[Resolved] Google hijacked by directrdr.com - AVG, Malwarebytes and Ad (page 4)

LDTate

Post #46December 6, 2009, 10:43 PM UTC

If you navigate to C:\Documents and Settings\your username\Application Data\Mozilla\Firefox\Profiles\random characters.default\extensions you see a number of folders. In each one is a file called install.rdf. I'd like you to open each folder in turn, right click these files and select Open with…. Scroll down until you find Wordpad, select it and hit OK.
If you don't have the option Open with…, try Open instead. It should tell you it can't open the file and you should select the Select the program from a list option and access Wordpad that way. The next time you try to open a file, the Open with… option should be present.
You are looking for em:name. I want you to see if you can find one that references XUL cache if at all possible and copy and paste the full contents of the file into your next reply.

LDTate

Post #47December 6, 2009, 10:51 PM UTC

If you haven't already done the above, just run GooredFix again post the results and see if you're still getting redirected.

davey_weir

Post #48December 6, 2009, 10:53 PM UTC last edited December 6, 2009, 10:53 PM UTC

It says access is denied to Documents and Settings. There is a little padlock in the bottom left of the folder icon. Ive accessed this folder before - any ideas?? Sorry, also the problem seems to happen in IE, and not really in Firefox.

LDTate

Post #49December 6, 2009, 11:04 PM UTC

Then we are dealing with something else.

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

Click NO
In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
Now click the Scan button.
Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.

Download OTL to your desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

davey_weir

Post #50December 7, 2009, 12:16 AM UTC

I had to run GMER in safe mode as it kept giving me the blue "screen of death" and restarting my netbook.

The results are:

GMER 1.0.15.15252 - http://www.gmer.net
Rootkit scan 2009-12-06 23:48:51
Windows 6.1.7100
Running: gmer.exe; Driver: C:\Users\Darren\AppData\Local\Temp\fwtyqpob.sys

—- System - GMER 1.0.15 —-

INT 0x1F \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 81C1FAF8
INT 0x37 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 81C1F104
INT 0xC1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 81C1F3F4
INT 0xD1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 81C082D8
INT 0xD2 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 81C07898
INT 0xDF \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 81C1F1DC
INT 0xE1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 81C1F958
INT 0xE3 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 81C1F6F8
INT 0xFD \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 81C1FF2C
INT 0xFE \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 81C201A8

—- Kernel code sections - GMER 1.0.15 —-

.text ntoskrnl.exe!ZwSaveKeyEx + 13B1 81C7D4A9 1 Byte [06]
.text ntoskrnl.exe!KiDispatchInterrupt + 5A2 81C9D952 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, …] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

Device \Driver\ACPI_HAL \Device\0000004f halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
Device -> \Driver\atapi \Device\Harddisk0\DR0 8472E369

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00234ee46e80
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00234ee46e80@001fcd27312a 0xF7 0x41 0x9E 0xA0 …
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00234ee46e80@00237a865c3d 0xF0 0x65 0xD8 0x9B …
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00234ee46e80 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00234ee46e80@001fcd27312a 0xF7 0x41 0x9E 0xA0 …
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00234ee46e80@00237a865c3d 0xF0 0x65 0xD8 0x9B …

—- Files - GMER 1.0.15 —-

File C:\Windows\system32\drivers\atapi.sys suspicious modification

—- EOF - GMER 1.0.15 —-

The OTL was ran during normal windows mode, and the results are:

OTL logfile created on: 07/12/2009 - Run 2
OTL by OldTimer - Version 3.1.11.8 Folder = C:\Users\Darren\Desktop
Ultimate Edition (Version = 6.1.7100) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7100.0)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1014.43 Mb Total Physical Memory | 351.66 Mb Available Physical Memory | 34.67% Memory free
1.99 Gb Paging File | 1.15 Gb Available in Paging File | 57.79% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 143.04 Gb Total Space | 115.30 Gb Free Space | 80.61% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DARRENSNETBOOK
Current User Name: Darren
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 90 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Darren\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
PRC - C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe (Research In Motion Limited)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\System32\igfxsrvc.exe (Intel Corporation)
PRC - C:\Windows\System32\igfxpers.exe (Intel Corporation)
PRC - C:\Windows\System32\igfxext.exe (Intel Corporation)
PRC - C:\Windows\System32\hkcmd.exe (Intel Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
PRC - C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation)
PRC - C:\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe (SAMSUNG Electronics)

========== Modules (SafeList) ==========

MOD - C:\Users\Darren\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7100.19_none_b6a32c7c247ee542\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation)
MOD - C:\Windows\System32\samcli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\netutils.dll (Microsoft Corporation)
MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
SRV - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
SRV - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
SRV - (aswUpdSv) – C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
SRV - (gupdate) Google Update Service (gupdate) – C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
SRV - (HomeGroupListener) – C:\Windows\System32\ListSvc.dll (Microsoft Corporation)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (WwanSvc) – C:\Windows\System32\wwansvc.dll (Microsoft Corporation)
SRV - (WbioSrvc) – C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)
SRV - (Power) – C:\Windows\System32\umpo.dll (Microsoft Corporation)
SRV - (Themes) – C:\Windows\System32\themeservice.dll (Microsoft Corporation)
SRV - (sppuinotify) – C:\Windows\System32\sppuinotify.dll (Microsoft Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (RpcEptMapper) – C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SRV - (HomeGroupProvider) – C:\Windows\System32\provsvc.dll (Microsoft Corporation)
SRV - (PNRPsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (p2pimsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (PNRPAutoReg) – C:\Windows\System32\pnrpauto.dll (Microsoft Corporation)
SRV - (PeerDistSvc) – C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (FontCache) – C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (Dhcp) – C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SRV - (defragsvc) – C:\Windows\System32\defragsvc.dll (Microsoft Corporation)
SRV - (BDESVC) – C:\Windows\System32\bdesvc.dll (Microsoft Corporation)
SRV - (AxInstSV) ActiveX Installer (AxInstSV) – C:\Windows\System32\AxInstSv.dll (Microsoft Corporation)
SRV - (AppIDSvc) – C:\Windows\System32\appidsvc.dll (Microsoft Corporation)
SRV - (sppsvc) – C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
SRV - (wlidsvc) – C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV - (SBSDWSCService) – C:\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (odserv) – C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (Microsoft Office Groove Audit Service) – C:\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)
SRV - (ose) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (StarOpen) – C:\Windows\System32\drivers\StarOpen.sys ()
DRV - (aswSP) – C:\Windows\System32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswFsBlk) – C:\Windows\System32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (aswMonFlt) – C:\Windows\System32\drivers\aswMonFlt.sys (ALWIL Software)
DRV - (aswTdi) – C:\Windows\System32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswRdr) – C:\Windows\System32\drivers\aswRdr.sys (ALWIL Software)
DRV - (yukonw7) – C:\Windows\System32\drivers\yk62x86.sys ()
DRV - (athr) – C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (igfx) – C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (adp94xx) – C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)
DRV - (adpahci) – C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\DRIVERS\elxstor.sys (Emulex)
DRV - (iaStorV) – C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)
DRV - (amdsbs) – C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)
DRV - (adpu320) – C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)
DRV - (MegaSR) – C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)
DRV - (arcsas) – C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)
DRV - (nvstor) – C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation)
DRV - (KSecPkg) – C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)
DRV - (nvraid) – C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation)
DRV - (LSI_FC) – C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)
DRV - (LSI_SCSI) – C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)
DRV - (amdsata) – C:\Windows\system32\DRIVERS\amdsata.sys (AMD)
DRV - (LSI_SAS) – C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)
DRV - (arc) – C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)
DRV - (aic78xx) – C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)
DRV - (HpSAMD) – C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)
DRV - (LSI_SAS2) – C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)
DRV - (FsDepends) – C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)
DRV - (nfrd960) – C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)
DRV - (pcw) – C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation)
DRV - (amdxata) – C:\Windows\system32\DRIVERS\amdxata.sys (AMD)
DRV - (cmdide) – C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (iirsp) – C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (megasas) – C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation)
DRV - (ql2300) – C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)
DRV - (vmbus) – C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)
DRV - (rdyboost) – C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation)
DRV - (hwpolicy) – C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)
DRV - (vhdmp) – C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)
DRV - (vsmraid) – C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) – C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)
DRV - (SiSRaid4) – C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)
DRV - (storflt) – C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)
DRV - (SiSRaid2) – C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)
DRV - (vdrvroot) – C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)
DRV - (storvsc) – C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)
DRV - (stexstor) – C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology)
DRV - (WIMMount) – C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)
DRV - (viaide) – C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)
DRV - (CNG) – C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.)
DRV - (rdpbus) – C:\Windows\System32\drivers\rdpbus.sys (Microsoft Corporation)
DRV - (RDPREFMP) – C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)
DRV - (ROOTMODEM) – C:\Windows\System32\drivers\rootmdm.sys (Microsoft Corporation)
DRV - (RasAgileVpn) WAN Miniport (IKEv2) – C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)
DRV - (WfpLwf) – C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)
DRV - (NdisCap) – C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
DRV - (vwifimp) – C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
DRV - (vwififlt) – C:\Windows\System32\drivers\vwififlt.sys (Microsoft Corporation)
DRV - (vwifibus) – C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)
DRV - (1394ohci) – C:\Windows\system32\DRIVERS\1394ohci.sys (Microsoft Corporation)
DRV - (UmPass) – C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)
DRV - (usbser) – C:\Windows\System32\drivers\usbser.sys (Microsoft Corporation)
DRV - (mshidkmdf) – C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)
DRV - (MTConfig) – C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)
DRV - (CompositeBus) – C:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation)
DRV - (AppID) – C:\Windows\system32\drivers\appid.sys (Microsoft Corporation)
DRV - (scfilter) – C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)
DRV - (s3cap) – C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) – C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)
DRV - (discache) – C:\Windows\System32\drivers\discache.sys (Microsoft Corporation)
DRV - (HidBatt) – C:\Windows\system32\DRIVERS\HidBatt.sys (Microsoft Corporation)
DRV - (AcpiPmi) – C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)
DRV - (AmdPPM) – C:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation)
DRV - (hcw85cir) – C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (BrUsbMdm) – C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.)
DRV - (BrSerWdm) – C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)
DRV - (ebdrv) – C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)
DRV - (b06bdrv) – C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)
DRV - (b57nd60x) – C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (secdrv) – C:\Windows\System32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (UsbserFilt) – C:\Windows\System32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) – C:\Windows\System32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) – C:\Windows\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) – C:\Windows\System32\drivers\ccdcmb.sys (Nokia)
DRV - (RimVSerPort) – C:\Windows\System32\drivers\RimSerial.sys (Research in Motion Ltd)
DRV - (pccsmcfd) – C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (hwdatacard) – C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (RimUsb) – C:\Windows\System32\drivers\RimUsb.sys (Research In Motion Limited)
DRV - (KMDFMEMIO) – C:\Windows\System32\drivers\KMDFMEMIO.sys (SAMSUNG ELECTRONICS CO., LTD.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 96 8D EC 53 3B 75 CA 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.co.uk/"

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Nokia\Nokia PC Suite 7\bkmrksync\ [2009/07/30 20:25:59 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/12/05 02:55:05 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/12/05 02:54:52 | 00,000,000 | —D | M]

[2009/12/05 02:55:17 | 00,000,000 | —D | M] – C:\Users\Darren\AppData\Roaming\Mozilla\Extensions
[2009/12/06 12:39:15 | 00,000,000 | —D | M] – C:\Users\Darren\AppData\Roaming\Mozilla\Firefox\Profiles\62v0gvcn.default\extensions
[2009/12/05 02:54:52 | 00,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/11/03 01:42:02 | 00,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2009/11/03 01:42:02 | 00,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2009/11/03 01:42:02 | 00,000,769 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2009/11/03 01:42:02 | 00,000,831 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: (348943 bytes) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 123haustiereundmehr.com
O1 - Hosts: 11961 more lines…
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [BlackBerryAutoUpdate] C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe (Research In Motion Limited)
O4 - HKLM..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [Persistence] C:\Windows\System32\igfxpers.exe (Intel Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O15 - HKCU\..Trusted Domains: 57 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (livessp) - C:\Windows\System32\livessp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/03/20 15:42:25 | 00,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 90 Days ==========

[2009/12/06 23:49:21 | 00,000,000 | —D | C] – C:\Users\Darren\AppData\Local\Adobe
[2009/12/06 23:19:08 | 00,537,088 | —- | C] (OldTimer Tools) – C:\Users\Darren\Desktop\OTL.exe
[2009/12/06 22:31:19 | 00,000,000 | —D | C] – C:\Users\Darren\Desktop\GooredFix Backups
[2009/12/06 22:29:41 | 00,071,848 | —- | C] (jpshortstuff) – C:\Users\Darren\Desktop\GooredFix.exe
[2009/12/06 00:55:34 | 00,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2009/12/06 00:55:21 | 00,000,000 | —D | C] – C:\Users\Darren\AppData\Local\temp
[2009/12/06 00:05:20 | 00,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2009/12/05 14:19:44 | 00,000,000 | —D | C] – C:\Avenger
[2009/12/05 02:55:04 | 00,000,000 | —D | C] – C:\Users\Darren\AppData\Roaming\Mozilla
[2009/12/05 02:55:04 | 00,000,000 | —D | C] – C:\Users\Darren\AppData\Local\Mozilla
[2009/12/05 02:54:48 | 00,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2009/12/05 01:59:31 | 00,000,000 | —D | C] – C:\Program Files\ESET
[2009/12/05 01:36:58 | 00,000,000 | —D | C] – C:\HJT
[2009/12/05 00:18:55 | 00,161,792 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2009/12/05 00:18:55 | 00,136,704 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2009/12/05 00:18:55 | 00,031,232 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2009/12/05 00:18:12 | 00,000,000 | —D | C] – C:\Windows\ERDNT
[2009/12/05 00:17:11 | 00,000,000 | —D | C] – C:\Qoobox
[2009/12/04 22:25:14 | 00,000,000 | —D | C] – C:\Users\Darren\Documents\hidownload
[2009/12/04 22:21:36 | 00,278,528 | —- | C] (Real Networks, Inc) – C:\Windows\System32\pncrt.dll
[2009/12/04 22:21:34 | 00,000,000 | —D | C] – C:\HiDownload
[2009/12/02 23:41:40 | 00,000,000 | —D | C] – C:\Program Files\Research In Motion
[2009/12/02 23:40:39 | 00,027,136 | —- | C] (Research in Motion Ltd) – C:\Windows\System32\drivers\RimSerial.sys
[2009/12/02 15:56:27 | 00,023,120 | —- | C] (ALWIL Software) – C:\Windows\System32\drivers\aswRdr.sys
[2009/12/02 15:56:26 | 00,048,560 | —- | C] (ALWIL Software) – C:\Windows\System32\drivers\aswTdi.sys
[2009/12/02 15:56:18 | 00,097,480 | —- | C] (ALWIL Software) – C:\Windows\System32\AvastSS.scr
[2009/12/02 15:56:17 | 00,114,768 | —- | C] (ALWIL Software) – C:\Windows\System32\drivers\aswSP.sys
[2009/12/02 15:56:17 | 00,020,560 | —- | C] (ALWIL Software) – C:\Windows\System32\drivers\aswFsBlk.sys
[2009/12/02 15:55:25 | 01,280,480 | —- | C] (ALWIL Software) – C:\Windows\System32\aswBoot.exe
[2009/12/02 15:55:25 | 01,060,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MFC71.dll
[2009/12/02 15:55:25 | 00,499,712 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MSVCP71.dll
[2009/12/02 15:55:25 | 00,053,328 | —- | C] (ALWIL Software) – C:\Windows\System32\drivers\aswMonFlt.sys
[2009/12/02 15:55:21 | 00,000,000 | —D | C] – C:\Program Files\Alwil Software
[2009/12/02 01:31:29 | 00,000,000 | —D | C] – C:\Windows\pss
[2009/12/01 02:13:45 | 00,093,360 | —- | C] (Sunbelt Software) – C:\Windows\System32\drivers\SBREDrv.sys
[2009/11/28 02:50:46 | 00,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2009/11/28 02:14:44 | 00,000,000 | —D | C] – C:\Users\Darren\Documents\My Art
[2009/11/28 02:13:22 | 00,000,000 | —D | C] – C:\Users\Darren\AppData\Roaming\Samsung
[2009/11/28 01:43:19 | 00,000,000 | —D | C] – C:\Program Files\Trend Micro
[2009/11/28 01:38:25 | 00,348,160 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msvcr71.dll
[2009/11/28 01:34:33 | 00,000,000 | —D | C] – C:\Windows\System32\Samsung_USB_Drivers
[2009/11/26 11:41:58 | 00,000,000 | —D | C] – C:\AVG9
[2009/11/25 00:12:40 | 00,000,000 | —D | C] – C:\ProgramData\VirginMedia
[2009/11/25 00:12:37 | 00,000,000 | —D | C] – C:\Users\Darren\AppData\Local\VirginMedia
[2009/11/24 23:44:03 | 00,000,000 | —D | C] – C:\Windows\Temp
[2009/11/24 11:24:08 | 00,000,000 | —D | C] – C:\Users\Darren\AppData\Roaming\Malwarebytes
[2009/11/24 11:23:56 | 00,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2009/11/22 14:22:18 | 00,000,000 | —D | C] – C:\ProgramData\Lavasoft
[2009/11/19 22:34:44 | 00,000,000 | —D | C] – C:\Users\Darren\Desktop\BlackBerry
[2009/11/15 22:33:55 | 00,000,000 | —D | C] – C:\ProgramData\Research In Motion
[2009/11/15 22:13:00 | 00,000,000 | —D | C] – C:\Users\Darren\AppData\Roaming\Research In Motion
[2009/11/15 22:10:04 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Roxio Shared
[2009/11/15 22:09:50 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Research In Motion
[2009/11/15 22:09:49 | 00,000,000 | —D | C] – C:\BlackBerry
[2009/11/03 00:33:55 | 00,000,000 | —D | C] – C:\Program Files\AVG
[2009/11/02 22:59:10 | 00,000,000 | —D | C] – C:\Windows\System32\appmgmt
[2009/11/02 22:00:40 | 00,000,000 | —D | C] – C:\ProgramData\SUPERAntiSpyware.com
[2009/11/02 22:00:17 | 00,000,000 | —D | C] – C:\Users\Darren\AppData\Roaming\SUPERAntiSpyware.com
[2009/11/01 22:02:06 | 00,000,000 | —D | C] – C:\Windows\Minidump
[2009/10/27 20:06:08 | 00,000,000 | —D | C] – C:\Users\Darren\AppData\Roaming\Windows Live Writer
[2009/10/27 20:06:08 | 00,000,000 | —D | C] – C:\Users\Darren\AppData\Local\Windows Live Writer
[2009/10/27 20:06:08 | 00,000,000 | —D | C] – C:\Users\Darren\Documents\My Weblog Posts
[2009/10/18 22:46:32 | 00,000,000 | —D | C] – C:\Users\Darren\Documents\Bank Charges Templates
[2009/10/13 21:02:46 | 00,050,688 | —- | C] (Atribune.org) – C:\Users\Darren\Desktop\ATF-Cleaner.exe
[2009/10/13 20:51:08 | 00,000,000 | —D | C] – C:\Program Files\Adobe
[2009/10/12 20:55:34 | 00,000,000 | —D | C] – C:\Users\Darren\Documents\OneNote Notebooks
[2009/10/10 11:22:59 | 00,000,000 | —D | C] – C:\Users\Darren\Desktop\Bruno (2009) DVDRip-MAXSPEED
[2009/10/02 20:47:26 | 00,195,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MpSigStub.exe
[2009/09/28 09:22:00 | 00,364,544 | —- | C] (Marvell) – C:\Windows\System32\yk62x86.dll
[2009/09/26 20:05:12 | 00,000,000 | —D | C] – C:\Windows\Sun
[2009/09/21 17:58:28 | 01,218,048 | —- | C] (Atheros Communications, Inc.) – C:\Windows\System32\drivers\athr.sys
[2009/09/21 00:05:13 | 00,000,000 | —D | C] – C:\Users\Darren\Documents\PGCE
[2009/09/16 20:38:36 | 00,000,000 | —D | C] – C:\Users\Darren\AppData\Local\Google
[2009/09/16 20:38:36 | 00,000,000 | —D | C] – C:\Program Files\Google
[2009/09/12 14:34:06 | 00,000,000 | —D | C] – C:\SopCast
[2009/09/10 17:01:10 | 00,000,000 | —D | C] – C:\Users\Darren\Documents\html
[2009/09/08 23:16:49 | 00,716,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript.dll
[1 C:\Users\Darren\Documents\*.tmp files -> C:\Users\Darren\Documents\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2009/12/07 00:06:34 | 05,242,880 | -HS- | M] () – C:\Users\Darren\ntuser.dat
[2009/12/07 00:04:29 | 00,013,392 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2009/12/07 00:04:29 | 00,013,392 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2009/12/06 23:56:54 | 00,000,880 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2009/12/06 23:56:53 | 00,016,384 | —- | M] () – C:\Windows\System32\Ikeext.etl
[2009/12/06 23:56:31 | 00,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2009/12/06 23:56:04 | 00,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2009/12/06 23:55:52 | 79,777,7920 | -HS- | M] () – C:\hiberfil.sys
[2009/12/06 23:19:12 | 00,537,088 | —- | M] (OldTimer Tools) – C:\Users\Darren\Desktop\OTL.exe
[2009/12/06 22:48:17 | 00,000,884 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2009/12/06 22:29:43 | 00,071,848 | —- | M] (jpshortstuff) – C:\Users\Darren\Desktop\GooredFix.exe
[2009/12/06 00:43:54 | 00,000,215 | —- | M] () – C:\Windows\system.ini
[2009/12/06 00:02:46 | 03,581,119 | R— | M] () – C:\Users\Darren\Desktop\ComboFix.exe
[2009/12/05 14:59:21 | 00,722,162 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2009/12/05 14:59:21 | 00,622,546 | —- | M] () – C:\Windows\System32\perfh009.dat
[2009/12/05 14:59:21 | 00,112,726 | —- | M] () – C:\Windows\System32\perfc009.dat
[2009/12/05 03:36:00 | 00,524,288 | —- | M] () – C:\Users\Darren\Desktop\dds.scr
[2009/12/05 02:55:08 | 00,000,000 | —- | M] () – C:\Windows\nsreg.dat
[2009/12/05 02:54:57 | 00,001,889 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2009/12/05 01:39:37 | 00,001,407 | —- | M] () – C:\Users\Darren\Desktop\Hijackthis.lnk
[2009/12/04 19:51:56 | 00,002,170 | —- | M] () – C:\Users\Public\Desktop\Google Earth.lnk
[2009/12/03 01:02:07 | 00,000,256 | —- | M] () – C:\Windows\System32\pool.bin
[2009/12/02 23:55:05 | 01,064,510 | —- | M] () – C:\Users\Darren\Documents\LoaderBackup-(2009-12-02).ipd
[2009/12/02 23:39:36 | 00,001,540 | —- | M] () – C:\Users\Public\Desktop\Desktop Manager.lnk
[2009/12/02 23:32:55 | 27,106,0312 | —- | M] () – C:\Users\Darren\Desktop\501_b049_multilanguage.exe
[2009/12/02 15:56:27 | 00,002,018 | —- | M] () – C:\Users\Public\Desktop\avast! Antivirus.lnk
[2009/12/02 15:56:15 | 00,002,577 | —- | M] () – C:\Windows\System32\config.nt
[2009/12/02 15:27:00 | 00,524,288 | —- | M] () – C:\Users\Darren\Desktop\dds.pif
[2009/12/01 13:28:36 | 00,028,160 | —- | M] () – C:\Users\Darren\Documents\Letter to Direct Group Gap Insurance 2.doc
[2009/12/01 13:10:16 | 00,026,624 | —- | M] () – C:\Users\Darren\Documents\Robs Invoice.doc
[2009/12/01 02:13:36 | 00,093,360 | —- | M] (Sunbelt Software) – C:\Windows\System32\drivers\SBREDrv.sys
[2009/11/28 02:36:35 | 00,000,000 | —- | M] () – C:\ProgramData\LauncherAccess.dt
[2009/11/28 01:50:50 | 00,005,632 | —- | M] () – C:\Windows\System32\drivers\StarOpen.sys
[2009/11/25 15:19:51 | 02,157,357 | —- | M] () – C:\Users\Darren\Documents\Amys work.rtf
[2009/11/25 15:13:01 | 00,070,789 | —- | M] () – C:\Users\Darren\Documents\Amys work.docx
[2009/11/25 10:31:22 | 00,000,162 | -H– | M] () – C:\Users\Darren\Documents\~$ys work.docx
[2009/11/24 23:54:29 | 01,280,480 | —- | M] (ALWIL Software) – C:\Windows\System32\aswBoot.exe
[2009/11/24 23:50:12 | 00,114,768 | —- | M] (ALWIL Software) – C:\Windows\System32\drivers\aswSP.sys
[2009/11/24 23:50:00 | 00,020,560 | —- | M] (ALWIL Software) – C:\Windows\System32\drivers\aswFsBlk.sys
[2009/11/24 23:49:48 | 00,053,328 | —- | M] (ALWIL Software) – C:\Windows\System32\drivers\aswMonFlt.sys
[2009/11/24 23:49:07 | 00,048,560 | —- | M] (ALWIL Software) – C:\Windows\System32\drivers\aswTdi.sys
[2009/11/24 23:48:57 | 00,023,120 | —- | M] (ALWIL Software) – C:\Windows\System32\drivers\aswRdr.sys
[2009/11/24 23:47:28 | 00,097,480 | —- | M] (ALWIL Software) – C:\Windows\System32\AvastSS.scr
[2009/11/24 11:13:08 | 00,524,288 | -HS- | M] () – C:\Users\Darren\ntuser.dat{2a80093a-d776-11de-b51c-00234ee46e80}.TMContainer00000000000000000002.regtrans-ms
[2009/11/24 11:13:08 | 00,524,288 | -HS- | M] () – C:\Users\Darren\ntuser.dat{2a80093a-d776-11de-b51c-00234ee46e80}.TMContainer00000000000000000001.regtrans-ms
[2009/11/24 11:13:08 | 00,065,536 | -HS- | M] () – C:\Users\Darren\ntuser.dat{2a80093a-d776-11de-b51c-00234ee46e80}.TM.blf
[2009/11/21 12:17:18 | 00,292,352 | —- | M] () – C:\Users\Darren\Desktop\gmer.exe
[2009/11/15 21:47:17 | 32,269,5512 | —- | M] () – C:\Users\Darren\Documents\500_b028_multilanguage.exe
[2009/11/14 01:47:57 | 00,260,608 | —- | M] () – C:\Windows\PEV.exe
[2009/11/13 21:22:04 | 00,193,536 | —- | M] () – C:\Users\Darren\Documents\Darren Melling Sports Club Administrator Application Form.doc
[2009/11/12 18:18:17 | 00,306,176 | —- | M] () – C:\Users\Darren\Documents\Darren Melling Knowsley Council FDO Application Form.doc
[2009/11/12 18:17:14 | 00,306,176 | —- | M] () – C:\Users\Darren\Documents\Knowsley Council FDO Application Form.doc
[2009/11/10 21:47:59 | 00,341,504 | —- | M] () – C:\Users\Darren\Documents\job_application_form.doc
[2009/11/10 00:39:37 | 00,027,136 | —- | M] () – C:\Users\Darren\Documents\Letter to Direct Group GAP Insurance.doc
[2009/11/03 00:15:20 | 00,524,288 | -HS- | M] () – C:\Users\Darren\ntuser.dat{9bc8da66-c806-11de-a56b-00234ee46e80}.TMContainer00000000000000000002.regtrans-ms
[2009/11/03 00:15:20 | 00,524,288 | -HS- | M] () – C:\Users\Darren\ntuser.dat{9bc8da66-c806-11de-a56b-00234ee46e80}.TMContainer00000000000000000001.regtrans-ms
[2009/11/03 00:15:20 | 00,065,536 | -HS- | M] () – C:\Users\Darren\ntuser.dat{9bc8da66-c806-11de-a56b-00234ee46e80}.TM.blf
[2009/11/02 23:43:38 | 00,348,943 | —- | M] () – C:\Windows\System32\drivers\etc\hosts.20091202-013959.backup
[2009/11/02 23:43:38 | 00,348,943 | —- | M] () – C:\Windows\System32\drivers\etc\hosts.20091202-013839.backup
[2009/11/02 23:43:38 | 00,348,943 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2009/11/02 20:42:06 | 00,195,456 | —- | M] (Microsoft Corporation) – C:\Windows\System32\MpSigStub.exe
[2009/10/28 20:40:41 | 00,348,943 | R— | M] () – C:\Windows\System32\drivers\etc\hosts.20091102-234338.backup
[2009/10/27 22:25:27 | 00,027,136 | —- | M] () – C:\Users\Darren\Documents\Darren Melling - SkillsCoachCoveringLetter2009.doc
[2009/10/27 22:21:10 | 00,143,360 | —- | M] () – C:\Users\Darren\Documents\Darren Melling - SkillsCoachApplicationForm2009.doc
[2009/10/25 06:11:34 | 00,077,312 | —- | M] () – C:\Windows\MBR.exe
[2009/10/24 23:43:11 | 00,347,241 | R— | M] () – C:\Windows\System32\drivers\etc\hosts.20091028-204041.backup
[2009/10/18 18:49:19 | 00,344,153 | R— | M] () – C:\Windows\System32\drivers\etc\hosts.20091025-004311.backup
[2009/10/18 18:37:00 | 00,562,688 | —- | M] () – C:\Users\Darren\Documents\Darren Melling CV.doc
[2009/10/18 18:37:00 | 00,156,160 | —- | M] () – C:\Users\Darren\Documents\Letter to Bury FCCT.doc
[2009/10/13 21:45:40 | 00,028,672 | —- | M] () – C:\Users\Darren\Documents\Letter to Bury FC.doc
[2009/10/13 21:02:50 | 00,050,688 | —- | M] (Atribune.org) – C:\Users\Darren\Desktop\ATF-Cleaner.exe
[2009/10/09 00:49:44 | 30,000,0000 | —- | M] () – C:\Users\Darren\Desktop\Bruno_(2009)_DVDRip-MAXSPEED.part1.rar
[2009/10/05 23:14:38 | 07,236,854 | —- | M] () – C:\Users\Darren\Documents\2008-SebringSedan-2nd.pdf
[2009/10/03 22:07:58 | 00,338,227 | R— | M] () – C:\Windows\System32\drivers\etc\hosts.20091018-194919.backup
[2009/09/28 09:22:00 | 00,364,544 | —- | M] (Marvell) – C:\Windows\System32\yk62x86.dll
[2009/09/28 09:22:00 | 00,315,392 | —- | M] () – C:\Windows\System32\drivers\yk62x86.sys
[2009/09/28 00:41:14 | 00,335,315 | R— | M] () – C:\Windows\System32\drivers\etc\hosts.20091003-230758.backup
[2009/09/24 22:01:40 | 00,028,160 | —- | M] () – C:\Users\Darren\Documents\Letter to Zurich personal items.doc
[2009/09/23 00:00:37 | 00,028,160 | —- | M] () – C:\Users\Darren\Documents\Letter FPN.doc
[2009/09/22 01:19:11 | 00,331,255 | R— | M] () – C:\Windows\System32\drivers\etc\hosts.20090928-014113.backup
[2009/09/21 17:58:28 | 01,218,048 | —- | M] (Atheros Communications, Inc.) – C:\Windows\System32\drivers\athr.sys
[2009/09/18 17:24:56 | 00,011,949 | —- | M] () – C:\Users\Darren\Documents\Invoice.docx
[2009/09/12 14:34:07 | 00,000,590 | —- | M] () – C:\Users\Darren\Desktop\SopCast.lnk
[2009/09/11 23:56:53 | 00,329,973 | R— | M] () – C:\Windows\System32\drivers\etc\hosts.20090922-021911.backup
[2009/09/10 23:19:15 | 00,055,017 | —- | M] () – C:\Users\Darren\Desktop\AMY LEAS CHRISTMAS LIST FOR DAZZIE RISCAL TO BUY.docx
[2009/09/10 22:09:50 | 00,010,471 | —- | M] () – C:\Users\Darren\Documents\hallie hseet.docx
[2009/09/10 17:03:42 | 00,000,024 | —- | M] () – C:\Users\Darren\Documents\myfirstpage.html
[1 C:\Users\Darren\Documents\*.tmp files -> C:\Users\Darren\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2009/12/06 23:17:49 | 00,292,352 | —- | C] () – C:\Users\Darren\Desktop\gmer.exe
[2009/12/06 00:02:34 | 03,581,119 | R— | C] () – C:\Users\Darren\Desktop\ComboFix.exe
[2009/12/05 14:17:47 | 00,731,136 | —- | C] () – C:\Users\Darren\Desktop\avenger.exe
[2009/12/05 03:35:55 | 00,524,288 | —- | C] () – C:\Users\Darren\Desktop\dds.scr
[2009/12/05 02:55:08 | 00,000,000 | —- | C] () – C:\Windows\nsreg.dat
[2009/12/05 02:54:57 | 00,001,889 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2009/12/05 01:36:59 | 00,001,407 | —- | C] () – C:\Users\Darren\Desktop\Hijackthis.lnk
[2009/12/05 00:18:55 | 00,260,608 | —- | C] () – C:\Windows\PEV.exe
[2009/12/05 00:18:55 | 00,098,816 | —- | C] () – C:\Windows\sed.exe
[2009/12/05 00:18:55 | 00,080,412 | —- | C] () – C:\Windows\grep.exe
[2009/12/05 00:18:55 | 00,077,312 | —- | C] () – C:\Windows\MBR.exe
[2009/12/05 00:18:55 | 00,068,096 | —- | C] () – C:\Windows\zip.exe
[2009/12/04 19:51:56 | 00,002,170 | —- | C] () – C:\Users\Public\Desktop\Google Earth.lnk
[2009/12/02 23:55:05 | 01,064,510 | —- | C] () – C:\Users\Darren\Documents\LoaderBackup-(2009-12-02).ipd
[2009/12/02 23:44:07 | 00,000,256 | —- | C] () – C:\Windows\System32\pool.bin
[2009/12/02 23:39:36 | 00,001,540 | —- | C] () – C:\Users\Public\Desktop\Desktop Manager.lnk
[2009/12/02 23:19:43 | 27,106,0312 | —- | C] () – C:\Users\Darren\Desktop\501_b049_multilanguage.exe
[2009/12/02 15:56:27 | 00,002,018 | —- | C] () – C:\Users\Public\Desktop\avast! Antivirus.lnk
[2009/12/02 15:55:25 | 00,380,928 | —- | C] () – C:\Windows\System32\actskin4.ocx
[2009/12/02 15:26:22 | 00,524,288 | —- | C] () – C:\Users\Darren\Desktop\dds.pif
[2009/12/01 13:28:35 | 00,028,160 | —- | C] () – C:\Users\Darren\Documents\Letter to Direct Group Gap Insurance 2.doc
[2009/12/01 13:10:14 | 00,026,624 | —- | C] () – C:\Users\Darren\Documents\Robs Invoice.doc
[2009/11/28 02:12:25 | 00,000,000 | —- | C] () – C:\ProgramData\LauncherAccess.dt
[2009/11/28 01:33:49 | 00,000,766 | —- | C] () – C:\Windows\System32\Uninstall.ico
[2009/11/28 01:33:35 | 00,005,632 | —- | C] () – C:\Windows\System32\drivers\StarOpen.sys
[2009/11/26 11:54:08 | 00,016,384 | —- | C] () – C:\Windows\System32\Ikeext.etl
[2009/11/25 15:19:47 | 02,157,357 | —- | C] () – C:\Users\Darren\Documents\Amys work.rtf
[2009/11/25 10:31:22 | 00,000,162 | -H– | C] () – C:\Users\Darren\Documents\~$ys work.docx
[2009/11/22 23:12:47 | 00,524,288 | -HS- | C] () – C:\Users\Darren\ntuser.dat{2a80093a-d776-11de-b51c-00234ee46e80}.TMContainer00000000000000000002.regtrans-ms
[2009/11/22 23:12:47 | 00,524,288 | -HS- | C] () – C:\Users\Darren\ntuser.dat{2a80093a-d776-11de-b51c-00234ee46e80}.TMContainer00000000000000000001.regtrans-ms
[2009/11/22 23:12:47 | 00,065,536 | -HS- | C] () – C:\Users\Darren\ntuser.dat{2a80093a-d776-11de-b51c-00234ee46e80}.TM.blf
[2009/11/18 21:25:14 | 00,070,789 | —- | C] () – C:\Users\Darren\Documents\Amys work.docx
[2009/11/15 21:47:19 | 32,269,5512 | —- | C] () – C:\Users\Darren\Documents\500_b028_multilanguage.exe
[2009/11/13 21:22:02 | 00,193,536 | —- | C] () – C:\Users\Darren\Documents\Darren Melling Sports Club Administrator Application Form.doc
[2009/11/12 18:18:15 | 00,306,176 | —- | C] () – C:\Users\Darren\Documents\Darren Melling Knowsley Council FDO Application Form.doc
[2009/11/10 23:11:29 | 00,306,176 | —- | C] () – C:\Users\Darren\Documents\Knowsley Council FDO Application Form.doc
[2009/11/10 21:47:49 | 00,341,504 | —- | C] () – C:\Users\Darren\Documents\job_application_form.doc
[2009/11/10 00:33:28 | 00,027,136 | —- | C] () – C:\Users\Darren\Documents\Letter to Direct Group GAP Insurance.doc
[2009/11/02 23:33:47 | 00,524,288 | -HS- | C] () – C:\Users\Darren\ntuser.dat{9bc8da66-c806-11de-a56b-00234ee46e80}.TMContainer00000000000000000002.regtrans-ms
[2009/11/02 23:33:47 | 00,524,288 | -HS- | C] () – C:\Users\Darren\ntuser.dat{9bc8da66-c806-11de-a56b-00234ee46e80}.TMContainer00000000000000000001.regtrans-ms
[2009/11/02 23:33:47 | 00,065,536 | -HS- | C] () – C:\Users\Darren\ntuser.dat{9bc8da66-c806-11de-a56b-00234ee46e80}.TM.blf
[2009/10/27 22:13:30 | 00,027,136 | —- | C] () – C:\Users\Darren\Documents\Darren Melling - SkillsCoachCoveringLetter2009.doc
[2009/10/27 21:50:38 | 00,143,360 | —- | C] () – C:\Users\Darren\Documents\Darren Melling - SkillsCoachApplicationForm2009.doc
[2009/10/18 18:37:00 | 00,562,688 | —- | C] () – C:\Users\Darren\Documents\Darren Melling CV.doc
[2009/10/18 18:37:00 | 00,156,160 | —- | C] () – C:\Users\Darren\Documents\Letter to Bury FCCT.doc
[2009/10/13 21:45:39 | 00,028,672 | —- | C] () – C:\Users\Darren\Documents\Letter to Bury FC.doc
[2009/10/09 00:49:23 | 30,000,0000 | —- | C] () – C:\Users\Darren\Desktop\Bruno_(2009)_DVDRip-MAXSPEED.part1.rar
[2009/10/05 23:14:23 | 07,236,854 | —- | C] () – C:\Users\Darren\Documents\2008-SebringSedan-2nd.pdf
[2009/09/28 09:22:00 | 00,315,392 | —- | C] () – C:\Windows\System32\drivers\yk62x86.sys
[2009/09/24 22:01:38 | 00,028,160 | —- | C] () – C:\Users\Darren\Documents\Letter to Zurich personal items.doc
[2009/09/23 00:00:36 | 00,028,160 | —- | C] () – C:\Users\Darren\Documents\Letter FPN.doc
[2009/09/18 17:24:55 | 00,011,949 | —- | C] () – C:\Users\Darren\Documents\Invoice.docx
[2009/09/16 20:38:43 | 00,000,884 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2009/09/16 20:38:42 | 00,000,880 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2009/09/12 14:34:07 | 00,000,590 | —- | C] () – C:\Users\Darren\Desktop\SopCast.lnk
[2009/09/12 14:33:27 | 05,529,301 | —- | C] () – C:\Users\Darren\Desktop\Setup-SopCast-3.2.4-2009-7-9.exe
[2009/09/10 23:19:14 | 00,055,017 | —- | C] () – C:\Users\Darren\Desktop\AMY LEAS CHRISTMAS LIST FOR DAZZIE RISCAL TO BUY.docx
[2009/09/10 22:09:48 | 00,010,471 | —- | C] () – C:\Users\Darren\Documents\hallie hseet.docx
[2009/09/10 17:03:42 | 00,000,024 | —- | C] () – C:\Users\Darren\Documents\myfirstpage.html
[2009/09/06 00:26:00 | 00,000,017 | —- | C] () – C:\Users\Darren\AppData\Local\resmon.resmoncfg
[2009/07/20 22:23:02 | 00,000,135 | R— | C] () – C:\Windows\System32\lngEng.ini
[2009/07/20 22:23:02 | 00,000,117 | —- | C] () – C:\Windows\System32\lngKor.ini
[2009/04/22 03:50:07 | 00,073,216 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/04/22 03:40:32 | 00,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll

========== LOP Check ==========

[2009/11/27 11:50:18 | 00,000,000 | —D | M] – C:\Users\Darren\AppData\Roaming\MP3Rocket
[2009/07/30 21:33:34 | 00,000,000 | —D | M] – C:\Users\Darren\AppData\Roaming\Nokia
[2009/07/30 21:33:39 | 00,000,000 | —D | M] – C:\Users\Darren\AppData\Roaming\PC Suite
[2009/11/15 22:13:00 | 00,000,000 | —D | M] – C:\Users\Darren\AppData\Roaming\Research In Motion
[2009/12/02 01:25:03 | 00,000,000 | —D | M] – C:\Users\Darren\AppData\Roaming\Samsung
[2009/10/27 20:07:54 | 00,000,000 | —D | M] – C:\Users\Darren\AppData\Roaming\Windows Live Writer
[2009/11/25 10:29:34 | 00,032,630 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

< End of report >
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
SRV - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
SRV - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
SRV - (aswUpdSv) – C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
SRV - (gupdate) Google Update Service (gupdate) – C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
SRV - (HomeGroupListener) – C:\Windows\System32\ListSvc.dll (Microsoft Corporation)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (WwanSvc) – C:\Windows\System32\wwansvc.dll (Microsoft Corporation)
SRV - (WbioSrvc) – C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)
SRV - (Power) – C:\Windows\System32\umpo.dll (Microsoft Corporation)
SRV - (Themes) – C:\Windows\System32\themeservice.dll (Microsoft Corporation)
SRV - (sppuinotify) – C:\Windows\System32\sppuinotify.dll (Microsoft Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (RpcEptMapper) – C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SRV - (HomeGroupProvider) – C:\Windows\System32\provsvc.dll (Microsoft Corporation)
SRV - (PNRPsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (p2pimsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (PNRPAutoReg) – C:\Windows\System32\pnrpauto.dll (Microsoft Corporation)
SRV - (PeerDistSvc) – C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (FontCache) – C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (Dhcp) – C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SRV - (defragsvc) – C:\Windows\System32\defragsvc.dll (Microsoft Corporation)
SRV - (BDESVC) – C:\Windows\System32\bdesvc.dll (Microsoft Corporation)
SRV - (AxInstSV) ActiveX Installer (AxInstSV) – C:\Windows\System32\AxInstSv.dll (Microsoft Corporation)
SRV - (AppIDSvc) – C:\Windows\System32\appidsvc.dll (Microsoft Corporation)
SRV - (sppsvc) – C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
SRV - (wlidsvc) – C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV - (SBSDWSCService) – C:\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (odserv) – C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (Microsoft Office Groove Audit Service) – C:\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)
SRV - (ose) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (StarOpen) – C:\Windows\System32\drivers\StarOpen.sys ()
DRV - (aswSP) – C:\Windows\System32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswFsBlk) – C:\Windows\System32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (aswMonFlt) – C:\Windows\System32\drivers\aswMonFlt.sys (ALWIL Software)
DRV - (aswTdi) – C:\Windows\System32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswRdr) – C:\Windows\System32\drivers\aswRdr.sys (ALWIL Software)
DRV - (yukonw7) – C:\Windows\System32\drivers\yk62x86.sys ()
DRV - (athr) – C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (igfx) – C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (adp94xx) – C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)
DRV - (adpahci) – C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\DRIVERS\elxstor.sys (Emulex)
DRV - (iaStorV) – C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)
DRV - (amdsbs) – C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)
DRV - (adpu320) – C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)
DRV - (MegaSR) – C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)
DRV - (arcsas) – C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)
DRV - (nvstor) – C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation)
DRV - (KSecPkg) – C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)
DRV - (nvraid) – C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation)
DRV - (LSI_FC) – C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)
DRV - (LSI_SCSI) – C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)
DRV - (amdsata) – C:\Windows\system32\DRIVERS\amdsata.sys (AMD)
DRV - (LSI_SAS) – C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)
DRV - (arc) – C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)
DRV - (aic78xx) – C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)
DRV - (HpSAMD) – C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)
DRV - (LSI_SAS2) – C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)
DRV - (FsDepends) – C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)
DRV - (nfrd960) – C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)
DRV - (pcw) – C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation)
DRV - (amdxata) – C:\Windows\system32\DRIVERS\amdxata.sys (AMD)
DRV - (cmdide) – C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (iirsp) – C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (megasas) – C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation)
DRV - (ql2300) – C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)
DRV - (vmbus) – C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)
DRV - (rdyboost) – C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation)
DRV - (hwpolicy) – C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)
DRV - (vhdmp) – C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)
DRV - (vsmraid) – C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) – C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)
DRV - (SiSRaid4) – C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)
DRV - (storflt) – C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)
DRV - (SiSRaid2) – C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)
DRV - (vdrvroot) – C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)
DRV - (storvsc) – C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)
DRV - (stexstor) – C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology)
DRV - (WIMMount) – C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)
DRV - (viaide) – C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)
DRV - (CNG) – C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.)
DRV - (rdpbus) – C:\Windows\System32\drivers\rdpbus.sys (Microsoft Corporation)
DRV - (RDPREFMP) – C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)
DRV - (ROOTMODEM) – C:\Windows\System32\drivers\rootmdm.sys (Microsoft Corporation)
DRV - (RasAgileVpn) WAN Miniport (IKEv2) – C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)
DRV - (WfpLwf) – C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)
DRV - (NdisCap) – C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
DRV - (vwifimp) – C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
DRV - (vwififlt) – C:\Windows\System32\drivers\vwififlt.sys (Microsoft Corporation)
DRV - (vwifibus) – C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)
DRV - (1394ohci) – C:\Windows\system32\DRIVERS\1394ohci.sys (Microsoft Corporation)
DRV - (UmPass) – C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)
DRV - (usbser) – C:\Windows\System32\drivers\usbser.sys (Microsoft Corporation)
DRV - (mshidkmdf) – C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)
DRV - (MTConfig) – C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)
DRV - (CompositeBus) – C:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation)
DRV - (AppID) – C:\Windows\system32\drivers\appid.sys (Microsoft Corporation)
DRV - (scfilter) – C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)
DRV - (s3cap) – C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) – C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)
DRV - (discache) – C:\Windows\System32\drivers\discache.sys (Microsoft Corporation)
DRV - (HidBatt) – C:\Windows\system32\DRIVERS\HidBatt.sys (Microsoft Corporation)
DRV - (AcpiPmi) – C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)
DRV - (AmdPPM) – C:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation)
DRV - (hcw85cir) – C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (BrUsbMdm) – C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.)
DRV - (BrSerWdm) – C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)
DRV - (ebdrv) – C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)
DRV - (b06bdrv) – C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)
DRV - (b57nd60x) – C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (secdrv) – C:\Windows\System32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (UsbserFilt) – C:\Windows\System32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) – C:\Windows\System32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) – C:\Windows\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) – C:\Windows\System32\drivers\ccdcmb.sys (Nokia)
DRV - (RimVSerPort) – C:\Windows\System32\drivers\RimSerial.sys (Research in Motion Ltd)
DRV - (pccsmcfd) – C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (hwdatacard) – C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (RimUsb) – C:\Windows\System32\drivers\RimUsb.sys (Research In Motion Limited)
DRV - (KMDFMEMIO) – C:\Windows\System32\drivers\KMDFMEMIO.sys (SAMSUNG ELECTRONICS CO., LTD.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 96 8D EC 53 3B 75 CA 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.co.uk/"

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Nokia\Nokia PC Suite 7\bkmrksync\ [2009/07/30 20:25:59 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/12/05 02:55:05 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/12/05 02:54:52 | 00,000,000 | —D | M]

[2009/12/05 02:55:17 | 00,000,000 | —D | M] – C:\Users\Darren\AppData\Roaming\Mozilla\Extensions
[2009/12/06 12:39:15 | 00,000,000 | —D | M] – C:\Users\Darren\AppData\Roaming\Mozilla\Firefox\Profiles\62v0gvcn.default\extensions
[2009/12/05 02:54:52 | 00,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/11/03 01:42:02 | 00,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2009/11/03 01:42:02 | 00,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2009/11/03 01:42:02 | 00,000,769 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2009/11/03 01:42:02 | 00,000,831 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: (348943 bytes) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 123haustiereundmehr.com
O1 - Hosts: 11961 more lines…
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [BlackBerryAutoUpdate] C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe (Research In Motion Limited)
O4 - HKLM..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [Persistence] C:\Windows\System32\igfxpers.exe (Intel Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O15 - HKCU\..Trusted Domains: 57 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (livessp) - C:\Windows\System32\livessp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/03/20 15:42:25 | 00,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 90 Days ==========

[2009/12/06 23:49:21 | 00,000,000 | —D | C] – C:\Users\Darren\AppData\Local\Adobe
[2009/12/06 23:19:08 | 00,537,088 | —- | C] (OldTimer Tools) – C:\Users\Darren\Desktop\OTL.exe
[2009/12/06 22:31:19 | 00,000,000 | —D | C] – C:\Users\Darren\Desktop\GooredFix Backups
[2009/12/06 22:29:41 | 00,071,848 | —- | C] (jpshortstuff) – C:\Users\Darren\Desktop\GooredFix.exe
[2009/12/06 00:55:34 | 00,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2009/12/06 00:55:21 | 00,000,000 | —D | C] – C:\Users\Darren\AppData\Local\temp
[2009/12/06 00:05:20 | 00,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2009/12/05 14:19:44 | 00,000,000 | —D | C] – C:\Avenger
[2009/12/05 02:55:04 | 00,000,000 | —D | C] – C:\Users\Darren\AppData\Roaming\Mozilla
[2009/12/05 02:55:04 | 00,000,000 | —D | C] – C:\Users\Darren\AppData\Local\Mozilla
[2009/12/05 02:54:48 | 00,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2009/12/05 01:59:31 | 00,000,000 | —D | C] – C:\Program Files\ESET
[2009/12/05 01:36:58 | 00,000,000 | —D | C] – C:\HJT
[2009/12/05 00:18:55 | 00,161,792 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2009/12/05 00:18:55 | 00,136,704 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2009/12/05 00:18:55 | 00,031,232 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2009/12/05 00:18:12 | 00,000,000 | —D | C] – C:\Windows\ERDNT
[2009/12/05 00:17:11 | 00,000,000 | —D | C] – C:\Qoobox
[2009/12/04 22:25:14 | 00,000,000 | —D | C] – C:\Users\Darren\Documents\hidownload
[2009/12/04 22:21:36 | 00,278,528 | —- | C] (Real Networks, Inc) – C:\Windows\System32\pncrt.dll
[2009/12/04 22:21:34 | 00,000,000 | —D | C] – C:\HiDownload
[2009/12/02 23:41:40 | 00,000,000 | —D | C] – C:\Program Files\Research In Motion
[2009/12/02 23:40:39 | 00,027,136 | —- | C] (Research in Motion Ltd) – C:\Windows\System32\drivers\RimSerial.sys
[2009/12/02 15:56:27 | 00,023,120 | —- | C] (ALWIL Software) – C:\Windows\System32\drivers\aswRdr.sys
[2009/12/02 15:56:26 | 00,048,560 | —- | C] (ALWIL Software) – C:\Windows\System32\drivers\aswTdi.sys
[2009/12/02 15:56:18 | 00,097,480 | —- | C] (ALWIL Software) – C:\Windows\System32\AvastSS.scr
[2009/12/02 15:56:17 | 00,114,768 | —- | C] (ALWIL Software) – C:\Windows\System32\drivers\aswSP.sys
[2009/12/02 15:56:17 | 00,020,560 | —- | C] (ALWIL Software) – C:\Windows\System32\drivers\aswFsBlk.sys
[2009/12/02 15:55:25 | 01,280,480 | —- | C] (ALWIL Software) – C:\Windows\System32\aswBoot.exe
[2009/12/02 15:55:25 | 01,060,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MFC71.dll
[2009/12/02 15:55:25 | 00,499,712 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MSVCP71.dll
[2009/12/02 15:55:25 | 00,053,328 | —- | C] (ALWIL Software) – C:\Windows\System32\drivers\aswMonFlt.sys
[2009/12/02 15:55:21 | 00,000,000 | —D | C] – C:\Program Files\Alwil Software
[2009/12/02 01:31:29 | 00,000,000 | —D | C] – C:\Windows\pss
[2009/12/01 02:13:45 | 00,093,360 | —- | C] (Sunbelt Software) – C:\Windows\System32\drivers\SBREDrv.sys
[2009/11/28 02:50:46 | 00,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2009/11/28 02:14:44 | 00,000,000 | —D | C] – C:\Users\Darren\Documents\My Art
[2009/11/28 02:13:22 | 00,000,000 | —D | C] – C:\Users\Darren\AppData\Roaming\Samsung
[2009/11/28 01:43:19 | 00,000,000 | —D | C] – C:\Program Files\Trend Micro
[2009/11/28 01:38:25 | 00,348,160 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msvcr71.dll
[2009/11/28 01:34:33 | 00,000,000 | —D | C] – C:\Windows\System32\Samsung_USB_Drivers
[2009/11/26 11:41:58 | 00,000,000 | —D | C] – C:\AVG9
[2009/11/25 00:12:40 | 00,000,000 | —D | C] – C:\ProgramData\VirginMedia
[2009/11/25 00:12:37 | 00,000,000 | —D | C] – C:\Users\Darren\AppData\Local\VirginMedia
[2009/11/24 23:44:03 | 00,000,000 | —D | C] – C:\Windows\Temp
[2009/11/24 11:24:08 | 00,000,000 | —D | C] – C:\Users\Darren\AppData\Roaming\Malwarebytes
[2009/11/24 11:23:56 | 00,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2009/11/22 14:22:18 | 00,000,000 | —D | C] – C:\ProgramData\Lavasoft
[2009/11/19 22:34:44 | 00,000,000 | —D | C] – C:\Users\Darren\Desktop\BlackBerry
[2009/11/15 22:33:55 | 00,000,000 | —D | C] – C:\ProgramData\Research In Motion
[2009/11/15 22:13:00 | 00,000,000 | —D | C] – C:\Users\Darren\AppData\Roaming\Research In Motion
[2009/11/15 22:10:04 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Roxio Shared
[2009/11/15 22:09:50 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Research In Motion
[2009/11/15 22:09:49 | 00,000,000 | —D | C] – C:\BlackBerry
[2009/11/02 22:59:10 | 00,000,000 | —D | C] – C:\Windows\System32\appmgmt
[2009/11/02 22:00:40 | 00,000,000 | —D | C] – C:\ProgramData\SUPERAntiSpyware.com
[2009/11/01 22:02:06 | 00,000,000 | —D | C] – C:\Windows\Minidump
[2009/10/27 20:06:08 | 00,000,000 | —D | C] – C:\Users\Darren\Documents\My Weblog Posts
[2009/10/18 22:46:32 | 00,000,000 | —D | C] – C:\Users\Darren\Documents\Bank Charges Templates
[2009/10/13 21:02:46 | 00,050,688 | —- | C] (Atribune.org) – C:\Users\Darren\Desktop\ATF-Cleaner.exe
[2009/10/12 20:55:34 | 00,000,000 | —D | C] – C:\Users\Darren\Documents\OneNote Notebooks
[2009/10/10 11:22:59 | 00,000,000 | —D | C] – C:\Users\Darren\Desktop\Bruno (2009) DVDRip-MAXSPEED
[2009/10/02 20:47:26 | 00,195,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MpSigStub.exe
[2009/09/28 09:22:00 | 00,364,544 | —- | C] (Marvell) – C:\Windows\System32\yk62x86.dll
[2009/09/26 20:05:12 | 00,000,000 | —D | C] – C:\Windows\Sun
[2009/09/21 17:58:28 | 01,218,048 | —- | C] (Atheros Communications, Inc.) – C:\Windows\System32\drivers\athr.sys
[2009/09/21 00:05:13 | 00,000,000 | —D | C] – C:\Users\Darren\Documents\PGCE
[2009/09/12 14:34:06 | 00,000,000 | —D | C] – C:\SopCast
[2009/09/10 17:01:10 | 00,000,000 | —D | C] – C:\Users\Darren\Documents\html
[2009/09/08 23:16:49 | 00,716,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript.dll
[1 C:\Users\Darren\Documents\*.tmp files -> C:\Users\Darren\Documents\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2009/12/07 00:11:51 | 05,242,880 | -HS- | M] () – C:\Users\Darren\ntuser.dat
[2009/12/07 00:04:29 | 00,013,392 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2009/12/07 00:04:29 | 00,013,392 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2009/12/06 23:56:54 | 00,000,880 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2009/12/06 23:56:53 | 00,016,384 | —- | M] () – C:\Windows\System32\Ikeext.etl
[2009/12/06 23:56:31 | 00,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2009/12/06 23:56:04 | 00,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2009/12/06 23:55:52 | 79,777,7920 | -HS- | M] () – C:\hiberfil.sys
[2009/12/06 23:19:12 | 00,537,088 | —- | M] (OldTimer Tools) – C:\Users\Darren\Desktop\OTL.exe
[2009/12/06 22:48:17 | 00,000,884 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2009/12/06 22:29:43 | 00,071,848 | —- | M] (jpshortstuff) – C:\Users\Darren\Desktop\GooredFix.exe
[2009/12/06 00:43:54 | 00,000,215 | —- | M] () – C:\Windows\system.ini
[2009/12/06 00:02:46 | 03,581,119 | R— | M] () – C:\Users\Darren\Desktop\ComboFix.exe
[2009/12/05 14:59:21 | 00,722,162 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2009/12/05 14:59:21 | 00,622,546 | —- | M] () – C:\Windows\System32\perfh009.dat
[2009/12/05 14:59:21 | 00,112,726 | —- | M] () – C:\Windows\System32\perfc009.dat
[2009/12/05 03:36:00 | 00,524,288 | —- | M] () – C:\Users\Darren\Desktop\dds.scr
[2009/12/05 02:55:08 | 00,000,000 | —- | M] () – C:\Windows\nsreg.dat
[2009/12/05 02:54:57 | 00,001,889 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2009/12/05 01:39:37 | 00,001,407 | —- | M] () – C:\Users\Darren\Desktop\Hijackthis.lnk
[2009/12/04 19:51:56 | 00,002,170 | —- | M] () – C:\Users\Public\Desktop\Google Earth.lnk
[2009/12/03 01:02:07 | 00,000,256 | —- | M] () – C:\Windows\System32\pool.bin
[2009/12/02 23:55:05 | 01,064,510 | —- | M] () – C:\Users\Darren\Documents\LoaderBackup-(2009-12-02).ipd
[2009/12/02 23:39:36 | 00,001,540 | —- | M] () – C:\Users\Public\Desktop\Desktop Manager.lnk
[2009/12/02 23:32:55 | 27,106,0312 | —- | M] () – C:\Users\Darren\Desktop\501_b049_multilanguage.exe
[2009/12/02 15:56:27 | 00,002,018 | —- | M] () – C:\Users\Public\Desktop\avast! Antivirus.lnk
[2009/12/02 15:56:15 | 00,002,577 | —- | M] () – C:\Windows\System32\config.nt
[2009/12/02 15:27:00 | 00,524,288 | —- | M] () – C:\Users\Darren\Desktop\dds.pif
[2009/12/01 13:28:36 | 00,028,160 | —- | M] () – C:\Users\Darren\Documents\Letter to Direct Group Gap Insurance 2.doc
[2009/12/01 13:10:16 | 00,026,624 | —- | M] () – C:\Users\Darren\Documents\Robs Invoice.doc
[2009/12/01 02:13:36 | 00,093,360 | —- | M] (Sunbelt Software) – C:\Windows\System32\drivers\SBREDrv.sys
[2009/11/28 02:36:35 | 00,000,000 | —- | M] () – C:\ProgramData\LauncherAccess.dt
[2009/11/28 01:50:50 | 00,005,632 | —- | M] () – C:\Windows\System32\drivers\StarOpen.sys
[2009/11/25 15:19:51 | 02,157,357 | —- | M] () – C:\Users\Darren\Documents\Amys work.rtf
[2009/11/25 15:13:01 | 00,070,789 | —- | M] () – C:\Users\Darren\Documents\Amys work.docx
[2009/11/25 10:31:22 | 00,000,162 | -H– | M] () – C:\Users\Darren\Documents\~$ys work.docx
[2009/11/24 23:54:29 | 01,280,480 | —- | M] (ALWIL Software) – C:\Windows\System32\aswBoot.exe
[2009/11/24 23:50:12 | 00,114,768 | —- | M] (ALWIL Software) – C:\Windows\System32\drivers\aswSP.sys
[2009/11/24 23:50:00 | 00,020,560 | —- | M] (ALWIL Software) – C:\Windows\System32\drivers\aswFsBlk.sys
[2009/11/24 23:49:48 | 00,053,328 | —- | M] (ALWIL Software) – C:\Windows\System32\drivers\aswMonFlt.sys
[2009/11/24 23:49:07 | 00,048,560 | —- | M] (ALWIL Software) – C:\Windows\System32\drivers\aswTdi.sys
[2009/11/24 23:48:57 | 00,023,120 | —- | M] (ALWIL Software) – C:\Windows\System32\drivers\aswRdr.sys
[2009/11/24 23:47:28 | 00,097,480 | —- | M] (ALWIL Software) – C:\Windows\System32\AvastSS.scr
[2009/11/24 11:13:08 | 00,524,288 | -HS- | M] () – C:\Users\Darren\ntuser.dat{2a80093a-d776-11de-b51c-00234ee46e80}.TMContainer00000000000000000002.regtrans-ms
[2009/11/24 11:13:08 | 00,524,288 | -HS- | M] () – C:\Users\Darren\ntuser.dat{2a80093a-d776-11de-b51c-00234ee46e80}.TMContainer00000000000000000001.regtrans-ms
[2009/11/24 11:13:08 | 00,065,536 | -HS- | M] () – C:\Users\Darren\ntuser.dat{2a80093a-d776-11de-b51c-00234ee46e80}.TM.blf
[2009/11/21 12:17:18 | 00,292,352 | —- | M] () – C:\Users\Darren\Desktop\gmer.exe
[2009/11/15 21:47:17 | 32,269,5512 | —- | M] () – C:\Users\Darren\Documents\500_b028_multilanguage.exe
[2009/11/14 01:47:57 | 00,260,608 | —- | M] () – C:\Windows\PEV.exe
[2009/11/13 21:22:04 | 00,193,536 | —- | M] () – C:\Users\Darren\Documents\Darren Melling Sports Club Administrator Application Form.doc
[2009/11/12 18:18:17 | 00,306,176 | —- | M] () – C:\Users\Darren\Documents\Darren Melling Knowsley Council FDO Application Form.doc
[2009/11/12 18:17:14 | 00,306,176 | —- | M] () – C:\Users\Darren\Documents\Knowsley Council FDO Application Form.doc
[2009/11/10 21:47:59 | 00,341,504 | —- | M] () – C:\Users\Darren\Documents\job_application_form.doc
[2009/11/10 00:39:37 | 00,027,136 | —- | M] () – C:\Users\Darren\Documents\Letter to Direct Group GAP Insurance.doc
[2009/11/03 00:15:20 | 00,524,288 | -HS- | M] () – C:\Users\Darren\ntuser.dat{9bc8da66-c806-11de-a56b-00234ee46e80}.TMContainer00000000000000000002.regtrans-ms
[2009/11/03 00:15:20 | 00,524,288 | -HS- | M] () – C:\Users\Darren\ntuser.dat{9bc8da66-c806-11de-a56b-00234ee46e80}.TMContainer00000000000000000001.regtrans-ms
[2009/11/03 00:15:20 | 00,065,536 | -HS- | M] () – C:\Users\Darren\ntuser.dat{9bc8da66-c806-11de-a56b-00234ee46e80}.TM.blf
[2009/11/02 23:43:38 | 00,348,943 | —- | M] () – C:\Windows\System32\drivers\etc\hosts.20091202-013959.backup
[2009/11/02 23:43:38 | 00,348,943 | —- | M] () – C:\Windows\System32\drivers\etc\hosts.20091202-013839.backup
[2009/11/02 23:43:38 | 00,348,943 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2009/11/02 20:42:06 | 00,195,456 | —- | M] (Microsoft Corporation) – C:\Windows\System32\MpSigStub.exe
[2009/10/28 20:40:41 | 00,348,943 | R— | M] () – C:\Windows\System32\drivers\etc\hosts.20091102-234338.backup
[2009/10/27 22:25:27 | 00,027,136 | —- | M] () – C:\Users\Darren\Documents\Darren Melling - SkillsCoachCoveringLetter2009.doc
[2009/10/27 22:21:10 | 00,143,360 | —- | M] () – C:\Users\Darren\Documents\Darren Melling - SkillsCoachApplicationForm2009.doc
[2009/10/25 06:11:34 | 00,077,312 | —- | M] () – C:\Windows\MBR.exe
[2009/10/24 23:43:11 | 00,347,241 | R— | M] () – C:\Windows\System32\drivers\etc\hosts.20091028-204041.backup
[2009/10/18 18:49:19 | 00,344,153 | R— | M] () – C:\Windows\System32\drivers\etc\hosts.20091025-004311.backup
[2009/10/18 18:37:00 | 00,562,688 | —- | M] () – C:\Users\Darren\Documents\Darren Melling CV.doc
[2009/10/18 18:37:00 | 00,156,160 | —- | M] () – C:\Users\Darren\Documents\Letter to Bury FCCT.doc
[2009/10/13 21:45:40 | 00,028,672 | —- | M] () – C:\Users\Darren\Documents\Letter to Bury FC.doc
[2009/10/13 21:02:50 | 00,050,688 | —- | M] (Atribune.org) – C:\Users\Darren\Desktop\ATF-Cleaner.exe
[2009/10/09 00:49:44 | 30,000,0000 | —- | M] () – C:\Users\Darren\Desktop\Bruno_(2009)_DVDRip-MAXSPEED.part1.rar
[2009/10/05 23:14:38 | 07,236,854 | —- | M] () – C:\Users\Darren\Documents\2008-SebringSedan-2nd.pdf
[2009/10/03 22:07:58 | 00,338,227 | R— | M] () – C:\Windows\System32\drivers\etc\hosts.20091018-194919.backup
[2009/09/28 09:22:00 | 00,364,544 | —- | M] (Marvell) – C:\Windows\System32\yk62x86.dll
[2009/09/28 09:22:00 | 00,315,392 | —- | M] () – C:\Windows\System32\drivers\yk62x86.sys
[2009/09/28 00:41:14 | 00,335,315 | R— | M] () – C:\Windows\System32\drivers\etc\hosts.20091003-230758.backup
[2009/09/24 22:01:40 | 00,028,160 | —- | M] () – C:\Users\Darren\Documents\Letter to Zurich personal items.doc
[2009/09/23 00:00:37 | 00,028,160 | —- | M] () – C:\Users\Darren\Documents\Letter FPN.doc
[2009/09/22 01:19:11 | 00,331,255 | R— | M] () – C:\Windows\System32\drivers\etc\hosts.20090928-014113.backup
[2009/09/21 17:58:28 | 01,218,048 | —- | M] (Atheros Communications, Inc.) – C:\Windows\System32\drivers\athr.sys
[2009/09/18 17:24:56 | 00,011,949 | —- | M] () – C:\Users\Darren\Documents\Invoice.docx
[2009/09/12 14:34:07 | 00,000,590 | —- | M] () – C:\Users\Darren\Desktop\SopCast.lnk
[2009/09/11 23:56:53 | 00,329,973 | R— | M] () – C:\Windows\System32\drivers\etc\hosts.20090922-021911.backup
[2009/09/10 23:19:15 | 00,055,017 | —- | M] () – C:\Users\Darren\Desktop\AMY LEAS CHRISTMAS LIST FOR DAZZIE RISCAL TO BUY.docx
[2009/09/10 22:09:50 | 00,010,471 | —- | M] () – C:\Users\Darren\Documents\hallie hseet.docx
[2009/09/10 17:03:42 | 00,000,024 | —- | M] () – C:\Users\Darren\Documents\myfirstpage.html
[1 C:\Users\Darren\Documents\*.tmp files -> C:\Users\Darren\Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2009/12/06 23:17:49 | 00,292,352 | —- | C] () – C:\Users\Darren\Desktop\gmer.exe
[2009/12/06 00:02:34 | 03,581,119 | R— | C] () – C:\Users\Darren\Desktop\ComboFix.exe
[2009/12/05 14:17:47 | 00,731,136 | —- | C] () – C:\Users\Darren\Desktop\avenger.exe
[2009/12/05 03:35:55 | 00,524,288 | —- | C] () – C:\Users\Darren\Desktop\dds.scr
[2009/12/05 02:55:08 | 00,000,000 | —- | C] () – C:\Windows\nsreg.dat
[2009/12/05 02:54:57 | 00,001,889 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2009/12/05 01:36:59 | 00,001,407 | —- | C] () – C:\Users\Darren\Desktop\Hijackthis.lnk
[2009/12/05 00:18:55 | 00,260,608 | —- | C] () – C:\Windows\PEV.exe
[2009/12/05 00:18:55 | 00,098,816 | —- | C] () – C:\Windows\sed.exe
[2009/12/05 00:18:55 | 00,080,412 | —- | C] () – C:\Windows\grep.exe
[2009/12/05 00:18:55 | 00,077,312 | —- | C] () – C:\Windows\MBR.exe
[2009/12/05 00:18:55 | 00,068,096 | —- | C] () – C:\Windows\zip.exe
[2009/12/04 19:51:56 | 00,002,170 | —- | C] () – C:\Users\Public\Desktop\Google Earth.lnk
[2009/12/02 23:55:05 | 01,064,510 | —- | C] () – C:\Users\Darren\Documents\LoaderBackup-(2009-12-02).ipd
[2009/12/02 23:44:07 | 00,000,256 | —- | C] () – C:\Windows\System32\pool.bin
[2009/12/02 23:39:36 | 00,001,540 | —- | C] () – C:\Users\Public\Desktop\Desktop Manager.lnk
[2009/12/02 23:19:43 | 27,106,0312 | —- | C] () – C:\Users\Darren\Desktop\501_b049_multilanguage.exe
[2009/12/02 15:56:27 | 00,002,018 | —- | C] () – C:\Users\Public\Desktop\avast! Antivirus.lnk
[2009/12/02 15:55:25 | 00,380,928 | —- | C] () – C:\Windows\System32\actskin4.ocx
[2009/12/02 15:26:22 | 00,524,288 | —- | C] () – C:\Users\Darren\Desktop\dds.pif
[2009/12/01 13:28:35 | 00,028,160 | —- | C] () – C:\Users\Darren\Documents\Letter to Direct Group Gap Insurance 2.doc
[2009/12/01 13:10:14 | 00,026,624 | —- | C] () – C:\Users\Darren\Documents\Robs Invoice.doc
[2009/11/28 02:12:25 | 00,000,000 | —- | C] () – C:\ProgramData\LauncherAccess.dt
[2009/11/28 01:33:49 | 00,000,766 | —- | C] () – C:\Windows\System32\Uninstall.ico
[2009/11/28 01:33:35 | 00,005,632 | —- | C] () – C:\Windows\System32\drivers\StarOpen.sys
[2009/11/26 11:54:08 | 00,016,384 | —- | C] () – C:\Windows\System32\Ikeext.etl
[2009/11/25 15:19:47 | 02,157,357 | —- | C] () – C:\Users\Darren\Documents\Amys work.rtf
[2009/11/25 10:31:22 | 00,000,162 | -H– | C] () – C:\Users\Darren\Documents\~$ys work.docx
[2009/11/22 23:12:47 | 00,524,288 | -HS- | C] () – C:\Users\Darren\ntuser.dat{2a80093a-d776-11de-b51c-00234ee46e80}.TMContainer00000000000000000002.regtrans-ms
[2009/11/22 23:12:47 | 00,524,288 | -HS- | C] () – C:\Users\Darren\ntuser.dat{2a80093a-d776-11de-b51c-00234ee46e80}.TMContainer00000000000000000001.regtrans-ms
[2009/11/22 23:12:47 | 00,065,536 | -HS- | C] () – C:\Users\Darren\ntuser.dat{2a80093a-d776-11de-b51c-00234ee46e80}.TM.blf
[2009/11/18 21:25:14 | 00,070,789 | —- | C] () – C:\Users\Darren\Documents\Amys work.docx
[2009/11/15 21:47:19 | 32,269,5512 | —- | C] () – C:\Users\Darren\Documents\500_b028_multilanguage.exe
[2009/11/13 21:22:02 | 00,193,536 | —- | C] () – C:\Users\Darren\Documents\Darren Melling Sports Club Administrator Application Form.doc
[2009/11/12 18:18:15 | 00,306,176 | —- | C] () – C:\Users\Darren\Documents\Darren Melling Knowsley Council FDO Application Form.doc
[2009/11/10 23:11:29 | 00,306,176 | —- | C] () – C:\Users\Darren\Documents\Knowsley Council FDO Application Form.doc
[2009/11/10 21:47:49 | 00,341,504 | —- | C] () – C:\Users\Darren\Documents\job_application_form.doc
[2009/11/10 00:33:28 | 00,027,136 | —- | C] () – C:\Users\Darren\Documents\Letter to Direct Group GAP Insurance.doc
[2009/11/02 23:33:47 | 00,524,288 | -HS- | C] () – C:\Users\Darren\ntuser.dat{9bc8da66-c806-11de-a56b-00234ee46e80}.TMContainer00000000000000000002.regtrans-ms
[2009/11/02 23:33:47 | 00,524,288 | -HS- | C] () – C:\Users\Darren\ntuser.dat{9bc8da66-c806-11de-a56b-00234ee46e80}.TMContainer00000000000000000001.regtrans-ms
[2009/11/02 23:33:47 | 00,065,536 | -HS- | C] () – C:\Users\Darren\ntuser.dat{9bc8da66-c806-11de-a56b-00234ee46e80}.TM.blf
[2009/10/27 22:13:30 | 00,027,136 | —- | C] () – C:\Users\Darren\Documents\Darren Melling - SkillsCoachCoveringLetter2009.doc
[2009/10/27 21:50:38 | 00,143,360 | —- | C] () – C:\Users\Darren\Documents\Darren Melling - SkillsCoachApplicationForm2009.doc
[2009/10/18 18:37:00 | 00,562,688 | —- | C] () – C:\Users\Darren\Documents\Darren Melling CV.doc
[2009/10/18 18:37:00 | 00,156,160 | —- | C] () – C:\Users\Darren\Documents\Letter to Bury FCCT.doc
[2009/10/13 21:45:39 | 00,028,672 | —- | C] () – C:\Users\Darren\Documents\Letter to Bury FC.doc
[2009/10/09 00:49:23 | 30,000,0000 | —- | C] () – C:\Users\Darren\Desktop\Bruno_(2009)_DVDRip-MAXSPEED.part1.rar
[2009/10/05 23:14:23 | 07,236,854 | —- | C] () – C:\Users\Darren\Documents\2008-SebringSedan-2nd.pdf
[2009/09/28 09:22:00 | 00,315,392 | —- | C] () – C:\Windows\System32\drivers\yk62x86.sys
[2009/09/24 22:01:38 | 00,028,160 | —- | C] () – C:\Users\Darren\Documents\Letter to Zurich personal items.doc
[2009/09/23 00:00:36 | 00,028,160 | —- | C] () – C:\Users\Darren\Documents\Letter FPN.doc
[2009/09/18 17:24:55 | 00,011,949 | —- | C] () – C:\Users\Darren\Documents\Invoice.docx
[2009/09/16 20:38:43 | 00,000,884 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2009/09/16 20:38:42 | 00,000,880 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2009/09/12 14:34:07 | 00,000,590 | —- | C] () – C:\Users\Darren\Desktop\SopCast.lnk
[2009/09/12 14:33:27 | 05,529,301 | —- | C] () – C:\Users\Darren\Desktop\Setup-SopCast-3.2.4-2009-7-9.exe
[2009/09/10 23:19:14 | 00,055,017 | —- | C] () – C:\Users\Darren\Desktop\AMY LEAS CHRISTMAS LIST FOR DAZZIE RISCAL TO BUY.docx
[2009/09/10 22:09:48 | 00,010,471 | —- | C] () – C:\Users\Darren\Documents\hallie hseet.docx
[2009/09/10 17:03:42 | 00,000,024 | —- | C] () – C:\Users\Darren\Documents\myfirstpage.html
[2009/09/06 00:26:00 | 00,000,017 | —- | C] () – C:\Users\Darren\AppData\Local\resmon.resmoncfg
[2009/07/20 22:23:02 | 00,000,135 | R— | C] () – C:\Windows\System32\lngEng.ini
[2009/07/20 22:23:02 | 00,000,117 | —- | C] () – C:\Windows\System32\lngKor.ini
[2009/04/22 03:50:07 | 00,073,216 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/04/22 03:40:32 | 00,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll

========== LOP Check ==========

[2009/11/27 11:50:18 | 00,000,000 | —D | M] – C:\Users\Darren\AppData\Roaming\MP3Rocket
[2009/07/30 21:33:34 | 00,000,000 | —D | M] – C:\Users\Darren\AppData\Roaming\Nokia
[2009/07/30 21:33:39 | 00,000,000 | —D | M] – C:\Users\Darren\AppData\Roaming\PC Suite
[2009/11/15 22:13:00 | 00,000,000 | —D | M] – C:\Users\Darren\AppData\Roaming\Research In Motion
[2009/12/02 01:25:03 | 00,000,000 | —D | M] – C:\Users\Darren\AppData\Roaming\Samsung
[2009/10/27 20:07:54 | 00,000,000 | —D | M] – C:\Users\Darren\AppData\Roaming\Windows Live Writer
[2009/11/25 10:29:34 | 00,032,630 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

< End of report >

LDTate

Post #51December 7, 2009, 10:36 PM UTC

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:filefind
atapi.sys
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

davey_weir

Post #52December 7, 2009, 11:58 PM UTC

Thanks Tate The results are: SystemLook v1.0 by jpshortstuff (29.08.09) Log created at 23:56 on 07/12/2009 by Darren (Administrator - Elevation successful) ========== filefind ========== Searching for "atapi.sys" C:\Windows\ERDNT\cache\atapi.sys –a— 21584 bytes [00:48 06/12/2009] [14:36 01/12/2009] 80C40F7FDFC376E4C5FEEC28B41C119E C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_b27d5421375ad1cd\atapi.sys –a— 21584 bytes [03:08 22/04/2009] [05:24 22/04/2009] 80C40F7FDFC376E4C5FEEC28B41C119E C:\Windows\System32\drivers\atapi.sys –a— 21584 bytes [03:08 22/04/2009] [14:36 01/12/2009] 80C40F7FDFC376E4C5FEEC28B41C119E C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7100.0_none_4e2b207b769f9fe5\atapi.sys –a— 21584 bytes [03:08 22/04/2009] [05:24 22/04/2009] 80C40F7FDFC376E4C5FEEC28B41C119E -=End Of File=-

LDTate

Post #53December 8, 2009, 1:04 AM UTC

I'm checking with the pros as to our next step.

davey_weir

Post #54December 8, 2009, 1:08 AM UTC

Much appreciated. It is still happening. I have just had to click a search result 14 times before it took me to the site I wished to visit!

LDTate

Post #55December 8, 2009, 1:42 AM UTC last edited December 8, 2009, 12:37 PM UTC

Lets give this a shot.

Open Notepad and copy/paste the entire contents of the quotebox below into Notepad:

@echo off
copy /y C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_b27d5421375ad1cd\atapi.sys c:\
quit

Save this Notepad file as replace.bat and choose to Save as type: - All Files then close the Notepad file.
It should look like this: [external image: Posted Image]

Double-click on replace.bat to run it. A DOS window will open and close again, this is normal. Please delete the file afterwards.

Next:

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:filefind
atapi.sys
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

davey_weir

Post #56December 8, 2009, 8:41 PM UTC

SystemLook v1.0 by jpshortstuff (29.08.09) Log created at 20:39 on 08/12/2009 by Darren (Administrator - Elevation successful) ========== filefind ========== Searching for "atapi.sys" C:\atapi.sys –a— 21584 bytes [20:38 08/12/2009] [05:24 22/04/2009] 80C40F7FDFC376E4C5FEEC28B41C119E C:\Windows\ERDNT\cache\atapi.sys –a— 21584 bytes [00:48 06/12/2009] [14:36 01/12/2009] 80C40F7FDFC376E4C5FEEC28B41C119E C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_b27d5421375ad1cd\atapi.sys –a— 21584 bytes [03:08 22/04/2009] [05:24 22/04/2009] 80C40F7FDFC376E4C5FEEC28B41C119E C:\Windows\System32\drivers\atapi.sys –a— 21584 bytes [03:08 22/04/2009] [14:36 01/12/2009] 80C40F7FDFC376E4C5FEEC28B41C119E C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7100.0_none_4e2b207b769f9fe5\atapi.sys –a— 21584 bytes [03:08 22/04/2009] [05:24 22/04/2009] 80C40F7FDFC376E4C5FEEC28B41C119E -=End Of File=-

LDTate

Post #57December 9, 2009, 1:07 AM UTC last edited December 9, 2009, 1:09 AM UTC

Print this out.

Reboot your computer and as Windows starts
Tap F8 and select Repair your computer. Then select Command Prompt.

At the C:\ type in the following

copy c:\atapi.sys c:\windows\system32\drivers\atapi.sys

You should see a message '1 file copied'. If you did not see that message, try again and ensure there is a space after the word copy and another space between the file paths.

davey_weir

Post #58December 10, 2009, 9:52 PM UTC

Hi Tate I did the above step and indeed the 1 file copied was shown. However, this did not solve the issue, so…… Being completely p***ed off I did a clean install of Windows 7 and result! No directrdr.com! Thanks for all of your efforts though Tate, I really appreciate it.

LDTate

Post #59December 10, 2009, 9:59 PM UTC

We already have a fix for this with XP and Vista. We are still working on a fix for Windows 7. We understand your frustration. Sorry we didn't have the Windows 7 fix yet. You're more then welcome. Peace be with you

LDTate

Post #60December 12, 2009, 6:47 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

[Resolved] Google hijacked by directrdr.com - AVG, Malwarebytes and Ad

✨ Ask AI

Ask AI