[Resolved] win32Trojan-gen help plz

lisafunkypants Topic Starter

Post #1December 12, 2009, 4:25 PM UTC

Hi All
done the self help stuff but Avast is still coming up with this trojan, which is in D:\System Volume information but i cant find the folder or the .exe file its in, i also have a HTML Script-inf in a password protected account which has been previously deleted.

Comp is really slow and has frozen with trails from the window across the screen.
I would be extremely gratefull for any help

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:42:52, on 12/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16945)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\IObit\IObit Security 360\IS360srv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
C:\Apps\Powercinema\PCMService.exe
C:\apps\ABoard\ABoard.exe
C:\apps\ABoard\AOSD.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\IObit\IObit Security 360\IS360tray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\STK02N\STK02NM.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\IObit\IObit Security 360\is360.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kibagames.com/Game/Boys/Spiderman_Dress_Up
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [EmailChecker] C:\APPS\EmailChecker\ech.exe
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [IObit Security 360] "C:\Program Files\IObit\IObit Security 360\IS360tray.exe" /autostart
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-21-3965977090-3551812889-490671574-1007\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'leah')
O4 - HKUS\S-1-5-21-3965977090-3551812889-490671574-1007\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'leah')
O4 - HKUS\S-1-5-21-3965977090-3551812889-490671574-1007\..\Run: [Google Update] "D:\Documents and Settings\leah.048919120306.000\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c (User 'leah')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE (User 'SYSTEM')
O4 - S-1-5-18 Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE (User 'Default user')
O4 - .DEFAULT Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: STK02N 2.3 PNP Monitor.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)
O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\uk.htm
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

–
End of file - 10926 bytes

Malwarebytes' Anti-Malware 1.42
Database version: 3349
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

12/12/2009 16:22:05
mbam-log-2009-12-12 (16-22-05).txt

Scan type: Quick Scan
Objects scanned: 560875
Time elapsed: 1 hour(s), 36 minute(s), 34 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

oldman960

Post #2December 13, 2009, 7:27 PM UTC

Hi lisfunkypants, welcome to the forum.

To make cleaning this machine easier

Please do not uninstall/install any programs unless asked to
It is more difficult when files/programs are appearing in/disappearing from the logs.
Please do not run any scans other than those requested
Please follow all instructions in the order posted
All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
Do not attach any logs/reports, etc.. unless specifically requested to do so.
If you have problems with or do not understand the instructions, Please ask before continuing.
Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

That dection is in an old System Restore point. We'll worry about that later as it's harmless unless you use System Restore to return to that point.

Download OTL to your desktop.

Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
Check the boxes beside LOP Check and Purity Check.
Copy and paste the bold text into the window under Custom Scan
netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
/md5stop
%systemroot%\*. /mp /s
CREATERESTOREPOINT
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

Thanks

lisafunkypants

Post #3December 13, 2009, 9:39 PM UTC

OTL logfile created on: 13/12/2009 21:28:52 - Run 1
OTL by OldTimer - Version 3.1.17.0 Folder = D:\Documents and Settings\bailey.048919120306\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1023.48 Mb Total Physical Memory | 433.35 Mb Available Physical Memory | 42.34% Memory free
2.40 Gb Paging File | 1.85 Gb Available in Paging File | 76.95% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 29.99 Gb Total Space | 9.87 Gb Free Space | 32.91% Space Free | Partition Type: NTFS
Drive D: | 113.04 Gb Total Space | 12.93 Gb Free Space | 11.44% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: 048919120306
Current User Name: bailey
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - D:\Documents and Settings\bailey.048919120306\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
PRC - C:\Program Files\IObit\IObit Security 360\is360.exe (IObit)
PRC - C:\Program Files\IObit\IObit Security 360\is360tray.exe (IObit)
PRC - C:\Program Files\IObit\IObit Security 360\is360srv.exe (IObit)
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\STK02N\STK02NM.exe (Syntek Ltd.)
PRC - C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
PRC - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe (Cyberlink)
PRC - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe (Cyberlink)
PRC - c:\APPS\Powercinema\Kernel\TV\CLSched.exe ()
PRC - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe ()
PRC - C:\APPS\Powercinema\PCMService.exe (CyberLink Corp.)
PRC - c:\APPS\HIDSERVICE\HidService.exe ()
PRC - C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe (Ulead Systems, Inc.)
PRC - C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe (America Online, Inc.)
PRC - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)
PRC - C:\Program Files\SpywareGuard\sgmain.exe ()
PRC - C:\Program Files\SpywareGuard\sgbhp.exe ()
PRC - C:\WINDOWS\system32\slserv.exe ( )
PRC - C:\APPS\ABOARD\ABOARD.EXE (NEC Computers International)
PRC - C:\APPS\ABOARD\AOSD.EXE (NEC Computers International)

========== Modules (SafeList) ==========

MOD - D:\Documents and Settings\bailey.048919120306\My Documents\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\sxs.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msvbvm60.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\linkinfo.dll (Microsoft Corporation)
MOD - C:\Program Files\SpywareGuard\spywareguard.dll ()

========== Win32 Services (SafeList) ==========

SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
SRV - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
SRV - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
SRV - (aswUpdSv) – C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
SRV - (IS360service) – C:\Program Files\IObit\IObit Security 360\is360srv.exe (IObit)
SRV - (iPod Service) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (NVSvc) – C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation)
SRV - (getPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (fsssvc) – C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Bonjour Service) – C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (gusvc) – C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)
SRV - (CyberLink Media Library Service) – C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe (Cyberlink)
SRV - (CLSched) CyberLink Task Scheduler (CTS) – c:\APPS\Powercinema\Kernel\TV\CLSched.exe ()
SRV - (CLCapSvc) CyberLink Background Capture Service (CBCS) – c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe ()
SRV - (GenericHidService) – c:\APPS\HIDSERVICE\HidService.exe ()
SRV - (AOL ACS) – C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe (America Online, Inc.)
SRV - (UleadBurningHelper) – C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)
SRV - (SLService) – C:\WINDOWS\System32\slserv.exe ( )

========== Driver Services (SafeList) ==========

DRV - (aswMon2) – C:\WINDOWS\system32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswSP) – C:\WINDOWS\system32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswFsBlk) – C:\WINDOWS\system32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (aswTdi) – C:\WINDOWS\system32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswRdr) – C:\WINDOWS\system32\drivers\aswRdr.sys (ALWIL Software)
DRV - (Aavmker4) – C:\WINDOWS\system32\drivers\aavmker4.sys (ALWIL Software)
DRV - (USBAAPL) – C:\WINDOWS\system32\drivers\usbaapl.sys (Apple, Inc.)
DRV - (fssfltr) – C:\WINDOWS\system32\drivers\fssfltr_tdi.sys (Microsoft Corporation)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (GEARAspiWDM) – C:\WINDOWS\system32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (PxHelp20) – C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (adfs) – C:\WINDOWS\system32\drivers\adfs.sys (Adobe Systems, Inc.)
DRV - (amdagp) – C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) – C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (Secdrv) – C:\WINDOWS\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (DCamUSBSTK02N) – C:\WINDOWS\system32\drivers\STK02NW2.sys (Syntek Ltd.)
DRV - (Afc) – C:\WINDOWS\system32\drivers\afc.sys (Arcsoft, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (Ptilink) – C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.)
DRV - (RecAgent) – C:\WINDOWS\system32\drivers\RecAgent.sys (Smart Link)
DRV - (HdAudAddService) – C:\WINDOWS\system32\drivers\Hdaudio.sys (Windows ® Server 2003 DDK provider)
DRV - (RTL8023) – C:\WINDOWS\system32\drivers\Rtlnic51.sys (Realtek Semiconductor Corporation )
DRV - (Slntamr) – C:\WINDOWS\system32\drivers\slntamr.sys ( )
DRV - (Mtlmnt5) – C:\WINDOWS\system32\drivers\mtlmnt5.sys ( )
DRV - (Mtlstrm) – C:\WINDOWS\system32\drivers\mtlstrm.sys ( )
DRV - (SlNtHal) – C:\WINDOWS\system32\drivers\slnthal.sys ( )
DRV - (SlWdmSup) – C:\WINDOWS\system32\drivers\slwdmsup.sys (Vireo Software)
DRV - (NtMtlFax) – C:\WINDOWS\system32\drivers\ntmtlfax.sys ( )
DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)
DRV - (Sparrow) – C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) – C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) – C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) – C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) – C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (SONYPVU1) Sony USB Filter Driver (SONYPVU1) – C:\WINDOWS\system32\drivers\SONYPVU1.SYS (Sony Corporation)
DRV - (ultra) – C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) – C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) – C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) – C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) – C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) – C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) – C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) – C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) – C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (CmdIde) – C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.kibagames.com/Game/Boys/Spiderman_Dress_Up
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 48
FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.2
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20091028

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/12/03 19:37:15 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/12/03 20:28:28 | 00,000,000 | —D | M]

[2009/08/29 20:15:23 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\Mozilla\Extensions
[2009/08/28 13:35:45 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\Mozilla\Extensions\[removed]
[2009/12/13 11:38:07 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\Mozilla\Firefox\Profiles\tvsl80k7.default\extensions
[2009/11/24 10:44:37 | 00,000,000 | —D | M] (FEBE) – D:\Documents and Settings\bailey.048919120306\Application Data\Mozilla\Firefox\Profiles\tvsl80k7.default\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2009/11/06 14:05:28 | 00,000,000 | —D | M] (WOT) – D:\Documents and Settings\bailey.048919120306\Application Data\Mozilla\Firefox\Profiles\tvsl80k7.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2009/10/10 15:45:11 | 00,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – D:\Documents and Settings\bailey.048919120306\Application Data\Mozilla\Firefox\Profiles\tvsl80k7.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2009/10/10 15:18:31 | 00,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – D:\Documents and Settings\bailey.048919120306\Application Data\Mozilla\Firefox\Profiles\tvsl80k7.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}(2)
[2009/12/13 11:38:07 | 00,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/07/17 08:40:12 | 00,704,512 | —- | M] (BitComet) – C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2009/03/24 11:10:44 | 00,114,688 | —- | M] (Zylom) – C:\Program Files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
[2009/11/09 19:36:36 | 00,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2009/11/09 19:36:36 | 00,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2009/11/09 19:36:37 | 00,000,769 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2009/11/09 19:36:37 | 00,000,831 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: (27 bytes) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (SpywareGuardDLBLOCK.CBrowserHelper) - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll ()
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (WOT Helper) - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (WOT) - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O4 - HKLM..\Run: [ACTIVBOARD] c:\APPS\ABOARD\ABOARD.EXE (NEC Computers International)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [EmailChecker] C:\APPS\EmailChecker\ech.exe (NEC Computers International)
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\Hdaudpropshortcut.exe (Windows ® Server 2003 DDK provider)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [IObit Security 360] C:\Program Files\IObit\IObit Security 360\IS360tray.exe (IObit)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [PCMService] c:\Apps\Powercinema\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe (Ulead Systems, Inc.)
O4 - Startup: D:\Documents and Settings\All Users\Start Menu\Programs\Startup\STK02N 2.3 PNP Monitor.lnk = C:\WINDOWS\STK02N\STK02NM.exe (Syntek Ltd.)
O4 - Startup: D:\Documents and Settings\bailey.048919120306\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O4 - Startup: D:\Documents and Settings\bailey.048919120306\Start Menu\Programs\Startup\SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog; This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: 33 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wot {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {81559C35-8464-49F7-BB0E-07A383BEF910} - C:\Program Files\SpywareGuard\spywareguard.dll ()
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{026c61f6-ab5f-11de-bd66-00038a000015}\Shell\AutoRun\command - "" = F:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\usb.exe – File not found
O33 - MountPoints2\{026c61f6-ab5f-11de-bd66-00038a000015}\Shell\open\command - "" = F:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\usb.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2009/12/10 00:05:20 | 00,017,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spmsg.dll
[2009/12/03 19:35:29 | 00,000,000 | -HSD | C] – C:\Config.Msi
[2009/12/02 16:48:53 | 00,000,000 | —D | C] – C:\divx
[2009/12/02 16:30:20 | 00,000,000 | —D | C] – C:\WINDOWS\System32\drivers\umdf
[2009/12/02 16:28:57 | 00,974,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mfc70.dll
[2009/12/02 16:28:56 | 00,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msxml3a.dll
[2009/11/27 20:51:07 | 00,023,120 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2009/11/27 20:51:06 | 00,048,560 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2009/11/27 20:51:06 | 00,027,408 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2009/11/27 20:51:04 | 00,097,480 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\AvastSS.scr
[2009/11/27 20:51:03 | 00,114,768 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2009/11/27 20:51:03 | 00,094,160 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2009/11/27 20:51:03 | 00,093,424 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2009/11/27 20:51:03 | 00,020,560 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2009/11/27 20:50:44 | 01,280,480 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\aswBoot.exe
[2009/11/26 18:29:50 | 00,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2009/11/26 18:29:50 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2009/11/26 18:29:50 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2005/10/17 19:17:53 | 00,014,976 | —- | C] ( ) – C:\WINDOWS\System32\drivers\winddx.sys
[1979/12/31 23:00:00 | 01,301,128 | —- | C] ( ) – C:\WINDOWS\System32\drivers\mtlstrm.sys
[1979/12/31 23:00:00 | 00,548,952 | —- | C] ( ) – C:\WINDOWS\System32\drivers\slntamr.sys
[1979/12/31 23:00:00 | 00,221,736 | —- | C] ( ) – C:\WINDOWS\System32\drivers\mtlmnt5.sys
[1979/12/31 23:00:00 | 00,167,384 | —- | C] ( ) – C:\WINDOWS\System32\drivers\ntmtlfax.sys
[1979/12/31 23:00:00 | 00,086,128 | —- | C] ( ) – C:\WINDOWS\System32\drivers\slnthal.sys
[7 C:\WINDOWS\Fonts\*.tmp files -> C:\WINDOWS\Fonts\*.tmp -> ]
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[261 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2009/12/13 20:36:00 | 00,001,006 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3965977090-3551812889-490671574-1007UA.job
[2009/12/13 19:30:00 | 00,000,252 | —- | M] () – C:\WINDOWS\tasks\Setup my PC.job
[2009/12/13 14:36:00 | 00,000,954 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3965977090-3551812889-490671574-1007Core.job
[2009/12/13 11:03:09 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/12/13 11:02:58 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/12/12 23:49:16 | 04,456,448 | —- | M] () – D:\Documents and Settings\bailey.048919120306\ntuser.dat
[2009/12/12 23:49:16 | 00,000,178 | -HS- | M] () – D:\Documents and Settings\bailey.048919120306\ntuser.ini
[2009/12/12 23:48:49 | 10,722,786 | -H– | M] () – D:\Documents and Settings\bailey.048919120306\Local Settings\Application Data\IconCache.db
[2009/12/10 18:57:03 | 00,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/12/10 14:19:19 | 00,442,544 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2009/12/10 14:19:19 | 00,072,178 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2009/12/10 14:19:18 | 00,521,766 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2009/12/10 00:06:06 | 00,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[2009/12/06 03:48:00 | 00,000,456 | —- | M] () – C:\WINDOWS\tasks\Driver Robot.job
[2009/12/03 16:14:06 | 00,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/12/03 16:13:56 | 00,019,160 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/12/02 17:49:23 | 00,081,920 | —- | M] (Realtek Semiconductor Corp.) – C:\WINDOWS\ALCFDRTM.VER
[2009/12/02 17:00:59 | 00,009,728 | —- | M] () – D:\Documents and Settings\bailey.048919120306\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/02 16:30:26 | 00,316,640 | —- | M] () – C:\WINDOWS\WMSysPr9.prx
[2009/12/01 15:28:59 | 00,059,576 | -H– | M] () – C:\WINDOWS\System32\mlfcache.dat
[2009/12/01 14:36:56 | 00,000,923 | —- | M] () – C:\WINDOWS\win.ini
[2009/11/27 20:51:03 | 00,002,626 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2009/11/26 13:54:14 | 00,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2009/11/25 23:05:21 | 00,000,030 | —- | M] () – C:\WINDOWS\iedit.INI
[2009/11/24 23:54:29 | 01,280,480 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\aswBoot.exe
[2009/11/24 23:51:09 | 00,093,424 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2009/11/24 23:50:59 | 00,094,160 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2009/11/24 23:50:12 | 00,114,768 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2009/11/24 23:50:00 | 00,020,560 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2009/11/24 23:49:07 | 00,048,560 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2009/11/24 23:48:57 | 00,023,120 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2009/11/24 23:47:54 | 00,027,408 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2009/11/24 23:47:28 | 00,097,480 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\AvastSS.scr
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[261 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2009/11/27 20:50:50 | 00,380,928 | —- | C] () – C:\WINDOWS\System32\actskin4.ocx
[2009/11/12 20:19:52 | 00,000,000 | —- | C] () – C:\WINDOWS\webica.ini
[2009/10/17 15:08:37 | 00,002,516 | -HS- | C] () – D:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
[2009/10/17 15:08:37 | 00,000,088 | RHS- | C] () – D:\Documents and Settings\All Users\Application Data\E5EC4FC83E.sys
[2009/10/06 09:56:05 | 00,000,000 | —- | C] () – C:\WINDOWS\angelinaballerina.ini
[2009/08/27 12:45:36 | 00,009,728 | —- | C] () – D:\Documents and Settings\bailey.048919120306\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/25 22:59:59 | 00,000,030 | —- | C] () – C:\WINDOWS\iedit.INI
[2009/08/21 01:33:39 | 00,073,712 | —- | C] () – D:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2009/08/19 09:23:56 | 00,012,288 | —- | C] () – C:\WINDOWS\impborl.dll
[2008/08/11 12:29:27 | 00,000,000 | —- | C] () – D:\Documents and Settings\All Users\Application Data\LauncherAccess.dt
[2007/03/02 17:37:51 | 00,033,460 | —- | C] () – D:\Documents and Settings\All Users\Application Data\Svclog.log
[2005/10/17 21:33:24 | 00,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2005/10/17 20:31:23 | 00,198,144 | —- | C] () – C:\WINDOWS\System32\_psisdecd.dll
[2005/10/17 19:38:47 | 00,000,514 | —- | C] () – C:\WINDOWS\System32\SETUPPC.INI
[2005/10/17 19:33:02 | 00,007,584 | —- | C] () – C:\WINDOWS\HDReg.ini
[2005/10/17 19:17:53 | 00,475,136 | —- | C] () – C:\WINDOWS\System32\SLLights.dll
[2005/10/17 19:17:53 | 00,155,648 | —- | C] () – C:\WINDOWS\System32\amr_cpl.dll
[2005/10/17 19:17:53 | 00,135,168 | —- | C] () – C:\WINDOWS\System32\SLMOHServ.dll
[2005/05/20 13:05:02 | 00,005,606 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2004/08/10 16:13:32 | 00,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/10 15:38:10 | 01,290,752 | —- | C] () – C:\WINDOWS\System32\quartz(2).dll
[2004/08/10 15:37:59 | 00,014,336 | —- | C] () – C:\WINDOWS\System32\msdmo(2).dll
[2004/08/10 15:37:40 | 00,059,904 | —- | C] () – C:\WINDOWS\System32\devenum(2).dll
[2004/06/23 13:14:44 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/03/24 08:22:26 | 00,138,396 | —- | C] () – C:\WINDOWS\System32\drivers\PFC027.SYS
[2004/01/08 09:30:22 | 00,011,170 | —- | C] () – C:\WINDOWS\System32\PA207USD.DLL
[1979/12/31 23:00:00 | 00,540,672 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[1979/12/31 23:00:00 | 00,188,416 | —- | C] () – C:\WINDOWS\System32\slextspk.dll
[1979/12/31 23:00:00 | 00,159,744 | —- | C] () – C:\WINDOWS\System32\SLGen.dll
[1979/12/31 23:00:00 | 00,049,152 | —- | C] () – C:\WINDOWS\System32\coinst.dll

========== LOP Check ==========

[2009/12/06 03:48:00 | 00,000,456 | —- | M] () – C:\WINDOWS\Tasks\Driver Robot.job
[2009/12/13 19:30:00 | 00,000,252 | —- | M] () – C:\WINDOWS\Tasks\Setup my PC.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2008/04/13 18:36:38 | 00,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ERDNT\cache\agp440.sys
[2008/04/13 18:36:38 | 00,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 18:36:38 | 00,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/03 22:07:42 | 00,042,368 | —- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB – C:\WINDOWS\$NtServicePackUninstall$\agp440.sys

< MD5 for: ATAPI.SYS >
[2008/04/13 18:40:30 | 00,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 18:40:30 | 00,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 21:59:44 | 00,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 00:11:53 | 00,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008/04/14 00:11:53 | 00,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/14 00:11:53 | 00,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll
[2004/08/04 13:00:00 | 00,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/14 00:12:01 | 00,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008/04/14 00:12:01 | 00,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/14 00:12:01 | 00,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll
[2009/02/06 18:46:09 | 00,408,064 | —- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 – C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
[2004/08/04 13:00:00 | 00,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 13:00:00 | 00,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/14 00:12:05 | 00,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ERDNT\cache\scecli.dll
[2008/04/14 00:12:05 | 00,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/14 00:12:05 | 00,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

========== Alternate Data Streams ==========

@Alternate Data Stream - 173 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:567D3254
@Alternate Data Stream - 161 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:68FB0053
@Alternate Data Stream - 152 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:6B520784
@Alternate Data Stream - 152 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:63596073
@Alternate Data Stream - 152 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:5E3B85EF
@Alternate Data Stream - 147 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:E9A4C114
@Alternate Data Stream - 147 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:766442E5
@Alternate Data Stream - 145 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:BC9021B2
@Alternate Data Stream - 145 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:3D857D30
@Alternate Data Stream - 145 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:2164CF08
@Alternate Data Stream - 145 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:0725B4DA
@Alternate Data Stream - 141 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:38D53DB8
@Alternate Data Stream - 140 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:15C56B30
@Alternate Data Stream - 139 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:5D52AB7A
@Alternate Data Stream - 137 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:EDDEC855
@Alternate Data Stream - 137 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:148EE14E
@Alternate Data Stream - 136 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:A98B12D4
@Alternate Data Stream - 135 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:6D6C4572
@Alternate Data Stream - 131 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:5E22637F
@Alternate Data Stream - 130 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:8B0F52E5
@Alternate Data Stream - 130 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:64DD1889
@Alternate Data Stream - 125 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:CA84168C
@Alternate Data Stream - 125 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
@Alternate Data Stream - 125 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:1CB8D545
@Alternate Data Stream - 124 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:F1FF5647
@Alternate Data Stream - 124 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:73828A71
@Alternate Data Stream - 124 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:2B99FE60
@Alternate Data Stream - 123 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:96FAC731
@Alternate Data Stream - 123 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:615435BE
@Alternate Data Stream - 123 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:47BE4EDF
@Alternate Data Stream - 121 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:52562F72
@Alternate Data Stream - 120 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:F951183D
@Alternate Data Stream - 118 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:435657D8
@Alternate Data Stream - 117 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:F69BB936
@Alternate Data Stream - 117 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:D37AE80B
@Alternate Data Stream - 117 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:74699137
@Alternate Data Stream - 114 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:78CC8F21
@Alternate Data Stream - 114 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:3CF23EC3
@Alternate Data Stream - 114 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:0AA21473
@Alternate Data Stream - 113 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:A2F5F542
@Alternate Data Stream - 112 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:3BB21850
@Alternate Data Stream - 111 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:B19CC382
@Alternate Data Stream - 110 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:EAC3589E
@Alternate Data Stream - 110 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:9CF56DF4
@Alternate Data Stream - 110 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:27AD48A5
@Alternate Data Stream - 110 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:20DB22E7
@Alternate Data Stream - 108 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:45858237
@Alternate Data Stream - 108 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:0A051701
@Alternate Data Stream - 106 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:C6798065
@Alternate Data Stream - 106 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:949483BD
@Alternate Data Stream - 100 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:C4A1F01E
< End of report >

——————————————————————————————————————————————————————————-

OTL Extras logfile created on: 13/12/2009 21:28:52 - Run 1
OTL by OldTimer - Version 3.1.17.0 Folder = D:\Documents and Settings\bailey.048919120306\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1023.48 Mb Total Physical Memory | 433.35 Mb Available Physical Memory | 42.34% Memory free
2.40 Gb Paging File | 1.85 Gb Available in Paging File | 76.95% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 29.99 Gb Total Space | 9.87 Gb Free Space | 32.91% Space Free | Partition Type: NTFS
Drive D: | 113.04 Gb Total Space | 12.93 Gb Free Space | 11.44% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: 048919120306
Current User Name: bailey
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.chm [@ = chm.file] – "%SYSTEMROOT%\hh.exe" %1
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
chm.file [open] – "%SYSTEMROOT%\hh.exe" %1
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
htmlfile [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
http [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "%programfiles%\internet explorer\iexplore.exe"

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"18202:TCP" = 18202:TCP:*:Enabled:BitComet 18202 TCP
"18202:UDP" = 18202:UDP:*:Enabled:BitComet 18202 UDP
"5353:TCP" = 5353:TCP:*:Enabled:Adobe CSI CS4

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%ProgramFiles%\AOL 9.0\aol.exe" = %ProgramFiles%\AOL 9.0\aol.exe:*:Enabled:AOL – File not found
"%ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\logo_ubi.exe" = %ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\logo_ubi.exe:*:Enabled:SPLINTER CELL PANDORA – File not found
"%ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\pandora.exe" = %ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\pandora.exe:*:Enabled:PANDORA – File not found
"C:\APPS\skype\phone\Skype.exe" = C:\APPS\skype\phone\Skype.exe:*:Enabled:Skype – ()
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync – (Microsoft Corporation)
"C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour – (Apple Inc.)
"C:\Program Files\Electronic Arts\EADM\Core.exe" = C:\Program Files\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager – (Electronic Arts)
"C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" = C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4 – (Adobe Systems Incorporated)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00ADFB20-AE75-46F4-AD2C-F48B15AC3100}" = Adobe Color NA Recommended Settings CS4
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}" = Adobe Setup
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{139E303E-1050-497F-98B1-9AE87B15C463}" = Windows Live Family Safety
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E16F01-2E2D-4248-A42F-76261C147B6C}" = Adobe Drive CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}" = Adobe AIR
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java™ 6 Update 17
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{40727DD3-9679-4D09-81D0-25F0017DF61C}" = ArcSoft VideoImpression 2
"{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}" = Microsoft Works
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4}" = Adobe Color EU Extra Settings CS4
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support
"{63E88B74-6BE9-4F21-BDE6-2EE21D031C3B}" = Mini-Cam USB Camera (SC-120)
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7D1D6A24-65D4-454C-8815-4F08A5FFF12C}" = Macromedia Shockwave Player
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}" = iTunes
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-7AD7-1033-7B44-A92000000001}" = Adobe Reader 9.2
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B2AE44CB-2AAB-4C08-A54B-D264BD604DA8}" = Citrix Presentation Server Client
"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = The Sims™ 3
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{DB6BD5D5-8482-45C0-99CF-745C5B924497}" = WOT for Internet Explorer
"{DC8C3C99-E373-483B-B179-0D0DB11DE1B3}" = Angelina Ballerina
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E42E07F5-5A90-4BA9-B55A-79FCF9EAF9B5}" = STK02N 2.3
"{E4848436-0345-47E2-B648-8B522FCDA623}" = Adobe Photoshop CS4
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe_faf656ef605427ee2f42989c3ad31b8" = Adobe Photoshop CS4
"Advanced SystemCare 3_is1" = Advanced SystemCare 3
"avast!" = avast! Antivirus
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.3
"AVS4YOU Video Converter 6_is1" = AVS Video Converter 6
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"EADM" = EA Download Manager
"ERUNT_is1" = ERUNT 1.1j
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"Free Studio_is1" = Free Studio version 4.2
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"iMesh" = iMesh
"InstallShield_{63E88B74-6BE9-4F21-BDE6-2EE21D031C3B}" = Mini-Cam USB Camera (SC-120)
"IObit Security 360_is1" = IObit Security 360
"Living 3D Dolphins Full Screen Saver" = Living 3D Dolphins Full Screen Saver
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Messenger Plus! Live" = Messenger Plus! Live
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.5.5)" = Mozilla Firefox (3.5.5)
"MSNINST" = MSN
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"Picasa 3" = Picasa 3
"Solar System 3D Screensaver_is1" = Solar System 3D Screensaver 1.4
"SpywareBlaster_is1" = SpywareBlaster 4.2
"SpywareGuard_is1" = SpywareGuard v2.2
"SystemRequirementsLab" = System Requirements Lab
"Uninstall_is1" = Uninstall 1.0.0.1
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 10
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WMFDist11" = Windows Media Format 11 runtime
"Zylom Games Player Plugin" = Zylom Games Player Plugin

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 19/10/2009 10:35:40 | Computer Name = 048919120306 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 20/10/2009 10:17:07 | Computer Name = 048919120306 | Source = MsiInstaller | ID = 10005
Description = Product: Adobe Setup – Please install Adobe Setup using Setup.exe

Error - 27/10/2009 21:05:30 | Computer Name = 048919120306 | Source = IS360srv.exe | ID = 0
Description =

Error - 30/10/2009 06:32:32 | Computer Name = 048919120306 | Source = Application Error | ID = 1000
Description = Faulting application msnmsgr.exe, version 14.0.8089.726, faulting
module kernel32.dll, version 5.1.2600.5781, fault address 0x00012afb.

Error - 30/10/2009 06:33:22 | Computer Name = 048919120306 | Source = Application Error | ID = 1000
Description = Faulting application msnmsgr.exe, version 14.0.8089.726, faulting
module kernel32.dll, version 5.1.2600.5781, fault address 0x00012afb.

Error - 30/10/2009 06:33:41 | Computer Name = 048919120306 | Source = Application Error | ID = 1000
Description = Faulting application msnmsgr.exe, version 14.0.8089.726, faulting
module kernel32.dll, version 5.1.2600.5781, fault address 0x00012afb.

Error - 17/11/2009 17:46:26 | Computer Name = 048919120306 | Source = Application Error | ID = 1000
Description = Faulting application firefox.exe, version 1.9.1.3593, faulting module
unknown, version 0.0.0.0, fault address 0x00020066.

Error - 26/11/2009 17:35:08 | Computer Name = 048919120306 | Source = Application Error | ID = 1000
Description = Faulting application wlcomm.exe, version 14.0.8064.206, faulting module
kernel32.dll, version 5.1.2600.5781, fault address 0x00012afb.

Error - 01/12/2009 08:49:23 | Computer Name = 048919120306 | Source = Application Error | ID = 1000
Description = Faulting application imesh.exe, version 9.1.0.0, faulting module imesh.exe,
version 9.1.0.0, fault address 0x00a2f8cd.

Error - 01/12/2009 09:18:30 | Computer Name = 048919120306 | Source = Application Error | ID = 1000
Description = Faulting application imesh.exe, version 9.1.0.0, faulting module imesh.exe,
version 9.1.0.0, fault address 0x00a2f8cd.

[ System Events ]
Error - 05/12/2009 23:45:59 | Computer Name = 048919120306 | Source = DCOM | ID = 10010
Description = The server {DC0C2640-1415-4644-875C-6F4D769839BA} did not register
with DCOM within the required timeout.

Error - 05/12/2009 23:46:35 | Computer Name = 048919120306 | Source = DCOM | ID = 10010
Description = The server {DC0C2640-1415-4644-875C-6F4D769839BA} did not register
with DCOM within the required timeout.

Error - 05/12/2009 23:47:11 | Computer Name = 048919120306 | Source = DCOM | ID = 10010
Description = The server {DC0C2640-1415-4644-875C-6F4D769839BA} did not register
with DCOM within the required timeout.

Error - 05/12/2009 23:47:47 | Computer Name = 048919120306 | Source = DCOM | ID = 10010
Description = The server {DC0C2640-1415-4644-875C-6F4D769839BA} did not register
with DCOM within the required timeout.

Error - 05/12/2009 23:48:23 | Computer Name = 048919120306 | Source = DCOM | ID = 10010
Description = The server {DC0C2640-1415-4644-875C-6F4D769839BA} did not register
with DCOM within the required timeout.

Error - 05/12/2009 23:48:58 | Computer Name = 048919120306 | Source = DCOM | ID = 10010
Description = The server {DC0C2640-1415-4644-875C-6F4D769839BA} did not register
with DCOM within the required timeout.

Error - 07/12/2009 13:24:30 | Computer Name = 048919120306 | Source = DCOM | ID = 10010
Description = The server {DC0C2640-1415-4644-875C-6F4D769839BA} did not register
with DCOM within the required timeout.

Error - 08/12/2009 17:38:16 | Computer Name = 048919120306 | Source = DCOM | ID = 10010
Description = The server {DC0C2640-1415-4644-875C-6F4D769839BA} did not register
with DCOM within the required timeout.

Error - 09/12/2009 18:33:47 | Computer Name = 048919120306 | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the Netman service.

Error - 11/12/2009 20:53:43 | Computer Name = 048919120306 | Source = DCOM | ID = 10010
Description = The server {DC0C2640-1415-4644-875C-6F4D769839BA} did not register
with DCOM within the required timeout.

< End of report >

oldman960

Post #4December 14, 2009, 12:08 AM UTC

Hi lisafunkypants,

IMesh

Do you actually use this program? It's full of adware, plus it's a P2P program.

P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

References for the risk of these programs can be found in these links:
http://www.microsoft.com/windows/ie/commun…protection.mspx

http://www.internetworldstats.com/articles…cles/art053.htm

I would recommend that you uninstall IMesh, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.

IObit Security 360

In light of this, I don't think you will be getting the proection you thought you might be.

…….IObit did subsequently remove all of Malwarebytes' definitions from their database (thereby cutting their database size by ~40% in one fell swoop). …….

…….IObit's in-the-wild detection rates dropped from over 70% to under 20% overnight after removing Malwarebytes' definitions from their database…….

http://www.malwarebytes.org/forums/index.php?showtopic=33217

I suggest you uninstall it. You all ready have a resident antispyware program running.

Open hijackthis, do a system scan only and checkmark these lines, if present

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

Close ALL other windows/browsers and click Fix Checked. Answer Yes if prompted. Close HJT.

There are some traces of Norton (Symantec) in your logs.

Download the Norton Removal Tool from HERE and save it to your desktop.

Next Double click on Norton_Removal_Tool.exe to run the tool.

Follow the on-screen instructions.
Your computer may be restarted more than once, and you may be asked to repeat some steps after the computer restarts.

You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

Click the Update tab
Click Check for Updates
If an update is found, it will download and install the latest version.
The program will close to update and reopen.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Please post back with

MBAM log
new OTL log, there will just be an OTL.txt this time.

Let us know about IMesh amd IOBit.

Thanks

lisafunkypants

Post #5December 14, 2009, 10:03 AM UTC

Malwarebytes' Anti-Malware 1.42
Database version: 3356
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

14/12/2009 08:14:27
mbam-log-2009-12-14 (08-14-27).txt

Scan type: Quick Scan
Objects scanned: 467824
Time elapsed: 1 hour(s), 15 minute(s), 3 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

———————————————–

OTL logfile created on: 14/12/2009 09:54:36 - Run 3
OTL by OldTimer - Version 3.1.17.0 Folder = D:\Documents and Settings\bailey.048919120306\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1023.48 Mb Total Physical Memory | 560.70 Mb Available Physical Memory | 54.78% Memory free
2.40 Gb Paging File | 1.96 Gb Available in Paging File | 81.73% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 29.99 Gb Total Space | 9.86 Gb Free Space | 32.89% Space Free | Partition Type: NTFS
Drive D: | 113.04 Gb Total Space | 12.83 Gb Free Space | 11.35% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: 048919120306
Current User Name: bailey
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - D:\Documents and Settings\bailey.048919120306\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\STK02N\STK02NM.exe (Syntek Ltd.)
PRC - C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
PRC - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe (Cyberlink)
PRC - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe (Cyberlink)
PRC - c:\APPS\Powercinema\Kernel\TV\CLSched.exe ()
PRC - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe ()
PRC - C:\APPS\Powercinema\PCMService.exe (CyberLink Corp.)
PRC - c:\APPS\HIDSERVICE\HidService.exe ()
PRC - C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe (Ulead Systems, Inc.)
PRC - C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe (America Online, Inc.)
PRC - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)
PRC - C:\Program Files\SpywareGuard\sgmain.exe ()
PRC - C:\Program Files\SpywareGuard\sgbhp.exe ()
PRC - C:\WINDOWS\system32\slserv.exe ( )
PRC - C:\APPS\ABOARD\ABOARD.EXE (NEC Computers International)
PRC - C:\APPS\ABOARD\AOSD.EXE (NEC Computers International)

========== Modules (SafeList) ==========

MOD - D:\Documents and Settings\bailey.048919120306\My Documents\Downloads\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
SRV - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
SRV - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
SRV - (aswUpdSv) – C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
SRV - (iPod Service) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (NVSvc) – C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation)
SRV - (getPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (fsssvc) – C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Bonjour Service) – C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (gusvc) – C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)
SRV - (CyberLink Media Library Service) – C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe (Cyberlink)
SRV - (CLSched) CyberLink Task Scheduler (CTS) – c:\APPS\Powercinema\Kernel\TV\CLSched.exe ()
SRV - (CLCapSvc) CyberLink Background Capture Service (CBCS) – c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe ()
SRV - (GenericHidService) – c:\APPS\HIDSERVICE\HidService.exe ()
SRV - (AOL ACS) – C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe (America Online, Inc.)
SRV - (UleadBurningHelper) – C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)
SRV - (SLService) – C:\WINDOWS\System32\slserv.exe ( )

========== Driver Services (SafeList) ==========

DRV - (aswMon2) – C:\WINDOWS\system32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswSP) – C:\WINDOWS\system32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswFsBlk) – C:\WINDOWS\system32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (aswTdi) – C:\WINDOWS\system32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswRdr) – C:\WINDOWS\system32\drivers\aswRdr.sys (ALWIL Software)
DRV - (Aavmker4) – C:\WINDOWS\system32\drivers\aavmker4.sys (ALWIL Software)
DRV - (USBAAPL) – C:\WINDOWS\system32\drivers\usbaapl.sys (Apple, Inc.)
DRV - (fssfltr) – C:\WINDOWS\system32\drivers\fssfltr_tdi.sys (Microsoft Corporation)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (GEARAspiWDM) – C:\WINDOWS\system32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (PxHelp20) – C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (adfs) – C:\WINDOWS\system32\drivers\adfs.sys (Adobe Systems, Inc.)
DRV - (amdagp) – C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) – C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (Secdrv) – C:\WINDOWS\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (DCamUSBSTK02N) – C:\WINDOWS\system32\drivers\STK02NW2.sys (Syntek Ltd.)
DRV - (Afc) – C:\WINDOWS\system32\drivers\afc.sys (Arcsoft, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (Ptilink) – C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.)
DRV - (RecAgent) – C:\WINDOWS\system32\drivers\RecAgent.sys (Smart Link)
DRV - (HdAudAddService) – C:\WINDOWS\system32\drivers\Hdaudio.sys (Windows ® Server 2003 DDK provider)
DRV - (RTL8023) – C:\WINDOWS\system32\drivers\Rtlnic51.sys (Realtek Semiconductor Corporation )
DRV - (Slntamr) – C:\WINDOWS\system32\drivers\slntamr.sys ( )
DRV - (Mtlmnt5) – C:\WINDOWS\system32\drivers\mtlmnt5.sys ( )
DRV - (Mtlstrm) – C:\WINDOWS\system32\drivers\mtlstrm.sys ( )
DRV - (SlNtHal) – C:\WINDOWS\system32\drivers\slnthal.sys ( )
DRV - (SlWdmSup) – C:\WINDOWS\system32\drivers\slwdmsup.sys (Vireo Software)
DRV - (NtMtlFax) – C:\WINDOWS\system32\drivers\ntmtlfax.sys ( )
DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)
DRV - (Sparrow) – C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) – C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) – C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) – C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) – C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (SONYPVU1) Sony USB Filter Driver (SONYPVU1) – C:\WINDOWS\system32\drivers\SONYPVU1.SYS (Sony Corporation)
DRV - (ultra) – C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) – C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) – C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) – C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) – C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) – C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) – C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) – C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) – C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (CmdIde) – C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3965977090-3551812889-490671574-1008\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.kibagames.com/Game/Boys/Spiderman_Dress_Up
IE - HKU\S-1-5-21-3965977090-3551812889-490671574-1008\S-1-5-21-3965977090-3551812889-490671574-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 48
FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.2
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20091028

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/12/03 19:37:15 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/12/03 20:28:28 | 00,000,000 | —D | M]

[2009/08/29 20:15:23 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\Mozilla\Extensions
[2009/08/28 13:35:45 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\Mozilla\Extensions\[removed]
[2009/12/13 11:38:07 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\Mozilla\Firefox\Profiles\tvsl80k7.default\extensions
[2009/11/24 10:44:37 | 00,000,000 | —D | M] (FEBE) – D:\Documents and Settings\bailey.048919120306\Application Data\Mozilla\Firefox\Profiles\tvsl80k7.default\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2009/11/06 14:05:28 | 00,000,000 | —D | M] (WOT) – D:\Documents and Settings\bailey.048919120306\Application Data\Mozilla\Firefox\Profiles\tvsl80k7.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2009/10/10 15:45:11 | 00,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – D:\Documents and Settings\bailey.048919120306\Application Data\Mozilla\Firefox\Profiles\tvsl80k7.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2009/10/10 15:18:31 | 00,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – D:\Documents and Settings\bailey.048919120306\Application Data\Mozilla\Firefox\Profiles\tvsl80k7.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}(2)
[2009/12/13 22:46:38 | 00,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/07/17 08:40:12 | 00,704,512 | —- | M] (BitComet) – C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2009/03/24 11:10:44 | 00,114,688 | —- | M] (Zylom) – C:\Program Files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
[2009/11/09 19:36:36 | 00,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2009/11/09 19:36:36 | 00,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2009/11/09 19:36:37 | 00,000,769 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2009/11/09 19:36:37 | 00,000,831 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: (27 bytes) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (SpywareGuardDLBLOCK.CBrowserHelper) - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll ()
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (WOT Helper) - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (WOT) - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKU\S-1-5-19\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-20\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-21-3965977090-3551812889-490671574-1008\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-21-3965977090-3551812889-490671574-1008\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKU\S-1-5-21-3965977090-3551812889-490671574-1008\..\Toolbar\WebBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O4 - HKLM..\Run: [ACTIVBOARD] c:\APPS\ABOARD\ABOARD.EXE (NEC Computers International)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [EmailChecker] C:\APPS\EmailChecker\ech.exe (NEC Computers International)
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\Hdaudpropshortcut.exe (Windows ® Server 2003 DDK provider)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [PCMService] c:\Apps\Powercinema\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe (Ulead Systems, Inc.)
O4 - Startup: D:\Documents and Settings\All Users\Start Menu\Programs\Startup\STK02N 2.3 PNP Monitor.lnk = C:\WINDOWS\STK02N\STK02NM.exe (Syntek Ltd.)
O4 - Startup: D:\Documents and Settings\bailey.048919120306\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O4 - Startup: D:\Documents and Settings\bailey.048919120306\Start Menu\Programs\Startup\SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe ()
O4 - Startup: D:\Documents and Settings\lisa.SN048919120306\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe (Leader Technologies)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3965977090-3551812889-490671574-1008\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3965977090-3551812889-490671574-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-3965977090-3551812889-490671574-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-3965977090-3551812889-490671574-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKU\S-1-5-21-3965977090-3551812889-490671574-1008_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog; This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\.DEFAULT\..Trusted Domains: 8 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-18\..Trusted Domains: 8 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-21-3965977090-3551812889-490671574-1008\..Trusted Domains: 33 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wot {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {81559C35-8464-49F7-BB0E-07A383BEF910} - C:\Program Files\SpywareGuard\spywareguard.dll ()
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{026c61f6-ab5f-11de-bd66-00038a000015}\Shell\AutoRun\command - "" = F:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\usb.exe – File not found
O33 - MountPoints2\{026c61f6-ab5f-11de-bd66-00038a000015}\Shell\open\command - "" = F:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\usb.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2009/12/12 00:00:23 | 00,000,000 | —D | C] – D:\Documents and Settings\All Users\Application Data\171A5
[2009/12/11 22:19:31 | 00,000,000 | —D | C] – D:\Documents and Settings\All Users\Application Data\BigFishGamesCache
[2009/12/10 00:05:20 | 00,017,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spmsg.dll
[2009/12/03 19:42:13 | 00,000,000 | —D | C] – C:\Program Files\iPod
[2009/12/03 19:42:01 | 00,000,000 | —D | C] – C:\Program Files\iTunes
[2009/12/03 19:35:29 | 00,000,000 | -HSD | C] – C:\Config.Msi
[2009/12/02 16:48:53 | 00,000,000 | —D | C] – C:\divx
[2009/12/02 16:33:04 | 00,000,000 | —D | C] – D:\Documents and Settings\bailey.048919120306\Application Data\AVS4YOU
[2009/12/02 16:32:58 | 00,000,000 | —D | C] – D:\Documents and Settings\All Users\Application Data\AVS4YOU
[2009/12/02 16:30:33 | 00,000,000 | —D | C] – C:\Program Files\Common Files\AVSMedia
[2009/12/02 16:30:20 | 00,000,000 | —D | C] – C:\WINDOWS\System32\drivers\umdf
[2009/12/02 16:28:57 | 00,974,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mfc70.dll
[2009/12/02 16:28:56 | 00,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msxml3a.dll
[2009/12/02 16:28:56 | 00,000,000 | —D | C] – C:\Program Files\AVS4YOU
[2009/11/27 20:51:07 | 00,023,120 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2009/11/27 20:51:06 | 00,048,560 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2009/11/27 20:51:06 | 00,027,408 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2009/11/27 20:51:04 | 00,097,480 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\AvastSS.scr
[2009/11/27 20:51:03 | 00,114,768 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2009/11/27 20:51:03 | 00,094,160 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2009/11/27 20:51:03 | 00,093,424 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2009/11/27 20:51:03 | 00,020,560 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2009/11/27 20:50:44 | 01,280,480 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\aswBoot.exe
[2009/11/27 20:50:36 | 00,000,000 | —D | C] – C:\Program Files\Alwil Software
[2009/11/26 23:35:43 | 00,000,000 | —D | C] – D:\Documents and Settings\bailey.048919120306\Application Data\DivX
[2009/11/26 18:29:50 | 00,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2009/11/26 18:29:50 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2009/11/26 18:29:50 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2008/04/22 14:10:54 | 00,000,000 | —D | M] – D:\Documents and Settings\NetworkService\Application Data\AVG7
[2008/04/22 14:10:54 | 00,000,000 | —D | M] – D:\Documents and Settings\LocalService\Application Data\AVG7
[2007/12/27 14:15:00 | 00,000,000 | —D | M] – D:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2007/11/13 09:31:45 | 00,000,000 | —D | M] – D:\Documents and Settings\LocalService\Application Data\Symantec
[2006/08/04 17:36:46 | 00,000,000 | —D | M] – D:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2006/08/04 17:36:46 | 00,000,000 | —D | M] – D:\Documents and Settings\NetworkService\Application Data\Google
[2006/08/04 17:36:15 | 00,000,000 | —D | M] – D:\Documents and Settings\NetworkService\Application Data\Symantec
[2005/10/17 20:15:17 | 00,000,000 | –SD | M] – D:\Documents and Settings\NetworkService\Application Data\Microsoft
[2005/10/17 20:15:17 | 00,000,000 | –SD | M] – D:\Documents and Settings\LocalService\Application Data\Microsoft
[2005/10/17 20:15:17 | 00,000,000 | —D | M] – D:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2005/10/17 20:15:17 | 00,000,000 | —D | M] – D:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2005/10/17 19:17:53 | 00,014,976 | —- | C] ( ) – C:\WINDOWS\System32\drivers\winddx.sys
[1979/12/31 23:00:00 | 01,301,128 | —- | C] ( ) – C:\WINDOWS\System32\drivers\mtlstrm.sys
[1979/12/31 23:00:00 | 00,548,952 | —- | C] ( ) – C:\WINDOWS\System32\drivers\slntamr.sys
[1979/12/31 23:00:00 | 00,221,736 | —- | C] ( ) – C:\WINDOWS\System32\drivers\mtlmnt5.sys
[1979/12/31 23:00:00 | 00,167,384 | —- | C] ( ) – C:\WINDOWS\System32\drivers\ntmtlfax.sys
[1979/12/31 23:00:00 | 00,086,128 | —- | C] ( ) – C:\WINDOWS\System32\drivers\slnthal.sys
[7 C:\WINDOWS\Fonts\*.tmp files -> C:\WINDOWS\Fonts\*.tmp -> ]
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[261 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2009/12/14 09:36:00 | 00,001,006 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3965977090-3551812889-490671574-1007UA.job
[2009/12/14 09:35:37 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/12/14 09:35:27 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/12/14 08:30:00 | 00,000,252 | —- | M] () – C:\WINDOWS\tasks\Setup my PC.job
[2009/12/14 00:29:01 | 04,456,448 | —- | M] () – D:\Documents and Settings\bailey.048919120306\ntuser.dat
[2009/12/14 00:29:01 | 00,000,178 | -HS- | M] () – D:\Documents and Settings\bailey.048919120306\ntuser.ini
[2009/12/14 00:28:56 | 10,726,846 | -H– | M] () – D:\Documents and Settings\bailey.048919120306\Local Settings\Application Data\IconCache.db
[2009/12/13 14:36:00 | 00,000,954 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3965977090-3551812889-490671574-1007Core.job
[2009/12/10 18:57:03 | 00,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/12/10 14:19:19 | 00,442,544 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2009/12/10 14:19:19 | 00,072,178 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2009/12/10 14:19:18 | 00,521,766 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2009/12/10 00:06:06 | 00,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[2009/12/06 03:48:00 | 00,000,456 | —- | M] () – C:\WINDOWS\tasks\Driver Robot.job
[2009/12/03 16:14:06 | 00,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/12/03 16:13:56 | 00,019,160 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/12/02 17:49:23 | 00,081,920 | —- | M] (Realtek Semiconductor Corp.) – C:\WINDOWS\ALCFDRTM.VER
[2009/12/02 17:00:59 | 00,009,728 | —- | M] () – D:\Documents and Settings\bailey.048919120306\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/02 16:30:26 | 00,316,640 | —- | M] () – C:\WINDOWS\WMSysPr9.prx
[2009/12/01 15:28:59 | 00,059,576 | -H– | M] () – C:\WINDOWS\System32\mlfcache.dat
[2009/12/01 14:36:56 | 00,000,923 | —- | M] () – C:\WINDOWS\win.ini
[2009/11/27 20:51:03 | 00,002,626 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2009/11/26 13:54:14 | 00,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2009/11/25 23:05:21 | 00,000,030 | —- | M] () – C:\WINDOWS\iedit.INI
[2009/11/24 23:54:29 | 01,280,480 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\aswBoot.exe
[2009/11/24 23:51:09 | 00,093,424 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2009/11/24 23:50:59 | 00,094,160 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2009/11/24 23:50:12 | 00,114,768 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2009/11/24 23:50:00 | 00,020,560 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2009/11/24 23:49:07 | 00,048,560 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2009/11/24 23:48:57 | 00,023,120 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2009/11/24 23:47:54 | 00,027,408 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2009/11/24 23:47:28 | 00,097,480 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\AvastSS.scr
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[261 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2009/11/27 20:50:50 | 00,380,928 | —- | C] () – C:\WINDOWS\System32\actskin4.ocx
[2009/11/12 20:19:52 | 00,000,000 | —- | C] () – C:\WINDOWS\webica.ini
[2009/10/17 15:08:37 | 00,002,516 | -HS- | C] () – D:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
[2009/10/17 15:08:37 | 00,000,088 | RHS- | C] () – D:\Documents and Settings\All Users\Application Data\E5EC4FC83E.sys
[2009/10/06 09:56:05 | 00,000,000 | —- | C] () – C:\WINDOWS\angelinaballerina.ini
[2009/08/27 12:45:36 | 00,009,728 | —- | C] () – D:\Documents and Settings\bailey.048919120306\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/25 22:59:59 | 00,000,030 | —- | C] () – C:\WINDOWS\iedit.INI
[2009/08/21 01:33:39 | 00,073,712 | —- | C] () – D:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2009/08/19 09:23:56 | 00,012,288 | —- | C] () – C:\WINDOWS\impborl.dll
[2008/08/11 12:29:27 | 00,000,000 | —- | C] () – D:\Documents and Settings\All Users\Application Data\LauncherAccess.dt
[2007/03/02 17:37:51 | 00,033,460 | —- | C] () – D:\Documents and Settings\All Users\Application Data\Svclog.log
[2005/10/17 21:33:24 | 00,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2005/10/17 20:31:23 | 00,198,144 | —- | C] () – C:\WINDOWS\System32\_psisdecd.dll
[2005/10/17 19:38:47 | 00,000,514 | —- | C] () – C:\WINDOWS\System32\SETUPPC.INI
[2005/10/17 19:33:02 | 00,007,584 | —- | C] () – C:\WINDOWS\HDReg.ini
[2005/10/17 19:17:53 | 00,475,136 | —- | C] () – C:\WINDOWS\System32\SLLights.dll
[2005/10/17 19:17:53 | 00,155,648 | —- | C] () – C:\WINDOWS\System32\amr_cpl.dll
[2005/10/17 19:17:53 | 00,135,168 | —- | C] () – C:\WINDOWS\System32\SLMOHServ.dll
[2005/05/20 13:05:02 | 00,005,606 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2004/08/10 16:13:32 | 00,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/10 15:38:10 | 01,290,752 | —- | C] () – C:\WINDOWS\System32\quartz(2).dll
[2004/08/10 15:37:59 | 00,014,336 | —- | C] () – C:\WINDOWS\System32\msdmo(2).dll
[2004/08/10 15:37:40 | 00,059,904 | —- | C] () – C:\WINDOWS\System32\devenum(2).dll
[2004/06/23 13:14:44 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/03/24 08:22:26 | 00,138,396 | —- | C] () – C:\WINDOWS\System32\drivers\PFC027.SYS
[2004/01/08 09:30:22 | 00,011,170 | —- | C] () – C:\WINDOWS\System32\PA207USD.DLL
[1979/12/31 23:00:00 | 00,540,672 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[1979/12/31 23:00:00 | 00,188,416 | —- | C] () – C:\WINDOWS\System32\slextspk.dll
[1979/12/31 23:00:00 | 00,159,744 | —- | C] () – C:\WINDOWS\System32\SLGen.dll
[1979/12/31 23:00:00 | 00,049,152 | —- | C] () – C:\WINDOWS\System32\coinst.dll

========== LOP Check ==========

[2008/09/22 11:25:12 | 00,000,000 | —D | M] – D:\Documents and Settings\Administrator.048919120306\Application Data\Ulead Systems
[2009/12/12 00:00:23 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\171A5
[2009/08/21 01:20:43 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\2B138
[2009/08/21 01:29:03 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\3399
[2006/05/26 00:12:53 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\ACIDPEAKPLAYVGA
[2009/01/11 18:42:35 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Ashtons. Family Resort
[2006/03/06 11:46:01 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\blueyonder
[2007/05/11 20:06:27 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\BVRP Software
[2007/11/09 10:03:10 | 00,000,000 | -H-D | M] – D:\Documents and Settings\All Users\Application Data\CanonBJ
[2009/04/26 08:40:08 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Downloaded Installations
[2009/07/10 20:23:56 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Electronic Arts
[2008/06/15 11:17:38 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Exetender
[2007/03/04 16:48:00 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Fileroadreferror
[2009/04/25 19:47:08 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Fugazo
[2009/09/18 14:10:57 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\GameHouse
[2009/03/03 18:33:50 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Gogii
[2006/09/07 10:28:45 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\GrimActiveFilm16
[2009/04/26 08:40:00 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Grisoft
[2008/02/20 19:06:42 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Installations
[2009/08/21 17:50:35 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\IObit
[2007/03/07 10:26:23 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\logs
[2006/05/25 16:17:35 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Messenger Plus!
[2008/06/16 20:30:12 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Metaboli Player
[2008/08/11 22:01:54 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\MumboJumbo
[2009/05/11 14:07:59 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\O2CM-CE
[2009/01/20 14:50:28 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Oberon Games
[2005/10/17 12:37:22 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\OD2
[2009/01/18 19:41:49 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\OnlineArmor
[2009/07/14 11:53:09 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2007/08/05 12:35:58 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\PC Suite
[2009/06/27 19:19:24 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\PCPitstop
[2009/09/25 17:43:21 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\PlayFirst
[2006/03/18 12:40:41 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\POPWWPROFILES
[2006/08/26 13:54:03 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\RTE
[2006/08/09 13:01:15 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Rule Readme Real 16
[2009/04/15 22:27:18 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Sandlot Games
[2009/12/12 23:28:21 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\TEMP
[2007/02/13 11:19:17 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Ubisoft
[2007/09/30 16:51:08 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\UDL
[2005/10/17 12:40:43 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Ulead Systems
[2005/10/17 12:32:34 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/08/20 23:29:00 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Winferno
[2008/08/06 12:24:02 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Zylom
[2009/09/20 12:05:57 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/15 11:35:31 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2009/08/18 15:40:06 | 00,000,000 | —D | M] – D:\Documents and Settings\Bailey\Application Data\OnlineArmor
[2009/10/28 23:50:45 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\Blitware
[2009/11/02 14:13:58 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2009/09/30 08:45:44 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\CometNetwork
[2009/08/27 10:38:27 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\IObit
[2009/11/04 11:46:50 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\Leadertech
[2009/08/28 13:57:54 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\LimeWire
[2009/10/07 18:35:50 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\OD2
[2009/12/12 23:05:16 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\PlayFirst
[2009/10/23 19:54:43 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\SystemRequirementsLab
[2009/08/20 10:24:51 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\Ulead Systems
[2009/08/21 19:15:24 | 00,000,000 | —D | M] – D:\Documents and Settings\bikini babe\Application Data\IObit
[2009/08/22 18:16:39 | 00,000,000 | —D | M] – D:\Documents and Settings\bikini babe\Application Data\LimeWire
[2009/08/18 19:44:51 | 00,000,000 | —D | M] – D:\Documents and Settings\bikini babe\Application Data\Ulead Systems
[2009/08/20 23:28:07 | 00,000,000 | —D | M] – D:\Documents and Settings\leah.048919120306.000\Application Data\blinkx
[2009/09/27 13:02:32 | 00,000,000 | —D | M] – D:\Documents and Settings\leah.048919120306.000\Application Data\CometNetwork
[2009/09/27 14:52:15 | 00,000,000 | —D | M] – D:\Documents and Settings\leah.048919120306.000\Application Data\FrostWire
[2009/11/12 20:21:29 | 00,000,000 | —D | M] – D:\Documents and Settings\leah.048919120306.000\Application Data\ICAClient
[2009/09/11 10:32:15 | 00,000,000 | —D | M] – D:\Documents and Settings\leah.048919120306.000\Application Data\IObit
[2009/08/20 23:28:11 | 00,000,000 | —D | M] – D:\Documents and Settings\leah.048919120306.000\Application Data\Jenkat
[2009/09/27 12:42:53 | 00,000,000 | —D | M] – D:\Documents and Settings\leah.048919120306.000\Application Data\LimeWire
[2009/08/21 21:00:15 | 00,000,000 | —D | M] – D:\Documents and Settings\leah.048919120306.000\Application Data\OD2
[2009/08/25 22:59:36 | 00,000,000 | —D | M] – D:\Documents and Settings\leah.048919120306.000\Application Data\Ulead Systems
[2009/05/16 09:20:15 | 00,000,000 | —D | M] – D:\Documents and Settings\Lisa's Internett x\Application Data\aAvgApi
[2009/06/25 09:05:53 | 00,000,000 | —D | M] – D:\Documents and Settings\Lisa's Internett x\Application Data\IObit
[2009/05/31 16:47:09 | 00,000,000 | —D | M] – D:\Documents and Settings\Lisa's Internett x\Application Data\Leadertech
[2009/05/16 12:55:03 | 00,000,000 | —D | M] – D:\Documents and Settings\Lisa's Internett x\Application Data\OD2
[2009/06/25 08:50:33 | 00,000,000 | —D | M] – D:\Documents and Settings\Lisa's Internett x\Application Data\OnlineArmor
[2009/05/11 14:46:41 | 00,000,000 | —D | M] – D:\Documents and Settings\Lisa's Internett x\Application Data\Tatara Systems
[2009/05/01 10:45:52 | 00,000,000 | —D | M] – D:\Documents and Settings\Lisa's Internett x\Application Data\Ulead Systems
[2006/08/31 20:04:31 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306\Application Data\ClockPlusSend
[2006/08/12 17:25:02 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306\Application Data\Leadertech
[2008/07/31 19:44:09 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306\Application Data\LimeWire
[2006/09/21 18:51:11 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306\Application Data\Nokia
[2006/09/21 18:52:10 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306\Application Data\Nokia Multimedia Player
[2006/08/13 09:54:25 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306\Application Data\OD2
[2006/09/21 17:29:04 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306\Application Data\PC Suite
[2006/08/26 13:54:03 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306\Application Data\RTE
[2006/09/01 08:24:02 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306\Application Data\stupid draw
[2006/09/29 09:29:18 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306\Application Data\Template
[2006/10/26 16:47:15 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306\Application Data\Ulead Systems
[2008/09/25 12:29:57 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306.000\Application Data\IDLELICENSE
[2008/09/25 12:29:57 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306.000\Application Data\Leadertech
[2008/09/25 12:29:56 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306.000\Application Data\LimeWire
[2008/09/25 12:29:54 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306.000\Application Data\OD2
[2008/09/25 12:29:54 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306.000\Application Data\Screenshot Sender
[2008/09/25 12:29:53 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306.000\Application Data\Template
[2008/09/25 12:29:52 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306.000\Application Data\Ulead Systems
[2006/01/29 23:16:01 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.SN048919120306\Application Data\Leadertech
[2008/07/31 19:44:26 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.SN048919120306\Application Data\LimeWire
[2006/03/06 15:57:11 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.SN048919120306\Application Data\MSNInstaller
[2006/02/01 16:07:40 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.SN048919120306\Application Data\OD2
[2006/03/03 17:08:59 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.SN048919120306\Application Data\Template
[2006/02/14 12:54:03 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.SN048919120306\Application Data\Ulead Systems
[2006/07/30 09:27:51 | 00,000,000 | —D | M] – D:\Documents and Settings\Little Leah\Application Data\OD2
[2006/08/09 18:56:52 | 00,000,000 | —D | M] – D:\Documents and Settings\Little Leah\Application Data\Ulead Systems
[2008/04/22 14:10:54 | 00,000,000 | —D | M] – D:\Documents and Settings\LocalService\Application Data\AVG7
[2008/04/22 14:24:03 | 00,000,000 | —D | M] – D:\Documents and Settings\LocalService.NT AUTHORITY.007\Application Data\AVG7
[2008/07/20 20:11:29 | 00,000,000 | —D | M] – D:\Documents and Settings\LocalService.NT AUTHORITY.008\Application Data\AVG7
[2008/09/25 12:32:18 | 00,000,000 | —D | M] – D:\Documents and Settings\LocalService.NT AUTHORITY.009\Application Data\AVG7
[2008/10/28 10:54:50 | 00,000,000 | —D | M] – D:\Documents and Settings\LocalService.NT AUTHORITY.010\Application Data\AVG7
[2009/01/05 21:01:23 | 00,000,000 | —D | M] – D:\Documents and Settings\LocalService.NT AUTHORITY.012\Application Data\AVG7
[2006/03/09 16:06:18 | 00,000,000 | —D | M] – D:\Documents and Settings\mini rats\Application Data\Aim
[2008/07/31 19:44:31 | 00,000,000 | —D | M] – D:\Documents and Settings\mini rats\Application Data\LimeWire
[2006/03/09 15:33:48 | 00,000,000 | —D | M] – D:\Documents and Settings\mini rats\Application Data\MSNInstaller
[2006/03/09 16:37:40 | 00,000,000 | —D | M] – D:\Documents and Settings\mini rats\Application Data\OD2
[2008/04/22 14:10:54 | 00,000,000 | —D | M] – D:\Documents and Settings\NetworkService\Application Data\AVG7
[2007/04/23 18:07:20 | 00,000,000 | —D | M] – D:\Documents and Settings\renshai warrior\Application Data\OD2
[2007/07/26 08:40:52 | 00,000,000 | —D | M] – D:\Documents and Settings\renshai warrior.048919120306\Application Data\AVG7
[2007/05/07 19:26:28 | 00,000,000 | —D | M] – D:\Documents and Settings\renshai warrior.048919120306\Application Data\Leadertech
[2008/07/31 19:44:32 | 00,000,000 | —D | M] – D:\Documents and Settings\renshai warrior.048919120306\Application Data\LimeWire
[2007/04/26 14:38:39 | 00,000,000 | —D | M] – D:\Documents and Settings\renshai warrior.048919120306\Application Data\OD2
[2007/07/18 20:18:40 | 00,000,000 | —D | M] – D:\Documents and Settings\renshai warrior.048919120306\Application Data\Ulead Systems
[2006/04/13 12:24:58 | 00,000,000 | —D | M] – D:\Documents and Settings\shane.048919120306\Application Data\Aim
[2006/04/01 17:37:05 | 00,000,000 | —D | M] – D:\Documents and Settings\shane.048919120306\Application Data\LimeWire
[2006/03/24 19:33:42 | 00,000,000 | —D | M] – D:\Documents and Settings\shane.048919120306\Application Data\OD2
[2006/04/11 13:52:23 | 00,000,000 | —D | M] – D:\Documents and Settings\shane.048919120306\Application Data\Ulead Systems
[2009/12/06 03:48:00 | 00,000,456 | —- | M] () – C:\WINDOWS\Tasks\Driver Robot.job
[2009/12/14 08:30:00 | 00,000,252 | —- | M] () – C:\WINDOWS\Tasks\Setup my PC.job

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 173 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:567D3254
@Alternate Data Stream - 161 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:68FB0053
@Alternate Data Stream - 152 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:6B520784
@Alternate Data Stream - 152 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:63596073
@Alternate Data Stream - 152 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:5E3B85EF
@Alternate Data Stream - 147 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:E9A4C114
@Alternate Data Stream - 147 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:766442E5
@Alternate Data Stream - 145 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:BC9021B2
@Alternate Data Stream - 145 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:3D857D30
@Alternate Data Stream - 145 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:2164CF08
@Alternate Data Stream - 145 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:0725B4DA
@Alternate Data Stream - 141 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:38D53DB8
@Alternate Data Stream - 140 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:15C56B30
@Alternate Data Stream - 139 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:5D52AB7A
@Alternate Data Stream - 137 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:EDDEC855
@Alternate Data Stream - 137 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:148EE14E
@Alternate Data Stream - 136 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:A98B12D4
@Alternate Data Stream - 135 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:6D6C4572
@Alternate Data Stream - 131 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:5E22637F
@Alternate Data Stream - 130 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:8B0F52E5
@Alternate Data Stream - 130 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:64DD1889
@Alternate Data Stream - 125 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:CA84168C
@Alternate Data Stream - 125 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
@Alternate Data Stream - 125 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:1CB8D545
@Alternate Data Stream - 124 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:F1FF5647
@Alternate Data Stream - 124 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:73828A71
@Alternate Data Stream - 124 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:2B99FE60
@Alternate Data Stream - 123 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:96FAC731
@Alternate Data Stream - 123 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:615435BE
@Alternate Data Stream - 123 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:47BE4EDF
@Alternate Data Stream - 121 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:52562F72
@Alternate Data Stream - 120 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:F951183D
@Alternate Data Stream - 118 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:435657D8
@Alternate Data Stream - 117 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:F69BB936
@Alternate Data Stream - 117 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:D37AE80B
@Alternate Data Stream - 117 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:74699137
@Alternate Data Stream - 114 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:78CC8F21
@Alternate Data Stream - 114 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:3CF23EC3
@Alternate Data Stream - 114 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:0AA21473
@Alternate Data Stream - 113 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:A2F5F542
@Alternate Data Stream - 112 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:3BB21850
@Alternate Data Stream - 111 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:B19CC382
@Alternate Data Stream - 110 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:EAC3589E
@Alternate Data Stream - 110 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:9CF56DF4
@Alternate Data Stream - 110 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:27AD48A5
@Alternate Data Stream - 110 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:20DB22E7
@Alternate Data Stream - 108 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:45858237
@Alternate Data Stream - 108 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:0A051701
@Alternate Data Stream - 106 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:C6798065
@Alternate Data Stream - 106 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:949483BD
@Alternate Data Stream - 100 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:C4A1F01E
< End of report >

lisafunkypants

Post #6December 14, 2009, 10:07 AM UTC last edited December 14, 2009, 6:20 PM UTC

Malwarebytes' Anti-Malware 1.42
Database version: 3356
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

14/12/2009 08:14:27
mbam-log-2009-12-14 (08-14-27).txt

Scan type: Quick Scan
Objects scanned: 467824
Time elapsed: 1 hour(s), 15 minute(s), 3 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

———————————————–

OTL logfile created on: 14/12/2009 09:54:36 - Run 3
OTL by OldTimer - Version 3.1.17.0 Folder = D:\Documents and Settings\bailey.048919120306\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1023.48 Mb Total Physical Memory | 560.70 Mb Available Physical Memory | 54.78% Memory free
2.40 Gb Paging File | 1.96 Gb Available in Paging File | 81.73% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 29.99 Gb Total Space | 9.86 Gb Free Space | 32.89% Space Free | Partition Type: NTFS
Drive D: | 113.04 Gb Total Space | 12.83 Gb Free Space | 11.35% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: 048919120306
Current User Name: bailey
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - D:\Documents and Settings\bailey.048919120306\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\STK02N\STK02NM.exe (Syntek Ltd.)
PRC - C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
PRC - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe (Cyberlink)
PRC - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe (Cyberlink)
PRC - c:\APPS\Powercinema\Kernel\TV\CLSched.exe ()
PRC - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe ()
PRC - C:\APPS\Powercinema\PCMService.exe (CyberLink Corp.)
PRC - c:\APPS\HIDSERVICE\HidService.exe ()
PRC - C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe (Ulead Systems, Inc.)
PRC - C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe (America Online, Inc.)
PRC - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)
PRC - C:\Program Files\SpywareGuard\sgmain.exe ()
PRC - C:\Program Files\SpywareGuard\sgbhp.exe ()
PRC - C:\WINDOWS\system32\slserv.exe ( )
PRC - C:\APPS\ABOARD\ABOARD.EXE (NEC Computers International)
PRC - C:\APPS\ABOARD\AOSD.EXE (NEC Computers International)

========== Modules (SafeList) ==========

MOD - D:\Documents and Settings\bailey.048919120306\My Documents\Downloads\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
SRV - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
SRV - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
SRV - (aswUpdSv) – C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
SRV - (iPod Service) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (NVSvc) – C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation)
SRV - (getPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (fsssvc) – C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Bonjour Service) – C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (gusvc) – C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)
SRV - (CyberLink Media Library Service) – C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe (Cyberlink)
SRV - (CLSched) CyberLink Task Scheduler (CTS) – c:\APPS\Powercinema\Kernel\TV\CLSched.exe ()
SRV - (CLCapSvc) CyberLink Background Capture Service (CBCS) – c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe ()
SRV - (GenericHidService) – c:\APPS\HIDSERVICE\HidService.exe ()
SRV - (AOL ACS) – C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe (America Online, Inc.)
SRV - (UleadBurningHelper) – C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)
SRV - (SLService) – C:\WINDOWS\System32\slserv.exe ( )

========== Driver Services (SafeList) ==========

DRV - (aswMon2) – C:\WINDOWS\system32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswSP) – C:\WINDOWS\system32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswFsBlk) – C:\WINDOWS\system32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (aswTdi) – C:\WINDOWS\system32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswRdr) – C:\WINDOWS\system32\drivers\aswRdr.sys (ALWIL Software)
DRV - (Aavmker4) – C:\WINDOWS\system32\drivers\aavmker4.sys (ALWIL Software)
DRV - (USBAAPL) – C:\WINDOWS\system32\drivers\usbaapl.sys (Apple, Inc.)
DRV - (fssfltr) – C:\WINDOWS\system32\drivers\fssfltr_tdi.sys (Microsoft Corporation)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (GEARAspiWDM) – C:\WINDOWS\system32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (PxHelp20) – C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (adfs) – C:\WINDOWS\system32\drivers\adfs.sys (Adobe Systems, Inc.)
DRV - (amdagp) – C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) – C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (Secdrv) – C:\WINDOWS\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (DCamUSBSTK02N) – C:\WINDOWS\system32\drivers\STK02NW2.sys (Syntek Ltd.)
DRV - (Afc) – C:\WINDOWS\system32\drivers\afc.sys (Arcsoft, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (Ptilink) – C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.)
DRV - (RecAgent) – C:\WINDOWS\system32\drivers\RecAgent.sys (Smart Link)
DRV - (HdAudAddService) – C:\WINDOWS\system32\drivers\Hdaudio.sys (Windows ® Server 2003 DDK provider)
DRV - (RTL8023) – C:\WINDOWS\system32\drivers\Rtlnic51.sys (Realtek Semiconductor Corporation )
DRV - (Slntamr) – C:\WINDOWS\system32\drivers\slntamr.sys ( )
DRV - (Mtlmnt5) – C:\WINDOWS\system32\drivers\mtlmnt5.sys ( )
DRV - (Mtlstrm) – C:\WINDOWS\system32\drivers\mtlstrm.sys ( )
DRV - (SlNtHal) – C:\WINDOWS\system32\drivers\slnthal.sys ( )
DRV - (SlWdmSup) – C:\WINDOWS\system32\drivers\slwdmsup.sys (Vireo Software)
DRV - (NtMtlFax) – C:\WINDOWS\system32\drivers\ntmtlfax.sys ( )
DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)
DRV - (Sparrow) – C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) – C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) – C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) – C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) – C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (SONYPVU1) Sony USB Filter Driver (SONYPVU1) – C:\WINDOWS\system32\drivers\SONYPVU1.SYS (Sony Corporation)
DRV - (ultra) – C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) – C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) – C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) – C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) – C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) – C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) – C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) – C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) – C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (CmdIde) – C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3965977090-3551812889-490671574-1008\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.kibagames.com/Game/Boys/Spiderman_Dress_Up
IE - HKU\S-1-5-21-3965977090-3551812889-490671574-1008\S-1-5-21-3965977090-3551812889-490671574-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 48
FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.2
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20091028

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/12/03 19:37:15 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/12/03 20:28:28 | 00,000,000 | —D | M]

[2009/08/29 20:15:23 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\Mozilla\Extensions
[2009/08/28 13:35:45 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\Mozilla\Extensions\[removed]
[2009/12/13 11:38:07 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\Mozilla\Firefox\Profiles\tvsl80k7.default\extensions
[2009/11/24 10:44:37 | 00,000,000 | —D | M] (FEBE) – D:\Documents and Settings\bailey.048919120306\Application Data\Mozilla\Firefox\Profiles\tvsl80k7.default\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2009/11/06 14:05:28 | 00,000,000 | —D | M] (WOT) – D:\Documents and Settings\bailey.048919120306\Application Data\Mozilla\Firefox\Profiles\tvsl80k7.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2009/10/10 15:45:11 | 00,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – D:\Documents and Settings\bailey.048919120306\Application Data\Mozilla\Firefox\Profiles\tvsl80k7.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2009/10/10 15:18:31 | 00,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – D:\Documents and Settings\bailey.048919120306\Application Data\Mozilla\Firefox\Profiles\tvsl80k7.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}(2)
[2009/12/13 22:46:38 | 00,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/07/17 08:40:12 | 00,704,512 | —- | M] (BitComet) – C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2009/03/24 11:10:44 | 00,114,688 | —- | M] (Zylom) – C:\Program Files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
[2009/11/09 19:36:36 | 00,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2009/11/09 19:36:36 | 00,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2009/11/09 19:36:37 | 00,000,769 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2009/11/09 19:36:37 | 00,000,831 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: (27 bytes) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (SpywareGuardDLBLOCK.CBrowserHelper) - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll ()
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (WOT Helper) - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (WOT) - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKU\S-1-5-19\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-20\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-21-3965977090-3551812889-490671574-1008\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-21-3965977090-3551812889-490671574-1008\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKU\S-1-5-21-3965977090-3551812889-490671574-1008\..\Toolbar\WebBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O4 - HKLM..\Run: [ACTIVBOARD] c:\APPS\ABOARD\ABOARD.EXE (NEC Computers International)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [EmailChecker] C:\APPS\EmailChecker\ech.exe (NEC Computers International)
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\Hdaudpropshortcut.exe (Windows ® Server 2003 DDK provider)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [PCMService] c:\Apps\Powercinema\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe (Ulead Systems, Inc.)
O4 - Startup: D:\Documents and Settings\All Users\Start Menu\Programs\Startup\STK02N 2.3 PNP Monitor.lnk = C:\WINDOWS\STK02N\STK02NM.exe (Syntek Ltd.)
O4 - Startup: D:\Documents and Settings\bailey.048919120306\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O4 - Startup: D:\Documents and Settings\bailey.048919120306\Start Menu\Programs\Startup\SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe ()
O4 - Startup: D:\Documents and Settings\lisa.SN048919120306\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe (Leader Technologies)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3965977090-3551812889-490671574-1008\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3965977090-3551812889-490671574-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-3965977090-3551812889-490671574-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-3965977090-3551812889-490671574-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKU\S-1-5-21-3965977090-3551812889-490671574-1008_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog; This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\.DEFAULT\..Trusted Domains: 8 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-18\..Trusted Domains: 8 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-21-3965977090-3551812889-490671574-1008\..Trusted Domains: 33 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wot {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {81559C35-8464-49F7-BB0E-07A383BEF910} - C:\Program Files\SpywareGuard\spywareguard.dll ()
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{026c61f6-ab5f-11de-bd66-00038a000015}\Shell\AutoRun\command - "" = F:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\usb.exe – File not found
O33 - MountPoints2\{026c61f6-ab5f-11de-bd66-00038a000015}\Shell\open\command - "" = F:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\usb.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2009/12/12 00:00:23 | 00,000,000 | —D | C] – D:\Documents and Settings\All Users\Application Data\171A5
[2009/12/11 22:19:31 | 00,000,000 | —D | C] – D:\Documents and Settings\All Users\Application Data\BigFishGamesCache
[2009/12/10 00:05:20 | 00,017,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spmsg.dll
[2009/12/03 19:42:13 | 00,000,000 | —D | C] – C:\Program Files\iPod
[2009/12/03 19:42:01 | 00,000,000 | —D | C] – C:\Program Files\iTunes
[2009/12/03 19:35:29 | 00,000,000 | -HSD | C] – C:\Config.Msi
[2009/12/02 16:48:53 | 00,000,000 | —D | C] – C:\divx
[2009/12/02 16:33:04 | 00,000,000 | —D | C] – D:\Documents and Settings\bailey.048919120306\Application Data\AVS4YOU
[2009/12/02 16:32:58 | 00,000,000 | —D | C] – D:\Documents and Settings\All Users\Application Data\AVS4YOU
[2009/12/02 16:30:33 | 00,000,000 | —D | C] – C:\Program Files\Common Files\AVSMedia
[2009/12/02 16:30:20 | 00,000,000 | —D | C] – C:\WINDOWS\System32\drivers\umdf
[2009/12/02 16:28:57 | 00,974,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mfc70.dll
[2009/12/02 16:28:56 | 00,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msxml3a.dll
[2009/12/02 16:28:56 | 00,000,000 | —D | C] – C:\Program Files\AVS4YOU
[2009/11/27 20:51:07 | 00,023,120 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2009/11/27 20:51:06 | 00,048,560 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2009/11/27 20:51:06 | 00,027,408 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2009/11/27 20:51:04 | 00,097,480 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\AvastSS.scr
[2009/11/27 20:51:03 | 00,114,768 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2009/11/27 20:51:03 | 00,094,160 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2009/11/27 20:51:03 | 00,093,424 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2009/11/27 20:51:03 | 00,020,560 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2009/11/27 20:50:44 | 01,280,480 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\aswBoot.exe
[2009/11/27 20:50:36 | 00,000,000 | —D | C] – C:\Program Files\Alwil Software
[2009/11/26 23:35:43 | 00,000,000 | —D | C] – D:\Documents and Settings\bailey.048919120306\Application Data\DivX
[2009/11/26 18:29:50 | 00,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2009/11/26 18:29:50 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2009/11/26 18:29:50 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2008/04/22 14:10:54 | 00,000,000 | —D | M] – D:\Documents and Settings\NetworkService\Application Data\AVG7
[2008/04/22 14:10:54 | 00,000,000 | —D | M] – D:\Documents and Settings\LocalService\Application Data\AVG7
[2007/12/27 14:15:00 | 00,000,000 | —D | M] – D:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2007/11/13 09:31:45 | 00,000,000 | —D | M] – D:\Documents and Settings\LocalService\Application Data\Symantec
[2006/08/04 17:36:46 | 00,000,000 | —D | M] – D:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2006/08/04 17:36:46 | 00,000,000 | —D | M] – D:\Documents and Settings\NetworkService\Application Data\Google
[2006/08/04 17:36:15 | 00,000,000 | —D | M] – D:\Documents and Settings\NetworkService\Application Data\Symantec
[2005/10/17 20:15:17 | 00,000,000 | –SD | M] – D:\Documents and Settings\NetworkService\Application Data\Microsoft
[2005/10/17 20:15:17 | 00,000,000 | –SD | M] – D:\Documents and Settings\LocalService\Application Data\Microsoft
[2005/10/17 20:15:17 | 00,000,000 | —D | M] – D:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2005/10/17 20:15:17 | 00,000,000 | —D | M] – D:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2005/10/17 19:17:53 | 00,014,976 | —- | C] ( ) – C:\WINDOWS\System32\drivers\winddx.sys
[1979/12/31 23:00:00 | 01,301,128 | —- | C] ( ) – C:\WINDOWS\System32\drivers\mtlstrm.sys
[1979/12/31 23:00:00 | 00,548,952 | —- | C] ( ) – C:\WINDOWS\System32\drivers\slntamr.sys
[1979/12/31 23:00:00 | 00,221,736 | —- | C] ( ) – C:\WINDOWS\System32\drivers\mtlmnt5.sys
[1979/12/31 23:00:00 | 00,167,384 | —- | C] ( ) – C:\WINDOWS\System32\drivers\ntmtlfax.sys
[1979/12/31 23:00:00 | 00,086,128 | —- | C] ( ) – C:\WINDOWS\System32\drivers\slnthal.sys
[7 C:\WINDOWS\Fonts\*.tmp files -> C:\WINDOWS\Fonts\*.tmp -> ]
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[261 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2009/12/14 09:36:00 | 00,001,006 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3965977090-3551812889-490671574-1007UA.job
[2009/12/14 09:35:37 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/12/14 09:35:27 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/12/14 08:30:00 | 00,000,252 | —- | M] () – C:\WINDOWS\tasks\Setup my PC.job
[2009/12/14 00:29:01 | 04,456,448 | —- | M] () – D:\Documents and Settings\bailey.048919120306\ntuser.dat
[2009/12/14 00:29:01 | 00,000,178 | -HS- | M] () – D:\Documents and Settings\bailey.048919120306\ntuser.ini
[2009/12/14 00:28:56 | 10,726,846 | -H– | M] () – D:\Documents and Settings\bailey.048919120306\Local Settings\Application Data\IconCache.db
[2009/12/13 14:36:00 | 00,000,954 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3965977090-3551812889-490671574-1007Core.job
[2009/12/10 18:57:03 | 00,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/12/10 14:19:19 | 00,442,544 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2009/12/10 14:19:19 | 00,072,178 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2009/12/10 14:19:18 | 00,521,766 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2009/12/10 00:06:06 | 00,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[2009/12/06 03:48:00 | 00,000,456 | —- | M] () – C:\WINDOWS\tasks\Driver Robot.job
[2009/12/03 16:14:06 | 00,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/12/03 16:13:56 | 00,019,160 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/12/02 17:49:23 | 00,081,920 | —- | M] (Realtek Semiconductor Corp.) – C:\WINDOWS\ALCFDRTM.VER
[2009/12/02 17:00:59 | 00,009,728 | —- | M] () – D:\Documents and Settings\bailey.048919120306\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/02 16:30:26 | 00,316,640 | —- | M] () – C:\WINDOWS\WMSysPr9.prx
[2009/12/01 15:28:59 | 00,059,576 | -H– | M] () – C:\WINDOWS\System32\mlfcache.dat
[2009/12/01 14:36:56 | 00,000,923 | —- | M] () – C:\WINDOWS\win.ini
[2009/11/27 20:51:03 | 00,002,626 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2009/11/26 13:54:14 | 00,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2009/11/25 23:05:21 | 00,000,030 | —- | M] () – C:\WINDOWS\iedit.INI
[2009/11/24 23:54:29 | 01,280,480 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\aswBoot.exe
[2009/11/24 23:51:09 | 00,093,424 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2009/11/24 23:50:59 | 00,094,160 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2009/11/24 23:50:12 | 00,114,768 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2009/11/24 23:50:00 | 00,020,560 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2009/11/24 23:49:07 | 00,048,560 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2009/11/24 23:48:57 | 00,023,120 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2009/11/24 23:47:54 | 00,027,408 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2009/11/24 23:47:28 | 00,097,480 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\AvastSS.scr
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[261 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2009/11/27 20:50:50 | 00,380,928 | —- | C] () – C:\WINDOWS\System32\actskin4.ocx
[2009/11/12 20:19:52 | 00,000,000 | —- | C] () – C:\WINDOWS\webica.ini
[2009/10/17 15:08:37 | 00,002,516 | -HS- | C] () – D:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
[2009/10/17 15:08:37 | 00,000,088 | RHS- | C] () – D:\Documents and Settings\All Users\Application Data\E5EC4FC83E.sys
[2009/10/06 09:56:05 | 00,000,000 | —- | C] () – C:\WINDOWS\angelinaballerina.ini
[2009/08/27 12:45:36 | 00,009,728 | —- | C] () – D:\Documents and Settings\bailey.048919120306\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/25 22:59:59 | 00,000,030 | —- | C] () – C:\WINDOWS\iedit.INI
[2009/08/21 01:33:39 | 00,073,712 | —- | C] () – D:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2009/08/19 09:23:56 | 00,012,288 | —- | C] () – C:\WINDOWS\impborl.dll
[2008/08/11 12:29:27 | 00,000,000 | —- | C] () – D:\Documents and Settings\All Users\Application Data\LauncherAccess.dt
[2007/03/02 17:37:51 | 00,033,460 | —- | C] () – D:\Documents and Settings\All Users\Application Data\Svclog.log
[2005/10/17 21:33:24 | 00,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2005/10/17 20:31:23 | 00,198,144 | —- | C] () – C:\WINDOWS\System32\_psisdecd.dll
[2005/10/17 19:38:47 | 00,000,514 | —- | C] () – C:\WINDOWS\System32\SETUPPC.INI
[2005/10/17 19:33:02 | 00,007,584 | —- | C] () – C:\WINDOWS\HDReg.ini
[2005/10/17 19:17:53 | 00,475,136 | —- | C] () – C:\WINDOWS\System32\SLLights.dll
[2005/10/17 19:17:53 | 00,155,648 | —- | C] () – C:\WINDOWS\System32\amr_cpl.dll
[2005/10/17 19:17:53 | 00,135,168 | —- | C] () – C:\WINDOWS\System32\SLMOHServ.dll
[2005/05/20 13:05:02 | 00,005,606 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2004/08/10 16:13:32 | 00,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/10 15:38:10 | 01,290,752 | —- | C] () – C:\WINDOWS\System32\quartz(2).dll
[2004/08/10 15:37:59 | 00,014,336 | —- | C] () – C:\WINDOWS\System32\msdmo(2).dll
[2004/08/10 15:37:40 | 00,059,904 | —- | C] () – C:\WINDOWS\System32\devenum(2).dll
[2004/06/23 13:14:44 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/03/24 08:22:26 | 00,138,396 | —- | C] () – C:\WINDOWS\System32\drivers\PFC027.SYS
[2004/01/08 09:30:22 | 00,011,170 | —- | C] () – C:\WINDOWS\System32\PA207USD.DLL
[1979/12/31 23:00:00 | 00,540,672 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[1979/12/31 23:00:00 | 00,188,416 | —- | C] () – C:\WINDOWS\System32\slextspk.dll
[1979/12/31 23:00:00 | 00,159,744 | —- | C] () – C:\WINDOWS\System32\SLGen.dll
[1979/12/31 23:00:00 | 00,049,152 | —- | C] () – C:\WINDOWS\System32\coinst.dll

========== LOP Check ==========

[2008/09/22 11:25:12 | 00,000,000 | —D | M] – D:\Documents and Settings\Administrator.048919120306\Application Data\Ulead Systems
[2009/12/12 00:00:23 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\171A5
[2009/08/21 01:20:43 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\2B138
[2009/08/21 01:29:03 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\3399
[2006/05/26 00:12:53 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\ACIDPEAKPLAYVGA
[2009/01/11 18:42:35 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Ashtons. Family Resort
[2006/03/06 11:46:01 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\blueyonder
[2007/05/11 20:06:27 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\BVRP Software
[2007/11/09 10:03:10 | 00,000,000 | -H-D | M] – D:\Documents and Settings\All Users\Application Data\CanonBJ
[2009/04/26 08:40:08 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Downloaded Installations
[2009/07/10 20:23:56 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Electronic Arts
[2008/06/15 11:17:38 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Exetender
[2007/03/04 16:48:00 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Fileroadreferror
[2009/04/25 19:47:08 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Fugazo
[2009/09/18 14:10:57 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\GameHouse
[2009/03/03 18:33:50 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Gogii
[2006/09/07 10:28:45 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\GrimActiveFilm16
[2009/04/26 08:40:00 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Grisoft
[2008/02/20 19:06:42 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Installations
[2009/08/21 17:50:35 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\IObit
[2007/03/07 10:26:23 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\logs
[2006/05/25 16:17:35 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Messenger Plus!
[2008/06/16 20:30:12 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Metaboli Player
[2008/08/11 22:01:54 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\MumboJumbo
[2009/05/11 14:07:59 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\O2CM-CE
[2009/01/20 14:50:28 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Oberon Games
[2005/10/17 12:37:22 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\OD2
[2009/01/18 19:41:49 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\OnlineArmor
[2009/07/14 11:53:09 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2007/08/05 12:35:58 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\PC Suite
[2009/06/27 19:19:24 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\PCPitstop
[2009/09/25 17:43:21 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\PlayFirst
[2006/03/18 12:40:41 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\POPWWPROFILES
[2006/08/26 13:54:03 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\RTE
[2006/08/09 13:01:15 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Rule Readme Real 16
[2009/04/15 22:27:18 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Sandlot Games
[2009/12/12 23:28:21 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\TEMP
[2007/02/13 11:19:17 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Ubisoft
[2007/09/30 16:51:08 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\UDL
[2005/10/17 12:40:43 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Ulead Systems
[2005/10/17 12:32:34 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/08/20 23:29:00 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Winferno
[2008/08/06 12:24:02 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\Zylom
[2009/09/20 12:05:57 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/15 11:35:31 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2009/08/18 15:40:06 | 00,000,000 | —D | M] – D:\Documents and Settings\Bailey\Application Data\OnlineArmor
[2009/10/28 23:50:45 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\Blitware
[2009/11/02 14:13:58 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2009/09/30 08:45:44 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\CometNetwork
[2009/08/27 10:38:27 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\IObit
[2009/11/04 11:46:50 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\Leadertech
[2009/08/28 13:57:54 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\LimeWire
[2009/10/07 18:35:50 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\OD2
[2009/12/12 23:05:16 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\PlayFirst
[2009/10/23 19:54:43 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\SystemRequirementsLab
[2009/08/20 10:24:51 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\Ulead Systems
[2009/08/21 19:15:24 | 00,000,000 | —D | M] – D:\Documents and Settings\bikini babe\Application Data\IObit
[2009/08/22 18:16:39 | 00,000,000 | —D | M] – D:\Documents and Settings\bikini babe\Application Data\LimeWire
[2009/08/18 19:44:51 | 00,000,000 | —D | M] – D:\Documents and Settings\bikini babe\Application Data\Ulead Systems
[2009/08/20 23:28:07 | 00,000,000 | —D | M] – D:\Documents and Settings\leah.048919120306.000\Application Data\blinkx
[2009/09/27 13:02:32 | 00,000,000 | —D | M] – D:\Documents and Settings\leah.048919120306.000\Application Data\CometNetwork
[2009/09/27 14:52:15 | 00,000,000 | —D | M] – D:\Documents and Settings\leah.048919120306.000\Application Data\FrostWire
[2009/11/12 20:21:29 | 00,000,000 | —D | M] – D:\Documents and Settings\leah.048919120306.000\Application Data\ICAClient
[2009/09/11 10:32:15 | 00,000,000 | —D | M] – D:\Documents and Settings\leah.048919120306.000\Application Data\IObit
[2009/08/20 23:28:11 | 00,000,000 | —D | M] – D:\Documents and Settings\leah.048919120306.000\Application Data\Jenkat
[2009/09/27 12:42:53 | 00,000,000 | —D | M] – D:\Documents and Settings\leah.048919120306.000\Application Data\LimeWire
[2009/08/21 21:00:15 | 00,000,000 | —D | M] – D:\Documents and Settings\leah.048919120306.000\Application Data\OD2
[2009/08/25 22:59:36 | 00,000,000 | —D | M] – D:\Documents and Settings\leah.048919120306.000\Application Data\Ulead Systems
[2009/05/16 09:20:15 | 00,000,000 | —D | M] – D:\Documents and Settings\Lisa's Internett x\Application Data\aAvgApi
[2009/06/25 09:05:53 | 00,000,000 | —D | M] – D:\Documents and Settings\Lisa's Internett x\Application Data\IObit
[2009/05/31 16:47:09 | 00,000,000 | —D | M] – D:\Documents and Settings\Lisa's Internett x\Application Data\Leadertech
[2009/05/16 12:55:03 | 00,000,000 | —D | M] – D:\Documents and Settings\Lisa's Internett x\Application Data\OD2
[2009/06/25 08:50:33 | 00,000,000 | —D | M] – D:\Documents and Settings\Lisa's Internett x\Application Data\OnlineArmor
[2009/05/11 14:46:41 | 00,000,000 | —D | M] – D:\Documents and Settings\Lisa's Internett x\Application Data\Tatara Systems
[2009/05/01 10:45:52 | 00,000,000 | —D | M] – D:\Documents and Settings\Lisa's Internett x\Application Data\Ulead Systems
[2006/08/31 20:04:31 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306\Application Data\ClockPlusSend
[2006/08/12 17:25:02 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306\Application Data\Leadertech
[2008/07/31 19:44:09 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306\Application Data\LimeWire
[2006/09/21 18:51:11 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306\Application Data\Nokia
[2006/09/21 18:52:10 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306\Application Data\Nokia Multimedia Player
[2006/08/13 09:54:25 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306\Application Data\OD2
[2006/09/21 17:29:04 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306\Application Data\PC Suite
[2006/08/26 13:54:03 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306\Application Data\RTE
[2006/09/01 08:24:02 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306\Application Data\stupid draw
[2006/09/29 09:29:18 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306\Application Data\Template
[2006/10/26 16:47:15 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306\Application Data\Ulead Systems
[2008/09/25 12:29:57 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306.000\Application Data\IDLELICENSE
[2008/09/25 12:29:57 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306.000\Application Data\Leadertech
[2008/09/25 12:29:56 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306.000\Application Data\LimeWire
[2008/09/25 12:29:54 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306.000\Application Data\OD2
[2008/09/25 12:29:54 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306.000\Application Data\Screenshot Sender
[2008/09/25 12:29:53 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306.000\Application Data\Template
[2008/09/25 12:29:52 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.048919120306.000\Application Data\Ulead Systems
[2006/01/29 23:16:01 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.SN048919120306\Application Data\Leadertech
[2008/07/31 19:44:26 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.SN048919120306\Application Data\LimeWire
[2006/03/06 15:57:11 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.SN048919120306\Application Data\MSNInstaller
[2006/02/01 16:07:40 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.SN048919120306\Application Data\OD2
[2006/03/03 17:08:59 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.SN048919120306\Application Data\Template
[2006/02/14 12:54:03 | 00,000,000 | —D | M] – D:\Documents and Settings\lisa.SN048919120306\Application Data\Ulead Systems
[2006/07/30 09:27:51 | 00,000,000 | —D | M] – D:\Documents and Settings\Little Leah\Application Data\OD2
[2006/08/09 18:56:52 | 00,000,000 | —D | M] – D:\Documents and Settings\Little Leah\Application Data\Ulead Systems
[2008/04/22 14:10:54 | 00,000,000 | —D | M] – D:\Documents and Settings\LocalService\Application Data\AVG7
[2008/04/22 14:24:03 | 00,000,000 | —D | M] – D:\Documents and Settings\LocalService.NT AUTHORITY.007\Application Data\AVG7
[2008/07/20 20:11:29 | 00,000,000 | —D | M] – D:\Documents and Settings\LocalService.NT AUTHORITY.008\Application Data\AVG7
[2008/09/25 12:32:18 | 00,000,000 | —D | M] – D:\Documents and Settings\LocalService.NT AUTHORITY.009\Application Data\AVG7
[2008/10/28 10:54:50 | 00,000,000 | —D | M] – D:\Documents and Settings\LocalService.NT AUTHORITY.010\Application Data\AVG7
[2009/01/05 21:01:23 | 00,000,000 | —D | M] – D:\Documents and Settings\LocalService.NT AUTHORITY.012\Application Data\AVG7
[2006/03/09 16:06:18 | 00,000,000 | —D | M] – D:\Documents and Settings\mini rats\Application Data\Aim
[2008/07/31 19:44:31 | 00,000,000 | —D | M] – D:\Documents and Settings\mini rats\Application Data\LimeWire
[2006/03/09 15:33:48 | 00,000,000 | —D | M] – D:\Documents and Settings\mini rats\Application Data\MSNInstaller
[2006/03/09 16:37:40 | 00,000,000 | —D | M] – D:\Documents and Settings\mini rats\Application Data\OD2
[2008/04/22 14:10:54 | 00,000,000 | —D | M] – D:\Documents and Settings\NetworkService\Application Data\AVG7
[2007/04/23 18:07:20 | 00,000,000 | —D | M] – D:\Documents and Settings\renshai warrior\Application Data\OD2
[2007/07/26 08:40:52 | 00,000,000 | —D | M] – D:\Documents and Settings\renshai warrior.048919120306\Application Data\AVG7
[2007/05/07 19:26:28 | 00,000,000 | —D | M] – D:\Documents and Settings\renshai warrior.048919120306\Application Data\Leadertech
[2008/07/31 19:44:32 | 00,000,000 | —D | M] – D:\Documents and Settings\renshai warrior.048919120306\Application Data\LimeWire
[2007/04/26 14:38:39 | 00,000,000 | —D | M] – D:\Documents and Settings\renshai warrior.048919120306\Application Data\OD2
[2007/07/18 20:18:40 | 00,000,000 | —D | M] – D:\Documents and Settings\renshai warrior.048919120306\Application Data\Ulead Systems
[2006/04/13 12:24:58 | 00,000,000 | —D | M] – D:\Documents and Settings\shane.048919120306\Application Data\Aim
[2006/04/01 17:37:05 | 00,000,000 | —D | M] – D:\Documents and Settings\shane.048919120306\Application Data\LimeWire
[2006/03/24 19:33:42 | 00,000,000 | —D | M] – D:\Documents and Settings\shane.048919120306\Application Data\OD2
[2006/04/11 13:52:23 | 00,000,000 | —D | M] – D:\Documents and Settings\shane.048919120306\Application Data\Ulead Systems
[2009/12/06 03:48:00 | 00,000,456 | —- | M] () – C:\WINDOWS\Tasks\Driver Robot.job
[2009/12/14 08:30:00 | 00,000,252 | —- | M] () – C:\WINDOWS\Tasks\Setup my PC.job

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 173 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:567D3254
@Alternate Data Stream - 161 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:68FB0053
@Alternate Data Stream - 152 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:6B520784
@Alternate Data Stream - 152 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:63596073
@Alternate Data Stream - 152 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:5E3B85EF
@Alternate Data Stream - 147 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:E9A4C114
@Alternate Data Stream - 147 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:766442E5
@Alternate Data Stream - 145 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:BC9021B2
@Alternate Data Stream - 145 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:3D857D30
@Alternate Data Stream - 145 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:2164CF08
@Alternate Data Stream - 145 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:0725B4DA
@Alternate Data Stream - 141 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:38D53DB8
@Alternate Data Stream - 140 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:15C56B30
@Alternate Data Stream - 139 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:5D52AB7A
@Alternate Data Stream - 137 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:EDDEC855
@Alternate Data Stream - 137 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:148EE14E
@Alternate Data Stream - 136 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:A98B12D4
@Alternate Data Stream - 135 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:6D6C4572
@Alternate Data Stream - 131 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:5E22637F
@Alternate Data Stream - 130 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:8B0F52E5
@Alternate Data Stream - 130 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:64DD1889
@Alternate Data Stream - 125 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:CA84168C
@Alternate Data Stream - 125 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
@Alternate Data Stream - 125 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:1CB8D545
@Alternate Data Stream - 124 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:F1FF5647
@Alternate Data Stream - 124 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:73828A71
@Alternate Data Stream - 124 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:2B99FE60
@Alternate Data Stream - 123 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:96FAC731
@Alternate Data Stream - 123 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:615435BE
@Alternate Data Stream - 123 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:47BE4EDF
@Alternate Data Stream - 121 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:52562F72
@Alternate Data Stream - 120 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:F951183D
@Alternate Data Stream - 118 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:435657D8
@Alternate Data Stream - 117 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:F69BB936
@Alternate Data Stream - 117 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:D37AE80B
@Alternate Data Stream - 117 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:74699137
@Alternate Data Stream - 114 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:78CC8F21
@Alternate Data Stream - 114 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:3CF23EC3
@Alternate Data Stream - 114 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:0AA21473
@Alternate Data Stream - 113 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:A2F5F542
@Alternate Data Stream - 112 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:3BB21850
@Alternate Data Stream - 111 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:B19CC382
@Alternate Data Stream - 110 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:EAC3589E
@Alternate Data Stream - 110 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:9CF56DF4
@Alternate Data Stream - 110 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:27AD48A5
@Alternate Data Stream - 110 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:20DB22E7
@Alternate Data Stream - 108 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:45858237
@Alternate Data Stream - 108 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:0A051701
@Alternate Data Stream - 106 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:C6798065
@Alternate Data Stream - 106 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:949483BD
@Alternate Data Stream - 100 bytes -> D:\Documents and Settings\All Users\Application Data\TEMP:C4A1F01E
< End of report >

Hi ,
Thanks for your help. the OTL report has all users included as i thought there maybe some thing in the other accounts, if you just want the bailey accounts report let me know and i will redo it for you.
I didnt know imesh was on the pc i didnt download it must have been my daughter i have deleted that and i have totally removed the norton,
pc's ok still slow

Can i just tell you that Avast is saying theres loads of stuff
BV AutoRun-G(wrm)
WMA:Winmad(Drp)
Win 32 Adaware
and this Trojan-gen
all in diffenrent accounts some which i deleted ages ago

oldman960

Post #7December 14, 2009, 7:20 PM UTC

Hi lisafunkypants,

Let's try to clean this log up a bit. There are pieces of old programs that have been uninstalled. Did you uninstall IOBit?

There are some remnants of an old AVG7 install. Download and run this tool

http://www.avg.com/filedir/util/support/delavg7_en.exe

Next, Double click on OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:OTL
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-19\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-20\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-21-3965977090-3551812889-490671574-1008\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-21-3965977090-3551812889-490671574-1008\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
[2007/11/13 09:31:45 | 00,000,000 | —D | M] – D:\Documents and Settings\LocalService\Application Data\Symantec
[2006/08/04 17:36:15 | 00,000,000 | —D | M] – D:\Documents and Settings\NetworkService\Application Data\Symantec

:Commands
[purity]
[emptytemp]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Please post the OTL fix log.

Thanks

lisafunkypants

Post #8December 14, 2009, 11:53 PM UTC

hi yes i did remove iobit All processes killed ========== OTL ========== Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found. Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found. Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found. Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found. Registry value HKEY_USERS\S-1-5-21-3965977090-3551812889-490671574-1008\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found. Registry value HKEY_USERS\S-1-5-21-3965977090-3551812889-490671574-1008\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}\ not found. D:\Documents and Settings\LocalService\Application Data\Symantec\Shared folder moved successfully. D:\Documents and Settings\LocalService\Application Data\Symantec folder moved successfully. D:\Documents and Settings\NetworkService\Application Data\Symantec\Shared folder moved successfully. D:\Documents and Settings\NetworkService\Application Data\Symantec folder moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: Administrator.048919120306 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: Administrator.Sam ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: All Users User: Bailey ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: bailey.048919120306 ->Temp folder emptied: 23363433 bytes ->Temporary Internet Files folder emptied: 13578338 bytes ->Java cache emptied: 13689500 bytes ->FireFox cache emptied: 60338226 bytes User: bikini babe ->Temp folder emptied: 39551311 bytes ->Temporary Internet Files folder emptied: 78991 bytes ->Java cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: leah User: leah.048919120306 User: leah.048919120306.000 ->Temp folder emptied: 77600454 bytes ->Temporary Internet Files folder emptied: 9953358 bytes ->Java cache emptied: 43191198 bytes ->FireFox cache emptied: 104905827 bytes ->Google Chrome cache emptied: 231554923 bytes User: Leah.Sam User: Leyah User: lisa the master User: Lisa's Internett x ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 5537862 bytes ->Java cache emptied: 25620942 bytes User: lisa.048919120306 ->Temp folder emptied: 1963192 bytes ->Temporary Internet Files folder emptied: 3021280 bytes ->Java cache emptied: 201466 bytes User: lisa.048919120306.000 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Java cache emptied: 0 bytes User: Lisa.Sam User: lisa.SN048919120306 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Java cache emptied: 0 bytes User: LISA~1~048 User: LISA~1~SN0 User: Lisa~Sam User: Little Leah ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Java cache emptied: 646663 bytes User: LocalService ->Temp folder emptied: 65536 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService.NT AUTHORITY ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY.000 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY.001 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: LocalService.NT AUTHORITY.002 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: LocalService.NT AUTHORITY.003 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: LocalService.NT AUTHORITY.004 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: LocalService.NT AUTHORITY.005 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: LocalService.NT AUTHORITY.006 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY.007 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: LocalService.NT AUTHORITY.008 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: LocalService.NT AUTHORITY.009 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: LocalService.NT AUTHORITY.010 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: LocalService.NT AUTHORITY.011 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY.012 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 2535148 bytes User: LocalService.NT AUTHORITY.013 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: LocalService.NT AUTHORITY.014 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: LocalService.NT AUTHORITY.015 ->Temp folder emptied: 65748 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: LocalService.NT AUTHORITY.016 ->Temp folder emptied: 65748 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: mini rats ->Temp folder emptied: 65536 bytes ->Temporary Internet Files folder emptied: 67 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService.NT AUTHORITY ->Temp folder emptied: 0 bytes User: NetworkService.NT AUTHORITY.000 ->Temp folder emptied: 0 bytes User: NetworkService.NT AUTHORITY.001 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: NetworkService.NT AUTHORITY.002 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: NetworkService.NT AUTHORITY.003 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: NetworkService.NT AUTHORITY.004 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: NetworkService.NT AUTHORITY.005 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService.NT AUTHORITY.006 ->Temp folder emptied: 0 bytes User: NetworkService.NT AUTHORITY.007 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: NetworkService.NT AUTHORITY.008 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: NetworkService.NT AUTHORITY.009 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: NetworkService.NT AUTHORITY.010 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: NetworkService.NT AUTHORITY.011 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService.NT AUTHORITY.012 ->Temp folder emptied: 41586 bytes ->Temporary Internet Files folder emptied: 377389 bytes User: NetworkService.NT AUTHORITY.013 ->Temp folder emptied: 10752 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: NetworkService.NT AUTHORITY.014 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: NetworkService.NT AUTHORITY.015 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: NetworkService.NT AUTHORITY.016 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: renshai warrior ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 5218429 bytes ->Java cache emptied: 68695 bytes User: renshai warrior.048919120306 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Java cache emptied: 724588 bytes User: Renshai Warrior.048919120306.000 User: Renshai Warrior.048919120306.001 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Google Chrome cache emptied: 85545878 bytes ->Apple Safari cache emptied: 209572479 bytes User: shane.048919120306 ->Temp folder emptied: 961792 bytes ->Java cache emptied: 1755712 bytes User: shane.SN048919120306.000 User: x leah x User: x likle lu lu x User: x.bby.le.eya.x %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 1072866 bytes %systemroot%\System32 .tmp files removed: 70931064 bytes Windows Temp folder emptied: 278528 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 34293 bytes RecycleBin emptied: 199031 bytes Total Files Cleaned = 986.75 mb OTL by OldTimer - Version 3.1.17.0 log created on 12142009_234645 Files\Folders moved on Reboot… File move failed. D:\Documents and Settings\mini rats\Local Settings\Temp\hsperfdata_mini rats\2560 scheduled to be moved on reboot. File move failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot. File\Folder C:\WINDOWS\temp\Perflib_Perfdata_4f8.dat not found! Registry entries deleted on Reboot…

oldman960

Post #9December 15, 2009, 1:18 AM UTC last edited December 15, 2009, 1:24 AM UTC

Hi lisafunkypants,

I just saw your edit from earlier today. I'll get you to attach a log from Avast, it will give us more information on what and where avast is making the detections.

To attach a file, do the following:

Click Add Reply
Under the reply panel is the Attachments Panel
Click the browse button and browse to this location, C:\Program Files\Alwil Software\Avast4\DATA\log
click on this file warning.log (it should be the last one in the list) then click the green Upload button
Once it has uploaded, click the Manage Current Attachments drop down box
[external image: Posted Image] to insert the attachment into your post

Next, Double click on OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:OTL
PRC - C:\Windows\Explorer.EXE (Microsoft Corporation)
[2008/04/22 14:10:54 | 00,000,000 | —D | M] – D:\Documents and Settings\NetworkService\Application Data\AVG7
[2008/04/22 14:10:54 | 00,000,000 | —D | M] – D:\Documents and Settings\LocalService\Application Data\AVG7
[2008/04/22 14:10:54 | 00,000,000 | —D | M] – D:\Documents and Settings\NetworkService\Application Data\AVG7
[2007/07/26 08:40:52 | 00,000,000 | —D | M] – D:\Documents and Settings\renshai warrior.048919120306\Application Data\AVG7
2008/04/22 14:24:03 | 00,000,000 | —D | M] – D:\Documents and Settings\LocalService.NT AUTHORITY.007\Application Data\AVG7
[2008/07/20 20:11:29 | 00,000,000 | —D | M] – D:\Documents and Settings\LocalService.NT AUTHORITY.008\Application Data\AVG7
[2008/09/25 12:32:18 | 00,000,000 | —D | M] – D:\Documents and Settings\LocalService.NT AUTHORITY.009\Application Data\AVG7
[2008/10/28 10:54:50 | 00,000,000 | —D | M] – D:\Documents and Settings\LocalService.NT AUTHORITY.010\Application Data\AVG7
[2009/01/05 21:01:23 | 00,000,000 | —D | M] – D:\Documents and Settings\LocalService.NT AUTHORITY.012\Application Data\AVG7
[2009/08/27 10:38:27 | 00,000,000 | —D | M] – D:\Documents and Settings\bailey.048919120306\Application Data\IObit
[2009/08/21 19:15:24 | 00,000,000 | —D | M] – D:\Documents and Settings\bikini babe\Application Data\IObit
[2009/09/11 10:32:15 | 00,000,000 | —D | M] – D:\Documents and Settings\leah.048919120306.000\Application Data\IObit
[2009/06/25 09:05:53 | 00,000,000 | —D | M] – D:\Documents and Settings\Lisa's Internett x\Application Data\IObit
[2009/08/21 17:50:35 | 00,000,000 | —D | M] – D:\Documents and Settings\All Users\Application Data\IObit
:Services

:Reg

:Files
C:\Program Files\IObit\IObit Security 360
D:\Documents and Settings\All Users\Application Data\IObit

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Please post back with

avast warning log
OTL fix log

Thanks

lisafunkypants

Post #10December 15, 2009, 1:52 PM UTC last edited December 15, 2009, 1:54 PM UTC

All processes killed ========== OTL ========== No active process named Explorer.EXE was found! D:\Documents and Settings\NetworkService\Application Data\AVG7 folder moved successfully. D:\Documents and Settings\LocalService\Application Data\AVG7 folder moved successfully. Folder D:\Documents and Settings\NetworkService\Application Data\AVG7\ not found. D:\Documents and Settings\renshai warrior.048919120306\Application Data\AVG7 folder moved successfully. D:\Documents and Settings\LocalService.NT AUTHORITY.008\Application Data\AVG7 folder moved successfully. D:\Documents and Settings\LocalService.NT AUTHORITY.009\Application Data\AVG7 folder moved successfully. D:\Documents and Settings\LocalService.NT AUTHORITY.010\Application Data\AVG7 folder moved successfully. D:\Documents and Settings\LocalService.NT AUTHORITY.012\Application Data\AVG7 folder moved successfully. D:\Documents and Settings\bailey.048919120306\Application Data\IObit\Advanced SystemCare\Backup\Registry folder moved successfully. D:\Documents and Settings\bailey.048919120306\Application Data\IObit\Advanced SystemCare\Backup folder moved successfully. D:\Documents and Settings\bailey.048919120306\Application Data\IObit\Advanced SystemCare folder moved successfully. D:\Documents and Settings\bailey.048919120306\Application Data\IObit folder moved successfully. D:\Documents and Settings\bikini babe\Application Data\IObit\Advanced SystemCare\Backup\Registry folder moved successfully. D:\Documents and Settings\bikini babe\Application Data\IObit\Advanced SystemCare\Backup folder moved successfully. D:\Documents and Settings\bikini babe\Application Data\IObit\Advanced SystemCare folder moved successfully. D:\Documents and Settings\bikini babe\Application Data\IObit folder moved successfully. D:\Documents and Settings\leah.048919120306.000\Application Data\IObit\Advanced SystemCare\Backup\Registry folder moved successfully. D:\Documents and Settings\leah.048919120306.000\Application Data\IObit\Advanced SystemCare\Backup folder moved successfully. D:\Documents and Settings\leah.048919120306.000\Application Data\IObit\Advanced SystemCare folder moved successfully. D:\Documents and Settings\leah.048919120306.000\Application Data\IObit folder moved successfully. D:\Documents and Settings\Lisa's Internett x\Application Data\IObit\Advanced SystemCare\Backup\Registry folder moved successfully. D:\Documents and Settings\Lisa's Internett x\Application Data\IObit\Advanced SystemCare\Backup folder moved successfully. D:\Documents and Settings\Lisa's Internett x\Application Data\IObit\Advanced SystemCare folder moved successfully. D:\Documents and Settings\Lisa's Internett x\Application Data\IObit folder moved successfully. D:\Documents and Settings\All Users\Application Data\IObit\IObit Security 360 folder moved successfully. D:\Documents and Settings\All Users\Application Data\IObit folder moved successfully. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== C:\Program Files\IObit\IObit Security 360\Update\Language folder moved successfully. C:\Program Files\IObit\IObit Security 360\Update folder moved successfully. C:\Program Files\IObit\IObit Security 360\Quarantine Zone folder moved successfully. C:\Program Files\IObit\IObit Security 360\log\Scan folder moved successfully. C:\Program Files\IObit\IObit Security 360\log folder moved successfully. C:\Program Files\IObit\IObit Security 360\language(2) folder moved successfully. C:\Program Files\IObit\IObit Security 360\Images(2) folder moved successfully. C:\Program Files\IObit\IObit Security 360\Downloaded folder moved successfully. C:\Program Files\IObit\IObit Security 360 folder moved successfully. File\Folder D:\Documents and Settings\All Users\Application Data\IObit not found. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Administrator.048919120306 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Administrator.Sam ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: All Users User: Bailey ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: bailey.048919120306 ->Temp folder emptied: 68196 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 37789712 bytes User: bikini babe ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Java cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: leah User: leah.048919120306 User: leah.048919120306.000 ->Temp folder emptied: 96428 bytes ->Temporary Internet Files folder emptied: 1182094 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 61431079 bytes ->Google Chrome cache emptied: 0 bytes User: Leah.Sam User: Leyah User: lisa the master User: Lisa's Internett x ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Java cache emptied: 0 bytes User: lisa.048919120306 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Java cache emptied: 0 bytes User: lisa.048919120306.000 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Java cache emptied: 0 bytes User: Lisa.Sam User: lisa.SN048919120306 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Java cache emptied: 0 bytes User: LISA~1~048 User: LISA~1~SN0 User: Lisa~Sam User: Little Leah ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Java cache emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY.000 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY.001 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY.002 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY.003 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY.004 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY.005 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY.006 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY.007 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY.008 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY.009 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY.010 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY.011 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY.012 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY.013 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY.014 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY.015 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService.NT AUTHORITY.016 ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: mini rats ->Temp folder emptied: 65536 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService.NT AUTHORITY ->Temp folder emptied: 0 bytes User: NetworkService.NT AUTHORITY.000 ->Temp folder emptied: 0 bytes User: NetworkService.NT AUTHORITY.001 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService.NT AUTHORITY.002 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService.NT AUTHORITY.003 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService.NT AUTHORITY.004 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService.NT AUTHORITY.005 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService.NT AUTHORITY.006 ->Temp folder emptied: 0 bytes User: NetworkService.NT AUTHORITY.007 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService.NT AUTHORITY.008 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService.NT AUTHORITY.009 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService.NT AUTHORITY.010 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService.NT AUTHORITY.011 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService.NT AUTHORITY.012 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService.NT AUTHORITY.013 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService.NT AUTHORITY.014 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService.NT AUTHORITY.015 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: NetworkService.NT AUTHORITY.016 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: renshai warrior ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Java cache emptied: 0 bytes User: renshai warrior.048919120306 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Java cache emptied: 0 bytes User: Renshai Warrior.048919120306.000 User: Renshai Warrior.048919120306.001 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Google Chrome cache emptied: 0 bytes ->Apple Safari cache emptied: 0 bytes User: shane.048919120306 ->Temp folder emptied: 0 bytes ->Java cache emptied: 0 bytes User: shane.SN048919120306.000 User: x leah x User: x likle lu lu x User: x.bby.le.eya.x %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes Windows Temp folder emptied: 16384 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 96.11 mb OTL by OldTimer - Version 3.1.17.0 log created on 12152009_134241 Files\Folders moved on Reboot… File move failed. D:\Documents and Settings\mini rats\Local Settings\Temp\hsperfdata_mini rats\2560 scheduled to be moved on reboot. File move failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot. C:\WINDOWS\temp\Perflib_Perfdata_4f8.dat moved successfully. Registry entries deleted on Reboot… it wouldnt let me upload, it said i am not permitted to upload this type of file so ive split into 2 files hope it worked 📎warning_1.txt 📎warning2.txt

oldman960

Post #11December 15, 2009, 7:21 PM UTC

Hi lisafunkypants,

Sorry about that, the forum does not allow .log files. Is that the complete file?

Did you move the detections to the chest when Avast warned you of them?

1 was in a System Restore point which we will remove later. It's harmless unless you use System restore to revert back to that point.

Several were in temporary internet files which have been since removed except for one user account x likle lu lu x

renshai warrior.048919120306 has 3 detections we can remove if you haven't moved the files to the chest.

The rest are a detection of an autorun.

Next, Double click on OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:OTL
PRC - C:\Windows\Explorer.EXE (Microsoft Corporation)

:Files
D:\Documents and Settings\x likle lu lu x\Local Settings\Temporary Internet Files\Content.IE5\IG28Z9R6\im-names[1].htm
D:\Documents and Settings\renshai warrior.048919120306\Incomplete\T-1971086– RoLand - dj eddy mix now your gone _CyberPirates_ [Theme].wma
D:\Documents and Settings\renshai warrior.048919120306\Incomplete\T-539890-_MiNT_ dj eddy now your gone -new version- XviD.wma
D:\Documents and Settings\renshai warrior.048919120306\Shared\!!!!! dj eddy mix now your gone !!!!! (Tool).wma

:Reg
[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{026c61f6-ab5f-11de-bd66-00038a000015}]

:Commands
[start explorer]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

1 detection is on the F:\ drive. Make sure whatever USD device that was attached and recognized as F is attached when you run the next scan.

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Right click SystemLook.exe and select Run as Administrator to run it.
Copy the content of the following codebox into the main textfield
Do not copy the word CODE , please note the script starts with the :
```
:contents
F:\AUTORUN.INF
:filefind
autorun.inf
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Please post back with

OTL fix log
SystemLook log

Thanks

lisafunkypants

Post #12December 15, 2009, 10:20 PM UTC last edited December 15, 2009, 10:24 PM UTC

Hi

Is that the complete file?

Yes that was the complete log,

Did you move the detections to the chest when Avast warned you of them?

I couldnt move them to the chest it said they were in password protected accounts.
The files in chest are different bar 1, should i delete them from the chest?

1 detection is on the F:\ drive.

the F drive is the mobile phone or camera the phone is plugged in
may i also say the USB port at the front of the pc has stopped working and the other one is very temperamental (not since youve been helping me they started behaving strangely before i contacted you). Dont know if this has anything to do with what were trying to sort, its happened before and it was apparantly a software issue??!!

========== OTL ==========
Process Explorer.EXE killed successfully!
========== FILES ==========
File\Folder D:\Documents and Settings\x likle lu lu x\Local Settings\Temporary Internet Files\Content.IE5\IG28Z9R6\im-names[1].htm not found.
File\Folder D:\Documents and Settings\renshai warrior.048919120306\Incomplete\T-1971086– RoLand - dj eddy mix now your gone _CyberPirates_ [Theme].wma not found.
D:\Documents and Settings\renshai warrior.048919120306\Incomplete\T-539890-_MiNT_ dj eddy now your gone -new version- XviD.wma moved successfully.
D:\Documents and Settings\renshai warrior.048919120306\Shared\!!!!! dj eddy mix now your gone !!!!! (Tool).wma moved successfully.
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{026c61f6-ab5f-11de-bd66-00038a000015}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{026c61f6-ab5f-11de-bd66-00038a000015}\ not found.
========== COMMANDS ==========

OTL by OldTimer - Version 3.1.17.0 log created on 12152009_220127

——————————————————————————————————

SystemLook v1.0 by jpshortstuff (29.08.09)
Log created at 22:09 on 15/12/2009 by bailey (Administrator - Elevation successful)

========== contents ==========

F:\AUTORUN.INF - Unable to open file.

========== filefind ==========

Searching for "autorun.inf"
C:\APPS\UVS8\Player\AUTORUN.INF –a— 31 bytes [19:40 17/10/2005] [19:41 15/03/2004] 52A868BF1EC01B28712F46053740EA8A
C:\Program Files\Common Files\Adobe\Bridge CS4 Extensions\Adobe Output Module\mediagallery\resources\flashgallery\AUTORUN.inf –a— 48 bytes [08:29 07/05/2008] [08:29 07/05/2008] E20376B4E2759915BE266334FF95D29F

-=End Of File=-

oldman960

Post #13December 15, 2009, 11:35 PM UTC

Hi lisafunkypants,

The files in chest are different bar 1, should i delete them from the chest?

Leave them there for now.

Right click on My compter

click properties
click on the Hardware tab
Click the Device Manager button

Anything with a yellow triangle?

With the phone plugged in run OTL with this fix. Save the log, then do the same with the camera.

:Files
F:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\usb.exe

Next

Open windows explorer (right click the Start button and click Explore)

At the top of windows explorer, click tools, folder options, click the view tab

check Display the contents of system folders
check Show hidden files and folders
uncheck "Hide extensions for known file types" box
uncheck "Hide protecting operating system files" box

Click apply, click ok

We'll try to open the file with notepad. Please do this with the camera then repeat for the phone.

In windows explorer navigate to this file

F:\AUTORUN.INF

Right click it and select Open with, select notepad

Copy and paste the contents into you next reply.

Please post both OTL fix logs and the contemts of the autorun.inf file if you can obtain them.

Thanks

lisafunkypants

Post #14December 17, 2009, 1:44 PM UTC

hi the pc has gone crazy i cant use my keyboard i am using on-screen keyboard the mouse makes the font larger/smaller when i use scroller unless i have the phone connected the camera isnt fdrive just fone, the camera will not come on now when plugged into pc, when i click on link on page it opens it 3times in browser i cant find autorun file in search it says it does not exist there are no yellow triangles log from phone; ========== FILES ========== File\Folder F:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\usb.exe not found. OTL by OldTimer - Version 3.1.17.0 log created on 12172009_134157

oldman960

Post #15December 17, 2009, 3:49 PM UTC last edited December 17, 2009, 11:06 PM UTC

Hi lisafunkypants, What type of keyboard do you have? Is a USB keyboard? Check to see if the Control (ctrl) key is not stuck on the keyboard. Do you have another keyboard you can try?

✨ Ask AI

Ask AI