Spyware / Malware / Virus Removal

[Resolved] Adware HBHelper / Browser Hijacker Desktop

113 min read

Looking for the outcome? Ask AI

Shenlord Topic Starter

Post #1March 23, 2010, 9:58 PM UTC

Hey guys.
Adware HBHelper and Browser Hijacker Desktop keep reinstalling themselves. (5-6 times). I have used Malwarebytes, Avast, Super Antispyware and Spybot. I have used several restore points… which make the comp functional for a few hours. Then the virus messes up the exe function again.
The virus prevents me from opening setup.exe files. autorun on cd.s. Can't use the start-search function. I can open exe files in safe mode.
I keep getting the message:

[ Windows cannot acces the specified device, path or file. You may not have the appropriate permissions for this item.] Cannot access User Accounts and a few others in Control Panel. Otherwise the comp runs fine.

I have saved Erunt backup registry. used Defogger,used Sysrestore and saved the various requested logs.
I started on a Hijack this page and am not sure if you need the hjt log. I will forward it as well as the others you asked for: DDS, DDS Attach and Gmer log.

Also Spybot found Microsoft windows security center antivirus override and windows firewall override malware. I removed them but later read that they probably were false positives.
I await your instructions. Thank you so much for helping out.
Kind regards:
JPS

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:19:29 PM, on 3/23/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Tall Emu\Online Armor\OAcat.exe
C:\Program Files\Tall Emu\Online Armor\oasrv.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\ASUS.SYS\config\DVMExportService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
E:\Program Files\TekSIP\TekSIP.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\ASUS\AI Suite\Q-Button\QButton.exe
C:\WINDOWS\ZSSnp211.exe
C:\WINDOWS\Domino.exe
E:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe
C:\Program Files\dvd43\dvd43_tray.exe
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\Program Files\MSN Toolbar\Platform\4.0.0379.0\mswinext.exe
C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
E:\program files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Pamela\Pamela.exe
C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\9E0D937F462E4362A83B254A9F8AB3F8\InnerPassFileSharing.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Outlook Express\msimn.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.greatnewsnetwork.org
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 70.176.5.205:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - E:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O2 - BHO: SBCONVERT - {3017FB3E-9A77-4396-88C5-0EC9548FB42F} - C:\Program Files\SpeedBit Video Downloader\Toolbar\tbcore3.dll
O2 - BHO: SBCONVERT - {31B27F2D-6BC6-451B-B3D2-4EAB36B2FC3B} - C:\Program Files\SpeedBit Video Downloader\Toolbar\tbcore3.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: MSN Toolbar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\4.0.0379.0\npwinext.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: ChromeFrame BHO - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files\Google\Chrome Frame\Application\5.0.342.0\npchrome_frame.dll
O2 - BHO: GrabberObj Class - {FF7C3CF0-4B15-11D1-ABED-709549C10000} - C:\PROGRA~1\SpeedBit Video Downloader\Toolbar\grabber.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - E:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O3 - Toolbar: SpeedBit Video Downloader - {0329E7D6-6F54-462D-93F6-F5C3118BADF2} - C:\Program Files\SpeedBit Video Downloader\Toolbar\tbcore3.dll
O3 - Toolbar: MSN Toolbar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\4.0.0379.0\npwinext.dll
O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\AI Suite\Q-Button\QButton.exe"
O4 - HKLM\..\Run: [QFan Help] "C:\Program Files\ASUS\AI Suite\QFan3\QFanHelp.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ZSSnp211] C:\WINDOWS\ZSSnp211.exe
O4 - HKLM\..\Run: [Domino] C:\WINDOWS\Domino.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SmartDefrag] "E:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" /StartUp
O4 - HKLM\..\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [MSN Toolbar] "C:\Program Files\MSN Toolbar\Platform\4.0.0379.0\mswinext.exe"
O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKCU\..\Run: [WinPatrol.exe] C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
O4 - HKCU\..\Run: [SmartRAM] "E:\program files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" /m
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [pamela.exe] "C:\Program Files\Pamela\Pamela.exe"
O4 - HKCU\..\Run: [SpeedBitVideoAccelerator] C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe
O4 - HKCU\..\Run: [Innerpass] C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\9E0D937F462E4362A83B254A9F8AB3F8\InnerPassFileSharing.exe autostart
O4 - HKUS\S-1-5-18\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Default user')
O9 - Extra button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - E:\Program Files\Evernote\Evernote3.5\enbar.dll
O9 - Extra 'Tools' menuitem: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - E:\Program Files\Evernote\Evernote3.5\enbar.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O10 - Unknown file in Winsock LSP: c:\progra~1\speedbit video accelerator\sblsp.dll
O10 - Unknown file in Winsock LSP: c:\progra~1\speedbit video accelerator\sblsp.dll
O10 - Unknown file in Winsock LSP: c:\progra~1\speedbit video accelerator\sblsp.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1221690851234
O18 - Protocol: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files\Google\Chrome Frame\Application\5.0.342.0\npchrome_frame.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AODService - Unknown owner - C:\Program.exe (file missing)
O23 - Service: ASUS System Control Service (AsSysCtrlService) - Unknown owner - C:\Program Files\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BroadCam Video Streaming Server (BroadCamService) - NCH Software - C:\Program Files\NCH Software\BroadCam\broadcam.exe
O23 - Service: DeviceVM Meta Data Export Service (DvmMDES) - DeviceVM - C:\ASUS.SYS\config\DVMExportService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Online Armor Helper Service (OAcat) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\OAcat.exe
O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\oasrv.exe
O23 - Service: TekSIP - Yasin KAPLAN - E:\Program Files\TekSIP\TekSIP.exe

–
End of file - 11041 bytes

********************************************
DDS log

DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 13:33:51.28 on Tue 03/23/2010
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_18
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2765 [GMT -5:00]

AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Online Armor Firewall *disabled* {B797DAA0-7E2E-4711-8BB3-D12744F1922A}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Tall Emu\Online Armor\OAcat.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\ASUS.SYS\config\DVMExportService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
E:\Program Files\TekSIP\TekSIP.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\ASUS\AI Suite\Q-Button\QButton.exe
C:\WINDOWS\ZSSnp211.exe
C:\WINDOWS\Domino.exe
E:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe
C:\Program Files\dvd43\dvd43_tray.exe
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\Program Files\MSN Toolbar\Platform\4.0.0379.0\mswinext.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
E:\program files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Pamela\Pamela.exe
C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe
C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\9E0D937F462E4362A83B254A9F8AB3F8\InnerPassFileSharing.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe
C:\Documents and Settings\Jean-Paul\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Bar = hxxp://www.google.com/ie
uStart Page = hxxp://www.greatnewsnetwork.org
uInternet Settings,ProxyServer = 70.176.5.205:80
uInternet Settings,ProxyOverride = localhost;*.local
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\tbFre1.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Solid Converter PDF: {259f616c-a300-44f5-b04a-ed001a26c85c} - e:\program files\soliddocuments\solidconverterpdf\scpdf\ExploreExtPDF.dll
BHO: SBCONVERT Class: {3017fb3e-9a77-4396-88c5-0ec9548fb42f} - c:\program files\speedbit video downloader\toolbar\tbcore3.dll
BHO: SBCONVERT Class: {31b27f2d-6bc6-451b-b3d2-4eab36b2fc3b} - c:\program files\speedbit video downloader\toolbar\tbcore3.dll
BHO: EWPBrowseObject Class: {68f9551e-0411-48e4-9aaf-4bc42a6a46be} - c:\program files\canon\easy-webprint\EWPBrowseLoader.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: MSN Toolbar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn toolbar\platform\4.0.0379.0\npwinext.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: ChromeFrame BHO: {ecb3c477-1a0a-44bd-bb57-78f9efe34fa7} - c:\program files\google\chrome frame\application\5.0.342.0\npchrome_frame.dll
BHO: GrabberObj Class: {ff7c3cf0-4b15-11d1-abed-709549c10000} - c:\progra~1\speedbit video downloader\toolbar\grabber.dll
TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll
TB: Freecorder Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - c:\program files\freecorder\tbFre1.dll
TB: Solid Converter PDF: {259f616c-a300-44f5-b04a-ed001a26c85c} - e:\program files\soliddocuments\solidconverterpdf\scpdf\ExploreExtPDF.dll
TB: SpeedBit Video Downloader: {0329e7d6-6f54-462d-93f6-f5c3118badf2} - c:\program files\speedbit video downloader\toolbar\tbcore3.dll
TB: MSN Toolbar: {8dcb7100-df86-4384-8842-8fa844297b3f} - c:\program files\msn toolbar\platform\4.0.0379.0\npwinext.dll
TB: Cole2k Media Toolbar: {015407a9-d183-4379-8452-dfd7c2297902} - c:\program files\cole2k media toolbar\v2.0.0.2\Cole2k_Media_Toolbar.dll
TB: {89A9931F-49ED-4C14-BA58-879E79069A82} - No File
TB: goonlinetv Toolbar: {8e2059f1-eda8-4ce0-bbea-b51c2cc43382} - c:\program files\goonlinetv\tbgoo0.dll
uRun: [WinPatrol.exe] c:\program files\billp studios\winpatrol\WinPatrol.exe
uRun: [SmartRAM] "e:\program files\iobit\advanced systemcare 3\Sup_SmartRAM.exe" /m
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [pamela.exe] "c:\program files\pamela\Pamela.exe"
uRun: [SpeedBitVideoAccelerator] c:\program files\speedbit video accelerator\VideoAccelerator.exe
uRun: [Innerpass] c:\documents and settings\all users\application data\skype\plugins\plugins\9e0d937f462e4362a83b254a9f8ab3f8\InnerPassFileSharing.exe autostart
mRun: [Ai Nap] "c:\program files\asus\ai suite\q-button\QButton.exe"
mRun: [QFan Help] "c:\program files\asus\ai suite\qfan3\QFanHelp.exe"
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [ZSSnp211] c:\windows\ZSSnp211.exe
mRun: [Domino] c:\windows\Domino.exe
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SmartDefrag] "e:\program files\iobit\iobit smartdefrag\IObit SmartDefrag.exe" /StartUp
mRun: [dvd43] c:\program files\dvd43\dvd43_tray.exe
mRun: [avast5] "c:\program files\alwil software\avast5\avastUI.exe" /nogui
mRun: [MSN Toolbar] "c:\program files\msn toolbar\platform\4.0.0379.0\mswinext.exe"
mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume
dRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
uPolicies-explorer: NoInstrumentation = 1 (0x1)
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - {BC0E0A5D-AB5A-4fa4-A5FA-280E1D58EEEE} - e:\program files\evernote\evernote3.5\enbar.dll
LSP: c:\progra~1\speedbit video accelerator\sblsp.dll
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/3/9/8/398422c0-8d3e-40e1-a617-af65a72a0465/LegitCheckControl.cab
DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} - hxxp://protect.microsoft.com/security/protect/wsa/shared/CAB/x86/msSecAdv.cab?1116220378452
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {33564D57-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/D/0/D/D0DD87DA-994F-4334-8B55-AF2E4D98ED0C/wmv9dmo.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1221690851234
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_01-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - c:\program files\google\chrome frame\application\5.0.342.0\npchrome_frame.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\Skype4COM.dll
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - e:\program files\superantispyware\SASSEH.DLL
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll
SEH: OA Shell Helper: {4f07da45-8170-4859-9b5f-037ef2970034} - c:\progra~1\tall emu\online armor\oaevent.dll
LSA: Notification Packages = :\windows\system32\srrstr.dll cecli scecli scecli scecli scecli

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\jean-p~1\applic~1\mozilla\firefox\profiles\ms8jk89y.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - prefs.js: keyword.URL - hxxp://www.ask.com/web?o=13796&l=dis&q=
FF - component: c:\documents and settings\jean-paul\application data\mozilla\firefox\profiles\ms8jk89y.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\jean-paul\application data\mozilla\firefox\profiles\ms8jk89y.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\components\RadioWMPCore.dll
FF - component: c:\documents and settings\jean-paul\application data\mozilla\firefox\profiles\ms8jk89y.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\documents and settings\jean-paul\application data\mozilla\firefox\profiles\ms8jk89y.default\extensions\{7104ec46-5dfb-4609-84f0-915970e383d7}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\jean-paul\application data\mozilla\firefox\profiles\ms8jk89y.default\extensions\{7104ec46-5dfb-4609-84f0-915970e383d7}\components\RadioWMPCore.dll
FF - component: c:\program files\microsoft\search enhancement pack\search helper\firefoxextension\searchhelperextension\components\SEPsearchhelperff.dll
FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll
FF - component: c:\program files\speedbit video downloader\spfirefox\components\Engine.dll
FF - plugin: c:\documents and settings\jean-paul\application data\move networks\plugins\npqmp071505000011.dll
FF - plugin: c:\documents and settings\jean-paul\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\jean-paul\local settings\application data\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\dimdim\plugin\application\npDimDimControl.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npDimdimControl.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npPandoWebInst.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPSFDMGR.dll
FF - plugin: c:\program files\opera\program\plugins\np_gp.dll
FF - plugin: c:\program files\opera\program\plugins\npDimDimControl.dll
FF - plugin: c:\program files\real\netscape6\nppl3260.dll
FF - plugin: c:\program files\real\netscape6\nprjplug.dll
FF - plugin: c:\program files\real\netscape6\nprpjplug.dll
FF - plugin: c:\windows\system32\c2mp\npdivx32.dll
FF - plugin: e:\program files\divx player\npDivxPlayerPlugin.dll
FF - plugin: e:\program files\google\picasa3\npPicasa3.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.chrome.favicons - fales
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", "-1");
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); // now unused
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.delay", 50);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2008-5-10 162640]
R1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [2010-3-7 223312]
R1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [2010-3-7 24656]
R1 OAnet;OAnet;c:\windows\system32\drivers\OAnet.sys [2010-3-7 29776]
R1 SASDIFSV;SASDIFSV;e:\program files\superantispyware\sasdifsv.sys [2008-5-28 8944]
R1 SASKUTIL;SASKUTIL;e:\program files\superantispyware\SASKUTIL.SYS [2008-5-28 55024]
R2 AsSysCtrlService;ASUS System Control Service;c:\program files\asus\assysctrlservice\1.00.00\AsSysCtrlService.exe [2009-5-21 86016]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-5-10 19024]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-3-12 40384]
R2 DvmMDES;DeviceVM Meta Data Export Service;c:\asus.sys\config\DVMExportService.exe [2008-11-26 323584]
R2 nxsIO32;NextSensor Kernel I/O Driver;c:\windows\system32\drivers\nxsIO32.sys [2007-4-28 2208]
R2 OAcat;Online Armor Helper Service;c:\program files\tall emu\online armor\oacat.exe [2010-3-7 1282248]
R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-8-7 242048]
R2 TekSIP;TekSIP;e:\program files\teksip\TekSIP.exe [2009-8-17 303104]
R2 wlidsvc;Windows Live ID Sign-in Assistant;c:\program files\common files\microsoft shared\windows live\WLIDSVC.EXE [2009-8-18 1529728]
R3 dfmirage;dfmirage;c:\windows\system32\drivers\dfmirage.sys [2005-11-27 31896]
R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1e51x86.sys [2009-5-19 39424]
R3 MovRVDrv32;MovRVDrv32;c:\windows\system32\drivers\MovRVDrv32.sys [2008-6-29 3768]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-5-22 993280]
S2 AODService;AODService;c:\program files\amd\overdrive\aodassist –> c:\program files\amd\overdrive\AODAssist [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-10-22 133104]
S2 PSTRIP;PSTRIP;\??\c:\windows\system32\drivers\pstrip.sys –> c:\windows\system32\drivers\PSTRIP.SYS [?]
S2 SvcOnlineArmor;Online Armor;c:\program files\tall emu\online armor\oasrv.exe [2010-3-7 3291336]
S3 Alpham;Ideazon Merc Composite Keyboard Driver;c:\windows\system32\drivers\Alpham.sys [2005-12-4 34944]
S3 Alpham1;Ideazon Merc USB Human Interface Device;c:\windows\system32\drivers\Alpham1.sys [2007-7-23 42624]
S3 Alpham2;Ideazon Merc MM USB Human Interface Device;c:\windows\system32\drivers\Alpham2.sys [2007-3-20 18432]
S3 aswArKrn;aswArKrn;\??\c:\docume~1\jean-p~1\locals~1\temp\aswarkrn.sys –> c:\docume~1\jean-p~1\locals~1\temp\aswArKrn.sys [?]
S3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-3-12 40384]
S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-3-12 40384]
S3 BroadCamService;BroadCam Video Streaming Server;c:\program files\nch software\broadcam\broadcam.exe [2010-2-9 946180]
S3 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [2009-5-24 12672]
S3 iteio;iteio;\??\c:\windows\system32\drivers\iteio.sys –> c:\windows\system32\drivers\iteio.sys [?]
S3 MovPDrv32;MovPDrv32;c:\windows\system32\drivers\MovPDrv32.sys [2008-8-17 508544]
S3 P0630VID;Creative WebCam Live!;c:\windows\system32\drivers\P0630Vid.sys [2009-12-10 91841]
S3 SaiH0004;SaiH0004;c:\windows\system32\drivers\SaiH0004.sys [2007-11-7 182528]
S3 SaiL0004;SaiL0004;c:\windows\system32\drivers\SaiL0004.sys [2007-11-7 15104]
S3 SaiU0004;SaiU0004;c:\windows\system32\drivers\SaiU0004.sys [2007-11-7 27392]
S3 SASENUM;SASENUM;e:\program files\superantispyware\SASENUM.SYS [2008-5-28 7408]
S3 vvftav211;vvftav211;c:\windows\system32\drivers\vvftav211.sys [2010-2-3 480128]
S3 ZSMC30x;USB PC Camera Service ZSMC30x;c:\windows\system32\drivers\ZS211.sys [2010-2-3 1537280]
S4 AMD_RAIDXpert;AMD RAIDXpert;c:\program files\amd\raidxpert\bin\RAIDXpertService.exe [2008-8-31 122880]
S4 SoundMovieServer;SoundMovieServer;"c:\windows\system32\snmvtsvc.exe" –> c:\windows\system32\snmvtsvc.exe [?]
S4 VideoAcceleratorService;VideoAcceleratorService;c:\progra~1\speedbit video accelerator\videoacceleratorservice.exe -start -scm –> c:\progra~1\speedbit video accelerator\VideoAcceleratorService.exe -start -scm [?]
S4 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]

=============== Created Last 30 ================

2010-03-23 13:19 –d—– c:\windows\system32\wbem\Repository
2010-03-22 17:07 –d—– c:\program files\Trend Micro
2010-03-20 19:26 –d—– c:\program files\uTorrent
2010-03-18 15:35 –d—– c:\program files\GiPo@Utilities
2010-03-18 15:35 –d—– c:\program files\common files\Gibinsoft Shared
2010-03-12 18:38 –d—– c:\program files\iTunes
2010-03-12 14:06 –d—– c:\program files\Microsoft
2010-03-12 14:06 –d—– c:\program files\MSN Toolbar
2010-03-12 14:05 –d—– c:\program files\MSN Toolbar Installer
2010-03-12 11:23 –d—– c:\docume~1\alluse~1\applic~1\Alwil Software
2010-03-10 11:17 3,558,912 -c—— c:\windows\system32\dllcache\moviemk.exe
2010-03-07 18:10 –d—– c:\docume~1\jean-p~1\applic~1\OnlineArmor
2010-03-07 18:10 –d—– c:\docume~1\alluse~1\applic~1\OnlineArmor
2010-03-07 18:09 223,312 a——- c:\windows\system32\drivers\OADriver.sys
2010-03-07 18:09 29,776 a——- c:\windows\system32\drivers\OAnet.sys
2010-03-07 18:09 24,656 a——- c:\windows\system32\drivers\OAmon.sys
2010-03-07 18:09 –d—– c:\program files\Tall Emu
2010-03-02 09:49 0 a—h— c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2010-03-02 09:49 21,504 a——- c:\windows\system32\drivers\hidserv.dll
2010-02-24 09:39 –d—– c:\docume~1\jean-p~1\applic~1\Toolbar4
2010-02-23 16:55 –d—– c:\docume~1\alluse~1\applic~1\Dimdim
2010-02-23 16:55 -cd-h— c:\docume~1\alluse~1\applic~1\{BF03BF7A-B118-4C26-B9F7-08C12D3D06E3}
2010-02-22 19:04 –d—– c:\program files\Yahoo!

==================== Find3M ====================

2010-03-22 17:31 170,882 a——- c:\windows\pchealth\helpctr\config\cache\Professional_32_1033.dat
2010-02-19 18:47 3,604,480 a——- c:\windows\system32\GPhotos.scr
2010-02-09 12:00 695,578 a——- c:\windows\system32\unins000.exe
2010-01-05 05:00 832,512 a——- c:\windows\system32\wininet.dll
2010-01-05 05:00 78,336 a——- c:\windows\system32\ieencode.dll
2010-01-05 05:00 17,408 a——- c:\windows\system32\corpol.dll
2010-01-04 17:35 156,160 a——- c:\windows\system32\RemoteControl.dll
2009-05-21 20:54 87,608 a——- c:\docume~1\jean-p~1\applic~1\ezpinst.exe
2009-05-21 20:54 47,360 a——- c:\docume~1\jean-p~1\applic~1\pcouffin.sys
2008-04-17 19:51 991 ——– c:\program files\GH3D.txt
2008-04-17 19:51 142 ——– c:\program files\GamersHell.url
2007-06-27 11:12 3,075 a——- c:\docume~1\jean-p~1\applic~1\SAS7_000.DAT
1998-12-08 13:53 186,368 ——– c:\program files\common files\IRAREG.DLL
1998-12-08 13:53 99,840 ——– c:\program files\common files\IRAABOUT.DLL
1998-12-08 13:53 70,144 ——– c:\program files\common files\IRAMDMTR.DLL
1998-12-08 13:53 48,640 ——– c:\program files\common files\IRALPTTR.DLL
1998-12-08 13:53 31,744 ——– c:\program files\common files\IRAWEBTR.DLL
1998-12-08 13:53 17,920 ——– c:\program files\common files\IRASRIAL.DLL
2009-08-17 21:02 80 —shr– c:\windows\system32\870508C509.dll
2009-09-27 01:59 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009092620090927\index.dat

============= FINISH: 13:34:21.17 ===============

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-03-23 15:20:43
Windows 5.1.2600 Service Pack 3
Running: gcvfs7p2.exe; Driver: C:\DOCUME~1\JEAN-P~1\LOCALS~1\Temp\fxtdypog.sys

—- System - GMER 1.0.15 —-

SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwAllocateVirtualMemory [0xA8D3F420]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwAssignProcessToJobObject [0xA8D3FC60]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xA8C94C56]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwConnectPort [0xA8D3DA90]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwCreateFile [0xA8D4CCB0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xA8C94B12]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwCreatePort [0xA8D3D740]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwCreateProcess [0xA8D3A320]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwCreateProcessEx [0xA8D3A710]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwCreateSection [0xA8D39DE0]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwCreateThread [0xA8D3BCA0]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwDebugActiveProcess [0xA8D3C900]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteKey [0xA8C950C6]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xA8C94FF0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xA8C946E8]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwLoadDriver [0xA8D3EB40]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwOpenFile [0xA8D4D420]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xA8C94BEC]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xA8C94628]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwOpenSection [0xA8D3A080]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xA8C9468C]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwProtectVirtualMemory [0xA8D3F8A0]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwQueryDirectoryFile [0xA8D3EFB0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xA8C94D0C]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwQueueApcThread [0xA8D3FE00]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRenameKey [0xA8C95194]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwRequestWaitReplyPort [0xA8D3E690]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xA8C94CCC]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwResumeThread [0xA8D3D060]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwSecureConnectPort [0xA8D3DE80]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwSetContextThread [0xA8D3C6E0]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwSetSystemInformation [0xA8D3CAA0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xA8C94E4C]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwShutdownSystem [0xA8D3EA10]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwSuspendProcess [0xA8D3D240]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwSuspendThread [0xA8D3CE60]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwSystemDebugControl [0xA8D3CC90]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwTerminateProcess [0xA8D3BA30]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwTerminateThread [0xA8D3C4B0]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwUnloadDriver [0xA8D3ED70]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwWriteVirtualMemory [0xA8D3FA70]

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

Device \Driver\Tcpip \Device\Ip OAmon.sys (TDI Helper Driver/Tall Emu)

AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\Tcpip \Device\Tcp OAmon.sys (TDI Helper Driver/Tall Emu)

AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\Tcpip \Device\Udp OAmon.sys (TDI Helper Driver/Tall Emu)

AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\Tcpip \Device\RawIp OAmon.sys (TDI Helper Driver/Tall Emu)

AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\Tcpip \Device\IPMULTICAST OAmon.sys (TDI Helper Driver/Tall Emu)

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

—- Threads - GMER 1.0.15 —-

Thread System [4:168] 8B14987C

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\ControlSet001\Services\gasfkyaawndvbg@start 1
Reg HKLM\SYSTEM\ControlSet001\Services\gasfkyaawndvbg@type 1
Reg HKLM\SYSTEM\ControlSet001\Services\gasfkyaawndvbg@group file system
Reg HKLM\SYSTEM\ControlSet001\Services\gasfkyaawndvbg@imagepath \systemroot\system32\drivers\gasfkylkbtcsbo.sys
Reg HKLM\SYSTEM\ControlSet001\Services\gasfkyaawndvbg\main (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\gasfkyaawndvbg\main@aid 10063
Reg HKLM\SYSTEM\ControlSet001\Services\gasfkyaawndvbg\main@sid 0
Reg HKLM\SYSTEM\ControlSet001\Services\gasfkyaawndvbg\main@cmddelay 14400
Reg HKLM\SYSTEM\ControlSet001\Services\gasfkyaawndvbg\main\delete (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\gasfkyaawndvbg\main\delete@C:\DOCUME~1\JEAN-P~1\LOCALS~1\Temp\gasfkyximcrvgvxo.tmp
Reg HKLM\SYSTEM\ControlSet001\Services\gasfkyaawndvbg\main\delete@C:\DOCUME~1\JEAN-P~1\LOCALS~1\Temp\gasfkyjcxwtlqppg.tmp
Reg HKLM\SYSTEM\ControlSet001\Services\gasfkyaawndvbg\main\injector (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\gasfkyaawndvbg\main\injector@* gasfkywsp8.dll
Reg HKLM\SYSTEM\ControlSet001\Services\gasfkyaawndvbg\main\tasks (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\gasfkyaawndvbg\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\gasfkyaawndvbg\[removed] \systemroot\system32\drivers\gasfkylkbtcsbo.sys
Reg HKLM\SYSTEM\ControlSet001\Services\gasfkyaawndvbg\[removed] \systemroot\system32\gasfkydqmutslp.dll
Reg HKLM\SYSTEM\ControlSet001\Services\gasfkyaawndvbg\[removed] \systemroot\system32\gasfkyoaemycxh.dat
Reg HKLM\SYSTEM\ControlSet001\Services\gasfkyaawndvbg\[removed] \systemroot\system32\gasfkyrinbmrxb.dll
Reg HKLM\SYSTEM\ControlSet001\Services\gasfkyaawndvbg\[removed] \systemroot\system32\gasfkydbfcnxyw.dat
Reg HKLM\SYSTEM\ControlSet001\Services\gasfkyaawndvbg\[removed] \systemroot\system32\gasfkyckfhmais.dll
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG10.00.00.01WORKSTATION D98EFB25476BFE2C01EA2D0BE48CF6D8B52E8896AABC362E08A63B1349314E4D0E1266FB30EB497D
C3A1AADDF295FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9
E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79338EDD5E5BE2F6E667A2D97226D213B555A6A0AC
4980AC7933D8672C9BB043E433B3B421ED62743119E59607255100CEBB5E0D9120ED5DE5686809E4F
BC84047FE712BEF8818F04D4FD9C94CA0D600CA58D746BCB96A45874069BDAB5BE2B451B3D7F84956
BFF91980CBBB2A4F506AA0136A55052019483B378C9474014FCC992901F1D008E411AB7FDCA693702
4388A5F6079CF3E5771FB7AE5EE37A383CA7D6C683D3143B4CC635715968438577388606AC20975A4
620A6D6E056E7218821D3A71D6962480D7E043DC6D7ACC94BAD9F19A181E99A44FE8A582611A8C4A5
EDB09608D3135BE700A3384DE76C9AC42879F69B282F21F805EEEE1E23E07FA5B617EDD06B5FC09E8
87CCBD74FD3D8F515A2C339F2D3D80D0F6C632BB636B2E0B1CF6F8B85C6D1DA646E71F8B1AAAD542D
F8CB44218A7583300607A7313B70F12B902A2F0E273DD25F6122252D9093A06EA6A924F4157DA298E
A2A8645F5B672BB0E2AFCD89EACFF1110B26D0CEC39C9E922455D0ADE35FCC79A60B3D5A3C2AA1361
1D94314289DAF4AC6ECDC8D397DA3AFC96625E1D9E1C95A3CD70
Reg HKLM\SOFTWARE\Classes\mailto@ URL:MailTo Protocol
Reg HKLM\SOFTWARE\Classes\mailto@URL Protocol
Reg HKLM\SOFTWARE\Classes\mailto\DefaultIcon
Reg HKLM\SOFTWARE\Classes\mailto\DefaultIcon@ %ProgramFiles%\Outlook Express\msimn.exe,-2
Reg HKLM\SOFTWARE\Classes\mailto\shell
Reg HKLM\SOFTWARE\Classes\mailto\shell\open
Reg HKLM\SOFTWARE\Classes\mailto\shell\open\command
Reg HKLM\SOFTWARE\Classes\mailto\shell\open\command@ "%ProgramFiles%\Outlook Express\msimn.exe" /mailurl:%1

—- EOF - GMER 1.0.15 —-

📎Attachdds2.txt

SweetTech

Post #2March 23, 2010, 11:12 PM UTC

My name is SweetTech. I would be glad to take a look at your log and help you with solving any malware problems. I'd be grateful if you would note the following:

Logs from malware removal programs (DDS is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post.
Please make sure to carefully read any instruction that I give you.
Reading too lightly will cause you to miss important steps, which could have destructive effects.
If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
These instructions have been specifically tailored to your computer and the issues you are experiencing with your computer. It's important to note that these instructions are not suitable for any other computer, even if the issues are fairly similar.
Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
Please do not use the Attachment feature for any log file (only exception is for OTS logs). Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together
Because of this, you must reply within three days. I will post a reminder should you seem to fail to do this, however, if you fail to reply within two days then,
unless I have been notified of your absence in advance, the topic shall be closed!
Please do not PM me directly for help. If you have any questions, post them in this topic.
Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________

Questions:

Did you set up a proxy in Internet Explorer?

uInternet Settings,ProxyServer = 70.176.5.205:80

NEXT:

[external image: Posted Image] One or more of the identified infections is a backdoor trojan and password stealer.

This type of infection allows hackers to access and remotely control your computer, log keystrokes, steal critical system information, and download and execute files without your knowledge.
If you do any banking or other financial transactions on the PC or if it contains any other sensitive information, then from a clean computer, change all passwords where applicable.
It would also be wise to contact those same financial institutions to appraise them of your situation.

I highly suggest you take a look at the two links provided below:
1. How Do I Handle Possible Identify Theft, Internet Fraud, and CC Fraud?
2. When should I re-format? How should I reinstall?

NEXT:

We note you are using one or more products from IOBit.
IOBit has been accused by Malwarebytes of illegally using their intellectual property without permission.
Please see this for additional information on these allegations: http://www.malwarebytes.org/forums/index.php?showtopic=29681.
Additionally, both WOT and SiteAdvisor have flagged IOBit’s site.

A thread in the IOBit’s forum responded to the accusations from MalwareBytes.
It is noteworthy that several responses from users raising specific questions about IOBit’s response and finding it unsatisfactory were deleted and the thread was closed.
The bottom line from IOBit was:“No hard proof shows that IObit stole database of Malwarebytes.”

At least until the issues of possible database theft and spyware packaging is resolved, 247Fixes recommends against the use of IOBit products.

NEXT:

Running ComboFix
Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your Anti-Virus and Anti-Spyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the ComboFix log in your next reply as well as describe how your computer is running now

NEXT:

Please make sure you include the following items in your next post:

1. Any comments or questions you may have that you'd like for me to answer in my next post to you.
2. An answer to my question posed to you above under the question section.
3. The log that was produced after running ComboFix.
4. An update on how your computer is currently running.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.

Shenlord

Post #3March 24, 2010, 1:37 AM UTC

Hi. Thanks for answering so fast. 1. No I did not set up a proxy server in Internet Explorer 2. I uninstalled all the iobit products. 3. I installed and ran combofix in safe mode. I could not install it in normal mode. It installed the MS console and scanned. It erased many files, rebooted the comp in normal mode. No hitch. Right as Windows was about to open at the end of rebooting, I got the message " File CF9214.cfxxe To open this file Window needs to know what tool etc." I thought it was the log - it was - and opened it in notepad. Windows then opened normally. The log is very garbled. I didn't know what else to open the file with, and windows would not open till I dealt with the file. Pasted later in post. Update on comp running: I now cannot open Safari browser. I am still getting: "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item." when trying to open setup.exe files and some programs. I can still do most things. 4. Question: Is it better if I stay off the internet? Stay off the computer? - I have a laptop as a backup. I do not have sensitive financial or personal info on this comp. I play games, watch movies, design websites, write emails. I found the original cfxxe file. I don't know how to open it to paste it for you.. Let me know what else you want me to do with it. I don't think I can send it as an attachment Here is the ComboFix Log: Ah. Th forum telles me the post is too long and to reduce it. I will send it as .txt attachment instead. oops it is 385K. Still too big. I tried to send it as rar file. could not. I will copy parts of it. tell me what else you want me to do. Beginning fragment MZ ÿÿ ¸ @ Ø º ´ Í!¸LÍ!This program cannot be run in DOS mode.$ íÕêYŒ»¹YŒ»¹YŒ»¹šƒ´¹_Œ»¹YŒº¹€Œ»¹šƒæ¹^Œ»¹æƒÛ¹[Œ»¹šƒå¹XŒ»¹šƒä¹mŒ»¹šƒá¹XŒ»¹RichYŒ»¹ PE L ¯[H à ø ö FP ð ÐJ Û© € @ö P à ( Ä 8 @“ @ H X ó € .text ö ø `.data $Ê Ê ü @ À.rsrc ( à * Æ @ @,¡H( ,¡H5 ” H? ¡HJ KERNEL32.dll NTDLL.DLL msvcrt.dll USER32.dll †|…Þ€|é€|°™€|.“€|·¤€|¥¤€|“(|i|soƒ|¹€|~ó€|€|0%€|;«|cø‚|Åƒ|Kƒ|¨ƒ|ê#ƒ|d@‡|‰O‡|eO‡|§Kƒ|ŽÞ€|Ñ&|€›‘|½‘|…|¿™€|`³€|Ÿ€|«²|®€|\·|e´€|j| |à|æƒ|lç€||uú€|þ|I‚|µÙ‚|sVƒ|¬‹†|Ü·€|¸—€|6#€|Û®€|Ð!€|Ÿ¬€|8¬|¯|áš€|t›€|N|„ñ€|p|˜/|d¨€|ë?ƒ|öè€|7ƒ|þ|×›€|Ú¸|0®€|Íä€||\ª€|&ª€|¤ ‘|Q¬€| ÿ|ˆœ€|€|œTƒ|@@‡|*L‡|Œ*‡|K¹|É/|á|aº€|™*|/|¯®|d¡€||ð|gî€|Êï€|qï€|â¸€| Ÿ€|ò|i\…|¬|o€||è€| ÛñÀM¤ñÀMØ#ÅM•ÖÃMgÂMëîÀM8ÅM¶žÂM®-ÂMšžÂMÎžÂMÃÀÁMiÃMPoÂMçÿÂM€ÃM ×ÁMôÔÁM²æÁM×ÐÁM³ÃMNÂÀMJöÁMz]ÂMÇûÁM/€ÃM"ÑÀMöîÂM~žÂMwÎÀMÏ®ÃM¼qÂM|SÂMù€ÃMÄÁMÂÁMJÜÀM¼òÀM¿ÐÀMjÃMÓqÂMÈùÂM€üÄMÃM·×ÀM 7ÄÁM1<ÂMûÂMa~ÃMÔlÃMk€ÃMnÃM±ÃMÝöÂM°rÃM¸~ÃM=ÑÀMcüÁMtmÂMã~ÃM»jÃM½gÃM+ÜÀM ÑÀM¡êÁMhäÁMOîÃMœaÂM”\ÂM”~ÃMÌÃM2ÃMwØÀM A~QšA~{C~•‘A~ ; x;ÓJ…¤Ý ÷Á ÿÿ…˜Ý Ã‹ÿU‹ìƒ} „^J ÿuÿuÿ ÐJYY]Â ‹ÿU‹ìW‹}j"WèÉÿÿÿ…À… ‹Ç_]Â \ ‹ÿU‹ìƒì0V‹u…ö„ÏZ €= úÒJ …ÂZ ƒ>+„¹Z €=|;ÓJ WÇE …l7 ƒ}„áE ‹…À…·& ƒ~4 t ÿuVèà) …Àu&‹…ÀV…¹& èm ‰E¡ì:ÓJ…Àt 9puè]) €=|;ÓJ _…Z7 ‹E^ÉÂ ‹ÿU‹ìS3Û9]t9ÄúÒJu8ü:ÓJ…zà []Â ‹Mðd‰ Y_^[ÉQÃ‹ÿU‹ìì ¡x;ÓJVW‹}‰Eü‹G83ö;Æ„jL fƒx:…-F · PèÊ …À„#6 ‹G8· Pè® …À…6 ‹G8· PÿäÐJ3öf‹ð‹G8Yƒî@…À„!L PÿÜÐJYƒø„ö5 WèÎ ‹Mü_^èþÿÿÉÂ ‹ÿU‹ìS‹]V3ö9ð¹ÒJ‡šF Vè Fƒþ|ô^[]Â ‹ÿU‹ì‹Eƒø}V4… ;ÓJ‹…À…Ü6 ^]Â ‹ÿU‹ìƒìfƒ} ¡x;ÓJV‹u‰Eü…³‡ Vh ÿLÐJ3À‹Mü^èýÿÿÉÂ ‹ÿU‹ìƒìÿuÆ4úÒJ ÿÜÐJ…ÀYu!EVWÿuÿuÿÐJ‹5ÐJ‹øÿÖ‹ Ð°ÒJ;È…yÕ Qè £Ô°ÒJ3À…ÿ_”À^ÉÂ ‹ÿU‹ì‹E3É…Àtfƒ8 tA@@ëõfƒx uôD ]Â h²ñÑJd¡ P‹D$‰l$l$+àSVW‹Eø‰eèP‹EüÇEüÿÿÿÿ‰EøEðd£ Ã¡;ÓJ…À„á6 j ÿÐÂ ‹ÿSV‹5ÈÐJWÿ5´úÒJjÿÖ‹= ÐJYPÿ×h´úÒJjÿÖ‹üÐJYPÿÓ…Àt¡´úÒJƒà<…@ h°úÒJj ÿÖYPÿÓ…Àt+¡°úÒJ‹Èƒá€ù…† ¨…ÿ… ¡túÒJ…ÀthüÐJÿÐ_^[ÃC M D . E X E ‹ÿU‹ìV‹uƒÆVjÿPÐJPÿLÐJ…À„W5 ‰0‹ ô¹ÒJ‰Hÿð¹ÒJ£ô¹ÒJƒÀ^]Â ‹ÿU‹ìVÿuè«ÿÿÿ‹ð…ö„-5 ‹Æ^]Â ‹ÿU‹ì‹ESV‹5PÐJW‹}ƒÀøƒÇWPj ‰EÿÖPÿŒÐJ‹Ø…Û„ò4 Sj ‰;ÿÖPÿÐJ;]…Qq C_^[]Â ‹ÿU‹ìƒì$¡x;ÓJV‹u…ö‰Eü‹E‰Eä„~F SWVÿÜÐJY… PèIÿÿÿf‹=€;ÓJ3Ûf…ÿ‰EÜ‰Eìf‰}àt2ÇEè€;ÓJÿuàÿuäèêúÿÿ…Àuf‰|]ðCƒEè‹Eèf‹ f‹øf…ÿf‰EàuÕfƒd]ð 3À@‰Eà‰Eè3Àf‹f…À„° fƒø"tPÿ¤ÐJ…ÀYuPf‹PEðPèŽúÿÿ…Àu?ƒeà ƒ}ä t3Àf‹Pÿuäèrúÿÿ…À…— ‹Mìf‹ƒEìf‰fƒ>"„× ƒeè FFë’‹]öÃ…¹S ƒãt3Àf‹Pÿuäè,úÿÿ…Àuž‹}ƒç…£S 3Àf‹f…Àtfƒø"…¾C 3Àf9…ôC ‹Eì+EÜÑøD PÿuÜèAþÿÿ_[‹Mü^è¿ùÿÿÉÂ ) öE…ñC öE…lS ƒeè ƒEìécÿÿÿ‹ÿU‹ìSV‹u‹F8…ÀW‹=ÜÐJ„ÏD Pÿ×Y‹Ø‹F<…À„·D Pÿ×YÃD Pè^ýÿÿ‹Ø…Û‰]t^‹F8…Àt PSÿØÐJYYSÿ×C‹F<…ÀY„D Pÿ×Y…Àt0‹F ÿµèýÿÿ…ôýÿÿPj+èÄþÿÿƒø+„µ ƒÿÿÆ…óýÿÿ Æ…òýÿÿ uu3Ûˆñýÿÿ‹F8f‹ Wh€;ÓJèãôÿÿ…À…+ f;=ˆ;ÓJ„ CÆ…òýÿÿ €½ñýÿÿ t“‹F8…À‹=ÜÐJ„î‚ Pÿ×Y‰…ìýÿÿ;ìýÿÿ…1* ‹…äýÿÿ‹Mü_^[ègôÿÿÉÂ WhìCÓJèvôÿÿ…À„œþÿÿ€=dúÒJ „¢þÿÿ‰ìýÿÿé„þÿÿ‹ÿU‹ì‹E@‹Åô;ÓJ]Â ÿ5xúÒJÿ¸ÐJÿ5xúÒJƒ%è¹ÒJ ÿ¼ÐJÃ‹ÿU‹ì‹Efƒ%‚ÒJ £ø¹ÒJ‹E£ü¹ÒJ¸‚ÒJ£$úÒJ£0úÒJ]Â ÿ%ÐÐJ‹ÿU‹ìSV‹uÿu‰5húÒJèŽõÿÿÿuVèŸÿÿÿ3ÛSh€FÓJèÇÿÿÿ;ÃYYuHS‰8úÒJ‰,úÒJèA ‹ð;ó„ÌM èÓ …ÀtSèŽ ƒø …&7 ‰(úÒJ8ÉFÓJ…*7 ‹Æ^[]Â ‹ÿU‹ì¡8úÒJÿ8úÒJS‹]ƒû1ˆ˜à°ÒJ„3g jÇä¹ÒJ è2 ƒ%ä¹ÒJ ƒ=DúÒJ „óK èr ÿ 8úÒJƒû1[„g ]Â ‹ÿU‹ìƒ=,úÒJ …|f ÿuÿ5t;ÓJèD ƒøÿ£DúÒJ„¸1 ¡t;ÓJ…À„\f PÿÜÐJY@€=ÈFÓJ £@úÒJ…•1 ¡DúÒJ]Â ‹ÿU‹ìQQSVWj h@FÓJèŽþÿÿ…ÀYY…&¿ ‹u…ö„N öE!¡$úÒJ£0úÒJ‰uøu@è° ‹ØS‰]üÿ¤ÐJ…ÀYtfƒû uäöE¸‚;ÓJu¸€;ÓJSPèòÿÿ…À…_J è” EPEüPèž » ;Ã…ÿ ‹]ü‹=ÀÐJf‰FFS‰uÿ×…ÀY…8 fƒû|„K fƒû&„A fƒû>„7 fƒû<„- ‹Eøfƒ& · _^[ÉÂ ‹ $úÒJfƒ9 t#fƒ9 „XF ƒ=ÄFÓJ …aF f‹AA‰ $úÒJÃè ‹ $úÒJëÐ‹ÿU‹ìQQSVWèýÿÿ¡$úÒJf‹@þ‹ ø¹ÒJf£€ÒJ‹Áƒàƒø¿‚ÒJ…®D fƒ%‚PÒJ h ÿ5ü¹ÒJWÿŒÐJWÿÜÐJ‹ ü¹ÒJAƒÄ£ü¹ÒJ‰=$úÒJèƒ ¡$úÒJ_^£0úÒJ[ÉÃ= ‚ø QL$é - …= sì+È‹Ä…‹á‹‹@PÃ‹ÿU‹ìÿuÿuÿuÿŒÐJ‹EƒÄ]Â =$úÒJ€ÒJtƒ-$úÒJÃ‹ÿU‹ì¸@ è}ÿÿÿ¡x;ÓJV‰Eü¡$úÒJW3ÿ;Çµø¿ÿÿtP‹ÆPÿØÐJYY‹…ø¿ÿÿf;Ç‰½ð¿ÿÿ‰½ô¿ÿÿtDSjYñ½ô¿ÿÿ 1j%[f;Ã„éK ‹$úÒJf‰ $úÒJÿ…ô¿ÿÿfƒø t f‹3ÿf;Çu¾[½ô¿ÿÿ ¡$úÒJf‰8Ç$úÒJ‚ÒJj" ‹Mü_^èzïÿÿÉÃ3Àf‹Pÿ¤ÐJ…ÀYuö¸‚;ÓJu¸€;ÓJ3Éf‹QPèjïÿÿ…Àt|¸ éŠ ‹ÿU‹ìVWè¾ýÿÿƒ=ÀFÓJ ‹}‹uf‰…)$ f‹S·Âƒø)j[~[‹Èƒé<„€ +Ët|+Ë„èK ƒéº ¸ @ éåûÿÿ‹ÿU‹ìQQSVWEü3ÛP‰]ü‰]øè{ …À…d. èl ‹}ü;û‹ð…^. è– …Àt$SèQúÿÿEüP‰]üèF …À…‡. SSèšúÿÿ‹}ü‹^4‹Ã…Àt‹3ÒBÓâ‰Mü…Uø…†. Uø‹ø‹@ëß_‹Æ^[ÉÃ=DúÒJ @ V…=I ÿ5t;ÓJ‹5¸ÐJhÐBÓJÿÖ…ÀYY„q^ ÿ5t;ÓJhÐFÓJÿÖ…ÀYY„Z^ ÿ5t;ÓJhäBÓJÿÖ…ÀYY„Ì` ÿ5t;ÓJhÜFÓJÿÖ…ÀYY„µ` ÿ5t;ÓJh,CÓJÿÖ…ÀYY„G° ÿ5t;ÓJhèFÓJÿÖ…ÀYY„0° ^‹ÿU‹ìQSV3öWV‰uü]üè ‹øèw …Àt'jè1ùÿÿ= @ „¹ Sè! …À…Z VVèuùÿÿ‹Eü‰G4‹Ç_^[ÉÃ‹ÿU‹ìQQƒeü ƒeø SVW‹}¡t;ÓJ3Ûf‹fƒû<„x fƒû>„n SÿÀÐJ…ÀY…$ ‹Eü…À_^[…Ú 3ÀÉÂ ‹ÿU‹ìVèG ‹ð…ö„o* ‹Eƒf@ ‰¡@úÒJÀPè‘ïÿÿ…À‰F8t‹ t;ÓJ…Ét QPÿØÐJYY‹Æ^]Â jPèïÿÿÃhª%ÐJhû'ÐJj0h%ÐJè Ã‹ÿU‹ìSVWÿU‹ø‰}èN …Àt<3ÛSèøÿÿÿ5t;ÓJ‹5°ÐJÿuÿÖ…ÀYY„È ¡8úÒJ€¸ß°ÒJ1„x^ SSè7øÿÿ‹Ç_^[]Â ‹ $úÒJ3Àf9•ÀÃhû'ÐJhŽ(ÐJj/h¨(ÐJèsÿÿÿÃ& & hŽ(ÐJh³(ÐJj.hÌ(ÐJèNÿÿÿÃ| | ‹G<;Æ…>, 3À‹ @úÒJÁÑàPèiîÿÿ‹ð…öt‹G<…À…(, ¡t;ÓJ…Àt PVÿ„ÐJYY‰w<3öéáýÿÿ‹ÿU‹ìV‹u3Àf‹f…ÀtPÿ¤ÐJ…ÀYtFFëè‹Æ^]Â ¡$úÒJ‹Èé‚ÒJƒáþƒù|*3Ûf‹XüSÿ¤ÐJ…ÀYuSh´)ÐJè¥éÿÿ…À„Èúÿÿ¡$úÒJf‹ fƒø…°úÿÿö"¸ „¥úÿÿéúÿÿ( ) | & = , ; " ‹ÿU‹ìV‹uW3ÿ…öt)9}t$3Àf‹f…ÀtPÿuFFè.éÿÿ…ÀuGëæ‹Ç_^]Â 3Àëö‹ÿU‹ì‹Eƒ ŠM‹ öÑ"È€áöÙÉA‹Á]Â ‹ÿU‹ìÿuÿuÿuÿuh *ÐJèæðÿÿ]Â ‹ÿU‹ìƒì¡x;ÓJfƒeú ‰Eüf‹Ef‰Eôf¡Œ;ÓJf‰EøEôPfÇEö: ÿœÐJ3ÉA;È‹MüÀ÷ØèbèÿÿÉÂ ‹MìƒEìFFf‹f‰f‹f…À„9³ fƒø"tfƒ~ uØfƒ> …÷íÿÿé³ ‹ÿU‹ì‹M…Ét‹Ef‹ÐW‹}Áâf‹ÐÑé‹Âó«Éfó«_]Â SVh 3öV»°KÓJSè¿ÿÿÿ;þtWÿÜÐJY3Ò…Àë3Àëôf‹Wfƒù"t f‰u°KÓJFB;Ð|èfƒ$u°KÓJ ^‹Ã[éþçÿÿ‹ÿU‹ìW‹}…ÿt4V3öf‹7Vÿ¤ÐJ…ÀY…ÉC Vh€;ÓJèŠçÿÿ…À…ÇC ƒ} …BE ^‹Ç_]Â C O P Y C M D ‹ÿU‹ìS3Û9]„õ VÿÐJ‹ð;ó„ë WSÿuèvÿÿÿ‹øj W‰}èQîÿÿ;Ã… fragment 2 ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿ ÿÿÿ ÿ è ( 00 ¨ ¨ h 00 ¨% ¨ h t4 V S _ V E R S I O N _ I N F O ½ïþ ˆ( ˆ( ? Ô S t r i n g F i l e I n f o ° 0 4 0 9 0 4 B 0 L C o m p a n y N a m e M i c r o s o f t C o r p o r a t i o n \ F i l e D e s c r i p t i o n W i n d o w s C o m m a n d P r o c e s s o r b ! F i l e V e r s i o n 5 . 1 . 2 6 0 0 . 5 5 1 2 ( x p s p . 0 8 0 4 1 3 - 2 1 1 1 ) ( I n t e r n a l N a m e c m d € . L e g a l C o p y r i g h t © M i c r o s o f t C o r p o r a t i o n . A l l r i g h t s r e s e r v e d . 8 O r i g i n a l F i l e n a m e C m d . E x e j % P r o d u c t N a m e M i c r o s o f t ® W i n d o w s ® O p e r a t i n g S y s t e m @ P r o d u c t V e r s i o n 5 . 1 . 2 6 0 0 . 5 5 1 2 D V a r F i l e I n f o $ T r a n s l a t i o n ° (# ,# ” .# 2# ø 4# :# T <# <# ä ?# J# P L# T# è [# d# Ð k# l# Ä n# o# X q# Û# l ' $' ø '' )' Ä N Y % 0 t A n i n c o r r e c t p a r a m e t e r w a s e n t e r e d f o r t h e c o m m a n d . X T h e s y n t a x o f t h e c o m m a n d i s i n c o r r e c t . P P r e s s a n y k e y t o c o n t i n u e . . . % 0 4 % 1 , D e l e t e ( Y / N ) ? % 0 € T h e s y s t e m c a n n o t a c c e p t t h e p a t h o r f i l e n a m e r e q u e s t e d . ` T h e s y s t e m c a n n o t a c c e p t t h e d a t e e n t e r e d . \ N o b a t c h l a b e l s p e c i f i e d t o G O T O c o m m a n d . À ' % 1 ' i s n o t r e c o g n i z e d a s a n i n t e r n a l o r e x t e r n a l c o m m a n d , o p e r a b l e p r o g r a m o r b a t c h f i l e . ` T h e s y s t e m c a n n o t a c c e p t t h e t i m e e n t e r e d . X ( C ) C o p y r i g h t 1 9 8 5 - 2 0 0 1 M i c r o s o f t C o r p . ^ C 0 % 1 f i l e ( s ) c o p i e d . 8 T h e c u r r e n t d a t e i s : % 0 8 T h e c u r r e n t t i m e i s : % 0 0 D i r e c t o r y o f % 1 X T h e s y s t e m i s o u t o f e n v i r o n m e n t s p a c e . l T h e s y s t e m c a n n o t e x e c u t e t h e s p e c i f i e d p r o g r a m . @ T h e i n p u t l i n e i s t o o l o n g . ` T h e c o n t e n t s o f t h e t a r g e t f i l e w e r e l o s t . ° I n s e r t t h e d i s k e t t e t h a t c o n t a i n s t h e b a t c h f i l e a n d p r e s s a n y k e y w h e n r e a d y . % 0 L E n t e r t h e n e w d a t e : ( m m - d d - y y ) % 0 8 E n t e r t h e n e w t i m e : % 0 ” T h e h a n d l e c o u l d n o t b e d u p l i c a t e d d u r i n g r e d i r e c t i o n o f h a n d l e % 1 . $ E C H O i s o f f . E C H O i s o n . ( V E R I F Y i s o f f . $ V E R I F Y i s o n . X T h e f i l e c a n n o t b e c o p i e d o n t o i t s e l f . H % 1 w a s u n e x p e c t e d a t t h i s t i m e . \ T h e P r o c e s s I d e n t i f i c a t i o n N u m b e r i s % 1 . € A d u p l i c a t e f i l e n a m e e x i s t s , o r t h e f i l e c a n n o t b e f o u n d . @ % 1 , A r e y o u s u r e ( Y / N ) ? % 0 h T h e f o l l o w i n g c h a r a c t e r s t r i n g i s t o o l o n g : % 1 P M i c r o s o f t W i n d o w s X P [ V e r s i o n % 1 ] % 0 „ T h e h a n d l e c o u l d n o t b e d u p l i c a t e d d u r i n g a p i p e o p e r a t i o n . M o r e ? % 0 X T h e s y s t e m c a n n o t c o m p l e t e t h e p r o c e s s . % 1 @ V o l u m e S e r i a l N u m b e r i s % 1 \ A s u b d i r e c t o r y o r f i l e % 1 a l r e a d y e x i s t s . T E r r o r o c c u r r e d w h i l e p r o c e s s i n g : % 1 . L V o l u m e i n d r i v e % 1 h a s n o l a b e l . < V o l u m e i n d r i v e % 1 i s % 2 K E Y S i s o n . $ K E Y S i s o f f . | T h e s y s t e m c a n n o t a c c e p t t h e S T A R T c o m m a n d p a r a m e t e r % 1 . P T h e s y s t e m c a n n o t f i n d t h e f i l e % 1 . l T h e p r o c e s s t r i e d t o w r i t e t o a n o n e x i s t e n t p i p e . L " % 1 " i s n o t a r e c o g n i z e d d e v i c e . H T h e b a t c h f i l e c a n n o t b e f o u n d . , % 1 f i l e ( s ) m o v e d . è A p r o g r a m a t t e m p t e d t o r e f e r e n c e s t o r a g e o u t s i d e t h e l i m i t s o f a s t a c k s e g m e n t . T h e p r o g r a m w a s e n d e d . % 1 % 1 % 0 < C o m m a n d n o t i m p l e m e n t e d . ( < D I R > % 0 ( O u t o f m e m o r y . 8 I n v a l i d s w i t c h - " % 1 " . T P a r a m e t e r f o r m a t n o t c o r r e c t - " % 1 " . \ ( E r r o r o c c u r r e d i n e n v i r o n m e n t v a r i a b l e ) < % 1 F i l e ( s ) % 2 b y t e s D % 1 D i r ( s ) % 2 b y t e s f r e e < T o t a l F i l e s L i s t e d : D T e r m i n a t e b a t c h j o b ( Y / N ) ? % 0 L T h e c u r r e n t d i r e c t o r y i s i n v a l i d . „ D i s p l a y s t h e n a m e o f o r c h a n g e s t h e c u r r e n t d i r e c t o r y . C H D I R [ / D ] [ d r i v e : ] [ p a t h ] C H D I R [ . . ] C D [ / D ] [ d r i v e : ] [ p a t h ] C D [ . . ] . . S p e c i f i e s t h a t y o u w a n t t o c h a n g e t o t h e p a r e n t d i r e c t o r y . T y p e C D d r i v e : t o d i s p l a y t h e c u r r e n t d i r e c t o r y i n t h e s p e c i f i e d d r i v e . T y p e C D w i t h o u t p a r a m e t e r s t o d i s p l a y t h e c u r r e n t d r i v e a n d d i r e c t o r y . U s e t h e / D s w i t c h t o c h a n g e c u r r e n t d r i v e i n a d d i t i o n t o c h a n g i n g c u r r e n t d i r e c t o r y f o r a d r i v e . < C l e a r s t h e s c r e e n . C L S C o p i e s o n e o r m o r e f i l e s t o a n o t h e r l o c a t i o n . C O P Y [ / D ] [ / V ] [ / N ] [ / Y | / - Y ] [ / Z ] [ / A | / B ] s o u r c e [ / A | / B ] [ + s o u r c e [ / A | / B ] [ + . . . ] ] [ d e s t i n a t i o n [ / A | / B ] ] s o u r c e S p e c i f i e s t h e f i l e o r f i l e s t o b e c o p i e d . / A I n d i c a t e s a n A S C I I t e x t f i l e . / B I n d i c a t e s a b i n a r y f i l e . / D A l l o w t h e d e s t i n a t i o n f i l e t o b e c r e a t e d d e c r y p t e d d e s t i n a t i o n S p e c i f i e s t h e d i r e c t o r y a n d / o r f i l e n a m e f o r t h e n e w f i l e ( s ) . / V V e r i f i e s t h a t n e w f i l e s a r e w r i t t e n c o r r e c t l y . / N U s e s s h o r t f i l e n a m e , i f a v a i l a b l e , w h e n c o p y i n g a f i l e w i t h a n o n - 8 d o t 3 n a m e . / Y S u p p r e s s e s p r o m p t i n g t o c o n f i r m y o u w a n t t o o v e r w r i t e a n e x i s t i n g d e s t i n a t i o n f i l e . / - Y C a u s e s p r o m p t i n g t o c o n f i r m y o u w a n t t o o v e r w r i t e a n e x i s t i n g d e s t i n a t i o n f i l e . / Z C o p i e s n e t w o r k e d f i l e s i n r e s t a r t a b l e m o d e . T h e s w i t c h / Y m a y b e p r e s e t i n t h e C O P Y C M D e n v i r o n m e n t v a r i a b l e . T h i s m a y b e o v e r r i d d e n w i t h / - Y o n t h e c o m m a n d l i n e . D e f a u l t i s t o p r o m p t o n o v e r w r i t e s u n l e s s C O P Y c o m m a n d i s b e i n g e x e c u t e d f r o m w i t h i n a b a t c h s c r i p t . T o a p p e n d f i l e s , s p e c i f y a s i n g l e f i l e f o r d e s t i n a t i o n , b u t m u l t i p l e f i l e s f o r s o u r c e ( u s i n g w i l d c a r d s o r f i l e 1 + f i l e 2 + f i l e 3 f o r m a t ) . p D i s p l a y s o r s e t s t h e d a t e . D A T E [ / T | d a t e ] T y p e D A T E w i t h o u t p a r a m e t e r s t o d i s p l a y t h e c u r r e n t d a t e s e t t i n g a n d a p r o m p t f o r a n e w o n e . P r e s s E N T E R t o k e e p t h e s a m e d a t e . ð D e l e t e s o n e o r m o r e f i l e s . D E L [ / P ] [ / F ] [ / Q ] [ / A [ [ : ] a t t r i b u t e s ] ] n a m e s E R A S E [ / P ] [ / F ] [ / Q ] [ / A [ [ : ] a t t r i b u t e s ] ] n a m e s n a m e s S p e c i f i e s a l i s t o f o n e o r m o r e f i l e s o r d i r e c t o r i e s . W i l d c a r d s m a y b e u s e d t o d e l e t e m u l t i p l e f i l e s . I f a d i r e c t o r y i s s p e c i f i e d , a l l f i l e s w i t h i n t h e d i r e c t o r y w i l l b e d e l e t e d . / P P r o m p t s f o r c o n f i r m a t i o n b e f o r e d e l e t i n g e a c h f i l e . / F F o r c e d e l e t i n g o f r e a d - o n l y f i l e s . / S D e l e t e s p e c i f i e d f i l e s f r o m a l l s u b d i r e c t o r i e s . / Q Q u i e t m o d e , d o n o t a s k i f o k t o d e l e t e o n g l o b a l w i l d c a r d / A S e l e c t s f i l e s t o d e l e t e b a s e d o n a t t r i b u t e s a t t r i b u t e s R R e a d - o n l y f i l e s S S y s t e m f i l e s H H i d d e n f i l e s A F i l e s r e a d y f o r a r c h i v i n g - P r e f i x m e a n i n g n o t D i s p l a y s a l i s t o f f i l e s a n d s u b d i r e c t o r i e s i n a d i r e c t o r y . D I R [ d r i v e : ] [ p a t h ] [ f i l e n

SweetTech

Post #4March 24, 2010, 1:45 AM UTC

Hello,

Response to Safari issue
Please correct me if I'm wrong but before running ComboFix you were able to run Safari with no issues. Do you receive any error messages when trying to run Safari?

Response to "Windows cannot access the specified device, path, or file…. Error
What setup file is this for that you are trying to install?

Response to using computer question
For the time being I'd recommend doing the least amount of work on the infected computer until we get it cleaned up.

The log that you posted from ComboFix looks to be a little strange. Could you please try and see if you can locate the ComboFix log in your root drive (C:). You can find instructions below.

Locating ComboFix Log

Right click on START on the left end of your Windows toolbar (lower left corner of your screen)
Click on Explore
Click on Local Disk (C:) in the left-hand window pane
Look for ComboFix.txt in the right-hand window pane and right click on it
Put your cursor (arrow) on Open With
Move your cursor to the new menu that opens and click on Choose Program…
Click on Notepad

When file opens, Copy/Paste text here.

Shenlord

Post #5March 24, 2010, 4:30 AM UTC

Hello SweetTech. 1. Yes. Safari worked before ComboFix. Error message is : Problem with shortcut The action is only valid for products that are currently installed 2. Set up exe files used? I just try any on my desktop to test: e.g. HJTinstall exe or sysrestore setup. (also user options in control panel). I then get error message and know the problem is still there. 3. the COmboFix log file I posted indeed came from C: drive. It is garbled there. After my comp rebooted at the end of the combofix fix, I was prompted to open that file with a tool and chose notepad. The garbled version is the result you saw. So there is other way to get log - short of rerunning combofix. The Original file seems to be heavily corrupted. The COmboFix process - in safe mode - seemed to run without a hitch: installing MS console, scanning, deleting and rebooting. Problem is log file. 4. I will only use comp when you need me too. (this is written on laptop.) Thank you once again SweetTech. Have a nice evening/morning. JPS

SweetTech

Post #6March 24, 2010, 5:00 PM UTC

Hello Shenlord,

1. I'll come back to this issue regarding Safari later.

2. I'd like to come back to this issue as well.

3. That log that you posted looks really strange. I'm not exactly sure what happened to it, but if you don't mind, I'd like to have you upload it somewhere for me so that I can have access to it at a later time if need be.

Please open this link HERE in a new window.

In the box marked Link to topic where this file was requested: please paste in the following text

http://forums.whatthetech.com/Adware_HBHelper_Browser_Hijacker_Desktop_t111140.html&view=findpost&p=643174#entry643174

Click the Browse button and locate a file named: ComboFix.txt

Select this file and click Open
In the largest box please put

File Requested By: SweetTech
Unknown CF Output in Log.

Finally click Send File

Please return here and let me know when that file has been uploaded.

NEXT:

OTL Custom Scan

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
mv61xx.sys
/md5stop
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
You may need two posts to fit them both in.

NEXT:

Please make sure you include the following items in your next post:

1. Any comments or questions you may have that you'd like for me to answer in my next post to you.
2. A confirmation that you submitted that file.
3. The logs that were produced after running OTL. (OTL.txt & Attach.txt)
4. An update on how your computer is currently running.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.

Shenlord

Post #7March 24, 2010, 7:23 PM UTC

Hi Sweettech. Not sure if the server uploaded the unusual CF.txt file or not. It told me to try later after telling me upload was successful.?? File is only 345kb. Check and see but I think it went.. I separately sent the original. cfxxe version that is in the CF c: directory. [Your file was successfully submitted. Please let the user helping you know that you have submitted the file.Query failed : MySQL server has gone away .]

SweetTech

Post #8March 24, 2010, 7:38 PM UTC

Can you please try and upload the file again. It doesn't seem like it got uploaded.

Shenlord

Post #9March 24, 2010, 8:08 PM UTC

Hi
1. No questions
2. I submitted the odd log earlier.
3. OTL log below (run in safe mode)….. Extras in next post
4. No change in comp. Avast has disappeared…. gone…. pfft. I have realtime protection from Super Antispyware Pro. I could reinstall Avast if you think it is wise. Computer is off unless I'm doing my homework for you.

OTL logfile created on: 3/24/2010 2:52:26 PM - Run 1
OTL by OldTimer - Version 3.1.37.3 Folder = C:\Documents and Settings\Administrator\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 89.00% Memory free
5.00 Gb Paging File | 5.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): c:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 14.74 Gb Free Space | 19.79% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 74.52 Gb Total Space | 48.87 Gb Free Space | 65.58% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JPRIG
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: SafeMode with Networking
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Administrator\My Documents\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Tall Emu\Online Armor\oaevent.dll (Tall Emu)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcp80.dll (Microsoft Corporation)
MOD - E:\program files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
MOD - C:\WINDOWS\system32\wtsapi32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\winsta.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msacm32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\cabinet.dll (Microsoft Corporation)
MOD - C:\WINDOWS\AppPatch\acgenral.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\rsaenh.dll (Microsoft Corporation)
MOD - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (SoundMovieServer) – File not found
SRV - (avast! Web Scanner) – File not found
SRV - (avast! Mail Scanner) – File not found
SRV - (avast! Antivirus) – File not found
SRV - (aswUpdSv) – File not found
SRV - (VideoAcceleratorService) – C:\Program Files\SpeedBit Video Accelerator\VideoAcceleratorService.exe (Speedbit Ltd.)
SRV - (BroadCamService) – C:\Program Files\NCH Software\BroadCam\broadcam.exe (NCH Software)
SRV - (SvcOnlineArmor) – C:\Program Files\Tall Emu\Online Armor\oasrv.exe (Tall Emu)
SRV - (OAcat) – C:\Program Files\Tall Emu\Online Armor\OAcat.exe (Tall Emu)
SRV - (TekSIP) – E:\Program Files\TekSIP\TekSIP.exe (Yasin KAPLAN)
SRV - (DvmMDES) – C:\ASUS.SYS\config\DVMExportService.exe (DeviceVM)
SRV - (AODService) – C:\Program Files\AMD\OverDrive\AODAssist.exe ()
SRV - (AMD_RAIDXpert) – C:\Program Files\AMD\RAIDXpert\bin\RAIDXpertService.exe (AMD)
SRV - (AsSysCtrlService) – C:\Program Files\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe ()
SRV - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\HPZipm12.exe (HP)

========== Driver Services (SafeList) ==========

DRV - (aswTdi) – C:\WINDOWS\system32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswSP) – C:\WINDOWS\system32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswRdr) – C:\WINDOWS\system32\drivers\aswRdr.sys (ALWIL Software)
DRV - (aswMon2) – C:\WINDOWS\system32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswFsBlk) – C:\WINDOWS\system32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (Aavmker4) – C:\WINDOWS\system32\drivers\aavmker4.sys (ALWIL Software)
DRV - (OAmon) – C:\WINDOWS\system32\drivers\OAmon.sys (Tall Emu)
DRV - (OAnet) – C:\WINDOWS\system32\drivers\OAnet.sys (Tall Emu Pty Ltd)
DRV - (OADevice) – C:\WINDOWS\system32\drivers\OADriver.sys (Tall Emu)
DRV - (L1e) – C:\WINDOWS\system32\drivers\l1e51x86.sys (Atheros Communications, Inc.)
DRV - (NuidFltr) – C:\WINDOWS\system32\drivers\nuidfltr.sys (Microsoft Corporation)
DRV - (cpuz132) – C:\WINDOWS\system32\drivers\cpuz132_x32.sys (Windows ® Codename Longhorn DDK provider)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (ZSMC30x) – C:\WINDOWS\system32\drivers\ZS211.sys (ZSMC.Corporation)
DRV - (vvftav211) – C:\WINDOWS\system32\drivers\vvftav211.sys (Vimicro Corporation)
DRV - (VIAHdAudAddService) – C:\WINDOWS\system32\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV - (dvd43llh) – C:\WINDOWS\system32\drivers\dvd43llh.sys (RIF)
DRV - (MovRVDrv32) – C:\WINDOWS\system32\drivers\MovRVDrv32.sys (Windows ® 2000 DDK provider)
DRV - (SndTDriverV32) – C:\WINDOWS\system32\drivers\SndTDriverV32.sys (Windows ® 2000/XP)
DRV - (SASENUM) – E:\program files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – E:\program files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – E:\program files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (MovPDrv32) – C:\WINDOWS\system32\drivers\MovPDrv32.sys (Windows ® 2000/XP)
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\usbaudio.sys (Microsoft Corporation)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (monfilt) – C:\WINDOWS\system32\drivers\monfilt.sys (Creative Technology Ltd.)
DRV - (AsIO) – C:\WINDOWS\system32\drivers\AsIO.sys ()
DRV - (nxsIO32) – C:\WINDOWS\system32\drivers\nxsIO32.sys ()
DRV - (LMouFilt) – C:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) – C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (L8042Kbd) – C:\WINDOWS\system32\drivers\L8042Kbd.sys (Logitech Inc.)
DRV - (SaiNtBus) – C:\WINDOWS\system32\drivers\SaiBus.sys (Saitek)
DRV - (SaiMini) – C:\WINDOWS\system32\drivers\SaiMini.sys (Saitek)
DRV - (SaiU0004) – C:\WINDOWS\system32\drivers\SaiU0004.sys (Saitek)
DRV - (SaiH0004) – C:\WINDOWS\system32\drivers\SaiH0004.sys (Saitek)
DRV - (SaiL0004) – C:\WINDOWS\system32\drivers\SaiL0004.sys (Saitek)
DRV - (Alpham) – C:\WINDOWS\system32\drivers\Alpham.sys (Ideazon Corporation)
DRV - (dfmirage) – C:\WINDOWS\system32\drivers\dfmirage.sys (DemoForge, LLC)
DRV - (NCPro) – C:\WINDOWS\system32\drivers\MTictwl.sys ()
DRV - (MagicTune) – C:\WINDOWS\system32\drivers\MTictwl.sys ()
DRV - (ATITool) – C:\WINDOWS\system32\drivers\ATITool.sys ()
DRV - (nvnforce) Service for NVIDIA® nForce™ – C:\WINDOWS\system32\drivers\nvapu.sys (NVIDIA Corporation)
DRV - (nvax) Service for NVIDIA® nForce™ – C:\WINDOWS\system32\drivers\nvax.sys (NVIDIA Corporation)
DRV - (P0630VID) – C:\WINDOWS\system32\drivers\P0630Vid.sys (Creative Technology Ltd.)
DRV - (BANTExt) – C:\WINDOWS\System32\Drivers\BANTExt.sys ()
DRV - (nvatabus) – C:\WINDOWS\System32\DRIVERS\nvatabus.sys (NVIDIA Corporation)
DRV - (nvnetbus) – C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (ULCDRHlp) – C:\WINDOWS\system32\drivers\ULCDRHlp.sys (Ulead Systems, Inc.)
DRV - (MTsensor) – C:\WINDOWS\system32\drivers\ASACPI.sys ()
DRV - (es1371) Creative AudioPCI (ES1371,ES1373) (WDM) – C:\WINDOWS\system32\drivers\es1371mp.sys (Creative Technology Ltd.)
DRV - (Sentinel) – C:\WINDOWS\System32\Drivers\SENTINEL.SYS (Rainbow Technologies, Inc.)
DRV - (Sntnlusb) – C:\WINDOWS\system32\drivers\SNTNLUSB.SYS (Rainbow Technologies Inc.)
DRV - (DS1410D) – C:\WINDOWS\system32\drivers\ds1410d.sys ()
DRV - (sbpci) SB AudioPCI Audio Driver (WDM) – C:\WINDOWS\system32\drivers\sbpci.sys (Creative Technology Ltd.)
DRV - (PfModNT) – C:\WINDOWS\system32\PfModNT.sys (Creative Technology Ltd.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {0329E7D6-6F54-462D-93F6-F5C3118BADF2}:2.1.5
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.5.4.20081105
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..keyword.URL: "http://www.ask.com/web?o=13796&l;=dis&q;="

FF - HKLM\software\mozilla\Firefox\Extensions\\{0329E7D6-6F54-462D-93F6-F5C3118BADF2}: C:\Program Files\SpeedBit Video Downloader\SPFireFox [2010/02/24 09:39:39 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Flock 2.5.5\extensions\\Components: C:\Program Files\Flock\components [2010/02/25 14:25:12 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Flock 2.5.5\extensions\\Plugins: C:\Program Files\Flock\plugins [2010/02/25 14:25:17 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/03/21 21:26:48 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/03/07 17:31:39 | 000,000,000 | —D | M]

[2008/09/17 15:34:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2010/03/23 18:19:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\bo4nnl5q.default\extensions
[2010/03/07 17:27:56 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\bo4nnl5q.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/03/07 17:28:03 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\bo4nnl5q.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/03/23 19:59:28 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/03/14 17:10:48 | 000,000,000 | —D | M] (Skype extension for Firefox) – C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/03/07 17:28:02 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2008/01/23 01:20:30 | 000,491,520 | —- | M] (BitComet) – C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2008/07/16 23:36:16 | 000,204,800 | —- | M] (Dimdim Inc.) – C:\Program Files\Mozilla Firefox\plugins\npDimdimControl.dll
[2009/10/03 13:15:57 | 000,238,776 | —- | M] (Pando Networks) – C:\Program Files\Mozilla Firefox\plugins\npPandoWebInst.dll
[2008/03/12 15:04:10 | 000,086,016 | —- | M] (SpiralFrog Inc.) – C:\Program Files\Mozilla Firefox\plugins\NPSFDMGR.dll

O1 HOSTS File: ([2010/03/21 16:22:34 | 000,348,846 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 11960 more lines…
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Freecorder Toolbar) - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll (Conduit Ltd.)
O2 - BHO: (Solid Converter PDF) - {259F616C-A300-44F5-B04A-ED001A26C85C} - E:\program files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll (VoyagerSoft, LLC)
O2 - BHO: (EWPBrowseObject Class) - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll ()
O2 - BHO: (ChromeFrame BHO) - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files\Google\Chrome Frame\Application\5.0.342.0\npchrome_frame.dll (@COMPANY_FULLNAME@)
O2 - BHO: (GrabberObj Class) - {FF7C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\SpeedBit Video Downloader\Toolbar\Grabber.dll (Speedbit Ltd.)
O3 - HKLM\..\Toolbar: (Freecorder Toolbar) - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Solid Converter PDF) - {259F616C-A300-44F5-B04A-ED001A26C85C} - E:\program files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll (VoyagerSoft, LLC)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O4 - HKLM..\Run: [Ai Nap] C:\Program Files\ASUS\AI Suite\Q-Button\QButton.exe ()
O4 - HKLM..\Run: [combofix] C:\ComboFix\CF9214.cfx File not found
O4 - HKLM..\Run: [Domino] C:\WINDOWS\Domino.exe ()
O4 - HKLM..\Run: [dvd43] C:\Program Files\dvd43\DVD43_Tray.exe ()
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [QFan Help] C:\Program Files\ASUS\AI Suite\QFan3\QFanHelp.exe ()
O4 - HKLM..\Run: [SmartDefrag] E:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe File not found
O4 - HKLM..\Run: [ZSSnp211] C:\WINDOWS\ZSSnp211.exe (ZSMCSNAP)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - E:\program files\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O9 - Extra 'Tools' menuitem : Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - E:\program files\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\SpeedBit Video Accelerator\sblsp.dll (Speedbit Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\SpeedBit Video Accelerator\sblsp.dll (Speedbit Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files\SpeedBit Video Accelerator\sblsp.dll (Speedbit Ltd.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/3/9…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} http://protect.microsoft.com/security/prot…b?1116220378452 (MSSecurityAdvisor Class)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2…78f/wvc1dmo.cab (Reg Error: Value error.)
O16 - DPF: {33564D57-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/D/0…D0C/wmv9dmo.cab (Reg Error: Value error.)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1221690851234 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_01)
O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\cf - No CLSID value found
O18 - Protocol\Handler\gcf {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files\Google\Chrome Frame\Application\5.0.342.0\npchrome_frame.dll (@COMPANY_FULLNAME@)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {4F07DA45-8170-4859-9B5F-037EF2970034} - C:\Program Files\Tall Emu\Online Armor\oaevent.dll (Tall Emu)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - E:\program files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/05/06 13:47:37 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (autocheck autocheck lsdelete) - File not found
O34 - HKLM BootExecute: (OODBS) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/03/23 19:29:00 | 000,000,000 | —D | C] – C:\WINDOWS\temp
[2010/03/23 19:23:11 | 000,000,000 | RHSD | C] – C:\cmdcons
[2010/03/23 19:22:03 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2010/03/23 19:22:03 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2010/03/23 19:22:03 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2010/03/23 19:22:03 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2010/03/23 19:21:52 | 000,000,000 | –SD | C] – C:\ComboFix
[2010/03/23 19:21:26 | 000,000,000 | —D | C] – C:\Qoobox
[2010/03/22 17:07:41 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/03/22 15:34:34 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2010/03/20 21:54:34 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
[2010/03/20 19:26:07 | 000,000,000 | —D | C] – C:\Program Files\uTorrent
[2010/03/20 19:24:54 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\uTorrent
[2010/03/18 15:35:13 | 000,000,000 | —D | C] – C:\Program Files\GiPo@Utilities
[2010/03/18 15:35:13 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Gibinsoft Shared
[2010/03/14 17:10:37 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Skype
[2010/03/12 18:38:05 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2010/03/12 14:06:55 | 000,000,000 | —D | C] – C:\Program Files\Microsoft
[2010/03/12 14:06:45 | 000,000,000 | —D | C] – C:\Program Files\MSN Toolbar
[2010/03/12 14:06:32 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2010/03/12 14:05:46 | 000,000,000 | —D | C] – C:\Program Files\MSN Toolbar Installer
[2010/03/12 14:05:00 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2010/03/12 14:04:03 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/03/12 14:04:03 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/03/12 14:04:03 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/03/12 11:23:48 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/03/10 11:17:51 | 003,558,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\moviemk.exe
[2010/03/07 18:10:09 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\OnlineArmor
[2010/03/07 18:09:48 | 000,223,312 | —- | C] (Tall Emu) – C:\WINDOWS\System32\drivers\OADriver.sys
[2010/03/07 18:09:48 | 000,029,776 | —- | C] (Tall Emu Pty Ltd) – C:\WINDOWS\System32\drivers\OAnet.sys
[2010/03/07 18:09:48 | 000,024,656 | —- | C] (Tall Emu) – C:\WINDOWS\System32\drivers\OAmon.sys
[2010/03/07 18:09:47 | 000,000,000 | —D | C] – C:\Program Files\Tall Emu
[2010/03/07 17:34:29 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2010/03/07 17:33:50 | 000,000,000 | —D | C] – C:\Program Files\ERUNT
[2010/03/07 17:28:44 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\My Documents\Downloads
[2010/03/07 17:23:11 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\IObit
[2010/03/07 17:22:06 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator\Recent
[2010/03/07 17:12:57 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Macromedia
[2010/03/07 16:57:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\Identities
[2010/03/07 16:57:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Identities
[2010/03/07 16:40:03 | 000,401,720 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Administrator\Desktop\HijackThis.exe
[2010/03/07 16:38:44 | 000,401,720 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Administrator\My Documents\HijackThis.exe
[2010/03/07 16:33:36 | 009,758,152 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\Administrator\My Documents\windows-kb890830-v3.4.exe
[2010/03/07 16:32:49 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\Opera
[2010/03/07 16:32:48 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Opera
[2010/03/07 11:09:10 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Malwarebytes
[2010/03/02 09:49:48 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\hidserv.dll
[2010/02/25 12:12:09 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Apple Computer
[2010/02/25 12:11:57 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Apple Computer
[2010/02/23 18:44:30 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Real
[2010/02/23 16:55:55 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Dimdim
[2010/02/23 16:55:50 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\{BF03BF7A-B118-4C26-B9F7-08C12D3D06E3}
[2010/02/22 19:04:44 | 000,000,000 | —D | C] – C:\Program Files\Yahoo!
[2009/10/22 13:37:00 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2009/10/22 13:32:20 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2009/01/16 12:52:55 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Freecorder
[2008/10/08 10:55:50 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2008/09/23 12:43:00 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[2008/07/29 23:13:03 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2008/07/23 15:19:17 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
[2008/07/23 15:19:02 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Adobe
[2008/07/23 15:18:27 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Mozilla
[2008/07/23 15:18:27 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Mozilla
[1998/12/08 13:53:54 | 000,186,368 | —- | C] (Symantec Corp., Peter Norton Computing Group) – C:\Program Files\Common Files\IRAREG.DLL
[1998/12/08 13:53:54 | 000,099,840 | —- | C] (Symantec Corp.) – C:\Program Files\Common Files\IRAABOUT.DLL
[1998/12/08 13:53:54 | 000,070,144 | —- | C] (Symantec Corp., Peter Norton Computing Group) – C:\Program Files\Common Files\IRAMDMTR.DLL
[1998/12/08 13:53:54 | 000,048,640 | —- | C] (Symantec Corp., Peter Norton Computing Group) – C:\Program Files\Common Files\IRALPTTR.DLL
[1998/12/08 13:53:54 | 000,031,744 | —- | C] (Symantec Corp., Peter Norton Computing Group) – C:\Program Files\Common Files\IRAWEBTR.DLL
[1998/12/08 13:53:54 | 000,017,920 | —- | C] (Symantec Corp.) – C:\Program Files\Common Files\IRASRIAL.DLL
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/03/24 14:40:32 | 000,001,519 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Notepad.lnk
[2010/03/24 14:40:26 | 004,718,592 | —- | M] () – C:\Documents and Settings\Administrator\ntuser.dat
[2010/03/24 14:30:35 | 000,533,362 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/03/24 14:30:35 | 000,448,550 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/03/24 14:30:35 | 000,074,948 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/03/24 14:26:39 | 000,001,374 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/03/24 14:26:19 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/03/24 14:25:15 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/03/24 14:18:00 | 000,000,994 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1177238915-2000478354-725345543-1003UA.job
[2010/03/24 13:53:00 | 000,000,892 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/03/24 13:41:32 | 000,000,888 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/03/23 19:29:26 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Administrator\ntuser.ini
[2010/03/23 19:23:15 | 000,000,281 | RHS- | M] () – C:\boot.ini
[2010/03/23 13:48:16 | 2145,386,496 | —- | M] () – C:\WINDOWS\MEMORY.DMP
[2010/03/23 11:18:00 | 000,000,942 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1177238915-2000478354-725345543-1003Core.job
[2010/03/23 01:48:00 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/03/22 20:10:41 | 000,001,958 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Age Of Empires II - The Age Of Kings.lnk
[2010/03/22 20:10:41 | 000,001,949 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Age Of Empires II - The Conquerors.lnk
[2010/03/22 18:00:00 | 000,000,454 | —- | M] () – C:\WINDOWS\tasks\next.job
[2010/03/22 15:40:39 | 007,936,656 | -H– | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db
[2010/03/22 15:17:36 | 000,001,543 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Command Prompt.lnk
[2010/03/21 22:00:00 | 000,000,392 | —- | M] () – C:\WINDOWS\tasks\SmartDefrag.job
[2010/03/21 16:22:34 | 000,348,846 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/03/20 23:11:06 | 000,000,534 | —- | M] () – C:\Documents and Settings\All Users\Desktop\µTorrent.lnk
[2010/03/20 22:25:34 | 000,059,360 | —- | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/03/20 21:49:30 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/03/20 20:33:34 | 000,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/03/19 10:52:00 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/03/12 18:33:39 | 000,001,854 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2010/03/12 18:02:38 | 000,261,632 | —- | M] () – C:\WINDOWS\PEV.exe
[2010/03/12 11:24:23 | 000,001,700 | —- | M] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2010/03/12 11:24:22 | 000,002,688 | —- | M] () – C:\WINDOWS\System32\config.nt
[2010/03/10 13:43:43 | 000,001,675 | —- | M] () – C:\Documents and Settings\All Users\Desktop\FileZilla Client.lnk
[2010/03/09 06:24:23 | 000,038,848 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\avastSS.scr
[2010/03/09 06:24:05 | 000,153,184 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\aswBoot.exe
[2010/03/09 06:12:54 | 000,046,672 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2010/03/09 06:12:33 | 000,162,640 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2010/03/09 06:09:08 | 000,023,376 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2010/03/09 06:08:41 | 000,100,432 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2010/03/09 06:08:38 | 000,094,800 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2010/03/09 06:08:30 | 000,019,024 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2010/03/09 06:08:15 | 000,028,880 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2010/03/07 18:10:10 | 000,095,020 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.idx
[2010/03/07 18:01:08 | 000,001,347 | —- | M] () – C:\WINDOWS\win.ini
[2010/03/07 18:01:08 | 000,000,227 | —- | M] () – C:\WINDOWS\SYSTEM.INI
[2010/03/07 18:01:08 | 000,000,211 | —- | M] () – C:\Boot.bak
[2010/03/07 17:38:28 | 004,718,592 | -H– | M] () – C:\Documents and Settings\Administrator\ntuser.bak
[2010/03/07 17:33:50 | 000,000,611 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\NTREGOPT.lnk
[2010/03/07 17:33:50 | 000,000,592 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\ERUNT.lnk
[2010/03/07 17:31:42 | 000,001,602 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/03/07 17:22:59 | 000,000,682 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Shortcut to CCleaner.lnk
[2010/03/07 17:22:37 | 000,000,406 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\cc_20100307_162230.reg
[2010/03/07 17:21:39 | 000,000,664 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\CCleaner.lnk
[2010/03/07 17:18:27 | 000,126,424 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\cc_20100307_161800.reg
[2010/03/07 16:56:58 | 000,001,297 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\WinXP_EXE_Fix.reg
[2010/03/07 16:40:03 | 000,401,720 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Administrator\Desktop\HijackThis.exe
[2010/03/07 16:38:44 | 000,401,720 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Administrator\My Documents\HijackThis.exe
[2010/03/07 16:33:36 | 009,758,152 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Administrator\My Documents\windows-kb890830-v3.4.exe
[2010/03/07 16:24:52 | 000,000,438 | RHS- | M] () – C:\Documents and Settings\Administrator\ntuser.pol
[2010/03/07 15:40:14 | 000,001,475 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Windows Explorer.lnk
[2010/03/02 09:49:51 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
[2010/02/23 18:46:29 | 000,000,100 | —- | M] () – C:\WINDOWS\cdplayer.ini
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/03/24 14:40:32 | 000,001,519 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Notepad.lnk
[2010/03/23 19:23:15 | 000,000,211 | —- | C] () – C:\Boot.bak
[2010/03/23 19:23:13 | 000,260,272 | —- | C] () – C:\cmldr
[2010/03/23 19:22:03 | 000,261,632 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/03/23 19:22:03 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2010/03/23 19:22:03 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2010/03/23 19:22:03 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/03/23 19:22:03 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/03/22 20:10:41 | 000,001,958 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Age Of Empires II - The Age Of Kings.lnk
[2010/03/22 20:10:41 | 000,001,949 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Age Of Empires II - The Conquerors.lnk
[2010/03/22 15:17:29 | 000,001,543 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Command Prompt.lnk
[2010/03/20 19:26:07 | 000,000,534 | —- | C] () – C:\Documents and Settings\All Users\Desktop\µTorrent.lnk
[2010/03/12 18:38:46 | 000,002,137 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/03/12 11:24:23 | 000,001,700 | —- | C] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2010/03/07 17:33:50 | 000,000,611 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\NTREGOPT.lnk
[2010/03/07 17:33:50 | 000,000,592 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\ERUNT.lnk
[2010/03/07 17:22:59 | 000,000,682 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Shortcut to CCleaner.lnk
[2010/03/07 17:22:34 | 000,000,406 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\cc_20100307_162230.reg
[2010/03/07 17:21:39 | 000,000,664 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\CCleaner.lnk
[2010/03/07 17:18:16 | 000,126,424 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\cc_20100307_161800.reg
[2010/03/07 16:56:58 | 000,001,297 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\WinXP_EXE_Fix.reg
[2010/03/07 16:24:52 | 000,000,438 | RHS- | C] () – C:\Documents and Settings\Administrator\ntuser.pol
[2010/03/07 15:39:54 | 000,001,475 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Windows Explorer.lnk
[2010/03/02 09:49:51 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
[2010/02/23 16:56:03 | 000,000,454 | —- | C] () – C:\WINDOWS\tasks\next.job
[2009/09/19 16:04:20 | 000,000,116 | —- | C] () – C:\WINDOWS\ConverterCore.INI
[2009/09/11 19:28:23 | 000,000,000 | —- | C] () – C:\WINDOWS\SETUP32.INI
[2009/08/26 17:31:10 | 000,000,039 | —- | C] () – C:\WINDOWS\System32\PCE_TRIAL_VERSIONs.sys
[2009/08/16 14:23:44 | 000,000,080 | RHS- | C] () – C:\WINDOWS\System32\870508C509.dll
[2009/07/31 00:10:14 | 000,000,991 | —- | C] () – C:\Program Files\GH3D.txt
[2009/07/31 00:10:14 | 000,000,142 | —- | C] () – C:\Program Files\GamersHell.url
[2009/06/13 19:43:52 | 000,000,091 | —- | C] () – C:\WINDOWS\System32\avalokitesvara2.ini
[2009/06/13 19:42:52 | 000,000,091 | —- | C] () – C:\WINDOWS\System32\quanyin waterfall.ini
[2009/06/13 19:22:32 | 000,000,091 | —- | C] () – C:\WINDOWS\System32\krishna_flute.ini
[2009/05/25 14:37:21 | 000,000,128 | —- | C] () – C:\Documents and Settings\All Users\Application Data\sandra.ldb
[2009/05/25 14:35:24 | 010,440,704 | —- | C] () – C:\Documents and Settings\All Users\Application Data\sandra.mda
[2009/05/24 20:15:32 | 000,219,136 | —- | C] () – C:\WINDOWS\sqlite3_engine.dll
[2009/05/21 01:46:09 | 000,004,588 | —- | C] () – C:\WINDOWS\AbleBurn.ini
[2009/05/21 01:42:55 | 000,000,111 | —- | C] () – C:\WINDOWS\TruDirect.ini
[2009/05/19 22:43:04 | 000,024,576 | R— | C] () – C:\WINDOWS\System32\AsIO.dll
[2009/05/19 22:43:04 | 000,012,400 | R— | C] () – C:\WINDOWS\System32\drivers\AsIO.sys
[2009/05/19 22:39:04 | 000,001,746 | —- | C] () – C:\WINDOWS\Language_trs.ini
[2009/05/19 22:36:47 | 000,005,810 | R— | C] () – C:\WINDOWS\System32\drivers\ASACPI.sys
[2009/05/19 22:36:26 | 000,040,216 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2009/05/19 22:36:25 | 000,010,296 | —- | C] () – C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2008/11/26 01:08:23 | 000,000,120 | —- | C] () – C:\WINDOWS\NVPerformance.INI
[2008/10/08 02:36:58 | 000,090,668 | —- | C] () – C:\WINDOWS\System32\vobis32.dll
[2008/10/08 01:48:54 | 000,000,036 | —- | C] () – C:\WINDOWS\Progs_.ini
[2008/10/08 01:48:49 | 000,000,601 | —- | C] () – C:\WINDOWS\1Way.ini
[2008/07/04 03:07:00 | 000,532,480 | —- | C] () – C:\WINDOWS\System32\libxml2.dll
[2007/11/08 18:52:07 | 000,013,396 | —- | C] () – C:\WINDOWS\System32\drivers\MTictwl.sys
[2007/06/25 16:30:17 | 000,000,057 | —- | C] () – C:\WINDOWS\TUTORI~1.INI
[2007/04/28 13:49:17 | 000,000,477 | —- | C] () – C:\WINDOWS\System32\ntmsqapi.dll
[2007/04/28 13:41:24 | 000,002,208 | —- | C] () – C:\WINDOWS\System32\drivers\nxsIO32.sys
[2007/02/13 12:32:28 | 000,006,592 | —- | C] () – C:\WINDOWS\System32\drivers\ds1410d.sys
[2006/12/14 15:32:52 | 000,000,009 | —- | C] () – C:\Documents and Settings\All Users\Application Data\DragToDiscUserNameD.txt
[2006/11/16 21:43:33 | 000,667,648 | —- | C] () – C:\WINDOWS\System32\FreeImage.dll
[2006/11/16 18:44:53 | 000,003,840 | —- | C] () – C:\WINDOWS\System32\drivers\BANTExt.sys
[2006/11/16 18:43:07 | 000,176,235 | —- | C] () – C:\WINDOWS\System32\Primomonnt.dll
[2006/08/31 11:46:13 | 000,000,310 | —- | C] () – C:\WINDOWS\primopdf.ini
[2006/08/22 11:57:37 | 000,077,824 | R— | C] () – C:\WINDOWS\System32\hpzids01.dll
[2006/07/30 17:05:23 | 000,000,049 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2006/05/12 04:09:38 | 000,579,602 | —- | C] () – C:\WINDOWS\System32\x264vfw.dll
[2006/05/07 20:55:05 | 000,001,755 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/05/07 13:26:58 | 000,154,112 | —- | C] () – C:\WINDOWS\System32\dxr.dll
[2006/05/07 13:24:54 | 000,099,840 | —- | C] () – C:\WINDOWS\System32\mkx.dll
[2006/05/07 13:24:42 | 000,051,200 | —- | C] () – C:\WINDOWS\System32\avi.dll
[2006/05/07 13:24:30 | 000,061,440 | —- | C] () – C:\WINDOWS\System32\mmfinfo.dll
[2006/05/07 13:24:16 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\mp4.dll
[2006/05/07 13:24:04 | 000,057,856 | —- | C] () – C:\WINDOWS\System32\ogm.dll
[2006/05/07 13:23:46 | 000,045,568 | —- | C] () – C:\WINDOWS\System32\mkzlib.dll
[2006/05/07 13:23:42 | 000,023,552 | —- | C] () – C:\WINDOWS\System32\mkunicode.dll
[2006/04/18 17:30:56 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2006/04/17 16:19:39 | 000,000,285 | —- | C] () – C:\WINDOWS\MusicEditor.INI
[2006/04/16 19:32:39 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\xmltok.dll
[2006/04/16 19:32:39 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\xmlparse.dll
[2006/03/21 14:13:33 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\DivXWMPExtType.dll
[2006/02/22 11:21:25 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2006/02/22 11:21:25 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\unace.dll
[2005/12/30 15:18:26 | 000,139,264 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2005/12/30 15:10:30 | 000,524,288 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2005/11/29 15:17:16 | 000,005,632 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2005/11/29 15:14:42 | 002,675,712 | —- | C] () – C:\WINDOWS\System32\libavcodec.dll
[2005/11/29 15:11:30 | 000,371,200 | —- | C] () – C:\WINDOWS\System32\libmplayer.dll
[2005/11/29 15:10:46 | 000,217,088 | —- | C] () – C:\WINDOWS\System32\ff_kernelDeint.dll
[2005/11/29 15:10:10 | 000,118,784 | —- | C] () – C:\WINDOWS\System32\libmpeg2_ff.dll
[2005/11/29 15:10:06 | 000,512,000 | —- | C] () – C:\WINDOWS\System32\ff_x264.dll
[2005/11/29 15:09:54 | 000,143,360 | —- | C] () – C:\WINDOWS\System32\ff_realaac.dll
[2005/11/29 15:09:50 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\TomsMoComp_ff.dll
[2005/11/29 15:09:30 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\ff_wmv9.dll
[2005/11/29 15:09:24 | 000,056,320 | —- | C] () – C:\WINDOWS\System32\ff_unrar.dll
[2005/11/29 15:09:14 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\ff_theora.dll
[2005/11/29 15:09:06 | 000,131,072 | —- | C] () – C:\WINDOWS\System32\ff_samplerate.dll
[2005/11/29 15:09:04 | 000,155,648 | —- | C] () – C:\WINDOWS\System32\ff_libmad.dll
[2005/11/29 15:09:00 | 000,167,936 | —- | C] () – C:\WINDOWS\System32\ff_libdts.dll
[2005/11/29 15:09:00 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\ff_liba52.dll
[2005/11/05 08:31:14 | 000,000,547 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll.manifest
[2005/09/26 04:24:38 | 000,024,064 | —- | C] () – C:\WINDOWS\System32\drivers\ATITool.sys
[2005/07/23 20:43:24 | 000,000,063 | —- | C] () – C:\WINDOWS\WININIT.INI
[2005/07/23 19:22:32 | 000,000,374 | —- | C] () – C:\WINDOWS\dreamsp.ini
[2005/07/13 10:36:48 | 000,000,100 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2005/06/12 17:55:30 | 000,000,535 | —- | C] () – C:\WINDOWS\CleaningLab.INI
[2005/06/12 17:48:59 | 000,019,968 | —- | C] () – C:\WINDOWS\System32\cpuinf32.dll
[2005/06/12 17:46:13 | 000,000,919 | —- | C] () – C:\WINDOWS\mgxoschk.ini
[2005/06/12 17:46:13 | 000,000,024 | —- | C] () – C:\WINDOWS\magix.ini
[2005/06/12 16:53:50 | 000,000,063 | —- | C] () – C:\WINDOWS\mdm.ini
[2005/05/16 04:55:24 | 000,003,972 | —- | C] () – C:\WINDOWS\System32\drivers\PciBus.sys
[2005/05/16 02:23:16 | 000,156,672 | —- | C] () – C:\WINDOWS\System32\RTLCPAPI.dll
[2005/05/16 02:03:27 | 000,000,590 | —- | C] () – C:\WINDOWS\ODBC.INI
[2005/05/06 13:57:18 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/10/15 12:10:04 | 000,217,088 | —- | C] () – C:\WINDOWS\NVGfxOgl.dll
[2003/02/10 03:13:10 | 000,000,416 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\systmsp2pb6
[2002/05/17 17:18:30 | 000,124,928 | —- | C] () – C:\WINDOWS\System32\mp4fil32.dll
[1999/01/22 05:46:58 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\MSRTEDIT.DLL

========== LOP Check ==========

[2010/03/23 18:38:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\IObit
[2010/03/07 16:32:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Opera
[2010/03/20 19:30:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\uTorrent
[2009/05/22 00:17:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\1Click DVD Copy
[2008/12/04 20:48:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Age of Empires 3
[2010/03/12 11:23:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2009/05/21 15:17:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Applications
[2009/05/21 19:38:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ASUS OC Profiles
[2009/08/16 09:19:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Broderbund
[2006/12/14 11:45:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\CA
[2006/11/16 18:30:54 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\CanonBJ
[2009/08/26 17:31:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Chexp
[2010/02/23 16:55:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Dimdim
[2008/09/18 03:38:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\fsribcre
[2010/03/23 18:38:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\IObit
[2009/08/26 17:30:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ITRI mTTS
[2009/10/19 15:51:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MyDefrag
[2007/06/25 15:45:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nuance
[2010/03/07 18:41:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\OnlineArmor
[2008/09/20 15:29:25 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2009/10/03 13:17:05 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PMB Files
[2007/06/25 15:45:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ScanSoft
[2009/10/10 23:19:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SpeedBit
[2009/05/21 20:43:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Spiralfrog
[2010/02/25 12:14:24 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/09/30 22:25:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Transparent
[2009/06/05 22:47:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ulead Systems
[2009/09/16 10:25:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/05/29 20:47:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2010/02/23 16:55:58 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{BF03BF7A-B118-4C26-B9F7-08C12D3D06E3}
[2010/02/09 12:09:02 | 000,000,306 | —- | M] () – C:\WINDOWS\Tasks\expressburnSevenDays.job
[2010/02/09 12:09:02 | 000,000,312 | —- | M] () – C:\WINDOWS\Tasks\expressburnSevenDaysInit.job
[2010/02/09 12:08:50 | 000,000,270 | —- | M] () – C:\WINDOWS\Tasks\expressburnShakeIcon.job
[2010/03/23 01:48:00 | 000,000,330 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2010/03/22 18:00:00 | 000,000,454 | —- | M] () – C:\WINDOWS\Tasks\next.job
[2010/03/21 22:00:00 | 000,000,392 | —- | M] () – C:\WINDOWS\Tasks\SmartDefrag.job
[2010/02/09 12:08:46 | 000,000,288 | —- | M] () – C:\WINDOWS\Tasks\videopadSevenDays.job
[2010/02/09 12:08:45 | 000,000,288 | —- | M] () – C:\WINDOWS\Tasks\videopadShakeIcon.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2004/08/04 03:05:44 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/04/14 07:51:44 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2004/08/04 03:05:44 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
[2008/04/14 07:51:44 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/09/14 02:32:29 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\sp3.cab:AGP440.sys
[2008/04/14 02:06:40 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\agp440.sys
[2008/04/14 02:06:40 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/04 01:07:42 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB – C:\WINDOWS\$NtServicePackUninstall$\agp440.sys

< MD5 for: AHCIX86.SYS >
[2008/03/07 20:24:52 | 000,176,136 | —- | M] (AMD Technologies Inc.) MD5=B6E729A575F84938A08D367E8352EB86 – C:\ATI\support\8-9_xp32_dd_ccc_wdm_enu_68898\SBDrv\RAID7xx\x86\ahcix86.sys

< MD5 for: ATAPI.SYS >
[2004/08/04 03:05:44 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/04/14 07:51:44 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2004/08/04 03:05:44 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
[2008/04/14 07:51:44 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/09/14 02:32:29 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\sp3.cab:atapi.sys
[2008/04/14 02:10:32 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\atapi.sys
[2008/04/14 02:10:32 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/04 00:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 07:41:54 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 19:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\eventlog.dll
[2008/04/13 19:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\eventlog.dll
[2008/04/14 07:41:54 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll
[2004/08/04 02:56:44 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/14 07:42:02 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 19:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\netlogon.dll
[2008/04/13 19:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\netlogon.dll
[2008/04/14 07:42:02 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll
[2004/08/04 02:56:46 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: NVATA.SYS >
[2006/04/24 19:52:28 | 000,100,736 | —- | M] (NVIDIA Corporation) MD5=C03E15101F6D9E82CD9B0E7D715F5DE3 – C:\NVIDIA\nForceWin2KXP\6.86\IDE\Win2K\sata_ide\nvata.sys
[2006/04/24 19:52:28 | 000,100,736 | —- | M] (NVIDIA Corporation) MD5=C03E15101F6D9E82CD9B0E7D715F5DE3 – C:\NVIDIA\nForceWin2KXP\6.86\IDE\WinXP\sata_ide\nvata.sys

< MD5 for: NVATABUS.SYS >
[2003/09/02 17:51:00 | 000,054,656 | —- | M] (NVIDIA Corporation) MD5=04EF5690AC54924CF745A4A2D1FBF9C1 – C:\NVIDIA\nForceWin2KXP\3.13\IDE\Win2K\NvAtaBus.sys
[2003/09/02 17:51:00 | 000,054,656 | —- | M] (NVIDIA Corporation) MD5=04EF5690AC54924CF745A4A2D1FBF9C1 – C:\NVIDIA\nForceWin2KXP\3.13\IDE\WinXP\NvAtaBus.sys
[2005/02/18 11:44:24 | 000,088,960 | —- | M] (NVIDIA Corporation) MD5=A1F88223528AADBB6374132BECBBDCC1 – C:\WINDOWS\system32\drivers\nvatabus.sys
[2006/04/24 19:52:28 | 000,100,736 | —- | M] (NVIDIA Corporation) MD5=C03E15101F6D9E82CD9B0E7D715F5DE3 – C:\NVIDIA\nForceWin2KXP\6.86\IDE\Win2K\legacy\nvatabus.sys
[2006/04/24 19:52:28 | 000,100,736 | —- | M] (NVIDIA Corporation) MD5=C03E15101F6D9E82CD9B0E7D715F5DE3 – C:\NVIDIA\nForceWin2KXP\6.86\IDE\Win2K\sataraid\nvatabus.sys
[2006/04/24 19:52:28 | 000,100,736 | —- | M] (NVIDIA Corporation) MD5=C03E15101F6D9E82CD9B0E7D715F5DE3 – C:\NVIDIA\nForceWin2KXP\6.86\IDE\WinXP\legacy\nvatabus.sys
[2006/04/24 19:52:28 | 000,100,736 | —- | M] (NVIDIA Corporation) MD5=C03E15101F6D9E82CD9B0E7D715F5DE3 – C:\NVIDIA\nForceWin2KXP\6.86\IDE\WinXP\sataraid\nvatabus.sys

< MD5 for: SCECLI.DLL >
[2004/08/04 02:56:46 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/14 07:42:06 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\scecli.dll
[2008/04/14 07:42:06 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2009/05/21 09:20:36 | 001,880,064 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2009/05/21 08:53:45 | 000,049,152 | —- | M] () – C:\WINDOWS\system32\config\security.sav
[2009/05/21 09:20:36 | 039,583,744 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2009/05/21 09:20:36 | 011,010,048 | —- | M] () – C:\WINDOWS\system32\config\system.sav

========== Files - Unicode (All) ==========
[2009/11/03 12:15:34 | 000,000,000 | —D | M](C:\Documents and Settings\All Users\Desktop\Adobe 9 Reader ????) – C:\Documents and Settings\All Users\Desktop\Adobe 9 Reader 安装程序
[2009/11/03 12:15:25 | 000,000,000 | —D | C](C:\Documents and Settings\All Users\Desktop\Adobe 9 Reader ????) – C:\Documents and Settings\All Users\Desktop\Adobe 9 Reader 安装程序

========== Alternate Data Streams ==========

@Alternate Data Stream - 134 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AC6124CA
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0F8F5844
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C97C8631
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C176AF6C
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8
< End of report >

Shenlord

Post #10March 24, 2010, 8:10 PM UTC

OTL Extras log
OTL Extras logfile created on: 3/24/2010 2:52:26 PM - Run 1
OTL by OldTimer - Version 3.1.37.3 Folder = C:\Documents and Settings\Administrator\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 89.00% Memory free
5.00 Gb Paging File | 5.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): c:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 14.74 Gb Free Space | 19.79% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 74.52 Gb Total Space | 48.87 Gb Free Space | 65.58% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JPRIG
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: SafeMode with Networking
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "E:\Program Files\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
https [open] – "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [3DPhotoBrowser] – "c:\program files\3d photo browser\3dphotobrowser.exe" "%1" ( )
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Wipe Contents and Remove] – Reg Error: Value error.
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = 1
"FirewallOverride" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1723:TCP" = 1723:TCP:*:Enabled:@xpsp2res.dll,-22015
"1701:UDP" = 1701:UDP:*:Enabled:@xpsp2res.dll,-22016
"500:UDP" = 500:UDP:*:Enabled:@xpsp2res.dll,-22017

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"3724:TCP" = 3724:TCP:*:Enabled:Blizzard Downloader: 3724
"6112:TCP" = 6112:TCP:*:Enabled:Blizzard Downloader
"26271:TCP" = 26271:TCP:*:Enabled:BitComet 26271 TCP
"26271:UDP" = 26271:UDP:*:Enabled:BitComet 26271 UDP
"1723:TCP" = 1723:TCP:*:Enabled:@xpsp2res.dll,-22015
"1701:UDP" = 1701:UDP:*:Enabled:@xpsp2res.dll,-22016
"500:UDP" = 500:UDP:*:Enabled:@xpsp2res.dll,-22017
"5060:UDP" = 5060:UDP:*:Enabled:TekSIP SIP Signalling (UDP)
"5060:TCP" = 5060:TCP:*:Enabled:TekSIP SIP Signalling (TCP)
"4100:UDP" = 4100:UDP:*:Enabled:uPNP Router Control Port
"86:TCP" = 86:TCP:*:Enabled:BroadCam Video Streaming Server Web Server

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox – (Mozilla Corporation)
"C:\WINDOWS\system32\dpnsvr.exe" = C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server – (Microsoft Corporation)
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test – (Microsoft Corporation)
"C:\WINDOWS\system32\dxdiag.exe" = C:\WINDOWS\system32\dxdiag.exe:*:Enabled:Microsoft DirectX Diagnostic Tool – (Microsoft Corporation)
"C:\WINDOWS\system32\mmc.exe" = C:\WINDOWS\system32\mmc.exe:*:Enabled:Microsoft Management Console – (Microsoft Corporation)
"C:\Program Files\Microsoft Games\Age of Empires III\age3y.exe" = C:\Program Files\Microsoft Games\Age of Empires III\age3y.exe:*:Enabled:Age of Empires III - The Asian Dynasties – (Microsoft Corporation)
"C:\Program Files\Microsoft Games\Age of Empires III\age3x.exe" = C:\Program Files\Microsoft Games\Age of Empires III\age3x.exe:*:Enabled:Age of Empires III - The WarChiefs – (Ensemble Studios)
"C:\Program Files\JLC's Software\Internet TV\Internet TV.exe" = C:\Program Files\JLC's Software\Internet TV\Internet TV.exe:*:Enabled:Internet TV – File not found
"E:\program files\TekSIP\TekSIP.exe" = E:\program files\TekSIP\TekSIP.exe:*:Enabled:TekSIP Service – (Yasin KAPLAN)
"E:\program files\TekSIP\TSManager.exe" = E:\program files\TekSIP\TSManager.exe:*:Enabled:TekSIP Manager – (Yasin KAPLAN)
"C:\Program Files\Java\jre6\bin\javaw.exe" = C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java™ Platform SE binary – (Sun Microsystems, Inc.)
"C:\Program Files\Pando Networks\Media Booster\PMB.exe" = C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster – ()
"C:\Program Files\Turbine\The Lord of the Rings Online\lotroclient.exe" = C:\Program Files\Turbine\The Lord of the Rings Online\lotroclient.exe:*:Enabled:lotroclient – File not found
"C:\Program Files\World of Warcraft\WoW-3.2.0-enUS-downloader.exe" = C:\Program Files\World of Warcraft\WoW-3.2.0-enUS-downloader.exe:*:Enabled:Blizzard Downloader – File not found
"C:\Program Files\World of Warcraft\Launcher.exe" = C:\Program Files\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher – File not found
"C:\Documents and Settings\Jean-Paul\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.dll" = C:\Documents and Settings\Jean-Paul\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.dll:*:Enabled:Google Talk Plugin – (Google)
"C:\Documents and Settings\Jean-Paul\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe" = C:\Documents and Settings\Jean-Paul\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin – (Google)
"E:\program files\uTorrent\uTorrent.exe" = E:\program files\uTorrent\uTorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)
"C:\Program Files\SightSpeed\SightSpeed.exe" = C:\Program Files\SightSpeed\SightSpeed.exe:*:Enabled:SightSpeed – (SightSpeed Inc.)
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser – (Opera Software)
"C:\Program Files\Dimdim\Plugin\Application\Dimdim.exe" = C:\Program Files\Dimdim\Plugin\Application\Dimdim.exe:*:Enabled:Dimdim – ()
"C:\Documents and Settings\All Users\Application Data\Dimdim\Updater\next.exe" = C:\Documents and Settings\All Users\Application Data\Dimdim\Updater\next.exe:*:Enabled:next – ()
"C:\Program Files\Dimdim\Plugin\Application\myScreen.exe" = C:\Program Files\Dimdim\Plugin\Application\myScreen.exe:*:Enabled:myScreen – (Dimdim, Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{0DDD0E2F-E003-4D77-A7F0-B68166506B85}" = ITRI Model-based TTS EX 1.36
"{0F9196C6-58B4-445B-B56E-B1200FECC151}" = Microsoft Bootvis
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP1700" = Canon iP1700
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{1761224D-B108-4921-BB02-5551F7B412F6}" = Google AdWords Editor
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1A655D51-1423-48A3-B748-8F5A0BE294C8}" = Microsoft Visual J# .NET Redistributable Package 1.1
"{1C08A24C-B168-407E-A826-68FAF5F20710}" = Age of Empires III - The WarChiefs
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java™ 6 Update 14
"{28359586-3409-4435-8302-B8D93BB78625}" = Penpower Chinese Expert
"{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}" = Rhapsody Player Engine
"{2EAF7E61-068E-11DF-953C-005056806466}" = Google Earth
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.® AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver
"{310BC5E2-31AF-49BB-904D-E71EB93645DC}" = AI Suite
"{3248F0A8-6813-11D6-A77B-00B0D0150010}" = J2SE Runtime Environment 5.0 Update 1
"{3248F0A8-6813-11D6-A77B-00B0D0150020}" = J2SE Runtime Environment 5.0 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160060}" = Java™ 6 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{326957C7-83FD-4550-A59A-849B7B4297DE}" = Microsoft Easy Assist v2
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3D047C15-C859-45F7-81CE-F2681778069B}" = iPod for Windows 2006-01-10
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{4082F02F-E70A-423B-97F2-96558820DE64}" = TAD Patch Launcher
"{4324BC93-C82F-ED16-BA86-5E34B9E05303}" = ccc-core-static
"{44D02D8B-FFB3-4245-8D26-68D10B4C4023}" = ZSMC USB PC Camera (ZS0211)
"{4ED118EE-785C-CC18-5D2E-D5CA4BAA03F0}" = Catalyst Control Center Graphics Full New
"{539475B7-44B7-8B0A-134C-F01B9C8B7569}" = ccc-core-preinstall
"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
"{57930C74-D044-4AF1-8A23-3A2CDAF87325}" = TruDirect
"{587178E7-B1DF-494E-9838-FA4DD36E873C}" = ASUSUpdate
"{5AC7AE54-55DF-1126-076C-623F008D40B6}" = Catalyst Control Center Graphics Full Existing
"{634F6989-4BB5-4EF2-AF6F-C15700F81494}_is1" = Advanced System Optimizer 2.01
"{634F6989-4BB5-4EF2-AF6F-C15700F81494}}_is1" = Advanced System Optimizer 2
"{6351D217-3EE3-1967-29BE-6A77635FE485}" = Skins
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{65BCF909-6AF7-4B01-8EB3-713CE2873DC8}" = Microsoft Expression Web 3
"{690BE098-6D0D-493D-B079-BD7E8F81A141}" = Opera 10.10
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6AB9CD3A-F91F-233B-923B-6C59BA63524D}" = Catalyst Control Center HydraVision Full
"{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com
"{72736F5F-520D-472A-88CC-7B02872FD34E}" = ATI Catalyst Registration
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{752E90AC-3F11-4EA3-88EA-96441047EC31}" = Microsoft Expression Web 3 SP1
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{786758B9-61F2-3F48-F321-998D9732F5D0}" = KeywordBlueprint
"{786C5747-1033-0000-B58E-000000000001}" = Adobe Stock Photos 1.0
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX
"{7B9CC60A-9B81-46A3-A953-76B6BF9EEC97}" = Age of Empires III
"{7C7F30F4-94E7-4AA8-8941-90C4A80C68BF}" = NVIDIA nTune
"{8338BA06-E527-491B-9400-F51708FEE695}" = iPod for Windows 2005-11-17
"{85A91C22-C369-FCFB-5F1F-D59EB21AD0E1}" = CCC Help English
"{885744A4-1A01-44B0-858A-0AE6738CBCF7}" = PrimoPDF Redistribution Package
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A4D41F3-3EDA-4DAC-9403-839708EA0667}" = Install(US)2
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8B76B8E9-F773-4B75-A08C-120079EB765E}" = RAIDXpert
"{8E5585C5-13F9-4795-9F57-227E73382C7D}" = Chinese Toolbox FREE
"{8EDBA74D-0686-4C99-BFDD-F894678E5B39}" = Adobe Common File Installer
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{99AD9D6D-A456-49EE-8360-F22EE7AA1272}" = Express Gate
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BC76CCE-A9EC-4A3A-9B51-D823805E1D1F}" = SolidConverterPDF
"{9C2AC00C-0C06-4B7E-97A4-A833808D54D6}" = EPU
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A31951C5-DCD8-4DFE-A525-CFC701F54792}" = TurboV
"{A3BE3F1E-2472-4211-8735-E8239BE49D9F}" = Ulead Burn.Now 4.5
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C}" = Windows Defender Signatures
"{A6D0140F-E62F-9D1E-2408-9CFF91FF6FC8}" = ccc-utility
"{A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}" = iTunes
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3
"{B08ABBC4-52E5-46B0-A3AA-FBE4EFEF14FC}" = SeoDev Synonymizer
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B41069C7-7E24-473F-B400-BF48B82D9948}" = AMD OverDrive
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B74D4E10-6884-0000-0000-000000000103}" = Adobe Bridge 1.0
"{B85F6BEB-B42B-459E-BCAE-B76F06A2E80A}" = AS Fan Patch 1.1
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BB533746-CF08-11D7-BCF1-005004748D87}" = Java SATARaid
"{BBF6D0CD-A081-369F-B0B8-F168594CBB6B}" = Google Talk Plugin
"{BF941884-7532-EC23-12D1-CF6E80ED0F93}" = Market Samurai
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C3113E55-7BCB-4de3-8EBF-60E6CE6B2196}_is1" = SiSoftware Sandra Professional Home 2009.SP3c
"{C43C1415-3DFC-4089-9A32-0BECF28A6046}" = Age of Empires III - The Asian Dynasties
"{C44A7422-E380-44BE-79FE-1C032D8A03A7}" = Catalyst Control Center Core Implementation
"{C75252F7-2A8C-432E-ABD8-26FCCDCF3C14}" = TekSIP
"{C9C641B6-DB5C-4C84-B6C9-9540388DA0DA}" = WebMeeting Plug-in
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D3B1C799-CB73-42DE-BA0F-2344793A095C}" = Catalyst Control Center - Branding
"{D3EE034D-5B92-4A55-AA02-2E6D0A6A96EE}" = Windows Resource Kit Tools - SubInAcl.exe
"{D4936AAF-FFD0-44A1-A7EA-A2DB41CEB5BC}" = iPod for Windows 2005-09-23
"{D6E4E5D6-7693-4BB4-95BA-21F38FAFEE90}" = Safari
"{D7A6C517-11F2-419F-B5BB-27772B939698}" = NvMixer
"{DA40A047-19E3-41A7-A551-76E02D498885}" = Jing
"{DDDD90B2-80F2-413A-8A8E-38C5076A7DBA}" = Dragon NaturallySpeaking 9
"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = AusLogics Disk Defrag
"{E5D24929-91A4-B0A1-DE00-AFC453921EF7}" = Catalyst Control Center Graphics Light
"{E6C09BFB-BA75-15C7-5B18-A2CE31C4F42B}" = Catalyst Control Center Graphics Previews Common
"{E9787678-1033-0000-8E67-000000000001}" = Adobe Help Center 1.0
"{EE0D5DCD-2B97-4473-98DF-E93C0BD92F7A}" = Adobe Stock Photos 1.0
"{F44DA61E-720D-4E79-871F-F6E628B33242}" = OpenOffice.org 3.0
"{F6869CD2-3DB4-476D-A4C7-B3AE7C3ACF7B}" = Windows Media Connect
"{F761359C-9CED-45AE-9A51-9D6605CD55C4}" = Evernote
"{F7B412D0-C9C9-43B8-A34B-17916122EAC1}" = Penpower Chinese Expert
"{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone Configuration Utility
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FC2C7405-BC58-4E11-8F51-29671BEAC06B}" = Natural Color Pro
"{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = HighMAT Extension to Microsoft Windows XP CD Writing Wizard
"3D Photo Browser" = 3D Photo Browser 8.51
"Abexo Free Registry Cleaner" = Abexo Free Registry Cleaner
"Absolute Color Picker_is1" = Absolute Color Picker
"Active@ Disk Wiper FREE" = Active@ Disk Wiper FREE
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"Advanced Video FX Utility" = Advanced Video FX Utility
"All ATI Software" = ATI - Software Uninstall Utility
"Amaya" = Amaya
"ATI Display Driver" = ATI Display Driver
"Atomic Clock Sync" = Atomic Clock Sync
"Audacity_is1" = Audacity 1.2.6
"avalokitesvara" = firstscreensaver.com\avalokitesvara
"AvantBrowser" = Avant Browser (remove only)
"avast!" = avast! Antivirus
"AVS DVDMenu Editor_is1" = AVS DVDMenu Editor 1.2.1.19
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.2
"AVS4YOU Video Converter_is1" = AVS Video Converter 5.6
"AVS4YOU Video Editor_is1" = AVS Video Editor 3.5
"B991B020-2968-11D8-AF23-444553540000_is1" = FreeMind
"Belarc Advisor 2.0" = Belarc Advisor 7.2
"BioWIN_is1" = BioWIN 5.11
"BroadCam" = BroadCam Video Streaming Server
"Cacheman 5.50" = Cacheman 5.50
"CamStudio" = CamStudio
"CamStudio Lossless Codec_is1" = CamStudio Lossless Codec v1.4
"Canon iP1700 User Registration" = Canon iP1700 User Registration
"CanonMyPrinter" = Canon My Printer
"CCleaner" = CCleaner
"ChineseTransliterator-Original Formatting" = ChineseTransliterator-Original Formatting
"Cole2k Media - Codec Pack" = Cole2k Media - Codec Pack (Advanced)
"Cole2k Media Toolbar" = Cole2k Media Toolbar
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"CommissionBlueprint.KeywordBlueprint.E611A7DFA7A14643DD636F3114ECD771F85A61
E0.1" = KeywordBlueprint
"CopyToDVD_is1" = CopyToDVD
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.51
"Creative PD0630" = Creative WebCam Live! Driver (1.02.03.0606)
"Creative Photo Manager" = Creative Photo Manager
"Creative WebCam Center" = Creative WebCam Center
"Creative WebCam Live! User's Guide English" = Creative WebCam Live! User's Guide (English)
"Debut" = Debut Video Capture Software
"Defraggler" = Defraggler
"Dfine DEMO" = Dfine DEMO
"DVD43_is1" = DVD43 v4.3.1
"Easy-PhotoPrint" = Canon Utilities Easy-PhotoPrint
"Easy-WebPrint" = Easy-WebPrint
"ERUNT_is1" = ERUNT 1.1j
"ExpressBurn" = Express Burn
"FileZilla Client" = FileZilla Client 3.3.2
"Flock (2.5.5)" = Flock (2.5.5)
"Free Audio Dub_is1" = Free Audio Dub version 1.3
"Free PDF to Word Doc Converter_is1" = Free PDF to Word Doc Converter v1.1
"Free Video to Mp3 Converter_is1" = Free Video to Mp3 Converter version 2.9
"Free YouTube to Mp3 Converter_is1" = Free YouTube to Mp3 Converter version 2.4
"Freecorder Toolbar" = Freecorder Toolbar
"Freecorder Toolbar3.03" = Freecorder Toolbar 3.03 Application
"Get Yahoo! Messenger" = Get Yahoo! Messenger
"Google Chrome Frame" = Google Chrome Frame
"GoogleVideoPlayer" = Google Video Player
"goonlinetv Toolbar" = goonlinetv Toolbar
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{1C08A24C-B168-407E-A826-68FAF5F20710}" = Age of Empires III - The WarChiefs
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager
"InstallShield_{3D047C15-C859-45F7-81CE-F2681778069B}" = iPod for Windows 2006-01-10
"InstallShield_{7B9CC60A-9B81-46A3-A953-76B6BF9EEC97}" = Age of Empires III
"InstallShield_{7C7F30F4-94E7-4AA8-8941-90C4A80C68BF}" = NVIDIA nTune
"InstallShield_{8338BA06-E527-491B-9400-F51708FEE695}" = iPod for Windows 2005-11-17
"InstallShield_{8B76B8E9-F773-4B75-A08C-120079EB765E}" = RAIDXpert
"InstallShield_{A3BE3F1E-2472-4211-8735-E8239BE49D9F}" = Ulead Burn.Now 4.5 SE
"InstallShield_{C43C1415-3DFC-4089-9A32-0BECF28A6046}" = Age of Empires III - The Asian Dynasties
"InstallShield_{D4936AAF-FFD0-44A1-A7EA-A2DB41CEB5BC}" = iPod for Windows 2005-09-23
"krishna's Flute" = firstscreensaver.com\krishna's Flute
"Macrovision FLEXid Drivers" = Macrovision FLEXid Drivers
"MAGIX audio cleaning lab 2005" = MAGIX audio cleaning lab 2005
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MarketSamurai.6E37012E1CBD7F47B14488FCC715944F3EBDCEDC.1" = Market Samurai
"Mavis Beacon Teaches Typing Deluxe 17" = Mavis Beacon Teaches Typing Deluxe 17
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Miro" = Miro
"Mozilla Firefox (3.6)" = Mozilla Firefox (3.6)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MultiTranse Oriental_is1" = MultiTranse Oriental 6.0
"nik SharpenerPro Demo" = nik SharpenerPro Demo
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"OnlineArmor_is1" = Online Armor 4.0
"Pamela" = Pamela Pro 4.6
"PC Wizard 2008_is1" = PC Wizard 2008.1.871
"Picasa 3" = Picasa 3
"Picasa2" = Picasa 2
"PrimoPDF3.0" = PrimoPDF
"Prism" = Prism Video Converter
"Rainbow Sentinel Driver" = Sentinel System Driver
"ShaPlus Google Translator" = ShaPlus Google Translator 2.0
"SightSpeed" = SightSpeed
"Software Informer_is1" = Software Informer 1.0 BETA
"Sound Blaster AudioPCI" = Sound Blaster AudioPCI
"SoundTaxi_is1" = SoundTaxi 3.4.5
"SpeedBit Video Accelerator" = SpeedBit Video Accelerator
"SpeedBit Video Downloader" = SpeedBit Video Downloader
"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.5.2.20
"ST6UNST #1" = Karen's Disk Slack Checker
"Tweak UI 2.10" = Tweak UI
"Uninstall_is1" = Uninstall 1.0.0.0
"VideoPad" = VideoPad Video Editor
"VLC media player" = VideoLAN VLC media player 0.8.6d
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Web_3.0.3813.0" = Microsoft Expression Web 3
"WebCam Live! Product Registration" = WebCam Live! Product Registration
"WebMeeting Plug-in" = WebMeeting Plug-in
"Windows Media Connect" = Windows Media Connect
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinPatrol" = WinPatrol
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

========== Last 10 Event Log Errors ==========

[ Antivirus Events ]
Error - 9/27/2009 5:32:35 AM | Computer Name = JPRIG | Source = avast! | ID = 33554522
Description =

Error - 9/27/2009 5:32:35 AM | Computer Name = JPRIG | Source = avast! | ID = 33554522
Description =

Error - 9/27/2009 5:32:35 AM | Computer Name = JPRIG | Source = avast! | ID = 33554522
Description =

Error - 9/27/2009 5:32:35 AM | Computer Name = JPRIG | Source = avast! | ID = 33554522
Description =

Error - 9/27/2009 5:32:35 AM | Computer Name = JPRIG | Source = avast! | ID = 33554522
Description =

Error - 9/27/2009 5:32:36 AM | Computer Name = JPRIG | Source = avast! | ID = 33554522
Description =

Error - 9/27/2009 5:32:36 AM | Computer Name = JPRIG | Source = avast! | ID = 33554522
Description =

Error - 9/27/2009 5:32:36 AM | Computer Name = JPRIG | Source = avast! | ID = 33554522
Description =

Error - 9/27/2009 5:32:36 AM | Computer Name = JPRIG | Source = avast! | ID = 33554522
Description =

Error - 9/27/2009 5:32:36 AM | Computer Name = JPRIG | Source = avast! | ID = 33554522
Description =

[ Application Events ]
Error - 10/19/2006 4:10:30 AM | Computer Name = JPRIG | Source = MsiInstaller | ID = 1023
Description = Product: Microsoft .NET Framework 2.0 - Update 'Security Update for
Microsoft .NET Framework 2.0 (KB922770)' could not be installed. Error code 1603.
Additional information is available in the log file C:\WINDOWS\TEMP\NDP20-KB922770-X86\NDP20-KB922770-X86-msi.0.log.

Error - 10/20/2006 12:18:02 AM | Computer Name = JPRIG | Source = MsiInstaller | ID = 1023
Description = Product: Microsoft .NET Framework 2.0 - Update 'Security Update for
Microsoft .NET Framework 2.0 (KB922770)' could not be installed. Error code 1603.
Additional information is available in the log file C:\WINDOWS\TEMP\NDP20-KB922770-X86\NDP20-KB922770-X86-msi.0.log.

Error - 10/20/2006 8:09:08 AM | Computer Name = JPRIG | Source = MsiInstaller | ID = 1023
Description = Product: Microsoft .NET Framework 2.0 - Update 'Security Update for
Microsoft .NET Framework 2.0 (KB922770)' could not be installed. Error code 1603.
Additional information is available in the log file C:\WINDOWS\TEMP\NDP20-KB922770-X86\NDP20-KB922770-X86-msi.0.log.

Error - 10/21/2006 12:55:06 AM | Computer Name = JPRIG | Source = MsiInstaller | ID = 1023
Description = Product: Microsoft .NET Framework 2.0 - Update 'Security Update for
Microsoft .NET Framework 2.0 (KB922770)' could not be installed. Error code 1603.
Additional information is available in the log file C:\WINDOWS\TEMP\NDP20-KB922770-X86\NDP20-KB922770-X86-msi.0.log.

Error - 10/22/2006 1:06:44 AM | Computer Name = JPRIG | Source = MsiInstaller | ID = 1023
Description = Product: Microsoft .NET Framework 2.0 - Update 'Security Update for
Microsoft .NET Framework 2.0 (KB922770)' could not be installed. Error code 1603.
Additional information is available in the log file C:\WINDOWS\TEMP\NDP20-KB922770-X86\NDP20-KB922770-X86-msi.0.log.

Error - 10/23/2006 2:22:35 AM | Computer Name = JPRIG | Source = MsiInstaller | ID = 1023
Description = Product: Microsoft .NET Framework 2.0 - Update 'Security Update for
Microsoft .NET Framework 2.0 (KB922770)' could not be installed. Error code 1603.
Additional information is available in the log file C:\WINDOWS\TEMP\NDP20-KB922770-X86\NDP20-KB922770-X86-msi.0.log.

Error - 10/23/2006 8:50:38 AM | Computer Name = JPRIG | Source = MsiInstaller | ID = 1023
Description = Product: Microsoft .NET Framework 2.0 - Update 'Security Update for
Microsoft .NET Framework 2.0 (KB922770)' could not be installed. Error code 1603.
Additional information is available in the log file C:\WINDOWS\TEMP\NDP20-KB922770-X86\NDP20-KB922770-X86-msi.0.log.

Error - 10/24/2006 2:36:50 AM | Computer Name = JPRIG | Source = MsiInstaller | ID = 1023
Description = Product: Microsoft .NET Framework 2.0 - Update 'Security Update for
Microsoft .NET Framework 2.0 (KB922770)' could not be installed. Error code 1603.
Additional information is available in the log file C:\WINDOWS\TEMP\NDP20-KB922770-X86\NDP20-KB922770-X86-msi.0.log.

Error - 10/25/2006 12:24:25 AM | Computer Name = JPRIG | Source = MsiInstaller | ID = 1023
Description = Product: Microsoft .NET Framework 2.0 - Update 'Security Update for
Microsoft .NET Framework 2.0 (KB922770)' could not be installed. Error code 1603.
Additional information is available in the log file C:\WINDOWS\TEMP\NDP20-KB922770-X86\NDP20-KB922770-X86-msi.0.log.

Error - 10/25/2006 4:31:23 PM | Computer Name = JPRIG | Source = MsiInstaller | ID = 1023
Description = Product: Microsoft .NET Framework 2.0 - Update 'Security Update for
Microsoft .NET Framework 2.0 (KB922770)' could not be installed. Error code 1603.
Additional information is available in the log file C:\WINDOWS\TEMP\NDP20-KB922770-X86\NDP20-KB922770-X86-msi.0.log.

[ System Events ]
Error - 9/11/2006 5:03:54 PM | Computer Name = JPRIG | Source = Service Control Manager | ID = 7000
Description = The PSTRIP service failed to start due to the following error: %%2

Error - 9/12/2006 11:46:39 AM | Computer Name = JPRIG | Source = Service Control Manager | ID = 7000
Description = The PSTRIP service failed to start due to the following error: %%2

Error - 9/13/2006 9:06:56 AM | Computer Name = JPRIG | Source = Service Control Manager | ID = 7000
Description = The PSTRIP service failed to start due to the following error: %%2

Error - 9/14/2006 9:40:55 AM | Computer Name = JPRIG | Source = Service Control Manager | ID = 7000
Description = The PSTRIP service failed to start due to the following error: %%2

Error - 9/14/2006 3:46:43 PM | Computer Name = JPRIG | Source = Service Control Manager | ID = 7000
Description = The PSTRIP service failed to start due to the following error: %%2

Error - 9/15/2006 10:26:12 AM | Computer Name = JPRIG | Source = Service Control Manager | ID = 7000
Description = The PSTRIP service failed to start due to the following error: %%2

Error - 9/16/2006 11:25:51 AM | Computer Name = JPRIG | Source = Service Control Manager | ID = 7000
Description = The PSTRIP service failed to start due to the following error: %%2

Error - 9/17/2006 9:26:25 AM | Computer Name = JPRIG | Source = Service Control Manager | ID = 7000
Description = The PSTRIP service failed to start due to the following error: %%2

Error - 9/17/2006 10:05:57 PM | Computer Name = JPRIG | Source = Service Control Manager | ID = 7000
Description = The PSTRIP service failed to start due to the following error: %%2

Error - 9/18/2006 9:41:58 AM | Computer Name = JPRIG | Source = Service Control Manager | ID = 7000
Description = The PSTRIP service failed to start due to the following error: %%2

< End of report >

SweetTech

Post #11March 24, 2010, 8:22 PM UTC

I just checked, and I don't seem to see that log that you submitted. Could you please submit it again for me?

Shenlord

Post #12March 24, 2010, 9:21 PM UTC

Same message from the bleeping comp upload function/ server: I will try again in a while Error message We apologize for the temporary outage. The administrators are performing maintenance on the site and will be finished soon. Please try again shortly. You can try refreshing the page in a couple of minutes by clicking here.

Shenlord

Post #13March 24, 2010, 9:25 PM UTC

Unusual CF file request: the .cfxxe CF file just uploaded as did the cfxxe.txt version.

SweetTech

Post #14March 24, 2010, 9:30 PM UTC last edited March 24, 2010, 9:30 PM UTC

I received the two files that you have uploaded for me. Thank you.

I would also like to see a list of files quarantined by ComboFix, so please do this:
Click Start > Run then copy/paste the following single-line command into the Run box and click OK:

C:\Qoobox\ComboFix-quarantined-files.txt

A text file should open. Post the contents of that file in your next reply.

Shenlord

Post #15March 24, 2010, 9:35 PM UTC

Quote[Windows cannot find C:\Qoobox\ComboFix-quarantined-files.txt . Make sure you typed … correctly. etc.] (I copy pasted it twice from your post in the run window). I'll try again.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Adware HBHelper / Browser Hijacker Desktop

✨ Ask AI

Ask AI