009-05-18 14:14:25 | 00,000,000 | —D | C] – C:\WINDOWS\System32\790151
[2009-05-18 14:14:14 | 00,000,000 | —- | C] () – C:\WINDOWS\win32.exe
[2009-05-18 14:14:14 | 00,000,000 | —- | C] () – C:\WINDOWS\kernel32.exe
[2009-05-18 14:14:12 | 00,000,000 | —- | C] () – C:\WINDOWS\system32.exe
[2009-05-18 14:13:43 | 00,023,552 | —- | C] () – C:\WINDOWS\System32\yxivhokn.exe
[2009-05-18 06:47:32 | 59,546,100 | —- | C] () – C:\Documents and Settings\Eppo Clappo\Desktop\_What_Digital_Camera_200905_UK_.rar
[2009-05-17 22:51:05 | 91,694,956 | —- | C] () – C:\Documents and Settings\Eppo Clappo\Desktop\PHPAScript.v4.0.rar
[2009-05-17 09:44:00 | 43,019,780 | —- | C] () – C:\Documents and Settings\Eppo Clappo\Desktop\Maxim_2009_06_USA.rar
[2009-05-16 06:51:24 | 05,328,814 | —- | C] () – C:\Documents and Settings\Eppo Clappo\Desktop\01-tinchy_stryder-number_1_feat._n-dubz_(radio_edit).mp3
[2009-05-14 22:26:24 | 00,000,000 | —D | C] – C:\Documents and Settings\Eppo Clappo\My Documents\WebDrive
[2009-05-14 15:09:02 | 01,593,344 | —- | C] (South River Technologies, LLC) – C:\WINDOWS\System32\wdHelper.dll.BAK
[2009-05-14 15:08:22 | 00,000,000 | -H-D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\WebDrive
[2009-05-14 15:08:10 | 00,000,000 | —D | C] – C:\Program Files\WebDrive
[2009-05-14 15:07:44 | 00,000,000 | —D | C] – C:\WINDOWS\Downloaded Installations
[2009-05-12 15:58:28 | 00,000,000 | —D | C] – C:\Program Files\Microsoft Silverlight
[2009-05-11 14:36:15 | 01,668,175 | -HS- | C] () – C:\WINDOWS\System32\twktcscv.ini
[2009-05-11 02:36:44 | 01,668,166 | -HS- | C] () – C:\WINDOWS\System32\plviolcu.ini
[2009-05-10 15:41:12 | 00,000,000 | —D | C] – C:\Documents and Settings\Eppo Clappo\My Documents\My Received Podcasts
[2009-05-10 15:41:12 | 00,000,000 | —D | C] – C:\Documents and Settings\Eppo Clappo\Application Data\iPodder
[2009-05-10 15:40:57 | 00,000,648 | —- | C] () – C:\Documents and Settings\Eppo Clappo\Desktop\Juice.lnk
[2009-05-10 15:40:57 | 00,000,000 | —D | C] – C:\Program Files\Juice
[2009-05-10 14:36:45 | 01,668,175 | -HS- | C] () – C:\WINDOWS\System32\dvuvhftw.ini
[2009-05-10 08:02:47 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\The Humans
[2009-05-10 08:02:05 | 00,001,706 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\The Humans.lnk
[2009-05-10 08:01:51 | 00,507,400 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_1.dll
[2009-05-10 08:01:51 | 00,065,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAPOFX1_0.dll
[2009-05-10 08:01:50 | 00,238,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine3_1.dll
[2009-05-10 08:01:48 | 00,025,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\X3DAudio1_4.dll
[2009-05-10 08:01:47 | 01,491,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_38.dll
[2009-05-10 08:01:47 | 00,467,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_38.dll
[2009-05-10 08:01:45 | 03,850,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DX9_38.dll
[2009-05-10 07:58:33 | 00,000,000 | —D | C] – C:\WINDOWS\System32\DirectX
[2009-05-10 07:58:31 | 00,000,000 | —D | C] – C:\WINDOWS\Logs
[2009-05-10 07:56:29 | 00,000,000 | —D | C] – C:\WINDOWS\System32\URTTEMP
[2009-05-10 07:54:06 | 00,000,000 | —D | C] – C:\Program Files\Deep Silver
[2009-05-10 02:34:14 | 01,668,175 | -HS- | C] () – C:\WINDOWS\System32\nodxufqi.ini
[2009-05-09 19:49:00 | 00,000,000 | —D | C] – C:\Documents and Settings\Eppo Clappo\My Documents\My Logo Design Studio Projects
[2009-05-09 19:49:00 | 00,000,000 | —D | C] – C:\Documents and Settings\Eppo Clappo\Application Data\Summitsoft
[2009-05-09 02:38:25 | 01,668,184 | -HS- | C] () – C:\WINDOWS\System32\nbsulpry.ini
[2009-05-08 02:38:25 | 01,668,175 | -HS- | C] () – C:\WINDOWS\System32\wxlegoob.ini
[2009-05-07 19:10:30 | 00,000,000 | —D | C] – C:\Documents and Settings\Eppo Clappo\Application Data\Little Worlds Online
[2009-05-07 19:10:16 | 00,000,713 | —- | C] () – C:\Documents and Settings\Eppo Clappo\Desktop\Color Cross.lnk
[2009-05-07 19:10:15 | 00,000,000 | —D | C] – C:\Program Files\Color Cross
[2009-05-07 14:35:23 | 01,668,184 | -HS- | C] () – C:\WINDOWS\System32\ulgsyimo.ini
[2009-05-07 14:35:23 | 00,074,752 | —- | C] () – C:\WINDOWS\System32\omiysglu.dll.vzr
[2009-05-07 02:24:10 | 01,668,175 | -HS- | C] () – C:\WINDOWS\System32\obwkowjt.ini
[2009-05-06 06:05:19 | 01,668,153 | -HS- | C] () – C:\WINDOWS\System32\ovtjxlmi.ini
[2009-05-05 05:19:01 | 01,668,153 | -HS- | C] () – C:\WINDOWS\System32\egtnleke.ini
[2009-05-04 13:57:00 | 00,000,000 | —D | C] – C:\Drivers
[2009-05-04 12:51:34 | 01,668,166 | -HS- | C] () – C:\WINDOWS\System32\xaevjdlq.ini
[2009-05-04 00:15:41 | 01,668,175 | -HS- | C] () – C:\WINDOWS\System32\dgwoiodd.ini
[2009-05-03 17:50:21 | 00,125,440 | —- | C] () – C:\WINDOWS\dx7ogl32.dll
[2009-05-03 17:50:19 | 04,171,776 | —- | C] () – C:\WINDOWS\ss100hm.scr
[2009-05-03 17:50:19 | 00,000,000 | —D | C] – C:\Program Files\100 Happy Money 3
[2009-05-03 09:00:49 | 00,000,898 | —- | C] () – C:\Documents and Settings\Eppo Clappo\Desktop\uTorrent Ultra Accelerator.lnk
[2009-05-03 09:00:25 | 00,000,000 | —D | C] – C:\Program Files\uTorrent Ultra Accelerator
[2009-05-02 21:03:54 | 00,163,712 | —- | C] () – C:\WINDOWS\System32\drivers\vidstub.sys
[2009-05-02 20:46:47 | 00,000,804 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Sun xVM VirtualBox.lnk
[2009-05-02 20:46:19 | 00,000,000 | —D | C] – C:\Program Files\Sun
[2009-05-02 19:28:06 | 00,000,759 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Stylizer.lnk
[2009-05-02 19:28:03 | 00,000,000 | —D | C] – C:\Program Files\Skybound Stylizer 4
[2009-05-02 16:27:51 | 00,000,000 | —D | C] – C:\Program Files\WinDjView
[2009-05-02 13:21:06 | 01,668,153 | -HS- | C] () – C:\WINDOWS\System32\opqbphku.ini
[2009-05-01 19:43:51 | 00,015,688 | —- | C] () – C:\WINDOWS\System32\lsdelete.exe
[2009-05-01 19:34:47 | 00,000,472 | —- | C] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2009-05-01 19:34:42 | 00,064,160 | —- | C] (Lavasoft AB) – C:\WINDOWS\System32\drivers\Lbd.sys
[2009-05-01 19:34:41 | 00,000,000 | —D | C] – C:\WINDOWS\System32\DRVSTORE
[2009-05-01 19:32:49 | 00,000,000 | -H-D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
[2009-05-01 19:32:44 | 00,000,877 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Ad-Aware.lnk
[2009-05-01 19:32:39 | 00,000,000 | —D | C] – C:\Program Files\Lavasoft
[2009-05-01 19:32:39 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
[2009-04-30 16:44:10 | 19,014,048 | —- | C] () – C:\Documents and Settings\Eppo Clappo\Desktop\CloudAntivirus.exe
[2009-04-30 06:13:38 | 01,669,907 | -HS- | C] () – C:\WINDOWS\System32\gnyqbnau.ini
[2009-04-29 06:12:20 | 01,669,898 | -HS- | C] () – C:\WINDOWS\System32\yxlsgnue.ini
[2009-04-28 05:50:29 | 01,663,355 | -HS- | C] () – C:\WINDOWS\System32\qyemkdpp.ini
[2009-04-27 20:43:09 | 00,304,957 | —- | C] () – C:\Documents and Settings\Eppo Clappo\Desktop\hjsplit.zip
[2009-04-27 19:31:15 | 00,000,740 | —- | C] () – C:\Documents and Settings\Eppo Clappo\Desktop\Eusing Free Registry Cleaner.lnk
[2009-04-27 19:31:09 | 00,000,000 | —D | C] – C:\Program Files\Eusing Free Registry Cleaner
[2009-04-27 13:11:23 | 01,642,587 | -HS- | C] () – C:\WINDOWS\System32\tmhheavl.ini
[2009-04-27 07:36:48 | 00,000,000 | —D | C] – C:\WINDOWS\System32\appmgmt
[2009-04-26 20:07:51 | 00,099,328 | —- | C] () – C:\WINDOWS\System32\xzamal.dll
[2009-04-26 20:07:48 | 00,099,328 | —- | C] () – C:\WINDOWS\System32\oqksvroo.dll
[2009-04-26 20:07:46 | 01,642,587 | -HS- | C] () – C:\WINDOWS\System32\qvfrjolk.ini
[2009-04-26 18:11:20 | 00,000,738 | —- | C] () – C:\Documents and Settings\Eppo Clappo\Desktop\Ballance.lnk
[2009-04-26 18:11:16 | 00,000,000 | —D | C] – C:\Program Files\Ballance
[2009-04-26 14:21:54 | 00,011,392 | —- | C] (H+H Software GmbH) – C:\WINDOWS\System32\drivers\HH9Help.sys
[2009-04-26 14:21:53 | 00,113,688 | —- | C] (H+H Software GmbH) – C:\WINDOWS\System32\drivers\vdrv9000.sys
[2009-04-26 14:21:31 | 00,000,000 | –SD | C] – C:\Documents and Settings\All Users.WINDOWS\Documents\Virtual CDs
[2009-04-26 14:21:02 | 00,000,000 | –SD | C] – C:\Documents and Settings\Eppo Clappo\My Documents\Virtual CD v9
[2009-04-26 14:21:01 | 00,000,000 | –SD | C] – C:\Documents and Settings\All Users.WINDOWS\Documents\Virtual CD v9
[2009-04-26 14:21:00 | 01,097,728 | —- | C] (NuMedia Soft, Inc.) – C:\WINDOWS\System32\NMSDVDX.dll
[2009-04-26 14:20:51 | 01,843,200 | —- | C] (NCT Company Ltd.) – C:\WINDOWS\System32\NCTAudioFile2.dll
[2009-04-26 14:20:51 | 00,315,392 | —- | C] (NCT Company Ltd.) – C:\WINDOWS\System32\NCTAudioPlayer2.dll
[2009-04-26 14:20:50 | 01,044,480 | —- | C] (eHelp Corporation.) – C:\WINDOWS\System32\ROBOEX32.DLL
[2009-04-26 14:20:29 | 00,000,000 | —D | C] – C:\Program Files\Virtual CD v9
[2009-04-26 14:19:12 | 00,000,000 | —D | C] – C:\Documents and Settings\Eppo Clappo\Application Data\InstallShield
[2009-04-26 14:05:38 | 00,000,594 | —- | C] () – C:\WINDOWS\System32\PTxSCP.lic
[2009-04-26 13:08:00 | 00,000,000 | —D | C] – C:\!kk
[2009-04-26 12:32:03 | 00,000,000 | —D | C] – C:\radio-items-mp3
[2009-04-26 11:48:43 | 00,000,000 | —D | C] – C:\Documents and Settings\Eppo Clappo\My Documents\FFOutput
[2009-04-26 11:48:08 | 00,000,000 | —D | C] – C:\Program Files\FormatFactory
[2009-04-26 11:35:41 | 00,000,000 | —D | C] – C:\Documents and Settings\Eppo Clappo\Application Data\BinarySense
[2009-04-26 11:35:25 | 00,000,000 | —D | C] – C:\Program Files\Common Files\BinarySense
[2009-04-26 10:32:57 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\PassMark
[2009-04-26 10:32:43 | 00,000,000 | —D | C] – C:\Program Files\WirelessMon
[2009-04-26 08:11:23 | 01,642,596 | -HS- | C] () – C:\WINDOWS\System32\xpnryynn.ini
[2009-04-26 08:08:02 | 00,099,328 | —- | C] () – C:\WINDOWS\System32\tmecnl.dll
[2009-04-26 08:08:01 | 00,099,328 | —- | C] () – C:\WINDOWS\System32\uxsaamsf.dll
[2009-04-25 06:12:25 | 01,642,587 | -HS- | C] () – C:\WINDOWS\System32\ksrafqux.ini
[2009-04-24 06:28:31 | 01,642,299 | -HS- | C] () – C:\WINDOWS\System32\olerayad.ini
[2009-04-23 19:12:23 | 00,010,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\hh.exe
[2009-04-23 19:12:21 | 00,124,688 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MSWINSCK.OCX
[2009-04-23 19:12:06 | 03,063,808 | —- | C] (Aladdin Knowledge Systems.) – C:\WINDOWS\System32\hinstall.exe
[2009-04-23 19:12:06 | 00,331,776 | —- | C] (Aladdin Knowledge Systems) – C:\WINDOWS\System32\haspvb32.dll
[2009-04-23 19:12:06 | 00,062,464 | —- | C] () – C:\WINDOWS\System32\MMRegOCX.EXE
[2009-04-23 19:12:06 | 00,000,315 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Jazler TV.lnk
[2009-04-23 19:12:05 | 00,000,000 | —D | C] – C:\Jazler TV
[2009-04-23 17:39:40 | 00,000,000 | —D | C] – C:\Jazler Radio 2 Logs
[2009-04-23 17:39:39 | 00,000,000 | —D | C] – C:\Jazler Backups
[2009-04-23 17:39:07 | 00,083,456 | —- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) – C:\WINDOWS\System32\L3CODECX.AX.BAK
[2009-04-23 17:38:35 | 00,000,000 | —- | C] () – C:\WINDOWS\TempFile
[2009-04-23 17:38:34 | 00,685,056 | —- | C] (Aladdin Knowledge Systems Ltd.) – C:\WINDOWS\System32\drivers\hardlock.sys
[2009-04-23 17:38:16 | 00,006,656 | —- | C] (Aladdin Knowledge Systems.) – C:\WINDOWS\System32\haspvdd.dll
[2009-04-23 17:38:16 | 00,000,383 | —- | C] () – C:\WINDOWS\System32\haspdos.sys
[2009-04-23 17:38:15 | 00,047,616 | —- | C] (Aladdin Knowledge Systems) – C:\WINDOWS\System32\drivers\Haspnt.sys
[2009-04-23 17:38:15 | 00,002,577 | —- | C] () – C:\WINDOWS\System32\config.hsp
[2009-04-23 17:34:32 | 00,415,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msrepl35.dll
[2009-04-23 17:34:32 | 00,368,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\VBAR332.DLL
[2009-04-23 17:34:32 | 00,344,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msexch35.dll
[2009-04-23 17:34:32 | 00,170,865 | —- | C] () – C:\WINDOWS\System32\Odbcjet.hlp
[2009-04-23 17:34:32 | 00,089,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\VB5DB.DLL
[2009-04-23 17:34:32 | 00,044,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msrpfs35.dll
[2009-04-23 17:34:32 | 00,006,902 | —- | C] () – C:\WINDOWS\System32\Odbcjet.cnt
[2009-04-23 17:34:31 | 01,238,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msjt4jlt.dll
[2009-04-23 17:34:31 | 01,050,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msjet35.dll
[2009-04-23 17:34:31 | 00,294,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msxbse35.dll
[2009-04-23 17:34:31 | 00,262,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msrd2x35.dll
[2009-04-23 17:34:31 | 00,252,688 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msexcl35.dll
[2009-04-23 17:34:31 | 00,250,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mspdox35.dll
[2009-04-23 17:34:31 | 00,168,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msltus35.dll
[2009-04-23 17:34:31 | 00,166,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mstext35.dll
[2009-04-23 17:34:31 | 00,039,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\JETCOMP.exe
[2009-04-23 17:34:31 | 00,024,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msjter35.dll
[2009-04-23 17:34:30 | 00,123,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msjint35.dll
[2009-04-23 17:34:29 | 00,457,257 | —- | C] (Janus Systems SA de CV) – C:\WINDOWS\System32\GRIDEX20.OCX
[2009-04-23 17:34:28 | 00,131,072 | —- | C] (xFX JumpStart) – C:\WINDOWS\System32\EQPro.ocx
[2009-04-23 17:34:28 | 00,011,776 | —- | C] (VBSmart) – C:\WINDOWS\System32\SmartSubClass.dll
[2009-04-23 17:34:27 | 00,260,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MSFLXGRD.OCX
[2009-04-23 17:34:27 | 00,224,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\TABCTL32.OCX
[2009-04-23 17:34:27 | 00,212,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\RICHTX32.OCX
[2009-04-23 17:34:27 | 00,143,360 | —- | C] (AudioEnhance) – C:\WINDOWS\System32\AEnhanceAUDIO.dll
[2009-04-23 17:34:27 | 00,131,072 | —- | C] (GDCL (www.gdcl.co.uk)) – C:\WINDOWS\System32\FSFWrap.dll
[2009-04-23 17:34:27 | 00,119,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MSSTDFMT.DLL
[2009-04-23 17:34:27 | 00,090,112 | —- | C] (http://www.mvps.org/vb) – C:\WINDOWS\System32\ccrpTmr6.dll
[2009-04-23 17:34:27 | 00,065,536 | —- | C] (xFX JumpStart) – C:\WINDOWS\System32\xFXSlider.ocx
[2009-04-23 17:34:27 | 00,024,576 | —- | C] (AudioEnhance) – C:\WINDOWS\System32\StreamSensor.dll
[2009-04-23 17:34:26 | 00,322,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MSDBRPTR.DLL
[2009-04-23 17:34:26 | 00,103,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MSCOMM32.OCX
[2009-04-23 17:34:25 | 01,081,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MSCOMCTL.OCX
[2009-04-23 17:34:25 | 00,662,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MSCOMCT2.OCX
[2009-04-23 17:34:24 | 00,949,248 | —- | C] (SwiftSoft) – C:\WINDOWS\System32\MMAudioX2.OCX
[2009-04-23 17:34:24 | 00,428,032 | —- | C] (SwiftSoft) – C:\WINDOWS\System32\MMTypesX2.OCX
[2009-04-23 17:34:24 | 00,282,624 | —- | C] (Janus Systems SA de CV) – C:\WINDOWS\System32\JSBBar16.ocx
[2009-04-23 17:34:24 | 00,184,320 | —- | C] (Audiopimp.com, IRC Inc. ) – C:\WINDOWS\System32\ID3Edit.dll
[2009-04-23 17:34:24 | 00,078,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MSBIND.DLL
[2009-04-23 17:34:24 | 00,045,056 | —- | C] (AMFMedia) – C:\WINDOWS\System32\JazlerMonitor.ocx
[2009-04-23 17:34:24 | 00,036,864 | —- | C] (AMFMedia) – C:\WINDOWS\System32\JazlerSlider.ocx
[2009-04-23 17:34:20 | 00,610,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\Comctl32.ocx
[2009-04-23 17:34:20 | 00,164,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\COMCT232.OCX
[2009-04-23 17:34:20 | 00,152,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\COMDLG32.OCX
[2009-04-23 17:34:20 | 00,136,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MSDERUN.DLL
[2009-04-23 17:34:20 | 00,069,632 | —- | C] (AXSoft Software) – C:\WINDOWS\System32\AXSDINFO.OCX
[2009-04-23 06:11:43 | 00,000,121 | -HS- | C] () – C:\WINDOWS\System32\gywkuhpp.ini
[2009-04-22 21:15:36 | 00,000,000 | —D | C] – C:\Documents and Settings\Eppo Clappo\Application Data\IrfanView
[2009-04-22 06:48:19 | 01,644,416 | -HS- | C] () – C:\WINDOWS\System32\qshxcyph.ini
[2009-04-21 18:58:06 | 00,063,833 | —- | C] () – C:\Documents and Settings\Eppo Clappo\Desktop\BlueScreen.zip
[2009-04-21 06:55:03 | 00,000,000 | —D | C] – C:\temp-upload
[2009-04-20 18:45:59 | 00,000,676 | —- | C] () – C:\Documents and Settings\Eppo Clappo\Desktop\Alt.Binz.lnk
[2009-04-20 18:45:58 | 00,000,000 | —D | C] – C:\Program Files\AltBinz
[2009-04-20 15:02:57 | 00,000,000 | —D | C] – C:\Documents and Settings\Eppo Clappo\My Documents\Downloads
[2009-04-20 13:01:37 | 01,555,386 | -HS- | C] () – C:\WINDOWS\System32\sanksdns.ini
[2009-04-19 21:16:51 | 00,048,640 | —- | C] (Alpine Snow) – C:\Documents and Settings\Eppo Clappo\Application Data\WKey.exe
[2009-04-19 20:53:05 | 00,332,800 | R— | C] (Ralink Technology Corp.) – C:\WINDOWS\System32\drivers\netr28u.sys
[2009-04-19 20:27:47 | 00,000,042 | —- | C] () – C:\WINDOWS\System32\DriverChecker.lie
[2009-04-19 20:27:05 | 00,000,685 | —- | C] () – C:\Documents and Settings\Eppo Clappo\Desktop\Driver Checker.lnk
[2009-04-19 20:27:04 | 00,081,408 | —- | C] (Windows ® Codename Longhorn DDK provider) – C:\WINDOWS\System32\devcon_x64.exe
[2009-04-19 20:27:04 | 00,055,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\devcon.exe
[2009-04-19 20:27:03 | 00,000,000 | —D | C] – C:\Program Files\Driver Checker
[2009-04-19 18:33:37 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Adobe
[2009-04-19 18:00:44 | 00,000,000 | —D | C] – C:\Documents and Settings\Eppo Clappo\Application Data\ContentGuard
[2009-04-19 18:00:05 | 00,000,698 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Zinio Reader.lnk
[2009-04-19 18:00:05 | 00,000,687 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\My Zinio Library.lnk
[2009-04-19 18:00:02 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Zinio
[2009-04-19 17:59:57 | 00,000,000 | —D | C] – C:\Program Files\Zinio
[2009-04-19 17:45:56 | 00,000,000 | —D | C] – C:\Documents and Settings\Eppo Clappo\Local Settings\Apps
[2009-04-19 17:41:52 | 00,000,000 | –SD | C] – C:\Documents and Settings\Eppo Clappo\My Documents\My Zinio Library
[2009-04-19 16:24:54 | 00,000,000 | —D | C] – C:\xxx-promos
[2009-04-19 16:02:35 | 00,000,000 | —D | C] – C:\!factuur-temp
[2009-04-19 16:01:04 | 00,000,000 | —D | C] – C:\Tekstblokken
[2009-04-19 15:13:34 | 00,603,904 | —- | C] (TuneUp Software) – C:\WINDOWS\System32\TUProgSt.exe
[2009-04-19 15:13:29 | 00,027,904 | —- | C] (TuneUp Software) – C:\WINDOWS\System32\uxtuneup.dll
[2009-04-19 15:13:29 | 00,000,498 | —- | C] () – C:\WINDOWS\tasks\1-Click Maintenance.job
[2009-04-19 15:13:26 | 00,362,240 | —- | C] (TuneUp Software) – C:\WINDOWS\System32\TuneUpDefragService.exe
[2009-04-19 15:13:23 | 00,000,000 | —D | C] – C:\Documents and Settings\Eppo Clappo\Application Data\TuneUp Software
[2009-04-19 15:13:01 | 00,001,617 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\TuneUp 1-Click Maintenance.lnk
[2009-04-19 15:13:00 | 00,001,545 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\TuneUp Utilities 2009.lnk
[2009-04-19 15:12:47 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\TuneUp Software
[2009-04-19 15:12:46 | 00,000,000 | —D | C] – C:\Program Files\TuneUp Utilities 2009
[2009-04-19 15:12:25 | 00,000,000 | -HSD | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
[2009-04-19 14:41:59 | 00,000,127 | —- | C] () – C:\WINDOWS\System32\msexcr.ini
[2009-04-19 13:46:32 | 00,767,328 | —- | C] (Kings Information & Network) – C:\WINDOWS\System32\kdfinj.dll
[2009-04-19 13:46:30 | 00,131,072 | —- | C] (AhnLab, Inc.) – C:\WINDOWS\System32\drivers\Mkd2kfNT.sys
[2009-04-19 13:46:30 | 00,079,104 | —- | C] (AhnLab, Inc.) – C:\WINDOWS\System32\drivers\Mkd2Nadr.sys
[2009-04-19 13:44:57 | 00,000,000 | —D | C] – C:\Program Files\AhnLab
[2009-04-19 12:10:46 | 00,000,000 | —D | C] – C:\Documents and Settings\Eppo Clappo\Application Data\SpinTop Games
[2009-04-19 12:10:31 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
[2009-04-19 12:10:05 | 00,001,111 | —- | C] () – C:\Documents and Settings\Eppo Clappo\Desktop\Amazing Adventures Bundle.lnk
[2009-04-19 12:09:42 | 00,000,000 | —D | C] – C:\Program Files\SNATCHDATA
[2009-04-19 12:03:42 | 01,555,377 | -HS- | C] () – C:\WINDOWS\System32\nytnjffa.ini
[2009-04-19 12:03:12 | 00,054,082 | -HS- | C] () – C:\WINDOWS\System32\BbIlkUtv.ini2
[2009-04-19 12:03:12 | 00,054,082 | -HS- | C] () – C:\WINDOWS\System32\BbIlkUtv.ini
[2009-04-19 12:03:09 | 00,237,056 | —- | C] () – C:\WINDOWS\System32\vtUklIbB.dll
[2009-04-19 11:58:12 | 00,000,000 | —D | C] – C:\GreetSoft
[2009-04-19 11:49:17 | 00,001,950 | —- | C] () – C:\Documents and Settings\Eppo Clappo\Desktop\MapleStory Europe.lnk
[2009-04-19 11:47:48 | 00,000,000 | —D | C] – C:\Program Files\NEXON
[2009-04-19 10:33:17 | 00,004,096 | —- | C] () – C:\WINDOWS\d3dx.dat
[2009-04-19 10:32:53 | 00,000,654 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Turtix.lnk
[2009-04-19 10:32:33 | 00,000,000 | —D | C] – C:\Program Files\Turtix
[2009-04-19 09:23:03 | 00,000,000 | —D | C] – C:\Documents and Settings\Eppo Clappo\Application Data\OpenOffice.org
[2009-04-19 09:01:00 | 00,000,000 | —D | C] – C:\Program Files\IrfanView
[2009-04-19 08:05:05 | 00,000,000 | —D | C] – C:\download
[2009-04-19 08:04:41 | 00,000,000 | —D | C] – C:\Nexon
[2009-04-19 08:04:40 | 00,421,888 | —- | C] (NEXON Inc.) – C:\WINDOWS\NEXON_EU_DownloaderUpdater.exe
[2009-04-17 14:18:57 | 00,000,000 | —- | C] () – C:\WINDOWS\WB.ini
[2009-04-16 18:18:57 | 00,157,184 | R— | C] () – C:\WINDOWS\System32\RtlCPAPI.dll
[2009-04-16 18:18:49 | 00,000,164 | R— | C] () – C:\WINDOWS\avrack.ini
[2009-04-16 18:17:29 | 00,003,964 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2009-04-16 18:17:26 | 00,005,824 | —- | C] () – C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2009-04-16 17:52:53 | 00,000,096 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2009-04-16 17:52:24 | 00,164,352 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2008-05-18 13:01:22 | 00,058,792 | —- | C] () – C:\WINDOWS\System32\wbload.dll
[2008-04-14 14:00:00 | 00,676,224 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.DLL
[2008-04-14 14:00:00 | 00,000,507 | —- | C] () – C:\WINDOWS\win.ini
[2008-04-14 14:00:00 | 00,000,231 | —- | C] () – C:\WINDOWS\system.ini
[2005-10-10 15:49:00 | 01,662,976 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2005-10-10 15:49:00 | 01,466,368 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2005-10-10 15:49:00 | 01,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2005-10-10 15:49:00 | 00,573,440 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[2005-10-10 15:49:00 | 00,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2005-10-10 15:49:00 | 00,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2005-10-10 15:49:00 | 00,045,056 | —- | C] () – C:\WINDOWS\System32\nvapi.dll

========== Files - Modified Within 30 Days ==========

[2 C:\WINDOWS\System32\*.tmp files]
[21 C:\WINDOWS\*.tmp files]
[2009-05-18 21:13:15 | 00,054,082 | -HS- | M] () – C:\WINDOWS\System32\BbIlkUtv.ini
[2009-05-18 21:12:31 | 00,004,212 | -H– | M] () – C:\WINDOWS\System32\zllictbl.dat
[2009-05-18 21:11:06 | 00,054,082 | -HS- | M] () – C:\WINDOWS\System32\BbIlkUtv.ini2
[2009-05-18 21:10:02 | 00,002,257 | —- | M] () – C:\Documents and Settings\Eppo Clappo\Start Menu\Programs\Startup\Styler.lnk
[2009-05-18 21:09:45 | 00,039,291 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2009-05-18 21:08:57 | 00,351,218 | —- | M] () – C:\WINDOWS\System32\vsconfig.xml
[2009-05-18 21:08:39 | 00,000,000 | —- | M] () – C:\WINDOWS\TempFile
[2009-05-18 21:08:37 | 00,000,498 | —- | M] () – C:\WINDOWS\tasks\1-Click Maintenance.job
[2009-05-18 21:08:33 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009-05-18 21:08:00 | 00,000,062 | -HS- | M] () – C:\Documents and Settings\Eppo Clappo\Local Settings\desktop.ini
[2009-05-18 21:07:50 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009-05-18 20:59:43 | 00,501,248 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Eppo Clappo\Desktop\OTListIt2.exe
[2009-05-18 20:22:15 | 00,094,208 | —- | M] () – C:\Documents and Settings\Eppo Clappo\Desktop\GooredFix.exe
[2009-05-18 19:50:44 | 00,000,830 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\RegistryBooster.lnk
[2009-05-18 19:50:05 | 01,678,384 | —- | M] (Uniblue Systems ) – C:\Documents and Settings\Eppo Clappo\Desktop\registryboosterplc.exe
[2009-05-18 19:45:32 | 00,001,581 | —- | M] () – C:\rollback.ini
[2009-05-18 19:44:45 | 06,841,223 | —- | M] () – C:\Documents and Settings\Eppo Clappo\Desktop\Fedde Le Grand - Scared Of Me (Radio Edit).mp3
[2009-05-18 19:44:24 | 07,355,311 | —- | M] () – C:\Documents and Settings\Eppo Clappo\Desktop\Paul van Dijk - For An Angel (Radio Edit).mp3
[2009-05-18 19:44:03 | 07,560,114 | —- | M] () – C:\Documents and Settings\Eppo Clappo\Desktop\Richard Durand - Always The Sun (Radio Edit).mp3
[2009-05-18 19:40:26 | 00,016,384 | —- | M] () – C:\WINDOWS\System32\SYS32DLL.exe
[2009-05-18 19:38:44 | 00,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2009-05-18 17:13:39 | 00,000,000 | —- | M] () – C:\WINDOWS\st_1242667035.exe
[2009-05-18 17:13:38 | 00,000,000 | —- | M] () – C:\WINDOWS\st_1242673797.exe
[2009-05-18 14:57:06 | 91,058,720 | -HS- | M] () – C:\WINDOWS\System32\drivers\fidbox.dat
[2009-05-18 14:57:06 | 01,224,788 | -HS- | M] () – C:\WINDOWS\System32\drivers\fidbox.idx
[2009-05-18 14:14:14 | 00,000,000 | —- | M] () – C:\WINDOWS\win32.exe
[2009-05-18 14:14:14 | 00,000,000 | —- | M] () – C:\WINDOWS\kernel32.exe
[2009-05-18 14:14:12 | 00,000,000 | —- | M] () – C:\WINDOWS\system32.exe
[2009-05-18 14:13:43 | 00,023,552 | —- | M] () – C:\WINDOWS\System32\yxivhokn.exe
[2009-05-18 13:24:34 | 00,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009-05-18 06:53:34 | 59,546,100 | —- | M] () – C:\Documents and Settings\Eppo Clappo\Desktop\_What_Digital_Camera_200905_UK_.rar
[2009-05-17 23:08:57 | 91,694,956 | —- | M] () – C:\Documents and Settings\Eppo Clappo\Desktop\PHPAScript.v4.0.rar
[2009-05-17 09:46:53 | 43,019,780 | —- | M] () – C:\Documents and Settings\Eppo Clappo\Desktop\Maxim_2009_06_USA.rar
[2009-05-14 15:09:03 | 01,593,344 | —- | M] (South River Technologies, LLC) – C:\WINDOWS\System32\wdHelper.dll
[2009-05-12 06:14:46 | 01,668,175 | -HS- | M] () – C:\WINDOWS\System32\twktcscv.ini
[2009-05-11 02:58:08 | 01,668,166 | -HS- | M] () – C:\WINDOWS\System32\plviolcu.ini
[2009-05-10 22:34:56 | 01,668,175 | -HS- | M] () – C:\WINDOWS\System32\dvuvhftw.ini
[2009-05-10 15:40:59 | 00,000,648 | —- | M] () – C:\Documents and Settings\Eppo Clappo\Desktop\Juice.lnk
[2009-05-10 08:09:19 | 01,668,175 | -HS- | M] () – C:\WINDOWS\System32\nodxufqi.ini
[2009-05-10 08:02:05 | 00,001,706 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\The Humans.lnk
[2009-05-10 07:57:27 | 00,510,888 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2009-05-10 07:57:27 | 00,441,514 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2009-05-10 07:57:27 | 00,071,454 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2009-05-10 07:32:23 | 00,000,740 | —- | M] () – C:\Documents and Settings\Eppo Clappo\Desktop\Eusing Free Registry Cleaner.lnk
[2009-05-09 06:38:41 | 01,668,184 | -HS- | M] () – C:\WINDOWS\System32\nbsulpry.ini
[2009-05-08 17:22:51 | 01,668,175 | -HS- | M] () – C:\WINDOWS\System32\wxlegoob.ini
[2009-05-07 19:10:16 | 00,000,713 | —- | M] () – C:\Documents and Settings\Eppo Clappo\Desktop\Color Cross.lnk
[2009-05-07 18:40:39 | 01,668,184 | -HS- | M] () – C:\WINDOWS\System32\ulgsyimo.ini
[2009-05-07 14:35:23 | 00,074,752 | —- | M] () – C:\WINDOWS\System32\omiysglu.dll.vzr
[2009-05-07 06:45:04 | 01,668,175 | -HS- | M] () – C:\WINDOWS\System32\obwkowjt.ini
[2009-05-06 06:26:40 | 01,668,153 | -HS- | M] () – C:\WINDOWS\System32\ovtjxlmi.ini
[2009-05-05 05:40:12 | 01,668,153 | -HS- | M] () – C:\WINDOWS\System32\egtnleke.ini
[2009-05-04 13:12:57 | 01,668,166 | -HS- | M] () – C:\WINDOWS\System32\xaevjdlq.ini
[2009-05-04 12:51:01 | 00,000,007 | —- | M] () – C:\WINDOWS\System32\ANIWZCSUSERNAME
[2009-05-04 06:27:32 | 01,668,175 | -HS- | M] () – C:\WINDOWS\System32\dgwoiodd.ini
[2009-05-03 09:00:50 | 00,000,898 | —- | M] () – C:\Documents and Settings\Eppo Clappo\Desktop\uTorrent Ultra Accelerator.lnk
[2009-05-02 21:20:05 | 00,163,712 | —- | M] () – C:\WINDOWS\System32\drivers\vidstub.sys
[2009-05-02 20:48:54 | 00,003,284 | —- | M] () – C:\WINDOWS\System32\ANIWZCS{FD44C8BF-F5B1-4892-A059-D1A5ACFFC3DB}
[2009-05-02 20:48:47 | 00,000,012 | —- | M] () – C:\WINDOWS\System32\ANIWZCSUSERNAME{FD44C8BF-F5B1-4892-A059-D1A5ACFFC3DB}
[2009-05-02 20:46:47 | 00,000,804 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Sun xVM VirtualBox.lnk
[2009-05-02 19:28:06 | 00,000,759 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Stylizer.lnk
[2009-05-02 13:42:27 | 01,668,153 | -HS- | M] () – C:\WINDOWS\System32\opqbphku.ini
[2009-05-01 19:34:26 | 00,015,688 | —- | M] () – C:\WINDOWS\System32\lsdelete.exe
[2009-05-01 19:34:16 | 00,064,160 | —- | M] (Lavasoft AB) – C:\WINDOWS\System32\drivers\Lbd.sys
[2009-05-01 19:32:45 | 00,000,877 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Ad-Aware.lnk
[2009-04-30 18:25:52 | 01,669,907 | -HS- | M] () – C:\WINDOWS\System32\gnyqbnau.ini
[2009-04-30 16:44:51 | 19,014,048 | —- | M] () – C:\Documents and Settings\Eppo Clappo\Desktop\CloudAntivirus.exe
[2009-04-30 06:13:14 | 01,669,898 | -HS- | M] () – C:\WINDOWS\System32\yxlsgnue.ini
[2009-04-29 06:09:59 | 01,663,355 | -HS- | M] () – C:\WINDOWS\System32\qyemkdpp.ini
[2009-04-27 20:43:24 | 00,304,957 | —- | M] () – C:\Documents and Settings\Eppo Clappo\Desktop\hjsplit.zip
[2009-04-27 13:32:46 | 01,642,587 | -HS- | M] () – C:\WINDOWS\System32\tmhheavl.ini
[2009-04-26 20:29:18 | 01,642,587 | -HS- | M] () – C:\WINDOWS\System32\qvfrjolk.ini
[2009-04-26 20:07:48 | 00,099,328 | —- | M] () – C:\WINDOWS\System32\xzamal.dll
[2009-04-26 20:07:48 | 00,099,328 | —- | M] () – C:\WINDOWS\System32\oqksvroo.dll
[2009-04-26 18:23:13 | 00,000,127 | —- | M] () – C:\WINDOWS\System32\msexcr.ini
[2009-04-26 18:11:20 | 00,000,738 | —- | M] () – C:\Documents and Settings\Eppo Clappo\Desktop\Ballance.lnk
[2009-04-26 14:53:00 | 01,642,596 | -HS- | M] () – C:\WINDOWS\System32\xpnryynn.ini
[2009-04-26 08:11:23 | 01,642,587 | -HS- | M] () – C:\WINDOWS\System32\ksrafqux.ini
[2009-04-26 08:08:01 | 00,099,328 | —- | M] () – C:\WINDOWS\System32\uxsaamsf.dll
[2009-04-26 08:08:01 | 00,099,328 | —- | M] () – C:\WINDOWS\System32\tmecnl.dll
[2009-04-24 06:49:42 | 01,642,299 | -HS- | M] () – C:\WINDOWS\System32\olerayad.ini
[2009-04-23 19:12:06 | 00,000,315 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Jazler TV.lnk
[2009-04-23 18:17:36 | 01,644,416 | -HS- | M] () – C:\WINDOWS\System32\qshxcyph.ini
[2009-04-23 17:38:16 | 00,006,656 | —- | M] (Aladdin Knowledge Systems.) – C:\WINDOWS\System32\haspvdd.dll
[2009-04-23 17:38:16 | 00,000,383 | —- | M] () – C:\WINDOWS\System32\haspdos.sys
[2009-04-23 17:38:15 | 00,047,616 | —- | M] (Aladdin Knowledge Systems) – C:\WINDOWS\System32\drivers\Haspnt.sys
[2009-04-23 17:38:15 | 00,002,620 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2009-04-23 06:11:43 | 00,000,121 | -HS- | M] () – C:\WINDOWS\System32\gywkuhpp.ini
[2009-04-22 03:08:38 | 05,328,814 | —- | M] () – C:\Documents and Settings\Eppo Clappo\Desktop\01-tinchy_stryder-number_1_feat._n-dubz_(radio_edit).mp3
[2009-04-21 18:58:07 | 00,063,833 | —- | M] () – C:\Documents and Settings\Eppo Clappo\Desktop\BlueScreen.zip
[2009-04-20 19:41:42 | 01,555,386 | -HS- | M] () – C:\WINDOWS\System32\sanksdns.ini
[2009-04-20 18:45:59 | 00,000,676 | —- | M] () – C:\Documents and Settings\Eppo Clappo\Desktop\Alt.Binz.lnk
[2009-04-20 12:59:40 | 01,555,377 | -HS- | M] () – C:\WINDOWS\System32\nytnjffa.ini
[2009-04-19 21:31:56 | 00,048,640 | —- | M] (Alpine Snow) – C:\Documents and Settings\Eppo Clappo\Application Data\WKey.exe
[2009-04-19 20:46:34 | 00,003,964 | —- | M] () – C:\WINDOWS\Ascd_tmp.ini
[2009-04-19 20:27:48 | 00,000,042 | —- | M] () – C:\WINDOWS\System32\DriverChecker.lie
[2009-04-19 20:27:05 | 00,000,685 | —- | M] () – C:\Documents and Settings\Eppo Clappo\Desktop\Driver Checker.lnk
[2009-04-19 18:00:05 | 00,000,698 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Zinio Reader.lnk
[2009-04-19 18:00:05 | 00,000,687 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\My Zinio Library.lnk
[2009-04-19 15:13:34 | 00,603,904 | —- | M] (TuneUp Software) – C:\WINDOWS\System32\TUProgSt.exe
[2009-04-19 15:13:27 | 00,362,240 | —- | M] (TuneUp Software) – C:\WINDOWS\System32\TuneUpDefragService.exe
[2009-04-19 15:13:01 | 00,001,617 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\TuneUp 1-Click Maintenance.lnk
[2009-04-19 15:13:00 | 00,001,545 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\TuneUp Utilities 2009.lnk
[2009-04-19 13:46:32 | 00,767,328 | —- | M] (Kings Information & Network) – C:\WINDOWS\System32\kdfinj.dll
[2009-04-19 12:10:05 | 00,001,111 | —- | M] () – C:\Documents and Settings\Eppo Clappo\Desktop\Amazing Adventures Bundle.lnk
[2009-04-19 12:03:11 | 00,237,056 | —- | M] () – C:\WINDOWS\System32\vtUklIbB.dll
[2009-04-19 11:49:17 | 00,001,950 | —- | M] () – C:\Documents and Settings\Eppo Clappo\Desktop\MapleStory Europe.lnk
[2009-04-19 10:33:17 | 00,004,096 | —- | M] () – C:\WINDOWS\d3dx.dat
[2009-04-19 10:32:53 | 00,000,654 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Turtix.lnk
[2009-04-19 08:04:40 | 00,421,888 | —- | M] (NEXON Inc.) – C:\WINDOWS\NEXON_EU_DownloaderUpdater.exe

========== LOP Check ==========

[2009-05-18 19:50:25 | 00,000,000 | RH-D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data
[2009-04-19 15:12:25 | 00,000,000 | -HSD | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
[2009-05-01 19:32:50 | 00,000,000 | -H-D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
[2009-05-18 19:50:46 | 00,000,000 | -H-D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
[2009-05-01 19:34:35 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
[2009-04-18 06:24:58 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\MailFrontier
[2009-04-16 17:49:40 | 00,000,000 | –SD | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft
[2009-04-16 17:59:10 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft Help
[2009-04-26 10:32:57 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\PassMark
[2009-05-17 13:15:11 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
[2009-05-10 08:02:47 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\The Humans
[2009-04-19 15:12:47 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\TuneUp Software
[2009-05-14 15:10:01 | 00,000,000 | -H-D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\WebDrive
[2009-05-18 19:50:56 | 00,000,000 | RH-D | M] – C:\Documents and Settings\Eppo Clappo\Application Data
[2009-04-16 20:12:09 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\Adobe
[2009-04-26 11:35:41 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\BinarySense
[2009-05-13 20:41:10 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\ContentGuard
[2009-04-16 17:52:39 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\Desktopicon
[2009-04-16 20:44:16 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\Foxit
[2009-04-16 17:57:00 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\Identities
[2009-04-26 14:19:12 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\InstallShield
[2009-05-10 15:41:12 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\iPodder
[2009-04-22 21:15:36 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\IrfanView
[2009-05-07 19:10:30 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\Little Worlds Online
[2009-04-16 20:12:09 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\Macromedia
[2009-04-17 20:45:26 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\MailFrontier
[2009-04-17 16:03:45 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\Media Player Classic
[2009-04-19 17:53:32 | 00,000,000 | –SD | M] – C:\Documents and Settings\Eppo Clappo\Application Data\Microsoft
[2009-04-16 19:49:02 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\Mozilla
[2009-04-19 09:23:03 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\OpenOffice.org
[2009-04-19 12:10:46 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\SpinTop Games
[2009-04-16 17:57:16 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\Styler
[2009-05-09 19:49:00 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\Summitsoft
[2009-04-16 21:27:49 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\Sun
[2009-04-16 22:32:16 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\SystemRequirementsLab
[2009-04-16 19:49:11 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\Talkback
[2009-04-16 21:48:57 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\TeamViewer
[2009-04-19 15:13:23 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\TuneUp Software
[2009-05-18 19:50:56 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\Uniblue
[2009-05-03 21:34:53 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\uTorrent
[2009-04-26 19:36:35 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\VoipBuster
[2009-04-18 18:24:17 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\Winamp
[2009-04-16 17:45:04 | 00,000,000 | —D | M] – C:\Documents and Settings\Eppo Clappo\Application Data\WinRAR
[2009-05-18 21:08:37 | 00,000,498 | —- | M] () – C:\WINDOWS\Tasks\1-Click Maintenance.job
[2009-05-18 19:38:44 | 00,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2008-04-14 14:00:00 | 00,000,065 | RH– | M] () – C:\WINDOWS\Tasks\desktop.ini
[2009-05-18 21:08:33 | 00,000,006 | -H– | M] () – C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========


========== Alternate Data Streams ==========

@Alternate Data Stream - 182 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:7204B89D
@Alternate Data Stream - 170 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:6724CB45
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:3C77A608
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP:2BE9FEFC
< End of report >


———————————————

combofix log:

ComboFix 09-05-19.04 - Eppo Clappo 19-05-2009 22:52.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.959.550 [GMT 2:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Updated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
FW: ZoneAlarm Security Suite Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ccrpTmr6.dll
c:\windows\system32\drivers\UAClqbrpdwylyfuxvy.sys
c:\windows\system32\mcrh.tmp
c:\windows\system32\UACbltnikmybiuwnjb.dll
c:\windows\system32\UACcdeotewxjvdsdbq.dat
c:\windows\system32\uacinit.dll
c:\windows\system32\UACisiacnyhtpoacen.log
c:\windows\system32\UACmixrqpitqpmdejb.log
c:\windows\system32\UACrmhiqpioqwcrjet.log
c:\windows\system32\UACtoqkxgmeuxqwowi.dll
c:\windows\system32\UACxfmucjolejryinr.dll
c:\windows\system32\UACxngfvnpgcxkrvim.dll
c:\windows\system32\UACxtexyiklohmdjuw.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_UACd.sys


((((((((((((((((((((((((( Files Created from 2009-04-19 to 2009-05-19 )))))))))))))))))))))))))))))))
.

2009-05-19 20:57 . 2009-05-19 20:57 ——– d—–w c:\windows\system32\xircom
2009-05-19 20:57 . 2009-05-19 20:57 ——– d—–w c:\program files\microsoft frontpage
2009-05-19 20:18 . 2009-05-19 20:20 ——– d—–w C:\Rooter$
2009-05-18 19:03 . 2009-05-18 19:03 ——– d—–w C:\_OTListIt
2009-05-18 17:50 . 2009-05-18 17:50 ——– d—–w c:\documents and settings\Eppo Clappo\Application Data\Uniblue
2009-05-18 17:50 . 2009-05-18 17:50 ——– d—–w c:\program files\Uniblue
2009-05-18 17:50 . 2009-05-18 17:50 ——– dc-h–w c:\documents and settings\All Users.WINDOWS\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
2009-05-14 13:08 . 2009-05-14 13:10 ——– d–h–w c:\documents and settings\All Users.WINDOWS\Application Data\WebDrive
2009-05-14 13:08 . 2009-05-14 13:08 ——– d—–w c:\program files\WebDrive
2009-05-14 13:07 . 2009-05-14 13:07 ——– d—–w c:\windows\Downloaded Installations
2009-05-12 13:58 . 2009-05-12 13:58 ——– d—–w c:\program files\Microsoft Silverlight
2009-05-10 13:41 . 2009-05-10 13:41 ——– d—–w c:\documents and settings\Eppo Clappo\Application Data\iPodder
2009-05-10 13:40 . 2009-05-10 13:41 ——– d—–w c:\program files\Juice
2009-05-10 06:02 . 2009-05-10 06:02 ——– d—–w c:\documents and settings\All Users.WINDOWS\Application Data\The Humans
2009-05-10 06:01 . 2008-05-30 12:17 65032 —-a-w c:\windows\system32\XAPOFX1_0.dll
2009-05-10 06:01 . 2008-05-30 12:19 507400 —-a-w c:\windows\system32\XAudio2_1.dll
2009-05-10 06:01 . 2008-05-30 12:18 238088 —-a-w c:\windows\system32\xactengine3_1.dll
2009-05-10 06:01 . 2008-05-30 12:17 25608 —-a-w c:\windows\system32\X3DAudio1_4.dll
2009-05-10 06:01 . 2008-05-30 12:11 1491992 —-a-w c:\windows\system32\D3DCompiler_38.dll
2009-05-10 06:01 . 2008-05-30 12:11 467984 —-a-w c:\windows\system32\d3dx10_38.dll
2009-05-10 06:01 . 2008-05-30 12:11 3850760 —-a-w c:\windows\system32\D3DX9_38.dll
2009-05-10 05:58 . 2009-05-10 05:58 ——– d—–w c:\windows\Logs
2009-05-10 05:56 . 2009-05-10 05:56 ——– d—–w c:\windows\system32\URTTEMP
2009-05-10 05:54 . 2009-05-10 05:55 ——– d—–w c:\program files\Deep Silver
2009-05-09 17:49 . 2009-05-09 17:49 ——– d—–w c:\documents and settings\Eppo Clappo\Application Data\Summitsoft
2009-05-08 12:26 . 2009-05-10 13:46 ——– d—–w c:\documents and settings\Eppo Clappo\Local Settings\Application Data\RadioSure
2009-05-07 17:10 . 2009-05-07 17:10 ——– d—–w c:\documents and settings\Eppo Clappo\Application Data\Little Worlds Online
2009-05-07 17:10 . 2009-05-07 17:10 ——– d—–w c:\program files\Color Cross
2009-05-04 11:57 . 2009-05-04 11:57 ——– d—a-w C:\Drivers
2009-05-03 15:50 . 2008-08-08 09:19 125440 —-a-w c:\windows\dx7ogl32.dll
2009-05-03 15:50 . 2008-10-13 16:14 4171776 —-a-w c:\windows\ss100hm.scr
2009-05-03 15:50 . 2009-05-03 15:50 ——– d—–w c:\program files\100 Happy Money 3
2009-05-03 07:00 . 2009-05-03 19:52 ——– d—–w c:\program files\uTorrent Ultra Accelerator
2009-05-02 19:03 . 2009-05-02 19:20 163712 —-a-w c:\windows\system32\drivers\vidstub.sys
2009-05-02 18:50 . 2009-05-02 18:50 ——– d—–w c:\documents and settings\Eppo Clappo\.VirtualBox
2009-05-01 17:32 . 2009-05-01 17:32 ——– dc-h–w c:\documents and settings\All Users.WINDOWS\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-05-01 17:32 . 2009-05-01 17:32 ——– d—–w c:\program files\Lavasoft
2009-05-01 17:32 . 2009-05-01 17:34 ——– d—–w c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft
2009-04-27 18:39 . 2009-04-27 18:39 133648 —-a-w c:\windows\system32\VBoxNetFltNotify.dll
2009-04-27 18:39 . 2009-04-27 18:39 87696 —-a-w c:\windows\system32\drivers\VBoxNetFlt.sys
2009-04-27 17:31 . 2009-05-10 05:32 ——– d—–w c:\program files\Eusing Free Registry Cleaner
2009-04-26 16:11 . 2009-04-26 16:11 ——– d—–w c:\program files\Ballance
2009-04-26 12:21 . 2006-09-20 10:42 11392 —-a-w c:\windows\system32\drivers\HH9Help.sys
2009-04-26 12:21 . 2009-03-17 15:37 113688 —-a-w c:\windows\system32\drivers\vdrv9000.sys
2009-04-26 12:21 . 2007-04-16 12:58 1097728 —-a-w c:\windows\system32\NMSDVDX.dll
2009-04-26 12:20 . 2004-07-13 09:58 315392 —-a-w c:\windows\system32\NCTAudioPlayer2.dll
2009-04-26 12:20 . 2004-07-13 09:57 1843200 —-a-w c:\windows\system32\NCTAudioFile2.dll
2009-04-26 12:20 . 2003-07-24 16:01 1044480 —-a-w c:\windows\system32\ROBOEX32.DLL
2009-04-26 12:20 . 2009-04-26 12:20 ——– d—–w c:\program files\Virtual CD v9
2009-04-26 12:19 . 2009-04-26 12:19 ——– d—–w c:\documents and settings\Eppo Clappo\Application Data\InstallShield
2009-04-26 11:08 . 2009-05-03 18:42 ——– d—–w C:\!kk
2009-04-26 10:32 . 2009-05-16 11:46 ——– d—–w C:\radio-items-mp3
2009-04-26 09:48 . 2009-04-26 09:48 ——– d—–w c:\program files\FormatFactory
2009-04-26 09:35 . 2009-04-26 09:35 ——– d—–w c:\documents and settings\Eppo Clappo\Application Data\BinarySense
2009-04-26 09:35 . 2009-04-27 17:59 ——– d—–w c:\program files\Common Files\BinarySense
2009-04-26 08:32 . 2009-04-26 08:32 ——– d—–w c:\documents and settings\All Users.WINDOWS\Application Data\PassMark
2009-04-26 08:32 . 2009-04-26 08:34 ——– d—–w c:\program files\WirelessMon
2009-04-23 17:12 . 2005-05-27 00:22 10752 —-a-w c:\windows\hh.exe
2009-04-23 17:12 . 2005-08-26 11:07 3063808 —-a-w c:\windows\system32\hinstall.exe
2009-04-23 17:12 . 2003-07-25 12:20 331776 —-a-w c:\windows\system32\haspvb32.dll
2009-04-23 17:12 . 2001-01-15 00:16 62464 —-a-w c:\windows\system32\MMRegOCX.EXE
2009-04-23 17:12 . 2009-04-23 17:20 ——– d—–w C:\Jazler TV
2009-04-23 15:39 . 2009-04-23 15:39 ——– d—–w C:\Jazler Radio 2 Logs
2009-04-23 15:39 . 2009-04-23 17:15 ——– d—–w C:\Jazler Backups
2009-04-23 15:38 . 2005-07-28 06:18 685056 —-a-w c:\windows\system32\drivers\hardlock.sys
2009-04-23 15:38 . 2009-04-23 15:38 383 —-a-w c:\windows\system32\haspdos.sys
2009-04-23 15:38 . 2009-04-23 15:38 6656 —-a-w c:\windows\system32\haspvdd.dll
2009-04-23 15:38 . 2009-04-23 15:38 47616 —-a-w c:\windows\system32\drivers\Haspnt.sys
2009-04-22 19:15 . 2009-04-22 19:15 ——– d—–w c:\documents and settings\Eppo Clappo\Application Data\IrfanView
2009-04-21 04:55 . 2009-04-21 04:55 ——– d—–w C:\temp-upload
2009-04-20 16:45 . 2009-04-20 16:47 ——– d—–w c:\program files\AltBinz

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-19 20:59 . 2009-04-16 18:02 4212 —ha-w c:\windows\system32\zllictbl.dat
2009-05-19 20:58 . 2009-04-17 18:43 91564064 –sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-19 20:56 . 2009-04-17 18:43 1231412 –sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-18 18:54 . 2009-04-16 15:51 ——– d—–w c:\program files\Hunt Virus Utilities
2009-05-14 13:09 . 2009-04-06 06:47 1593344 —-a-w c:\windows\system32\wdHelper.dll
2009-05-10 05:54 . 2009-04-16 16:08 ——– d–h–w c:\program files\InstallShield Installation Information
2009-05-10 05:28 . 2009-04-16 15:40 ——– d—–w c:\program files\CCleaner
2009-05-02 19:03 . 2009-04-16 15:39 ——– d—–w c:\program files\Stardock
2009-05-02 18:46 . 2009-05-02 18:46 ——– d—–w c:\program files\Sun
2009-05-02 17:28 . 2009-05-02 17:28 ——– d—–w c:\program files\Skybound Stylizer 4
2009-05-02 14:27 . 2009-05-02 14:27 ——– d—–w c:\program files\WinDjView
2009-05-01 17:34 . 2009-05-01 17:43 15688 —-a-w c:\windows\system32\lsdelete.exe
2009-05-01 17:34 . 2009-05-01 17:34 64160 —-a-w c:\windows\system32\drivers\Lbd.sys
2009-04-27 18:39 . 2009-05-02 18:46 79888 —-a-w c:\windows\system32\drivers\VBoxNetAdp.sys
2009-04-27 18:39 . 2009-05-02 18:46 41424 —-a-w c:\windows\system32\drivers\VBoxUSBMon.sys
2009-04-27 18:39 . 2009-05-02 18:46 100944 —-a-w c:\windows\system32\drivers\VBoxDrv.sys
2009-04-24 16:49 . 2009-04-16 18:44 ——– d—–w c:\program files\Foxit Software
2009-04-22 12:49 . 2009-04-16 18:18 ——– d—–w c:\program files\Winamp
2009-04-22 12:34 . 2009-04-16 18:44 ——– d—–w c:\program files\AskBarDis
2009-04-19 20:14 . 2009-04-19 20:14 410984 —-a-w c:\windows\system32\deploytk.dll
2009-04-19 20:13 . 2009-04-16 19:28 ——– d—–w c:\program files\Java
2009-04-19 19:31 . 2009-04-19 19:16 48640 —-a-w c:\documents and settings\Eppo Clappo\Application Data\WKey.exe
2009-04-19 18:59 . 2009-04-19 18:27 ——– d—–w c:\program files\Driver Checker
2009-04-19 18:29 . 2009-04-16 16:27 36864 —-a-w c:\windows\system32\drivers\AmdK8.sys
2009-04-19 16:33 . 2009-04-19 16:33 ——– d—–w c:\program files\Common Files\Adobe
2009-04-19 16:00 . 2009-04-19 15:59 ——– d—–w c:\program files\Zinio
2009-04-19 16:00 . 2009-04-19 16:00 ——– d—–w c:\program files\Common Files\Zinio
2009-04-19 13:14 . 2009-04-19 13:12 ——– d—–w c:\program files\TuneUp Utilities 2009
2009-04-19 13:13 . 2009-04-19 13:13 603904 —-a-w c:\windows\system32\TUProgSt.exe
2009-04-19 13:13 . 2009-04-19 13:13 362240 —-a-w c:\windows\system32\TuneUpDefragService.exe
2009-04-19 11:46 . 2009-04-19 11:46 767328 —-a-w c:\windows\system32\kdfinj.dll
2009-04-19 11:44 . 2009-04-19 11:44 ——– d—–w c:\program files\AhnLab
2009-04-19 10:09 . 2009-04-19 10:09 ——– d—–w c:\program files\SNATCHDATA
2009-04-19 09:47 . 2009-04-19 09:47 ——– d—–w c:\program files\NEXON
2009-04-19 08:33 . 2009-04-19 08:33 4096 —-a-w c:\windows\d3dx.dat
2009-04-19 08:33 . 2009-04-19 08:32 ——– d—–w c:\program files\Turtix
2009-04-19 07:01 . 2009-04-19 07:01 ——– d—–w c:\program files\IrfanView
2009-04-19 06:04 . 2009-04-19 06:04 421888 —-a-w c:\windows\NEXON_EU_DownloaderUpdater.exe
2009-04-18 18:04 . 2009-04-18 18:04 ——– d—–w c:\program files\VoipBuster.com
2009-04-18 14:44 . 2009-04-16 15:52 ——– d—–w c:\program files\PowerCmd
2009-04-18 05:35 . 2009-04-16 15:52 ——– d—–w c:\program files\Unlocker
2009-04-17 05:40 . 2009-04-16 15:57 19360 —-a-w c:\documents and settings\Eppo Clappo\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-16 20:35 . 2009-04-16 20:32 ——– d—–w c:\program files\SystemRequirementsLab
2009-04-16 19:46 . 2009-04-16 19:46 ——– d—–w c:\program files\TeamViewer
2009-04-16 19:28 . 2009-04-16 19:28 ——– d—–w c:\program files\JRE
2009-04-16 19:28 . 2009-04-16 19:28 ——– d—–w c:\program files\OpenOffice.org 3
2009-04-16 19:28 . 2009-04-16 19:28 ——– d—–w c:\program files\Common Files\Java
2009-04-16 18:02 . 2009-04-16 18:02 ——– d—–w c:\program files\Zone Labs
2009-04-16 17:49 . 2009-04-16 17:49 0 —-a-w c:\windows\nsreg.dat
2009-04-16 16:31 . 2009-04-16 16:31 1536 —-a-w c:\windows\system32\TrueSoft.dat
2009-04-16 16:27 . 2009-04-16 16:27 ——– d—–w c:\program files\AMD
2009-04-16 16:18 . 2009-04-16 16:18 ——– d—–w c:\program files\Realtek Sound Manager
2009-04-16 16:18 . 2009-04-16 16:18 ——– d—–w c:\program files\AvRack
2009-04-16 16:18 . 2009-04-16 16:18 ——– d—–w c:\program files\Realtek AC97
2009-04-16 16:18 . 2009-04-16 16:08 ——– d—–w c:\program files\Common Files\InstallShield
2009-04-16 15:59 . 2009-04-16 15:59 ——– d—–w c:\program files\Microsoft WSE
2009-04-16 15:58 . 2009-04-16 15:58 68936 —-a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-04-16 15:58 . 2009-04-16 15:58 ——– d—–w c:\program files\MSBuild
2009-04-16 15:58 . 2009-04-16 15:58 ——– d—–w c:\program files\Reference Assemblies
2009-04-16 15:58 . 2009-04-16 15:58 ——– d—–w c:\program files\MSXML 6.0
2009-04-16 15:57 . 2009-04-16 15:40 ——– d—–w c:\program files\Styler
2009-04-16 15:57 . 2009-04-16 15:43 ——– d—–w c:\program files\VistaExperience.org
2009-04-16 15:52 . 2009-04-16 15:52 ——– d—–w c:\program files\K-Lite Codec Pack
2009-04-16 15:52 . 2009-04-16 15:52 ——– d—–w c:\program files\Common Files\Stardock
2009-04-16 15:51 . 2009-04-16 15:51 ——– d—–w c:\program files\HashTab Shell Extension
2009-04-16 15:51 . 2009-04-16 15:41 ——– d—–w c:\program files\Windows Sidebar
2009-04-16 15:51 . 2009-04-16 15:51 ——– d—–w c:\program files\Alky for Applications
2009-04-16 15:51 . 2009-04-16 15:51 ——– d—–w c:\program files\Sysinternals
2009-04-16 15:51 . 2009-04-16 15:51 ——– d—–w c:\program files\IZArc
2009-04-16 15:46 . 2009-04-16 15:46 21640 —-a-w c:\windows\system32\emptyregdb.dat
2009-04-16 15:44 . 2009-04-16 15:44 ——– d—–w c:\program files\uTorrent
2009-04-16 15:40 . 2009-04-16 15:40 ——– d—–w c:\program files\7-Zip
2009-04-16 15:40 . 2009-04-16 15:40 ——– d—–w c:\program files\Desktop
2009-04-16 15:40 . 2009-04-16 15:40 ——– d—–w c:\program files\System
2009-04-16 15:39 . 2009-04-16 15:39 ——– d—–w c:\program files\Stanimir Stoyanov
2009-04-16 15:39 . 2009-04-16 15:39 ——– d—–w c:\program files\Windows Media Connect 2
2009-04-06 06:48 . 2009-04-06 06:48 1921024 —-a-w c:\windows\system32\wdCryptoUtils.dll
2009-04-06 06:48 . 2009-04-06 06:48 663552 —-a-w c:\windows\system32\wdResDll.dll
2009-04-06 06:47 . 2009-04-06 06:47 1179648 —-a-w c:\windows\system32\wdShellExt.dll
2009-04-06 06:47 . 2009-04-06 06:47 466944 —-a-w c:\windows\system32\wdnp32.dll
2009-04-06 06:46 . 2009-04-06 06:46 69632 —-a-w c:\windows\system32\wdIconDll.dll
2009-04-06 06:46 . 2009-04-06 06:46 237568 —-a-w c:\windows\system32\wdUIResDll.dll
2009-03-31 17:20 . 2009-04-17 18:39 72584 —-a-w c:\windows\zllsputility.exe
2009-03-31 17:20 . 2009-04-17 18:39 1221512 —-a-w c:\windows\system32\zpeng25.dll
2009-03-27 08:03 . 2009-04-16 16:23 453152 —-a-w c:\windows\system32\nvudisp.exe
2009-03-27 08:03 . 2009-03-27 08:03 801312 —-a-w c:\windows\system32\nvcplui.exe
2009-03-27 06:14 . 2009-04-16 16:23 453152 —-a-w c:\windows\system32\NVUNINST.EXE
2009-03-06 14:22 . 2008-04-14 12:00 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:17 . 2008-05-18 11:03 828416 —-a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2008-05-18 11:03 78336 —-a-w c:\windows\system32\ieencode.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-11-18 10:58 333192 —-a-w c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-11-18 333192]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\WebDrive]
@="{37D70BD3-073C-4180-ADD9-C032EA5A7204}"
[HKEY_CLASSES_ROOT\CLSID\{37D70BD3-073C-4180-ADD9-C032EA5A7204}]
2009-04-06 06:47 1179648 —-a-w c:\windows\system32\wdShellExt.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"LClock"="c:\program files\LClock\lclock.exe" [2004-09-19 65536]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-03-22 1271808]
"VoipBuster"="c:\program files\VoipBuster.com\VoipBuster\VoipBuster.exe" [2008-11-10 9017648]
"TuneUp MemOptimizer"="c:\program files\TuneUp Utilities 2009\MemOptimizer.exe" [2008-11-20 155904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-10-10 7286784]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-04-10 37888]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-19 148888]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-03-31 982408]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-10-10 86016]
"VC9Player"="c:\program files\Virtual CD v9\System\VC9Play.exe" [2009-04-17 202056]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-05-01 516440]
"BootSkin Startup Jobs"="c:\progra~1\Stardock\WINCUS~1\BootSkin\BootSkin.exe" [2004-04-26 270336]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2005-09-22 90112]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2005-10-10 1519616]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"LClock"="c:\program files\LClock\LClock.exe" [2004-09-19 65536]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]
"nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2009-02-20 124928]

c:\documents and settings\Eppo Clappo\Start Menu\Programs\Startup\
Styler.lnk - c:\documents and settings\Eppo Clappo\Application Data\Microsoft\Installer\{E9ECF354-2422-4FDB-9ABF-D8ADAC0EF941}\_585b207a.exe [2009-4-16 15086]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
2008-05-12 08:49 210168 —-a-w c:\program files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Nexon\\NEXON_EU_Downloader\\NEXON_EU_Downloader_Engine.exe"=
"c:\\Program Files\\VoipBuster.com\\VoipBuster\\VoipBuster.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\WebDrive\\webdrive.exe"=
"c:\\Program Files\\WebDrive\\wdService.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [1-5-2009 19:34 64160]
R1 vdrv9000;vdrv9000;c:\windows\system32\drivers\vdrv9000.sys [26-4-2009 14:21 113688]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [18-1-2009 23:34 953168]
R2 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [23-3-2009 11:35 185640]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [19-4-2009 15:13 603904]
R2 VC9SecS;Virtual CD v9 Management Service;c:\program files\Virtual CD v9\System\VC9SecS.exe [26-4-2009 14:20 132424]
R2 WebDriveFSD;WebDrive Filesystem Driver;c:\program files\WebDrive\wdfsd.sys [6-4-2009 8:48 201112]
R3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [9-5-2007 17:03 560896]
S3 HH9Help.sys;HH9Help.sys;c:\windows\system32\drivers\HH9Help.sys [26-4-2009 14:21 11392]
S3 Mkd2kfNt;Mkd2kfNt;c:\windows\system32\drivers\Mkd2kfNT.sys [19-4-2009 13:46 131072]
S3 Mkd2Nadr;Mkd2Nadr;c:\windows\system32\drivers\Mkd2Nadr.sys [19-4-2009 13:46 79104]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D58F39FF-953E-4F45-898F-59F243B9A523}]
RUNDLL32 advpack.dll,LaunchINFSection Sidebar.inf,Register
.
Contents of the 'Scheduled Tasks' folder

2009-05-19 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-11-20 14:28]

2009-05-18 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 17:34]
.
- - - - ORPHANS REMOVED - - - -

BHO-{F9B9DD48-C8A6-4108-BA07-ACAFAF486A9B} - c:\windows\system32\vtUklIbB.dll
ShellExecuteHooks-{5f754a53-bcc1-4c7b-b3a0-4c77fb31e16c} - c:\windows\system32\xzamal.dll


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
FF - ProfilePath - c:\documents and settings\Eppo Clappo\Application Data\Mozilla\Firefox\Profiles\g7sudb8n.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.nl/ig
FF - plugin: c:\program files\AhnLab\ASP\MyKeyDefense 2.5\npmkd25aos.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll

—- FIREFOX POLICIES —-
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-19 22:58
Windows 5.1.2600 Service Pack 3, v.5755 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\vdrv9000]
"ImagePath"="system32\DRIVERS\vdrv9000.sys"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(708)
c:\windows\system32\wdnp32.dll
c:\windows\system32\wdHelper.dll
c:\windows\system32\wdUIResDll.dll
c:\windows\system32\wdCryptoUtils.dll
c:\program files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll

- - - - - - - > 'explorer.exe'(3580)
c:\program files\Zone Labs\ZoneAlarm\MailFrontier\mlfhook.dll
c:\program files\RocketDock\RocketDock.dll
c:\program files\Styler\StylerHelper.dll
c:\windows\system32\wdShellExt.dll
c:\windows\system32\wdHelper.dll
c:\windows\system32\wdUIResDll.dll
c:\program files\LClock\LC.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ZoneLabs\vsmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\pctspk.exe
c:\program files\WebDrive\wdService.exe
c:\program files\TeamViewer\Version4\TeamViewer.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\program files\Virtual CD v9\System\vc9tray.exe
c:\program files\Styler\Styler.exe
c:\program files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
.
**************************************************************************
.
Completion time: 2009-05-19 23:03 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-19 21:03

Pre-Run: 20.605.693.952 bytes free
Post-Run: 20.811.227.136 bytes free

337 — E O F — 2009-04-19 09:43

And here is the hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:57:00, on 20-5-2009
Platform: Windows XP SP3, v.5755 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.21020)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\Virtual CD v9\System\VC9SecS.exe
C:\Program Files\WebDrive\wdService.exe
C:\Program Files\TeamViewer\Version4\TeamViewer.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Virtual CD v9\System\VC9Play.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\LClock\lclock.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\VoipBuster.com\VoipBuster\VoipBuster.exe
C:\Program Files\TuneUp Utilities 2009\MemOptimizer.exe
C:\Program Files\Styler\Styler.exe
C:\Program Files\Virtual CD v9\System\VC9Tray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\OpenOffice.org 3\program\swriter.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VC9Player] C:\Program Files\Virtual CD v9\System\VC9Play.exe
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\PROGRA~1\Stardock\WINCUS~1\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\lclock.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [VoipBuster] "C:\Program Files\VoipBuster.com\VoipBuster\VoipBuster.exe" -nosplash -minimized
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2009\MemOptimizer.exe" autostart
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [LClock] C:\Program Files\LClock\LClock.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: Styler.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe
O23 - Service: Virtual CD v9 Management Service (VC9SecS) - H+H Software GmbH - C:\Program Files\Virtual CD v9\System\VC9SecS.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WebDrive Service (WebDriveService) - South River Technologies, LLC - C:\Program Files\WebDrive\wdService.exe

–
End of file - 7025 bytes

new HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:52:49, on 22-5-2009
Platform: Windows XP SP3, v.5755 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.21020)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\Virtual CD v9\System\VC9SecS.exe
C:\Program Files\WebDrive\wdService.exe
C:\Program Files\TeamViewer\Version4\TeamViewer.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Virtual CD v9\System\VC9Play.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\LClock\lclock.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\VoipBuster.com\VoipBuster\VoipBuster.exe
C:\Program Files\TuneUp Utilities 2009\MemOptimizer.exe
C:\Program Files\Styler\Styler.exe
C:\Program Files\Virtual CD v9\System\VC9Tray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Java\jre6\bin\java.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VC9Player] C:\Program Files\Virtual CD v9\System\VC9Play.exe
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\PROGRA~1\Stardock\WINCUS~1\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\lclock.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [VoipBuster] "C:\Program Files\VoipBuster.com\VoipBuster\VoipBuster.exe" -nosplash -minimized
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2009\MemOptimizer.exe" autostart
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [LClock] C:\Program Files\LClock\LClock.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: Styler.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe
O23 - Service: Virtual CD v9 Management Service (VC9SecS) - H+H Software GmbH - C:\Program Files\Virtual CD v9\System\VC9SecS.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WebDrive Service (WebDriveService) - South River Technologies, LLC - C:\Program Files\WebDrive\wdService.exe

–
End of file - 6799 bytes