whittgr
Kapersky Log
——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Friday, May 28, 2010
Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Friday, May 28, 2010 14:16:06
Records in database: 4194561
——————————————————————————–
Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes
Scan area - My Computer:
C:\
D:\
E:\
Scan statistics:
Objects scanned: 289691
Threats found: 8
Infected objects found: 18
Suspicious objects found: 4
Scan duration: 03:39:16
File name / Threat / Threats count
C:\Saved Stuff\Backup Drivers\Driver Backup 3-8-2009-173259.exe Infected: Virus.Win32.Parite.b 1
C:\Saved Stuff\John.TRINITY\My Documents\Progs\Nero 8.3.2.1 with Activation\Nero-8.3.2.1b_eng_trial.exe Infected: Virus.Win32.Parite.b 1
C:\Saved Stuff\John.TRINITY\My Documents\Progs\NextUp - Text Aloud + AT&T; Natural Voices + NeoSpeech Voices + SERIAL\Audrey16bu.exe Infected: Virus.Win32.Parite.b 1
C:\Saved Stuff\John.TRINITY\My Documents\Progs\NextUp - Text Aloud + AT&T; Natural Voices + NeoSpeech Voices + SERIAL\Crystal16dr.exe Infected: Virus.Win32.Parite.b 1
C:\Saved Stuff\John.TRINITY\My Documents\Progs\NextUp - Text Aloud + AT&T; Natural Voices + NeoSpeech Voices + SERIAL\Kate3.exe Infected: Virus.Win32.Parite.b 1
C:\Saved Stuff\John.TRINITY\My Documents\Progs\NextUp - Text Aloud + AT&T; Natural Voices + NeoSpeech Voices + SERIAL\Mike16ni.exe Infected: Virus.Win32.Parite.b 1
C:\Saved Stuff\John.TRINITY\My Documents\Progs\NextUp - Text Aloud + AT&T; Natural Voices + NeoSpeech Voices + SERIAL\Paul3.exe Infected: Virus.Win32.Parite.b 1
D:\Documents and Settings\John\Local Settings\Application Data\Identities\{6006CD92-4D66-4058-A143-CEA9FA3E6692}\Microsoft\Outlook Express\Deleted Items.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 4
D:\Qoobox\Quarantine\D\Documents and Settings\John\Application Data\ATManager\apmanager.exe.vir Infected: not-a-virus:FraudTool.Win32.Agent.asn 1
D:\Qoobox\Quarantine\D\Documents and Settings\John\Application Data\mtl.dll.vir Infected: Trojan-Ransom.Win32.Winac.a 1
D:\Qoobox\Quarantine\D\Documents and Settings\John\Local Settings\Application Data\nsgsnudvf\viwifsjtssd.exe.vir Infected: Trojan.Win32.FraudPack.awjx 1
D:\Qoobox\Quarantine\D\WINDOWS\Fvuvia.exe.vir Infected: Trojan.Win32.Genome.jxmb 1
D:\Qoobox\Quarantine\[4]-Submit_2010-05-27_19.01.09.zip Infected: not-a-virus:FraudTool.Win32.Agent.asn 1
D:\System Volume Information\_restore{0B1F65EE-CB93-4655-969A-9909828700D5}\RP7\A0006109.exe Infected: not-a-virus:FraudTool.Win32.Agent.asn 1
D:\System Volume Information\_restore{0B1F65EE-CB93-4655-969A-9909828700D5}\RP7\A0006112.dll Infected: Trojan-Ransom.Win32.Winac.a 1
D:\System Volume Information\_restore{0B1F65EE-CB93-4655-969A-9909828700D5}\RP7\A0006113.exe Infected: Trojan.Win32.FraudPack.awjx 1
D:\System Volume Information\_restore{0B1F65EE-CB93-4655-969A-9909828700D5}\RP7\A0006115.exe Infected: Trojan.Win32.Genome.jxmb 1
D:\WINDOWS\system32\drivers\etc\hosts.20090424-143124.backup Infected: Trojan.Win32.Qhost.mcf 1
D:\WINDOWS\system32\isaxbox.sys Infected: Rootkit.Win32.Tiny.ic 1
Selected area has been scanned.
MBAM Log
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 4152
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
5/28/2010 5:28:11 PM
mbam-log-2010-05-28 (17-28-11).txt
Scan type: Quick scan
Objects scanned: 133760
Time elapsed: 3 minute(s), 43 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
D:\Documents and Settings\John\Desktop\ATManager.lnk (Rogue.ATManager) -> Quarantined and deleted successfully.
OTL Log
OTL logfile created on: 5/28/2010 6:18:18 PM - Run 2
OTL by OldTimer - Version 3.2.5.0 Folder = D:\Documents and Settings\John\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 69.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 88.00% Paging File free
Paging file location(s): D:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = D: | %SystemRoot% = D:\WINDOWS | %ProgramFiles% = D:\Program Files
Drive C: | 111.78 Gb Total Space | 17.55 Gb Free Space | 15.70% Space Free | Partition Type: NTFS
Drive D: | 465.75 Gb Total Space | 165.87 Gb Free Space | 35.61% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: TRINITY
Current User Name: John
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
========== Processes (SafeList) ==========
PRC - D:\Documents and Settings\John\Desktop\OTL.exe (OldTimer Tools)
PRC - D:\Program Files\MediaMall\MediaMallServer.exe (MediaMall Technologies, Inc.)
PRC - D:\Program Files\MediaMall\PlayOn.exe (MediaMall Technologies, Inc.)
PRC - D:\Program Files\Orb Networks\Orb\bin\OrbLauncher.exe (Orb Networks)
PRC - D:\Program Files\Orb Networks\Orb\bin\OrbMediaService.exe (Orb Networks)
PRC - D:\Program Files\Orb Networks\Orb\bin\Orb.exe (Orb Networks, Inc.)
PRC - D:\Program Files\Avanquest\SystemSuite\MXTask2.exe (Avanquest North America, Inc.)
PRC - D:\Program Files\Avanquest\SystemSuite\MXTask.exe (Avanquest North America, Inc.)
PRC - D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - D:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
PRC - D:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - D:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe (Logitech Inc.)
PRC - D:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe (Logitech Inc.)
PRC - D:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe (Logitech Inc.)
PRC - D:\Program Files\Logitech\GamePanel Software\Applets\LCDMedia.exe (Logitech Inc.)
PRC - D:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe (Logitech Inc.)
PRC - D:\Program Files\Common Files\AntiVirus\SBAMSvc.exe (Sunbelt Software)
PRC - D:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - D:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE (SEIKO EPSON CORPORATION)
PRC - D:\Program Files\Microsoft Broadband Networking\MSBNTray.exe (Microsoft Corporation)
PRC - D:\WINDOWS\system32\devldr32.exe (Creative Technology Ltd.)
========== Modules (SafeList) ==========
MOD - D:\Documents and Settings\John\Desktop\OTL.exe (OldTimer Tools)
MOD - D:\Program Files\Avanquest\SystemSuite\WinHook.dll (Avanquest North America, Inc.)
MOD - D:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
========== Win32 Services (SafeList) ==========
SRV - (DAUpdaterSvc) – D:\Program Files\Dragon Age\bin_ship\daupdatersvc.service.exe (BioWare)
SRV - (MediaMall Server) – D:\Program Files\MediaMall\MediaMallServer.exe (MediaMall Technologies, Inc.)
SRV - (OrbMediaService) – D:\Program Files\Orb Networks\Orb\bin\OrbMediaService.exe (Orb Networks)
SRV - (FLEXnet Licensing Service) – D:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (SystemSuite Task Manager) – D:\Program Files\Avanquest\SystemSuite\MXTask.exe (Avanquest North America, Inc.)
SRV - (IntuitUpdateService) – D:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
SRV - (YahooAUService) – D:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (SBAMSvc) – D:\Program Files\Common Files\AntiVirus\SBAMSvc.exe (Sunbelt Software)
SRV - (Adobe Version Cue CS4) – D:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe (Adobe Systems Incorporated)
SRV - (EPSON_PM_RPCV4_01) EPSON V3 Service4(01) – D:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE (SEIKO EPSON CORPORATION)
========== Driver Services (SafeList) ==========
DRV - (sptd) – D:\WINDOWS\System32\Drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (nv) – D:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (hotcore3) – D:\WINDOWS\system32\DRIVERS\hotcore3.sys (Paragon Software Group)
DRV - (Uim_IM) – D:\WINDOWS\system32\drivers\Uim_IM.sys (Paragon)
DRV - (UimBus) – D:\WINDOWS\system32\drivers\UimBus.sys (Windows ® 2000 DDK provider)
DRV - (LMouFilt) – D:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) – D:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (SBRE) – D:\WINDOWS\system32\drivers\SBREDrv.sys (Sunbelt Software)
DRV - (sbtis) – D:\WINDOWS\system32\drivers\sbtis.sys (Sunbelt Software)
DRV - (TFilter) – D:\Program Files\Avanquest\SystemSuite\TFilter.sys (Avanquest North America, Inc.)
DRV - (nvgts) – D:\WINDOWS\system32\DRIVERS\nvgts.sys (NVIDIA Corporation)
DRV - (adfs) – D:\WINDOWS\system32\drivers\adfs.sys (Adobe Systems, Inc.)
DRV - (sbapifs) – D:\WINDOWS\system32\drivers\sbapifs.sys (Sunbelt Software)
DRV - (sbaphd) – D:\WINDOWS\system32\drivers\sbaphd.sys (Sunbelt Software)
DRV - (gameenum) – D:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) – D:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (nvnetbus) – D:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) – D:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (RTLWUSB) – D:\WINDOWS\system32\drivers\RTL8187.sys (Realtek Semiconductor Corporation )
DRV - (nvata) – D:\WINDOWS\system32\DRIVERS\nvata.sys (NVIDIA Corporation)
DRV - (AmdK8) – D:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (SjyPkt) – D:\WINDOWS\system32\drivers\SjyPkt.sys (Windows ® 2000 DDK provider)
DRV - (SI3132) – D:\WINDOWS\system32\DRIVERS\SI3132.sys (Silicon Image, Inc.)
DRV - (SiFilter) – D:\WINDOWS\system32\DRIVERS\SiWinAcc.sys (Silicon Image, Inc.)
DRV - (MTsensor) – D:\WINDOWS\system32\drivers\ASACPI.sys ()
DRV - (MSW_USB) – D:\WINDOWS\system32\drivers\MN510-51.sys (Microsoft, Inc.)
DRV - (sfman) Creative SoundFont Manager Driver (WDM) – D:\WINDOWS\system32\drivers\sfman.sys (Creative Technology Ltd.)
DRV - (ctljystk) – D:\WINDOWS\system32\drivers\ctljystk.sys (Creative Technology Ltd.)
DRV - (emu10k) Creative SB Live! series(WDM) – D:\WINDOWS\system32\drivers\emu10k1f.sys (Creative Technology Ltd.)
DRV - (emu10k1) Creative Interface Manager Driver (WDM) – D:\WINDOWS\system32\drivers\ctlface.sys (Creative Technology Ltd.)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "AIM Search"
FF - prefs.js..browser.search.defaulturl: "http://aim.search.aol.com/search/search?query={searchTerms}&invocationType;=tb50-ff-aim-chromesbox-en-us"
FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-type: "${8}"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: {e1170235-2845-420c-acc3-42261a29dd46}:4.0.1
FF - prefs.js..extensions.enabledItems: {4d855a8a-1536-4aa8-bf99-da2362910205}:[removed]
FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.4
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:2.2.0
FF - prefs.js..extensions.enabledItems: {B17C1C5A-04B1-11DB-9804-B622A1EF5492}:1.2
FF - prefs.js..extensions.enabledItems: paypalfirefoxplugin@orbiscom:[removed]
FF - prefs.js..extensions.enabledItems: {37E4D8EA-8BDA-4831-8EA1-89053939A250}:3.0.0.1
FF - prefs.js..extensions.enabledItems: {7b13ec3e-999a-4b70-b9cb-2617b8323822}:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:7
FF - prefs.js..keyword.URL: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType;=tb50-ff-aim-ab-en-us&query;="
FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: D:\Program Files\Avanquest\SystemSuite\Firefox [2009/04/07 06:11:10 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{4d855a8a-1536-4aa8-bf99-da2362910205}: D:\Program Files\Avanquest\SystemSuite\Firefox3DV [2009/04/07 06:15:13 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\paypalfirefoxplugin@orbiscom: D:\Program Files\PayPal\PayPal Plug-In [2010/02/19 08:45:11 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Components: D:\Program Files\Mozilla Firefox\components [2010/05/07 15:03:47 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Plugins: D:\Program Files\Mozilla Firefox\plugins [2010/05/27 19:29:54 | 000,000,000 | —D | M]
[2009/04/07 05:53:19 | 000,000,000 | —D | M] – D:\Documents and Settings\John\Application Data\Mozilla\Extensions
[2010/05/27 19:33:33 | 000,000,000 | —D | M] – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\extensions
[2009/12/30 19:29:08 | 000,000,000 | —D | M] (FaceFun) – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\extensions\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}
[2010/04/26 20:19:24 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/10/16 05:26:22 | 000,000,000 | —D | M] (PDF Download) – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250}
[2009/12/30 19:44:33 | 000,000,000 | —D | M] (Dogpile Bundle Toolbar) – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\extensions\{517ca167-b6e8-4397-a0b4-a0074bbe3d5b}
[2009/06/04 18:11:03 | 000,000,000 | —D | M] (IE Tab) – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
[2010/03/18 18:49:15 | 000,000,000 | —D | M] (Zynga Toolbar) – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}
[2009/04/07 06:44:38 | 000,000,000 | —D | M] (FireFTP) – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}
[2009/08/06 18:34:02 | 000,000,000 | —D | M] (Password Exporter) – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\extensions\{B17C1C5A-04B1-11DB-9804-B622A1EF5492}
[2010/01/22 06:12:54 | 000,000,000 | —D | M] (Clipmarks) – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\extensions\{e1170235-2845-420c-acc3-42261a29dd46}
[2010/03/02 19:29:48 | 000,000,000 | —D | M] – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\extensions\[removed]
[2010/02/19 08:34:57 | 000,004,546 | —- | M] () – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\searchplugins\aim-search.xml
[2009/12/30 20:51:21 | 000,001,070 | —- | M] () – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\searchplugins\dogpile-search.xml
[2009/10/15 17:41:55 | 000,002,138 | —- | M] () – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\searchplugins\MySpace.xml
[2009/04/18 17:31:54 | 000,001,368 | —- | M] () – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\searchplugins\nextag.xml
[2010/05/22 01:54:38 | 000,002,363 | —- | M] () – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\searchplugins\search-the-web.xml
[2009/04/18 17:20:30 | 000,001,088 | —- | M] () – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\searchplugins\thottbot-wow.xml
[2009/05/08 16:36:13 | 000,000,945 | —- | M] () – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\searchplugins\youtube-video-search.xml
[2010/05/27 19:33:33 | 000,000,000 | —D | M] – D:\Program Files\Mozilla Firefox\extensions
[2009/09/05 11:30:03 | 000,238,776 | —- | M] (Pando Networks) – D:\Program Files\Mozilla Firefox\plugins\npPandoWebInst.dll
O1 HOSTS File: ([2010/05/27 19:17:45 | 000,000,027 | —- | M]) - D:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - D:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O2 - BHO: (no name) - {0347C33E-8762-4905-BF09-768834316C61} - No CLSID value found.
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - D:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()
O2 - BHO: (no name) - {21608B66-026F-4DCB-9244-0DACA328DCED} - No CLSID value found.
O2 - BHO: (XPL LinkScannerIE) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - D:\Program Files\Avanquest\SystemSuite\LinkScannerIE.dll (Exploit Prevention Labs, Inc.)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (DataVault Object) - {8373ADC0-6330-11DD-9D77-22C856D89593} - D:\Program Files\Avanquest\SystemSuite\IE_ContextMenu_Vault.dll (Avanquest North America, Inc.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - No CLSID value found.
O2 - BHO: (OToolbarHelper Class) - {EAD3A971-6A23-4246-8691-C9244E858967} - D:\Program Files\PayPal\PayPal Plug-In\PayPalHelper.dll ()
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - D:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll (Yahoo! Inc)
O2 - BHO: (no name) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - D:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()
O3 - HKLM\..\Toolbar: (PayPal Plug-In) - {DC0F2F93-27FA-4f84-ACAA-9416F90B9511} - D:\Program Files\PayPal\PayPal Plug-In\OToolbar.dll ()
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (TextAloud) - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - D:\Program Files\TextAloud\TAForIE.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe_ID0ENQBO] D:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4Tray.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] D:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] D:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [Launch LCDMon] D:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe (Logitech Inc.)
O4 - HKLM..\Run: [Launch LGDCore] D:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe (Logitech Inc.)
O4 - HKLM..\Run: [Launch LgDevAgt] D:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe (Logitech Inc.)
O4 - HKLM..\Run: [NvCplDaemon] D:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [Orb] D:\Program Files\Orb Networks\Orb\bin\OrbLauncher.exe (Orb Networks)
O4 - HKCU..\Run: [Messenger (Yahoo!)] D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [PlayOn] D:\Program Files\MediaMall\PlayOn.exe (MediaMall Technologies, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [uTorrent] D:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - Startup: D:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Broadband Networking.lnk = D:\WINDOWS\Installer\{8CC15633-2327-43F4-BA85-B83FDB4B59BE}\_18be6784.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Append Link Target to Existing PDF - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: E&xport; to Microsoft Excel - D:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab (System Requirements Lab Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1239115665796 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1240094785812 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - D:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - D:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - D:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - D:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - D:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: D:\Documents and Settings\John\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: D:\Documents and Settings\John\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/04/07 04:52:36 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2010/05/28 17:30:12 | 000,000,000 | —D | C] – D:\Documents and Settings\All Users\Application Data\Gosu
[2010/05/27 19:31:33 | 000,000,000 | -HSD | C] – D:\RECYCLER
[2010/05/24 16:11:03 | 000,212,480 | —- | C] (SteelWerX) – D:\WINDOWS\SWXCACLS.exe
[2010/05/24 16:11:03 | 000,161,792 | —- | C] (SteelWerX) – D:\WINDOWS\SWREG.exe
[2010/05/24 16:11:03 | 000,136,704 | —- | C] (SteelWerX) – D:\WINDOWS\SWSC.exe
[2010/05/24 16:11:03 | 000,031,232 | —- | C] (NirSoft) – D:\WINDOWS\NIRCMD.exe
[2010/05/24 16:10:54 | 000,000,000 | —D | C] – D:\Qoobox
[2010/05/22 09:36:49 | 000,000,000 | —D | C] – D:\_OTL
[2010/05/19 23:00:24 | 000,571,904 | —- | C] (OldTimer Tools) – D:\Documents and Settings\John\Desktop\OTL.exe
[2010/05/15 20:24:49 | 000,000,000 | —D | C] – D:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/05/15 20:24:48 | 000,000,000 | —D | C] – D:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/05/14 21:17:52 | 000,000,000 | —D | C] – D:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2010/05/14 19:53:36 | 000,000,000 | —D | C] – D:\spoolerlogs
[2010/05/13 23:50:27 | 000,000,000 | —D | C] – D:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2010/05/13 23:50:26 | 000,000,000 | —D | C] – D:\Documents and Settings\John\Local Settings\Application Data\Temp
[2010/05/13 23:50:21 | 000,000,000 | —D | C] – D:\Program Files\Common Files\DivX Shared
[2010/05/13 23:50:18 | 000,000,000 | —D | C] – D:\Documents and Settings\John\Local Settings\Application Data\Google
[2010/05/13 23:50:16 | 000,000,000 | —D | C] – D:\Program Files\Google
[2010/05/13 23:50:13 | 000,000,000 | —D | C] – D:\Program Files\DivX
[2010/05/13 23:50:06 | 000,000,000 | —D | C] – D:\Documents and Settings\All Users\Application Data\DivX
[2010/05/09 20:13:55 | 000,000,000 | —D | C] – D:\Documents and Settings\All Users\Application Data\WEBREG
[2010/05/08 10:53:53 | 000,000,000 | —D | C] – D:\Documents and Settings\John\Application Data\HP
[2010/05/08 10:46:24 | 000,000,000 | —D | C] – D:\Documents and Settings\All Users\Application Data\HP Product Assistant
[2010/05/08 10:46:24 | 000,000,000 | —D | C] – D:\Documents and Settings\All Users\Application Data\HP
[2010/05/08 10:46:06 | 000,000,000 | —D | C] – D:\Program Files\Common Files\HP
[2010/05/08 10:45:31 | 000,000,000 | —D | C] – D:\Program Files\HP
[2010/05/08 10:45:19 | 000,000,000 | —D | C] – D:\Config.Msi
[2010/05/08 10:37:23 | 000,000,000 | —D | C] – D:\Documents and Settings\All Users\Application Data\Hewlett-Packard
[2010/05/08 10:37:15 | 000,271,704 | R— | C] (Hewlett-Packard) – D:\WINDOWS\System32\hpzids01.dll
[2010/05/08 10:37:11 | 000,117,760 | —- | C] (Hewlett-Packard Company) – D:\WINDOWS\System32\hpzll5mu.dll
[2009/04/07 04:57:24 | 000,059,392 | —- | C] ( ) – D:\WINDOWS\System32\a3d.dll
========== Files - Modified Within 30 Days ==========
[2010/05/28 18:17:05 | 000,215,383 | —- | M] () – D:\WINDOWS\System32\nvapps.xml
[2010/05/28 18:17:05 | 000,002,355 | —- | M] () – D:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Broadband Networking.lnk
[2010/05/28 18:17:02 | 000,000,878 | —- | M] () – D:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/05/28 18:00:00 | 000,000,882 | —- | M] () – D:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/05/28 17:50:03 | 000,000,310 | —- | M] () – D:\WINDOWS\tasks\Orb Index when idle.job
[2010/05/28 17:29:51 | 000,000,006 | -H– | M] () – D:\WINDOWS\tasks\SA.DAT
[2010/05/28 17:29:50 | 000,002,048 | –S- | M] () – D:\WINDOWS\bootstat.dat
[2010/05/28 17:28:55 | 007,864,320 | -H– | M] () – D:\Documents and Settings\John\NTUSER.DAT
[2010/05/28 17:17:36 | 000,000,178 | -HS- | M] () – D:\Documents and Settings\John\ntuser.ini
[2010/05/27 19:17:57 | 000,000,227 | —- | M] () – D:\WINDOWS\system.ini
[2010/05/27 19:17:45 | 000,000,027 | —- | M] () – D:\WINDOWS\System32\drivers\etc\hosts
[2010/05/27 19:09:37 | 000,013,646 | —- | M] () – D:\WINDOWS\System32\wpa.dbl
[2010/05/26 23:07:55 | 000,020,169 | —- | M] () – D:\Documents and Settings\John\Desktop\AAA.jpg
[2010/05/26 19:40:40 | 000,073,704 | —- | M] () – D:\Documents and Settings\John\Desktop\27731_408587167544_182240747544_4204822_6439840_n.jpg
[2010/05/26 16:06:58 | 003,699,648 | R— | M] () – D:\Documents and Settings\John\Desktop\ComboFix.exe
[2010/05/25 22:26:58 | 085,906,573 | —- | M] () – D:\Documents and Settings\John\Desktop\Fresh Kuts DJ Mix Feb 2010 1.mp3
[2010/05/24 16:07:35 | 000,132,096 | —- | M] () – D:\Documents and Settings\John\Desktop\RootRepeal.exe
[2010/05/24 07:48:01 | 000,000,284 | —- | M] () – D:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/05/22 09:53:16 | 000,100,908 | —- | M] () – D:\Documents and Settings\John\Desktop\SystemLook.exe
[2010/05/22 09:31:24 | 000,000,176 | —- | M] () – D:\Documents and Settings\John\defogger_reenable
[2010/05/22 09:30:20 | 000,050,477 | —- | M] () – D:\Documents and Settings\John\Desktop\Defogger.exe
[2010/05/19 23:10:30 | 000,284,915 | —- | M] () – D:\Documents and Settings\John\Desktop\gmer.zip
[2010/05/19 23:00:24 | 000,571,904 | —- | M] (OldTimer Tools) – D:\Documents and Settings\John\Desktop\OTL.exe
[2010/05/13 23:51:18 | 000,001,450 | —- | M] () – D:\Documents and Settings\John\Desktop\DivX Movies.lnk
[2010/05/09 21:59:55 | 000,000,069 | —- | M] () – D:\WINDOWS\NeroDigital.ini
[2010/05/08 10:54:12 | 000,157,204 | —- | M] () – D:\WINDOWS\hphins26.dat
[2010/05/08 10:53:44 | 000,000,000 | —- | M] () – D:\Documents and Settings\John\Ÿ9Ÿ9
[2010/05/08 10:48:07 | 000,001,862 | —- | M] () – D:\Documents and Settings\All Users\Desktop\HP Photosmart Essential 2.5.lnk
[2010/05/08 10:47:35 | 000,001,964 | —- | M] () – D:\Documents and Settings\All Users\Desktop\Shop for HP Supplies.lnk
[2010/05/08 10:46:45 | 000,001,812 | —- | M] () – D:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2010/05/08 10:46:31 | 000,000,988 | —- | M] () – D:\Documents and Settings\All Users\Desktop\HP Solution Center.lnk
[2010/04/29 15:39:38 | 000,038,224 | —- | M] (Malwarebytes Corporation) – D:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/04/29 15:39:26 | 000,020,952 | —- | M] (Malwarebytes Corporation) – D:\WINDOWS\System32\drivers\mbam.sys
========== Files Created - No Company Name ==========
[2010/05/26 23:07:55 | 000,020,169 | —- | C] () – D:\Documents and Settings\John\Desktop\AAA.jpg
[2010/05/26 19:40:40 | 000,073,704 | —- | C] () – D:\Documents and Settings\John\Desktop\27731_408587167544_182240747544_4204822_6439840_n.jpg
[2010/05/25 22:26:12 | 085,906,573 | —- | C] () – D:\Documents and Settings\John\Desktop\Fresh Kuts DJ Mix Feb 2010 1.mp3
[2010/05/24 16:11:03 | 000,256,512 | —- | C] () – D:\WINDOWS\PEV.exe
[2010/05/24 16:11:03 | 000,098,816 | —- | C] () – D:\WINDOWS\sed.exe
[2010/05/24 16:11:03 | 000,080,412 | —- | C] () – D:\WINDOWS\grep.exe
[2010/05/24 16:11:03 | 000,077,312 | —- | C] () – D:\WINDOWS\MBR.exe
[2010/05/24 16:11:03 | 000,068,096 | —- | C] () – D:\WINDOWS\zip.exe
[2010/05/24 16:09:11 | 003,699,648 | R— | C] () – D:\Documents and Settings\John\Desktop\ComboFix.exe
[2010/05/24 16:07:35 | 000,132,096 | —- | C] () – D:\Documents and Settings\John\Desktop\RootRepeal.exe
[2010/05/22 09:53:16 | 000,100,908 | —- | C] () – D:\Documents and Settings\John\Desktop\SystemLook.exe
[2010/05/22 09:31:18 | 000,000,176 | —- | C] () – D:\Documents and Settings\John\defogger_reenable
[2010/05/22 09:30:20 | 000,050,477 | —- | C] () – D:\Documents and Settings\John\Desktop\Defogger.exe
[2010/05/19 23:10:41 | 000,293,376 | —- | C] () – D:\Documents and Settings\John\Desktop\gmer.exe
[2010/05/19 23:10:30 | 000,284,915 | —- | C] () – D:\Documents and Settings\John\Desktop\gmer.zip
[2010/05/13 23:51:18 | 000,001,450 | —- | C] () – D:\Documents and Settings\John\Desktop\DivX Movies.lnk
[2010/05/13 23:50:20 | 000,000,882 | —- | C] () – D:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/05/13 23:50:20 | 000,000,878 | —- | C] () – D:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/05/08 10:53:44 | 000,000,000 | —- | C] () – D:\Documents and Settings\John\Ÿ9Ÿ9
[2010/05/08 10:48:07 | 000,001,862 | —- | C] () – D:\Documents and Settings\All Users\Desktop\HP Photosmart Essential 2.5.lnk
[2010/05/08 10:47:35 | 000,001,964 | —- | C] () – D:\Documents and Settings\All Users\Desktop\Shop for HP Supplies.lnk
[2010/05/08 10:46:45 | 000,001,812 | —- | C] () – D:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2010/05/08 10:46:31 | 000,000,988 | —- | C] () – D:\Documents and Settings\All Users\Desktop\HP Solution Center.lnk
[2010/05/08 10:37:28 | 000,157,204 | —- | C] () – D:\WINDOWS\hphins26.dat
[2010/05/08 10:37:28 | 000,001,128 | —- | C] () – D:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2010/05/08 10:37:28 | 000,000,787 | —- | C] () – D:\WINDOWS\hphmdl26.dat
[2010/02/28 15:44:15 | 000,484,352 | —- | C] () – D:\WINDOWS\System32\lame_enc.dll
[2009/09/22 18:28:42 | 000,354,816 | —- | C] () – D:\WINDOWS\System32\psisdecd.dll
[2009/09/20 06:11:42 | 000,122,368 | —- | C] () – D:\WINDOWS\lua5.1.dll
[2009/08/29 15:17:06 | 000,043,520 | —- | C] () – D:\WINDOWS\System32\CmdLineExt03.dll
[2009/07/13 03:04:28 | 009,277,440 | —- | C] () – D:\WINDOWS\avcodec-52.dll
[2009/07/13 03:04:28 | 000,751,104 | —- | C] () – D:\WINDOWS\avformat-52.dll
[2009/07/13 03:04:28 | 000,218,624 | —- | C] () – D:\WINDOWS\swscale-0.dll
[2009/07/13 03:04:28 | 000,070,144 | —- | C] () – D:\WINDOWS\avutil-50.dll
[2009/04/22 00:19:06 | 000,172,173 | —- | C] () – D:\WINDOWS\System32\xlive.dll.cat
[2009/04/14 15:22:09 | 000,000,069 | —- | C] () – D:\WINDOWS\NeroDigital.ini
[2009/04/07 05:42:11 | 000,000,962 | R— | C] () – D:\WINDOWS\System32\AsusSetup.ini
[2009/04/07 05:42:11 | 000,000,403 | R— | C] () – D:\WINDOWS\System32\raidmgmt.ini
[2009/04/07 05:39:37 | 000,034,695 | —- | C] () – D:\WINDOWS\Ascd_log.ini
[2009/04/07 05:39:19 | 000,034,389 | —- | C] () – D:\WINDOWS\Ascd_tmp.ini
[2009/04/07 05:39:00 | 000,010,288 | —- | C] () – D:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2009/04/07 04:57:23 | 000,286,720 | —- | C] () – D:\WINDOWS\System32\nvnt4cpl.dll
[2009/04/07 04:57:21 | 000,005,810 | —- | C] () – D:\WINDOWS\System32\drivers\ASACPI.sys
[2009/03/27 10:03:00 | 001,724,416 | —- | C] () – D:\WINDOWS\System32\nvwdmcpl.dll
[2009/03/27 10:03:00 | 001,503,232 | —- | C] () – D:\WINDOWS\System32\nview.dll
[2009/03/27 10:03:00 | 001,101,824 | —- | C] () – D:\WINDOWS\System32\nvwimg.dll
[2009/03/27 10:03:00 | 000,466,944 | —- | C] () – D:\WINDOWS\System32\nvshell.dll
[2008/10/07 09:13:30 | 000,197,912 | —- | C] () – D:\WINDOWS\System32\physxcudart_20.dll
[2008/10/07 09:13:22 | 000,058,648 | —- | C] () – D:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – D:\WINDOWS\System32\AgCPanelSwedish.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – D:\WINDOWS\System32\AgCPanelSpanish.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – D:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – D:\WINDOWS\System32\AgCPanelPortugese.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – D:\WINDOWS\System32\AgCPanelKorean.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – D:\WINDOWS\System32\AgCPanelJapanese.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – D:\WINDOWS\System32\AgCPanelGerman.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – D:\WINDOWS\System32\AgCPanelFrench.dll
[2004/08/04 08:00:00 | 000,002,304 | —- | C] () – D:\WINDOWS\System32\isaxbox.sys
[2004/02/20 16:36:34 | 000,416,256 | —- | C] () – D:\WINDOWS\exchndl.dll
< End of report >
Computer seems to be running with no problems
——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Friday, May 28, 2010
Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Friday, May 28, 2010 14:16:06
Records in database: 4194561
——————————————————————————–
Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes
Scan area - My Computer:
C:\
D:\
E:\
Scan statistics:
Objects scanned: 289691
Threats found: 8
Infected objects found: 18
Suspicious objects found: 4
Scan duration: 03:39:16
File name / Threat / Threats count
C:\Saved Stuff\Backup Drivers\Driver Backup 3-8-2009-173259.exe Infected: Virus.Win32.Parite.b 1
C:\Saved Stuff\John.TRINITY\My Documents\Progs\Nero 8.3.2.1 with Activation\Nero-8.3.2.1b_eng_trial.exe Infected: Virus.Win32.Parite.b 1
C:\Saved Stuff\John.TRINITY\My Documents\Progs\NextUp - Text Aloud + AT&T; Natural Voices + NeoSpeech Voices + SERIAL\Audrey16bu.exe Infected: Virus.Win32.Parite.b 1
C:\Saved Stuff\John.TRINITY\My Documents\Progs\NextUp - Text Aloud + AT&T; Natural Voices + NeoSpeech Voices + SERIAL\Crystal16dr.exe Infected: Virus.Win32.Parite.b 1
C:\Saved Stuff\John.TRINITY\My Documents\Progs\NextUp - Text Aloud + AT&T; Natural Voices + NeoSpeech Voices + SERIAL\Kate3.exe Infected: Virus.Win32.Parite.b 1
C:\Saved Stuff\John.TRINITY\My Documents\Progs\NextUp - Text Aloud + AT&T; Natural Voices + NeoSpeech Voices + SERIAL\Mike16ni.exe Infected: Virus.Win32.Parite.b 1
C:\Saved Stuff\John.TRINITY\My Documents\Progs\NextUp - Text Aloud + AT&T; Natural Voices + NeoSpeech Voices + SERIAL\Paul3.exe Infected: Virus.Win32.Parite.b 1
D:\Documents and Settings\John\Local Settings\Application Data\Identities\{6006CD92-4D66-4058-A143-CEA9FA3E6692}\Microsoft\Outlook Express\Deleted Items.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 4
D:\Qoobox\Quarantine\D\Documents and Settings\John\Application Data\ATManager\apmanager.exe.vir Infected: not-a-virus:FraudTool.Win32.Agent.asn 1
D:\Qoobox\Quarantine\D\Documents and Settings\John\Application Data\mtl.dll.vir Infected: Trojan-Ransom.Win32.Winac.a 1
D:\Qoobox\Quarantine\D\Documents and Settings\John\Local Settings\Application Data\nsgsnudvf\viwifsjtssd.exe.vir Infected: Trojan.Win32.FraudPack.awjx 1
D:\Qoobox\Quarantine\D\WINDOWS\Fvuvia.exe.vir Infected: Trojan.Win32.Genome.jxmb 1
D:\Qoobox\Quarantine\[4]-Submit_2010-05-27_19.01.09.zip Infected: not-a-virus:FraudTool.Win32.Agent.asn 1
D:\System Volume Information\_restore{0B1F65EE-CB93-4655-969A-9909828700D5}\RP7\A0006109.exe Infected: not-a-virus:FraudTool.Win32.Agent.asn 1
D:\System Volume Information\_restore{0B1F65EE-CB93-4655-969A-9909828700D5}\RP7\A0006112.dll Infected: Trojan-Ransom.Win32.Winac.a 1
D:\System Volume Information\_restore{0B1F65EE-CB93-4655-969A-9909828700D5}\RP7\A0006113.exe Infected: Trojan.Win32.FraudPack.awjx 1
D:\System Volume Information\_restore{0B1F65EE-CB93-4655-969A-9909828700D5}\RP7\A0006115.exe Infected: Trojan.Win32.Genome.jxmb 1
D:\WINDOWS\system32\drivers\etc\hosts.20090424-143124.backup Infected: Trojan.Win32.Qhost.mcf 1
D:\WINDOWS\system32\isaxbox.sys Infected: Rootkit.Win32.Tiny.ic 1
Selected area has been scanned.
MBAM Log
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 4152
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
5/28/2010 5:28:11 PM
mbam-log-2010-05-28 (17-28-11).txt
Scan type: Quick scan
Objects scanned: 133760
Time elapsed: 3 minute(s), 43 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
D:\Documents and Settings\John\Desktop\ATManager.lnk (Rogue.ATManager) -> Quarantined and deleted successfully.
OTL Log
OTL logfile created on: 5/28/2010 6:18:18 PM - Run 2
OTL by OldTimer - Version 3.2.5.0 Folder = D:\Documents and Settings\John\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 69.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 88.00% Paging File free
Paging file location(s): D:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = D: | %SystemRoot% = D:\WINDOWS | %ProgramFiles% = D:\Program Files
Drive C: | 111.78 Gb Total Space | 17.55 Gb Free Space | 15.70% Space Free | Partition Type: NTFS
Drive D: | 465.75 Gb Total Space | 165.87 Gb Free Space | 35.61% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: TRINITY
Current User Name: John
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
========== Processes (SafeList) ==========
PRC - D:\Documents and Settings\John\Desktop\OTL.exe (OldTimer Tools)
PRC - D:\Program Files\MediaMall\MediaMallServer.exe (MediaMall Technologies, Inc.)
PRC - D:\Program Files\MediaMall\PlayOn.exe (MediaMall Technologies, Inc.)
PRC - D:\Program Files\Orb Networks\Orb\bin\OrbLauncher.exe (Orb Networks)
PRC - D:\Program Files\Orb Networks\Orb\bin\OrbMediaService.exe (Orb Networks)
PRC - D:\Program Files\Orb Networks\Orb\bin\Orb.exe (Orb Networks, Inc.)
PRC - D:\Program Files\Avanquest\SystemSuite\MXTask2.exe (Avanquest North America, Inc.)
PRC - D:\Program Files\Avanquest\SystemSuite\MXTask.exe (Avanquest North America, Inc.)
PRC - D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - D:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
PRC - D:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - D:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe (Logitech Inc.)
PRC - D:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe (Logitech Inc.)
PRC - D:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe (Logitech Inc.)
PRC - D:\Program Files\Logitech\GamePanel Software\Applets\LCDMedia.exe (Logitech Inc.)
PRC - D:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe (Logitech Inc.)
PRC - D:\Program Files\Common Files\AntiVirus\SBAMSvc.exe (Sunbelt Software)
PRC - D:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - D:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE (SEIKO EPSON CORPORATION)
PRC - D:\Program Files\Microsoft Broadband Networking\MSBNTray.exe (Microsoft Corporation)
PRC - D:\WINDOWS\system32\devldr32.exe (Creative Technology Ltd.)
========== Modules (SafeList) ==========
MOD - D:\Documents and Settings\John\Desktop\OTL.exe (OldTimer Tools)
MOD - D:\Program Files\Avanquest\SystemSuite\WinHook.dll (Avanquest North America, Inc.)
MOD - D:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
========== Win32 Services (SafeList) ==========
SRV - (DAUpdaterSvc) – D:\Program Files\Dragon Age\bin_ship\daupdatersvc.service.exe (BioWare)
SRV - (MediaMall Server) – D:\Program Files\MediaMall\MediaMallServer.exe (MediaMall Technologies, Inc.)
SRV - (OrbMediaService) – D:\Program Files\Orb Networks\Orb\bin\OrbMediaService.exe (Orb Networks)
SRV - (FLEXnet Licensing Service) – D:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (SystemSuite Task Manager) – D:\Program Files\Avanquest\SystemSuite\MXTask.exe (Avanquest North America, Inc.)
SRV - (IntuitUpdateService) – D:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
SRV - (YahooAUService) – D:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (SBAMSvc) – D:\Program Files\Common Files\AntiVirus\SBAMSvc.exe (Sunbelt Software)
SRV - (Adobe Version Cue CS4) – D:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe (Adobe Systems Incorporated)
SRV - (EPSON_PM_RPCV4_01) EPSON V3 Service4(01) – D:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE (SEIKO EPSON CORPORATION)
========== Driver Services (SafeList) ==========
DRV - (sptd) – D:\WINDOWS\System32\Drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (nv) – D:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (hotcore3) – D:\WINDOWS\system32\DRIVERS\hotcore3.sys (Paragon Software Group)
DRV - (Uim_IM) – D:\WINDOWS\system32\drivers\Uim_IM.sys (Paragon)
DRV - (UimBus) – D:\WINDOWS\system32\drivers\UimBus.sys (Windows ® 2000 DDK provider)
DRV - (LMouFilt) – D:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) – D:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (SBRE) – D:\WINDOWS\system32\drivers\SBREDrv.sys (Sunbelt Software)
DRV - (sbtis) – D:\WINDOWS\system32\drivers\sbtis.sys (Sunbelt Software)
DRV - (TFilter) – D:\Program Files\Avanquest\SystemSuite\TFilter.sys (Avanquest North America, Inc.)
DRV - (nvgts) – D:\WINDOWS\system32\DRIVERS\nvgts.sys (NVIDIA Corporation)
DRV - (adfs) – D:\WINDOWS\system32\drivers\adfs.sys (Adobe Systems, Inc.)
DRV - (sbapifs) – D:\WINDOWS\system32\drivers\sbapifs.sys (Sunbelt Software)
DRV - (sbaphd) – D:\WINDOWS\system32\drivers\sbaphd.sys (Sunbelt Software)
DRV - (gameenum) – D:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) – D:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (nvnetbus) – D:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) – D:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (RTLWUSB) – D:\WINDOWS\system32\drivers\RTL8187.sys (Realtek Semiconductor Corporation )
DRV - (nvata) – D:\WINDOWS\system32\DRIVERS\nvata.sys (NVIDIA Corporation)
DRV - (AmdK8) – D:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (SjyPkt) – D:\WINDOWS\system32\drivers\SjyPkt.sys (Windows ® 2000 DDK provider)
DRV - (SI3132) – D:\WINDOWS\system32\DRIVERS\SI3132.sys (Silicon Image, Inc.)
DRV - (SiFilter) – D:\WINDOWS\system32\DRIVERS\SiWinAcc.sys (Silicon Image, Inc.)
DRV - (MTsensor) – D:\WINDOWS\system32\drivers\ASACPI.sys ()
DRV - (MSW_USB) – D:\WINDOWS\system32\drivers\MN510-51.sys (Microsoft, Inc.)
DRV - (sfman) Creative SoundFont Manager Driver (WDM) – D:\WINDOWS\system32\drivers\sfman.sys (Creative Technology Ltd.)
DRV - (ctljystk) – D:\WINDOWS\system32\drivers\ctljystk.sys (Creative Technology Ltd.)
DRV - (emu10k) Creative SB Live! series(WDM) – D:\WINDOWS\system32\drivers\emu10k1f.sys (Creative Technology Ltd.)
DRV - (emu10k1) Creative Interface Manager Driver (WDM) – D:\WINDOWS\system32\drivers\ctlface.sys (Creative Technology Ltd.)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "AIM Search"
FF - prefs.js..browser.search.defaulturl: "http://aim.search.aol.com/search/search?query={searchTerms}&invocationType;=tb50-ff-aim-chromesbox-en-us"
FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-type: "${8}"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: {e1170235-2845-420c-acc3-42261a29dd46}:4.0.1
FF - prefs.js..extensions.enabledItems: {4d855a8a-1536-4aa8-bf99-da2362910205}:[removed]
FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.4
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:2.2.0
FF - prefs.js..extensions.enabledItems: {B17C1C5A-04B1-11DB-9804-B622A1EF5492}:1.2
FF - prefs.js..extensions.enabledItems: paypalfirefoxplugin@orbiscom:[removed]
FF - prefs.js..extensions.enabledItems: {37E4D8EA-8BDA-4831-8EA1-89053939A250}:3.0.0.1
FF - prefs.js..extensions.enabledItems: {7b13ec3e-999a-4b70-b9cb-2617b8323822}:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:7
FF - prefs.js..keyword.URL: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType;=tb50-ff-aim-ab-en-us&query;="
FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: D:\Program Files\Avanquest\SystemSuite\Firefox [2009/04/07 06:11:10 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{4d855a8a-1536-4aa8-bf99-da2362910205}: D:\Program Files\Avanquest\SystemSuite\Firefox3DV [2009/04/07 06:15:13 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\paypalfirefoxplugin@orbiscom: D:\Program Files\PayPal\PayPal Plug-In [2010/02/19 08:45:11 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Components: D:\Program Files\Mozilla Firefox\components [2010/05/07 15:03:47 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Plugins: D:\Program Files\Mozilla Firefox\plugins [2010/05/27 19:29:54 | 000,000,000 | —D | M]
[2009/04/07 05:53:19 | 000,000,000 | —D | M] – D:\Documents and Settings\John\Application Data\Mozilla\Extensions
[2010/05/27 19:33:33 | 000,000,000 | —D | M] – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\extensions
[2009/12/30 19:29:08 | 000,000,000 | —D | M] (FaceFun) – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\extensions\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}
[2010/04/26 20:19:24 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/10/16 05:26:22 | 000,000,000 | —D | M] (PDF Download) – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250}
[2009/12/30 19:44:33 | 000,000,000 | —D | M] (Dogpile Bundle Toolbar) – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\extensions\{517ca167-b6e8-4397-a0b4-a0074bbe3d5b}
[2009/06/04 18:11:03 | 000,000,000 | —D | M] (IE Tab) – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
[2010/03/18 18:49:15 | 000,000,000 | —D | M] (Zynga Toolbar) – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}
[2009/04/07 06:44:38 | 000,000,000 | —D | M] (FireFTP) – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}
[2009/08/06 18:34:02 | 000,000,000 | —D | M] (Password Exporter) – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\extensions\{B17C1C5A-04B1-11DB-9804-B622A1EF5492}
[2010/01/22 06:12:54 | 000,000,000 | —D | M] (Clipmarks) – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\extensions\{e1170235-2845-420c-acc3-42261a29dd46}
[2010/03/02 19:29:48 | 000,000,000 | —D | M] – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\extensions\[removed]
[2010/02/19 08:34:57 | 000,004,546 | —- | M] () – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\searchplugins\aim-search.xml
[2009/12/30 20:51:21 | 000,001,070 | —- | M] () – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\searchplugins\dogpile-search.xml
[2009/10/15 17:41:55 | 000,002,138 | —- | M] () – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\searchplugins\MySpace.xml
[2009/04/18 17:31:54 | 000,001,368 | —- | M] () – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\searchplugins\nextag.xml
[2010/05/22 01:54:38 | 000,002,363 | —- | M] () – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\searchplugins\search-the-web.xml
[2009/04/18 17:20:30 | 000,001,088 | —- | M] () – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\searchplugins\thottbot-wow.xml
[2009/05/08 16:36:13 | 000,000,945 | —- | M] () – D:\Documents and Settings\John\Application Data\Mozilla\Firefox\Profiles\efoa129p.default\searchplugins\youtube-video-search.xml
[2010/05/27 19:33:33 | 000,000,000 | —D | M] – D:\Program Files\Mozilla Firefox\extensions
[2009/09/05 11:30:03 | 000,238,776 | —- | M] (Pando Networks) – D:\Program Files\Mozilla Firefox\plugins\npPandoWebInst.dll
O1 HOSTS File: ([2010/05/27 19:17:45 | 000,000,027 | —- | M]) - D:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - D:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O2 - BHO: (no name) - {0347C33E-8762-4905-BF09-768834316C61} - No CLSID value found.
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - D:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()
O2 - BHO: (no name) - {21608B66-026F-4DCB-9244-0DACA328DCED} - No CLSID value found.
O2 - BHO: (XPL LinkScannerIE) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - D:\Program Files\Avanquest\SystemSuite\LinkScannerIE.dll (Exploit Prevention Labs, Inc.)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (DataVault Object) - {8373ADC0-6330-11DD-9D77-22C856D89593} - D:\Program Files\Avanquest\SystemSuite\IE_ContextMenu_Vault.dll (Avanquest North America, Inc.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - No CLSID value found.
O2 - BHO: (OToolbarHelper Class) - {EAD3A971-6A23-4246-8691-C9244E858967} - D:\Program Files\PayPal\PayPal Plug-In\PayPalHelper.dll ()
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - D:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll (Yahoo! Inc)
O2 - BHO: (no name) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - D:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()
O3 - HKLM\..\Toolbar: (PayPal Plug-In) - {DC0F2F93-27FA-4f84-ACAA-9416F90B9511} - D:\Program Files\PayPal\PayPal Plug-In\OToolbar.dll ()
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (TextAloud) - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - D:\Program Files\TextAloud\TAForIE.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe_ID0ENQBO] D:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4Tray.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] D:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] D:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [Launch LCDMon] D:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe (Logitech Inc.)
O4 - HKLM..\Run: [Launch LGDCore] D:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe (Logitech Inc.)
O4 - HKLM..\Run: [Launch LgDevAgt] D:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe (Logitech Inc.)
O4 - HKLM..\Run: [NvCplDaemon] D:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [Orb] D:\Program Files\Orb Networks\Orb\bin\OrbLauncher.exe (Orb Networks)
O4 - HKCU..\Run: [Messenger (Yahoo!)] D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [PlayOn] D:\Program Files\MediaMall\PlayOn.exe (MediaMall Technologies, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [uTorrent] D:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - Startup: D:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Broadband Networking.lnk = D:\WINDOWS\Installer\{8CC15633-2327-43F4-BA85-B83FDB4B59BE}\_18be6784.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Append Link Target to Existing PDF - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: E&xport; to Microsoft Excel - D:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab (System Requirements Lab Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1239115665796 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1240094785812 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - D:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - D:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - D:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - D:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - D:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: D:\Documents and Settings\John\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: D:\Documents and Settings\John\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/04/07 04:52:36 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2010/05/28 17:30:12 | 000,000,000 | —D | C] – D:\Documents and Settings\All Users\Application Data\Gosu
[2010/05/27 19:31:33 | 000,000,000 | -HSD | C] – D:\RECYCLER
[2010/05/24 16:11:03 | 000,212,480 | —- | C] (SteelWerX) – D:\WINDOWS\SWXCACLS.exe
[2010/05/24 16:11:03 | 000,161,792 | —- | C] (SteelWerX) – D:\WINDOWS\SWREG.exe
[2010/05/24 16:11:03 | 000,136,704 | —- | C] (SteelWerX) – D:\WINDOWS\SWSC.exe
[2010/05/24 16:11:03 | 000,031,232 | —- | C] (NirSoft) – D:\WINDOWS\NIRCMD.exe
[2010/05/24 16:10:54 | 000,000,000 | —D | C] – D:\Qoobox
[2010/05/22 09:36:49 | 000,000,000 | —D | C] – D:\_OTL
[2010/05/19 23:00:24 | 000,571,904 | —- | C] (OldTimer Tools) – D:\Documents and Settings\John\Desktop\OTL.exe
[2010/05/15 20:24:49 | 000,000,000 | —D | C] – D:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/05/15 20:24:48 | 000,000,000 | —D | C] – D:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/05/14 21:17:52 | 000,000,000 | —D | C] – D:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2010/05/14 19:53:36 | 000,000,000 | —D | C] – D:\spoolerlogs
[2010/05/13 23:50:27 | 000,000,000 | —D | C] – D:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2010/05/13 23:50:26 | 000,000,000 | —D | C] – D:\Documents and Settings\John\Local Settings\Application Data\Temp
[2010/05/13 23:50:21 | 000,000,000 | —D | C] – D:\Program Files\Common Files\DivX Shared
[2010/05/13 23:50:18 | 000,000,000 | —D | C] – D:\Documents and Settings\John\Local Settings\Application Data\Google
[2010/05/13 23:50:16 | 000,000,000 | —D | C] – D:\Program Files\Google
[2010/05/13 23:50:13 | 000,000,000 | —D | C] – D:\Program Files\DivX
[2010/05/13 23:50:06 | 000,000,000 | —D | C] – D:\Documents and Settings\All Users\Application Data\DivX
[2010/05/09 20:13:55 | 000,000,000 | —D | C] – D:\Documents and Settings\All Users\Application Data\WEBREG
[2010/05/08 10:53:53 | 000,000,000 | —D | C] – D:\Documents and Settings\John\Application Data\HP
[2010/05/08 10:46:24 | 000,000,000 | —D | C] – D:\Documents and Settings\All Users\Application Data\HP Product Assistant
[2010/05/08 10:46:24 | 000,000,000 | —D | C] – D:\Documents and Settings\All Users\Application Data\HP
[2010/05/08 10:46:06 | 000,000,000 | —D | C] – D:\Program Files\Common Files\HP
[2010/05/08 10:45:31 | 000,000,000 | —D | C] – D:\Program Files\HP
[2010/05/08 10:45:19 | 000,000,000 | —D | C] – D:\Config.Msi
[2010/05/08 10:37:23 | 000,000,000 | —D | C] – D:\Documents and Settings\All Users\Application Data\Hewlett-Packard
[2010/05/08 10:37:15 | 000,271,704 | R— | C] (Hewlett-Packard) – D:\WINDOWS\System32\hpzids01.dll
[2010/05/08 10:37:11 | 000,117,760 | —- | C] (Hewlett-Packard Company) – D:\WINDOWS\System32\hpzll5mu.dll
[2009/04/07 04:57:24 | 000,059,392 | —- | C] ( ) – D:\WINDOWS\System32\a3d.dll
========== Files - Modified Within 30 Days ==========
[2010/05/28 18:17:05 | 000,215,383 | —- | M] () – D:\WINDOWS\System32\nvapps.xml
[2010/05/28 18:17:05 | 000,002,355 | —- | M] () – D:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Broadband Networking.lnk
[2010/05/28 18:17:02 | 000,000,878 | —- | M] () – D:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/05/28 18:00:00 | 000,000,882 | —- | M] () – D:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/05/28 17:50:03 | 000,000,310 | —- | M] () – D:\WINDOWS\tasks\Orb Index when idle.job
[2010/05/28 17:29:51 | 000,000,006 | -H– | M] () – D:\WINDOWS\tasks\SA.DAT
[2010/05/28 17:29:50 | 000,002,048 | –S- | M] () – D:\WINDOWS\bootstat.dat
[2010/05/28 17:28:55 | 007,864,320 | -H– | M] () – D:\Documents and Settings\John\NTUSER.DAT
[2010/05/28 17:17:36 | 000,000,178 | -HS- | M] () – D:\Documents and Settings\John\ntuser.ini
[2010/05/27 19:17:57 | 000,000,227 | —- | M] () – D:\WINDOWS\system.ini
[2010/05/27 19:17:45 | 000,000,027 | —- | M] () – D:\WINDOWS\System32\drivers\etc\hosts
[2010/05/27 19:09:37 | 000,013,646 | —- | M] () – D:\WINDOWS\System32\wpa.dbl
[2010/05/26 23:07:55 | 000,020,169 | —- | M] () – D:\Documents and Settings\John\Desktop\AAA.jpg
[2010/05/26 19:40:40 | 000,073,704 | —- | M] () – D:\Documents and Settings\John\Desktop\27731_408587167544_182240747544_4204822_6439840_n.jpg
[2010/05/26 16:06:58 | 003,699,648 | R— | M] () – D:\Documents and Settings\John\Desktop\ComboFix.exe
[2010/05/25 22:26:58 | 085,906,573 | —- | M] () – D:\Documents and Settings\John\Desktop\Fresh Kuts DJ Mix Feb 2010 1.mp3
[2010/05/24 16:07:35 | 000,132,096 | —- | M] () – D:\Documents and Settings\John\Desktop\RootRepeal.exe
[2010/05/24 07:48:01 | 000,000,284 | —- | M] () – D:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/05/22 09:53:16 | 000,100,908 | —- | M] () – D:\Documents and Settings\John\Desktop\SystemLook.exe
[2010/05/22 09:31:24 | 000,000,176 | —- | M] () – D:\Documents and Settings\John\defogger_reenable
[2010/05/22 09:30:20 | 000,050,477 | —- | M] () – D:\Documents and Settings\John\Desktop\Defogger.exe
[2010/05/19 23:10:30 | 000,284,915 | —- | M] () – D:\Documents and Settings\John\Desktop\gmer.zip
[2010/05/19 23:00:24 | 000,571,904 | —- | M] (OldTimer Tools) – D:\Documents and Settings\John\Desktop\OTL.exe
[2010/05/13 23:51:18 | 000,001,450 | —- | M] () – D:\Documents and Settings\John\Desktop\DivX Movies.lnk
[2010/05/09 21:59:55 | 000,000,069 | —- | M] () – D:\WINDOWS\NeroDigital.ini
[2010/05/08 10:54:12 | 000,157,204 | —- | M] () – D:\WINDOWS\hphins26.dat
[2010/05/08 10:53:44 | 000,000,000 | —- | M] () – D:\Documents and Settings\John\Ÿ9Ÿ9
[2010/05/08 10:48:07 | 000,001,862 | —- | M] () – D:\Documents and Settings\All Users\Desktop\HP Photosmart Essential 2.5.lnk
[2010/05/08 10:47:35 | 000,001,964 | —- | M] () – D:\Documents and Settings\All Users\Desktop\Shop for HP Supplies.lnk
[2010/05/08 10:46:45 | 000,001,812 | —- | M] () – D:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2010/05/08 10:46:31 | 000,000,988 | —- | M] () – D:\Documents and Settings\All Users\Desktop\HP Solution Center.lnk
[2010/04/29 15:39:38 | 000,038,224 | —- | M] (Malwarebytes Corporation) – D:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/04/29 15:39:26 | 000,020,952 | —- | M] (Malwarebytes Corporation) – D:\WINDOWS\System32\drivers\mbam.sys
========== Files Created - No Company Name ==========
[2010/05/26 23:07:55 | 000,020,169 | —- | C] () – D:\Documents and Settings\John\Desktop\AAA.jpg
[2010/05/26 19:40:40 | 000,073,704 | —- | C] () – D:\Documents and Settings\John\Desktop\27731_408587167544_182240747544_4204822_6439840_n.jpg
[2010/05/25 22:26:12 | 085,906,573 | —- | C] () – D:\Documents and Settings\John\Desktop\Fresh Kuts DJ Mix Feb 2010 1.mp3
[2010/05/24 16:11:03 | 000,256,512 | —- | C] () – D:\WINDOWS\PEV.exe
[2010/05/24 16:11:03 | 000,098,816 | —- | C] () – D:\WINDOWS\sed.exe
[2010/05/24 16:11:03 | 000,080,412 | —- | C] () – D:\WINDOWS\grep.exe
[2010/05/24 16:11:03 | 000,077,312 | —- | C] () – D:\WINDOWS\MBR.exe
[2010/05/24 16:11:03 | 000,068,096 | —- | C] () – D:\WINDOWS\zip.exe
[2010/05/24 16:09:11 | 003,699,648 | R— | C] () – D:\Documents and Settings\John\Desktop\ComboFix.exe
[2010/05/24 16:07:35 | 000,132,096 | —- | C] () – D:\Documents and Settings\John\Desktop\RootRepeal.exe
[2010/05/22 09:53:16 | 000,100,908 | —- | C] () – D:\Documents and Settings\John\Desktop\SystemLook.exe
[2010/05/22 09:31:18 | 000,000,176 | —- | C] () – D:\Documents and Settings\John\defogger_reenable
[2010/05/22 09:30:20 | 000,050,477 | —- | C] () – D:\Documents and Settings\John\Desktop\Defogger.exe
[2010/05/19 23:10:41 | 000,293,376 | —- | C] () – D:\Documents and Settings\John\Desktop\gmer.exe
[2010/05/19 23:10:30 | 000,284,915 | —- | C] () – D:\Documents and Settings\John\Desktop\gmer.zip
[2010/05/13 23:51:18 | 000,001,450 | —- | C] () – D:\Documents and Settings\John\Desktop\DivX Movies.lnk
[2010/05/13 23:50:20 | 000,000,882 | —- | C] () – D:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/05/13 23:50:20 | 000,000,878 | —- | C] () – D:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/05/08 10:53:44 | 000,000,000 | —- | C] () – D:\Documents and Settings\John\Ÿ9Ÿ9
[2010/05/08 10:48:07 | 000,001,862 | —- | C] () – D:\Documents and Settings\All Users\Desktop\HP Photosmart Essential 2.5.lnk
[2010/05/08 10:47:35 | 000,001,964 | —- | C] () – D:\Documents and Settings\All Users\Desktop\Shop for HP Supplies.lnk
[2010/05/08 10:46:45 | 000,001,812 | —- | C] () – D:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2010/05/08 10:46:31 | 000,000,988 | —- | C] () – D:\Documents and Settings\All Users\Desktop\HP Solution Center.lnk
[2010/05/08 10:37:28 | 000,157,204 | —- | C] () – D:\WINDOWS\hphins26.dat
[2010/05/08 10:37:28 | 000,001,128 | —- | C] () – D:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2010/05/08 10:37:28 | 000,000,787 | —- | C] () – D:\WINDOWS\hphmdl26.dat
[2010/02/28 15:44:15 | 000,484,352 | —- | C] () – D:\WINDOWS\System32\lame_enc.dll
[2009/09/22 18:28:42 | 000,354,816 | —- | C] () – D:\WINDOWS\System32\psisdecd.dll
[2009/09/20 06:11:42 | 000,122,368 | —- | C] () – D:\WINDOWS\lua5.1.dll
[2009/08/29 15:17:06 | 000,043,520 | —- | C] () – D:\WINDOWS\System32\CmdLineExt03.dll
[2009/07/13 03:04:28 | 009,277,440 | —- | C] () – D:\WINDOWS\avcodec-52.dll
[2009/07/13 03:04:28 | 000,751,104 | —- | C] () – D:\WINDOWS\avformat-52.dll
[2009/07/13 03:04:28 | 000,218,624 | —- | C] () – D:\WINDOWS\swscale-0.dll
[2009/07/13 03:04:28 | 000,070,144 | —- | C] () – D:\WINDOWS\avutil-50.dll
[2009/04/22 00:19:06 | 000,172,173 | —- | C] () – D:\WINDOWS\System32\xlive.dll.cat
[2009/04/14 15:22:09 | 000,000,069 | —- | C] () – D:\WINDOWS\NeroDigital.ini
[2009/04/07 05:42:11 | 000,000,962 | R— | C] () – D:\WINDOWS\System32\AsusSetup.ini
[2009/04/07 05:42:11 | 000,000,403 | R— | C] () – D:\WINDOWS\System32\raidmgmt.ini
[2009/04/07 05:39:37 | 000,034,695 | —- | C] () – D:\WINDOWS\Ascd_log.ini
[2009/04/07 05:39:19 | 000,034,389 | —- | C] () – D:\WINDOWS\Ascd_tmp.ini
[2009/04/07 05:39:00 | 000,010,288 | —- | C] () – D:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2009/04/07 04:57:23 | 000,286,720 | —- | C] () – D:\WINDOWS\System32\nvnt4cpl.dll
[2009/04/07 04:57:21 | 000,005,810 | —- | C] () – D:\WINDOWS\System32\drivers\ASACPI.sys
[2009/03/27 10:03:00 | 001,724,416 | —- | C] () – D:\WINDOWS\System32\nvwdmcpl.dll
[2009/03/27 10:03:00 | 001,503,232 | —- | C] () – D:\WINDOWS\System32\nview.dll
[2009/03/27 10:03:00 | 001,101,824 | —- | C] () – D:\WINDOWS\System32\nvwimg.dll
[2009/03/27 10:03:00 | 000,466,944 | —- | C] () – D:\WINDOWS\System32\nvshell.dll
[2008/10/07 09:13:30 | 000,197,912 | —- | C] () – D:\WINDOWS\System32\physxcudart_20.dll
[2008/10/07 09:13:22 | 000,058,648 | —- | C] () – D:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – D:\WINDOWS\System32\AgCPanelSwedish.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – D:\WINDOWS\System32\AgCPanelSpanish.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – D:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – D:\WINDOWS\System32\AgCPanelPortugese.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – D:\WINDOWS\System32\AgCPanelKorean.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – D:\WINDOWS\System32\AgCPanelJapanese.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – D:\WINDOWS\System32\AgCPanelGerman.dll
[2008/10/07 09:13:20 | 000,058,648 | —- | C] () – D:\WINDOWS\System32\AgCPanelFrench.dll
[2004/08/04 08:00:00 | 000,002,304 | —- | C] () – D:\WINDOWS\System32\isaxbox.sys
[2004/02/20 16:36:34 | 000,416,256 | —- | C] () – D:\WINDOWS\exchndl.dll
< End of report >
Computer seems to be running with no problems
