Spyware / Malware / Virus Removal

Help needed

22 min read

Looking for the outcome? Ask AI

Numbz Topic Starter

Post #1June 10, 2010, 2:29 AM UTC

Hello i am new to this forum and would gladly appreciate all of your help.

Firstly, i would say that i have virus in my computer . I tried various antivirus, malware, spyware tools but besides spyware doctor, the rest of the tools could not identify or find the virus that spyware doctor found.

spyware doctor found 3 trojan, 8 worm.mevon.a and 1 exploit host file location redirect.

Malwarebytes found a trojan that spyware doctor found and delete it.
I went to search for help and i realise people used ad-aware and spybot. so i tried adaware but it only found cookies. afterwards i tried spybot and manage to find more cookies and the 2 trojans and it removed it as well. but along the deletion of the found threats there was a zip file that the remover say that could not be opened and i just pressed ok and restart the computer. after restart there was this command.com notepad that appear during startup and i didnt know what it was. so i checked online and managed to find only one person who said that it was actually spybot who initiated the notepad , the person commented that it was due to spybot not able to delete a virus in the previous virus removal but i am really unsure about this. should i rescan my computer again?

I found out from spybot that the trojan was actually megaupload toolbar which i compared the trojan registry with spyware doctor. After spybot removal, i did a scan with spyware doctor and the trojan wasn't there anymore. but the worm.mevon.a was still there. I realised too that the numbers eg. hkey_users s1-5- were similar to the trojan and it should be remnant froms megaupload toolbar but i still dont know how to thoroughly clean my com of this. Can anybody give me some help? thanks!📎Capture122.jpg

Attachments:

📎Capture2123.jpg

inzanity

Post #2June 11, 2010, 1:14 AM UTC

Hello and

I will be helping you on removing malwares on your computer. Log research takes time, so please be patient and I'd be grateful if you would note the following:

The fixes are specific to your problem and should only be used for the issues on this machine.
Do not install/uninstall anything on your computer unless advised.
Do not run any other scanning tools other than those instructed for you to use.
Follow the instructions on the order they are given.
Stay with this thread until advised when your computer is clean. Absence of symptoms does not necessarily mean a clean computer.
If you are being helped regarding this problem on another forum please advice us so that we can close this thread.
If you do not reply within 3 days after my last response, I will be asking you whether you still need assistance and if you still don't reply within 48 hours then the topic will be closed.
And lastly, if you have any questions, please ask before proceeding with any of the advised fixes.

_________________________________________________

Do the following for preparation:

Please download ERUNT from one of the following links:

ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.
Double click erunt-setup.
Choose a language then press Enter or click OK to continue.
Click Next on the Welcome window.
Install it using the default settings and choose No when asked to add ERUNT to the start up folder.
Make sure a check mark is placed beside Launch ERUNT and uncheck Show documentation.
Click Finish.
Once installed, open ERUNT.exe if it hasn't opened yet then create a registry back up.

How to create ERUNT back up:

Open ERUNT.exe, if it hasn't opened yet.
Click OK on the welcome screen.
Choose the default settings for the back up.
Make sure a check mark is placed beside System registry and Current user registry.
Click OK.
If the destination folder does not exist, ERUNT will prompt you and just click on Yes.
A confirmation window will popup when complete.
Click OK to close.

Note: To restore your registry, go to %WINDIR%\ERDNT (ex. C:\WINDOWS\ERDNT) and choose the folder which you want to restore and open ERDNT.exe

–Next–

Please download DeFogger to your desktop.
Double click DeFogger to run the tool.

The application window will appear
Click the Disable button to disable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.
Do not re-enable these drivers until otherwise instructed.

–Next–

Now for the scans:

[external image: Posted Image]
Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double click GMER.exe.
[external image: Posted Image]
If it gives you a warning about rootkit activity and asks if you want to run a full scan…click on NO, then use the following settings for a more complete scan..
In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
  [external image: Posted Image]
  Click the image to enlarge it
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "ark.txt"
Save the log where you can easily find it, such as your desktop.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Please copy and paste the report into your Post.

–Next–

OTL:

Download OTL to your desktop.
Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
Check the boxes beside LOP Check and Purity Check.
Copy and paste the following bold text into the box under Custom Scan

netsvcs
%SYSTEMDRIVE%\*.exe
c:\windows\system32\drivers\*.sys /90
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
/md5stop
CREATERESTOREPOINT
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of the OTL.txt and post it with your next reply along with the Extras.txt log.

To post in your next reply:
1. GMER log.
2. OTL logs.

inzanity

Post #3June 14, 2010, 1:16 AM UTC

Hi, It's been several days. Do you still need help on this? This thread will be closed if you don't respond within 48 hours.

Numbz

Post #4June 14, 2010, 7:27 AM UTC last edited June 14, 2010, 7:33 AM UTC

I'm sorry for the late reply. i could not get the gmer file log cause it lags my com too much but i will try it again and try to get the log. Here is the OTL log file. And do you mean that i have to close my anitvirus too when gmer.exe is performing its scan ?

OTL logfile created on: 6/12/2010 11:04:02 AM - Run 1
OTL by OldTimer - Version 3.2.6.0 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Tablet PC Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,014.00 Mb Total Physical Memory | 404.00 Mb Available Physical Memory | 40.00% Memory free
1.00 Gb Paging File | 0.00 Gb Available in Paging File | 39.00% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.28 Gb Total Space | 12.29 Gb Free Space | 32.98% Space Free | Partition Type: NTFS
Drive D: | 37.24 Gb Total Space | 3.75 Gb Free Space | 10.06% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: YOUR-32B7E84D0F
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software)
PRC - D:\Program Files\Orbitdownloader\orbitnet.exe (Orbitdownloader.com)
PRC - D:\Program Files\WIZET\MapleStory\hshield\HSUpdate.exe (AhnLab, Inc.)
PRC - C:\Program Files\SpeedFan\speedfan.exe (Almico Software (www.almico.com))
PRC - C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe (Veoh Networks)
PRC - C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe (Threat Expert Ltd.)
PRC - C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools)
PRC - C:\Program Files\Spyware Doctor\pctsAuxs.exe (PC Tools)
PRC - C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools)
PRC - D:\Program Files\Orbitdownloader\orbitdm.exe (Orbitdownloader.com)
PRC - D:\Program Files\Panasonic\VideoCam Suite 2\VideoCamSuiteAutoStart.exe (Panasonic Corporation)
PRC - C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
PRC - C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe (Logitech, Inc.)
PRC - C:\WINDOWS\system32\bgsvcgen.exe (B.H.A Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (CANON INC.)
PRC - C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe (Nuance Communications, Inc.)
PRC - C:\WINDOWS\system32\wisptis.exe (Microsoft Corporation)
PRC - C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe (FUJITSU LIMITED)
PRC - C:\WINDOWS\system32\igfxext.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
PRC - C:\Program Files\Intel\Wireless\Bin\1XConfig.exe (Intel)
PRC - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
PRC - C:\Program Files\Fujitsu\updnavi\updnavi.exe (FUJITSU LIMITED)
PRC - C:\WINDOWS\system32\o2flash.exe ()
PRC - C:\Program Files\Fujitsu\Utils\FjMnuIco.exe ()
PRC - C:\Program Files\Fujitsu\Utils\FjEvents.exe (Fujitsu Computer Systems Corporation)
PRC - C:\Program Files\Fujitsu\Utils\FjDspMon.exe (Fujitsu PC Corporation)
PRC - C:\Program Files\ltmoh\ltmoh.exe (Agere Systems)
PRC - C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe (FUJITSU LIMITED)
PRC - C:\Program Files\Common Files\Microsoft Shared\Ink\TabTip.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Microsoft Shared\Ink\TCServer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\digtizer.exe (WACOM)
PRC - C:\Program Files\Apoint2K\Hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\WINDOWS\system32\tabbtnu.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Spyware Doctor\PCTGMhk.dll (PC Tools)
MOD - C:\Program Files\Spyware Doctor\smum32.dll (PC Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll (Microsoft Corporation)
MOD - C:\Program Files\Logitech\SetPoint\lgscroll.dll (Logitech, Inc.)
MOD - C:\Program Files\ScanSoft\OmniPageSE4\OpHookSE4.dll (Nuance Communications, Inc.)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\VFuj02b1.dll (FUJITSU LIMITED)
MOD - C:\WINDOWS\system32\xpsp2res.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msvcp60.dll (Microsoft Corporation)
MOD - C:\WINDOWS\ime\SPTIP.dll (Microsoft Corporation)
MOD - C:\Program Files\Common Files\Microsoft Shared\Ink\tiptsf.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\WINDOWS\system32\MSCTFP.dll (Microsoft Corporation)
MOD - C:\WINDOWS\ime\SPGRMR.dll (Microsoft Corporation)
MOD - C:\Program Files\Common Files\Microsoft Shared\Ink\TipComponentsps.dll (Microsoft Corporation)
MOD - C:\Program Files\Windows Journal\nbmaptip.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (npggsvc) – File not found
SRV - (NipSvc) – File not found
SRV - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software)
SRV - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software)
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software)
SRV - (Browser Defender Update Service) – C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe (Threat Expert Ltd.)
SRV - (sdCoreService) – C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools)
SRV - (sdAuxService) – C:\Program Files\Spyware Doctor\pctsAuxs.exe (PC Tools)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (LBTServ) – C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (bgsvcgen) – C:\WINDOWS\System32\bgsvcgen.exe (B.H.A Corporation)
SRV - (S24EventMonitor) – C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
SRV - (EvtEng) – C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
SRV - (RegSrvc) – C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
SRV - (O2Flash) – C:\WINDOWS\system32\o2flash.exe ()
SRV - (Digitizer) – C:\WINDOWS\system32\digtizer.exe (WACOM)

========== Driver Services (SafeList) ==========

DRV - (GarenaPEngine) – C:\Documents and Settings\Administrator\Local Settings\Temp\VLLA7.tmp ()
DRV - (aswTdi) – C:\WINDOWS\system32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswSP) – C:\WINDOWS\system32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswRdr) – C:\WINDOWS\system32\drivers\aswRdr.sys (ALWIL Software)
DRV - (aswMon2) – C:\WINDOWS\system32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswFsBlk) – C:\WINDOWS\system32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (Aavmker4) – C:\WINDOWS\system32\drivers\aavmker4.sys (ALWIL Software)
DRV - (Tcpip6) – C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (Revoflt) – C:\WINDOWS\system32\drivers\revoflt.sys (VS Revo Group)
DRV - (Mkd2kfNt) – C:\WINDOWS\system32\drivers\Mkd2kfNT.sys (AhnLab, Inc.)
DRV - (btnetBUs) – C:\WINDOWS\system32\drivers\btnetBus.sys ()
DRV - (BtHidBus) – C:\WINDOWS\System32\Drivers\BtHidBus.sys (IVT Corporation.)
DRV - (PCTCore) – C:\WINDOWS\system32\drivers\PCTCore.sys (PC Tools)
DRV - (Mkd2Nadr) – C:\WINDOWS\system32\drivers\Mkd2Nadr.sys (AhnLab, Inc.)
DRV - (IvtBtBUs) – C:\WINDOWS\system32\drivers\IvtBtBus.sys (IVT Corporation.)
DRV - (vaxscsi) – C:\WINDOWS\System32\Drivers\vaxscsi.sys (Alcohol Soft Co., Ltd.)
DRV - (sptd) – C:\WINDOWS\System32\Drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (USBModem) – C:\WINDOWS\system32\drivers\lgusbmodem.sys (LG Electronics Inc.)
DRV - (UsbDiag) – C:\WINDOWS\system32\drivers\lgusbdiag.sys (LG Electronics Inc.)
DRV - (usbbus) – C:\WINDOWS\system32\drivers\lgusbbus.sys (LG Electronics Inc.)
DRV - (pccsmcfd) – C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia)
DRV - (LUsbFilt) – C:\WINDOWS\system32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (LMouFilt) – C:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) – C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (speedfan) – C:\WINDOWS\system32\speedfan.sys (Windows ® 2000 DDK provider)
DRV - (cdrbsdrv) – C:\WINDOWS\system32\drivers\cdrbsdrv.sys (B.H.A Corporation)
DRV - (EverestDriver) – C:\Documents and Settings\Administrator\My Documents\Downloads\New Folder (2)\kerneld.wnt ()
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (BlueletAudio) – C:\WINDOWS\system32\drivers\blueletaudio.sys (IVT Corporation)
DRV - (Btcsrusb) – C:\WINDOWS\system32\drivers\btcusb.sys (IVT Corporation)
DRV - (BTHidEnum) – C:\WINDOWS\system32\drivers\vbtenum.sys ()
DRV - (BTHidMgr) – C:\WINDOWS\System32\Drivers\BTHidMgr.sys (IVT Corporation)
DRV - (BT) – C:\WINDOWS\system32\drivers\BtNetDrv.sys (IVT Corporation)
DRV - (STAC97) – C:\WINDOWS\system32\drivers\STAC97.sys (SigmaTel, Inc.)
DRV - (VcommMgr) – C:\WINDOWS\system32\drivers\VcommMgr.sys (IVT Corporation)
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (O2SDRDR) – C:\WINDOWS\system32\DRIVERS\o2sd.sys (O2 Micro )
DRV - (O2MDRDR) – C:\WINDOWS\system32\DRIVERS\o2media.sys (O2Micro )
DRV - (w29n51) Intel® – C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation)
DRV - (tfsnudfa) – C:\WINDOWS\system32\dla\tfsnudfa.sys (Sonic Solutions)
DRV - (tfsnudf) – C:\WINDOWS\system32\dla\tfsnudf.sys (Sonic Solutions)
DRV - (tfsnifs) – C:\WINDOWS\system32\dla\tfsnifs.sys (Sonic Solutions)
DRV - (tfsncofs) – C:\WINDOWS\system32\dla\tfsncofs.sys (Sonic Solutions)
DRV - (tfsnboio) – C:\WINDOWS\system32\dla\tfsnboio.sys (Sonic Solutions)
DRV - (tfsnopio) – C:\WINDOWS\system32\dla\tfsnopio.sys (Sonic Solutions)
DRV - (tfsnpool) – C:\WINDOWS\system32\dla\tfsnpool.sys (Sonic Solutions)
DRV - (tfsndrct) – C:\WINDOWS\system32\dla\tfsndrct.sys (Sonic Solutions)
DRV - (tfsndres) – C:\WINDOWS\system32\dla\tfsndres.sys (Sonic Solutions)
DRV - (drvnddm) – C:\WINDOWS\system32\drivers\drvnddm.sys (Sonic Solutions)
DRV - (iaStor) – C:\WINDOWS\system32\drivers\iaStor.sys (Intel Corporation)
DRV - (sscdbhk5) – C:\WINDOWS\system32\drivers\sscdbhk5.sys (Sonic Solutions)
DRV - (ssrtln) – C:\WINDOWS\system32\drivers\ssrtln.sys (Sonic Solutions)
DRV - (O2SCBUS) – C:\WINDOWS\system32\drivers\ozscr.sys (O2Micro)
DRV - (VComm) – C:\WINDOWS\system32\drivers\VComm.sys (IVT Corporation)
DRV - (s24trans) – C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (IWCA) – C:\WINDOWS\system32\drivers\iwca.sys (Intel Corporation)
DRV - (BtnHnd) – C:\Program Files\Fujitsu\BtnHnd\BtnHnd.sys (FUJITSU LIMITED)
DRV - (drvmcdb) – C:\WINDOWS\system32\drivers\drvmcdb.sys (Sonic Solutions)
DRV - (hidpen) – C:\WINDOWS\system32\drivers\hidpen.sys (Wacom Co., Ltd)
DRV - (DX02) – C:\WINDOWS\system32\drivers\dx02.sys (Knowles Acoustics)
DRV - (FUJ02E3) – C:\WINDOWS\system32\drivers\fuj02e3.sys (FUJITSU LIMITED)
DRV - (pfc) – C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
DRV - (ApfiltrService) – C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (Fjbtndrv) – C:\WINDOWS\system32\drivers\FjBtndrv.sys (Fujitsu PC Corporation)
DRV - (LVVI500A) – C:\WINDOWS\system32\drivers\lvvi500a.sys (Logitech Inc.)
DRV - (LVBulk) – C:\WINDOWS\system32\drivers\LVBulk.sys (Logitech Inc.)
DRV - (lusbaudio) – C:\WINDOWS\system32\drivers\LVSound2.sys (Logitech Inc.)
DRV - (FUJ02E1) – C:\WINDOWS\system32\drivers\FUJ02E1.sys (Fujitsu Limited)
DRV - (irsir) – C:\WINDOWS\system32\drivers\irsir.sys (Microsoft Corporation)
DRV - (SMCIRDA) – C:\WINDOWS\system32\drivers\smcirda.sys (SMC)
DRV - (FUJ02B1) – C:\WINDOWS\system32\drivers\fuj02b1.sys (FUJITSU LIMITED)
DRV - (giveio) – C:\WINDOWS\system32\giveio.sys ()

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.live.com/sphome.aspx

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://sg.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.live.com/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://search.live.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.live.com/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.orbitdownloader.com/
IE - HKCU\..\URLSearchHook: {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre1.dll File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/06/03 18:52:18 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/06/03 18:53:37 | 000,000,000 | —D | M]

[2009/07/10 18:30:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2010/06/11 18:31:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0k9if5mn.default\extensions
[2009/11/05 18:22:07 | 000,000,000 | —D | M] (Freecorder Toolbar) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0k9if5mn.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}
[2009/09/02 23:26:53 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0k9if5mn.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/12/07 23:25:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0k9if5mn.default\extensions\[removed]
[2010/06/03 18:52:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\c5l4hguv.default\extensions
[2009/07/10 18:18:14 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\c5l4hguv.default\extensions\{40a1f5d7-afc2-498f-b264-02668d616ff6}
[2009/12/07 23:25:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\c5l4hguv.default\extensions\[removed]
[2010/06/11 18:31:46 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2010/06/09 20:19:28 | 000,405,458 | R— | M]) - C:\WINDOWS\System32\Drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.123topsearch.com
O1 - Hosts: 127.0.0.1 123topsearch.com
O1 - Hosts: 127.0.0.1 www.132.com
O1 - Hosts: 127.0.0.1 132.com
O1 - Hosts: 127.0.0.1 www.136136.net
O1 - Hosts: 127.0.0.1 136136.net
O1 - Hosts: 127.0.0.1 www.163ns.com
O1 - Hosts: 127.0.0.1 163ns.com
O1 - Hosts: 14020 more lines…
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - D:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll (Google Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll (Google Inc.)
O2 - BHO: (free-downloads.net Toolbar) - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre1.dll File not found
O3 - HKLM\..\Toolbar: (&Google; Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)
O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - D:\Program Files\Orbitdownloader\GrabPro.dll ()
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (free-downloads.net Toolbar) - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre1.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (&Google; Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - D:\Program Files\Orbitdownloader\GrabPro.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (free-downloads.net Toolbar) - {ECDEE021-0D17-467F-A1FF-C7A115230949} - C:\Program Files\free-downloads.net\tbfre1.dll File not found
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ALWIL Software)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [DrvIcon] C:\Program Files\Vista Drive Icon\DrvIcon.exe File not found
O4 - HKLM..\Run: [FjDspMon] C:\Program Files\Fujitsu\Utils\FjDspMon.exe (Fujitsu PC Corporation)
O4 - HKLM..\Run: [FjEvents] C:\Program Files\Fujitsu\Utils\FjEvents.exe (Fujitsu Computer Systems Corporation)
O4 - HKLM..\Run: [FJUPDNV_Chitose] C:\Program Files\Fujitsu\updnavi\updnavi.exe (FUJITSU LIMITED)
O4 - HKLM..\Run: [Fujitsu Menu] C:\Program Files\Fujitsu\Utils\FjMnuIco.exe ()
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [IndicatorUtility] C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe (FUJITSU LIMITED)
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [ISTray] C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [LoadBtnHnd] C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe (FUJITSU LIMITED)
O4 - HKLM..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe (Logitech Inc.)
O4 - HKLM..\Run: [LtMoh] C:\Program Files\ltmoh\ltmoh.exe (Agere Systems)
O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [Snippet] C:\Program Files\Microsoft Experience Pack\Snipping Tool\SnippingTool.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [TabletTip] C:\Program Files\Common Files\microsoft shared\ink\tabtip.exe (Microsoft Corporation)
O4 - HKLM..\Run: [TabletWizard] C:\WINDOWS\Help\splshwrp.exe (Microsoft Corporation)
O4 - HKCU..\Run: [LClock] C:\Program Files\LClock\LClock.exe File not found
O4 - HKCU..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe ()
O4 - HKCU..\Run: [VeohPlugin] C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe (Veoh Networks)
O4 - HKCU..\Run: [ViOrb] C:\Program Files\ViOrb\ViOrb.exe File not found
O4 - HKCU..\Run: [ViStart] C:\Program Files\ViStart\ViStart.exe File not found
O4 - HKCU..\Run: [VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe File not found
O4 - HKCU..\Run: [WebCamRT.exe] File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe (Logitech)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Orbit.lnk = D:\Program Files\Orbitdownloader\orbitdm.exe (Orbitdownloader.com)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VideoCam Suite 2.0.lnk = D:\Program Files\Panasonic\VideoCam Suite 2\VideoCamSuiteAutoStart.exe (Panasonic Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Toolbars present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWindowsUpdate = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetFolders = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayContextMenu = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogOff = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewOnDrive = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispCPL = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisallowRun = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWindowsUpdate = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetFolders = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayContextMenu = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogOff = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewOnDrive = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = FF FF FF FF [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoBandCustomize = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoMovingBands = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCloseDragDropBands = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetTaskbar = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoToolbarsOnTaskbar = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ClassicShell = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 4 = reg.exe (Microsoft Corporation)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 2 = zionle.exe
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 3 = zion2wc.exe
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun: 1 = zion-3-setup-wmirc.exe
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispCPL = 0
O8 - Extra context menu item: &Download; by Orbit - D:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab; video by Orbit - D:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Do&wnload; selected by Orbit - D:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load; all by Orbit - D:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O16 - DPF: {00000055-9980-0010-8000-00AA00389B71} http://codecs.microsoft.com/codecs/i386/fhg.CAB (Reg Error: Key error.)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_04)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O20 - Winlogon\Notify\IntelWireless: DllName - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll (Intel Corporation)
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O20 - Winlogon\Notify\loginkey: DllName - C:\Program Files\Common Files\Microsoft Shared\Ink\loginkey.dll - C:\Program Files\Common Files\Microsoft Shared\Ink\LoginKey.dll (Microsoft Corporation)
O20 - Winlogon\Notify\TabBtnWL: DllName - TabBtnWL.dll - C:\WINDOWS\System32\tabbtnwl.dll (Microsoft Corporation)
O20 - Winlogon\Notify\tpgwlnotify: DllName - tpgwlnot.dll - C:\WINDOWS\System32\tpgwlnot.dll (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - Unable to read "AutoRun" value or value not present!
O32 - AutoRun File - [2010/04/10 18:32:32 | 000,000,050 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2009/03/06 22:20:02 | 000,000,000 | RHSD | M] - C:\autorun.inf – [ NTFS ]
O32 - AutoRun File - [2009/03/06 22:20:04 | 000,000,000 | RHSD | M] - D:\autorun.inf – [ FAT32 ]
O33 - MountPoints2\{040089fa-9abc-11dd-aa58-0013ceedc3fe}\Shell - "" = AutoRun
O33 - MountPoints2\{040089fa-9abc-11dd-aa58-0013ceedc3fe}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{0f5786aa-abd7-11de-ba9a-0013ceedc3fe}\Shell - "" = AutoRun
O33 - MountPoints2\{0f5786aa-abd7-11de-ba9a-0013ceedc3fe}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{0f5786aa-abd7-11de-ba9a-0013ceedc3fe}\Shell\AutoRun\command - "" = F:\USBAutoRun.exe – File not found
O33 - MountPoints2\{1d9bdb06-856e-11de-ba51-0013ceedc3fe}\Shell - "" = AutoRun
O33 - MountPoints2\{1d9bdb06-856e-11de-ba51-0013ceedc3fe}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{3113f0b8-e66e-11de-bb27-0013ceedc3fe}\Shell\AutoRun\command - "" = wscript.exe system32.dll.vbe
O33 - MountPoints2\{3113f0b8-e66e-11de-bb27-0013ceedc3fe}\Shell\explore\command - "" = wscript.exe system32.dll.vbe
O33 - MountPoints2\{3113f0b8-e66e-11de-bb27-0013ceedc3fe}\Shell\open\command - "" = wscript.exe system32.dll.vbe
O33 - MountPoints2\{39bb898a-452b-11df-bbd2-0013ceedc3fe}\Shell - "" = Autorun
O33 - MountPoints2\{39bb898a-452b-11df-bbd2-0013ceedc3fe}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{39bb898a-452b-11df-bbd2-0013ceedc3fe}\Shell\Open\command - "" = regsvr.exe
O33 - MountPoints2\{7ffe5452-4939-11de-b9e2-0013ceedc3fe}\Shell - "" = AutoRun
O33 - MountPoints2\{7ffe5452-4939-11de-b9e2-0013ceedc3fe}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{7ffe5452-4939-11de-b9e2-0013ceedc3fe}\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found
O33 - MountPoints2\{7ffe5453-4939-11de-b9e2-0013ceedc3fe}\Shell\AutoRun\command - "" = c2e.exe
O33 - MountPoints2\{7ffe5453-4939-11de-b9e2-0013ceedc3fe}\Shell\open\Command - "" = c2e.exe
O33 - MountPoints2\{9efea3e6-decd-11de-bb13-0013ceedc3fe}\Shell\AutoRun\command - "" = F:\ZALJUBIT\\dousiju.exe – File not found
O33 - MountPoints2\{9efea3e6-decd-11de-bb13-0013ceedc3fe}\Shell\explore\command - "" = F:\ZALJUBIT\\dousiju.exe – File not found
O33 - MountPoints2\{9efea3e6-decd-11de-bb13-0013ceedc3fe}\Shell\open\command - "" = F:\ZALJUBIT\\dousiju.exe – File not found
O33 - MountPoints2\{c299afe9-3fbd-11df-bbc4-0013ceedc3fe}\Shell\AutoRun\command - "" = wscript.exe system32.dll.vbe
O33 - MountPoints2\{c299afe9-3fbd-11df-bbc4-0013ceedc3fe}\Shell\explore\command - "" = wscript.exe system32.dll.vbe
O33 - MountPoints2\{c299afe9-3fbd-11df-bbc4-0013ceedc3fe}\Shell\open\command - "" = wscript.exe system32.dll.vbe
O33 - MountPoints2\{dc14190e-9f32-11dd-aa5f-0013ceedc3fe}\Shell - "" = AutoRun
O33 - MountPoints2\{dc14190e-9f32-11dd-aa5f-0013ceedc3fe}\Shell\AutoRun - "" = Auto&Play;
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: Ias - C:\WINDOWS\system32\ias [2005/06/01 03:27:37 | 000,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (85018997883404288)

========== Files/Folders - Created Within 30 Days ==========

[2010/06/11 21:59:22 | 000,572,416 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2010/06/11 21:47:37 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2010/06/11 21:46:53 | 000,000,000 | —D | C] – C:\Program Files\ERUNT
[2010/06/11 17:49:51 | 000,743,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedvtool.dll
[2010/06/10 20:42:18 | 000,000,000 | —D | C] – C:\Program Files\SpeedFan
[2010/06/09 22:27:58 | 000,149,456 | —- | C] (PC Tools) – C:\WINDOWS\SGDetectionTool.dll
[2010/06/09 22:27:57 | 001,636,304 | —- | C] (Threat Expert Ltd.) – C:\WINDOWS\PCTBDCore.dll
[2010/06/09 22:27:57 | 000,165,840 | —- | C] (Threat Expert Ltd.) – C:\WINDOWS\PCTBDRes.dll
[2010/06/09 22:23:59 | 000,229,304 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctgntdi.sys
[2010/06/09 22:23:31 | 000,207,280 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\PCTCore.sys
[2010/06/09 22:23:30 | 000,087,784 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\PCTAppEvent.sys
[2010/06/09 22:23:13 | 000,070,408 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctplsg.sys
[2010/06/09 22:22:55 | 000,000,000 | —D | C] – C:\Program Files\Common Files\PC Tools
[2010/06/09 22:22:54 | 000,000,000 | —D | C] – C:\Program Files\Spyware Doctor
[2010/06/09 22:22:54 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\PC Tools
[2010/06/09 22:22:54 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\PC Tools
[2010/06/09 19:54:46 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2010/06/09 19:54:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2010/06/09 19:47:58 | 000,000,000 | —D | C] – C:\WINDOWS\System32\NtmsData
[2010/06/09 09:30:40 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/06/09 09:30:38 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/06/09 09:30:38 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/06/08 00:21:09 | 000,000,000 | —D | C] – C:\Program Files\AhnLab
[2010/06/08 00:09:06 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Sunbelt
[2010/06/08 00:08:54 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sunbelt
[2010/06/07 23:16:19 | 000,000,000 | —D | C] – C:\Program Files\Sunbelt Software
[2010/06/07 21:05:20 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\Threat Expert
[2010/06/05 17:51:42 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\VS Revo Group
[2010/06/05 17:51:09 | 000,027,064 | —- | C] (VS Revo Group) – C:\WINDOWS\System32\drivers\revoflt.sys
[2010/06/05 17:50:55 | 000,000,000 | —D | C] – C:\Program Files\VS Revo Group
[2010/06/05 15:10:26 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\IsolatedStorage
[2010/06/05 14:41:54 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\PrevxCSI
[2010/06/04 21:56:08 | 000,164,048 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2010/06/04 21:56:08 | 000,019,024 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2010/06/04 21:56:07 | 000,046,672 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2010/06/04 21:56:07 | 000,023,376 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2010/06/04 21:56:05 | 000,100,432 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2010/06/04 21:56:05 | 000,094,800 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2010/06/04 21:56:04 | 000,028,880 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2010/06/04 21:53:08 | 000,165,032 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\aswBoot.exe
[2010/06/04 21:53:08 | 000,038,848 | —- | C] (ALWIL Software) – C:\WINDOWS\System32\avastSS.scr
[2010/06/04 21:52:29 | 000,000,000 | —D | C] – C:\Program Files\Alwil Software
[2010/06/04 21:52:29 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/06/04 19:21:19 | 000,221,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MpSigStub.exe
[2010/06/04 18:47:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\Runscanner.net
[2010/06/04 16:11:48 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\McAfee
[2010/06/03 18:56:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\maple
[2010/06/02 10:04:32 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\AppData
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/06/12 11:10:05 | 000,000,438 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{89A3D8AD-309F-4E52-B9B6-F594E1E07DA7}.job
[2010/06/12 10:56:13 | 000,000,655 | —- | M] () – C:\WINDOWS\System32\msexcr.ini
[2010/06/12 10:53:04 | 000,001,010 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-529166198-2231506752-346657940-500UA.job
[2010/06/12 10:53:04 | 000,000,958 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-529166198-2231506752-346657940-500Core.job
[2010/06/12 10:53:04 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/06/12 10:52:57 | 000,000,540 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Orbit.lnk
[2010/06/12 10:51:51 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/06/11 21:59:25 | 000,572,416 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2010/06/11 21:51:29 | 012,582,912 | -H– | M] () – C:\Documents and Settings\Administrator\NTUSER.DAT
[2010/06/11 21:51:06 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Administrator\ntuser.ini
[2010/06/11 21:48:56 | 000,000,020 | —- | M] () – C:\Documents and Settings\Administrator\defogger_reenable
[2010/06/11 21:46:54 | 000,000,611 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\NTREGOPT.lnk
[2010/06/11 21:46:54 | 000,000,592 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\ERUNT.lnk
[2010/06/11 21:31:41 | 000,294,864 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/06/11 19:31:08 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/06/11 19:16:40 | 000,502,798 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/11 19:16:40 | 000,442,618 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/06/11 19:16:40 | 000,071,162 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/06/11 03:09:25 | 002,122,628 | -H– | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db
[2010/06/10 20:42:19 | 000,000,682 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\SpeedFan.lnk
[2010/06/10 20:42:18 | 000,000,045 | —- | M] () – C:\WINDOWS\System32\initdebug.nfo
[2010/06/10 20:42:18 | 000,000,000 | —- | M] () – C:\Documents and Settings\Administrator\initdebug.nfo
[2010/06/10 10:21:57 | 000,122,765 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Capture2123.jpg
[2010/06/10 10:19:32 | 000,102,585 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Capture122.jpg
[2010/06/10 00:54:20 | 000,002,344 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Google Chrome.lnk
[2010/06/09 22:50:00 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/06/09 22:23:19 | 000,001,637 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Spyware Doctor.lnk
[2010/06/09 21:26:22 | 000,000,408 | —- | M] () – C:\WINDOWS\wininit.ini
[2010/06/09 20:19:28 | 000,405,458 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/06/09 19:54:58 | 000,000,933 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Spybot - Search & Destroy.lnk
[2010/06/09 09:30:43 | 000,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/06/07 22:43:13 | 000,000,481 | —- | M] () – C:\Documents and Settings\All Users\Desktop\MapleStory.lnk
[2010/06/07 21:44:47 | 000,054,537 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\me.jpg
[2010/06/07 20:42:52 | 000,458,365 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Capture14.jpg
[2010/06/07 20:42:43 | 000,444,707 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Capture23.jpg
[2010/06/05 17:51:11 | 000,000,821 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Revo Uninstaller Pro.lnk
[2010/06/05 15:14:27 | 000,337,249 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Capture3.jpg
[2010/06/05 15:14:17 | 000,372,491 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Capture2.jpg
[2010/06/04 21:56:10 | 000,001,700 | —- | M] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2010/06/04 21:56:06 | 000,002,626 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2010/06/04 19:16:53 | 000,081,168 | —- | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/06/04 19:06:02 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/06/04 18:44:28 | 000,011,108 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\To.docx
[2010/06/04 18:44:19 | 000,000,452 | RHS- | M] () – C:\Documents and Settings\Administrator\ntuser.pol
[2010/06/03 22:59:43 | 000,000,241 | —- | M] () – C:\WINDOWS\QSync.INI
[2010/06/03 15:08:48 | 000,096,256 | —- | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/05/30 13:08:34 | 000,010,502 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Our system operates by relays.docx
[2010/05/23 20:35:21 | 000,010,101 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\websites for gpp.docx
[2010/05/21 14:14:28 | 000,221,568 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\MpSigStub.exe
[2010/05/18 00:20:24 | 000,012,756 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\Toh Yew Hong.docx
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/06/11 22:17:56 | 000,293,376 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\gmer.exe
[2010/06/11 21:48:26 | 000,000,648 | —- | C] () – C:\Documents and Settings\Administrator\defogger_disable.log
[2010/06/11 21:48:26 | 000,000,020 | —- | C] () – C:\Documents and Settings\Administrator\defogger_reenable
[2010/06/11 21:46:54 | 000,000,611 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\NTREGOPT.lnk
[2010/06/11 21:46:54 | 000,000,592 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\ERUNT.lnk
[2010/06/11 18:51:00 | 000,000,655 | —- | C] () – C:\WINDOWS\System32\msexcr.ini
[2010/06/10 20:42:19 | 000,000,682 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\SpeedFan.lnk
[2010/06/10 20:42:18 | 000,000,045 | —- | C] () – C:\WINDOWS\System32\initdebug.nfo
[2010/06/10 20:42:18 | 000,000,000 | —- | C] () – C:\Documents and Settings\Administrator\initdebug.nfo
[2010/06/10 10:21:57 | 000,122,765 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Capture2123.jpg
[2010/06/10 10:19:32 | 000,102,585 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Capture122.jpg
[2010/06/09 22:27:59 | 000,767,952 | —- | C] () – C:\WINDOWS\BDTSupport.dll
[2010/06/09 22:27:58 | 000,000,882 | —- | C] () – C:\WINDOWS\RegSDImport.xml
[2010/06/09 22:27:58 | 000,000,880 | —- | C] () – C:\WINDOWS\RegISSImport.xml
[2010/06/09 22:27:58 | 000,000,131 | —- | C] () – C:\WINDOWS\IDB.zip
[2010/06/09 22:27:57 | 001,152,470 | —- | C] () – C:\WINDOWS\UDB.zip
[2010/06/09 22:23:59 | 000,007,387 | —- | C] () – C:\WINDOWS\System32\drivers\pctgntdi.cat
[2010/06/09 22:23:31 | 000,007,412 | —- | C] () – C:\WINDOWS\System32\drivers\PCTAppEvent.cat
[2010/06/09 22:23:31 | 000,007,383 | —- | C] () – C:\WINDOWS\System32\drivers\pctcore.cat
[2010/06/09 22:23:19 | 000,001,637 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Spyware Doctor.lnk
[2010/06/09 22:23:13 | 000,007,383 | —- | C] () – C:\WINDOWS\System32\drivers\pctplsg.cat
[2010/06/09 19:54:58 | 000,000,933 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Spybot - Search & Destroy.lnk
[2010/06/09 12:01:40 | 000,011,042 | —- | C] () – C:\Documents and Settings\Administrator\FixQhost.log
[2010/06/09 09:30:43 | 000,000,696 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/06/07 22:43:13 | 000,000,481 | —- | C] () – C:\Documents and Settings\All Users\Desktop\MapleStory.lnk
[2010/06/07 21:44:46 | 000,054,537 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\me.jpg
[2010/06/07 20:42:51 | 000,458,365 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Capture14.jpg
[2010/06/07 20:42:43 | 000,444,707 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Capture23.jpg
[2010/06/05 17:51:11 | 000,000,821 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Revo Uninstaller Pro.lnk
[2010/06/05 15:14:27 | 000,337,249 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Capture3.jpg
[2010/06/05 15:14:16 | 000,372,491 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Capture2.jpg
[2010/06/04 21:56:10 | 000,001,700 | —- | C] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2010/06/04 18:44:27 | 000,011,108 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\To.docx
[2010/05/23 20:35:19 | 000,010,101 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\websites for gpp.docx
[2010/05/22 05:44:18 | 000,010,502 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Our system operates by relays.docx
[2010/05/18 00:20:21 | 000,012,756 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\Toh Yew Hong.docx
[2010/03/15 21:10:10 | 000,013,304 | —- | C] () – C:\WINDOWS\System32\drivers\BTNetFilter.sys
[2009/02/28 23:04:55 | 000,000,412 | —- | C] () – C:\WINDOWS\MAXLINK.INI
[2009/02/28 22:58:45 | 000,003,584 | —- | C] () – C:\WINDOWS\System32\CNCFLcNL.DLL
[2009/02/27 19:10:37 | 000,011,860 | —- | C] () – C:\WINDOWS\System32\drivers\vbtenum.sys
[2008/12/31 21:52:38 | 000,000,050 | —- | C] () – C:\WINDOWS\MegaManager.INI
[2008/12/07 12:44:54 | 000,022,528 | —- | C] () – C:\WINDOWS\System32\drivers\btnetBus.sys
[2008/12/02 14:25:10 | 000,000,241 | —- | C] () – C:\WINDOWS\QSync.INI
[2008/12/02 14:24:03 | 000,294,912 | —- | C] () – C:\WINDOWS\System32\liplW7.dll
[2008/12/02 14:24:02 | 000,290,816 | —- | C] () – C:\WINDOWS\System32\liplA6.dll
[2008/12/02 14:24:02 | 000,278,528 | —- | C] () – C:\WINDOWS\System32\liplPX.dll
[2008/12/02 14:24:02 | 000,278,528 | —- | C] () – C:\WINDOWS\System32\liplP6.dll
[2008/12/02 14:24:02 | 000,278,528 | —- | C] () – C:\WINDOWS\System32\liplM6.dll
[2008/12/02 14:24:02 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\lipl.dll
[2008/12/02 14:24:02 | 000,005,187 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2008/12/02 14:23:59 | 000,000,816 | —- | C] () – C:\WINDOWS\_delis32.ini
[2008/12/01 23:29:02 | 000,009,728 | —- | C] () – C:\WINDOWS\System32\BASSMOD.dll
[2008/11/15 22:42:13 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2008/10/24 00:24:59 | 000,000,004 | —- | C] () – C:\WINDOWS\System32\XPerWin.dll
[2008/10/24 00:24:56 | 000,000,037 | —- | C] () – C:\WINDOWS\System32\xsystem.dll
[2006/03/01 07:00:33 | 000,116,224 | —- | C] () – C:\WINDOWS\System32\pdfcmnnt.dll
[2005/08/09 21:31:51 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2005/08/07 04:20:10 | 000,000,408 | —- | C] () – C:\WINDOWS\wininit.ini
[2005/08/07 04:15:13 | 000,000,694 | —- | C] () – C:\WINDOWS\System32\FJSaver.ini
[2005/08/07 03:52:03 | 000,013,312 | —- | C] () – C:\WINDOWS\System32\RMDevice.dll
[2005/05/31 07:49:12 | 000,000,720 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2005/03/04 07:50:16 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2005/01/04 06:53:04 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2005/01/04 06:53:04 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\ProgressTrace.dll
[2004/08/12 22:44:10 | 000,016,384 | —- | C] () – C:\WINDOWS\System32\iwca.dll
[2003/04/11 06:04:00 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\JAWTAccessBridge.dll
[1996/04/04 03:33:26 | 000,005,248 | —- | C] () – C:\WINDOWS\System32\giveio.sys

========== LOP Check ==========

[2009/05/01 23:46:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\aAvgApi
[2006/03/01 07:24:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Alias
[2009/02/28 23:31:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Canon
[2008/12/01 17:04:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\DAEMON Tools
[2008/12/02 00:26:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\DAEMON Tools Pro
[2008/11/12 11:24:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\DMCache
[2010/06/06 14:06:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\DNA
[2010/06/03 18:58:26 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\FrostWire
[2009/06/30 22:54:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\GameRanger
[2008/08/19 19:48:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\GrabPro
[2008/10/21 17:05:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\gunz-mrb
[2006/03/01 07:00:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\HeuPrinter
[2008/10/30 22:08:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\IDM
[2010/04/10 18:27:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Leadertech
[2009/09/05 21:08:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\LG Electronics
[2008/12/31 21:44:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Megaupload
[2010/04/10 19:06:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\muvee Technologies
[2008/08/19 20:36:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Nexon
[2009/08/01 00:14:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\OpenOffice.org
[2010/06/12 10:53:26 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Orbit
[2010/04/04 15:42:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Panasonic
[2009/02/28 23:04:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\ScanSoft
[2008/12/30 23:30:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Styler
[2008/12/01 16:53:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\SystemRequirementsLab
[2008/12/30 16:42:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\vghd
[2009/08/03 21:56:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alias
[2010/06/04 21:52:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2009/02/28 22:59:32 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\CanonBJ
[2009/09/05 18:11:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Installations
[2010/03/09 20:59:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Messenger Plus!
[2010/04/10 18:30:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\muvee Technologies
[2010/04/04 15:12:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Panasonic
[2010/06/06 15:59:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PrevxCSI
[2009/02/28 23:04:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ScanSoft
[2010/04/10 18:34:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Seagate
[2010/06/12 10:53:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/06/09 22:50:00 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2010/06/12 11:10:05 | 000,000,438 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{89A3D8AD-309F-4E52-B9B6-F594E1E07DA7}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< c:\windows\system32\drivers\*.sys /90 >
[2010/05/07 04:33:29 | 000,028,880 | —- | M] (ALWIL Software) – C:\WINDOWS\system32\drivers\aavmker4.sys
[2010/05/07 04:33:47 | 000,019,024 | —- | M] (ALWIL Software) – C:\WINDOWS\system32\drivers\aswFsBlk.sys
[2010/05/07 04:33:55 | 000,094,800 | —- | M] (ALWIL Software) – C:\WINDOWS\system32\drivers\aswmon.sys
[2010/05/07 04:33:59 | 000,100,432 | —- | M] (ALWIL Software) – C:\WINDOWS\system32\drivers\aswmon2.sys
[2010/05/07 04:34:27 | 000,023,376 | —- | M] (ALWIL Software) – C:\WINDOWS\system32\drivers\aswRdr.sys
[2010/05/07 04:39:00 | 000,164,048 | —- | M] (ALWIL Software) – C:\WINDOWS\system32\drivers\aswSP.sys
[2010/05/07 04:39:23 | 000,046,672 | —- | M] (ALWIL Software) – C:\WINDOWS\system32\drivers\aswTdi.sys
[2010/04/29 15:39:26 | 000,020,952 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\system32\drivers\mbam.sys
[2010/04/29 15:39:38 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\system32\drivers\mbamswissarmy.sys

< MD5 for: AGP440.SYS >
[2004/08/04 20:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2004/08/04 20:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\I386\sp2.cab:AGP440.sys
[2008/04/14 02:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\agp440.sys
[2004/08/03 23:07:42 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB – C:\WINDOWS\SoftwareDistribution\Download\66b1d8e81a20b4b541ab3e558f2fd638\backup\agp440.sys

< MD5 for: ATAPI.SYS >
[2004/08/04 20:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2004/08/04 20:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\I386\sp2.cab:atapi.sys
[2008/04/14 02:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\atapi.sys
[2004/08/04 13:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\SoftwareDistribution\Download\66b1d8e81a20b4b541ab3e558f2fd638\backup\atapi.sys
[2004/08/04 13:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\system32\dllcache\atapi.sys
[2004/08/04 13:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/04 20:00:00 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\system32\ReinstallBackups\0010\DriverFiles\i386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 08:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\eventlog.dll
[2004/08/04 20:00:00 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\SoftwareDistribution\Download\66b1d8e81a20b4b541ab3e558f2fd638\backup\eventlog.dll
[2004/08/04 20:00:00 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\system32\dllcache\eventlog.dll
[2004/08/04 20:00:00 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\system32\eventlog.dll

< MD5 for: IASTOR.SYS >
[2004/12/17 14:11:38 | 000,477,696 | —- | M] (Intel Corporation) MD5=BDCE6B54E1D7D8399175A83A02274B7A – C:\Drivers\SATA\iaStor.sys
[2004/12/17 14:11:38 | 000,477,696 | —- | M] (Intel Corporation) MD5=BDCE6B54E1D7D8399175A83A02274B7A – C:\WINDOWS\system32\drivers\iaStor.sys
[2004/09/27 05:24:00 | 000,477,952 | —- | M] (Intel Corporation) MD5=DD19FDD8BB262F64A11C50CC23FC6F70 – C:\WINDOWS\OemDir\iaStor.sys
[2004/09/27 05:24:00 | 000,477,952 | —- | M] (Intel Corporation) MD5=DD19FDD8BB262F64A11C50CC23FC6F70 – C:\WINDOWS\system32\ReinstallBackups\0014\DriverFiles\iaStor.sys

< MD5 for: NETLOGON.DLL >
[2008/04/14 08:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\netlogon.dll
[2009/02/07 02:46:09 | 000,408,064 | —- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 – C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
[2009/02/07 02:46:09 | 000,408,064 | —- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 – C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll
[2004/08/04 20:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\SoftwareDistribution\Download\66b1d8e81a20b4b541ab3e558f2fd638\backup\netlogon.dll
[2004/08/04 20:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\system32\dllcache\netlogon.dll
[2004/08/04 20:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 20:00:00 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\SoftwareDistribution\Download\66b1d8e81a20b4b541ab3e558f2fd638\backup\scecli.dll
[2004/08/04 20:00:00 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\system32\dllcache\scecli.dll
[2004/08/04 20:00:00 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\system32\scecli.dll
[2008/04/14 08:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\scecli.dll

< MD5 for: VAXSCSI.SYS >
[2008/12/02 14:14:35 | 000,223,128 | —- | M] (Alcohol Soft Co., Ltd.) MD5=92CEBC2BC7BE2C8D49391B365569F306 – C:\WINDOWS\system32\drivers\vaxscsi.sys

========== Files - Unicode (All) ==========
[2010/05/04 21:57:15 | 000,000,000 | —D | M](C:\Program Files\????????????) – C:\Program Files\韩国语生活中应急的一句话
(C:\Program Files\????????????) – C:\Program Files\韩国语生活中应急的一句话

========== Alternate Data Streams ==========

@Alternate Data Stream - 147 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:333D43C5
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8
< End of report >

_________________________________
And heres the extra logfile

OTL Extras logfile created on: 6/12/2010 11:04:02 AM - Run 1
OTL by OldTimer - Version 3.2.6.0 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Tablet PC Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,014.00 Mb Total Physical Memory | 404.00 Mb Available Physical Memory | 40.00% Memory free
1.00 Gb Paging File | 0.00 Gb Available in Paging File | 39.00% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.28 Gb Total Space | 12.29 Gb Free Space | 32.98% Space Free | Partition Type: NTFS
Drive D: | 37.24 Gb Total Space | 3.75 Gb Free Space | 10.06% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: YOUR-32B7E84D0F
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] – C:\PROGRA~1\MICROS~4\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"5900:TCP" = 5900:TCP:*:Enabled:DS
"4445:TCP" = 4445:TCP:*:Enabled:DS

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"D:\Program Files\Orbitdownloader\orbitnet.exe" = D:\Program Files\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit – (Orbitdownloader.com)
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe" = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe:*:Disabled:backWeb-8876480 – ()
"C:\Program Files\Garena\Garena.exe" = C:\Program Files\Garena\Garena.exe:*:Enabled:Garena – (Garena Online PTE LTD)
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Disabled:Firefox – (Mozilla Corporation)
"C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" = C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe:*:Enabled:Veoh Web Player – (Veoh Networks)
"C:\Program Files\Skype\Plugin Manager\skypePM.exe" = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager – File not found
"C:\Program Files\Java\jre6\bin\java.exe" = C:\Program Files\Java\jre6\bin\java.exe:*:Disabled:Java™ Platform SE binary – (Sun Microsystems, Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = HeuPrinter
"{0759CACC-6CF9-4C3C-92C5-39668679AB16}" = Microsoft Ink Desktop
"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer
"{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}" = mLogView
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX300_series" = Canon MX300 series
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{14081443-583A-4605-BB91-83D38ADAC939}" = Microsoft Windows XP Tablet PC Edition 2005 Recognizer Pack
"{1759CACC-6CF9-4C3C-92C5-39668679AB17}" = Microsoft Ink Crossword
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBEE61B-F90E-4EE3-AE94-FCB8BD6EC443}" = Ink Art
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe
"{24CF0DBF-FF47-42E5-A13F-1D4D773E8AC7}" = Security Panel Application
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java™ 6 Update 13
"{28DA872A-0848-48CF-B749-19A198157A2A}" = mDriver
"{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper
"{3248F0A8-6813-11D6-A77B-00B0D0160040}" = Java™ 6 Update 4
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{341201D4-4F61-4ADB-987E-9CCE4D83A58D}" = Windows Live Toolbar Extension (Windows Live Toolbar)
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3BB2AA79-6623-48F4-B288-0CE1C88D40D6}" = O2Micro Flash Memory Card Windows Driver
"{3E9D596A-61D4-4239-BD19-2DB984D2A16F}" = mIWA
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{5337BED2-73A0-4EB8-A33C-91DFD4C2F82D}" = Fujitsu Pen Service
"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
"{5A24DD7E-7B01-41AC-ADA8-F1776177A3BA}" = Logitech ImageStudio
"{5FD8E317-90F5-4306-AB43-EF48D9560A16}" = PC-Doctor for Windows
"{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1" = Revo Uninstaller Pro 2.2.0
"{675F445D-0944-48DC-962E-DE2E9707AE8E}" = Fujitsu Hotkey Utility
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6DE14BE4-6F04-4935-8ABD-A0A19FE2E55A}" = mCore
"{6FFFE74E-3FBD-4E2E-97F9-5E9A2A077626}" = mIWCA
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7745B7A9-F323-4BB9-9811-01BF57A028DA}" = Map Button (Windows Live Toolbar)
"{80EAC1F5-3067-4E57-A09F-3AF728C59FE5}" = MapleStory
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{83258E90-1F76-4E13-9F60-A0F8ED41E76F}" = PC Connectivity Solution
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83BC3C76-E28B-4CDF-8A28-C47FDF663A10}" = IntelliSonic DX
"{8853C080-7F5C-4020-B663-C57FE29BB858}" = Microsoft Snipping Tool 2.0
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver for Mobile
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{8C6BB412-D3A8-4AAE-A01B-35B681789D68}" = mHelp
"{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}" = Logitech Desktop Messenger
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90B0D222-8C21-4B35-9262-53B042F18AF9}" = mPfWiz
"{93444A72-EEA4-43E9-A12C-372DCC126A9B}" = Security Panel Application for Supervisor
"{94658027-9F16-4509-BBD7-A59FE57C3023}" = mZConfig
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95120000-0122-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9CC89556-3578-48DD-8408-04E66EBEF401}" = mXML
"{9EDF1A5D-D8E0-413E-9782-75DD4A8C831B}" = VideoCam Suite 2.0
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A5C4AD72-25FE-4899-B6DF-6D8DF63C93CF}" = Highlight Viewer (Windows Live Toolbar)
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{AC76BA86-7AD7-1033-7B44-A00000000001}" = Adobe Reader 6.0.1
"{B2F3DBD9-A9D2-4838-B45D-C917DAB32BC3}" = ScanSoft OmniPage SE 4
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B41D74C6-886C-4406-AE27-241590A6C433}" = Fujitsu Radio Control
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C12EB29D-9D64-4ACA-84C2-33D8729AABD3}" = Microsoft Experience Pack for Tablet PC
"{C3F19A5F-35A8-4FDB-A6ED-0F4CE398DA48}" = Nokia Connectivity Cable Driver
"{C5BED10B-42A9-4142-B4C2-008C0FDE27D5}" = O2Micro Smartcard Driver
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2D6B9EB-C6DC-4DAA-B4DE-BB7D9735E7DA}" = Presto! PageManager 7.15.16
"{D4075EE9-BB9E-4012-9189-1211530C21F7}" = Fujitsu Button Driver Component
"{E0FAA0BA-874E-47C8-9ECA-BB333006CF16}" = Update Navi V1.1L46
"{E1640DA5-89B4-4F52-B15D-5DA3D14F29D4}" = LG USB Modem Drivers
"{EC502085-5F63-41A2-A290-41F9F9574270}" = Broadcom Gigabit Ethernet
"{F084395C-40FB-4DB3-981C-B51E74E1E83D}" = Smart Menus (Windows Live Toolbar)
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F6090A17-0967-4A8A-B3C3-422A1B514D49}" = mDrWiFi
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F6C2D09F-6C82-48BB-A9D5-6A0478F52BD6}" = Microsoft Media Transfer
"{F94FD9EE-B0A7-47BE-8C96-72F693BE4299}" = Fujitsu Button Utilities
"{FA02ACAC-9E14-4878-A257-92A22A647C2C}" = LG USB Modem Drivers
"{FA7314E7-9428-4866-80A8-762A538444DB}" = Microsoft Energy Blue Theme Pack
"{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe
"504244733D18C8F63FF584AEB290E3904E791693" = Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Agere Systems Soft Modem" = Agere Systems AC'97 Modem
"AhnLab Online Security" = AhnLab Online Security
"Audacity_is1" = Audacity 1.2.3
"avast5" = avast! Free Antivirus
"Browser Defender_is1" = Browser Defender 2.0.6.10
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ERUNT_is1" = ERUNT 1.1j
"fjbtndrv_88f5f7d550b6f9495c771d68ee8256fe01c940a5" = Windows Driver Package - Fujitsu PC Corporation (fjbtndrv) HIDClass 06/20/2003 1.000.0620.2003
"Garena" = Garena
"ie8" = Windows Internet Explorer 8
"InstallShield_{3BB2AA79-6623-48F4-B288-0CE1C88D40D6}" = O2Micro Flash Memory Card Windows Driver
"InstallShield_{5FD8E317-90F5-4306-AB43-EF48D9560A16}" = Fujitsu Hardware Diagnostics Tool
"InstallShield_{C5BED10B-42A9-4142-B4C2-008C0FDE27D5}" = O2Micro Smartcard Driver
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Messenger Plus! Live" = Messenger Plus! Live
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.5.9)" = Mozilla Firefox (3.5.9)
"MP Navigator EX 1.0" = Canon MP Navigator EX 1.0
"Orbit_is1" = Orbit Downloader
"PhotoFiltre" = PhotoFiltre
"ProInst" = Intel® PROSet/Wireless Software
"RemoveIT Pro v4 - SE" = RemoveIT Pro v4 - SE
"SpeedFan" = SpeedFan (remove only)
"Spyware Doctor" = Spyware Doctor 7.0
"SystemRequirementsLab" = System Requirements Lab
"Veoh Web Player Beta" = Veoh Web Player
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent DNA" = DNA
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 6/6/2010 2:13:35 AM | Computer Name = YOUR-32B7E84D0F | Source = Application Hang | ID = 1002
Description = Hanging application wmplayer.exe, version 10.0.0.3646, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 6/6/2010 4:52:27 AM | Computer Name = YOUR-32B7E84D0F | Source = Google Update | ID = 20
Description =

Error - 6/6/2010 5:29:47 AM | Computer Name = YOUR-32B7E84D0F | Source = Google Update | ID = 20
Description =

Error - 6/6/2010 5:52:26 AM | Computer Name = YOUR-32B7E84D0F | Source = Google Update | ID = 20
Description =

Error - 6/6/2010 10:09:03 AM | Computer Name = YOUR-32B7E84D0F | Source = Lavasoft Ad-Aware Service | ID = 0
Description =

Error - 6/7/2010 9:06:13 AM | Computer Name = YOUR-32B7E84D0F | Source = pctsSvc.exe | ID = 0
Description =

Error - 6/9/2010 7:55:54 AM | Computer Name = YOUR-32B7E84D0F | Source = Application Hang | ID = 1002
Description = Hanging application avscan.exe, version 10.0.3.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 6/11/2010 7:17:47 AM | Computer Name = YOUR-32B7E84D0F | Source = System.ServiceModel.Install 3.0.0.0 | ID = 0
Description =

Error - 6/11/2010 10:35:21 AM | Computer Name = YOUR-32B7E84D0F | Source = .NET Runtime Optimization Service | ID = 1111
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Service reached limit of transient errors. Will shut down. Last error returned
from Service Manager: 0x80004004.

Error - 6/11/2010 10:52:45 PM | Computer Name = YOUR-32B7E84D0F | Source = Google Update | ID = 20
Description =

[ OSession Events ]
Error - 5/30/2010 1:09:01 AM | Computer Name = YOUR-32B7E84D0F | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 6
seconds with 0 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 6/11/2010 9:54:01 AM | Computer Name = YOUR-32B7E84D0F | Source = DCOM | ID = 10010
Description = The server {7160A13D-73DA-4CEA-95B9-37356478588A} did not register
with DCOM within the required timeout.

Error - 6/11/2010 9:54:15 AM | Computer Name = YOUR-32B7E84D0F | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
SBRE

Error - 6/11/2010 10:13:10 AM | Computer Name = YOUR-32B7E84D0F | Source = DCOM | ID = 10010
Description = The server {7160A13D-73DA-4CEA-95B9-37356478588A} did not register
with DCOM within the required timeout.

Error - 6/11/2010 10:13:25 AM | Computer Name = YOUR-32B7E84D0F | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
SBRE

Error - 6/11/2010 11:03:15 AM | Computer Name = YOUR-32B7E84D0F | Source = Service Control Manager | ID = 7034
Description = The avast! Antivirus service terminated unexpectedly. It has done
this 1 time(s).

Error - 6/11/2010 11:03:15 AM | Computer Name = YOUR-32B7E84D0F | Source = Service Control Manager | ID = 7034
Description = The avast! Mail Scanner service terminated unexpectedly. It has done
this 1 time(s).

Error - 6/11/2010 11:03:15 AM | Computer Name = YOUR-32B7E84D0F | Source = Service Control Manager | ID = 7034
Description = The avast! Web Scanner service terminated unexpectedly. It has done
this 1 time(s).

Error - 6/11/2010 12:18:22 PM | Computer Name = YOUR-32B7E84D0F | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the Dnscache service.

Error - 6/11/2010 10:53:40 PM | Computer Name = YOUR-32B7E84D0F | Source = DCOM | ID = 10010
Description = The server {7160A13D-73DA-4CEA-95B9-37356478588A} did not register
with DCOM within the required timeout.

Error - 6/11/2010 10:53:48 PM | Computer Name = YOUR-32B7E84D0F | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
SBRE

< End of report >

inzanity

Post #5June 14, 2010, 8:20 AM UTC

Hi,

And do you mean that i have to close my anitvirus too when gmer.exe is performing its scan ?

Yes please, just for the meantime. You can re-enable it later.

If you are still having trouble running GMER, try it in safe mode.
To do this,

Restart your computer.
Keep on tapping f8 when windows starts to boot. Do this before you see the windows screen.
When a list of menu appears, scroll to Safe Mode using the arrow keys then press Enter.

Then run GMER again.

If that still wont' do then open GMER and click on the box beside "Files" to uncheck it then run.

inzanity

Post #6June 14, 2010, 8:52 AM UTC last edited June 14, 2010, 9:11 AM UTC

Also, please post the contents of this log -> C:\Documents and Settings\Administrator\defogger_disable.log

–Next–

Here is good reading regarding Orbitdownloader -> link

We recommend you to disable it, and, when you want download a file, just right click and choose "Download by Orbit".

orbitnet.exe uses excessive system and memory resources with no corresponding benefit. Applications such as these should be disabled to improve overall system performance.

–Next–

You have DNA, a P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

P2P (File Sharing ) programs form a direct conduit onto your computer, their security measures are easily circumvented, and Malware writers are increasingly exploiting them to spread their wares onto your computer. Further to that, if your P2P program is not configured correctly you may be sharing more files than you realize. There have been cases where people's Passwords, Address Books and other personal, private, and financial details have been exposed to the file sharing network by a badly configured program.

Many of the programs come bundled with other unwanted programs, but even the ones free of any bundled software are not safe to use.

This article from InfoWorld illustrates the dangers of a poorly configured P2P program.
http://www.infoworld.com/d/security-centra…-p-id-theft-103

When you use them you are downloading software from an unknown source directly onto your computer, bypassing your Firewall and Anti-Virus software. Hardly surprising then that many of these Downloads are being targeted to carry infections.

I would recommend that you uninstall DNA, via Control Panel -> Add or Remove Programs.

However, if you do not wish to remove this program please be advised not to use the said program during the course of cleaning your machine.

References for the risk of these programs can be found in these links:
http://www.esecurityguy.com/p2p_file_sharing
http://www.microsoft.com/protect/data/down…ilesharing.aspx

–Next–

Please go to VirSCAN

Click on Browse.
On the File Upload window, copy/paste the text below into the File name box:
C:\WINDOWS\System32\CNCFLcNL.DLL
Click Upload. Allow the file to be scanned. If it says already scanned – click Reanalyze Now

Repeat the procedure with the following file:
C:\WINDOWS\System32\XPerWin.dll

Please post the results in your next reply

To post in your next reply:
1. Defogger log.
2. GMER log.
3. VirSCAN log.

Edit: Added additional instructions.

Numbz

Post #7June 14, 2010, 4:02 PM UTC

Thanks for replying and giving me information about p2p programs. I'm not sure where DNA come from or maybe i just forgot but when i went to add or remove program it said error it might have been uninstalled but i'm not sure if it had been thoroughly uninstalled. I have also done the gmer.exe scan through save mode and here are the logs to post.

Defogger log
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 21:48 on 11/06/2010 (Administrator)

Checking for autostart values…
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers…
Unable to read sptd.sys
SPTD -> Disabled (Service running -> reboot required)

-=E.O.F=-

_________________________________

gmerlog
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\Cdfs \Cdfs F70C2400

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001e1000016e
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001e1000016e@0025e525cbb0 0x81 0x7A 0x7F 0x2A …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x9A 0x25 0x03 0xD4 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xC5 0xD5 0x17 0x9E …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x92 0xCC 0x93 0x31 …
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001e1000016e (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001e1000016e@0025e525cbb0 0x81 0x7A 0x7F 0x2A …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x9A 0x25 0x03 0xD4 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 2
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xC5 0xD5 0x17 0x9E …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x92 0xCC 0x93 0x31 …

—- EOF - GMER 1.0.15 —-
__________________________________

Virscan logs

_ _ _ _ _ _ _ _ __ _ _ _ _ _ _

PÃ &Text (
&OEM Text VirSCAN.org Scanned Report :
Scanned time : 2010/06/14 20:38:55 (SGT)
Scanner results: Scanners did not find malware!
File Name : CNCFLcNL.DLL
File Size : 3584 byte
File Type : PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bi
MD5 : 1eb9943b73427043c1dc3659d62ffda6
SHA1 : dd786874d78f5bea29801188a32b95cdeec4545b
Online report : http://virscan.org/report/d36ec18d68624dac…fcb07ec360.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 5.0.0.11 20100612060110 2010-06-12 40.09 -
AhnLab V3 … .. – 40.10 -
AntiVir 8.2.2.6 7.10.8.65 2010-06-14 0.26 -
Antiy 2.0.18 20100611.4748539 2010-06-11 0.02 -
Arcavir 2009 201006140046 2010-06-14 0.02 -
Authentium 5.1.1 201006131335 2010-06-13 1.27 -
AVAST! 4.7.4 100614-0 2010-06-14 0.00 -
AVG 8.5.793 271.1.1/2937 2010-06-14 0.23 -
BitDefender 7.90123.6184883 7.32207 2010-06-14 3.93 -
ClamAV 0.96.1 11183 2010-06-13 0.01 -
Comodo 3.13.579 5096 2010-06-14 40.09 -
CP Secure 1.3.0.5 2010.06.14 2010-06-14 0.03 -
Dr.Web 5.0.2.3300 2010.06.14 2010-06-14 8.45 -
F-Prot 4.4.4.56 20100613 2010-06-13 1.33 -
F-Secure 7.02.73807 2010.06.14.02 2010-06-14 11.52 -
Fortinet 4.1.133 12.52 2010-06-14 40.13 -
GData 21.347/21.117 20100614 2010-06-14 40.12 -
ViRobot 20100611 2010.06.11 2010-06-11 40.09 -
Ikarus T3.1.01.84 2010.06.14.76062 2010-06-14 7.08 -
JiangMin 13.0.900 2010.06.13 2010-06-13 40.11 -
Kaspersky 5.5.10 2010.06.14 2010-06-14 0.32 -
KingSoft 2009.2.5.15 2010.6.13.13 2010-06-13 40.30 -
McAfee 5400.1158 6012 2010-06-13 27.39 -
Microsoft 1.5802 2010.06.14 2010-06-14 40.20 -
Norman 6.04.12 6.04.00 2010-06-13 10.03 -
Panda 9.05.01 2010.06.13 2010-06-13 40.19 -
Trend Micro 9.120-1004 7.242.05 2010-06-14 0.03 -
Quick Heal 10.00 2010.06.14 2010-06-14 40.09 -
Rising 20.0 22.51.06.01 2010-06-13 40.09 -
Sophos 3.07.1 4.54 2010-06-14 3.46 -
Sunbelt 3.9.2424.2 6445 2010-06-13 40.09 -
Symantec 1.3.0.24 20100613.018 2010-06-13 0.05 -
nProtect 20100614.01 8640010 2010-06-14 40.09 -
The Hacker 6.5.2.0 v00298 2010-06-12 40.09 -
VBA32 3.12.12.5 20100613.1946 2010-06-13 2.76 -
VirusBuster 4.5.11.10 10.126.81/2048271 2010-06-14 2.48 -
VirSCAN.org Scanned Report :
Scanned time : 2010/06/14 20:38:55 (SGT)
Scanner results: Scanners did not find malware!
File Name : CNCFLcNL.DLL
File Size : 3584 byte
File Type : PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bi
MD5 : 1eb9943b73427043c1dc3659d62ffda6
SHA1 : dd786874d78f5bea29801188a32b95cdeec4545b
Online report : http://virscan.org/report/d36ec18d68624dac…fcb07ec360.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 5.0.0.11 20100612060110 2010-06-12 40.09 -
AhnLab V3 … .. – 40.10 -
AntiVir 8.2.2.6 7.10.8.65 2010-06-14 0.26 -
Antiy 2.0.18 20100611.4748539 2010-06-11 0.02 -
Arcavir 2009 201006140046 2010-06-14 0.02 -
Authentium 5.1.1 201006131335 2010-06-13 1.27 -
AVAST! 4.7.4 100614-0 2010-06-14 0.00 -
AVG 8.5.793 271.1.1/2937 2010-06-14 0.23 -
BitDefender 7.90123.6184883 7.32207 2010-06-14 3.93 -
ClamAV 0.96.1 11183 2010-06-13 0.01 -
Comodo 3.13.579 5096 2010-06-14 40.09 -
CP Secure 1.3.0.5 2010.06.14 2010-06-14 0.03 -
Dr.Web 5.0.2.3300 2010.06.14 2010-06-14 8.45 -
F-Prot 4.4.4.56 20100613 2010-06-13 1.33 -
F-Secure 7.02.73807 2010.06.14.02 2010-06-14 11.52 -
Fortinet 4.1.133 12.52 2010-06-14 40.13 -
GData 21.347/21.117 20100614 2010-06-14 40.12 -
ViRobot 20100611 2010.06.11 2010-06-11 40.09 -
Ikarus T3.1.01.84 2010.06.14.76062 2010-06-14 7.08 -
JiangMin 13.0.900 2010.06.13 2010-06-13 40.11 -
Kaspersky 5.5.10 2010.06.14 2010-06-14 0.32 -
KingSoft 2009.2.5.15 2010.6.13.13 2010-06-13 40.30 -
McAfee 5400.1158 6012 2010-06-13 27.39 -
Microsoft 1.5802 2010.06.14 2010-06-14 40.20 -
Norman 6.04.12 6.04.00 2010-06-13 10.03 -
Panda 9.05.01 2010.06.13 2010-06-13 40.19 -
Trend Micro 9.120-1004 7.242.05 2010-06-14 0.03 -
Quick Heal 10.00 2010.06.14 2010-06-14 40.09 -
Rising 20.0 22.51.06.01 2010-06-13 40.09 -
Sophos 3.07.1 4.54 2010-06-14 3.46 -
Sunbelt 3.9.2424.2 6445 2010-06-13 40.09 -
Symantec 1.3.0.24 20100613.018 2010-06-13 0.05 -
nProtect 20100614.01 8640010 2010-06-14 40.09 -
The Hacker 6.5.2.0 v00298 2010-06-12 40.09 -
VBA32 3.12.12.5 20100613.1946 2010-06-13 2.76 -
VirusBuster 4.5.11.10 10.126.81/2048271 2010-06-14 2.48 -

__________________________________

PÃ Ù &Text Ù ì &OEM Text VirSCAN.org Scanned Report :
Scanned time : 2010/06/14 20:55:05 (SGT)
Scanner results: Scanners did not find malware!
File Name : XPerWin.dll
File Size : 4 byte
File Type : data
MD5 : f2dd0dedb2c260419ece4a9e03b2e828
SHA1 : 0aaf76f425c6e0f43a36197de768e67d9e035abb
Online report : http://virscan.org/report/5e0729dff21b6e6f…bf56793562.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 5.0.0.11 20100612060110 2010-06-12 40.09 -
AhnLab V3 … .. – 40.09 -
AntiVir 8.2.2.6 7.10.8.65 2010-06-14 0.28 -
Antiy 2.0.18 20100611.4748539 2010-06-11 0.02 -
Arcavir 2009 201006140046 2010-06-14 0.02 -
Authentium 5.1.1 201006131335 2010-06-13 1.32 -
AVAST! 4.7.4 100614-0 2010-06-14 0.00 -
AVG 8.5.793 271.1.1/2937 2010-06-14 0.23 -
BitDefender 7.90123.6184883 7.32207 2010-06-14 4.08 -
ClamAV 0.96.1 11183 2010-06-13 0.00 -
Comodo 3.13.579 5096 2010-06-14 40.09 -
CP Secure 1.3.0.5 2010.06.14 2010-06-14 0.00 -
Dr.Web 5.0.2.3300 2010.06.14 2010-06-14 8.02 -
F-Prot 4.4.4.56 20100613 2010-06-13 1.27 -
F-Secure 7.02.73807 2010.06.14.02 2010-06-14 10.84 -
Fortinet 4.1.133 12.52 2010-06-14 40.09 -
GData 21.347/21.117 20100614 2010-06-14 40.15 -
ViRobot 20100611 2010.06.11 2010-06-11 40.22 -
Ikarus T3.1.01.84 2010.06.14.76062 2010-06-14 6.73 -
JiangMin 13.0.900 2010.06.13 2010-06-13 40.09 -
Kaspersky 5.5.10 2010.06.14 2010-06-14 0.06 -
KingSoft 2009.2.5.15 2010.6.13.13 2010-06-13 40.22 -
McAfee 5400.1158 6012 2010-06-13 25.78 -
Microsoft 1.5802 2010.06.14 2010-06-14 40.20 -
Norman 6.04.12 6.04.00 2010-06-13 6.01 -
Panda 9.05.01 2010.06.13 2010-06-13 40.10 -
Trend Micro 9.120-1004 7.242.05 2010-06-14 0.98 -
Quick Heal 10.00 2010.06.14 2010-06-14 40.09 -
Rising 20.0 22.51.06.01 2010-06-13 40.29 -
Sophos 3.07.1 4.54 2010-06-14 5.06 -
Sunbelt 3.9.2424.2 6445 2010-06-13 40.13 -
Symantec 1.3.0.24 20100613.018 2010-06-13 0.34 -
nProtect 20100614.01 8640010 2010-06-14 40.09 -
The Hacker 6.5.2.0 v00298 2010-06-12 40.20 -
VBA32 3.12.12.5 20100613.1946 2010-06-13 3.13 -
VirusBuster 4.5.11.10 10.126.81/2048271 2010-06-14 4.31 -
VirSCAN.org Scanned Report :
Scanned time : 2010/06/14 20:55:05 (SGT)
Scanner results: Scanners did not find malware!
File Name : XPerWin.dll
File Size : 4 byte
File Type : data
MD5 : f2dd0dedb2c260419ece4a9e03b2e828
SHA1 : 0aaf76f425c6e0f43a36197de768e67d9e035abb
Online report : http://virscan.org/report/5e0729dff21b6e6f…bf56793562.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 5.0.0.11 20100612060110 2010-06-12 40.09 -
AhnLab V3 … .. – 40.09 -
AntiVir 8.2.2.6 7.10.8.65 2010-06-14 0.28 -
Antiy 2.0.18 20100611.4748539 2010-06-11 0.02 -
Arcavir 2009 201006140046 2010-06-14 0.02 -
Authentium 5.1.1 201006131335 2010-06-13 1.32 -
AVAST! 4.7.4 100614-0 2010-06-14 0.00 -
AVG 8.5.793 271.1.1/2937 2010-06-14 0.23 -
BitDefender 7.90123.6184883 7.32207 2010-06-14 4.08 -
ClamAV 0.96.1 11183 2010-06-13 0.00 -
Comodo 3.13.579 5096 2010-06-14 40.09 -
CP Secure 1.3.0.5 2010.06.14 2010-06-14 0.00 -
Dr.Web 5.0.2.3300 2010.06.14 2010-06-14 8.02 -
F-Prot 4.4.4.56 20100613 2010-06-13 1.27 -
F-Secure 7.02.73807 2010.06.14.02 2010-06-14 10.84 -
Fortinet 4.1.133 12.52 2010-06-14 40.09 -
GData 21.347/21.117 20100614 2010-06-14 40.15 -
ViRobot 20100611 2010.06.11 2010-06-11 40.22 -
Ikarus T3.1.01.84 2010.06.14.76062 2010-06-14 6.73 -
JiangMin 13.0.900 2010.06.13 2010-06-13 40.09 -
Kaspersky 5.5.10 2010.06.14 2010-06-14 0.06 -
KingSoft 2009.2.5.15 2010.6.13.13 2010-06-13 40.22 -
McAfee 5400.1158 6012 2010-06-13 25.78 -
Microsoft 1.5802 2010.06.14 2010-06-14 40.20 -
Norman 6.04.12 6.04.00 2010-06-13 6.01 -
Panda 9.05.01 2010.06.13 2010-06-13 40.10 -
Trend Micro 9.120-1004 7.242.05 2010-06-14 0.98 -
Quick Heal 10.00 2010.06.14 2010-06-14 40.09 -
Rising 20.0 22.51.06.01 2010-06-13 40.29 -
Sophos 3.07.1 4.54 2010-06-14 5.06 -
Sunbelt 3.9.2424.2 6445 2010-06-13 40.13 -
Symantec 1.3.0.24 20100613.018 2010-06-13 0.34 -
nProtect 20100614.01 8640010 2010-06-14 40.09 -
The Hacker 6.5.2.0 v00298 2010-06-12 40.20 -
VBA32 3.12.12.5 20100613.1946 2010-06-13 3.13 -
VirusBuster 4.5.11.10 10.126.81/2048271 2010-06-14 4.31 -

Thanks!

inzanity

Post #8June 15, 2010, 1:16 AM UTC

Hi,

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (free-downloads.net Toolbar) - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre1.dll File not found
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (free-downloads.net Toolbar) - {ECDEE021-0D17-467F-A1FF-C7A115230949} - C:\Program Files\free-downloads.net\tbfre1.dll File not found
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKCU..\Run: [WebCamRT.exe] File not found
O32 - AutoRun File - [2010/04/10 18:32:32 | 000,000,050 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2009/03/06 22:20:02 | 000,000,000 | RHSD | M] - C:\autorun.inf – [ NTFS ]
O32 - AutoRun File - [2009/03/06 22:20:04 | 000,000,000 | RHSD | M] - D:\autorun.inf – [ FAT32 ]
O33 - MountPoints2\{040089fa-9abc-11dd-aa58-0013ceedc3fe}\Shell - "" = AutoRun
O33 - MountPoints2\{040089fa-9abc-11dd-aa58-0013ceedc3fe}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{0f5786aa-abd7-11de-ba9a-0013ceedc3fe}\Shell - "" = AutoRun
O33 - MountPoints2\{0f5786aa-abd7-11de-ba9a-0013ceedc3fe}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{0f5786aa-abd7-11de-ba9a-0013ceedc3fe}\Shell\AutoRun\command - "" = F:\USBAutoRun.exe – File not found
O33 - MountPoints2\{1d9bdb06-856e-11de-ba51-0013ceedc3fe}\Shell - "" = AutoRun
O33 - MountPoints2\{1d9bdb06-856e-11de-ba51-0013ceedc3fe}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{3113f0b8-e66e-11de-bb27-0013ceedc3fe}\Shell\AutoRun\command - "" = wscript.exe system32.dll.vbe
O33 - MountPoints2\{3113f0b8-e66e-11de-bb27-0013ceedc3fe}\Shell\explore\command - "" = wscript.exe system32.dll.vbe
O33 - MountPoints2\{3113f0b8-e66e-11de-bb27-0013ceedc3fe}\Shell\open\command - "" = wscript.exe system32.dll.vbe
O33 - MountPoints2\{39bb898a-452b-11df-bbd2-0013ceedc3fe}\Shell - "" = Autorun
O33 - MountPoints2\{39bb898a-452b-11df-bbd2-0013ceedc3fe}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{39bb898a-452b-11df-bbd2-0013ceedc3fe}\Shell\Open\command - "" = regsvr.exe
O33 - MountPoints2\{7ffe5452-4939-11de-b9e2-0013ceedc3fe}\Shell - "" = AutoRun
O33 - MountPoints2\{7ffe5452-4939-11de-b9e2-0013ceedc3fe}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7ffe5452-4939-11de-b9e2-0013ceedc3fe}\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found
O33 - MountPoints2\{7ffe5453-4939-11de-b9e2-0013ceedc3fe}\Shell\AutoRun\command - "" = c2e.exe
O33 - MountPoints2\{7ffe5453-4939-11de-b9e2-0013ceedc3fe}\Shell\open\Command - "" = c2e.exe
O33 - MountPoints2\{9efea3e6-decd-11de-bb13-0013ceedc3fe}\Shell\AutoRun\command - "" = F:\ZALJUBIT\\dousiju.exe – File not found
O33 - MountPoints2\{9efea3e6-decd-11de-bb13-0013ceedc3fe}\Shell\explore\command - "" = F:\ZALJUBIT\\dousiju.exe – File not found
O33 - MountPoints2\{9efea3e6-decd-11de-bb13-0013ceedc3fe}\Shell\open\command - "" = F:\ZALJUBIT\\dousiju.exe – File not found
O33 - MountPoints2\{c299afe9-3fbd-11df-bbc4-0013ceedc3fe}\Shell\AutoRun\command - "" = wscript.exe system32.dll.vbe
O33 - MountPoints2\{c299afe9-3fbd-11df-bbc4-0013ceedc3fe}\Shell\explore\command - "" = wscript.exe system32.dll.vbe
O33 - MountPoints2\{c299afe9-3fbd-11df-bbc4-0013ceedc3fe}\Shell\open\command - "" = wscript.exe system32.dll.vbe
O33 - MountPoints2\{dc14190e-9f32-11dd-aa5f-0013ceedc3fe}\Shell - "" = AutoRun
O33 - MountPoints2\{dc14190e-9f32-11dd-aa5f-0013ceedc3fe}\Shell\AutoRun - "" = Auto&Play
@Alternate Data Stream - 147 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:333D43C5
@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8

:Commands
[purity]
[emptytemp]
[emptyflash]

Then click the Run Fix button at the top.
Let the program run unhindered, reboot when it is done.
Then post the result and a new OTL log in your next reply. ( don't check the boxes beside LOP Check or Purity this time )

–Next–

Please open your MalwareBytes AntiMalware Program
Click the Update Tab and search for updates
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

To post in your next reply:
1. OTL logs.
2. Malwarebytes' log.

Numbz

Post #9June 15, 2010, 3:16 AM UTC

Hi. Here is the OTL log i will post the malwarebyteslog tonight. thanks alot! Is it still minimal output? otl.log All processes killed ========== OTL ========== HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully! Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ecdee021-0d17-467f-a1ff-c7a115230949}\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{ECDEE021-0D17-467F-A1FF-C7A115230949} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECDEE021-0D17-467F-A1FF-C7A115230949}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\KernelFaultCheck not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\WebCamRT.exe deleted successfully. C:\AUTOEXEC.BAT moved successfully. File not found. File not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{040089fa-9abc-11dd-aa58-0013ceedc3fe}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{040089fa-9abc-11dd-aa58-0013ceedc3fe}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{040089fa-9abc-11dd-aa58-0013ceedc3fe}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{040089fa-9abc-11dd-aa58-0013ceedc3fe}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0f5786aa-abd7-11de-ba9a-0013ceedc3fe}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f5786aa-abd7-11de-ba9a-0013ceedc3fe}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0f5786aa-abd7-11de-ba9a-0013ceedc3fe}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f5786aa-abd7-11de-ba9a-0013ceedc3fe}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0f5786aa-abd7-11de-ba9a-0013ceedc3fe}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f5786aa-abd7-11de-ba9a-0013ceedc3fe}\ not found. File F:\USBAutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1d9bdb06-856e-11de-ba51-0013ceedc3fe}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1d9bdb06-856e-11de-ba51-0013ceedc3fe}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1d9bdb06-856e-11de-ba51-0013ceedc3fe}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1d9bdb06-856e-11de-ba51-0013ceedc3fe}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3113f0b8-e66e-11de-bb27-0013ceedc3fe}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3113f0b8-e66e-11de-bb27-0013ceedc3fe}\ not found. File wscript.exe system32.dll.vbe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3113f0b8-e66e-11de-bb27-0013ceedc3fe}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3113f0b8-e66e-11de-bb27-0013ceedc3fe}\ not found. File wscript.exe system32.dll.vbe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3113f0b8-e66e-11de-bb27-0013ceedc3fe}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3113f0b8-e66e-11de-bb27-0013ceedc3fe}\ not found. File wscript.exe system32.dll.vbe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{39bb898a-452b-11df-bbd2-0013ceedc3fe}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{39bb898a-452b-11df-bbd2-0013ceedc3fe}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{39bb898a-452b-11df-bbd2-0013ceedc3fe}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{39bb898a-452b-11df-bbd2-0013ceedc3fe}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{39bb898a-452b-11df-bbd2-0013ceedc3fe}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{39bb898a-452b-11df-bbd2-0013ceedc3fe}\ not found. File regsvr.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7ffe5452-4939-11de-b9e2-0013ceedc3fe}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7ffe5452-4939-11de-b9e2-0013ceedc3fe}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7ffe5452-4939-11de-b9e2-0013ceedc3fe}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7ffe5452-4939-11de-b9e2-0013ceedc3fe}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7ffe5452-4939-11de-b9e2-0013ceedc3fe}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7ffe5452-4939-11de-b9e2-0013ceedc3fe}\ not found. File F:\LaunchU3.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7ffe5453-4939-11de-b9e2-0013ceedc3fe}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7ffe5453-4939-11de-b9e2-0013ceedc3fe}\ not found. File c2e.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7ffe5453-4939-11de-b9e2-0013ceedc3fe}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7ffe5453-4939-11de-b9e2-0013ceedc3fe}\ not found. File c2e.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9efea3e6-decd-11de-bb13-0013ceedc3fe}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9efea3e6-decd-11de-bb13-0013ceedc3fe}\ not found. File F:\ZALJUBIT\\dousiju.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9efea3e6-decd-11de-bb13-0013ceedc3fe}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9efea3e6-decd-11de-bb13-0013ceedc3fe}\ not found. File F:\ZALJUBIT\\dousiju.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9efea3e6-decd-11de-bb13-0013ceedc3fe}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9efea3e6-decd-11de-bb13-0013ceedc3fe}\ not found. File F:\ZALJUBIT\\dousiju.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c299afe9-3fbd-11df-bbc4-0013ceedc3fe}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c299afe9-3fbd-11df-bbc4-0013ceedc3fe}\ not found. File wscript.exe system32.dll.vbe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c299afe9-3fbd-11df-bbc4-0013ceedc3fe}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c299afe9-3fbd-11df-bbc4-0013ceedc3fe}\ not found. File wscript.exe system32.dll.vbe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c299afe9-3fbd-11df-bbc4-0013ceedc3fe}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c299afe9-3fbd-11df-bbc4-0013ceedc3fe}\ not found. File wscript.exe system32.dll.vbe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dc14190e-9f32-11dd-aa5f-0013ceedc3fe}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dc14190e-9f32-11dd-aa5f-0013ceedc3fe}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dc14190e-9f32-11dd-aa5f-0013ceedc3fe}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dc14190e-9f32-11dd-aa5f-0013ceedc3fe}\ not found. ADS C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2 deleted successfully. ADS C:\Documents and Settings\All Users\Application Data\TEMP:333D43C5 deleted successfully. ADS C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8 deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 19127730 bytes ->Temporary Internet Files folder emptied: 42646658 bytes ->Java cache emptied: 75480368 bytes ->FireFox cache emptied: 73580623 bytes ->Google Chrome cache emptied: 19579248 bytes ->Flash cache emptied: 154745 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 65984 bytes ->Temporary Internet Files folder emptied: 2536628 bytes User: NetworkService ->Temp folder emptied: 77640 bytes ->Temporary Internet Files folder emptied: 33664 bytes User: Nixon ->Temp folder emptied: 714230 bytes ->Temporary Internet Files folder emptied: 667932 bytes ->Java cache emptied: 5960787 bytes ->FireFox cache emptied: 11921305 bytes ->Flash cache emptied: 405 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 450282 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 49443754 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 34318 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 288.00 mb [EMPTYFLASH] User: Administrator ->Flash cache emptied: 0 bytes User: All Users User: Default User User: LocalService User: NetworkService User: Nixon ->Flash cache emptied: 0 bytes Total Flash Files Cleaned = 0.00 mb OTL by OldTimer - Version 3.2.6.0 log created on 06152010_110535 Files\Folders moved on Reboot… File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot. Registry entries deleted on Reboot…

inzanity

Post #10June 15, 2010, 3:18 AM UTC

Hi, Minimal output will do. Thanks.

Numbz

Post #11June 15, 2010, 3:46 PM UTC

malwarebytes log _________________ Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4199 Windows 5.1.2600 Service Pack 2 Internet Explorer 8.0.6001.18702 6/15/2010 11:37:53 PM mbam-log-2010-06-15 (23-37-53).txt Scan type: Quick scan Objects scanned: 138503 Time elapsed: 13 minute(s), 56 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

inzanity

Post #12June 16, 2010, 1:21 AM UTC

Hi,

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.

Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.

[external image: Posted Image]
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

–Next–

Open OTL.exe.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
There will only be a single log produced. OTL.Txt.
Note:This log can be located in the OTL. folder on you C:\ drive if it fails to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of this file and post it with your next reply.

To post in your next reply:
1. Kaspersky log.
2. OTL log.
3. How is your computer?

inzanity

Post #13June 19, 2010, 5:34 AM UTC

Hi, It's been several days. Do you still need help on this? This topic will be closed if you don't respond within 24 hours. Thank you.

Numbz

Post #14June 19, 2010, 1:47 PM UTC

I am so sorry. I am quite busy lately due to schoolwork and wasn't able to use my computer. I will post the log in another 3 days time.

inzanity

Post #15June 20, 2010, 2:17 AM UTC

Hi,

If that's the case then let's hold off Kaspersky scan for now. Do the following instead:

Open OTL.exe.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
There will only be a single log produced. OTL.Txt.
Note:This log can be located in the OTL. folder on you C:\ drive if it fails to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of this file and post it with your next reply.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Help needed

✨ Ask AI

Ask AI