Spyware / Malware / Virus Removal

Win32:Jifas?

69 min read

Looking for the outcome? Ask AI

oldman960

Post #16July 15, 2010, 12:26 PM UTC

Hi Ringmaster, Are you still with us? Thanks

Ringmaster

Post #17July 15, 2010, 3:37 PM UTC

Hey, sorry for the delay. I'm still here! All processes killed ========== REGISTRY ========== ========== SERVICES/DRIVERS ========== Service umiyjd stopped successfully! Service umiyjd deleted successfully! ========== FILES ========== c:\documents and settings\NetworkService\Local Settings\Application Data\imlsfyhyi folder moved successfully. c:\documents and settings\Creator\Local Settings\Application Data\rxsonypmv folder moved successfully. File\Folder c:\windows\system32\drivers\gwvsr.sys not found. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: All Users User: Creator ->Temp folder emptied: 10530225 bytes ->Temporary Internet Files folder emptied: 43120186 bytes ->Java cache emptied: 67185041 bytes ->FireFox cache emptied: 40052541 bytes ->Flash cache emptied: 103730 bytes User: Default User ->Temp folder emptied: 59964 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: LocalService ->Temp folder emptied: 65536 bytes ->Temporary Internet Files folder emptied: 49286 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Java cache emptied: 52 bytes ->Flash cache emptied: 9342 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 195089 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 16384 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 34318 bytes RecycleBin emptied: 147530 bytes Total Files Cleaned = 154.00 mb OTL by OldTimer - Version 3.2.8.1 log created on 07102010_175421 Files\Folders moved on Reboot… C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\QL6ABUXO\iframe[5].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\P9R3Z2TH\index[4].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\P9R3Z2TH\like[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\GD6YC0OC\mail[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\GD6YC0OC\mail[2].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\GD6YC0OC\mail[4].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\AntiPhishing\A0AB7674-8D67-4F4D-B5E1-96FAEADFB79D.dat moved successfully. File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot. File\Folder C:\WINDOWS\temp\Perflib_Perfdata_14c.dat not found! Registry entries deleted on Reboot…

Ringmaster

Post #18July 15, 2010, 3:37 PM UTC

Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4300 Windows 5.1.2600 Service Pack 2 Internet Explorer 7.0.5730.11 7/10/2010 7:13:42 PM mbam-log-2010-07-10 (19-13-42).txt Scan type: Quick scan Objects scanned: 143331 Time elapsed: 11 minute(s), 49 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 2 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Defense Center (Rogue.DefenseCenter) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\24d1ca9a-a864-4f7b-86fe-495eb56529d8 (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\7bde84a2-f58f-46ec-9eac-f1f90fead080 (Malware.Trace) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

Ringmaster

Post #19July 15, 2010, 3:39 PM UTC

OTL logfile created on: 7/10/2010 7:14:40 PM - Run 3
OTL by OldTimer - Version 3.2.8.1 Folder = C:\Documents and Settings\Creator\Desktop
Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 62.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 87.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 228.14 Gb Total Space | 8.99 Gb Free Space | 3.94% Space Free | Partition Type: NTFS
Drive D: | 4.09 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
Drive F: | 111.72 Gb Total Space | 0.90 Gb Free Space | 0.80% Space Free | Partition Type: NTFS
Drive G: | 149.01 Gb Total Space | 4.58 Gb Free Space | 3.07% Space Free | Partition Type: FAT32
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: AVATAR
Current User Name: Creator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Creator\Local Settings\temp\clclean.0001 (Macrovision Europe Ltd.)
PRC - C:\Documents and Settings\Creator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
PRC - C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
PRC - C:\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
PRC - C:\Program Files\Adobe\Acrobat 7.0\Distillr\acrotray.exe (Adobe Systems Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\lxddcoms.exe ( )
PRC - C:\Program Files\Lexmark 2500 Series\lxddamon.exe (Lexmark)
PRC - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe (Creative Labs)
PRC - C:\Program Files\Dell\Media Experience\DMXLauncher.exe ()
PRC - C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Company)
PRC - C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology\ELService.exe (Intel Corporation)
PRC - C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation)
PRC - C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
PRC - C:\Program Files\Logitech\Video\LogiTray.exe (Labtec Inc.)
PRC - C:\Program Files\Logitech\Video\FxSvr2.exe (Labtec Inc.)
PRC - C:\WINDOWS\system32\LVCOMSX.EXE (Labtec Inc.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Creator\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (Lavasoft Ad-Aware Service) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (Akamai) – c:\Program Files\Common Files\Akamai\rswin_3725.dll ()
SRV - (Macromedia Licensing Service) – C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe ()
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (sdCoreService) – C:\Program Files\Spyware Doctor\swdsvc.exe (PC Tools)
SRV - (sdAuxService) – C:\Program Files\Spyware Doctor\svcntaux.exe (PC Tools)
SRV - (lxdd_device) – C:\WINDOWS\System32\lxddcoms.exe ( )
SRV - (Creative Labs Licensing Service) – C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe (Creative Labs)
SRV - (ELService) – C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology\ELService.exe (Intel Corporation)
SRV - (IAANTMon) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation)
SRV - (MSSQL$SONY_MEDIAMGR) – C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (SQLAgent$SONY_MEDIAMGR) – C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\System32\DRIVERS\wanatw4.sys File not found
DRV - (DRVNDDM) – C:\WINDOWS\System32\Drivers\DRVNDDM.SYS File not found
DRV - (DRVMCDB) – C:\WINDOWS\System32\Drivers\DRVMCDB.SYS File not found
DRV - (DLAUDFAM) – C:\WINDOWS\System32\DLA\DLAUDFAM.SYS File not found
DRV - (DLAUDF_M) – C:\WINDOWS\System32\DLA\DLAUDF_M.SYS File not found
DRV - (DLARTL_N) – C:\WINDOWS\System32\Drivers\DLARTL_N.SYS File not found
DRV - (DLAPoolM) – C:\WINDOWS\System32\DLA\DLAPoolM.SYS File not found
DRV - (DLAOPIOM) – C:\WINDOWS\System32\DLA\DLAOPIOM.SYS File not found
DRV - (DLAIFS_M) – C:\WINDOWS\System32\DLA\DLAIFS_M.SYS File not found
DRV - (DLADResN) – C:\WINDOWS\System32\DLA\DLADResN.SYS File not found
DRV - (DLACDBHM) – C:\WINDOWS\System32\Drivers\DLACDBHM.SYS File not found
DRV - (DLABOIOM) – C:\WINDOWS\System32\DLA\DLABOIOM.SYS File not found
DRV - (catchme) – C:\DOCUME~1\Creator\LOCALS~1\Temp\catchme.sys File not found
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (ALWIL Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (ALWIL Software)
DRV - (Lbd) – C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (adfs) – C:\WINDOWS\System32\drivers\adfs.sys (Adobe Systems, Inc.)
DRV - (Partizan) – C:\WINDOWS\system32\drivers\Partizan.sys (Greatis Software)
DRV - (IKSysSec) – C:\WINDOWS\system32\drivers\iksyssec.sys (PCTools Research Pty Ltd.)
DRV - (IKSysFlt) – C:\WINDOWS\system32\drivers\iksysflt.sys (PCTools Research Pty Ltd.)
DRV - (IKFileSec) – C:\WINDOWS\system32\drivers\ikfilesec.sys (PCTools Research Pty Ltd.)
DRV - (sptd) – C:\WINDOWS\System32\Drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (IrBus) – C:\WINDOWS\system32\drivers\irbus.sys (Microsoft Corporation)
DRV - (ELhid) – C:\WINDOWS\system32\drivers\ELhid.sys (Intel Corporation)
DRV - (ELmon) – C:\WINDOWS\system32\drivers\ELmon.sys (Intel Corporation)
DRV - (ELkbd) – C:\WINDOWS\system32\drivers\ELkbd.sys (Intel Corporation)
DRV - (ELmou) – C:\WINDOWS\system32\drivers\ELmou.sys (Intel Corporation)
DRV - (ELacpi) – C:\WINDOWS\system32\drivers\ELacpi.sys (Intel Corporation)
DRV - (LVUSBSta) – C:\WINDOWS\system32\drivers\LVUSBSta.sys (Labtec Inc.)
DRV - (RT73) – C:\WINDOWS\system32\drivers\Dr71WU.sys (Ralink Technology, Corp.)
DRV - (LaCieUSBFilter) Silver USB Filter (USB BUS Filter Driver) – C:\WINDOWS\system32\drivers\LaCieUSBFilter.sys (LaCie Group)
DRV - (LaCieFWFilter) Silver 1394 Filter (1394 BUS Filter Driver) – C:\WINDOWS\system32\drivers\LaCieFWFilter.sys (LaCie Group S.A.)
DRV - (e1express) Intel® – C:\WINDOWS\system32\drivers\e1e5132.sys (Intel Corporation)
DRV - (iastor) – C:\WINDOWS\system32\drivers\iastor.sys (Intel Corporation)
DRV - (STHDA) High Definition Audio Driver (WDM) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (CTUSFSYN) – C:\WINDOWS\system32\drivers\CTUSFSYN.SYS (Creative Technology Ltd.)
DRV - (sigfilt) – C:\WINDOWS\system32\drivers\sigfilt.sys (Creative Technology Ltd.)
DRV - (PID_0920) Labtec WebCam(PID_0920) – C:\WINDOWS\system32\drivers\LV532AV.SYS ()
DRV - (ctsfm2k) – C:\WINDOWS\system32\drivers\CTSFM2K.SYS (Creative Technology Ltd)
DRV - (ossrv) – C:\WINDOWS\system32\drivers\CTOSS2K.SYS (Creative Technology Ltd.)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\Hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (amdagp) – C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) – C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (61883) – C:\WINDOWS\system32\drivers\61883.sys (Microsoft Corporation)
DRV - (Avc) – C:\WINDOWS\system32\drivers\avc.sys (Microsoft Corporation)
DRV - (MSDV) – C:\WINDOWS\system32\drivers\msdv.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (a347bus) – C:\WINDOWS\system32\DRIVERS\a347bus.sys ( )
DRV - (a347scsi) – C:\WINDOWS\System32\Drivers\a347scsi.sys ( )
DRV - (MaxtorFrontPanel1) – C:\WINDOWS\system32\drivers\mxofwfp.sys (Maxtor Corp.)
DRV - (Aspi32) – C:\WINDOWS\System32\drivers\ASPI32.SYS (Adaptec)
DRV - (Sparrow) – C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) – C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) – C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) – C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) – C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (ultra) – C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) – C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) – C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) – C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) – C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) – C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) – C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) – C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) – C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (CmdIde) – C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (Asapi) – C:\WINDOWS\System32\drivers\asapi.sys (VOB Computersysteme GmbH)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.fourhourworkweek.com/blog/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.hotmail.com/"

FF - HKLM\software\mozilla\Mozilla Firefox 1.5.0.12\Extensions\\Components: C:\Program Files\Mozilla Firefox\components\ [2007/09/24 18:05:12 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 1.5.0.12\Extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins\ [2010/07/10 16:28:01 | 000,000,000 | —D | M]

[2010/04/29 23:24:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Creator\Application Data\Mozilla\Firefox\Profiles\ck3q5tgs.default\extensions
[2009/09/25 02:53:41 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Creator\Application Data\Mozilla\Firefox\Profiles\ck3q5tgs.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2007/07/21 10:38:04 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Documents and Settings\Creator\Application Data\Mozilla\Firefox\Profiles\ck3q5tgs.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010/07/10 16:28:02 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/07/10 16:28:02 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2007/08/29 20:39:22 | 000,061,038 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\jar50.dll
[2007/08/29 20:39:22 | 000,049,256 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\jsd3250.dll
[2007/08/29 20:39:22 | 000,166,000 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\xpinstal.dll
[2008/09/03 20:11:24 | 000,054,600 | —- | M] (BitTorrent, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll
[2010/04/12 17:29:19 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2009/11/21 05:26:14 | 000,238,776 | —- | M] (Pando Networks) – C:\Program Files\Mozilla Firefox\plugins\npPandoWebInst.dll
[2007/08/21 14:49:24 | 000,000,680 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.png
[2007/08/21 14:49:24 | 000,000,741 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.src
[2007/08/21 14:49:24 | 000,001,150 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\answers.png
[2007/08/21 14:49:24 | 000,000,539 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\answers.src
[2007/08/21 14:49:24 | 000,000,356 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.png
[2007/08/21 14:49:24 | 000,001,007 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.src
[2007/08/21 14:49:24 | 000,000,210 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay.gif
[2007/08/21 14:49:24 | 000,001,056 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay.src
[2007/08/21 14:49:24 | 000,001,076 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\google.gif
[2007/08/21 14:49:24 | 000,000,718 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\google.src
[2007/08/21 14:49:24 | 000,000,088 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo.gif
[2007/08/21 14:49:24 | 000,001,122 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo.src

O1 HOSTS File: ([2010/07/10 04:37:24 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (&RoboForm) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems)
O4 - HKLM..\Run: [Acrobat Assistant 7.0] C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe ()
O4 - HKLM..\Run: [FaxCenterServer] C:\Program Files\Lexmark Fax Solutions\fm3032.exe ()
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe (Labtec Inc.)
O4 - HKLM..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe (Labtec Inc.)
O4 - HKLM..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE (Labtec Inc.)
O4 - HKLM..\Run: [lxddamon] C:\Program Files\Lexmark 2500 Series\lxddamon.exe (Lexmark)
O4 - HKLM..\Run: [LXDDCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXDDtime.DLL (Lexmark International, Inc.)
O4 - HKLM..\Run: [lxddmon.exe] C:\Program Files\Lexmark 2500 Series\lxddmon.exe ()
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (rootkit-scan)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MBMon] C:\WINDOWS\System32\CTMBHA.DLL ()
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)
O4 - HKCU..\Run: [BitTorrent DNA] C:\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
O4 - HKCU..\Run: [RoboForm] C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - HKCU..\Run: [SetDefaultMIDI] C:\WINDOWS\MIDIDEF.EXE (Creative Technology Ltd)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk = C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Customize Menu - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Fill Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: RoboForm Toolbar - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Save Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: contactjuggling.org ([www] https in Trusted sites)
O16 - DPF: {00000055-9980-0010-8000-00AA00389B71} http://codecs.microsoft.com/codecs/i386/fhg.CAB (Reg Error: Key error.)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2…78f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} http://upload.facebook.com/controls/Facebo…toUploader3.cab (Facebook Photo Uploader 4 Control)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {BEA7310D-06C4-4339-A784-DC3804819809} http://costco.pnimedia.com/upload/activex/…veX_Control.cab (Photo Upload Plugin Class)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flash…ent/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D8AA889B-2C65-47C3-8C16-3DCD4EF76A47} http://rms2.invokesolutions.com/events/bin…1437/MILive.cab (Reg Error: Key error.)
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Creator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Creator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/08/16 05:43:04 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (Partizan) - C:\WINDOWS\System32\Partizan.exe (Greatis Software)
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/07/10 17:54:21 | 000,000,000 | —D | C] – C:\_OTL
[2010/07/10 17:53:55 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/07/10 16:28:25 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2010/07/10 16:28:01 | 000,411,368 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2010/07/10 16:28:01 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/07/10 16:28:01 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/07/10 16:28:01 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/07/10 12:34:54 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Creator\Recent
[2010/07/09 16:08:23 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Creator\Desktop\OTL.exe
[2010/07/06 13:40:53 | 000,038,848 | —- | C] (ALWIL Software) – C:\WINDOWS\avastSS.scr
[2010/07/05 23:51:02 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Identities
[2010/07/05 09:04:50 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
[2010/07/05 09:04:44 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Sun
[2010/07/05 00:08:37 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/07/05 00:08:37 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/06/24 17:59:32 | 000,095,024 | —- | C] (Sunbelt Software) – C:\WINDOWS\System32\drivers\SBREDrv.sys
[2010/06/24 17:44:21 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
[2010/06/13 02:46:30 | 000,327,600 | —- | C] (Autodesk, Inc.) – C:\Documents and Settings\Creator\Desktop\AutodeskDesignRevSetup.exe
[2009/09/26 13:24:39 | 000,323,584 | —- | C] ( ) – C:\WINDOWS\System32\LXDDhcp.dll
[2007/04/28 03:10:25 | 000,160,640 | —- | C] ( ) – C:\WINDOWS\System32\drivers\a347bus.sys
[2007/04/28 03:10:25 | 000,005,248 | —- | C] ( ) – C:\WINDOWS\System32\drivers\a347scsi.sys
[2007/01/10 20:02:06 | 000,643,072 | —- | C] ( ) – C:\WINDOWS\System32\lxddpmui.dll
[2007/01/10 20:00:42 | 001,232,896 | —- | C] ( ) – C:\WINDOWS\System32\lxddserv.dll
[2007/01/10 19:54:42 | 000,425,984 | —- | C] ( ) – C:\WINDOWS\System32\lxddcomm.dll
[2007/01/10 19:53:10 | 000,585,728 | —- | C] ( ) – C:\WINDOWS\System32\lxddlmpm.dll
[2007/01/10 19:51:52 | 000,397,312 | —- | C] ( ) – C:\WINDOWS\System32\lxddiesc.dll
[2007/01/10 19:49:44 | 000,094,208 | —- | C] ( ) – C:\WINDOWS\System32\lxddpplc.dll
[2007/01/10 19:49:00 | 000,684,032 | —- | C] ( ) – C:\WINDOWS\System32\lxddcomc.dll
[2007/01/10 19:48:30 | 000,163,840 | —- | C] ( ) – C:\WINDOWS\System32\lxddprox.dll
[2007/01/10 19:42:24 | 000,413,696 | —- | C] ( ) – C:\WINDOWS\System32\lxddinpa.dll
[2007/01/10 19:41:44 | 000,999,424 | —- | C] ( ) – C:\WINDOWS\System32\lxddusb1.dll
[2007/01/10 19:37:42 | 000,696,320 | —- | C] ( ) – C:\WINDOWS\System32\lxddhbn3.dll

========== Files - Modified Within 30 Days ==========

[2010/07/10 18:04:44 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/07/10 18:01:34 | 000,002,335 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
[2010/07/10 17:59:11 | 000,063,302 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2010/07/10 17:58:20 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/07/10 17:57:48 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/07/10 17:57:39 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/07/10 17:56:02 | 014,417,920 | —- | M] () – C:\Documents and Settings\Creator\ntuser.dat
[2010/07/10 17:55:58 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Creator\ntuser.ini
[2010/07/10 04:37:34 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/07/10 04:37:24 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/07/10 03:51:05 | 000,000,074 | —- | M] () – C:\Documents and Settings\Creator\defogger_reenable
[2010/07/10 03:50:12 | 003,728,667 | R— | M] () – C:\Documents and Settings\Creator\Desktop\jgh.exe
[2010/07/10 03:48:57 | 000,050,477 | —- | M] () – C:\Documents and Settings\Creator\Desktop\Defogger.exe
[2010/07/09 21:47:32 | 000,002,451 | —- | M] () – C:\Documents and Settings\Creator\Desktop\HiJackThis.lnk
[2010/07/09 20:48:43 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/07/09 16:08:24 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Creator\Desktop\OTL.exe
[2010/07/09 16:07:58 | 000,359,929 | —- | M] () – C:\Documents and Settings\Creator\Desktop\dds.scr
[2010/07/06 13:40:54 | 000,002,626 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2010/07/06 01:01:48 | 000,078,848 | —- | M] () – C:\Documents and Settings\Creator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/03 22:59:17 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/06/30 03:55:10 | 033,925,298 | —- | M] () – C:\Documents and Settings\Creator\Desktop\M4V00397.MP4
[2010/06/29 02:49:19 | 000,000,005 | —- | M] () – C:\WINDOWS\Twain001.Mtx
[2010/06/29 02:49:16 | 000,000,156 | —- | M] () – C:\WINDOWS\Twunk001.MTX
[2010/06/28 16:57:33 | 000,038,848 | —- | M] (ALWIL Software) – C:\WINDOWS\avastSS.scr
[2010/06/28 16:57:12 | 000,165,032 | —- | M] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2010/06/28 16:37:52 | 000,046,672 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2010/06/28 16:37:30 | 000,165,456 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2010/06/28 16:33:13 | 000,023,376 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2010/06/28 16:32:45 | 000,100,176 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2010/06/28 16:32:42 | 000,094,544 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2010/06/28 16:32:33 | 000,017,744 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2010/06/28 16:32:16 | 000,028,880 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2010/06/27 15:33:13 | 002,649,229 | —- | M] () – C:\Documents and Settings\Creator\Desktop\retake.zip
[2010/06/24 17:59:26 | 000,095,024 | —- | M] (Sunbelt Software) – C:\WINDOWS\System32\drivers\SBREDrv.sys
[2010/06/24 17:59:24 | 000,015,880 | —- | M] () – C:\WINDOWS\System32\lsdelete.exe
[2010/06/24 17:59:08 | 000,064,288 | —- | M] (Lavasoft AB) – C:\WINDOWS\System32\drivers\Lbd.sys
[2010/06/24 17:44:20 | 000,000,885 | —- | M] () – C:\Documents and Settings\Creator\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk
[2010/06/24 17:44:20 | 000,000,867 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2010/06/24 16:52:54 | 001,301,352 | —- | M] () – C:\Documents and Settings\Creator\Desktop\swordfight.mp3
[2010/06/24 16:32:48 | 001,656,308 | —- | M] () – C:\Documents and Settings\Creator\Desktop\tOyLGeXb_QQ.mp3
[2010/06/24 16:15:08 | 023,355,246 | —- | M] () – C:\Documents and Settings\Creator\Desktop\Aileen_Contact_Staff_[www.keepvid.com].flv
[2010/06/18 01:08:43 | 002,103,538 | —- | M] () – C:\Documents and Settings\Creator\Desktop\angel-squared.wmv
[2010/06/13 02:46:30 | 000,327,600 | —- | M] (Autodesk, Inc.) – C:\Documents and Settings\Creator\Desktop\AutodeskDesignRevSetup.exe
[2010/06/13 02:36:46 | 001,609,587 | —- | M] () – C:\Documents and Settings\Creator\Desktop\THMRev4.dwf
[2010/06/10 23:12:11 | 000,002,265 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk

========== Files Created - No Company Name ==========

[2010/07/10 04:04:18 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/07/10 03:50:51 | 000,000,074 | —- | C] () – C:\Documents and Settings\Creator\defogger_reenable
[2010/07/10 03:50:08 | 003,728,667 | R— | C] () – C:\Documents and Settings\Creator\Desktop\jgh.exe
[2010/07/10 03:48:57 | 000,050,477 | —- | C] () – C:\Documents and Settings\Creator\Desktop\Defogger.exe
[2010/07/09 16:07:58 | 000,359,929 | —- | C] () – C:\Documents and Settings\Creator\Desktop\dds.scr
[2010/07/05 09:04:45 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/06/30 03:55:10 | 033,925,298 | —- | C] () – C:\Documents and Settings\Creator\Desktop\M4V00397.MP4
[2010/06/27 15:33:11 | 002,649,229 | —- | C] () – C:\Documents and Settings\Creator\Desktop\retake.zip
[2010/06/24 17:44:20 | 000,000,885 | —- | C] () – C:\Documents and Settings\Creator\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk
[2010/06/24 17:44:20 | 000,000,867 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2010/06/24 16:52:49 | 001,301,352 | —- | C] () – C:\Documents and Settings\Creator\Desktop\swordfight.mp3
[2010/06/24 16:32:41 | 001,656,308 | —- | C] () – C:\Documents and Settings\Creator\Desktop\tOyLGeXb_QQ.mp3
[2010/06/24 16:15:08 | 023,355,246 | —- | C] () – C:\Documents and Settings\Creator\Desktop\Aileen_Contact_Staff_[www.keepvid.com].flv
[2010/06/18 01:08:38 | 002,103,538 | —- | C] () – C:\Documents and Settings\Creator\Desktop\angel-squared.wmv
[2010/06/13 02:36:46 | 001,609,587 | —- | C] () – C:\Documents and Settings\Creator\Desktop\THMRev4.dwf
[2009/09/26 13:27:12 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\LXF3PMON.DLL
[2009/09/26 13:27:12 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\LXF3FXPU.DLL
[2009/09/26 13:26:52 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\lxf3oem.dll
[2009/09/26 13:26:52 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\LXF3PMRC.DLL
[2009/09/26 13:25:16 | 000,000,044 | —- | C] () – C:\WINDOWS\System32\lxddrwrd.ini
[2009/09/26 13:24:39 | 000,278,528 | —- | C] () – C:\WINDOWS\System32\LXDDinst.dll
[2009/09/26 13:23:55 | 000,331,776 | R— | C] () – C:\WINDOWS\System32\lxddcoin.dll
[2009/03/17 10:36:31 | 000,008,192 | —- | C] () – C:\WINDOWS\System32\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/03/12 02:02:15 | 000,010,752 | —- | C] () – C:\WINDOWS\System32\BASSMOD.dll
[2008/09/15 20:14:24 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2008/09/15 20:12:02 | 000,000,416 | —- | C] () – C:\WINDOWS\System32\dtu100.dll.manifest
[2008/09/15 20:12:02 | 000,000,416 | —- | C] () – C:\WINDOWS\System32\dpl100.dll.manifest
[2008/09/15 20:11:10 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\DivXWMPExtType.dll
[2008/08/05 18:01:36 | 000,000,437 | —- | C] () – C:\WINDOWS\PictureAgent.INI
[2008/03/06 02:44:28 | 000,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2007/12/17 15:01:07 | 000,010,688 | —- | C] () – C:\WINDOWS\hpdj3840.ini
[2007/12/16 17:12:49 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2007/11/14 04:01:22 | 000,000,197 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2007/08/21 11:45:14 | 000,008,704 | —- | C] () – C:\WINDOWS\System32\CNMVS75.DLL
[2007/05/01 21:04:21 | 000,000,042 | —- | C] () – C:\WINDOWS\gz_cd99.ini
[2007/02/12 06:46:04 | 000,208,896 | —- | C] () – C:\WINDOWS\System32\lxddgrd.dll
[2007/01/24 03:40:02 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\lxddcaps.dll
[2007/01/10 01:13:08 | 000,692,224 | —- | C] () – C:\WINDOWS\System32\lxdddrs.dll
[2006/12/08 04:24:35 | 000,237,568 | —- | C] () – C:\WINDOWS\System32\lame_enc.dll
[2006/10/07 01:08:04 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\lxddcnv4.dll
[2006/09/27 23:13:18 | 000,593,938 | —- | C] () – C:\WINDOWS\System32\x264vfw.dll
[2006/09/27 23:13:17 | 000,856,064 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2006/09/27 23:13:17 | 000,217,088 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2006/09/27 23:13:15 | 000,005,120 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2006/09/27 23:13:15 | 000,000,547 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll.manifest
[2006/07/04 02:46:44 | 000,163,328 | —- | C] () – C:\WINDOWS\System32\drivers\LV532AV.SYS
[2006/07/04 02:46:44 | 000,009,255 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2006/06/27 01:41:47 | 000,000,023 | —- | C] () – C:\WINDOWS\BlendSettings.ini
[2006/06/26 19:33:20 | 000,001,890 | -HS- | C] () – C:\WINDOWS\System32\KGyGaAvL.sys
[2006/06/26 19:33:20 | 000,000,008 | RHS- | C] () – C:\WINDOWS\System32\8507FF7F11.sys
[2006/06/20 20:17:24 | 000,000,000 | —- | C] () – C:\WINDOWS\plclient.INI
[2006/06/19 15:57:32 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2006/06/19 15:55:08 | 000,000,088 | RHS- | C] () – C:\WINDOWS\System32\C82620BD5E.sys
[2006/06/12 10:15:28 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/06/12 10:12:25 | 000,000,126 | —- | C] () – C:\WINDOWS\wininit.ini
[2006/06/12 10:02:38 | 000,005,811 | —- | C] () – C:\WINDOWS\System32\CTSBMB.INI
[2006/06/12 09:42:11 | 000,004,969 | —- | C] () – C:\WINDOWS\System32\Sigfilt.ini
[2006/06/12 09:42:11 | 000,000,029 | —- | C] () – C:\WINDOWS\System32\ctzapxx.ini
[2006/06/12 09:41:46 | 001,345,520 | —- | C] () – C:\WINDOWS\System32\CTMBHA.DLL
[2006/06/12 09:39:31 | 000,000,494 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2006/06/01 17:22:00 | 001,662,976 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2006/06/01 17:22:00 | 001,466,368 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2006/06/01 17:22:00 | 001,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2006/06/01 17:22:00 | 000,581,632 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[2006/06/01 17:22:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2006/06/01 17:22:00 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2006/06/01 17:22:00 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2006/05/18 10:47:12 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxddvs.dll
[2005/11/10 02:56:34 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2005/08/16 05:37:24 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2005/08/05 15:01:54 | 000,239,104 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2002/05/17 18:18:30 | 000,124,928 | —- | C] () – C:\WINDOWS\System32\mp4fil32.dll
[1999/01/27 13:39:06 | 000,065,024 | —- | C] () – C:\WINDOWS\System32\indounin.dll
[1997/06/13 07:56:08 | 000,056,832 | —- | C] () – C:\WINDOWS\System32\Iyvu9_32.dll
[1996/02/23 17:34:48 | 000,014,629 | —- | C] () – C:\WINDOWS\System32\Declw.dll
[1996/02/22 15:09:20 | 000,032,256 | —- | C] () – C:\WINDOWS\System32\Decln.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2D5907B8
< End of report >

Ringmaster

Post #20July 15, 2010, 3:43 PM UTC

Everything seems to be working fine. The only issue that came up was when I next rebooted my computer after completing the scans. My antivirus detected a file that it said it was "unsure" if it was malicious and asked if it could submit it for analysis. I haven't had anything pop up about that since. I've looked in my antivirus logs but can't find one that has recorded the name of the file for me to post.

oldman960

Post #21July 16, 2010, 1:17 AM UTC

Hi Ringmaster,

So far so good. Your AV may have detected a file that OTL was removing.

One more scan just to check our handywork.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions.
You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button
- Spyware, Adware, Dialers, and other potentially dangerous programs
- Archives
- Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Change the Files of type to Text file (.txt)
Set the Save In to Desktop
click the Save button.
Please post this log in your next reply.

Thanks

oldman960

Post #22July 19, 2010, 12:36 PM UTC

Hi How are you making out?

Ringmaster

Post #23July 20, 2010, 1:43 AM UTC

Finally got the scan completed. No issues with the system running that I've noticed. Here's the log: KASPERSKY ONLINE SCANNER 7.0: scan report Monday, July 19, 2010 Operating system: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Monday, July 19, 2010 08:34:33 Records in database: 4229589 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ Scan statistics: Objects scanned: 206583 Threats found: 6 Infected objects found: 8 Suspicious objects found: 0 Scan duration: 05:18:57 File name / Threat / Threats count C:\Program Files\eMule\Incoming\Super Freakonomics Unplugged.zip Infected: Trojan-Clicker.Win32.AutoIt.n 1 C:\Program Files\eMule\Incoming\Super Freakonomics Unplugged.zip Infected: Trojan-Clicker.Win32.AutoIt.q 1 C:\Qoobox\Quarantine\C\Documents and Settings\NetworkService\Local Settings\Application Data\aivnjlqsk\kcjoikmtssd.exe.vir Infected: Trojan.Win32.FraudPack.azav 1 C:\Qoobox\Quarantine\C\WINDOWS\PRAGMAxnsmqibaph\PRAGMAc.dll.vir Infected: Trojan.Win32.Tdss.beea 1 C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP343\A0051454.sys Infected: Trojan.Win32.FraudPack.ayqt 1 C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP345\A0054593.sys Infected: Rootkit.Win32.TDSS.ap 1 C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP345\A0054637.exe Infected: Trojan.Win32.FraudPack.azav 1 C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP345\A0054638.dll Infected: Trojan.Win32.Tdss.beea 1 Selected area has been scanned.

oldman960

Post #24July 20, 2010, 3:35 AM UTC last edited July 20, 2010, 3:36 AM UTC

Hi Ringmaster,

Most of the Kaspersky detections are old System Restore points and files we have already quarantined. These will be removed when we clean up the tools.

However there is an infected file (2 different variants) that was obtained via a P2P program. This may have also been the source of your infection.

LimeWire, emule.exe, BitTorrent_DNA, and BitTorrent

You have LimeWire, emule.exe, BitTorrent_DNA, and BitTorrent, P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

References for the risk of these programs can be found in these links:
http://www.microsoft.com/windows/ie/commun…protection.mspx

http://www.internetworldstats.com/articles…cles/art053.htm

I would recommend that you uninstall LimeWire, emule.exe, BitTorrent_DNA, and ]BitTorrent, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.

Next, Double click on OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Services

:Files
C:\Program Files\eMule\Incoming\Super Freakonomics Unplugged.zip 

:Commands
[emptytemp]
[emptyflash]
[Reboot]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Next

Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
UNCheck the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open a notepad window, OTL.Txt . There will not be an Extra.txt this time.

Please post back with

OTL fix log
new OTL.txt

Thanks

oldman960

Post #25July 23, 2010, 12:11 PM UTC

Hi Ringmaster, How are you making out?

Ringmaster

Post #26July 23, 2010, 3:56 PM UTC

Ran the scans. No perceptable issues with the system. Logs below: All processes killed ========== SERVICES/DRIVERS ========== ========== FILES ========== File\Folder C:\Program Files\eMule\Incoming\Super Freakonomics Unplugged.zip not found. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: All Users User: Creator ->Temp folder emptied: 110021530 bytes ->Temporary Internet Files folder emptied: 199088432 bytes ->Java cache emptied: 133227 bytes ->FireFox cache emptied: 1244999 bytes ->Flash cache emptied: 42336 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Java cache emptied: 0 bytes ->Flash cache emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 696352 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 297.00 mb [EMPTYFLASH] User: Administrator User: All Users User: Creator ->Flash cache emptied: 0 bytes User: Default User User: LocalService User: NetworkService ->Flash cache emptied: 0 bytes Total Flash Files Cleaned = 0.00 mb OTL by OldTimer - Version 3.2.8.1 log created on 07202010_001008 Files\Folders moved on Reboot… File\Folder C:\Documents and Settings\Creator\Local Settings\Temp\hsperfdata_Creator\5788 not found! C:\Documents and Settings\Creator\Local Settings\Temp\clclean.0001.dir.0000\~df394b.tmp moved successfully. C:\Documents and Settings\Creator\Local Settings\Temp\clclean.0001.dir.0000\~efe2.tmp moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\TUCB5JHC\108151195879699[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\TUCB5JHC\daisy[2].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\TUCB5JHC\dvd-player[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\TUCB5JHC\dvd-player[2].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\TUCB5JHC\dvd-player[3].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\TUCB5JHC\Fetish-Fantasy-Beginners-Enema-450018032[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\TB61QBBK\11[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\TB61QBBK\11[2].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\TB61QBBK\11[7].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\TB61QBBK\dvd-player[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\TB61QBBK\iframe[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\TB61QBBK\iframe[2].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\TB61QBBK\page2[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\TB61QBBK\the-minimalist-principle-omit-needless-things[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\TB61QBBK\viewprofile[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\SQEX81CA\daisy[10].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\SQEX81CA\daisy[9].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\SQEX81CA\dvd-player[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\SQEX81CA\home[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\SQEX81CA\iframe[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\SFJJN9LE\11[2].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\SFJJN9LE\daisy[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\SFJJN9LE\dvd-player[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\SFJJN9LE\iframe[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\SFJJN9LE\mail[2].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\S7Q7KFS3\dvd-player[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\S7Q7KFS3\dvd-player[2].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\S7Q7KFS3\dvd-player[3].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\QLDQEO3K\button[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\QLDQEO3K\button[2].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\Q04GZCPA\ads[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\Q04GZCPA\daisy[2].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\Q04GZCPA\daisy[3].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\Q04GZCPA\dvd-player[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\Q04GZCPA\dvd-player[2].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\Q04GZCPA\history_manager[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\Q04GZCPA\history_manager[2].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\Q04GZCPA\index[4].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\Q04GZCPA\index[7].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\KVY8AM82\daisy[3].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\KVY8AM82\dvd-player[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\KVY8AM82\history_manager[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\KVY8AM82\index[10].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\KVY8AM82\ROS_160x600;sz=160x600;ord=6216791868209[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\KVY8AM82\store[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\KVY8AM82\viewprofile[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\IWF2QSXR\dvd-player[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\IWF2QSXR\dvd-player[2].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\IWF2QSXR\dvd-player[3].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\IWF2QSXR\SweetSavant[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\GN0BO03H\daisy[5].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\GN0BO03H\dvd-player[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\GN0BO03H\index[2].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\GKP77BCA\c=82%7Crand=906046707%7Cpv=y%7Crt=ifr[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\GKP77BCA\daisy[6].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\GKP77BCA\dvd-player[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\GKP77BCA\guidedSearch[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\GKP77BCA\like[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\GKP77BCA\Malekkov[2].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\GKP77BCA\sy.htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\GKP77BCA\viewprofile[2].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\GKP77BCA\viewprofile[4].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\F54SD7YH\297644447[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\F54SD7YH\home[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\F54SD7YH\iframe3[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\F54SD7YH\iframe[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\F54SD7YH\iframe[2].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\F54SD7YH\index[2].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\F54SD7YH\nikkijumper[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\F54SD7YH\Reach_Out_&_Touch_Me-Scene-11-MED[1].mp4 moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\F54SD7YH\redirectiframe[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\DPK3DG61\cj[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\DPK3DG61\dvd-player[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\DPK3DG61\index[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\DPK3DG61\mail[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\DPK3DG61\openhand[1].cur moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\DF1BHO7X\11[2].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\DF1BHO7X\D141E0C6-6DB5-11DF-B57C-BA8C3FF5047F[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\DF1BHO7X\daisy[3].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\DF1BHO7X\daisy[8].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\DF1BHO7X\iframe[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\D8S168B9\dvd-player[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\D8S168B9\iframe[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\D8S168B9\iframe[2].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\D8S168B9\index[2].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\D8S168B9\index[3].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\D8S168B9\mail[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\D8S168B9\profile[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\D8S168B9\ROS_728x90;sz=728x90;ord=3136866092681[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\D8S168B9\viewprofile[4].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\88LO7S7M\blog[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\88LO7S7M\c=82%7Crand=937110593%7Cpv=y%7Crt=ifr[1].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\Content.IE5\88LO7S7M\history_manager[5].htm moved successfully. C:\Documents and Settings\Creator\Local Settings\Temporary Internet Files\AntiPhishing\A0AB7674-8D67-4F4D-B5E1-96FAEADFB79D.dat moved successfully. File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot. File\Folder C:\WINDOWS\temp\Perflib_Perfdata_424.dat not found! Registry entries deleted on Reboot…

Ringmaster

Post #27July 23, 2010, 3:57 PM UTC

OTL logfile created on: 7/23/2010 8:53:48 AM - Run 4
OTL by OldTimer - Version 3.2.8.1 Folder = C:\Documents and Settings\Creator\Desktop
Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 66.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 86.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 228.14 Gb Total Space | 6.57 Gb Free Space | 2.88% Space Free | Partition Type: NTFS
Drive D: | 4.09 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
Drive F: | 111.72 Gb Total Space | 1.77 Gb Free Space | 1.59% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: AVATAR
Current User Name: Creator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Creator\Local Settings\temp\clclean.0001 (Macrovision Europe Ltd.)
PRC - C:\Documents and Settings\Creator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
PRC - C:\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
PRC - C:\Program Files\Adobe\Acrobat 7.0\Distillr\acrotray.exe (Adobe Systems Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\lxddcoms.exe ( )
PRC - C:\Program Files\Lexmark 2500 Series\lxddmon.exe ()
PRC - C:\Program Files\Lexmark 2500 Series\lxddamon.exe (Lexmark)
PRC - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe (Creative Labs)
PRC - C:\Program Files\Dell\Media Experience\DMXLauncher.exe ()
PRC - C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Company)
PRC - C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology\ELService.exe (Intel Corporation)
PRC - C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation)
PRC - C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
PRC - C:\Program Files\Logitech\Video\LogiTray.exe (Labtec Inc.)
PRC - C:\Program Files\Logitech\Video\FxSvr2.exe (Labtec Inc.)
PRC - C:\WINDOWS\system32\LVCOMSX.EXE (Labtec Inc.)
PRC - C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe (Adobe Systems Incorporated)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Creator\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (Lavasoft Ad-Aware Service) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (Akamai) – c:\Program Files\Common Files\Akamai\rswin_3725.dll ()
SRV - (Macromedia Licensing Service) – C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe ()
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (sdCoreService) – C:\Program Files\Spyware Doctor\swdsvc.exe (PC Tools)
SRV - (sdAuxService) – C:\Program Files\Spyware Doctor\svcntaux.exe (PC Tools)
SRV - (lxdd_device) – C:\WINDOWS\System32\lxddcoms.exe ( )
SRV - (Creative Labs Licensing Service) – C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe (Creative Labs)
SRV - (ELService) – C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology\ELService.exe (Intel Corporation)
SRV - (IAANTMon) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation)
SRV - (MSSQL$SONY_MEDIAMGR) – C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (SQLAgent$SONY_MEDIAMGR) – C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\System32\DRIVERS\wanatw4.sys File not found
DRV - (DRVNDDM) – C:\WINDOWS\System32\Drivers\DRVNDDM.SYS File not found
DRV - (DRVMCDB) – C:\WINDOWS\System32\Drivers\DRVMCDB.SYS File not found
DRV - (DLAUDFAM) – C:\WINDOWS\System32\DLA\DLAUDFAM.SYS File not found
DRV - (DLAUDF_M) – C:\WINDOWS\System32\DLA\DLAUDF_M.SYS File not found
DRV - (DLARTL_N) – C:\WINDOWS\System32\Drivers\DLARTL_N.SYS File not found
DRV - (DLAPoolM) – C:\WINDOWS\System32\DLA\DLAPoolM.SYS File not found
DRV - (DLAOPIOM) – C:\WINDOWS\System32\DLA\DLAOPIOM.SYS File not found
DRV - (DLAIFS_M) – C:\WINDOWS\System32\DLA\DLAIFS_M.SYS File not found
DRV - (DLADResN) – C:\WINDOWS\System32\DLA\DLADResN.SYS File not found
DRV - (DLACDBHM) – C:\WINDOWS\System32\Drivers\DLACDBHM.SYS File not found
DRV - (DLABOIOM) – C:\WINDOWS\System32\DLA\DLABOIOM.SYS File not found
DRV - (catchme) – C:\DOCUME~1\Creator\LOCALS~1\Temp\catchme.sys File not found
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (ALWIL Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (ALWIL Software)
DRV - (Lbd) – C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (adfs) – C:\WINDOWS\System32\drivers\adfs.sys (Adobe Systems, Inc.)
DRV - (Partizan) – C:\WINDOWS\system32\drivers\Partizan.sys (Greatis Software)
DRV - (IKSysSec) – C:\WINDOWS\system32\drivers\iksyssec.sys (PCTools Research Pty Ltd.)
DRV - (IKSysFlt) – C:\WINDOWS\system32\drivers\iksysflt.sys (PCTools Research Pty Ltd.)
DRV - (IKFileSec) – C:\WINDOWS\system32\drivers\ikfilesec.sys (PCTools Research Pty Ltd.)
DRV - (sptd) – C:\WINDOWS\System32\Drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (IrBus) – C:\WINDOWS\system32\drivers\irbus.sys (Microsoft Corporation)
DRV - (ELhid) – C:\WINDOWS\system32\drivers\ELhid.sys (Intel Corporation)
DRV - (ELmon) – C:\WINDOWS\system32\drivers\ELmon.sys (Intel Corporation)
DRV - (ELkbd) – C:\WINDOWS\system32\drivers\ELkbd.sys (Intel Corporation)
DRV - (ELmou) – C:\WINDOWS\system32\drivers\ELmou.sys (Intel Corporation)
DRV - (ELacpi) – C:\WINDOWS\system32\drivers\ELacpi.sys (Intel Corporation)
DRV - (LVUSBSta) – C:\WINDOWS\system32\drivers\LVUSBSta.sys (Labtec Inc.)
DRV - (RT73) – C:\WINDOWS\system32\drivers\Dr71WU.sys (Ralink Technology, Corp.)
DRV - (LaCieUSBFilter) Silver USB Filter (USB BUS Filter Driver) – C:\WINDOWS\system32\drivers\LaCieUSBFilter.sys (LaCie Group)
DRV - (LaCieFWFilter) Silver 1394 Filter (1394 BUS Filter Driver) – C:\WINDOWS\system32\drivers\LaCieFWFilter.sys (LaCie Group S.A.)
DRV - (e1express) Intel® – C:\WINDOWS\system32\drivers\e1e5132.sys (Intel Corporation)
DRV - (iastor) – C:\WINDOWS\system32\drivers\iastor.sys (Intel Corporation)
DRV - (STHDA) High Definition Audio Driver (WDM) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (CTUSFSYN) – C:\WINDOWS\system32\drivers\CTUSFSYN.SYS (Creative Technology Ltd.)
DRV - (sigfilt) – C:\WINDOWS\system32\drivers\sigfilt.sys (Creative Technology Ltd.)
DRV - (PID_0920) Labtec WebCam(PID_0920) – C:\WINDOWS\system32\drivers\LV532AV.SYS ()
DRV - (ctsfm2k) – C:\WINDOWS\system32\drivers\CTSFM2K.SYS (Creative Technology Ltd)
DRV - (ossrv) – C:\WINDOWS\system32\drivers\CTOSS2K.SYS (Creative Technology Ltd.)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\Hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (amdagp) – C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) – C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (61883) – C:\WINDOWS\system32\drivers\61883.sys (Microsoft Corporation)
DRV - (Avc) – C:\WINDOWS\system32\drivers\avc.sys (Microsoft Corporation)
DRV - (MSDV) – C:\WINDOWS\system32\drivers\msdv.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (a347bus) – C:\WINDOWS\system32\DRIVERS\a347bus.sys ( )
DRV - (a347scsi) – C:\WINDOWS\System32\Drivers\a347scsi.sys ( )
DRV - (MaxtorFrontPanel1) – C:\WINDOWS\system32\drivers\mxofwfp.sys (Maxtor Corp.)
DRV - (Aspi32) – C:\WINDOWS\System32\drivers\ASPI32.SYS (Adaptec)
DRV - (Sparrow) – C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) – C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) – C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) – C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) – C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (ultra) – C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) – C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) – C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) – C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) – C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) – C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) – C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) – C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) – C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (CmdIde) – C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (Asapi) – C:\WINDOWS\System32\drivers\asapi.sys (VOB Computersysteme GmbH)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.fourhourworkweek.com/blog/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.hotmail.com/"

FF - HKLM\software\mozilla\Mozilla Firefox 1.5.0.12\Extensions\\Components: C:\Program Files\Mozilla Firefox\components\ [2007/09/24 18:05:12 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 1.5.0.12\Extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins\ [2010/07/10 16:28:01 | 000,000,000 | —D | M]

[2010/04/29 23:24:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Creator\Application Data\Mozilla\Firefox\Profiles\ck3q5tgs.default\extensions
[2009/09/25 02:53:41 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Creator\Application Data\Mozilla\Firefox\Profiles\ck3q5tgs.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2007/07/21 10:38:04 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Documents and Settings\Creator\Application Data\Mozilla\Firefox\Profiles\ck3q5tgs.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010/07/10 16:28:02 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/07/10 16:28:02 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2007/08/29 20:39:22 | 000,061,038 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\jar50.dll
[2007/08/29 20:39:22 | 000,049,256 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\jsd3250.dll
[2007/08/29 20:39:22 | 000,166,000 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\xpinstal.dll
[2008/09/03 20:11:24 | 000,054,600 | —- | M] (BitTorrent, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll
[2010/04/12 17:29:19 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2009/11/21 05:26:14 | 000,238,776 | —- | M] (Pando Networks) – C:\Program Files\Mozilla Firefox\plugins\npPandoWebInst.dll
[2007/08/21 14:49:24 | 000,000,680 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.png
[2007/08/21 14:49:24 | 000,000,741 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.src
[2007/08/21 14:49:24 | 000,001,150 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\answers.png
[2007/08/21 14:49:24 | 000,000,539 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\answers.src
[2007/08/21 14:49:24 | 000,000,356 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.png
[2007/08/21 14:49:24 | 000,001,007 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.src
[2007/08/21 14:49:24 | 000,000,210 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay.gif
[2007/08/21 14:49:24 | 000,001,056 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay.src
[2007/08/21 14:49:24 | 000,001,076 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\google.gif
[2007/08/21 14:49:24 | 000,000,718 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\google.src
[2007/08/21 14:49:24 | 000,000,088 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo.gif
[2007/08/21 14:49:24 | 000,001,122 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo.src

O1 HOSTS File: ([2010/07/10 04:37:24 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (&RoboForm) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems)
O4 - HKLM..\Run: [Acrobat Assistant 7.0] C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe ()
O4 - HKLM..\Run: [FaxCenterServer] C:\Program Files\Lexmark Fax Solutions\fm3032.exe ()
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe (Labtec Inc.)
O4 - HKLM..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe (Labtec Inc.)
O4 - HKLM..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE (Labtec Inc.)
O4 - HKLM..\Run: [lxddamon] C:\Program Files\Lexmark 2500 Series\lxddamon.exe (Lexmark)
O4 - HKLM..\Run: [LXDDCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXDDtime.DLL (Lexmark International, Inc.)
O4 - HKLM..\Run: [lxddmon.exe] C:\Program Files\Lexmark 2500 Series\lxddmon.exe ()
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (rootkit-scan)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MBMon] C:\WINDOWS\System32\CTMBHA.DLL ()
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)
O4 - HKCU..\Run: [BitTorrent DNA] C:\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
O4 - HKCU..\Run: [RoboForm] C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - HKCU..\Run: [SetDefaultMIDI] C:\WINDOWS\MIDIDEF.EXE (Creative Technology Ltd)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk = C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Customize Menu - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Fill Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: RoboForm Toolbar - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Save Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: contactjuggling.org ([www] https in Trusted sites)
O16 - DPF: {00000055-9980-0010-8000-00AA00389B71} http://codecs.microsoft.com/codecs/i386/fhg.CAB (Reg Error: Key error.)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2…78f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} http://upload.facebook.com/controls/Facebo…toUploader3.cab (Facebook Photo Uploader 4 Control)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {BEA7310D-06C4-4339-A784-DC3804819809} http://costco.pnimedia.com/upload/activex/…veX_Control.cab (Photo Upload Plugin Class)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flash…ent/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D8AA889B-2C65-47C3-8C16-3DCD4EF76A47} http://rms2.invokesolutions.com/events/bin…1437/MILive.cab (Reg Error: Key error.)
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Creator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Creator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/08/16 05:43:04 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (Partizan) - C:\WINDOWS\System32\Partizan.exe (Greatis Software)
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/07/10 17:54:21 | 000,000,000 | —D | C] – C:\_OTL
[2010/07/10 17:53:55 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/07/10 16:28:25 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2010/07/10 16:28:01 | 000,411,368 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2010/07/10 16:28:01 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/07/10 16:28:01 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/07/10 16:28:01 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/07/10 12:34:54 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Creator\Recent
[2010/07/09 16:08:23 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Creator\Desktop\OTL.exe
[2010/07/06 13:40:53 | 000,038,848 | —- | C] (ALWIL Software) – C:\WINDOWS\avastSS.scr
[2010/07/05 23:51:02 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Identities
[2010/07/05 09:04:50 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
[2010/07/05 09:04:44 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Sun
[2010/07/05 00:08:37 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/07/05 00:08:37 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/06/24 17:59:32 | 000,095,024 | —- | C] (Sunbelt Software) – C:\WINDOWS\System32\drivers\SBREDrv.sys
[2010/06/24 17:44:21 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
[2009/09/26 13:24:39 | 000,323,584 | —- | C] ( ) – C:\WINDOWS\System32\LXDDhcp.dll
[2007/04/28 03:10:25 | 000,160,640 | —- | C] ( ) – C:\WINDOWS\System32\drivers\a347bus.sys
[2007/04/28 03:10:25 | 000,005,248 | —- | C] ( ) – C:\WINDOWS\System32\drivers\a347scsi.sys
[2007/01/10 20:02:06 | 000,643,072 | —- | C] ( ) – C:\WINDOWS\System32\lxddpmui.dll
[2007/01/10 20:00:42 | 001,232,896 | —- | C] ( ) – C:\WINDOWS\System32\lxddserv.dll
[2007/01/10 19:54:42 | 000,425,984 | —- | C] ( ) – C:\WINDOWS\System32\lxddcomm.dll
[2007/01/10 19:53:10 | 000,585,728 | —- | C] ( ) – C:\WINDOWS\System32\lxddlmpm.dll
[2007/01/10 19:51:52 | 000,397,312 | —- | C] ( ) – C:\WINDOWS\System32\lxddiesc.dll
[2007/01/10 19:49:44 | 000,094,208 | —- | C] ( ) – C:\WINDOWS\System32\lxddpplc.dll
[2007/01/10 19:49:00 | 000,684,032 | —- | C] ( ) – C:\WINDOWS\System32\lxddcomc.dll
[2007/01/10 19:48:30 | 000,163,840 | —- | C] ( ) – C:\WINDOWS\System32\lxddprox.dll
[2007/01/10 19:42:24 | 000,413,696 | —- | C] ( ) – C:\WINDOWS\System32\lxddinpa.dll
[2007/01/10 19:41:44 | 000,999,424 | —- | C] ( ) – C:\WINDOWS\System32\lxddusb1.dll
[2007/01/10 19:37:42 | 000,696,320 | —- | C] ( ) – C:\WINDOWS\System32\lxddhbn3.dll

========== Files - Modified Within 30 Days ==========

[2010/07/22 23:57:56 | 000,359,342 | —- | M] () – C:\Documents and Settings\Creator\Desktop\Smoke_by_vpiotr.jpg
[2010/07/22 20:47:30 | 000,370,712 | —- | M] () – C:\Documents and Settings\Creator\Desktop\Self-assessment WEB.jpg
[2010/07/22 20:22:16 | 004,579,237 | —- | M] () – C:\Documents and Settings\Creator\Desktop\Self-assessment copy.jpg
[2010/07/22 20:20:37 | 234,810,079 | —- | M] () – C:\Documents and Settings\Creator\Desktop\Self-assessment.psd
[2010/07/22 18:01:24 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/07/22 01:10:13 | 001,503,889 | —- | M] () – C:\Documents and Settings\Creator\Desktop\Smoke_3_Inverted_by_Teknari.jpg
[2010/07/22 01:09:14 | 000,975,908 | —- | M] () – C:\Documents and Settings\Creator\Desktop\smoke%20iStock_000002749818Large.jpg
[2010/07/22 00:49:18 | 000,007,757 | —- | M] () – C:\Documents and Settings\Creator\Desktop\_QUE7735.xmp
[2010/07/22 00:15:26 | 000,078,336 | —- | M] () – C:\Documents and Settings\Creator\Desktop\Brain arrows.doc
[2010/07/21 23:27:20 | 016,192,689 | —- | M] () – C:\Documents and Settings\Creator\Desktop\_QUE7735.NEF
[2010/07/21 02:21:09 | 014,417,920 | —- | M] () – C:\Documents and Settings\Creator\ntuser.dat
[2010/07/21 01:59:56 | 000,030,095 | —- | M] () – C:\Documents and Settings\Creator\Desktop\chicken_soup.jpg
[2010/07/20 01:02:31 | 000,002,335 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
[2010/07/20 01:01:21 | 000,063,302 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2010/07/20 01:01:03 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/07/20 00:13:40 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/07/20 00:13:30 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/07/20 00:12:15 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Creator\ntuser.ini
[2010/07/19 23:42:55 | 000,080,384 | —- | M] () – C:\Documents and Settings\Creator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/17 22:59:01 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/07/16 17:00:17 | 000,000,005 | —- | M] () – C:\WINDOWS\Twain001.Mtx
[2010/07/16 17:00:16 | 000,000,156 | —- | M] () – C:\WINDOWS\Twunk001.MTX
[2010/07/13 07:56:43 | 000,047,388 | —- | M] () – C:\Documents and Settings\Creator\Desktop\General Fire Safety Guidlelines.rtf
[2010/07/10 04:37:34 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/07/10 04:37:24 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/07/10 03:51:05 | 000,000,074 | —- | M] () – C:\Documents and Settings\Creator\defogger_reenable
[2010/07/10 03:50:12 | 003,728,667 | R— | M] () – C:\Documents and Settings\Creator\Desktop\jgh.exe
[2010/07/10 03:48:57 | 000,050,477 | —- | M] () – C:\Documents and Settings\Creator\Desktop\Defogger.exe
[2010/07/09 21:47:32 | 000,002,451 | —- | M] () – C:\Documents and Settings\Creator\Desktop\HiJackThis.lnk
[2010/07/09 20:48:43 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/07/09 16:08:24 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Creator\Desktop\OTL.exe
[2010/07/09 16:07:58 | 000,359,929 | —- | M] () – C:\Documents and Settings\Creator\Desktop\dds.scr
[2010/07/06 13:40:54 | 000,002,626 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2010/06/30 03:55:10 | 033,925,298 | —- | M] () – C:\Documents and Settings\Creator\Desktop\M4V00397.MP4
[2010/06/28 16:57:33 | 000,038,848 | —- | M] (ALWIL Software) – C:\WINDOWS\avastSS.scr
[2010/06/28 16:57:12 | 000,165,032 | —- | M] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2010/06/28 16:37:52 | 000,046,672 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2010/06/28 16:37:30 | 000,165,456 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2010/06/28 16:33:13 | 000,023,376 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2010/06/28 16:32:45 | 000,100,176 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2010/06/28 16:32:42 | 000,094,544 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2010/06/28 16:32:33 | 000,017,744 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2010/06/28 16:32:16 | 000,028,880 | —- | M] (ALWIL Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2010/06/27 15:33:13 | 002,649,229 | —- | M] () – C:\Documents and Settings\Creator\Desktop\retake.zip
[2010/06/24 17:59:26 | 000,095,024 | —- | M] (Sunbelt Software) – C:\WINDOWS\System32\drivers\SBREDrv.sys
[2010/06/24 17:59:24 | 000,015,880 | —- | M] () – C:\WINDOWS\System32\lsdelete.exe
[2010/06/24 17:59:08 | 000,064,288 | —- | M] (Lavasoft AB) – C:\WINDOWS\System32\drivers\Lbd.sys
[2010/06/24 17:44:20 | 000,000,885 | —- | M] () – C:\Documents and Settings\Creator\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk
[2010/06/24 17:44:20 | 000,000,867 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2010/06/24 16:52:54 | 001,301,352 | —- | M] () – C:\Documents and Settings\Creator\Desktop\swordfight.mp3
[2010/06/24 16:32:48 | 001,656,308 | —- | M] () – C:\Documents and Settings\Creator\Desktop\tOyLGeXb_QQ.mp3
[2010/06/24 16:15:08 | 023,355,246 | —- | M] () – C:\Documents and Settings\Creator\Desktop\Aileen_Contact_Staff_[www.keepvid.com].flv

========== Files Created - No Company Name ==========

[2010/07/22 23:58:17 | 000,359,342 | —- | C] () – C:\Documents and Settings\Creator\Desktop\Smoke_by_vpiotr.jpg
[2010/07/22 20:47:28 | 000,370,712 | —- | C] () – C:\Documents and Settings\Creator\Desktop\Self-assessment WEB.jpg
[2010/07/22 20:22:08 | 004,579,237 | —- | C] () – C:\Documents and Settings\Creator\Desktop\Self-assessment copy.jpg
[2010/07/22 01:23:36 | 234,810,079 | —- | C] () – C:\Documents and Settings\Creator\Desktop\Self-assessment.psd
[2010/07/22 01:10:34 | 001,503,889 | —- | C] () – C:\Documents and Settings\Creator\Desktop\Smoke_3_Inverted_by_Teknari.jpg
[2010/07/22 01:10:07 | 000,975,908 | —- | C] () – C:\Documents and Settings\Creator\Desktop\smoke%20iStock_000002749818Large.jpg
[2010/07/22 00:49:18 | 000,007,757 | —- | C] () – C:\Documents and Settings\Creator\Desktop\_QUE7735.xmp
[2010/07/22 00:40:17 | 016,192,689 | —- | C] () – C:\Documents and Settings\Creator\Desktop\_QUE7735.NEF
[2010/07/22 00:15:26 | 000,078,336 | —- | C] () – C:\Documents and Settings\Creator\Desktop\Brain arrows.doc
[2010/07/21 02:00:07 | 000,030,095 | —- | C] () – C:\Documents and Settings\Creator\Desktop\chicken_soup.jpg
[2010/07/13 07:56:43 | 000,047,388 | —- | C] () – C:\Documents and Settings\Creator\Desktop\General Fire Safety Guidlelines.rtf
[2010/07/10 04:04:18 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/07/10 03:50:51 | 000,000,074 | —- | C] () – C:\Documents and Settings\Creator\defogger_reenable
[2010/07/10 03:50:08 | 003,728,667 | R— | C] () – C:\Documents and Settings\Creator\Desktop\jgh.exe
[2010/07/10 03:48:57 | 000,050,477 | —- | C] () – C:\Documents and Settings\Creator\Desktop\Defogger.exe
[2010/07/09 16:07:58 | 000,359,929 | —- | C] () – C:\Documents and Settings\Creator\Desktop\dds.scr
[2010/07/05 09:04:45 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/06/30 03:55:10 | 033,925,298 | —- | C] () – C:\Documents and Settings\Creator\Desktop\M4V00397.MP4
[2010/06/27 15:33:11 | 002,649,229 | —- | C] () – C:\Documents and Settings\Creator\Desktop\retake.zip
[2010/06/24 17:44:20 | 000,000,885 | —- | C] () – C:\Documents and Settings\Creator\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk
[2010/06/24 17:44:20 | 000,000,867 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2010/06/24 16:52:49 | 001,301,352 | —- | C] () – C:\Documents and Settings\Creator\Desktop\swordfight.mp3
[2010/06/24 16:32:41 | 001,656,308 | —- | C] () – C:\Documents and Settings\Creator\Desktop\tOyLGeXb_QQ.mp3
[2010/06/24 16:15:08 | 023,355,246 | —- | C] () – C:\Documents and Settings\Creator\Desktop\Aileen_Contact_Staff_[www.keepvid.com].flv
[2009/09/26 13:27:12 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\LXF3PMON.DLL
[2009/09/26 13:27:12 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\LXF3FXPU.DLL
[2009/09/26 13:26:52 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\lxf3oem.dll
[2009/09/26 13:26:52 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\LXF3PMRC.DLL
[2009/09/26 13:25:16 | 000,000,044 | —- | C] () – C:\WINDOWS\System32\lxddrwrd.ini
[2009/09/26 13:24:39 | 000,278,528 | —- | C] () – C:\WINDOWS\System32\LXDDinst.dll
[2009/09/26 13:23:55 | 000,331,776 | R— | C] () – C:\WINDOWS\System32\lxddcoin.dll
[2009/03/17 10:36:31 | 000,008,192 | —- | C] () – C:\WINDOWS\System32\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/03/12 02:02:15 | 000,010,752 | —- | C] () – C:\WINDOWS\System32\BASSMOD.dll
[2008/09/15 20:14:24 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2008/09/15 20:12:02 | 000,000,416 | —- | C] () – C:\WINDOWS\System32\dtu100.dll.manifest
[2008/09/15 20:12:02 | 000,000,416 | —- | C] () – C:\WINDOWS\System32\dpl100.dll.manifest
[2008/09/15 20:11:10 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\DivXWMPExtType.dll
[2008/08/05 18:01:36 | 000,000,437 | —- | C] () – C:\WINDOWS\PictureAgent.INI
[2008/03/06 02:44:28 | 000,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2007/12/17 15:01:07 | 000,010,688 | —- | C] () – C:\WINDOWS\hpdj3840.ini
[2007/12/16 17:12:49 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2007/11/14 04:01:22 | 000,000,197 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2007/08/21 11:45:14 | 000,008,704 | —- | C] () – C:\WINDOWS\System32\CNMVS75.DLL
[2007/05/01 21:04:21 | 000,000,042 | —- | C] () – C:\WINDOWS\gz_cd99.ini
[2007/02/12 06:46:04 | 000,208,896 | —- | C] () – C:\WINDOWS\System32\lxddgrd.dll
[2007/01/24 03:40:02 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\lxddcaps.dll
[2007/01/10 01:13:08 | 000,692,224 | —- | C] () – C:\WINDOWS\System32\lxdddrs.dll
[2006/12/08 04:24:35 | 000,237,568 | —- | C] () – C:\WINDOWS\System32\lame_enc.dll
[2006/10/07 01:08:04 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\lxddcnv4.dll
[2006/09/27 23:13:18 | 000,593,938 | —- | C] () – C:\WINDOWS\System32\x264vfw.dll
[2006/09/27 23:13:17 | 000,856,064 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2006/09/27 23:13:17 | 000,217,088 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2006/09/27 23:13:15 | 000,005,120 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2006/09/27 23:13:15 | 000,000,547 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll.manifest
[2006/07/04 02:46:44 | 000,163,328 | —- | C] () – C:\WINDOWS\System32\drivers\LV532AV.SYS
[2006/07/04 02:46:44 | 000,009,255 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2006/06/27 01:41:47 | 000,000,023 | —- | C] () – C:\WINDOWS\BlendSettings.ini
[2006/06/26 19:33:20 | 000,001,890 | -HS- | C] () – C:\WINDOWS\System32\KGyGaAvL.sys
[2006/06/26 19:33:20 | 000,000,008 | RHS- | C] () – C:\WINDOWS\System32\8507FF7F11.sys
[2006/06/20 20:17:24 | 000,000,000 | —- | C] () – C:\WINDOWS\plclient.INI
[2006/06/19 15:57:32 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2006/06/19 15:55:08 | 000,000,088 | RHS- | C] () – C:\WINDOWS\System32\C82620BD5E.sys
[2006/06/12 10:15:28 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/06/12 10:12:25 | 000,000,126 | —- | C] () – C:\WINDOWS\wininit.ini
[2006/06/12 10:02:38 | 000,005,811 | —- | C] () – C:\WINDOWS\System32\CTSBMB.INI
[2006/06/12 09:42:11 | 000,004,969 | —- | C] () – C:\WINDOWS\System32\Sigfilt.ini
[2006/06/12 09:42:11 | 000,000,029 | —- | C] () – C:\WINDOWS\System32\ctzapxx.ini
[2006/06/12 09:41:46 | 001,345,520 | —- | C] () – C:\WINDOWS\System32\CTMBHA.DLL
[2006/06/12 09:39:31 | 000,000,494 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2006/06/01 17:22:00 | 001,662,976 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2006/06/01 17:22:00 | 001,466,368 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2006/06/01 17:22:00 | 001,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2006/06/01 17:22:00 | 000,581,632 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[2006/06/01 17:22:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2006/06/01 17:22:00 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2006/06/01 17:22:00 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2006/05/18 10:47:12 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxddvs.dll
[2005/11/10 02:56:34 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2005/08/16 05:37:24 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2005/08/05 15:01:54 | 000,239,104 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2002/05/17 18:18:30 | 000,124,928 | —- | C] () – C:\WINDOWS\System32\mp4fil32.dll
[1999/01/27 13:39:06 | 000,065,024 | —- | C] () – C:\WINDOWS\System32\indounin.dll
[1997/06/13 07:56:08 | 000,056,832 | —- | C] () – C:\WINDOWS\System32\Iyvu9_32.dll
[1996/02/23 17:34:48 | 000,014,629 | —- | C] () – C:\WINDOWS\System32\Declw.dll
[1996/02/22 15:09:20 | 000,032,256 | —- | C] () – C:\WINDOWS\System32\Decln.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2D5907B8
< End of report >

oldman960

Post #28July 24, 2010, 1:09 AM UTC

Hi Ringmaster,

Looks good.

From your desktop, please delete, if present

any notepads/logs that we created
DDS.scr

Keep Defogger, we will use it shortly.

Next

Click the Start button, click Run. Copy and paste the following line into the run box and click OK
Combofix /uninstall

Open OTL then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.

I suggest you keep MBAM. Keep MBAM updated and use it regularly.

To re-enable your Emulation drivers, double click DeFogger to run the tool.

The application window will appear
Click the Re-enable button to re-enable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.

Some Recommendations and prevention tips

You have an older version of Adobe Reader. You can download the current version HERE

You may want to consider Foxit Reader instead. It may be a bit lighter on resources.

Visit their support forum
Foxit Forum

In either case you should uninstall Adobe Reader 7.0 first. Be sure to move any PDF documents to another folder first though.

Some Recommendations and prevention tips

Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall. You have those already. You may find an antispyware more to your liking HERE

You should also use Spyware Blaster to help immunize your computer.

- SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

OR

A guide to understanding and using the hosts file.

Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS

Please read the info on disabling the DNS Client before installing a custom hosts file.

-Secure your Internet Explorer

From within Internet Explorer click on the Tools menu and then click on Options.

Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.

Next press the Apply button and then the OK to exit the Internet Properties page.

- Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis

- Ensure that Automatic Update is turned on so you get all the latest patches.
Click start, control panel, click Security Center.

- Keep your antivirus program updated, as well as any other security programs you have.

- You may also want to read this article By Tony Klein
http://www.freedomlist.com/forum/viewtopic.php?t=22879

We will keep this thread open for a couple of days.

Take care

oldman960

Post #29August 1, 2010, 5:03 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Win32:Jifas?

✨ Ask AI

Ask AI