Spyware / Malware / Virus Removal

[Resolved] URGENT NEED OF HELP ! ASAP !

18 min read

Looking for the outcome? Ask AI

AndrewHii Topic Starter

Post #1April 16, 2010, 3:02 AM UTC

Hello WTT I desperatly need your help on removing this virus .. Today I downloaded this program , I scanned it and everything seemed well intill I tried to install it thats where serious problems began .. My firewall said it was un regonized but I said to myself I scanned it so no wrorries I ran it but the program I meant to install wasnt installing it was something else . It was the XP Secuirty Virus now I cant do anything ! The only way I can get on the internet is by hitting the Favorites in my internet explorer file and when I click Mozilla FireFox or Internet Explorer or any program it tells me to "Select a recommended program from the list" even if I click Internet explorer it recommends internet explorer ??? And still doesnt open . I scanned immidiately nothing came up in the results I have no idea whats left to do please I desperatly need your HELP PLEASE !

CatByte

Post #2April 16, 2010, 3:15 AM UTC

Please download exeHelper to your desktop.

Double-click on exeHelper.com to run the fix.
A black window should pop up, press any key to close once the fix is completed.
Post the contents of log.txt (Will be created in the directory where you ran exeHelper.com)

Note If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

NEXT

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

Disable any script blocking protection
Double click dds.pif to run the tool.
When done, two DDS.txt's will open.
Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.

NEXT

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- Sections
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

AndrewHii

Post #3April 16, 2010, 3:45 AM UTC

Ok I got 2 of the 3 logs for the DDS scan I dont know how to disable my script Blocking can you help me please with that one ?

——————

exeHelper by Raktor
Build 20100414
Run at 23:16:15 on 04/15/10
Now searching…
Checking for numerical processes…
Checking for sysguard processes…
Checking for bad processes…
Checking for bad files…
Checking for bad registry entries…
Resetting filetype association for .exe
Removing HKCR\secfile
Resetting filetype association for .com
Removing HKCR\secfile
Resetting userinit and shell values…
Resetting policies…
–Finished–

Gmer.txt

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-04-15 23:37:14
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\andrew\LOCALS~1\Temp\kxdyqfoc.sys

—- System - GMER 1.0.15 —-

SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwAdjustPrivilegesToken [0xA8454212]
SSDT \??\C:\WINDOWS\system32\drivers\fslx.sys (FSL System Driver/Altiris, Inc.) ZwClose [0xA82997F8]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwConnectPort [0xA84537CA]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateFile [0xA8453E78]
SSDT \??\C:\WINDOWS\system32\drivers\fslx.sys (FSL System Driver/Altiris, Inc.) ZwCreateKey [0xA8299114]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreatePort [0xA84536A6]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateSection [0xA84567A6]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateSymbolicLinkObject [0xA8456A44]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateThread [0xA84531EA]
SSDT \??\C:\WINDOWS\system32\drivers\fslx.sys (FSL System Driver/Altiris, Inc.) ZwDeleteKey [0xA82998BA]
SSDT \??\C:\WINDOWS\system32\drivers\fslx.sys (FSL System Driver/Altiris, Inc.) ZwDeleteValueKey [0xA8299B0A]
SSDT \??\C:\WINDOWS\system32\drivers\fslx.sys (FSL System Driver/Altiris, Inc.) ZwDuplicateObject [0xA829A712]
SSDT \??\C:\WINDOWS\system32\drivers\fslx.sys (FSL System Driver/Altiris, Inc.) ZwEnumerateKey [0xA8299F2A]
SSDT \??\C:\WINDOWS\system32\drivers\fslx.sys (FSL System Driver/Altiris, Inc.) ZwEnumerateValueKey [0xA829A2E6]
SSDT \??\C:\WINDOWS\system32\drivers\fslx.sys (FSL System Driver/Altiris, Inc.) ZwFlushKey [0xA8299892]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwLoadDriver [0xA84563E2]
SSDT \??\C:\WINDOWS\system32\drivers\fslx.sys (FSL System Driver/Altiris, Inc.) ZwLoadKey [0xA829A5A4]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwMakeTemporaryObject [0xA8453A66]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwOpenFile [0xA8454054]
SSDT \??\C:\WINDOWS\system32\drivers\fslx.sys (FSL System Driver/Altiris, Inc.) ZwOpenKey [0xA8298D76]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwOpenProcess [0xA8452D00]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwOpenSection [0xA8453D02]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwOpenThread [0xA8452E98]
SSDT \??\C:\WINDOWS\system32\drivers\fslx.sys (FSL System Driver/Altiris, Inc.) ZwQueryKey [0xA829A038]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwQueryMultipleValueKey [0xA8455902]
SSDT \??\C:\WINDOWS\system32\drivers\fslx.sys (FSL System Driver/Altiris, Inc.) ZwQueryValueKey [0xA829A428]
SSDT \??\C:\WINDOWS\system32\drivers\fslx.sys (FSL System Driver/Altiris, Inc.) ZwRenameKey [0xA829A7A2]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwRequestWaitReplyPort [0xA8455E76]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSecureConnectPort [0xA845612A]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSetSecurityObject [0xA845482E]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSetSystemInformation [0xA84565AE]
SSDT \??\C:\WINDOWS\system32\drivers\fslx.sys (FSL System Driver/Altiris, Inc.) ZwSetValueKey [0xA8299D62]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwShutdownSystem [0xA8453A00]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSystemDebugControl [0xA8453BEE]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwTerminateProcess [0xA8453544]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwTerminateThread [0xA84533EA]
SSDT \??\C:\WINDOWS\system32\drivers\fslx.sys (FSL System Driver/Altiris, Inc.) ZwUnloadKey [0xA829A624]

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Ip cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\Tcpip \Device\Tcp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\Tcpip \Device\Udp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)
AttachedDevice \Driver\Tcpip \Device\RawIp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)

Device -> \Driver\iaStor \Device\Harddisk0\DR0 8A70FD6B

—- Files - GMER 1.0.15 —-

File C:\WINDOWS\system32\drivers\iaStor.sys suspicious modification

—- EOF - GMER 1.0.15 —-

CatByte

Post #4April 16, 2010, 3:47 AM UTC

It would be included with your antivirus if you have one, so just disable your antivirus

AndrewHii

Post #5April 16, 2010, 3:48 AM UTC

I canceled there proccess's .. Is the DDS supposed to say ACCESS DENIED ?

CatByte

Post #6April 16, 2010, 3:50 AM UTC

No, it isn't

try this scan instead:

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under the Custom Scan box paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\drivers\*.sys /90
CREATERESTOREPOINT
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them in your next reply.

AndrewHii

Post #7April 16, 2010, 4:11 AM UTC

OTL logfile created on: 4/15/2010 11:52:13 PM - Run 1
OTL by OldTimer - Version 3.2.1.1 Folder = C:\Documents and Settings\andrew\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 75.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 86.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.05 Gb Total Space | 67.29 Gb Free Space | 45.15% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
Drive I: | 1.52 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: HP12902580339
Current User Name: andrew
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\andrew\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe ()
PRC - C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Verizon\McciTrayApp.exe (Alcatel-Lucent)
PRC - C:\Program Files\AIM\aim.exe (AOL Inc.)
PRC - C:\Program Files\Application Updater\ApplicationUpdater.exe (Spigot, Inc.)
PRC - C:\Program Files\IObit\IObit Security 360\is360.exe (IObit)
PRC - C:\Program Files\IObit\IObit Security 360\is360tray.exe (IObit)
PRC - C:\Program Files\IObit\IObit Security 360\is360srv.exe (IObit)
PRC - C:\Program Files\PDF Complete\pdfsvc.exe (PDF Complete Inc)
PRC - c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\andrew\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Common Files\Motive\McciContextHook_DSR.dll (Alcatel-Lucent)
MOD - C:\WINDOWS\system32\guard32.dll (COMODO)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (Akamai) – C:/Program Files/Common Files/Akamai/rswin_3653.dll ()
SRV - (cmdAgent) – C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe ()
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Application Updater) – C:\Program Files\Application Updater\ApplicationUpdater.exe (Spigot, Inc.)
SRV - (IS360service) – C:\Program Files\IObit\IObit Security 360\is360srv.exe (IObit)
SRV - (pdfcDispatcher) – C:\Program Files\PDF Complete\pdfsvc.exe (PDF Complete Inc)
SRV - (SQLWriter) – c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
SRV - (MSSQL$MSSMLBIZ) SQL Server (MSSMLBIZ) – c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (SQLBrowser) – c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
SRV - (MSSQLServerADHelper) – c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…all&pf;=cmdt
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…all&pf;=cmdt
IE - HKLM\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL Inc.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.aol.com/?src=aim&ncid;=snsusaimc00000001
IE - HKCU\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL Inc.)
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll (America Online, Inc.)
IE - HKCU\..\URLSearchHook: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\YouTube Downloader Toolbar\SearchSettings.dll File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "http://aim.search.aol.com/aol/search?query={searchTerms}&invocationType;=tb50-ff-aim-chromesbox-en-us"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type;=937811"
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://my.msn.com"
FF - prefs.js..extensions.enabledItems: [removed]:1.2.3
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=greentree_ff1&ei;=utf-8&type;=937811&p;="

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/14 07:43:24 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/13 14:45:59 | 000,000,000 | —D | M]

[2010/04/09 11:50:45 | 000,000,000 | —D | M] – C:\Documents and Settings\andrew\Application Data\Mozilla\Extensions
[2010/04/15 09:28:09 | 000,000,000 | —D | M] – C:\Documents and Settings\andrew\Application Data\Mozilla\Firefox\Profiles\zkoqafgo.default\extensions
[2010/04/09 11:52:44 | 000,000,000 | —D | M] (AIM Toolbar) – C:\Documents and Settings\andrew\Application Data\Mozilla\Firefox\Profiles\zkoqafgo.default\extensions\{c2f863cd-0429-48c7-bb54-db756a951760}
[2010/04/07 16:16:11 | 000,002,267 | —- | M] () – C:\Documents and Settings\andrew\Application Data\Mozilla\Firefox\Profiles\zkoqafgo.default\searchplugins\aim-search.xml
[2010/04/15 15:31:39 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/04/07 16:12:05 | 000,238,776 | —- | M] (Pando Networks) – C:\Program Files\Mozilla Firefox\plugins\npPandoWebInst.dll

O1 HOSTS File: ([2006/02/28 03:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AOLSearchHook Class) - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll (America Online, Inc.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Verizon Broadband Toolbar) - {A057A204-BACC-4D26-8398-26FADCF27386} - C:\Program Files\verizon_broad\verizon_broad.dll (Verizon Online. )
O2 - BHO: (AIM Toolbar Loader) - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL Inc.)
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\YouTube Downloader Toolbar\SearchSettings.dll File not found
O2 - BHO: (YouTube Downloader Toolbar) - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YouTube Downloader Toolbar\IE\1.0\youtubedownloaderToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (AIM Toolbar) - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL Inc.)
O3 - HKLM\..\Toolbar: (Verizon Broadband Toolbar) - {A057A204-BACC-4D26-8398-26FADCF27386} - C:\Program Files\verizon_broad\verizon_broad.dll (Verizon Online. )
O3 - HKLM\..\Toolbar: (YouTube Downloader Toolbar) - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YouTube Downloader Toolbar\IE\1.0\youtubedownloaderToolbarIE.dll (Spigot, Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Verizon Broadband Toolbar) - {A057A204-BACC-4D26-8398-26FADCF27386} - C:\Program Files\verizon_broad\verizon_broad.dll (Verizon Online. )
O3 - HKCU\..\Toolbar\WebBrowser: (AIM Toolbar) - {61539ECD-CC67-4437-A03C-9AACCBD14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Verizon Broadband Toolbar) - {A057A204-BACC-4D26-8398-26FADCF27386} - C:\Program Files\verizon_broad\verizon_broad.dll (Verizon Online. )
O4 - HKLM..\Run: [CloneCDTray] C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe (SlySoft, Inc.)
O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4 - HKLM..\Run: [IObit Security 360] C:\Program Files\IObit\IObit Security 360\IS360tray.exe (IObit)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [PDF Complete] C:\Program Files\PDF Complete\pdfsty.exe (PDF Complete Inc)
O4 - HKLM..\Run: [SearchSettings] C:\Program Files\YouTube Downloader Toolbar\SearchSettings.exe (Spigot, Inc.)
O4 - HKLM..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe (Alcatel-Lucent)
O4 - HKCU..\Run: [Aim] C:\Program Files\AIM\aim.exe (AOL Inc.)
O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} https://activatemydsl.verizon.net/sdcCommon…20Installer.cab (Support.com Configuration Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 [removed]
O20 - AppInit_DLLs: (C:\WINDOWS\system32\guard32.dll) - C:\WINDOWS\system32\guard32.dll (COMODO)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/07/18 01:28:42 | 000,000,043 | R— | M] () - I:\autorun.inf – [ CDFS ]
O33 - MountPoints2\I\Shell - "" = AutoRun
O33 - MountPoints2\I\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\I\Shell\AutoRun\command - "" = I:\Setup.exe – [2007/07/18 01:28:42 | 000,073,728 | R— | M] (InstallShield Software Corporation)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – Reg Error: Key error. File not found

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2010/03/17 23:46:36 | 000,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (17746534284132352)

========== Files/Folders - Created Within 14 Days ==========

[2010/04/15 23:50:25 | 000,561,664 | —- | C] (OldTimer Tools) – C:\Documents and Settings\andrew\Desktop\OTL.exe
[2010/04/15 22:49:53 | 000,812,344 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\andrew\Desktop\HJTInstall.exe
[2010/04/15 22:47:21 | 000,053,248 | —- | C] (http://www.beyondlogic.org) – C:\WINDOWS\System32\Process.exe
[2010/04/15 22:44:38 | 000,000,000 | —D | C] – C:\SmitfraudFix
[2010/04/15 22:42:55 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/04/15 22:42:41 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/04/15 22:36:28 | 000,000,000 | —D | C] – C:\WINDOWS\CSC
[2010/04/15 22:19:23 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2010/04/15 22:15:32 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Macromedia
[2010/04/15 22:15:12 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/04/15 21:51:06 | 000,000,000 | —D | C] – C:\WINDOWS\Sun
[2010/04/15 21:44:32 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe
[2010/04/15 18:02:18 | 000,000,000 | —D | C] – C:\Program Files\WinAVI MP4 Converter
[2010/04/15 12:25:19 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Local Settings\Application Data\Identities
[2010/04/15 11:56:46 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Desktop\ms0
[2010/04/15 11:55:29 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Desktop\truflow_1_1
[2010/04/15 09:28:46 | 000,806,400 | —- | C] (GameKiller.net) – C:\Documents and Settings\andrew\Desktop\NzNett.exe
[2010/04/15 09:11:41 | 000,000,000 | —D | C] – C:\b396888e8efb1f82d5dbf972
[2010/04/15 08:56:32 | 000,983,040 | —- | C] (GameKiller.net) – C:\Documents and Settings\andrew\Desktop\NzMaple.exe
[2010/04/15 08:53:48 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Desktop\Winject
[2010/04/15 08:51:42 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Local Settings\Application Data\COMODO
[2010/04/13 14:46:27 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2010/04/13 14:39:07 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2010/04/13 14:31:47 | 000,000,000 | —D | C] – C:\WINDOWS\System32\appmgmt
[2010/04/13 14:09:41 | 000,086,016 | —- | C] (Cyberlink) – C:\WINDOWS\System32\QuickTime.ax
[2010/04/13 14:03:18 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Desktop\PSP Back Ups , DL's , etc
[2010/04/13 13:25:55 | 000,000,000 | —D | C] – C:\Program Files\WinAVI Video Converter
[2010/04/11 16:23:54 | 000,000,000 | R–D | C] – C:\Documents and Settings\andrew\My Documents\My Pictures
[2010/04/11 16:22:39 | 000,000,000 | R–D | C] – C:\Documents and Settings\andrew\My Documents\My Music
[2010/04/11 10:45:55 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2010/04/11 10:31:28 | 000,000,000 | —D | C] – C:\Program Files\DownloadToolz
[2010/04/11 10:13:03 | 000,000,000 | —D | C] – C:\Program Files\Common Files\AVSMedia
[2010/04/11 10:11:41 | 000,000,000 | —D | C] – C:\Program Files\AVS4YOU
[2010/04/11 10:11:41 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVS4YOU
[2010/04/10 16:56:20 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Application Data\YouTube Downloader
[2010/04/10 16:56:20 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Application Data\Search Settings
[2010/04/10 09:49:44 | 000,000,000 | —D | C] – C:\Program Files\Application Updater
[2010/04/10 09:49:43 | 000,000,000 | —D | C] – C:\Program Files\YouTube Downloader Toolbar
[2010/04/10 09:49:24 | 000,000,000 | —D | C] – C:\Program Files\YouTube Downloader
[2010/04/10 05:47:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Comodo Downloader
[2010/04/10 05:46:17 | 000,000,000 | -H-D | C] – C:\VritualRoot
[2010/04/10 05:46:05 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\COMODO
[2010/04/10 05:43:28 | 000,000,000 | —D | C] – C:\Program Files\COMODO
[2010/04/10 05:42:26 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\IObit
[2010/04/10 05:42:25 | 000,000,000 | —D | C] – C:\Program Files\IObit
[2010/04/10 05:40:27 | 008,116,768 | —- | C] (IObit ) – C:\Documents and Settings\All Users\Documents\is360setup141.exe
[2010/04/10 05:37:47 | 000,000,000 | —D | C] – C:\Fraps
[2010/04/09 21:04:25 | 000,029,184 | —- | C] (Thesycon GmbH, Germany) – C:\WINDOWS\System32\drivers\ActionReplayDS.sys
[2010/04/09 21:04:25 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Desktop\USA Code Manager PC software
[2010/04/09 21:04:12 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Application Data\WinRAR
[2010/04/09 20:32:05 | 000,019,805 | R— | C] (Thesycon GmbH, Germany) – C:\WINDOWS\System32\drivers\usbio.sys
[2010/04/09 19:04:16 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Application Data\Apple Computer
[2010/04/09 19:04:15 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Local Settings\Application Data\Apple Computer
[2010/04/09 17:23:33 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/04/09 17:23:09 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2010/04/09 17:23:09 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Apple Computer
[2010/04/09 17:23:03 | 000,000,000 | —D | C] – C:\Program Files\Apple Software Update
[2010/04/09 17:22:08 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2010/04/09 17:22:03 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Apple
[2010/04/09 17:22:03 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Apple
[2010/04/09 11:55:17 | 000,000,000 | —D | C] – C:\Program Files\MSXML 4.0
[2010/04/09 11:52:47 | 000,000,000 | —D | C] – C:\Program Files\Microsoft
[2010/04/09 11:52:46 | 000,000,000 | —D | C] – C:\Program Files\Windows Live SkyDrive
[2010/04/09 11:52:44 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Software Update Utility
[2010/04/09 11:52:44 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\PMB Files
[2010/04/09 11:52:43 | 000,000,000 | —D | C] – C:\Program Files\AIM Search
[2010/04/09 11:52:41 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Application Data\Adobe
[2010/04/09 11:51:10 | 000,000,000 | —D | C] – C:\Program Files\Ashampoo
[2010/04/09 11:51:05 | 000,000,000 | —D | C] – C:\WINDOWS\bin
[2010/04/09 11:51:00 | 000,000,000 | —D | C] – C:\Program Files\verizon_broad
[2010/04/09 11:51:00 | 000,000,000 | —D | C] – C:\Program Files\Verizon Broadband Firefox Toolbar
[2010/04/09 11:50:59 | 000,000,000 | —D | C] – C:\Program Files\Common Files\SupportSoft
[2010/04/09 11:50:44 | 000,000,000 | RH-D | C] – C:\Documents and Settings\andrew\SendTo
[2010/04/09 11:50:44 | 000,000,000 | RH-D | C] – C:\Documents and Settings\andrew\Recent
[2010/04/09 11:50:44 | 000,000,000 | -H-D | C] – C:\Documents and Settings\andrew\PrintHood
[2010/04/09 11:50:44 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Application Data\Sun
[2010/04/09 11:50:44 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Local Settings\Application Data\Seven Zip
[2010/04/09 11:50:44 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Local Settings\Application Data\Microsoft Help
[2010/04/09 11:50:44 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Application Data\Identities
[2010/04/09 11:50:44 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Local Settings\Application Data\ApplicationHistory
[2010/04/09 08:47:41 | 000,000,000 | —D | C] – C:\Program Files\ContentWatch(2)
[2010/04/08 21:49:15 | 000,000,000 | —D | C] – C:\Program Files\Datel
[2010/04/08 21:14:05 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Akamai
[2010/04/08 15:19:55 | 000,000,000 | —D | C] – C:\90a3801c55a66cde4b
[2010/04/08 15:17:06 | 000,000,000 | —D | C] – C:\036b67b57f6b4eda61634a54
[2010/04/08 04:44:04 | 000,000,000 | —D | C] – C:\90992dab30b4c6aa50
[2010/04/08 04:39:04 | 000,000,000 | —D | C] – C:\023929d22b5d977facb99b
[2010/04/08 04:36:15 | 000,000,000 | —D | C] – C:\66d070a74d175702e2f9c909b75641
[2010/04/08 04:33:40 | 000,000,000 | —D | C] – C:\1eca5aa21e3f21db9c1e9ce3d2454c
[2010/04/08 04:31:04 | 000,000,000 | —D | C] – C:\69c0ef23a8b0fd618c96
[2010/04/08 04:27:32 | 000,000,000 | —D | C] – C:\b91c9bb5d6740375cb40
[2010/04/08 04:24:52 | 000,000,000 | —D | C] – C:\016e542d71cc43e8c392
[2010/04/08 04:21:42 | 000,000,000 | —D | C] – C:\cf4ab8911476893ea136986618e3191e
[2010/04/08 04:19:04 | 000,000,000 | —D | C] – C:\e4883f89a4294536a81823bd04
[2010/04/08 04:16:30 | 000,000,000 | —D | C] – C:\d6d7136eeb202a5d8bd3e52268ed9f
[2010/04/08 04:13:58 | 000,000,000 | —D | C] – C:\df13a6ec3d8b0a55b63a710f027870b5
[2010/04/08 04:11:26 | 000,000,000 | —D | C] – C:\189e0920529fce5027
[2010/04/08 04:08:50 | 000,000,000 | —D | C] – C:\31dad707141606f800a5
[2010/04/08 04:06:17 | 000,000,000 | —D | C] – C:\8a2e454bdc4dddcc1447e6
[2010/04/08 04:03:42 | 000,000,000 | —D | C] – C:\111c9c889179d6726dc1
[2010/04/08 04:01:08 | 000,000,000 | —D | C] – C:\9716aa70a285fa1bfd6c34eb27794a9d
[2010/04/08 03:58:35 | 000,000,000 | —D | C] – C:\bc134a2a3b32596f824c8a873a
[2010/04/08 03:56:02 | 000,000,000 | —D | C] – C:\3aa907f551931343c2b664
[2010/04/08 03:53:30 | 000,000,000 | —D | C] – C:\9757662d5d71e266fb9179070cf5f30e
[2010/04/08 03:50:55 | 000,000,000 | —D | C] – C:\88d329bd30fdeb8da0
[2010/04/08 03:48:22 | 000,000,000 | —D | C] – C:\6e920d2ffbd97dc5f075b8c436dfd9
[2010/04/08 03:45:49 | 000,000,000 | —D | C] – C:\f1d6e81042b7f9c98990
[2010/04/08 03:43:17 | 000,000,000 | —D | C] – C:\093c30021b133087bd5e
[2010/04/08 03:40:43 | 000,000,000 | —D | C] – C:\f2ae3c43587ec4fe7d8bb6
[2010/04/08 03:38:10 | 000,000,000 | —D | C] – C:\0f88983144f378f0c9196da97a930eec
[2010/04/08 03:35:38 | 000,000,000 | —D | C] – C:\2abc3de27138c7d2fe0c00
[2010/04/08 03:33:05 | 000,000,000 | —D | C] – C:\8692aed876ecef8fc30644ec7c6468
[2010/04/08 03:30:31 | 000,000,000 | —D | C] – C:\34b7cf41a3adde17b403ab21c5
[2010/04/08 03:28:00 | 000,000,000 | —D | C] – C:\bcdb55a0d0c3e1efe5e19980dc
[2010/04/08 03:25:27 | 000,000,000 | —D | C] – C:\f6d0ed989ac38391c38167e8274128
[2010/04/08 03:22:54 | 000,000,000 | —D | C] – C:\74bfcffcf5bd4c7f1190295b25
[2010/04/08 03:20:21 | 000,000,000 | —D | C] – C:\0ea9bfe1c343762cb5c8c2f25ccc6e
[2010/04/08 03:17:47 | 000,000,000 | —D | C] – C:\7e4253a64ff94eb56e8ed19ce27d34
[2010/04/08 03:15:15 | 000,000,000 | —D | C] – C:\7ef08a039f0f0312ff95912a9ed532
[2010/04/08 03:12:43 | 000,000,000 | —D | C] – C:\ad6a48fffad25f8eccbd2a7431b8
[2010/04/08 03:10:09 | 000,000,000 | —D | C] – C:\f25a79cf993c3ee3a2e38a
[2010/04/08 03:07:36 | 000,000,000 | —D | C] – C:\c0f1f5bf944083c932
[2010/04/08 03:05:03 | 000,000,000 | —D | C] – C:\4d5a9c981b9d8db02c9162049606
[2010/04/08 03:03:03 | 000,000,000 | —D | C] – C:\WINDOWS\Minidump
[2010/04/08 03:02:20 | 000,000,000 | —D | C] – C:\462898e979a78161f2e5aa33ba2f8c
[2010/04/08 03:01:08 | 000,000,000 | —D | C] – C:\WINDOWS\ServicePackFiles
[2010/04/07 22:35:58 | 000,000,000 | –SD | C] – C:\Documents and Settings\andrew\UserData
[2010/04/07 22:34:37 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Local Settings\Application Data\AIM Toolbar
[2010/04/07 19:38:28 | 000,000,000 | —D | C] – C:\Program Files\TalismanOnline
[2010/04/07 18:53:45 | 000,000,000 | —D | C] – C:\Program Files\WinRAR
[2010/04/07 17:58:59 | 000,000,000 | —D | C] – C:\Nexon
[2010/04/07 16:41:37 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Tracing
[2010/04/07 16:40:43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NexonUS
[2010/04/07 16:40:10 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Documents\microsoft
[2010/04/07 16:39:47 | 000,000,000 | —D | C] – C:\Program Files\Windows Live
[2010/04/07 16:35:07 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Windows Live
[2010/04/07 16:12:20 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Local Settings\Application Data\PMB Files
[2010/04/07 16:12:07 | 000,000,000 | —D | C] – C:\Program Files\AIM Toolbar
[2010/04/07 16:12:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AIM Toolbar
[2010/04/07 16:11:54 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Application Data\acccore
[2010/04/07 16:11:53 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Local Settings\Application Data\AOL
[2010/04/07 16:11:53 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Local Settings\Application Data\AIM
[2010/04/07 16:11:47 | 000,000,000 | —D | C] – C:\Program Files\Pando Networks
[2010/04/07 16:11:44 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AIM
[2010/04/07 16:11:41 | 000,000,000 | —D | C] – C:\Program Files\Common Files\AOL
[2010/04/07 16:11:41 | 000,000,000 | —D | C] – C:\Program Files\AIM
[2010/04/07 15:51:15 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Application Data\Macromedia
[2010/04/07 15:50:45 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Application Data\uTorrent
[2010/04/07 14:58:55 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\ContentWatch
[2010/04/07 14:53:57 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Application Data\VERIZON_BROAD
[2010/04/07 14:51:02 | 000,719,872 | —- | C] (ContentWatch, Inc.) – C:\WINDOWS\System32\cwalsp.temp
[2010/04/07 14:20:06 | 000,279,368 | —- | C] (McAfee, Inc.) – C:\WINDOWS\sediag.exe
[2010/04/07 14:17:29 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee
[2010/04/07 14:10:34 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Motive
[2010/04/07 14:10:33 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Motive
[2010/04/07 13:50:45 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\PCHealth
[2010/04/07 13:44:50 | 000,000,000 | —D | C] – C:\Program Files\Verizon
[2010/04/07 13:44:50 | 000,000,000 | —D | C] – C:\WINDOWS\DSL
[2010/04/05 20:29:25 | 000,000,000 | —D | C] – C:\WINDOWS\System32\custom matrices
[2010/04/05 20:29:22 | 000,000,000 | —D | C] – C:\WINDOWS\System32\C2MP
[2010/04/05 19:53:31 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\vsosdk
[2010/04/05 18:47:30 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\My Documents\Downloads
[2010/04/05 18:46:11 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Local Settings\Application Data\Mozilla
[2010/04/05 18:46:11 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Application Data\Mozilla
[2010/04/05 18:46:02 | 000,000,000 | –SD | C] – C:\Documents and Settings\andrew\Application Data\Microsoft
[2010/04/05 18:46:02 | 000,000,000 | –SD | C] – C:\Documents and Settings\andrew\Cookies
[2010/04/05 18:46:02 | 000,000,000 | RH-D | C] – C:\Documents and Settings\andrew\Application Data
[2010/04/05 18:46:02 | 000,000,000 | R–D | C] – C:\Documents and Settings\andrew\Start Menu
[2010/04/05 18:46:02 | 000,000,000 | -H-D | C] – C:\Documents and Settings\andrew\Templates
[2010/04/05 18:46:02 | 000,000,000 | -H-D | C] – C:\Documents and Settings\andrew\Local Settings
[2010/04/05 18:46:02 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\My Documents
[2010/04/05 18:46:02 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Local Settings\Application Data\Microsoft
[2010/04/05 18:46:02 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Favorites
[2010/04/05 18:46:02 | 000,000,000 | —D | C] – C:\Documents and Settings\andrew\Desktop
[2010/04/05 18:42:41 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2010/04/05 18:35:44 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/04/05 18:30:10 | 000,626,688 | —- | C] (On2.com) – C:\WINDOWS\System32\vp7vfw.dll
[2010/04/05 18:30:09 | 000,000,000 | —D | C] – C:\Program Files\VSO
[2010/04/05 18:29:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\ConvertXtoDVD 3.3.4.106e And Keygen [1337x]
[2010/04/05 18:23:21 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SlySoft
[2010/04/05 17:30:24 | 000,000,000 | —D | C] – C:\Program Files\Tansee iPod Transfer
[2010/04/05 17:28:52 | 000,000,000 | —D | C] – C:\Program Files\SlySoft
[2010/04/05 17:28:27 | 000,000,000 | —D | C] – C:\Program Files\Elaborate Bytes
[2010/04/05 17:03:27 | 000,319,792 | —- | C] (BitTorrent, Inc.) – C:\Documents and Settings\All Users\Documents\uTorrent.exe
[2010/04/05 16:55:24 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Tansee iPod Transfer v3.8 [TBE Serial][h33t][matt14]
[2010/04/05 16:54:49 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\SlySoft - RETAIL Pack - 30 May 2008 -11in1- (AIO)
[2010/04/05 16:37:48 | 000,000,000 | —D | C] – C:\WINDOWS\System32\CatRoot_bak
[2010/04/05 16:37:35 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2010/04/05 16:09:46 | 000,000,000 | —D | C] – C:\WINDOWS\System32\PreInstall
[2010/04/05 15:09:31 | 000,000,000 | —D | C] – C:\WINDOWS\System32\SoftwareDistribution
[2010/03/18 00:03:31 | 000,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2010/03/17 23:46:33 | 000,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[5 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
[27 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 14 Days ==========

[2010/04/15 23:50:53 | 001,474,832 | —- | M] () – C:\WINDOWS\System32\drivers\sfi.dat
[2010/04/15 23:50:25 | 000,561,664 | —- | M] (OldTimer Tools) – C:\Documents and Settings\andrew\Desktop\OTL.exe
[2010/04/15 23:41:10 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/04/15 23:41:01 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/04/15 23:40:57 | 2110,963,712 | -HS- | M] () – C:\hiberfil.sys
[2010/04/15 23:17:10 | 000,525,824 | —- | M] () – C:\Documents and Settings\andrew\Desktop\dds.com
[2010/04/15 22:49:55 | 000,812,344 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\andrew\Desktop\HJTInstall.exe
[2010/04/15 22:45:12 | 002,707,456 | —- | M] () – C:\Documents and Settings\andrew\ntuser.dat
[2010/04/15 22:45:12 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\andrew\ntuser.ini
[2010/04/15 22:45:11 | 002,007,920 | -H– | M] () – C:\Documents and Settings\andrew\Local Settings\Application Data\IconCache.db
[2010/04/15 22:00:40 | 000,011,480 | -HS- | M] () – C:\Documents and Settings\andrew\Local Settings\Application Data\1743246443
[2010/04/15 22:00:40 | 000,011,480 | -HS- | M] () – C:\Documents and Settings\All Users\Application Data\1743246443
[2010/04/15 21:54:23 | 000,011,488 | -HS- | M] () – C:\Documents and Settings\andrew\Local Settings\Application Data\21a34KM55vORW
[2010/04/15 21:54:23 | 000,011,488 | -HS- | M] () – C:\Documents and Settings\All Users\Application Data\21a34KM55vORW
[2010/04/15 21:47:07 | 000,000,693 | —- | M] () – C:\WINDOWS\System32\msexcr.ini
[2010/04/15 13:19:15 | 000,149,308 | —- | M] () – C:\Documents and Settings\andrew\Desktop\maplestoryw10UPc4663A15.jpg
[2010/04/15 09:28:48 | 000,806,400 | —- | M] (GameKiller.net) – C:\Documents and Settings\andrew\Desktop\NzNett.exe
[2010/04/15 09:16:56 | 000,262,232 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/04/15 09:15:04 | 000,066,440 | —- | M] () – C:\Documents and Settings\andrew\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/04/15 09:10:48 | 000,567,288 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/04/15 09:10:48 | 000,488,162 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/04/15 09:10:48 | 000,088,786 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/04/15 08:57:36 | 000,000,519 | —- | M] () – C:\Documents and Settings\andrew\Desktop\The Nullz MapleStory Gateway.lnk
[2010/04/14 07:15:03 | 000,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/04/13 17:01:19 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/04/13 14:45:49 | 000,001,604 | —- | M] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2010/04/13 14:40:55 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\QuickTime.qtp
[2010/04/13 14:26:23 | 000,054,156 | -H– | M] () – C:\WINDOWS\QTFont.qfn
[2010/04/13 14:26:23 | 000,001,409 | —- | M] () – C:\WINDOWS\QTFont.for
[2010/04/12 17:06:11 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/04/11 01:52:47 | 000,000,408 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/04/10 13:35:02 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/04/10 05:43:32 | 000,001,653 | —- | M] () – C:\Documents and Settings\All Users\Desktop\COMODO Internet Security.lnk
[2010/04/10 05:42:27 | 000,000,733 | —- | M] () – C:\Documents and Settings\All Users\Desktop\IObit Security 360.lnk
[2010/04/10 05:41:46 | 043,083,264 | —- | M] () – C:\Documents and Settings\All Users\Documents\cis_setup_x86.msi
[2010/04/10 05:41:01 | 008,116,768 | —- | M] (IObit ) – C:\Documents and Settings\All Users\Documents\is360setup141.exe
[2010/04/10 05:37:48 | 000,000,478 | —- | M] () – C:\Documents and Settings\andrew\Desktop\Fraps.lnk
[2010/04/10 01:47:38 | 000,524,288 | —- | M] () – C:\Documents and Settings\andrew\Desktop\kjk.sav
[2010/04/10 01:45:55 | 000,000,136 | —- | M] () – C:\Documents and Settings\andrew\Desktop\hh.pkm
[2010/04/10 00:14:24 | 000,983,040 | —- | M] (GameKiller.net) – C:\Documents and Settings\andrew\Desktop\NzMaple.exe
[2010/04/09 21:04:35 | 000,000,867 | —- | M] () – C:\Documents and Settings\andrew\Desktop\Action Replay Code Manager.lnk
[2010/04/08 04:46:26 | 000,001,355 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/04/07 19:39:13 | 000,000,700 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Talisman Online.lnk
[2010/04/07 18:00:30 | 000,000,170 | —- | M] () – C:\Documents and Settings\All Users\Desktop\MapleStory.url
[2010/04/07 16:11:53 | 000,000,442 | -H– | M] () – C:\IPH.PH
[2010/04/07 16:11:43 | 000,001,574 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AIM.lnk
[2010/04/07 14:19:31 | 000,000,493 | —- | M] () – C:\WINDOWS\win.ini
[2010/04/05 18:23:48 | 000,001,477 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AnyDVD HD.lnk
[2010/04/05 17:28:52 | 000,000,766 | —- | M] () – C:\Documents and Settings\All Users\Desktop\CloneCD.lnk
[2010/04/05 17:28:28 | 000,000,852 | —- | M] () – C:\Documents and Settings\All Users\Desktop\CloneDVD2.lnk
[2010/04/05 17:03:27 | 000,319,792 | —- | M] (BitTorrent, Inc.) – C:\Documents and Settings\All Users\Documents\uTorrent.exe
[2010/04/05 17:03:27 | 000,000,483 | —- | M] () – C:\Documents and Settings\All Users\Desktop\µTorrent.lnk
[2010/04/05 16:37:44 | 000,000,000 | —- | M] () – C:\WINDOWS\nsreg.dat
[2010/04/05 16:37:38 | 000,001,602 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[5 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
[27 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/04/15 23:21:23 | 000,293,376 | —- | C] () – C:\Documents and Settings\andrew\Desktop\gmer.exe
[2010/04/15 23:17:09 | 000,525,824 | —- | C] () – C:\Documents and Settings\andrew\Desktop\dds.com
[2010/04/15 22:45:42 | 2110,963,712 | -HS- | C] () – C:\hiberfil.sys
[2010/04/15 22:43:04 | 001,872,472 | —- | C] () – C:\SmitfraudFix.exe
[2010/04/15 21:59:40 | 000,011,480 | -HS- | C] () – C:\Documents and Settings\andrew\Local Settings\Application Data\1743246443
[2010/04/15 21:59:40 | 000,011,480 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\1743246443
[2010/04/15 21:51:50 | 000,011,488 | -HS- | C] () – C:\Documents and Settings\andrew\Local Settings\Application Data\21a34KM55vORW
[2010/04/15 21:51:50 | 000,011,488 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\21a34KM55vORW
[2010/04/15 21:47:06 | 000,000,693 | —- | C] () – C:\WINDOWS\System32\msexcr.ini
[2010/04/15 13:08:35 | 000,149,308 | —- | C] () – C:\Documents and Settings\andrew\Desktop\maplestoryw10UPc4663A15.jpg
[2010/04/15 08:57:34 | 000,000,519 | —- | C] () – C:\Documents and Settings\andrew\Desktop\The Nullz MapleStory Gateway.lnk
[2010/04/15 08:53:48 | 000,151,552 | —- | C] () – C:\Documents and Settings\andrew\Desktop\Winject.exe
[2010/04/13 17:01:19 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/04/13 14:46:56 | 000,002,137 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/04/13 14:45:49 | 000,001,604 | —- | C] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2010/04/13 14:40:55 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\QuickTime.qtp
[2010/04/13 14:26:23 | 000,054,156 | -H– | C] () – C:\WINDOWS\QTFont.qfn
[2010/04/13 14:26:23 | 000,001,409 | —- | C] () – C:\WINDOWS\QTFont.for
[2010/04/11 10:12:14 | 002,707,456 | —- | C] () – C:\Documents and Settings\andrew\ntuser.dat
[2010/04/10 05:45:52 | 001,474,832 | —- | C] () – C:\WINDOWS\System32\drivers\sfi.dat
[2010/04/10 05:43:32 | 000,001,653 | —- | C] () – C:\Documents and Settings\All Users\Desktop\COMODO Internet Security.lnk
[2010/04/10 05:42:27 | 000,000,733 | —- | C] () – C:\Documents and Settings\All Users\Desktop\IObit Security 360.lnk
[2010/04/10 05:39:20 | 043,083,264 | —- | C] () – C:\Documents and Settings\All Users\Documents\cis_setup_x86.msi
[2010/04/10 05:37:48 | 000,000,478 | —- | C] () – C:\Documents and Settings\andrew\Desktop\Fraps.lnk
[2010/04/10 01:47:38 | 000,524,288 | —- | C] () – C:\Documents and Settings\andrew\Desktop\kjk.sav
[2010/04/10 01:45:55 | 000,000,136 | —- | C] () – C:\Documents and Settings\andrew\Desktop\hh.pkm
[2010/04/09 20:23:16 | 000,000,867 | —- | C] () – C:\Documents and Settings\andrew\Desktop\Action Replay Code Manager.lnk
[2010/04/09 17:23:05 | 000,000,284 | —- | C] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/04/09 08:55:02 | 000,000,408 | -H– | C] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/04/07 19:39:13 | 000,000,700 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Talisman Online.lnk
[2010/04/07 18:00:30 | 000,000,170 | —- | C] () – C:\Documents and Settings\All Users\Desktop\MapleStory.url
[2010/04/07 16:11:43 | 000,001,574 | —- | C] () – C:\Documents and Settings\All Users\Desktop\AIM.lnk
[2010/04/07 16:11:34 | 000,000,442 | -H– | C] () – C:\IPH.PH
[2010/04/05 18:46:02 | 000,001,024 | -H– | C] () – C:\Documents and Settings\andrew\ntuser.dat.LOG
[2010/04/05 18:46:02 | 000,000,178 | -HS- | C] () – C:\Documents and Settings\andrew\ntuser.ini
[2010/04/05 18:46:02 | 000,000,152 | —- | C] () – C:\Documents and Settings\andrew\BCM_DropUserDatabases.txt
[2010/04/05 18:46:02 | 000,000,051 | —- | C] () – C:\Documents and Settings\andrew\Local Settings\Application Data\setup.txt
[2010/04/05 18:23:48 | 000,001,477 | —- | C] () – C:\Documents and Settings\All Users\Desktop\AnyDVD HD.lnk
[2010/04/05 17:28:52 | 000,000,766 | —- | C] () – C:\Documents and Settings\All Users\Desktop\CloneCD.lnk
[2010/04/05 17:28:28 | 000,000,852 | —- | C] () – C:\Documents and Settings\All Users\Desktop\CloneDVD2.lnk
[2010/04/05 17:03:27 | 000,000,483 | —- | C] () – C:\Documents and Settings\All Users\Desktop\µTorrent.lnk
[2010/04/05 16:37:44 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2010/04/05 16:37:38 | 000,001,602 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/03/18 00:06:50 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2010/03/17 23:53:09 | 000,154,992 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/03/17 23:47:02 | 000,147,456 | —- | C] () – C:\WINDOWS\System32\igfxCoIn_v4964.dll
[2010/03/17 23:01:03 | 000,000,783 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2010/03/17 21:17:16 | 000,262,144 | —- | C] () – C:\Documents and Settings\All Users\ntuser.dat
[2010/03/17 21:17:16 | 000,001,024 | -H– | C] () – C:\Documents and Settings\All Users\ntuser.dat.LOG
[2010/03/02 20:00:00 | 004,555,278 | —- | C] () – C:\WINDOWS\System32\libavcodec.dll
[2010/03/02 20:00:00 | 001,449,935 | —- | C] () – C:\WINDOWS\System32\ffmpegmt.dll
[2010/03/02 20:00:00 | 000,882,688 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2010/03/02 20:00:00 | 000,877,385 | —- | C] () – C:\WINDOWS\System32\ff_x264.dll
[2010/03/02 20:00:00 | 000,556,491 | —- | C] () – C:\WINDOWS\System32\libmplayer.dll
[2010/03/02 20:00:00 | 000,336,384 | —- | C] () – C:\WINDOWS\System32\ff_libfaad2.dll
[2010/03/02 20:00:00 | 000,324,096 | —- | C] () – C:\WINDOWS\System32\TomsMoComp_ff.dll
[2010/03/02 20:00:00 | 000,248,320 | —- | C] () – C:\WINDOWS\System32\ff_kernelDeint.dll
[2010/03/02 20:00:00 | 000,216,576 | —- | C] () – C:\WINDOWS\System32\ff_libdts.dll
[2010/03/02 20:00:00 | 000,169,984 | —- | C] () – C:\WINDOWS\System32\ff_samplerate.dll
[2010/03/02 20:00:00 | 000,151,552 | —- | C] () – C:\WINDOWS\System32\ff_libmad.dll
[2010/03/02 20:00:00 | 000,145,408 | —- | C] () – C:\WINDOWS\System32\libmpeg2_ff.dll
[2010/03/02 20:00:00 | 000,121,856 | —- | C] () – C:\WINDOWS\System32\ff_liba52.dll
[2010/03/02 20:00:00 | 000,116,736 | —- | C] () – C:\WINDOWS\System32\ff_tremor.dll
[2010/03/02 20:00:00 | 000,100,864 | —- | C] () – C:\WINDOWS\System32\ff_wmv9.dll
[2010/03/02 20:00:00 | 000,097,792 | —- | C] () – C:\WINDOWS\System32\ff_unrar.dll
[2010/03/02 20:00:00 | 000,085,504 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2009/11/14 14:37:08 | 000,154,112 | —- | C] () – C:\WINDOWS\System32\ts.dll
[2009/11/14 14:33:38 | 000,249,856 | —- | C] () – C:\WINDOWS\System32\dxr.dll
[2009/11/14 14:11:50 | 000,093,184 | —- | C] () – C:\WINDOWS\System32\avss.dll
[2009/11/14 14:11:42 | 000,150,016 | —- | C] () – C:\WINDOWS\System32\mkx.dll
[2009/11/14 14:11:42 | 000,141,824 | —- | C] () – C:\WINDOWS\System32\mp4.dll
[2009/11/14 14:11:40 | 000,123,392 | —- | C] () – C:\WINDOWS\System32\ogm.dll
[2009/11/14 14:11:40 | 000,109,568 | —- | C] () – C:\WINDOWS\System32\avi.dll
[2009/11/14 14:11:38 | 000,097,792 | —- | C] () – C:\WINDOWS\System32\avs.dll
[2009/11/14 14:11:32 | 000,080,384 | —- | C] () – C:\WINDOWS\System32\mkzlib.dll
[2009/11/14 14:11:32 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\mkunicode.dll
[2009/06/07 12:24:04 | 000,180,224 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2009/01/10 18:15:44 | 000,159,744 | —- | C] () – C:\WINDOWS\System32\mmfinfo.dll
[2008/11/06 12:37:32 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2007/10/13 05:30:20 | 000,000,137 | —- | C] () – C:\WINDOWS\System32\Registration.ini
[2004/08/04 03:56:44 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\ieencode.dll
[2004/07/17 14:36:38 | 000,027,440 | —- | C] () – C:\WINDOWS\System32\drivers\secdrv.sys

========== LOP Check ==========

[2010/04/07 16:11:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AIM
[2010/04/07 16:12:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AIM Toolbar
[2010/04/10 05:42:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\IObit
[2010/04/07 16:40:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NexonUS
[2010/04/09 11:52:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PMB Files
[2010/04/05 18:23:21 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SlySoft
[2010/04/05 19:53:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\vsosdk
[2010/03/18 00:04:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
[2010/04/09 17:23:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/04/07 16:11:54 | 000,000,000 | —D | M] – C:\Documents and Settings\andrew\Application Data\acccore
[2010/04/10 16:56:20 | 000,000,000 | —D | M] – C:\Documents and Settings\andrew\Application Data\Search Settings
[2010/04/15 21:40:08 | 000,000,000 | —D | M] – C:\Documents and Settings\andrew\Application Data\uTorrent
[2010/04/10 16:56:54 | 000,000,000 | —D | M] – C:\Documents and Settings\andrew\Application Data\YouTube Downloader
[2010/04/11 01:52:47 | 000,000,408 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2006/02/28 08:00:00 | 018,738,937 | —- | M] () .cab file – C:\i386\sp2.cab:AGP440.sys
[2006/02/28 03:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/04/13 14:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\agp440.sys

< MD5 for: ATAPI.SYS >
[2006/02/28 08:00:00 | 018,738,937 | —- | M] () .cab file – C:\i386\sp2.cab:atapi.sys
[2006/02/28 03:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\atapi.sys
[2004/08/04 01:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\system32\drivers\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 20:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\eventlog.dll
[2004/08/04 03:56:44 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\system32\eventlog.dll

< MD5 for: IASTOR.SYS >
[2008/08/13 12:08:44 | 000,325,144 | —- | M] (Intel Corporation) MD5=42BE6406094936A23280D68D9AEC33D0 – C:\Compaq\MSD\IaStor.sys
[2008/08/13 12:08:44 | 000,325,144 | —- | M] (Intel Corporation) MD5=42BE6406094936A23280D68D9AEC33D0 – C:\WINDOWS\system32\drivers\iaStor.sys

< MD5 for: NETLOGON.DLL >
[2008/04/13 20:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\netlogon.dll
[2009/02/06 14:46:09 | 000,408,064 | —- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 – C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
[2009/02/06 14:46:09 | 000,408,064 | —- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 – C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll
[2009/02/06 14:46:09 | 000,408,064 | —- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 – C:\WINDOWS\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\sp2qfe\netlogon.dll
[2009/02/06 14:46:09 | 000,408,064 | —- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 – C:\WINDOWS\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\sp2qfe\netlogon.dll
[2004/08/04 03:56:46 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 03:56:46 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\system32\scecli.dll
[2008/04/13 20:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\scecli.dll

< MD5 for: SYMMPI.SYS >
[2002/04/04 01:32:06 | 000,028,416 | R— | M] (LSI Logic) MD5=F2B7E8416F508368AC6730E2AE1C614F – C:\WINDOWS\system32\drivers\symmpi.sys

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2004/08/04 03:56:44 | 000,357,888 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtmsft.dll
[2004/08/04 03:56:44 | 000,201,728 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtrans.dll
[2006/02/28 08:00:00 | 000,251,392 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\iepeers.dll
[27 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >
[5 C:\WINDOWS\system32\drivers\*.tmp files -> C:\WINDOWS\system32\drivers\*.tmp -> ]

< %systemroot%\System32\config\*.sav >
[2006/04/25 13:17:52 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2006/04/25 13:17:52 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2006/04/25 13:17:50 | 000,864,256 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\drivers\*.sys /90 >
[2010/03/03 17:54:12 | 000,015,376 | —- | M] (COMODO) – C:\WINDOWS\system32\drivers\cmderd.sys
[2010/03/23 18:40:00 | 000,224,808 | —- | M] (COMODO) – C:\WINDOWS\system32\drivers\cmdGuard.sys
[2010/03/03 17:54:14 | 000,025,160 | —- | M] (COMODO) – C:\WINDOWS\system32\drivers\cmdhlp.sys
[2010/03/03 17:54:16 | 000,086,720 | —- | M] (COMODO) – C:\WINDOWS\system32\drivers\inspect.sys
[2010/04/05 18:30:13 | 000,047,360 | —- | M] (VSO Software) – C:\WINDOWS\system32\drivers\pcouffin.sys
[5 C:\WINDOWS\system32\drivers\*.tmp files -> C:\WINDOWS\system32\drivers\*.tmp -> ]
< End of report >

————————————

OTL Extras logfile created on: 4/15/2010 11:52:13 PM - Run 1
OTL by OldTimer - Version 3.2.1.1 Folder = C:\Documents and Settings\andrew\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 75.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 86.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.05 Gb Total Space | 67.29 Gb Free Space | 45.15% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
Drive I: | 1.52 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: HP12902580339
Current User Name: andrew
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Minimal
Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.exe [@ = exefile] – Reg Error: Key error. File not found
.html [@ = htmlfile] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 1
"FirewallOverride" = 1
"FirewallDisableNotify" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"58960:TCP" = 58960:TCP:*:Enabled:Pando Media Booster
"58960:UDP" = 58960:UDP:*:Enabled:Pando Media Booster
"1043:TCP" = 1043:TCP:*:Enabled:Akamai NetSession Interface
"5000:UDP" = 5000:UDP:*:Enabled:Akamai NetSession Interface

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Documents and Settings\All Users\Documents\uTorrent.exe" = C:\Documents and Settings\All Users\Documents\uTorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)
"C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AIM – (AOL Inc.)
"C:\Program Files\Pando Networks\Media Booster\PMB.exe" = C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster – ()
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)
"C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe" = C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe:*:Enabled:Nexon Game Manager – (Nexon)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{004098A1-0362-4C42-A1C3-CAD436CFF4A1}" = YouTube Downloader Toolbar v1.0
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 2.5.4
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{2266312B-3502-41EE-82CD-8DC62276D87B}" = Vz In Home Agent
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{76BC2442-0002-47FA-9617-43BAD82BEF4C}" = Bonjour
"{76C24F39-B161-498F-BD8B-C64789812D13}_is1" = ConvertXtoDVD 3.3.4.106e
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7D8DBB7C-1C55-4950-A107-043C164F379A}" = Altiris Software Virtualization Agent
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{90A40409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{996A2FAA-7514-4628-9D12-A8FC34A0016E}" = iTunes
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support
"{B32C4059-6E7A-41EF-AD20-56DF1872B923}" = Business Contact Manager for Outlook 2007
"{B5C3B892-0849-476C-9F46-B12F84819D57}" = Apple Mobile Device Support
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC6B1BB4-4E06-4A5B-A166-B371B551324B}" = COMODO Internet Security
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DDD076BF-C5C3-468C-AA1B-F9A7E47446FE}" = Intel® Network Connections [removed]
"{E9F44C98-B8B6-480F-AF7B-E42A0A46F4E3}" = Microsoft SQL Server VSS Writer
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F9B3DD02-B0B3-42E9-8650-030DFF0D133D}" = Microsoft SQL Server Native Client
"Action Replay Code Manager_is1" = Action Replay Code Manager
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AIM Search" = AIM Search
"AIM Toolbar" = AIM Toolbar
"AIM_7" = AIM 7
"AnyDVD" = AnyDVD
"Business Contact Manager for Outlook 2007" = Business Contact Manager for Outlook 2007
"CloneCD" = CloneCD
"CloneDVD2" = CloneDVD2
"Cole2k Media - Codec Pack" = Cole2k Media - Codec Pack (Advanced) 7.9.1
"Fraps" = Fraps (remove only)
"HDMI" = Intel® Graphics Media Accelerator Driver
"IObit Security 360_is1" = IObit Security 360
"MapleStory" = MapleStory
"Media Player - Codec Pack" = Media Player Codec Pack 3.9.5
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"MSNINST" = MSN
"PDF Complete" = PDF Complete
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"Talisman Online_is1" = Talisman Online Ver.1644
"Tansee iPod Transfer_is1" = Tansee iPod Transfer v3.8
"uTorrent" = µTorrent
"Verizon Broadband Toolbar Firefox only" = Verizon Broadband Toolbar Firefox only
"Verizon Help and Support" = Verizon Help and Support Tool
"verizon_broad" = Verizon Broadband Toolbar (IE only)
"WIC" = Windows Imaging Component
"WinAVI Video Converter_is1" = WinAVI Video Converter
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 4/7/2010 4:04:28 PM | Computer Name = HP12902580339 | Source = MPSampleSubmission | ID = 5000
Description =

Error - 4/7/2010 4:04:46 PM | Computer Name = HP12902580339 | Source = MPSampleSubmission | ID = 5000
Description =

Error - 4/7/2010 4:04:47 PM | Computer Name = HP12902580339 | Source = MPSampleSubmission | ID = 5000
Description =

Error - 4/7/2010 4:05:12 PM | Computer Name = HP12902580339 | Source = Application Hang | ID = 1002
Description = Hanging application IEXPLORE.EXE, version 6.0.2900.2180, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/7/2010 4:05:13 PM | Computer Name = HP12902580339 | Source = MPSampleSubmission | ID = 5000
Description =

Error - 4/7/2010 4:05:13 PM | Computer Name = HP12902580339 | Source = Application Hang | ID = 1002
Description = Hanging application IEXPLORE.EXE, version 6.0.2900.2180, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/7/2010 4:05:26 PM | Computer Name = HP12902580339 | Source = Application Hang | ID = 1002
Description = Hanging application IEXPLORE.EXE, version 6.0.2900.2180, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/7/2010 4:05:29 PM | Computer Name = HP12902580339 | Source = Application Hang | ID = 1002
Description = Hanging application IEXPLORE.EXE, version 6.0.2900.2180, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/7/2010 4:05:53 PM | Computer Name = HP12902580339 | Source = MPSampleSubmission | ID = 5000
Description =

Error - 4/7/2010 4:10:30 PM | Computer Name = HP12902580339 | Source = MPSampleSubmission | ID = 5000
Description =

[ System Events ]
Error - 4/7/2010 3:01:57 PM | Computer Name = HP12902580339 | Source = Service Control Manager | ID = 7024
Description = The Background Intelligent Transfer Service service terminated with
service-specific error 2147952506 (0x8007277A).

Error - 4/7/2010 3:02:27 PM | Computer Name = HP12902580339 | Source = DCOM | ID = 10010
Description = The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register
with DCOM within the required timeout.

Error - 4/7/2010 3:02:31 PM | Computer Name = HP12902580339 | Source = Service Control Manager | ID = 7024
Description = The Background Intelligent Transfer Service service terminated with
service-specific error 2147952506 (0x8007277A).

Error - 4/7/2010 3:03:01 PM | Computer Name = HP12902580339 | Source = DCOM | ID = 10010
Description = The server {4991D34B-80A1-4291-83B6-3328366B9097} did not register
with DCOM within the required timeout.

Error - 4/7/2010 3:13:41 PM | Computer Name = HP12902580339 | Source = Service Control Manager | ID = 7023
Description = The Automatic Updates service terminated with the following error:
%%2147952506

Error - 4/7/2010 3:14:11 PM | Computer Name = HP12902580339 | Source = DCOM | ID = 10010
Description = The server {E60687F7-01A1-40AA-86AC-DB1CBF673334} did not register
with DCOM within the required timeout.

Error - 4/7/2010 4:11:36 PM | Computer Name = HP12902580339 | Source = SideBySide | ID = 16842784
Description = Dependent Assembly Microsoft.VC90.CRT could not be found and Last
Error was The referenced assembly is not installed on your system.

Error - 4/7/2010 4:11:36 PM | Computer Name = HP12902580339 | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error
message: The referenced assembly is not installed on your system. .

Error - 4/7/2010 4:11:36 PM | Computer Name = HP12902580339 | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\DOCUME~1\andrew\LOCALS~1\Temp\AIM_72~1.1\imappver.dll.
Reference
error message: The operation completed successfully. .

Error - 4/13/2010 2:45:20 PM | Computer Name = HP12902580339 | Source = Service Control Manager | ID = 7031
Description = The Apple Mobile Device service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

< End of report >

CatByte

Post #8April 16, 2010, 4:15 AM UTC

Hi,

Please do the following:

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

AndrewHii

Post #9April 16, 2010, 4:28 AM UTC

Ok im having a slight problem 1st. All of a sudden when I open a new link other then my homepage with Mozilla it says it crashes and ask's me if I wanna restart or quit Mozilla 2nd. My deafults for mozilla to save ComboFix was my documents then when I changed the destination and tried to re DL it onto my desktop I got an error message saying "Error Moving File or Folder" Cannot move Combofix.exe: Acess denied. Make sure the disk is not full or write-protected and that the file is not currently in use

CatByte

Post #10April 16, 2010, 4:33 AM UTC

Hi, delete that copy that you just downloaded (right click >delete) Open FireFox Go to Tools > Options > General tab under "downloads" > check the box that says "Always ask me where to save files" > OK now download a fresh copy, and save it directly to your desktop.

AndrewHii

Post #11April 16, 2010, 4:34 AM UTC last edited April 16, 2010, 4:39 AM UTC

Thats the problem I cant delete it keeps saying its in use btw thank you very much for your very fast replies EDIT : And I cant do it with firefox cause of the crashes and redirecting of links

CatByte

Post #12April 16, 2010, 4:40 AM UTC

Go into Task Manager (ctrl + Alt + Del) locate any processes with the names PEV.exe, SED.exe, Grep.exe, cfxxx.exe, end process on any you find…try again

AndrewHii

Post #13April 16, 2010, 4:48 AM UTC

[external image: Posted Image]

I cannot find any of the following you told me to cancel

CatByte

Post #14April 16, 2010, 4:52 AM UTC

Hi,

Please reboot your machine

Disable COmodo, that has been known to interfere in the past:

run this fix with OTL,

then try again with ComboFIX

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - Reg Error: Key error. File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\YouTube Downloader Toolbar\SearchSettings.dll File not found
[2010/04/15 22:00:40 | 000,011,480 | -HS- | M] () – C:\Documents and Settings\andrew\Local Settings\Application Data\1743246443
[2010/04/15 22:00:40 | 000,011,480 | -HS- | M] () – C:\Documents and Settings\All Users\Application Data\1743246443
[2010/04/15 21:54:23 | 000,011,488 | -HS- | M] () – C:\Documents and Settings\andrew\Local Settings\Application Data\21a34KM55vORW
[2010/04/15 21:54:23 | 000,011,488 | -HS- | M] () – C:\Documents and Settings\All Users\Application Data\21a34KM55vORW

:Commands
[resethosts]
[emptyflash]
[purity]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post the OTL log

Are you able to boot into safe mode?

If you can - try ComboFix in safe mode.

AndrewHii

Post #15April 16, 2010, 5:13 AM UTC last edited April 16, 2010, 11:30 AM UTC

Im goin to try safe mode .. Still the same error heres the log

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}\ deleted successfully.
C:\Documents and Settings\andrew\Local Settings\Application Data\1743246443 moved successfully.
C:\Documents and Settings\All Users\Application Data\1743246443 moved successfully.
C:\Documents and Settings\andrew\Local Settings\Application Data\21a34KM55vORW moved successfully.
C:\Documents and Settings\All Users\Application Data\21a34KM55vORW moved successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYFLASH]

User: Administrator

User: All Users

User: andrew
->Flash cache emptied: 5160 bytes

User: angelo
->Flash cache emptied: 2139 bytes

User: Default User

User: LocalService
->Flash cache emptied: 1654 bytes

User: NetworkService
->Flash cache emptied: 2831 bytes

User: rox
->Flash cache emptied: 877 bytes

Total Flash Files Cleaned = 0.00 mb

[EMPTYTEMP]

User: Administrator

User: All Users

User: andrew
->Temp folder emptied: 129209143 bytes
->Temporary Internet Files folder emptied: 54166205 bytes
->Java cache emptied: 547848 bytes
->FireFox cache emptied: 40956577 bytes
->Flash cache emptied: 0 bytes

User: angelo
->Temp folder emptied: 540360239 bytes
->Temporary Internet Files folder emptied: 513027673 bytes
->FireFox cache emptied: 104862250 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 18473763 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 377688 bytes
->Temporary Internet Files folder emptied: 22832787 bytes
->Flash cache emptied: 593 bytes

User: rox
->Temp folder emptied: 120537738 bytes
->Temporary Internet Files folder emptied: 25209487 bytes
->FireFox cache emptied: 35613006 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 14171537 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 641664 bytes
Windows Temp folder emptied: 18745309 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 9361810 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 1,573.00 mb

OTL by OldTimer - Version 3.2.1.1 log created on 04162010_005855

Files\Folders moved on Reboot…
File move failed. C:\Documents and Settings\andrew\Local Settings\Temp\B.tmp\evP.exe scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\andrew\Local Settings\Temp\3.tmp\evP.exe scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\andrew\Local Settings\Temporary Internet Files\Content.IE5\R1ZT8KRT\ComboFix[1].exe scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\andrew\Local Settings\Application Data\Mozilla\Firefox\Profiles\zkoqafgo.default\Cache.Trash\Trash\Cache\1EF26877d01 scheduled to be moved on reboot.
File\Folder C:\Documents and Settings\NetworkService\Local Settings\Temp\Perflib_Perfdata_51c.dat not found!
File move failed. C:\WINDOWS\S5EA497FD.tmp scheduled to be moved on reboot.
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_28c.dat not found!

Registry entries deleted on Reboot…

————

EDIT 1 : Safe mode deleted it successfully im about to run scan now

EDIT 2 : I got an error sayiing I do not have permissions to the content the error is

32788R22FWJF\hidec.exe

EDIT 3 : *UPDATE* I ran the scan through safe mode with networking and it went through now it installed the windows recovery
after it scanned it rebooted the computer into regular windows then ComboFix came up again and said please wait I waited for 25minutes
I clicked out restarted and went to Windows Recovery and I got this message

[external image: Posted Image]

And my computer with normal login seems to be goin normal but I wanna finish these steps
When combofix was scanning in safe mode it removed I think 7 items not to sure
But the XP Secuirty virus pop up isnt there anymore Thanks for your help so far
Hope when you reply back I can do final test if im up to that point lol (:

EDIT 4 : Ok so after I woke up this morning I tried combofix in safe mode again this time I got a log last time I didnt heres the results

ComboFix 10-04-15.02 - andrew 04/16/2010 7:23.2.2 - x86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2013.1772 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
—- Previous Run ——-
.
c:\documents and settings\rox\Application Data\inst.exe
c:\program files\YouTube Downloader Toolbar\IE\1.0\yoUTubedownloadertoolbarie.dll
c:\recycler\S-1-5-21-2721397692-649842262-2062883116-500
c:\windows\system32\_000003_.tmp.dll
c:\windows\system32\_000005_.tmp.dll
c:\windows\system32\_000110_.tmp.dll
c:\windows\system32\Process.exe

.
((((((((((((((((((((((((( Files Created from 2010-03-16 to 2010-04-16 )))))))))))))))))))))))))))))))
.

2010-04-16 04:58 . 2010-04-16 04:58 ——– d—–w- C:\_OTL
2010-04-16 04:18 . 2010-04-16 04:18 ——– d-s—w- c:\documents and settings\NetworkService\UserData
2010-04-16 02:44 . 2010-04-16 02:47 ——– d—–w- C:\SmitfraudFix
2010-04-16 01:51 . 2010-04-16 01:51 ——– d—–w- c:\windows\Sun
2010-04-16 01:44 . 2010-04-16 01:44 ——– d—–w- c:\program files\Common Files\Adobe
2010-04-15 22:02 . 2010-04-15 22:02 ——– d—–w- c:\program files\WinAVI MP4 Converter
2010-04-15 16:25 . 2010-04-15 16:25 ——– d—–w- c:\documents and settings\andrew\Local Settings\Application Data\Identities
2010-04-15 13:11 . 2010-04-15 13:12 ——– d—–w- C:\b396888e8efb1f82d5dbf972
2010-04-15 12:51 . 2010-04-15 12:51 ——– d—–w- c:\documents and settings\andrew\Local Settings\Application Data\COMODO
2010-04-13 21:01 . 2010-04-13 21:01 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-04-13 18:46 . 2010-04-13 18:46 ——– d—–w- c:\program files\iPod
2010-04-13 18:39 . 2010-04-13 18:46 ——– d—–w- c:\program files\iTunes
2010-04-13 17:25 . 2010-04-15 22:01 ——– d—–w- c:\program files\WinAVI Video Converter
2010-04-12 21:07 . 2004-08-04 04:56 21504 —-a-w- c:\windows\system32\hidserv.dll
2010-04-12 21:07 . 2004-08-04 04:56 21504 —-a-w- c:\windows\system32\dllcache\hidserv.dll
2010-04-12 21:07 . 2004-08-04 02:58 14848 —-a-w- c:\windows\system32\drivers\kbdhid.sys
2010-04-12 21:07 . 2004-08-04 02:58 14848 —-a-w- c:\windows\system32\dllcache\kbdhid.sys
2010-04-12 21:07 . 2004-08-04 03:08 31616 —-a-w- c:\windows\system32\drivers\usbccgp.sys
2010-04-12 21:07 . 2004-08-04 03:08 31616 —-a-w- c:\windows\system32\dllcache\usbccgp.sys
2010-04-12 21:05 . 2010-04-12 21:05 ——– d—–w- c:\windows\system32\wbem\Repository
2010-04-11 16:54 . 2010-04-15 22:01 ——– d—–w- c:\documents and settings\angelo\Local Settings\Application Data\WinAVI
2010-04-11 14:35 . 2010-04-11 14:35 ——– d—–w- c:\documents and settings\angelo\Local Settings\Application Data\AIM Toolbar
2010-04-11 14:31 . 2010-04-11 14:31 ——– d—–w- c:\program files\DownloadToolz
2010-04-11 14:13 . 2010-04-11 14:13 ——– d—–w- c:\program files\Common Files\AVSMedia
2010-04-11 14:11 . 2008-08-13 14:22 974848 —-a-w- c:\windows\system32\mfc70.dll
2010-04-11 14:11 . 2008-08-13 14:22 487424 —-a-w- c:\windows\system32\msvcp70.dll
2010-04-11 14:11 . 2008-08-13 14:22 344064 —-a-w- c:\windows\system32\msvcr70.dll
2010-04-11 14:11 . 2008-08-13 14:22 1700352 —-a-w- c:\windows\system32\GdiPlus.dll
2010-04-11 14:11 . 2008-08-13 14:22 24576 —-a-w- c:\windows\system32\msxml3a.dll
2010-04-11 14:11 . 2010-04-12 21:04 ——– d—–w- c:\program files\AVS4YOU
2010-04-11 14:11 . 2010-04-12 21:04 ——– d—–w- c:\documents and settings\All Users\Application Data\AVS4YOU
2010-04-10 20:56 . 2010-04-10 20:56 ——– d—–w- c:\documents and settings\andrew\Application Data\YouTube Downloader
2010-04-10 20:56 . 2010-04-10 20:56 ——– d—–w- c:\documents and settings\andrew\Application Data\Search Settings
2010-04-10 20:45 . 2010-04-10 20:45 ——– d—–w- c:\documents and settings\rox\Application Data\Search Settings
2010-04-10 20:45 . 2010-04-10 20:45 ——– d—–w- c:\documents and settings\rox\Application Data\YouTube Downloader
2010-04-10 17:35 . 2010-04-10 17:35 ——– d—–w- c:\documents and settings\rox\Local Settings\Application Data\Apple
2010-04-10 17:07 . 2010-04-10 17:07 ——– d—–w- c:\documents and settings\angelo\Application Data\Search Settings
2010-04-10 17:07 . 2010-04-10 17:07 ——– d—–w- c:\documents and settings\angelo\Application Data\YouTube Downloader
2010-04-10 13:49 . 2010-04-10 13:49 ——– d—–w- c:\program files\Application Updater
2010-04-10 13:49 . 2010-04-15 12:51 ——– d—–w- c:\program files\YouTube Downloader Toolbar
2010-04-10 13:49 . 2010-04-10 13:49 ——– d—–w- c:\program files\YouTube Downloader
2010-04-10 13:30 . 2010-04-10 15:21 ——– d—–w- c:\documents and settings\rox\Application Data\Apple Computer
2010-04-10 13:30 . 2010-04-10 15:21 ——– d—–w- c:\documents and settings\rox\Local Settings\Application Data\Apple Computer
2010-04-10 12:26 . 2010-04-10 12:26 ——– d—–w- c:\documents and settings\angelo\Application Data\DivX
2010-04-10 09:47 . 2010-04-10 09:47 ——– d—–w- c:\documents and settings\All Users\Application Data\Comodo Downloader
2010-04-10 09:46 . 2010-04-10 09:46 ——– d—–w- C:\VritualRoot
2010-04-10 09:46 . 2010-04-16 05:44 ——– d—–w- c:\documents and settings\All Users\Application Data\COMODO
2010-04-10 09:45 . 2010-04-16 05:44 1474832 —-a-w- c:\windows\system32\drivers\sfi.dat
2010-04-10 09:43 . 2010-04-10 09:43 ——– d—–w- c:\program files\COMODO
2010-04-10 09:42 . 2010-04-10 09:42 ——– d—–w- c:\documents and settings\All Users\Application Data\IObit
2010-04-10 09:42 . 2010-04-10 09:42 ——– d—–w- c:\program files\IObit
2010-04-10 09:37 . 2010-04-10 09:37 ——– d—–w- C:\Fraps
2010-04-10 01:04 . 2007-02-08 17:45 29184 —-a-w- c:\windows\system32\drivers\ActionReplayDS.sys
2010-04-10 00:32 . 2001-05-07 10:56 19805 —-a-r- c:\windows\system32\drivers\usbio.sys
2010-04-09 23:04 . 2010-04-15 15:05 ——– d—–w- c:\documents and settings\andrew\Application Data\Apple Computer
2010-04-09 23:04 . 2010-04-11 20:22 ——– d—–w- c:\documents and settings\andrew\Local Settings\Application Data\Apple Computer
2010-04-09 21:24 . 2010-04-10 15:00 ——– d—–w- c:\documents and settings\angelo\Application Data\Apple Computer
2010-04-09 21:23 . 2009-05-18 17:17 26600 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-04-09 21:23 . 2008-04-17 16:12 107368 —-a-w- c:\windows\system32\GEARAspi.dll
2010-04-09 21:23 . 2010-04-09 21:23 ——– d—–w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-04-09 21:23 . 2010-04-13 18:45 ——– d—–w- c:\program files\QuickTime
2010-04-09 21:23 . 2010-04-13 18:45 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-04-09 21:23 . 2010-04-09 21:23 ——– d—–w- c:\documents and settings\angelo\Local Settings\Application Data\Apple
2010-04-09 21:23 . 2010-04-09 21:23 ——– d—–w- c:\program files\Apple Software Update
2010-04-09 21:22 . 2009-10-16 06:33 41472 —-a-w- c:\windows\system32\drivers\usbaapl.sys
2010-04-09 21:22 . 2009-10-16 06:33 3003680 —-a-w- c:\windows\system32\usbaaplrc.dll
2010-04-09 21:22 . 2010-04-09 21:22 ——– d—–w- c:\program files\Bonjour
2010-04-09 21:22 . 2010-04-13 18:46 ——– d—–w- c:\program files\Common Files\Apple
2010-04-09 21:22 . 2010-04-09 21:22 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple
2010-04-09 21:21 . 2010-04-09 21:24 ——– d—–w- c:\documents and settings\angelo\Local Settings\Application Data\Apple Computer
2010-04-09 20:26 . 2010-04-16 01:42 ——– d—–w- c:\documents and settings\angelo\Application Data\uTorrent
2010-04-09 20:06 . 2010-04-09 20:06 313 —-a-w- c:\documents and settings\angelo\Avenged Sevenfold - Beast And The Harlot.zip
2010-04-09 19:39 . 2010-04-09 19:39 ——– d—–w- c:\documents and settings\angelo\Local Settings\Application Data\Identities
2010-04-09 18:32 . 2010-04-09 19:21 ——– d—–w- c:\documents and settings\angelo\king
2010-04-09 15:55 . 2010-04-09 15:55 ——– d—–w- c:\program files\MSXML 4.0
2010-04-09 15:52 . 2010-04-12 21:04 ——– d—–w- c:\documents and settings\angelo\Application Data\VERIZON_BROAD
2010-04-09 15:52 . 2010-04-09 15:52 ——– d—–w- c:\program files\Microsoft
2010-04-09 15:52 . 2010-04-09 15:52 ——– d—–w- c:\program files\Windows Live SkyDrive
2010-04-09 15:52 . 2010-04-09 15:52 ——– d—–w- c:\program files\Common Files\Software Update Utility
2010-04-09 15:52 . 2010-04-09 15:52 ——– d—–w- c:\documents and settings\All Users\Application Data\PMB Files
2010-04-09 15:52 . 2010-04-09 15:52 ——– d—–w- c:\program files\AIM Search
2010-04-09 15:52 . 2010-04-09 15:52 ——– d—–w- c:\documents and settings\rox\Local Settings\Application Data\Ashampoo
2010-04-09 15:51 . 2010-04-09 15:51 ——– d—–w- c:\program files\Ashampoo
2010-04-09 15:51 . 2010-04-09 15:51 ——– d—–w- c:\windows\bin
2010-04-09 15:51 . 2010-04-09 15:51 ——– d—–w- c:\documents and settings\rox\Application Data\Motive
2010-04-09 15:51 . 2010-04-09 15:51 ——– d—–w- c:\documents and settings\rox\Local Settings\Application Data\SupportSoft
2010-04-09 15:51 . 2010-04-09 15:51 ——– d—–w- c:\program files\verizon_broad
2010-04-09 15:51 . 2010-04-09 15:51 ——– d—–w- c:\program files\Verizon Broadband Firefox Toolbar
2010-04-09 15:50 . 2010-04-09 15:50 ——– d—–w- c:\program files\Common Files\SupportSoft
2010-04-09 01:49 . 2010-04-09 01:49 ——– d—–w- c:\program files\Datel
2010-04-09 01:14 . 2010-04-16 11:19 ——– d—–w- c:\program files\Common Files\Akamai
2010-04-08 19:19 . 2010-04-09 15:52 ——– d—–w- C:\90a3801c55a66cde4b
2010-04-08 19:17 . 2010-04-09 15:52 ——– d—–w- C:\036b67b57f6b4eda61634a54
2010-04-08 19:15 . 2009-08-06 23:23 215920 —-a-w- c:\windows\system32\muweb.dll
2010-04-08 19:15 . 2009-08-06 23:23 274288 —-a-w- c:\windows\system32\mucltui.dll
2010-04-08 19:14 . 2010-04-08 19:14 ——– d—–w- c:\documents and settings\angelo\Local Settings\Application Data\Ashampoo
2010-04-08 08:51 . 2010-04-09 19:52 ——– d-s—w- c:\documents and settings\angelo\UserData
2010-04-08 08:44 . 2010-04-09 15:55 ——– d—–w- C:\90992dab30b4c6aa50
2010-04-08 08:39 . 2010-04-09 15:55 ——– d—–w- C:\023929d22b5d977facb99b
2010-04-08 08:36 . 2010-04-09 15:55 ——– d—–w- C:\66d070a74d175702e2f9c909b75641
2010-04-08 08:33 . 2010-04-09 15:55 ——– d—–w- C:\1eca5aa21e3f21db9c1e9ce3d2454c
2010-04-08 08:31 . 2010-04-09 15:54 ——– d—–w- C:\69c0ef23a8b0fd618c96
2010-04-08 08:27 . 2010-04-09 15:54 ——– d—–w- C:\b91c9bb5d6740375cb40
2010-04-08 08:26 . 2004-08-04 07:56 82944 —h-tw- c:\windows\system32\2d40c3ce.dll
2010-04-08 08:26 . 2004-08-04 07:56 82944 —h-tw- c:\windows\system32\1346e6fb.dll
2010-04-08 08:24 . 2010-04-09 15:54 ——– d—–w- C:\016e542d71cc43e8c392
2010-04-08 08:21 . 2010-04-09 15:54 ——– d—–w- C:\cf4ab8911476893ea136986618e3191e
2010-04-08 08:19 . 2010-04-09 15:54 ——– d—–w- C:\e4883f89a4294536a81823bd04
2010-04-08 08:16 . 2010-04-09 15:54 ——– d—–w- C:\d6d7136eeb202a5d8bd3e52268ed9f
2010-04-08 08:13 . 2010-04-09 15:54 ——– d—–w- C:\df13a6ec3d8b0a55b63a710f027870b5
2010-04-08 08:11 . 2010-04-09 15:54 ——– d—–w- C:\189e0920529fce5027
2010-04-08 08:08 . 2010-04-09 15:54 ——– d—–w- C:\31dad707141606f800a5
2010-04-08 08:06 . 2010-04-09 15:54 ——– d—–w- C:\8a2e454bdc4dddcc1447e6
2010-04-08 08:03 . 2010-04-09 15:54 ——– d—–w- C:\111c9c889179d6726dc1
2010-04-08 08:01 . 2010-04-09 15:54 ——– d—–w- C:\9716aa70a285fa1bfd6c34eb27794a9d
2010-04-08 07:58 . 2010-04-09 15:54 ——– d—–w- C:\bc134a2a3b32596f824c8a873a
2010-04-08 07:56 . 2010-04-09 15:54 ——– d—–w- C:\3aa907f551931343c2b664
2010-04-08 07:53 . 2010-04-09 15:54 ——– d—–w- C:\9757662d5d71e266fb9179070cf5f30e
2010-04-08 07:50 . 2010-04-09 15:54 ——– d—–w- C:\88d329bd30fdeb8da0
2010-04-08 07:48 . 2010-04-09 15:54 ——– d—–w- C:\6e920d2ffbd97dc5f075b8c436dfd9
2010-04-08 07:45 . 2010-04-09 15:54 ——– d—–w- C:\f1d6e81042b7f9c98990
2010-04-08 07:43 . 2010-04-09 15:54 ——– d—–w- C:\093c30021b133087bd5e
2010-04-08 07:40 . 2010-04-09 15:54 ——– d—–w- C:\f2ae3c43587ec4fe7d8bb6
2010-04-08 07:38 . 2010-04-09 15:54 ——– d—–w- C:\0f88983144f378f0c9196da97a930eec
2010-04-08 07:35 . 2010-04-09 15:53 ——– d—–w- C:\2abc3de27138c7d2fe0c00

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-16 05:15 . 2010-04-16 05:15 0 –sh–w- c:\windows\S5EA497FD.tmp
2010-04-15 20:56 . 2010-04-05 20:51 66440 —-a-w- c:\documents and settings\angelo\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-15 13:15 . 2010-04-05 22:46 66440 —-a-w- c:\documents and settings\andrew\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-15 13:13 . 2010-03-18 03:53 154992 —-a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-04-09 15:51 . 2010-03-18 03:58 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-04-09 15:50 . 2010-04-09 12:47 ——– d—–w- c:\program files\ContentWatch(2)
2010-04-07 17:59 . 2010-04-05 19:50 66440 —-a-w- c:\documents and settings\rox\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-18 04:05 . 2010-03-18 04:05 1981 –sha-r- c:\windows\system32\drivers\103C_HP_BPC_HP Compaq dx7500 SFF_YB_0Comp_QMXL917_EU_48_I2A84h_SPEGATRON CORPORATION_V1.03_B5.11_T090223_WXP2_L409_M2014_J160_7Intel_8Pentium III Xeon_93_#100317_N808610CE_(KR792UT#ABA)_X_CD3_Z_2_G80862E22.MRK
2010-03-18 04:05 . 2010-03-18 03:56 ——– d—–w- c:\program files\Hewlett-Packard
2010-03-18 03:59 . 2010-03-18 03:58 ——– d—–w- c:\program files\HPQ
2010-03-18 03:59 . 2006-04-26 00:31 88207 —-a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-03-18 03:58 . 2010-03-18 03:58 319488 —-a-w- c:\windows\HideWin.exe
2010-03-18 03:58 . 2010-03-18 03:58 ——– d—–w- c:\program files\Realtek
2010-03-18 03:58 . 2010-03-18 03:58 ——– d—–w- c:\program files\Common Files\InstallShield
2010-03-18 03:58 . 2010-03-18 03:57 ——– d—–w- c:\program files\Intel
2010-03-18 03:57 . 2010-03-18 03:57 ——– d—–w- c:\program files\Java
2010-03-18 03:57 . 2010-03-18 03:57 ——– d—–w- c:\program files\Common Files\Java
2010-03-18 03:53 . 2010-03-18 03:53 ——– d—–w- c:\program files\MSBuild
2010-03-18 03:53 . 2010-03-18 03:53 ——– d—–w- c:\program files\Reference Assemblies
2010-03-18 03:46 . 2010-03-18 03:46 ——– d—–w- c:\program files\microsoft frontpage
2010-03-18 01:18 . 2010-03-18 01:18 ——– d—–w- c:\program files\Windows Sidebar
2010-03-12 16:52 . 2010-03-12 16:52 94208 —-a-w- c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\aimtbres.dll
2010-02-12 15:46 . 2010-02-12 15:46 91424 —-a-w- c:\windows\system32\dnssd.dll
2010-02-12 15:46 . 2010-02-12 15:46 107808 —-a-w- c:\windows\system32\dns-sd.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim"="c:\program files\AIM\aim.exe" [2010-03-08 3972440]
"Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2010-04-07 2937528]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-07-01 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-07-01 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-07-01 141848]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2008-04-07 318488]
"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 57344]
"Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2010-03-17 1565696]
"IObit Security 360"="c:\program files\IObit\IObit Security 360\IS360tray.exe" [2009-12-24 1280272]
"SearchSettings"="c:\program files\YouTube Downloader Toolbar\SearchSettings.exe" [2010-02-20 974848]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-26 142120]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Documents and Settings\\All Users\\Documents\\uTorrent.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"58960:TCP"= 58960:TCP:Pando Media Booster
"58960:UDP"= 58960:UDP:Pando Media Booster
"1864:TCP"= 1864:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface

S1 FSLX;FSLX;c:\windows\system32\drivers\fslx.sys [7/11/2008 6:44 PM 191872]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [8/4/2004 3:56 AM 14336]
S2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [2/19/2010 7:43 PM 380928]
S2 IS360service;IS360service;c:\program files\IObit\IObit Security 360\is360srv.exe [4/10/2010 5:42 AM 311568]
S2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [3/18/2010 12:04 AM 576024]
S3 ActionReplayDS;ActionReplayDS;c:\windows\system32\drivers\ActionReplayDS.sys [4/9/2010 9:04 PM 29184]
S3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [3/17/2010 11:47 PM 243856]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Contents of the 'Scheduled Tasks' folder

2010-04-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 15:50]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.aol.com/?src=aim&ncid;=snsusaimc00000001
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=en_us&c;=93&bd;=all&pf;=cmdt
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=en_us&c;=93&bd;=all&pf;=cmdt
FF - ProfilePath - c:\documents and settings\andrew\Application Data\Mozilla\Firefox\Profiles\zkoqafgo.default\
FF - prefs.js: browser.search.defaulturl - hxxp://aim.search.aol.com/aol/search?query={searchTerms}&invocationType;=tb50-ff-aim-chromesbox-en-us
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://my.msn.com
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei;=utf-8&type;=937811&p;=
FF - component: c:\program files\YouTube Downloader Toolbar\FF\components\youtubedownloaderToolbarFF.dll
FF - component: c:\program files\YouTube Downloader Toolbar\SSFF\components\SearchSettingsFF.dll
FF - plugin: c:\documents and settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll
FF - plugin: c:\program files\Common Files\Motive\npMotive.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdnupdater2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll

—- FIREFOX POLICIES —-
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, falsec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-HookURL - (no file)
URLSearchHooks-Rank - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS

**************************************************************************
scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Akamai]
"ServiceDll"="C:/Program Files/Common Files/Akamai/rswin_3653.dll"
–

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Akamai]
"ServiceDll"="C:/Program Files/Common Files/Akamai/rswin_3653.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\ASFWHide]
"ImagePath"="\??\c:\docume~1\rox\LOCALS~1\Temp\ASFWHide"
.
Completion time: 2010-04-16 07:26:01
ComboFix-quarantined-files.txt 2010-04-16 11:25

Pre-Run: 76,464,750,592 bytes free
Post-Run: 76,422,225,920 bytes free

- - End Of File - - 99EFB66D2E61DECFD21CDE1D87457101

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] URGENT NEED OF HELP ! ASAP !

✨ Ask AI

Ask AI