[Closed] Redirected Hostfiles

Hi,

I am having trouble with talking to people on either Skype or MSN–the person on the other end could not hear my voice, although I can hear fine on my side. Also, whenever I am making some clicks, for example, on some photos inside a photo folder on the desktop, it will give me the following message:

"Windows Explorer has encountered a problem and needs to close. We are sorry for the inconvenience. If you were in the middle of something, the information you were working on might be lost. For more information about this error, click here. Debug Close"

Just want to let you know that I have done a system restore on my own yesterday and the Ram works a little better after that; however, problems mentioned above still persist.

I have AVG, Malwarebytes, zonealarm, superantispyware and more; however, only Ad-aware and spybot were able to detect some problems. It looks like my computer got some redirected hostfiles and Win32.FraudLoad; somehow they can be easily re-activated after a reboot although I tried time after time to delete them out.

Below are the details of what Ad-aware and spybot found on my computer. DDS.txt, GMER.txt, and attachment will all be followed. I am not sure if those redirected hostfiles are still in the system or not because Ad-aware is not working anymore after that system restore. Also, uploading attach.txt has failed, so I am just going to paste in the post. Thanks so very much in advance!

Ad-adware:
Hostfile Entry engine.awaps.net(127.0.0.1) @ 273
Hostfile Entry ads2.expatica.com(127.0.0.1) @ 706
Hostfile Entry www.hit-counter-download.com(127.0.0.1) @ 914
Hostfile Entry dl.jiangmin.com(127.0.0.1) @ 1067
Hostfile Entry ads.mcafee.com(127.0.0.1) @ 1227
Hostfile Entry directads.mcafee.com(127.0.0.1) @ 1228
Hostfile Entry www-avast.com(127.0.0.1) @ 5879
Hostfile Entry om.symantec.com(127.0.0.1) @ 10501
Hostfile Entry a.answers.com(127.0.0.1) @ 10885
Hostfile Entry microsoft.com.org(127.0.0.1) @ 12862
Hostfile Entry www.www.microsoft.com.org(127.0.0.1) @ 12863
Hostfile Entry wdcs.trndmicro.com(127.0.0.1) @ 15040

Spybot:
Win32.FraudLoad
SBI $66C501C9) Class I*D
HKEY_CLASSES_ROOT\CLSID\{3F5A62E2-51F2-11D3-A075-CC7364CAE42A}

DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 3:48:08.29 on 04/12/2010 Mon
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_18
Microsoft Windows XP Professional 5.1.2600.3.936.86.1033.18.2039.1449 [GMT -10:00]

AV: AVG Internet Security *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Pro Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
svchost.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\fse\DiskPro.exe
C:\Program Files\ICBCEbankTools\ICBCAntiPhishing\IcbcDaemon.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kingsoft\PowerWord PE\ksdsvc.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AVG\AVG9\avgam.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
C:\WINDOWS\Installer\MSI16.tmp
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\TeamViewer.Host\TeamViewer Host 5.0.7687\TeamViewer_Service.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
C:\Program Files\Startup Faster\sfagent.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\reliz\akeys.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Kingsoft\PowerWord PE\CBTray.exe
C:\Program Files\Google\Google Pinyin 2\GooglePinyinDaemon.exe
C:\Program Files\Google\Google Pinyin 2\GooglePinyinService.exe
C:\Program Files\iDailyDiary\iDD.exe
C:\Documents and Settings\Administrator\Desktop\dds.scr
C:\WINDOWS\system32\conime.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
uURLSearchHooks: H - No File
mWinlogon: UIHost=c:\windows\system32\logonui_holersoft.exe
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: agihelper.AGUtils: {0bc6e3fa-78ef-4886-842c-5a1258c4455a} - mscoree.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot - search & destroy\SDHelper.dll
BHO: RoboForm: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
BHO: 谷歌金山词霸for IE: {a28581a7-e2a8-4b6c-9cc9-4a4cc1efd55a} - c:\program files\kingsoft\powerword pe\SelectForIE.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: ICBC Anti-Phishing class: {bb4491a2-d11a-4c6b-91c0-b53246a3122b} - c:\program files\icbcebanktools\icbcantiphishing\Icbc_AntiPhishing.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: DAPIELoader Class: {ff6c3cf0-4b15-11d1-abed-709549c10000} - c:\progra~1\dap\dapieloader.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
uRun: [FreeRAM XP] "c:\program files\yourware solutions\freeram xp pro\FreeRAM XP Pro.exe" -win
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [KingSoft PowerWord PE] c:\program files\kingsoft\powerword pe\CBTray.exe -AUTORUN
mRun: [StartupFaster] "c:\program files\startup faster\startuploader.exe" -run SFAURUN SFCURUN SFAUSTARTUP SFCUSTARTUP
StartupFolder: c:\docume~1\admini~1\startm~1\programs\startup\startupfaster\erunt autobackup.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\documents and settings\administrator\start menu\programs\startup\startupfaster\StartupFaster.ini
StartupFolder: c:\docume~1\admini~1\startm~1\programs\startup\startupfaster\webshots.lnk - c:\program files\webshots\3.1.5.7613\Launcher.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\startu~1\cyberbuddy.lnk - c:\program files\cyberbuddy\CyberBud.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\startu~1\hp digital imaging monitor.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\startu~1\hpzrcv01.lnk - c:\program files\hp\temp\{387d9916-bd27-480f-8cf0-3228832bbaa2}\setup\hpzstub.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\startu~1\hpzsetup.lnk - c:\program files\hp\temp\{387d9916-bd27-480f-8cf0-3228832bbaa2}\hpzstub.exe
StartupFolder: c:\documents and settings\all users\start menu\programs\startup\startupfaster\StartupFaster.ini
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\startu~1\winzip quick pick.lnk - c:\program files\winzip\WZQKPICK.EXE
mPolicies-explorer: NoResolveTrack = 1 (0x1)
mPolicies-system: DisableCAD = 1 (0x1)
IE: &Clean Traces - c:\program files\dap\privacy package\dapcleanerie.htm
IE: &Download with &DAP - c:\program files\dap\dapextie.htm
IE: Customize Menu - file://c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html
IE: Download &all with DAP - c:\program files\dap\dapextie2.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: Logoff - file://c:\program files\siber systems\ai roboform\RoboFormComLogoff.html
IE: RoboForm Toolbar - file://c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot - search & destroy\SDHelper.dll
Trusted Zone: download.com
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {3AA9CF07-DF20-48FF-98BE-DED276E40146} - hxxps://mybank.icbc.com.cn/icbc/GDReadPub.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1259040504156
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1259177746234
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} - hxxps://mybank.icbc.com.cn/icbc/newperbank/AxSafeControls.cab
DPF: {B1FBC1AD-5644-4084-882A-0F8BA85E7506} - hxxps://mybank.icbc.com.cn/icbc/ICBC_NetSign.dll
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\Skype4COM.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\l74oo4fh.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - prefs.js: browser.startup.homepage - hxxp://search.speedbit.com
FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p=
FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll
FF - component: c:\program files\dap\dapfirefox\components\DAPFireFox.dll
FF - component: c:\program files\siber systems\ai roboform\firefox\components\rfproxy_31.dll
FF - plugin: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\l74oo4fh.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
FF - plugin: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\l74oo4fh.default\extensions\[removed]\plugins\nptnt.dll
FF - plugin: c:\documents and settings\administrator\local settings\application data\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\opera\program\plugins\np_gp.dll
FF - plugin: c:\program files\windows media player\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", "-1");
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); // now unused
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.delay", 50);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2009-11-25 52872]
R0 wxbfileb;wxbfileb;c:\windows\system32\drivers\wxbfileb.sys [2009-12-3 18432]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-11-25 216200]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-11-25 29512]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-11-25 242696]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-7-28 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-7-28 72944]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2009-11-25 353680]
R2 avg9wd;AVG WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-3-4 308064]
R2 DiskPro_Service;DiskPro_Service;c:\program files\fse\DiskPro.exe [2009-12-3 73728]
R2 ICBC Daemon Service;ICBC Daemon Service;c:\program files\icbcebanktools\icbcantiphishing\IcbcDaemon.exe [2009-10-14 397184]
R2 KSDSVC;Kingsoft Common Content Service;c:\program files\kingsoft\powerword pe\ksdsvc.exe [2009-10-28 25240]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2009-11-25 303952]
R2 SCPDFV4ReadSpool;SolidConverterPDFv4ReadSpool;c:\windows\installer\MSI16.tmp [2009-12-19 189688]
R2 TeamViewer5;TeamViewer 5;c:\program files\teamviewer.host\teamviewer host 5.0.7687\TeamViewer_Service.exe [2010-2-2 185640]
R3 Alidevice;Alidevice;c:\windows\system32\drivers\alidevice.sys [2008-7-13 6656]
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [2009-11-23 87936]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2009-11-25 20824]
S2 lf;lf;\??\c:\program files\everstrike\lock folder xp 3.2\unishieldxp.sys –> c:\program files\everstrike\lock folder xp 3.2\UniShieldXP.sys [?]
S2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service –> c:\windows\system32\zonelabs\vsmon.exe -service [?]
S3 DfSdkS;Defragmentation-Service;c:\program files\ashampoo\ashampoo winoptimizer 6\DfSdkS.exe [2010-2-16 406016]
S3 getPlusHelper;getPlus® Helper;c:\windows\system32\svchost.exe -k getPlusHelper [2008-4-14 14336]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-7-28 7408]
S4 AGCoreService;AG Core Services;c:\program files\agi\core\4.0\AGCoreService.exe [2009-11-26 20480]
S4 CPSR;Application Sub Modoule Data Transfer;c:\program files\kiuys\egqq.exe –> c:\program files\kiuys\egqq.exe [?]

=============== Created Last 30 ================

2010-04-10 14:27 –d—– c:\windows\system32\wbem\Repository
2010-04-04 16:41 15,880 a——- c:\windows\system32\lsdelete.exe
2010-04-04 14:36 64,288 a——- c:\windows\system32\drivers\Lbd.sys
2010-04-04 14:36 95,024 a——- c:\windows\system32\drivers\SBREDrv.sys
2010-04-04 14:29 -cd-h— c:\docume~1\alluse~1\applic~1\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-04-04 14:29 –d—– c:\program files\Lavasoft
2010-04-03 15:20 0 a——- c:\windows\LiveUpdate.INI
2010-04-03 14:16 598,096 a——- c:\windows\system32\GLSetup2.exe
2010-04-03 09:34 –d—– c:\docume~1\admini~1\applic~1\TightVNC
2010-04-03 09:31 –d—– c:\program files\TightVNC
2010-04-01 22:27 –d—– c:\docume~1\alluse~1\applic~1\Fetion
2010-04-01 20:25 –d—– C:\AllokMP3toAMRFolder
2010-03-30 14:34 –d—– c:\program files\Super Mp3 Recorder Professional
2010-03-30 10:06 0 a—h— c:\windows\system32\drivers\Msft_Kernel_motfilt_01007.Wdf
2010-03-30 10:06 0 a—h— c:\windows\system32\drivers\Msft_Kernel_Motousbnet_01007.Wdf
2010-03-30 10:06 0 a—h— c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2010-03-30 10:06 14,640 ——– c:\windows\system32\spmsgXP_2k3.dll
2010-03-30 09:50 1,112,288 a——- c:\windows\system32\wdfcoinstaller01007.dll
2010-03-30 09:50 23,552 a——- c:\windows\system32\drivers\Motousbnet.sys
2010-03-30 09:50 6,400 a——- c:\windows\system32\drivers\motswch.sys
2010-03-30 09:50 6,016 a——- c:\windows\system32\drivers\motfilt.sys
2010-03-30 09:49 –d—– c:\program files\Motorola
2010-03-30 09:49 –d—– c:\program files\common files\Motorola Shared
2010-03-21 11:31 974,848 a——- c:\windows\system32\mfc70.dll
2010-03-21 11:31 344,064 a——- c:\windows\system32\msvcr70.dll
2010-03-21 11:31 7,406 a——- c:\windows\system32\update.ico
2010-03-21 11:31 4,710 a——- c:\windows\system32\player.ico
2010-03-21 11:30 –d—– C:\Gbhome_v6
2010-03-21 10:21 –d—– c:\program files\WinISO
2010-03-20 22:40 –d—– c:\documents and settings\all users\Real
2010-03-20 22:39 –d—– c:\program files\common files\Thunder Network
2010-03-20 22:39 –d—– c:\docume~1\alluse~1\applic~1\Thunder Network
2010-03-20 22:38 –d—– c:\program files\Thunder Network
2010-03-20 20:51 –d—– c:\program files\TurnTool
2010-03-16 07:18 –d—– C:\dcache
2010-03-15 22:34 –d—– C:\VGDownloads
2010-03-15 22:34 –d—– C:\Vagaa
2010-03-15 11:13 118 a——- c:\windows\ConverterCore.INI
2010-03-15 11:13 –d—– c:\docume~1\admini~1\applic~1\SolidDocuments
2010-03-14 19:10 –d—– C:\dosh
2010-03-14 19:03 –d—– c:\program files\LuDaShi
2010-03-14 19:03 15,400 a——- c:\windows\system32\drivers\ComputerZ_x64.sys
2010-03-14 19:03 15,400 a——- c:\windows\system32\drivers\ComputerZ.sys
2010-03-14 18:55 –d—– c:\program files\eMule
2010-03-13 19:06 108 a——- c:\windows\options.ini
2010-03-13 19:05 –d—– c:\program files\Tcale
2010-03-13 12:58 5,632 a——- c:\windows\system32\ptpusb.dll
2010-03-13 12:58 159,232 a——- c:\windows\system32\ptpusd.dll
2010-03-13 12:58 15,104 ac—— c:\windows\system32\dllcache\usbscan.sys
2010-03-13 12:58 15,104 a——- c:\windows\system32\drivers\usbscan.sys

==================== Find3M ====================

2010-03-29 15:24 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-29 15:24 20,824 a——- c:\windows\system32\drivers\mbam.sys
2010-03-10 17:38 4,212 a—h— c:\windows\system32\zllictbl.dat
2010-03-04 08:06 242,696 a——- c:\windows\system32\drivers\avgtdix.sys
2010-03-04 08:06 12,464 a——- c:\windows\system32\avgrsstx.dll
2010-03-04 08:05 216,200 a——- c:\windows\system32\drivers\avgldx86.sys
2010-03-04 08:05 52,872 a——- c:\windows\system32\drivers\avgrkx86.sys
2010-02-24 20:24 916,480 a——- c:\windows\system32\wininet.dll
2010-01-26 13:46 232,712 a——- c:\windows\system32\PDBoot.exe
2009-12-03 14:01 120 a–sh— c:\windows\system32\sferunnum.dll
============= FINISH: 3:49:00.59 ===============

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-04-12 03:58:20
Windows 5.1.2600 Service Pack 3
Running: njlbyv8f.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\fglyipow.sys


—- System - GMER 1.0.15 —-

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateFile [0xA9E936E0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateKey [0xA9EA0490]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDeleteFile [0xA9E93C70]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDeleteKey [0xA9EA0D10]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDeleteValueKey [0xA9EA0AC0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwLoadKey [0xA9EA1230]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwLoadKey2 [0xA9EA12B0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwOpenFile [0xA9E93AD0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwRenameKey [0xA9EA1970]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwReplaceKey [0xA9EA13D0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwRestoreKey [0xA9EA17C0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSetInformationFile [0xA9E93EA0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSetValueKey [0xA9EA0800]

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs wxbfileb.sys (wxbsoft File System Filter Driver/Microsoft Corporation)

Device \Driver\Tcpip \Device\Ip vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 Alidevice.SYS (Windows NT alipay kernel module/alipay.com)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 Alidevice.SYS (Windows NT alipay kernel module/alipay.com)

Device \Driver\Tcpip \Device\Tcp vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\Tcpip \Device\Udp vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\Tcpip \Device\RawIp vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SOFTWARE\Classes\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\Indeo?video 5.10 Compression Filter
Reg HKLM\SOFTWARE\Classes\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\Indeo?video 5.10 Compression Filter@FriendlyName Indeo? video 5.10 Compression Filter
Reg HKLM\SOFTWARE\Classes\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\Indeo?video 5.10 Compression Filter@CLSID {1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}
Reg HKLM\SOFTWARE\Classes\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\Indeo?video 5.10 Compression Filter@FilterData 0x02 0x00 0x00 0x00 …
Reg HKLM\SOFTWARE\Classes\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\Indeo?video 5.10 Compression Filter@EncoderType 1

—- EOF - GMER 1.0.15 —-

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-06-26.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 11/22/2009 8:22:57 PM
System Uptime: 4/12/2010 3:43:14 AM (0 hours ago)

Motherboard: Dell Inc. | |
Processor: Intel® Pentium® M processor 1.86GHz | Microprocessor | 1861/133mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 75 GiB total, 52.644 GiB free.
D: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Dell Wireless 1370 WLAN Mini-PCI Card
Device ID: PCI\VEN_14E4&DEV_4318&SUBSYS_00051028&REV_02\4&2FA23535&0&18F0
Manufacturer: Broadcom
Name: Dell Wireless 1370 WLAN Mini-PCI Card
PNP Device ID: PCI\VEN_14E4&DEV_4318&SUBSYS_00051028&REV_02\4&2FA23535&0&18F0
Service: BCM43XX

Class GUID: {4D36E96C-E325-11CE-BFC1-08002BE10318}
Description:
Device ID: ROOT\MEDIA\0000
Manufacturer:
Name:
PNP Device ID: ROOT\MEDIA\0000
Service:

==== System Restore Points ===================

RP27: 3/10/2010 6:21:40 PM - Software Distribution Service 3.0
RP28: 3/21/2010 10:44:44 AM - Installed 3D Home Architect Design Suite Deluxe 8
RP29: 3/29/2010 3:02:40 PM - Removed Opera 10.10.
RP30: 3/29/2010 3:02:57 PM - Installed Opera 10.51.
RP31: 3/30/2010 8:12:53 AM - Software Distribution Service 3.0
RP32: 3/30/2010 9:49:37 AM - Installed Motorola Driver Installation 4.5.0
RP33: 3/30/2010 10:06:25 AM - Installed Windows XP Wdf01007.
RP34: 4/8/2010 11:23:32 PM - Installed WinZip 14.0
RP35: 4/10/2010 2:25:35 PM - Restore Operation
RP36: 4/10/2010 2:41:51 PM - Software Distribution Service 3.0

==== Installed Programs ======================

Acrobat.com
Additional Background Pack 1
Additional Clipart Pack 1
Additional Clipart Pack BW
Adobe AIR
Adobe Download Manager
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Photoshop CS
Adobe Reader 9.2
Adobe Shockwave Player 11.5
AI RoboForm (All Users)
Allok RM RMVB to AVI MPEG DVD Converter 2.2.0920
Apple Application Support
Apple Software Update
Ashampoo WinOptimizer 6.60
Ask Toolbar
Avant Browser (remove only)
AVG 9.0
Bluetooth HID Switch Service
Broadcom Gigabit Integrated Controller
BufferChm
Business Card Designer Plus 7.3.0.0
C-Major Audio
Camfrog Video Chat 5.4
Camtasia Studio 2
CCleaner
Compatibility Pack for the 2007 Office system
CustomerResearchQFolder
CyberBuddy
D4300
D4300_Help
Dell Wireless WLAN Card
DeviceDiscovery
DeviceManagementQFolder
DJ_SF_03_D4300_ProductContext
DJ_SF_03_D4300_Software
DJ_SF_03_D4300_Software_Min
Download Accelerator Plus (DAP)
Dream Aquarium
eMule
ePrompter
ERUNT 1.1j
eSupportQFolder
EVEREST Home Edition v2.20
Fetion 2010
Google Chrome
Google Toolbar for Internet Explorer
GPBaseService
HijackThis 2.0.2
Holding Pattern Screen Saver
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
HP Customer Participation Program 10.0
HP Deskjet D4300 Printer Driver Software 10.0 Rel .3
HP Imaging Device Functions 10.0
HP Photosmart Essential 2.5
HP Smart Web Printing
HP Solution Center 10.0
HP Update
HPProductAssistant
HPSSupply
iDailyDiary 3.61
Intel® Graphics Media Accelerator Driver for Mobile
IrfanView (remove only)
Java Auto Updater
Java™ 6 Update 18
KeePass Password Safe 2.09
Lernout & Hauspie TruVoice American English TTS Engine
LogonStudio
Malwarebytes' Anti-Malware
MarketResearch
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Professional Edition 2003
Microsoft Office XP Professional with FrontPage
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft XML Parser
Mozilla Firefox (3.6)
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nero 8
neroxml
OGA Notifier 2.0.0048.0
Opera 10.10
PerfectDisk 10 Professional
PSSWCORE
QQ游戏
QQ锄大地游戏
QuickTime
Registry Mechanic 8.0
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371-v2)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974455)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978706)
Segoe UI
SereneScreen Aquarium
ShenProfessional 3.0
Shop for HP Supplies
Skype? 4.2
SmartWebPrintingOC
Solid Converter PDF v4
SolutionCenter
SplitCam
Spybot - Search & Destroy
SpywareBlaster 4.2
Startup Faster!
Startup Faster! 2004
Status
SUPERAntiSpyware Professional
Switch Off
TeamViewer 5
Texas Instruments PCIxx21/x515 drivers.
TI_Inst
Toolbox
TrayApp
TreeSize Professional 5.0
UnloadSupport
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Windows (KB971513)
Update for Windows Internet Explorer 8 (KB975364)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows XP (KB898461)
Update for Windows XP (KB951978)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VC 9.0 Runtime
VCRedistSetup
VideoToolkit01
WebcamMax
WebFldrs XP
WebReg
Webshots Desktop
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Upload Tool
Windows Media Format 11 runtime
Windows Media Player 11
WinRAR archiver
WinZip
Wisdom-soft ScreenHunter 5.1 Free
XP Codec Pack
XP变脸王 v9.4
ZoneAlarm Pro
中国工商银行防钓鱼软件
傲游浏览器2
可牛影像 2.3 正式版
搜狗拼音输入法 4.3正式版
文件夹加密超级大师 12.60
美图秀秀 2.1.1
谷歌拼音输入法 2.2
谷歌金山词霸合作版2.0

==== Event Viewer Messages From Past Week ========

4/8/2010 9:39:37 PM, error: Service Control Manager [7016] - The DiskPro_Service service has reported an invalid current state 0.
4/8/2010 1:04:06 PM, error: Service Control Manager [7024] - The TrueVector Internet Monitor service terminated with service-specific error 0 (0x0).
4/7/2010 6:32:18 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
4/7/2010 6:32:12 PM, error: Service Control Manager [7000] - The lf service failed to start due to the following error: The system cannot find the path specified.
4/7/2010 5:51:21 AM, error: Service Control Manager [7034] - The ICBC Daemon Service service terminated unexpectedly. It has done this 1 time(s).
4/7/2010 5:50:49 AM, error: Service Control Manager [7022] - The Cryptographic Services service hung on starting.
4/7/2010 5:50:49 AM, error: Service Control Manager [7001] - The TrueVector Internet Monitor service depends on the Cryptographic Services service which failed to start because of the following error: After starting, the service hung in a start-pending state.
4/6/2010 9:36:25 PM, error: Service Control Manager [7022] - The Wireless Zero Configuration service hung on starting.
4/6/2010 9:14:08 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the TrueVector Internet Monitor service to connect.
4/6/2010 9:14:08 AM, error: Service Control Manager [7000] - The TrueVector Internet Monitor service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
4/6/2010 6:48:37 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Dell Wireless WLAN Tray Service service to connect.
4/6/2010 6:48:37 AM, error: Service Control Manager [7000] - The Dell Wireless WLAN Tray Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
4/11/2010 12:50:21 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service helpsvc with arguments "" in order to run the server: {833E4010-AFF7-4AC3-AAC2-9F24C1457BCE}

==== End Of File ===========================

ComboFix 10-04-14.01 - Shaman 5/2010 Thu 1:21.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.936.86.1033.18.2039.1529 [GMT -10:00]
Location: c:\documents and settings\Administrator\Desktop\ComboFix.exe
AV: AVG Internet Security *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Pro Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((((((((((((((((( deleted files )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\etc\lmhosts

.
((((((((((((((((((((((((( New files of 2010-03-15 to 2010-04-15 )))))))))))))))))))))))))))))))
.

2010-04-14 00:55 . 2010-04-14 00:55 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\TurnTool
2010-04-12 19:57 . 2010-04-12 19:58 ——– d—–w- c:\program files\Lavasoft
2010-04-12 19:29 . 2010-04-12 19:29 ——– d—–w- c:\program files\VS Revo Group
2010-04-11 00:27 . 2010-04-11 00:27 ——– d—–w- c:\windows\system32\wbem\Repository
2010-04-06 16:56 . 2010-04-06 16:56 598368 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\EmailScanner.dll
2010-04-05 02:41 . 2010-04-05 00:36 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-04-05 00:35 . 2010-04-05 00:35 94712 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2010-04-05 00:35 . 2010-04-05 00:35 17480 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\EmailScannerBridge.dll
2010-04-05 00:35 . 2010-04-06 16:56 966104 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-04-05 00:35 . 2010-04-05 00:35 849744 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2010-04-05 00:35 . 2010-04-05 00:35 855864 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-04-05 00:35 . 2010-04-05 00:35 1597952 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2010-04-05 00:35 . 2010-04-05 00:35 818256 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2010-04-05 00:35 . 2010-04-06 16:56 1265264 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-04-05 00:29 . 2010-04-05 00:29 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-04-05 00:29 . 2010-02-04 15:53 2954656 -c–a-w- c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe
2010-04-05 00:29 . 2010-04-05 00:36 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-04-04 00:16 . 2010-04-04 00:16 598096 —-a-w- c:\windows\system32\GLSetup2.exe
2010-04-03 19:34 . 2010-04-03 20:08 ——– d—–w- c:\documents and settings\Administrator\Application Data\TightVNC
2010-04-03 19:31 . 2010-04-03 19:31 ——– d—–w- c:\documents and settings\LocalService\Application Data\TightVNC
2010-04-03 19:31 . 2010-04-03 19:31 ——– d—–w- c:\program files\TightVNC
2010-04-02 08:27 . 2010-04-02 08:27 ——– d—–w- c:\documents and settings\All Users\Application Data\Fetion
2010-04-02 06:25 . 2010-04-02 06:44 ——– d—–w- C:\AllokMP3toAMRFolder
2010-03-31 00:34 . 2010-03-31 00:42 ——– d—–w- c:\program files\Super Mp3 Recorder Professional
2010-03-30 20:06 . 2008-03-21 23:57 14640 ——w- c:\windows\system32\spmsgXP_2k3.dll
2010-03-30 19:50 . 2009-12-22 20:00 23552 —-a-w- c:\windows\system32\drivers\Motousbnet.sys
2010-03-30 19:50 . 2009-01-30 03:11 6016 —-a-w- c:\windows\system32\drivers\motfilt.sys
2010-03-30 19:50 . 2008-03-28 03:49 1112288 —-a-w- c:\windows\system32\wdfcoinstaller01007.dll
2010-03-30 19:50 . 2007-11-03 01:51 6400 —-a-w- c:\windows\system32\drivers\motswch.sys
2010-03-30 19:49 . 2010-03-30 19:49 ——– d—–w- c:\program files\Motorola
2010-03-30 19:49 . 2010-03-30 19:49 ——– d—–w- c:\program files\Common Files\Motorola Shared
2010-03-21 21:31 . 2002-01-06 14:48 974848 —-a-w- c:\windows\system32\mfc70.dll
2010-03-21 21:31 . 2002-01-06 05:37 344064 —-a-w- c:\windows\system32\msvcr70.dll
2010-03-21 21:30 . 2010-03-21 21:30 ——– d—–w- C:\Gbhome_v6
2010-03-21 20:21 . 2010-03-21 20:21 ——– d—–w- c:\program files\WinISO
2010-03-21 08:40 . 2010-03-21 08:40 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Thunder Network
2010-03-21 08:40 . 2010-03-21 08:40 ——– d—–w- c:\documents and settings\All Users\Real
2010-03-21 08:39 . 2010-03-21 08:40 ——– d—–w- c:\program files\Common Files\Thunder Network
2010-03-21 08:39 . 2010-03-25 04:44 ——– d—–w- c:\documents and settings\All Users\Application Data\Thunder Network
2010-03-21 08:38 . 2010-03-21 08:38 ——– d—–w- c:\program files\Thunder Network
2010-03-21 08:19 . 2008-08-12 19:30 167936 —-a-w- c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\l74oo4fh.default\extensions\[removed]\plugins\nptnt.dll
2010-03-21 06:51 . 2010-03-21 06:51 ——– d—–w- c:\program files\TurnTool
2010-03-16 17:18 . 2010-03-16 17:18 ——– d—–w- C:\dcache

.
(((((((((((((((((((((((((((((((((((((((( Edited files within three months ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-15 11:13 . 2009-11-25 10:00 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-04-15 11:10 . 2009-11-25 09:51 117760 —-a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-04-15 11:08 . 2009-11-25 19:03 ——– d—–w- c:\program files\Startup Faster
2010-04-14 08:49 . 2010-03-15 04:55 ——– d—–w- c:\program files\eMule
2010-04-14 07:37 . 2009-12-27 08:44 ——– d—–w- c:\documents and settings\Administrator\Application Data\SogouPY
2010-04-14 00:54 . 2009-11-25 17:04 ——– d—–w- c:\documents and settings\Administrator\Application Data\Skype
2010-04-14 00:47 . 2009-11-25 17:14 ——– d—–w- c:\documents and settings\Administrator\Application Data\skypePM
2010-04-14 00:03 . 2009-11-25 16:21 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-04-13 23:22 . 2009-11-25 16:29 ——– d—–w- c:\program files\SpywareBlaster
2010-04-13 18:19 . 2010-02-02 23:54 ——– d—–w- c:\documents and settings\Administrator\Application Data\TeamViewer
2010-04-12 23:08 . 2009-11-25 09:46 ——– d—–w- c:\documents and settings\All Users\Application Data\WinZip
2010-04-10 07:08 . 2009-11-24 09:46 ——– d—–w- c:\program files\Common Files\Adobe
2010-04-06 08:28 . 2009-12-03 23:46 ——– d—–w- c:\program files\fse
2010-04-06 08:22 . 2009-12-03 23:46 260 —-a-w- c:\windows\system32\FSEPath.dat
2010-04-04 19:56 . 2009-11-25 16:34 ——– d—–w- c:\program files\CCleaner
2010-04-03 19:44 . 2010-03-15 05:03 ——– d—–w- c:\program files\LuDaShi
2010-04-02 08:07 . 2009-11-25 09:25 ——– d—–w- c:\documents and settings\Administrator\Application Data\U3
2010-04-01 06:42 . 2009-11-25 19:14 ——– d—–w- c:\documents and settings\All Users\Application Data\avg9
2010-03-30 23:17 . 2009-11-25 16:30 ——– d—–w- c:\program files\DAP
2010-03-30 20:06 . 2010-03-30 20:06 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_motfilt_01007.Wdf
2010-03-30 20:06 . 2010-03-30 20:06 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_Motousbnet_01007.Wdf
2010-03-30 20:06 . 2010-03-30 20:06 0 —ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2010-03-30 01:24 . 2009-11-25 17:33 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-30 01:24 . 2009-11-25 17:33 20824 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-03-30 01:03 . 2009-11-29 09:56 ——– d—–w- c:\program files\Opera
2010-03-29 22:56 . 2009-11-25 17:33 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-03-29 22:54 . 2009-12-04 01:31 5918720 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-03-21 21:30 . 2009-11-23 09:12 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-03-15 21:13 . 2010-03-15 21:13 ——– d—–w- c:\documents and settings\Administrator\Application Data\SolidDocuments
2010-03-15 02:39 . 2009-12-08 18:07 ——– d—–w- c:\program files\ePrompter
2010-03-15 02:39 . 2009-12-18 21:02 ——– d—–w- c:\program files\Trillian
2010-03-14 05:06 . 2010-03-14 05:05 ——– d—–w- c:\program files\Tcale
2010-03-13 23:31 . 2009-11-25 14:55 ——– d—–w- c:\program files\ShenProfessional 3.0
2010-03-13 08:37 . 2009-12-13 10:16 ——– d—–w- c:\documents and settings\Administrator\Application Data\MxBoost
2010-03-11 03:38 . 2009-11-24 10:01 4212 —ha-w- c:\windows\system32\zllictbl.dat
2010-03-10 06:15 . 2008-04-14 12:00 420352 —-a-w- c:\windows\system32\vbscript.dll
2010-03-07 07:04 . 2009-11-25 17:41 ——– d—–w- c:\documents and settings\Administrator\Application Data\Fetion
2010-03-06 19:16 . 2009-11-25 17:36 ——– d—–w- c:\program files\iDailyDiary
2010-03-04 18:06 . 2009-11-25 19:15 242696 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-03-04 18:06 . 2010-03-04 18:06 12464 —-a-w- c:\windows\system32\avgrsstx.dll
2010-03-04 18:06 . 2009-11-25 19:15 29512 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-03-04 18:05 . 2009-11-25 19:15 216200 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2010-03-04 18:05 . 2009-11-25 19:15 52872 —-a-w- c:\windows\system32\drivers\avgrkx86.sys
2010-02-28 07:25 . 2010-02-28 07:25 ——– d—–w- c:\program files\Common Files\Skype
2010-02-26 08:23 . 2010-02-26 08:23 2217968 —-a-w- c:\documents and settings\Administrator\Application Data\Google\Google Pinyin 2\pinyin-2.2.11.69\GooglePinyinUpdater.exe
2010-02-25 06:24 . 2008-04-14 12:00 916480 —-a-w- c:\windows\system32\wininet.dll
2010-02-24 13:11 . 2008-04-14 12:00 455680 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-17 19:10 . 2008-04-14 12:00 2189952 —-a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 13:25 . 2008-04-14 00:01 2066816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-14 15:33 . 2009-11-25 16:40 ——– d—–w- c:\program files\Avant Browser
2010-02-12 04:33 . 2008-04-14 12:00 100864 —-a-w- c:\windows\system32\6to4svc.dll
2010-02-11 12:02 . 2008-04-14 12:00 226880 —-a-w- c:\windows\system32\drivers\tcpip6.sys
2010-02-04 15:53 . 2010-04-05 00:36 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-02-01 09:55 . 2010-02-01 09:55 10134 —-a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{65C101D4-0032-4970-A99B-476928F3E5D2}\ARPPRODUCTICON.exe
2010-01-27 08:34 . 2010-01-27 08:34 503808 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-61eba0c6-n\msvcp71.dll
2010-01-27 08:34 . 2010-01-27 08:34 499712 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-61eba0c6-n\jmc.dll
2010-01-27 08:34 . 2010-01-27 08:34 348160 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-61eba0c6-n\msvcr71.dll
2010-01-27 08:34 . 2010-01-27 08:34 61440 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-3ca14a60-n\decora-sse.dll
2010-01-27 08:34 . 2010-01-27 08:34 12800 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-3ca14a60-n\decora-d3d.dll
2010-01-26 23:46 . 2010-01-26 23:46 232712 —-a-w- c:\windows\system32\PDBoot.exe
2010-01-16 21:11 . 2010-01-16 21:11 20 —-a-w- c:\windows\system32\pub_store.dat
2010-01-16 19:35 . 2009-12-18 02:38 52224 —-a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-03-30 23:14 . 2009-12-16 12:13 251392 —-a-w- c:\program files\opera\program\plugins\dapop.dll
2009-12-04 00:01 . 2009-12-04 00:01 120 –sha-w- c:\windows\system32\sferunnum.dll
.

((((((((((((((((((((((((((((((((((((( log in point ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Attention*
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0bc6e3fa-78ef-4886-842c-5a1258c4455a}]
2008-07-25 21:16 282112 —-a-w- c:\windows\system32\mscoree.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-11-25 23:02 1230080 —-a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FF6C3CF0-4B15-11D1-ABED-709549C10000}]
2009-11-25 16:30 140880 —-a-w- c:\progra~1\DAP\dapieloader.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartupFaster"="c:\program files\Startup Faster\startuploader.exe" [2009-10-26 1455376]

c:\documents and settings\Administrator\Start Menu\Programs\Startup\StartupFaster
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
StartupFaster.ini [2010-4-15 578]
Webshots.lnk - c:\program files\Webshots\3.1.5.7613\Launcher.exe [2009-11-26 157000]

c:\documents and settings\All Users\Start Menu\Programs\Startup\StartupFaster
CyberBuddy.lnk - c:\program files\CyberBuddy\CyberBud.exe [2009-11-25 1497088]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
hpzrcv01.LNK - c:\program files\HP\Temp\{387D9916-BD27-480f-8CF0-3228832BBAA2}\setup\hpzstub.exe [2009-11-26 521552]
hpzsetup.LNK - c:\program files\HP\Temp\{387D9916-BD27-480f-8CF0-3228832BBAA2}\hpzstub.exe [2009-11-26 521552]
StartupFaster.ini [2010-4-15 1441]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2010-2-4 495432]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\windows\system32\logonui_holersoft.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 22:05 356352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-03-04 18:06 12464 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk *\0lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreeRAM XP]
2006-03-23 10:13 1591808 —-a-w- c:\program files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-11 09:08 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ERSvc"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\CyberBuddy\\CyberBud.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\Camfrog\\Camfrog Video Chat\\Camfrog Video Chat.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\腾讯游戏\\QQGAME\\QQGameDl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Maxthon2\\Modules\\MxDownloader\\MxDownloadServer.exe"=
"c:\\Program Files\\SogouInput\\4.3.0.3315\\PinyinUp.exe"=
"c:\\Program Files\\DAP\\DAP.exe"=
"c:\\Program Files\\TeamViewer.Host\\TeamViewer Host 5.0.7687\\TeamViewer.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\China Mobile\\Fetion\\VMDotNet\\v2.0.50727\\FetionVM.exe"=
"c:\\Program Files\\China Mobile\\Fetion\\FetionFx.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\ìú??ó??·\\QQGAME\\QQGameDl.exe"=

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [11/25/2009 9:15 AM 52872]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [4/4/2010 2:36 PM 64288]
R0 wxbfileb;wxbfileb;c:\windows\system32\drivers\wxbfileb.sys [12/3/2009 1:46 PM 18432]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [11/25/2009 9:15 AM 216200]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [11/25/2009 9:15 AM 242696]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/28/2009 10:53 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/28/2009 10:53 AM 72944]
R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [3/4/2010 8:06 AM 308064]
R2 DiskPro_Service;DiskPro_Service;c:\program files\fse\DiskPro.exe [12/3/2009 1:46 PM 73728]
R2 ICBC Daemon Service;ICBC Daemon Service;c:\program files\ICBCEbankTools\ICBCAntiPhishing\IcbcDaemon.exe [10/14/2009 9:40 AM 397184]
R2 KSDSVC;Kingsoft Common Content Service;c:\program files\Kingsoft\PowerWord PE\ksdsvc.exe [10/28/2009 11:58 PM 25240]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [11/25/2009 7:33 AM 303952]
R2 SCPDFV4ReadSpool;SolidConverterPDFv4ReadSpool;c:\windows\Installer\MSI16.tmp [12/19/2009 4:23 PM 189688]
R2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer.Host\TeamViewer Host 5.0.7687\TeamViewer_Service.exe [2/2/2010 3:46 PM 185640]
R3 Alidevice;Alidevice;c:\windows\system32\drivers\alidevice.sys [7/13/2008 4:10 PM 6656]
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [11/23/2009 10:58 AM 87936]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11/25/2009 7:33 AM 20824]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2/4/2010 5:52 AM 1265264]
S2 lf;lf;\??\c:\program files\Everstrike\Lock Folder XP 3.2\UniShieldXP.sys –> c:\program files\Everstrike\Lock Folder XP 3.2\UniShieldXP.sys [?]
S3 DfSdkS;Defragmentation-Service;c:\program files\Ashampoo\Ashampoo WinOptimizer 6\DfSdkS.exe [2/16/2010 10:13 AM 406016]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [7/28/2009 10:53 AM 7408]
S4 AGCoreService;AG Core Services;c:\program files\AGI\core\4.0\AGCoreService.exe [11/26/2009 6:59 AM 20480]
S4 CPSR;Application Sub Modoule Data Transfer;c:\program files\kiuys\egqq.exe –> c:\program files\kiuys\egqq.exe [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of ‘task manager’:

2010-04-15 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 00:35]

2010-02-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1645522239-507921405-1801674531-500Core.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-11-25 15:32]

2010-02-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1645522239-507921405-1801674531-500UA.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-11-25 15:32]

2010-02-17 c:\windows\Tasks\SogouImeMgr.job
- c:\progra~1\SogouInput\4.3.0.3315\PinyinRepair.exe [2009-11-05 09:58]

2010-02-23 c:\windows\Tasks\User_Feed_Synchronization-{A906E374-63C4-4F7E-8031-3E3B897E9B1D}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 14:31]
.
.
——- other scan ——-
.
uStart Page = hxxp://www.google.com
IE: &Clean Traces - c:\program files\DAP\Privacy Package\dapcleanerie.htm
IE: &Download with &DAP - c:\program files\DAP\dapextie.htm
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Download &all with DAP - c:\program files\DAP\dapextie2.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: Logoff - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComLogoff.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
Trusted Zone: download.com
DPF: {3AA9CF07-DF20-48FF-98BE-DED276E40146} - hxxps://mybank.icbc.com.cn/icbc/GDReadPub.cab
DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} - hxxps://mybank.icbc.com.cn/icbc/newperbank/AxSafeControls.cab
DPF: {B1FBC1AD-5644-4084-882A-0F8BA85E7506} - hxxps://mybank.icbc.com.cn/icbc/ICBC_NetSign.dll
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\l74oo4fh.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - prefs.js: browser.startup.homepage - hxxp://search.speedbit.com
FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p=
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - component: c:\program files\DAP\DAPFireFox\components\DAPFireFox.dll
FF - component: c:\program files\Siber Systems\AI RoboForm\Firefox\components\rfproxy_31.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\l74oo4fh.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\l74oo4fh.default\extensions\[removed]\plugins\nptnt.dll
FF - plugin: c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Opera\program\plugins\np_gp.dll
FF - plugin: c:\program files\Windows Media Player\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- Firefox —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

AddRemove-WebcamMax - c:\program files\WebcamMax\uninst.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-15 01:25
Windows 5.1.2600 Service Pack 3 NTFS

scan hidden processes 。。。

scan hidden start up groups 。。。

scan hidden documents 。。。

scan complete
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SCPDFV4ReadSpool]
"ImagePath"="c:\windows\Installer\MSI16.tmp"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1645522239-507921405-1801674531-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,6d,c9,fb,1c,6d,1a,15,48,b2,fa,65,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,04,23,9b,44,3d,9e,98,44,99,d5,4e,\

[HKEY_USERS\S-1-5-21-1645522239-507921405-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\睵8nOm葔hV2*]
"Order"=hex:08,00,00,00,02,00,00,00,0c,02,00,00,01,00,00,00,04,00,00,00,7e,00,
00,00,00,00,00,00,70,00,00,00,41,75,67,4d,02,00,00,00,01,00,00,00,5e,00,36,\
.
——————— processes ———————

- - - - - - - > 'winlogon.exe'(564)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
.
complete time: 2010-04-15 01:27:25
ComboFix-quarantined-files.txt 2010-04-15 11:27

Pre-Run: 55,870,599,168 bytes free
Post-Run: 55,841,316,864 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-CHS.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn /KERNEL=LOGOOS.EXE
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="(No Logo) Microsoft Windows"

- - End Of File - - 40AA7BD3420BBCF179FBDE0E86A00226

OTL logfile created on: 4/18/2010 8:57:51 AM - Run 1
OTL by OldTimer - Version 3.2.1.2 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 69.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 91.00% Paging File free
Paging file location(s): C:\pagefile.sys 4092 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 51.88 Gb Free Space | 69.61% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: RFMJHYTE-11D413
Current User Name: Shaman
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\AVG\AVG9\avgui.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgam.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe (Raxco Software, Inc.)
PRC - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe (Raxco Software, Inc.)
PRC - C:\Program Files\TeamViewer.Host\TeamViewer Host 5.0.7687\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\WINDOWS\Installer\MSI16.tmp (Solid Documents, LLC)
PRC - C:\Program Files\Kingsoft\PowerWord PE\ksdsvc.exe (Kingsoft Corporation)
PRC - C:\Program Files\Startup Faster\SFAgent.exe (URSoft,Inc)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\conime.exe (Microsoft Corporation)
PRC - C:\Program Files\fse\DiskPro.exe (夏冰软件)
PRC - C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe (YourWare Solutions ™)
PRC - C:\Program Files\reliz\akeys.exe (Softarium.com)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)


========== Win32 Services (SafeList) ==========

SRV - (CPSR) – File not found
SRV - (Lavasoft Ad-Aware Service) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (avg9wd) – C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (PDEngine) – C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe (Raxco Software, Inc.)
SRV - (PDAgent) – C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe (Raxco Software, Inc.)
SRV - (TeamViewer5) – C:\Program Files\TeamViewer.Host\TeamViewer Host 5.0.7687\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (SCPDFV4ReadSpool) – C:\WINDOWS\Installer\MSI16.tmp (Solid Documents, LLC)
SRV - (getPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (AGCoreService) – C:\Program Files\AGI\core\4.0\AGCoreService.exe (AG Interactive)
SRV - (KSDSVC) – C:\Program Files\Kingsoft\PowerWord PE\ksdsvc.exe (Kingsoft Corporation)
SRV - (ICBC Daemon Service) – C:\Program Files\ICBCEbankTools\ICBCAntiPhishing\IcbcDaemon.exe ()
SRV - (DfSdkS) – C:\Program Files\Ashampoo\Ashampoo WinOptimizer 6\Dfsdks.exe (mst software GmbH, Germany)
SRV - (vsmon) – C:\WINDOWS\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
SRV - (DiskPro_Service) – C:\Program Files\fse\DiskPro.exe (夏冰软件)
SRV - (Bluetooth Hid Switch Service) – C:\Program Files\BlueTooth\HidSwitchService\HidSw.exe (Cambridge Silicon Radio)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\..\URLSearchHook: *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo! Search"
FF - prefs.js..browser.search.selectedEngine: "Yahoo! Search"
FF - prefs.js..browser.startup.homepage: "http://search.speedbit.com"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.60
FF - prefs.js..extensions.enabledItems: {22119944-ED35-4ab1-910B-E619EA06A115}:6.9.98
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.783
FF - prefs.js..extensions.enabledItems: avg@igeared:4.002.023.004
FF - prefs.js..extensions.enabledItems: {F17C1572-C9EC-4e5c-A542-D05CBB5C5A08}:9.4.0.5
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:[removed]
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20091028
FF - prefs.js..extensions.enabledItems: [removed]:2.9.5.5
FF - prefs.js..keyword.URL: "http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type;=yahoo_avg_hs2-tb-web_us&p;="

FF - HKLM\software\mozilla\Firefox\extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/03/04 08:19:43 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\avg@igeared: C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared [2010/03/27 12:42:47 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files\Siber Systems\AI RoboForm\Firefox [2009/12/12 11:08:49 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/07 07:14:55 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/03 09:18:44 | 000,000,000 | —D | M]

[2009/11/24 01:10:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2010/04/17 23:47:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\l74oo4fh.default\extensions
[2009/11/28 01:15:03 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\l74oo4fh.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/04/16 23:32:32 | 000,000,000 | —D | M] (NoScript) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\l74oo4fh.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2009/12/02 22:42:56 | 000,000,000 | —D | M] (WOT) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\l74oo4fh.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010/01/24 18:53:33 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\l74oo4fh.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2010/03/20 22:19:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\l74oo4fh.default\extensions\[removed]
[2010/04/17 23:47:09 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2010/04/08 10:41:01 | 000,989,440 | —- | M]) - C:\WINDOWS\system32\drivers\etc\HOSTS
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 fr.a2dfp.net
O1 - Hosts: 127.0.0.1 m.fr.a2dfp.net
O1 - Hosts: 127.0.0.1 ad.a8.net
O1 - Hosts: 127.0.0.1 asy.a8ww.net
O1 - Hosts: 127.0.0.1 adv.abv.bg
O1 - Hosts: 127.0.0.1 bimg.abv.bg
O1 - Hosts: 127.0.0.1 www2.a-counter.kiev.ua
O1 - Hosts: 127.0.0.1 track.acclaimnetwork.com
O1 - Hosts: 127.0.0.1 accuserveadsystem.com
O1 - Hosts: 127.0.0.1 www.accuserveadsystem.com
O1 - Hosts: 127.0.0.1 achmedia.com
O1 - Hosts: 127.0.0.1 aconti.net
O1 - Hosts: 127.0.0.1 secure.aconti.net
O1 - Hosts: 127.0.0.1 www.aconti.net #[Dialer.Aconti]
O1 - Hosts: 127.0.0.1 ads.active.com
O1 - Hosts: 127.0.0.1 am1.activemeter.com
O1 - Hosts: 127.0.0.1 www.activemeter.com #[eTrust.Tracking.Cookie]
O1 - Hosts: 127.0.0.1 ads.activepower.net
O1 - Hosts: 127.0.0.1 data2.activshopper.com #[Trackware.ActivShopper]
O1 - Hosts: 127.0.0.1 stat.active24stats.nl #[eTrust.Tracking.Cookie]
O1 - Hosts: 127.0.0.1 ad2games.com
O1 - Hosts: 127.0.0.1 cms.ad2click.nl
O1 - Hosts: 127.0.0.1 ads.ad2games.com
O1 - Hosts: 127.0.0.1 content.ad20.net
O1 - Hosts: 29141 more lines…
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (谷歌金山词霸for IE) - {A28581A7-E2A8-4b6c-9CC9-4A4CC1EFD55A} - C:\Program Files\Kingsoft\PowerWord PE\SelectForIE.dll (Kingsoft Corporation)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (ICBC Anti-Phishing class) - {BB4491A2-D11A-4c6b-91C0-B53246A3122B} - C:\Program Files\ICBCEbankTools\ICBCAntiPhishing\Icbc_AntiPhishing.dll (中国工商银行)
O2 - BHO: (DAPIELoader Class) - {FF6C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\DAP\dapieloader.dll (SpeedBit Ltd.)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (&Google;) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (&RoboForm;) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (&Google;) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm;) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O4 - HKLM..\Run: [StartupFaster] C:\Program Files\Startup Faster\startuploader.exe (URSoft,Inc)
O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\StartupFaster [2009/12/02 22:30:07 | 000,000,000 | -H-D | M]
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\StartupFaster [2010/04/10 17:49:11 | 000,000,000 | -H-D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Clean; Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm ()
O8 - Extra context menu item: &Download; with &DAP; - C:\Program Files\DAP\dapextie.htm ()
O8 - Extra context menu item: Customize Menu - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: Download &all; with DAP - C:\Program Files\DAP\dapextie2.htm ()
O8 - Extra context menu item: Fill Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: Logoff - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComLogoff.html ()
O8 - Extra context menu item: RoboForm Toolbar - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Save Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O15 - HKCU\..Trusted Domains: download.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: internet ([]about in Internet)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {3AA9CF07-DF20-48FF-98BE-DED276E40146} https://mybank.icbc.com.cn/icbc/GDReadPub.cab (GDGetTokenInfo Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd…b?1259040504156 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1259177746234 (MUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} https://mybank.icbc.com.cn/icbc/newperbank/…afeControls.cab (AxSubmitControl Class)
O16 - DPF: {B1FBC1AD-5644-4084-882A-0F8BA85E7506} https://mybank.icbc.com.cn/icbc/ICBC_NetSign.dll (InfoSecICBCNetSign Class)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (C:\WINDOWS\system32\logonui_holersoft.exe) - C:\WINDOWS\system32\logonui_holersoft.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/11/22 20:20:07 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (PDBoot.exe) - C:\WINDOWS\System32\PDBoot.exe (Raxco Software, Inc.)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2009/11/22 09:59:19 | 000,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (54901231209938944)

========== Files/Folders - Created Within 14 Days ==========

[2010/04/18 08:51:40 | 000,562,176 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2010/04/17 23:34:13 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator\Recent
[2010/04/17 22:50:58 | 000,000,000 | —D | C] – C:\HostsXpert
[2010/04/15 20:09:42 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/04/15 01:19:53 | 000,000,000 | RHSD | C] – C:\cmdcons
[2010/04/15 01:17:17 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2010/04/15 01:17:17 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2010/04/15 01:17:17 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2010/04/15 01:17:17 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2010/04/15 01:15:20 | 000,000,000 | —D | C] – C:\Qoobox
[2010/04/13 14:55:33 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\TurnTool
[2010/04/12 22:46:16 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\3dBody.Net3.0
[2010/04/12 09:57:47 | 000,000,000 | —D | C] – C:\Program Files\Lavasoft
[2010/04/12 09:29:57 | 000,000,000 | —D | C] – C:\Program Files\VS Revo Group
[2010/04/10 17:47:31 | 000,000,000 | —D | C] – C:\Program Files\WinZip
[2010/04/06 23:11:09 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\AMRconvert
[2010/04/04 18:29:49 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\amrconverter(convertitore file audio.amr)
[2010/04/04 14:36:51 | 000,064,288 | —- | C] (Lavasoft AB) – C:\WINDOWS\System32\drivers\Lbd.sys
[2010/04/04 14:36:37 | 000,095,024 | —- | C] (Sunbelt Software) – C:\WINDOWS\System32\drivers\SBREDrv.sys
[2010/04/04 14:29:36 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
[2010/04/04 14:29:20 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Lavasoft
[2010/04/03 09:31:40 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\TightVNC
[2009/11/25 20:11:32 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Google
[2009/11/25 09:13:31 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2009/11/25 09:13:30 | 000,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2009/11/25 09:13:30 | 000,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[2009/11/25 09:13:30 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2004/11/24 08:25:52 | 000,335,872 | —- | C] ( ) – C:\WINDOWS\System32\drvc.dll
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 14 Days ==========

[2010/04/18 08:51:45 | 008,126,464 | —- | M] () – C:\Documents and Settings\Administrator\ntuser.dat
[2010/04/18 08:51:42 | 000,562,176 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2010/04/18 08:24:47 | 000,352,606 | —- | M] () – C:\WINDOWS\System32\vsconfig.xml
[2010/04/18 08:24:26 | 059,026,748 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/04/18 08:22:06 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/04/18 08:21:43 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/04/18 08:17:14 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/04/17 23:13:15 | 000,000,081 | —- | M] () – C:\Documents and Settings\Administrator\default.pls
[2010/04/17 23:02:04 | 000,000,069 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2010/04/17 15:13:48 | 000,113,152 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\7hrsKaspersky.jpg
[2010/04/16 22:16:38 | 000,014,336 | —- | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/15 12:22:56 | 000,012,834 | —- | M] () – C:\WINDOWS\ePrompter.ini
[2010/04/15 01:40:49 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\drivers\etc\lmhosts
[2010/04/15 01:25:32 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/04/15 01:19:59 | 000,000,375 | RHS- | M] () – C:\boot.ini
[2010/04/15 01:04:38 | 003,915,740 | R— | M] () – C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
[2010/04/12 23:20:33 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Administrator\ntuser.ini
[2010/04/10 14:44:05 | 000,000,654 | —- | M] () – C:\WINDOWS\win.ini
[2010/04/08 10:41:01 | 000,989,440 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100413-132300.backup
[2010/04/08 10:41:01 | 000,989,440 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100416-213248.backup
[2010/04/08 10:41:01 | 000,989,440 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100416-213113.backup
[2010/04/08 10:41:01 | 000,989,440 | —- | M] () – C:\WINDOWS\System32\drivers\etc\HOSTS
[2010/04/06 22:32:45 | 000,000,038 | —- | M] () – C:\WINDOWS\AviSplitter.INI
[2010/04/05 22:22:16 | 000,000,260 | —- | M] () – C:\WINDOWS\System32\FSEPath.dat
[2010/04/04 23:31:04 | 000,000,009 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\pwpe_wiki_ini.conf
[2010/04/04 14:36:35 | 000,095,024 | —- | M] (Sunbelt Software) – C:\WINDOWS\System32\drivers\SBREDrv.sys
[2010/04/04 14:36:26 | 000,015,880 | —- | M] () – C:\WINDOWS\System32\lsdelete.exe
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/04/17 22:40:40 | 000,000,210 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_17.log
[2010/04/17 15:13:48 | 000,113,152 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\7hrsKaspersky.jpg
[2010/04/16 18:22:06 | 000,000,210 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_16.log
[2010/04/15 01:19:59 | 000,000,304 | —- | C] () – C:\Boot.bak
[2010/04/15 01:19:56 | 000,260,272 | —- | C] () – C:\cmldr
[2010/04/15 01:17:17 | 000,261,632 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/04/15 01:17:17 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2010/04/15 01:17:17 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2010/04/15 01:17:17 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/04/15 01:17:17 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/04/15 01:13:15 | 000,000,846 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_15.log
[2010/04/15 01:04:27 | 003,915,740 | R— | C] () – C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
[2010/04/12 03:46:36 | 000,000,846 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_12.log
[2010/04/11 13:25:52 | 000,000,634 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_11.log
[2010/04/10 00:38:47 | 000,000,118 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_10.log
[2010/04/08 13:02:19 | 000,001,058 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_08.log
[2010/04/07 18:32:26 | 000,000,634 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_07.log
[2010/04/06 21:36:30 | 000,000,422 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_06.log
[2010/04/05 21:29:18 | 000,000,210 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_05.log
[2010/04/04 16:41:15 | 000,015,880 | —- | C] () – C:\WINDOWS\System32\lsdelete.exe
[2010/04/04 14:37:16 | 000,000,472 | —- | C] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/04/04 13:54:04 | 000,000,422 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_04.log
[2010/04/03 15:20:30 | 000,000,000 | —- | C] () – C:\WINDOWS\LiveUpdate.INI
[2010/04/03 13:34:28 | 000,000,210 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_03.log
[2010/04/02 16:05:36 | 000,000,210 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_02.log
[2010/04/01 19:29:20 | 000,000,846 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_04_01.log
[2010/03/31 07:39:12 | 000,000,210 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_31.log
[2010/03/30 08:53:33 | 000,002,542 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_30.log
[2010/03/29 00:20:56 | 000,000,422 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_29.log
[2010/03/26 09:20:27 | 000,000,210 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_26.log
[2010/03/25 19:30:03 | 000,000,634 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_25.log
[2010/03/23 11:10:25 | 000,000,118 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_23.log
[2010/03/22 21:04:38 | 000,000,422 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_22.log
[2010/03/21 22:01:27 | 000,000,210 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_21.log
[2010/03/20 09:45:36 | 000,000,210 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_20.log
[2010/03/19 20:00:53 | 000,000,846 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_19.log
[2010/03/18 21:13:10 | 000,000,634 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_18.log
[2010/03/15 11:13:42 | 000,000,118 | —- | C] () – C:\WINDOWS\ConverterCore.INI
[2010/03/13 19:06:54 | 000,000,108 | —- | C] () – C:\WINDOWS\options.ini
[2010/03/13 09:11:41 | 000,000,210 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_13.log
[2010/03/10 18:21:34 | 008,126,464 | —- | C] () – C:\Documents and Settings\Administrator\ntuser.dat
[2010/03/03 07:08:19 | 000,000,210 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_03.log
[2010/03/02 20:29:20 | 000,000,210 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_03_02.log
[2010/02/27 04:30:52 | 000,000,210 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_02_27.log
[2010/02/11 21:20:09 | 000,000,422 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_02_11.log
[2010/02/08 12:12:11 | 000,000,206 | —- | C] () – C:\WINDOWS\ScreenHunter.INI
[2010/01/31 05:55:56 | 000,000,210 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_01_31.log
[2010/01/19 10:59:31 | 000,000,210 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_01_19.log
[2009/12/24 21:41:18 | 000,000,000 | -H– | C] () – C:\Documents and Settings\Administrator\S-1-5-21-1645522239-507921405-1801674531-500.rrr.LOG
[2009/12/23 12:58:58 | 000,000,038 | —- | C] () – C:\WINDOWS\AviSplitter.INI
[2009/12/21 13:14:13 | 000,000,634 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2009_12_21.log
[2009/12/19 16:26:56 | 000,129,024 | —- | C] () – C:\WINDOWS\System32\AVERM.dll
[2009/12/19 16:23:15 | 000,021,240 | —- | C] () – C:\WINDOWS\System32\solidlocalmon.dll
[2009/12/19 16:23:15 | 000,013,560 | —- | C] () – C:\WINDOWS\System32\solidlocalui.dll
[2009/12/17 18:20:09 | 000,024,576 | -H– | C] () – C:\Documents and Settings\Administrator\NTUSER.tmp.LOG
[2009/12/17 06:39:56 | 000,014,336 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/08 08:07:49 | 000,012,834 | —- | C] () – C:\WINDOWS\ePrompter.ini
[2009/12/06 09:19:09 | 000,000,009 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\pwpe_wiki_ini.conf
[2009/12/05 20:08:26 | 000,271,872 | —- | C] () – C:\WINDOWS\System32\CodeCvt.dll
[2009/12/05 20:08:26 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\docman.dll
[2009/12/05 20:08:26 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\gifshowctrl.dll
[2009/12/05 20:08:26 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\fileprogressshow.dll
[2009/12/03 14:01:48 | 000,000,120 | -HS- | C] () – C:\WINDOWS\System32\sferunnum.dll
[2009/12/03 13:46:07 | 000,018,432 | —- | C] () – C:\WINDOWS\System32\drivers\wxbfileb.sys
[2009/12/01 22:17:41 | 000,000,282 | —- | C] () – C:\WINDOWS\System32\resdll.ini
[2009/12/01 12:51:43 | 000,000,034 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2009/11/27 10:49:02 | 000,000,081 | —- | C] () – C:\Documents and Settings\Administrator\default.pls
[2009/11/26 13:44:09 | 000,001,128 | —- | C] () – C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2009/11/25 20:33:12 | 000,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2009/11/25 10:10:59 | 000,000,024 | —- | C] () – C:\WINDOWS\LogonStudio.ini
[2009/11/25 10:10:14 | 000,187,392 | —- | C] () – C:\WINDOWS\System32\JPGUtils.dll
[2009/11/23 23:28:19 | 000,001,024 | —- | C] () – C:\Documents and Settings\Administrator\.rnd
[2009/11/23 11:16:16 | 000,000,178 | -HS- | C] () – C:\Documents and Settings\Administrator\ntuser.ini
[2009/11/23 11:16:15 | 000,001,024 | -H– | C] () – C:\Documents and Settings\Administrator\ntuser.dat.LOG
[2009/11/23 11:16:14 | 007,340,032 | —- | C] () – C:\Documents and Settings\Administrator\ntuser.dat.rmbak
[2009/11/23 10:59:09 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\stac97co.dll
[2009/11/23 10:56:43 | 000,757,760 | —- | C] () – C:\WINDOWS\System32\bcm1xsup.dll
[2009/11/23 10:56:42 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\preflib.dll
[2009/11/22 23:43:51 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.dll
[2008/04/14 02:00:00 | 000,056,880 | —- | C] () – C:\WINDOWS\System32\scvideo.dll
[2007/09/12 22:02:38 | 000,061,440 | —- | C] () – C:\WINDOWS\System32\GDReadPub.dll
[2005/12/06 13:54:40 | 000,000,631 | —- | C] () – C:\WINDOWS\smrpro.INI
[2004/10/11 19:40:58 | 002,255,360 | —- | C] () – C:\WINDOWS\System32\libavcodec.dll
[2004/10/11 19:39:48 | 000,028,160 | —- | C] () – C:\WINDOWS\System32\ff_wmv9.dll
[2004/10/11 19:39:08 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\ff_theora.dll
[2004/10/08 19:40:16 | 000,454,144 | —- | C] () – C:\WINDOWS\System32\ff_x264.dll
[2004/10/04 21:16:08 | 000,395,776 | —- | C] () – C:\WINDOWS\System32\libmplayer.dll
[2004/10/03 06:50:54 | 000,129,024 | —- | C] () – C:\WINDOWS\System32\ff_mpeg2enc.dll
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2009/12/04 00:17:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\AGI
[2009/12/17 07:06:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\AVG9
[2009/12/03 16:06:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Babylon
[2009/11/25 20:45:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Camfrog
[2010/03/06 21:04:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Fetion
[2009/12/04 13:44:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\KeePass
[2009/12/04 00:15:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\kingsoft
[2010/03/12 22:37:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\MxBoost
[2009/11/28 23:56:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Opera
[2010/01/16 10:12:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Registry Mechanic
[2009/11/25 06:40:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Softarium.com
[2010/04/17 17:35:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\SogouPY
[2009/12/26 22:45:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\SogouPY.users
[2010/03/15 11:13:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\SolidDocuments
[2010/04/13 08:19:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\TeamViewer
[2009/11/30 23:05:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Tencent
[2010/04/03 10:08:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\TightVNC
[2009/12/15 10:08:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Trillian
[2009/11/25 09:03:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\URSoft
[2009/12/19 16:13:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\WebcamMax
[2009/11/26 07:01:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Webshots
[2009/11/26 05:30:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\WinPatrol
[2009/11/26 06:59:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\agi
[2009/11/25 09:35:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2009/11/25 07:46:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Avg7
[2010/03/31 20:42:21 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2009/12/03 16:06:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Babylon
[2010/04/01 22:27:25 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Fetion
[2009/12/12 11:55:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\RoboForm
[2009/12/19 16:22:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SolidDocuments
[2009/11/25 06:31:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SpeedBit
[2010/04/18 08:55:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/11/26 08:59:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Tencent
[2010/03/24 18:44:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Thunder Network
[2009/12/19 16:20:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WebcamMax
[2010/04/12 13:08:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2010/04/04 14:29:37 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
[2010/04/18 08:21:43 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2010/02/16 16:00:00 | 000,000,332 | —- | M] () – C:\WINDOWS\Tasks\SogouImeMgr.job
[2010/02/23 10:29:34 | 000,000,424 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{A906E374-63C4-4F7E-8031-3E3B897E9B1D}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2008/04/14 02:00:00 | 020,056,462 | —- | M] () .cab file – C:\!SAFETY\I386\sp3.cab:AGP440.sys
[2008/04/14 02:00:00 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys

< MD5 for: ATAPI.SYS >
[2008/04/14 02:00:00 | 020,056,462 | —- | M] () .cab file – C:\!SAFETY\I386\sp3.cab:atapi.sys
[2008/04/14 02:00:00 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/04/14 00:10:32 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ERDNT\cache\atapi.sys
[2008/04/14 00:10:32 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\dllcache\atapi.sys
[2008/04/14 00:10:32 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys
[2008/04/14 02:00:00 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 02:00:00 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008/04/14 02:00:00 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\dllcache\eventlog.dll
[2008/04/14 02:00:00 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/14 02:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008/04/14 02:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\dllcache\netlogon.dll
[2008/04/14 02:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2008/04/14 02:00:00 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ERDNT\cache\scecli.dll
[2008/04/14 02:00:00 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\dllcache\scecli.dll
[2008/04/14 02:00:00 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2009/12/03 14:01:48 | 000,000,120 | -HS- | M] () Unable to obtain MD5 – C:\WINDOWS\system32\sferunnum.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2007/05/14 21:15:02 | 000,018,432 | —- | M] () Unable to obtain MD5 – C:\WINDOWS\system32\drivers\wxbfileb.sys

< %systemroot%\System32\config\*.sav >
[2009/11/22 10:04:55 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2009/11/22 10:04:54 | 001,089,536 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2009/11/22 10:04:54 | 000,905,216 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\drivers\*.sys /90 >
[2010/03/04 08:05:55 | 000,216,200 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\system32\drivers\avgldx86.sys
[2010/03/04 08:06:06 | 000,029,512 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\system32\drivers\avgmfx86.sys
[2010/03/04 08:05:52 | 000,052,872 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\system32\drivers\avgrkx86.sys
[2010/03/04 08:06:08 | 000,242,696 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\system32\drivers\avgtdix.sys
[2010/02/04 05:53:02 | 000,064,288 | —- | M] (Lavasoft AB) – C:\WINDOWS\system32\drivers\Lbd.sys
[2010/03/29 15:24:46 | 000,020,824 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\system32\drivers\mbam.sys
[2010/03/29 15:24:58 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\system32\drivers\mbamswissarmy.sys
[2010/02/24 03:11:07 | 000,455,680 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\drivers\mrxsmb.sys
[2010/04/04 14:36:35 | 000,095,024 | —- | M] (Sunbelt Software) – C:\WINDOWS\system32\drivers\SBREDrv.sys
[2010/02/11 02:02:15 | 000,226,880 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\drivers\tcpip6.sys

========== Alternate Data Streams ==========

@Alternate Data Stream - 147 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:28BB1CE8
@Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
@Alternate Data Stream - 139 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:20B9D0C7
@Alternate Data Stream - 138 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5F7539FF
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:010ADD2C
@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D74B6CF5
< End of report >

OTL Extras logfile created on: 4/18/2010 8:57:51 AM - Run 1
OTL by OldTimer - Version 3.2.1.2 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 69.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 91.00% Paging File free
Paging file location(s): C:\pagefile.sys 4092 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 51.88 Gb Free Space | 69.61% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: RFMJHYTE-11D413
Current User Name: Shaman
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Minimal
Quick Scan

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [fse] – "C:\Program Files\fse\fse.exe" lock "%1" (夏冰软件)
Directory [fseU] – "C:\Program Files\fse\fse.exe" unlock "%1" (夏冰软件)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)
"C:\Program Files\CyberBuddy\CyberBud.exe" = C:\Program Files\CyberBuddy\CyberBud.exe:*:Enabled:CyberBuddy – (DeFino Software)
"C:\Program Files\AVG\AVG9\avgam.exe" = C:\Program Files\AVG\AVG9\avgam.exe:*:Enabled:avgam.exe – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgdiagex.exe" = C:\Program Files\AVG\AVG9\avgdiagex.exe:*:Enabled:avgdiagex.exe – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgnsx.exe" = C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgupd.exe" = C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\Camfrog\Camfrog Video Chat\Camfrog Video Chat.exe" = C:\Program Files\Camfrog\Camfrog Video Chat\Camfrog Video Chat.exe:*:Enabled:Camfrog Client Module – (Camshare LC)
"C:\Program Files\eMule\emule.exe" = C:\Program Files\eMule\emule.exe:*:Enabled:eMule – (http://www.verycd.com)
"C:\Program Files\腾讯游戏\QQGAME\QQGameDl.exe" = C:\Program Files\腾讯游戏\QQGAME\QQGameDl.exe:*:Enabled:QQGameDl – ()
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe – (Hewlett-Packard Co.)
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser – (Opera Software)
"C:\Program Files\Maxthon2\Modules\MxDownloader\MxDownloadServer.exe" = C:\Program Files\Maxthon2\Modules\MxDownloader\MxDownloadServer.exe:*:Enabled:MxDownloadServer – (Maxthon International ltd.)
"C:\Program Files\SogouInput\4.3.0.3315\PinyinUp.exe" = C:\Program Files\SogouInput\4.3.0.3315\PinyinUp.exe:*:Enabled:Sogou Pinyin Service – (Sogou.com Inc.)
"C:\Program Files\DAP\DAP.exe" = C:\Program Files\DAP\DAP.exe:*:Enabled:Download Accelerator Plus (DAP) – (SpeedBit Ltd.)
"C:\Program Files\TeamViewer.Host\TeamViewer Host 5.0.7687\TeamViewer.exe" = C:\Program Files\TeamViewer.Host\TeamViewer Host 5.0.7687\TeamViewer.exe:*:Enabled:TeamViewer – (TeamViewer GmbH)
"C:\Program Files\TeamViewer\Version5\TeamViewer.exe" = C:\Program Files\TeamViewer\Version5\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application – (TeamViewer GmbH)
"C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe" = C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe:*:Enabled:Remote Assistance - Windows Messenger and Voice – (Microsoft Corporation)
"C:\Program Files\China Mobile\Fetion\VMDotNet\v2.0.50727\FetionVM.exe" = C:\Program Files\China Mobile\Fetion\VMDotNet\v2.0.50727\FetionVM.exe:*:Enabled:FetionVM – (China Mobile)
"C:\Program Files\China Mobile\Fetion\FetionFx.exe" = C:\Program Files\China Mobile\Fetion\FetionFx.exe:*:Enabled:Fetion – (China Mobile)
"C:\Program Files\ÌÚѶÓÎÏ·\QQGAME\QQGameDl.exe" = C:\Program Files\ìú??ó??·\QQGAME\QQGameDl.exe:*:Enabled:QQGameDl – File not found


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00718491-55BF-46C6-83EF-4B3B95AC807A}" = SplitCam
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{07620C4F-0964-4086-A872-C9C12E418E52}" = DJ_SF_03_D4300_Software
"{0F7C2E47-089E-4d23-B9F7-39BE00100776}" = Toolbox
"{11B83AD3-7A46-4C2E-A568-9505981D4C6F}" = HP Update
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{18669FF9-C8FE-407a-9F70-E674896B1DB4}" = GPBaseService
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{21199F32-B676-4FE2-A443-EF7DB6B8FD4F}" = Opera 10.10
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{24EFA94F-F3D6-4386-8824-B54712C9DC88}" = D4300_Help
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java™ 6 Update 18
"{338F08AB-C262-42C7-B000-34DE1A475273}" = Ad-Aware Email Scanner for Outlook
"{34BFB099-07B2-4E95-A673-7362D60866A2}" = PSSWCORE
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{36FDBE6E-6684-462b-AE98-9A39A1B200CC}" = HPProductAssistant
"{387D9916-BD27-480f-8CF0-3228832BBAA2}" = HP Deskjet D4300 Printer Driver Software 10.0 Rel .3
"{38B122B2-3257-4E43-BD51-327599ECBA46}" = 中国工商银行防钓鱼软件
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{42C7C4D8-033E-44F9-BF34-43808A0686CC}" = D4300
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5109C064-813E-4e87-B0DE-C8AF7B5BC02B}" = SmartWebPrintingOC
"{52A69E11-7CEB-4a7d-9607-68BA4F39A89B}" = DeviceDiscovery
"{56BFAA6E-2BCC-4AED-9233-84731E66B205}" = Solid Converter PDF v4
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5ACE69F0-A3E8-44eb-88C1-0A841E700180}" = TrayApp
"{5FCCD531-1B38-4A94-924C-127F722F1033}" = Nero 8
"{65C101D4-0032-4970-A99B-476928F3E5D2}" = Bluetooth HID Switch Service
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{687FEF8A-8597-40b4-832C-297EA3F35817}" = BufferChm
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{7B738CD9-D107-48C7-8E65-2E6639A39C8D}" = PerfectDisk 10 Professional
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver for Mobile
"{8A85DEAD-7C1F-4368-881C-72AC74CB2E91}" = UnloadSupport
"{8B0A7592-2AE0-48EA-A327-6EB7DAB25E4A}" = DJ_SF_03_D4300_Software_Min
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A040AC77-C1AA-4CC9-8931-9F648AF178F6}" = VC 9.0 Runtime
"{A0B9F8DF-C949-45ed-9808-7DC5C0C19C81}" = Status
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A4526249-944F-4108-B686-A435B4A62BA5}" = TI_Inst
"{a454c267-70b9-3bfc-af15-628bcc82d578}" = Webshots Desktop
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = C-Major Audio
"{A5AB9D5E-52E2-440e-A3ED-9512E253C81A}" = SolutionCenter
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-A92000000001}" = Adobe Reader 9.2
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B8DBED1E-8BC3-4d08-B94A-F9D7D88E9BBF}" = HPSSupply
"{BAD0FA60-09CF-4411-AE6A-C2844C8812FA}" = HP Photosmart Essential 2.5
"{BE6890C7-31EF-478C-812E-1E2899ABFCA9}" = Broadcom Gigabit Integrated Controller
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCB9B81A-167F-4832-B305-D2A0430840B3}" = WebReg
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240BC}" = WinZip 14.0
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Professional
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D2E0F0CC-6BE0-490b-B08B-9267083E34C9}" = MarketResearch
"{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E08DC77E-D09A-4e36-8067-D6DBBCC5F8DC}" = VideoToolkit01
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E60A3FF1-856E-4DD2-BFC6-FD9B976FE1C5}" = DJ_SF_03_D4300_ProductContext
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{EFB21DE7-8C19-4A88-BB28-A766E16493BC}" = Adobe Photoshop CS
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"Ad-Aware" = Ad-Aware
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AI RoboForm" = AI RoboForm (All Users)
"Allok RM RMVB to AVI MPEG DVD Converter_is1" = Allok RM RMVB to AVI MPEG DVD Converter 2.2.0920
"Ashampoo WinOptimizer 6_is1" = Ashampoo WinOptimizer 6.60
"AvantBrowser" = Avant Browser (remove only)
"AVG9Uninstall" = AVG 9.0
"BCDP7_is1" = Business Card Designer Plus 7.3.0.0
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card
"Camfrog 5.4" = Camfrog Video Chat 5.4
"Camtasia Studio 2" = Camtasia Studio 2
"CCleaner" = CCleaner
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"CyberBuddy" = CyberBuddy
"Download Accelerator Plus (DAP)" = Download Accelerator Plus (DAP)
"DreamAqua" = Dream Aquarium
"DSBACK1_is1" = Additional Background Pack 1
"DSCLIP1_is1" = Additional Clipart Pack 1
"DSCLIPBW_is1" = Additional Clipart Pack BW
"eMule" = eMule
"ePrompter" = ePrompter
"ERUNT_is1" = ERUNT 1.1j
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"Fetion" = Fetion 2010
"HijackThis" = HijackThis 2.0.2
"Holding Pattern" = Holding Pattern Screen Saver
"HP Imaging Device Functions" = HP Imaging Device Functions 10.0
"HP Photosmart Essential" = HP Photosmart Essential 2.5
"HP Smart Web Printing" = HP Smart Web Printing
"HP Solution Center & Imaging Support Tools" = HP Solution Center 10.0
"HPExtendedCapabilities" = HP Customer Participation Program 10.0
"iDailyDiary_is1" = iDailyDiary 3.61
"ie8" = Windows Internet Explorer 8
"InstallShield_{A4526249-944F-4108-B686-A435B4A62BA5}" = Texas Instruments PCIxx21/x515 drivers.
"InstallShield_{BE6890C7-31EF-478C-812E-1E2899ABFCA9}" = Broadcom Gigabit Integrated Controller
"IrfanView" = IrfanView (remove only)
"KeePassPasswordSafe2_is1" = KeePass Password Safe 2.09
"LogonStudio" = LogonStudio
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Maxthon2" = 傲游浏览器2
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6)" = Mozilla Firefox (3.6)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"PowerWord PE" = 谷歌金山词霸合作版2.0
"QQ游戏" = QQ游戏
"QQ锄大地游戏" = QQ锄大地游戏
"Registry Mechanic_is1" = Registry Mechanic 8.0
"Revo Uninstaller" = Revo Uninstaller 1.85
"SereneScreen Aquarium_is1" = SereneScreen Aquarium
"ShenProfessional 3.0" = ShenProfessional 3.0
"Shop for HP Supplies" = Shop for HP Supplies
"Sogou Input" = 搜狗拼音输入法 4.3正式版
"SpywareBlaster_is1" = SpywareBlaster 4.2
"Startup Faster! 2004_is1" = Startup Faster! 2004
"Startup Faster!_is1" = Startup Faster!
"SwitchOff" = Switch Off
"TeamViewer 5" = TeamViewer 5
"TreeSize Professional 5.0_is1" = TreeSize Professional 5.0
"tv_enua" = Lernout & Hauspie TruVoice American English TTS Engine
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"Wisdom-soft ScreenHunter 5.1 Free" = Wisdom-soft ScreenHunter 5.1 Free
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XP Codec Pack" = XP Codec Pack
"XP变脸王_is1" = XP变脸王 v9.4
"ZoneAlarm Pro" = ZoneAlarm Pro
"可牛影像" = 可牛影像 2.3 正式版
"文件夹加密超级大师_is1" = 文件夹加密超级大师 12.60
"美图秀秀" = 美图秀秀 2.1.1

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 4/12/2010 2:37:51 PM | Computer Name = RFMJHYTE-11D413 | Source = wltrysvc | ID = 2
Description = The service process could not connect to the service controller.

Error - 4/12/2010 3:08:10 PM | Computer Name = RFMJHYTE-11D413 | Source = Lavasoft Ad-Aware Service | ID = 0
Description =

Error - 4/12/2010 3:08:50 PM | Computer Name = RFMJHYTE-11D413 | Source = Lavasoft Ad-Aware Service | ID = 0
Description =

Error - 4/12/2010 3:58:31 PM | Computer Name = RFMJHYTE-11D413 | Source = Lavasoft Ad-Aware Service | ID = 0
Description =

Error - 4/12/2010 4:03:53 PM | Computer Name = RFMJHYTE-11D413 | Source = wltrysvc | ID = 2
Description = The service process could not connect to the service controller.

Error - 4/13/2010 1:45:26 PM | Computer Name = RFMJHYTE-11D413 | Source = wltrysvc | ID = 2
Description = The service process could not connect to the service controller.

Error - 4/13/2010 3:08:47 PM | Computer Name = RFMJHYTE-11D413 | Source = wltrysvc | ID = 2
Description = The service process could not connect to the service controller.

Error - 4/13/2010 7:26:23 PM | Computer Name = RFMJHYTE-11D413 | Source = wltrysvc | ID = 2
Description = The service process could not connect to the service controller.

Error - 4/14/2010 2:55:37 AM | Computer Name = RFMJHYTE-11D413 | Source = wltrysvc | ID = 2
Description = The service process could not connect to the service controller.

Error - 4/15/2010 7:37:46 AM | Computer Name = RFMJHYTE-11D413 | Source = wltrysvc | ID = 2
Description = The service process could not connect to the service controller.

[ System Events ]
Error - 4/18/2010 1:41:18 AM | Computer Name = RFMJHYTE-11D413 | Source = Service Control Manager | ID = 7034
Description = The ICBC Daemon Service service terminated unexpectedly. It has done
this 1 time(s).

Error - 4/18/2010 4:39:32 AM | Computer Name = RFMJHYTE-11D413 | Source = Service Control Manager | ID = 7022
Description = The CryptSvc service hung on starting.

Error - 4/18/2010 4:39:32 AM | Computer Name = RFMJHYTE-11D413 | Source = Service Control Manager | ID = 7022
Description = The Wireless Zero Configuration service hung on starting.

Error - 4/18/2010 4:39:32 AM | Computer Name = RFMJHYTE-11D413 | Source = Service Control Manager | ID = 7001
Description = The TrueVector Internet Monitor service depends on the CryptSvc service
which failed to start because of the following error: %%1070

Error - 4/18/2010 4:39:32 AM | Computer Name = RFMJHYTE-11D413 | Source = Service Control Manager | ID = 7000
Description = The lf service failed to start due to the following error: %%3

Error - 4/18/2010 4:50:56 AM | Computer Name = RFMJHYTE-11D413 | Source = Service Control Manager | ID = 7034
Description = The ICBC Daemon Service service terminated unexpectedly. It has done
this 1 time(s).

Error - 4/18/2010 2:19:47 PM | Computer Name = RFMJHYTE-11D413 | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the TrueVector Internet Monitor
service to connect.

Error - 4/18/2010 2:19:47 PM | Computer Name = RFMJHYTE-11D413 | Source = Service Control Manager | ID = 7000
Description = The TrueVector Internet Monitor service failed to start due to the
following error: %%1053

Error - 4/18/2010 2:19:47 PM | Computer Name = RFMJHYTE-11D413 | Source = Service Control Manager | ID = 7000
Description = The lf service failed to start due to the following error: %%3

Error - 4/18/2010 2:20:26 PM | Computer Name = RFMJHYTE-11D413 | Source = Service Control Manager | ID = 7034
Description = The ICBC Daemon Service service terminated unexpectedly. It has done
this 1 time(s).


< End of report >