Spyware / Malware / Virus Removal

Spyware/Malware Problem..

13 min read

Looking for the outcome? Ask AI

jsmith Topic Starter

Post #1July 23, 2010, 7:19 PM UTC last edited July 23, 2010, 7:20 PM UTC

Hello everyone,

A couple of days ago while I was surfing some sites, I visit them on a weekly bases, I had NOD going crazy blocking some indian sites and it turned off my windows firewall. After this I did a full scan with Malware bytes and removed the malwares and stuff and thought I was ok.. Yesterday I visited another site and once again I had an "attack" from another indian site (I mean .in site) this time tried to open something with Windows Media Player :/ Blocked it and nod but something was broken.. Did another full scan with Malware bytes found some more malware tried to remove it and restarted.. Now after that restart once the pc starts I only see the desktop image. I did CTRL+ALT+DEL and then run explorer in order to see everything and of course the cleaning on restart didn't work.. Tried a lot of programs and there are still various malware and registry changes (mainly with userinit.exe)..

By the way I use Win XP Home SP3..

Here is HijackThis log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:09:31 PM, on 7/23/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\DOCUME~1\Thomas\LOCALS~1\Temp\svcnost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Acer\Empowering Technology\admServ.exe
c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\admtray.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Acer\Acer Arcade\PCMService.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\DOCUME~1\Thomas\LOCALS~1\Temp\RtkBtMnt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://el.intl.acer.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://el.intl.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://el.intl.acer.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/def…://uk.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = OoiaYoaeo
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Aiceuo aeouaio oio Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe"
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe /normal-run1
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\ADOBE\SHOCKW~1\SWHELP~2.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; GTB5; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" -"http://www.miniclip.com/games/turbo-racing/en/"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Send to &Bluetooth Device… - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1201920689687
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\DOCUME~1\Thomas\LOCALS~1\Temp\620kou.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: ?nioinouo?o Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Aa?iiiao cache eaocaine?i ooie?a?ui - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\apache2\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\mysql\bin\mysqld-nt.exe

–
End of file - 14238 bytes

Thank you for any help you might provide me with

SweetTech

Post #2July 23, 2010, 7:31 PM UTC

Hello,

My name is SweetTech. I would be glad to take a look at your log and help you with solving any malware problems.

If you have already received help elsewhere please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post.
Please make sure to carefully read any instruction that I give you.
Reading too lightly will cause you to miss important steps, which could have destructive effects.
If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
These instructions have been specifically tailored to your computer and the issues you are experiencing with your computer. It's important to note that these instructions are not suitable for any other computer, even if the issues are fairly similar.
Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together
Because of this, you must reply within three days failure to reply will result in the topic being closed!
Please do not PM me directly for help. If you have any questions, post them in this topic. The only time you can and should PM me is when I have not been replying to you for several days (usually around 3 days) and you need an explanation. If that's the case, just send me a message on here.
Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________

OTL Custom Scan

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\system32\spool\prtprocs\w32x86\*.tmp
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
You may need two posts to fit them both in.

NEXT:

Scanning with GMER

Please download GMER from one of the following locations and save it to your desktop:

Main Mirror
This version will download a randomly named file (Recommended)
Zipped Mirror
This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

Disconnect from the Internet and close all running programs.
Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.

[external image: Posted Image]
GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system…click NO.
Now click the Scan button. If you see a rootkit warning window, click OK.
When the scan is finished, click the Save… button to save the scan results to your Desktop. Save the file as gmer.log.
Click the Copy button and paste the results into your next reply.
Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

– If you encounter any problems, try running GMER in safe mode.
– If GMER crashes or keeps resulting in a BSODs, uncheck Devices on the right side before scanning.

NEXT:

Please make sure you include the following items in your next post:

1. Any comments or questions you may have that you'd like for me to answer in my next post to you.
2. The logs that were produced after running the OTL scans. (OTL.txt & Extras.txt)
3. The log that was produced after running GMER
4. An update on how your computer is currently running.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.

jsmith

Post #3July 23, 2010, 9:30 PM UTC

Hello again.

Ok so I did everything but had a lot of problems with GMER. I had to restart twice and 1 was with the firewall down and previously the firewall was blocking various connections.. I hope it didn't mess things up more.. It still won't open Explorer.exe at the start and when I turned off the Antivirus and Firewall the PC was way too slow for anything.. So here are the logs:

OTL logfile created on: 7/23/2010 10:38:19 PM - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Thomas\Επιφάνεια εργασίας
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: Ηνωμένες Πολιτείες | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 68.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 84.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 71.82 Gb Total Space | 4.01 Gb Free Space | 5.59% Space Free | Partition Type: FAT32
Drive D: | 72.33 Gb Total Space | 0.64 Gb Free Space | 0.88% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: NWS-LAPTOP
Current User Name: Thomas
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\OTL.exe (OldTimer Tools)
PRC - C:\Documents and Settings\Thomas\Local Settings\Temp\svcnost.exe ()
PRC - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe (Raxco Software, Inc.)
PRC - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe (Raxco Software, Inc.)
PRC - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (ESET)
PRC - C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
PRC - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe ()
PRC - C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe (Nero AG)
PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
PRC - C:\Documents and Settings\Thomas\Local Settings\Temp\RtkBtMnt.exe (Realtek Semiconductor Corp.)
PRC - C:\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Incorporated)
PRC - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe ()
PRC - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe ()
PRC - C:\Program Files\Acer\Acer Arcade\PCMService.exe (CyberLink Corp.)
PRC - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe (Cyberlink)
PRC - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe (Cyberlink)
PRC - C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
PRC - C:\Program Files\Acer\OrbiCam\CameraAssistant.exe (Acer)
PRC - c:\Program Files\Common Files\Logitech\LVMVFM\LVPrcSrv.exe (Logitech)
PRC - C:\WINDOWS\system32\LVCOMSX.EXE (Logitech)
PRC - C:\Acer\Empowering Technology\eRecovery\Monitor.exe (acer Inc.)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe (HiTRUST)
PRC - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
PRC - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
PRC - C:\Acer\Empowering Technology\admtray.exe (Avocent Inc.)
PRC - C:\Acer\Empowering Technology\admServ.exe (Avocent Inc.)
PRC - C:\WINDOWS\system32\ElkCtrl.exe (Logitech Inc.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\mfc42.dll (Microsoft Corporation)
MOD - C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech)
MOD - C:\Acer\Empowering Technology\ePower\SysHook.dll ()
MOD - C:\Program Files\WIDCOMM\Bluetooth Software\BTKeyInd.dll ()
MOD - C:\WINDOWS\system32\sysenv.dll (HiTRUST)
MOD - C:\WINDOWS\system32\MSNChatHook.dll ()
MOD - C:\WINDOWS\system32\mfc42loc.dll (Microsoft Corporation)
MOD - C:\Program Files\CyEngine\Pokemon Online\Data\msscript.ocx (Microsoft Corporation)
MOD - C:\WINDOWS\system32\MFC71u.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msvcr71.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (AppMgmt) – C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (PDAgent) – C:\Program Files\Raxco\PerfectDisk\PDAgent.exe (Raxco Software, Inc.)
SRV - (PDEngine) – C:\Program Files\Raxco\PerfectDisk\PDEngine.exe (Raxco Software, Inc.)
SRV - (EhttpSrv) – C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe (ESET)
SRV - (ekrn) – C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (ESET)
SRV - (sdCoreService) – C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools)
SRV - (aawservice) – C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
SRV - (sdAuxService) – C:\Program Files\Spyware Doctor\pctsAuxs.exe (PC Tools)
SRV - (Symantec Core LC) – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe ()
SRV - (WLSetupSvc) – C:\Program Files\Windows Live\installer\WLSetupSvc.exe (Microsoft Corporation)
SRV - (usnjsvc) – C:\Program Files\Windows Live\Messenger\usnsvc.exe (Microsoft Corporation)
SRV - (InCDsrv) – C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe (Nero AG)
SRV - (wampmysqld) – c:\wamp\mysql\bin\mysqld-nt.exe ()
SRV - (wampapache) – c:\wamp\apache2\bin\httpd.exe (Apache Software Foundation)
SRV - (Viewpoint Manager Service) – C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
SRV - (CLSched) CyberLink Task Scheduler (CTS) – C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe ()
SRV - (CLCapSvc) CyberLink Background Capture Service (CBCS) – C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe ()
SRV - (CyberLink Media Library Service) – C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe (Cyberlink)
SRV - (LVPrcSrv) – c:\Program Files\Common Files\Logitech\LVMVFM\LVPrcSrv.exe (Logitech)
SRV - (S24EventMonitor) Intel® – C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
SRV - (EvtEng) Intel® – C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
SRV - (RegSrvc) Intel® – C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
SRV - (AWService) – C:\Acer\Empowering Technology\admServ.exe (Avocent Inc.)

========== Driver Services (SafeList) ==========

DRV - (SymIMMP) – C:\WINDOWS\System32\DRIVERS\SymIM.sys File not found
DRV - (SymIM) – C:\WINDOWS\System32\DRIVERS\SymIM.sys File not found
DRV - (EverestDriver) – C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\EverestUltimate4\kerneld.wnt File not found
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (DefragFS) – C:\WINDOWS\System32\drivers\DefragFs.sys (Raxco Software, Inc.)
DRV - (ZTEusbser6k) – C:\WINDOWS\system32\drivers\ZTEusbser6k.sys (ZTE Incorporated)
DRV - (ZTEusbnmea) – C:\WINDOWS\system32\drivers\ZTEusbnmea.sys (ZTE Incorporated)
DRV - (ZTEusbmdm6k) – C:\WINDOWS\system32\drivers\ZTEusbmdm6k.sys (ZTE Incorporated)
DRV - (massfilter) – C:\WINDOWS\system32\drivers\massfilter.sys (ZTE Incorporated)
DRV - (epfwtdir) – C:\WINDOWS\system32\drivers\epfwtdir.sys (ESET)
DRV - (ehdrv) – C:\WINDOWS\system32\drivers\ehdrv.sys (ESET)
DRV - (eamon) – C:\WINDOWS\system32\drivers\eamon.sys (ESET)
DRV - (IKSysSec) – C:\WINDOWS\system32\drivers\iksyssec.sys (PCTools Research Pty Ltd.)
DRV - (IKSysFlt) – C:\WINDOWS\system32\drivers\iksysflt.sys (PCTools Research Pty Ltd.)
DRV - (IKFileSec) – C:\WINDOWS\system32\drivers\ikfilesec.sys (PCTools Research Pty Ltd.)
DRV - (hamachi) – C:\WINDOWS\system32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (wip0204) – C:\WINDOWS\system32\drivers\wip0204.sys (Wippien Software)
DRV - (amdagp) – C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) – C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\Hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (sptd) – C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (incdrm) – C:\WINDOWS\system32\drivers\InCDRm.sys (Nero AG)
DRV - (InCDfs) – C:\WINDOWS\system32\drivers\InCDfs.sys (Nero AG)
DRV - (InCDPass) – C:\WINDOWS\system32\drivers\InCDPass.sys (Nero AG)
DRV - (hwdatacard) – C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (symlcbrd) – C:\WINDOWS\system32\drivers\symlcbrd.sys (Symantec Corporation)
DRV - (NTIDrvr) – C:\WINDOWS\system32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.Sys (Realtek Semiconductor Corp.)
DRV - (lvmvdrv) – C:\WINDOWS\system32\drivers\LVMVdrv.sys ()
DRV - (LVPrcMon) – C:\WINDOWS\system32\drivers\LVPrcMon.sys ()
DRV - (lv321av) Logitech USB PC Camera (VC0321) – C:\WINDOWS\system32\drivers\lv321av.sys (Logitech)
DRV - (LVUSBSta) – C:\WINDOWS\system32\drivers\LVUSBSta.sys (Logitech)
DRV - (ESMCR) – C:\WINDOWS\system32\drivers\ESM7SK.sys (ENE Technology Inc.)
DRV - (ESDCR) – C:\WINDOWS\system32\drivers\ESD7SK.sys (ENE Technology Inc.)
DRV - (EMSCR) – C:\WINDOWS\system32\drivers\EMS7SK.sys (ENE Technology Inc.)
DRV - (w39n51) Intel® – C:\WINDOWS\system32\drivers\w39n51.sys (Intel® Corporation)
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (SynTP) – C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (NPF) – C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies)
DRV - (EpmShd) – C:\WINDOWS\system32\drivers\epm-shd.sys (Acer Value Labs, USA)
DRV - (EpmPsd) – C:\WINDOWS\system32\drivers\epm-psd.sys (Acer Value Labs, USA)
DRV - (btaudio) – C:\WINDOWS\system32\drivers\btaudio.sys (Broadcom Corporation.)
DRV - (BTSERIAL) – C:\WINDOWS\system32\drivers\btserial.sys (Broadcom Corporation.)
DRV - (BTKRNL) – C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.)
DRV - (BTDriver) – C:\WINDOWS\system32\drivers\btport.sys (Broadcom Corporation.)
DRV - (BTWUSB) – C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (BTWDNDIS) – C:\WINDOWS\system32\drivers\btwdndis.sys (Broadcom Corporation.)
DRV - (s24trans) – C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (bcm4sbxp) – C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (SMCIRDA) – C:\WINDOWS\system32\drivers\smcirda.sys (SMSC)
DRV - (HSFHWAZL) – C:\WINDOWS\system32\drivers\HSFHWAZL.sys (Conexant Systems, Inc.)
DRV - (HSF_DPV) – C:\WINDOWS\system32\drivers\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (OsaFsLoc) – C:\WINDOWS\system32\drivers\OsaFsLoc.sys (OSA Technologies)
DRV - (NdisFilt) – C:\WINDOWS\system32\drivers\NdisFilt.sys (OSA Technologies)
DRV - (osaio) – C:\WINDOWS\system32\drivers\osaio.sys (OSA Technologies, An Avocent Company)
DRV - (NETMNT) – C:\WINDOWS\system32\drivers\NETMNT.sys ()
DRV - (osanbm) – C:\WINDOWS\system32\drivers\osanbm.sys (Windows ® 2000 DDK provider)
DRV - (int15.sys) – C:\Acer\Empowering Technology\eRecovery\int15.sys ()
DRV - (UBHelper) – C:\WINDOWS\System32\drivers\UBHelper.sys ()
DRV - (DKbFltr) – C:\WINDOWS\system32\drivers\DKbFltr.SYS (Dritek System Inc.)
DRV - (dac2w2k) – C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (ql1280) – C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (ql12160) – C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) – C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ultra) – C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (symc8xx) – C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (sym_u3) – C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) – C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (asc) – C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (Sparrow) – C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (mraid35x) – C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (symc810) – C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (asc3550) – C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (CmdIde) – C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (AliIde) – C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://el.intl.acer.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://el.intl.acer.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://el.intl.acer.yahoo.com/
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - HKLM\software\mozilla\K-Meleon\Extensions\\Plugins: C:\Program Files\K-Meleon\Plugins [2010/05/23 15:33:48 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\K-Meleon\Extensions\\Components: C:\Program Files\K-Meleon\Components [2010/05/23 15:33:40 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2007/12/26 18:50:06 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2007/12/26 18:50:06 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.14\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2008/07/07 10:50:12 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.14\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2008/09/02 14:54:12 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2009/05/19 19:06:26 | 000,000,000 | —D | M]

[2009/04/15 03:40:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Thomas\Application Data\Mozilla\Extensions
[2009/04/15 03:40:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Thomas\Application Data\Mozilla\Extensions\[removed]
[2007/12/26 18:50:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Thomas\Application Data\Mozilla\Firefox\Profiles\7aahy7j2.default\extensions
[2010/06/07 04:00:56 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Thomas\Application Data\Mozilla\Firefox\Profiles\7aahy7j2.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/06/07 04:00:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Thomas\Application Data\Mozilla\Firefox\Profiles\7aahy7j2.default\extensions\staged-xpis
[2007/12/26 18:50:06 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/05/23 15:19:38 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2007/12/26 18:50:10 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2008/03/31 13:32:26 | 000,067,696 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\jar50.dll
[2008/03/31 13:32:26 | 000,054,376 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\jsd3250.dll
[2008/03/31 13:32:26 | 000,034,952 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\myspell.dll
[2008/03/31 13:32:26 | 000,046,720 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\spellchk.dll
[2008/03/31 13:32:26 | 000,172,144 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\xpinstal.dll
[2007/04/16 20:07:14 | 000,180,293 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll
[2010/04/12 17:29:20 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2008/02/17 18:11:54 | 000,224,888 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.1001-search.info
O1 - Hosts: 127.0.0.1 1001-search.info
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.123topsearch.com
O1 - Hosts: 127.0.0.1 123topsearch.com
O1 - Hosts: 127.0.0.1 www.132.com
O1 - Hosts: 127.0.0.1 132.com
O1 - Hosts: 127.0.0.1 www.136136.net
O1 - Hosts: 127.0.0.1 136136.net
O1 - Hosts: 7885 more lines…
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (&Google; Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (&Google; Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll (HiTRUST)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google; Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll (HiTRUST)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe (Acer Value Labs, Taiwan)
O4 - HKLM..\Run: [ADMTray.exe] C:\Acer\Empowering Technology\admtray.exe (Avocent Inc.)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe (HiTRUST)
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Incorporated)
O4 - HKLM..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe (acer Inc.)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [LaunchApp] C:\WINDOWS\Alaunch.exe (Acer Inc.)
O4 - HKLM..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe (Acer)
O4 - HKLM..\Run: [LogitechCameraService(E)] C:\WINDOWS\System32\ElkCtrl.exe (Logitech Inc.)
O4 - HKLM..\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe (Acer)
O4 - HKLM..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE (Logitech)
O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PCMService] C:\Program Files\Acer\Acer Arcade\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [SkyTel] C:\WINDOWS\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Inc.)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\WINDOWS\System32\ADOBE\SHOCKW~1\SWHELP~2.EXE -Update -1100465 -Mozilla\4.0 ( File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Προγράμματα\Εκκίνηση\Bluetooth.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisallowRun = 1
O8 - Extra context menu item: Send to &Bluetooth; Device… - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {00000055-9980-0010-8000-00AA00389B71} http://codecs.microsoft.com/codecs/i386/fhg.CAB (Reg Error: Key error.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1201920689687 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\DOCUME~1\Thomas\LOCALS~1\Temp\620kou.dll) - C:\DOCUME~1\Thomas\LOCALS~1\Temp\620kou.dll File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe ()
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop Components:0 (Τρέχουσα αρχική σελίδα) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Thomas\Τα έγγραφά μου\Οι εικόνες μου\elementary.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Thomas\Τα έγγραφά μου\Οι εικόνες μου\elementary.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/08/30 06:53:20 | 000,000,050 | —- | M] () - C:\AUTOEXEC.BAT – [ FAT32 ]
O33 - MountPoints2\{1e76cc37-c21a-11dc-9f51-0016d456f5f6}\Shell\AutoRun\command - "" = G:\wd_windows_tools\setup.exe – File not found
O33 - MountPoints2\{324fabe3-8cfb-11dd-9f7e-eec3f598a194}\Shell - "" = AutoRun
O33 - MountPoints2\{324fabe3-8cfb-11dd-9f7e-eec3f598a194}\Shell\AutoRun\command - "" = G:\AutoRun.exe – File not found
O33 - MountPoints2\{543005f6-57d8-11dd-9f76-0018de75179a}\Shell - "" = AutoRun
O33 - MountPoints2\{543005f6-57d8-11dd-9f76-0018de75179a}\Shell\AutoRun\command - "" = H:\AutoRun.exe – File not found
O33 - MountPoints2\{54300603-57d8-11dd-9f76-0018de75179a}\Shell - "" = AutoRun
O33 - MountPoints2\{54300603-57d8-11dd-9f76-0018de75179a}\Shell\AutoRun\command - "" = G:\AutoRun.exe – File not found
O33 - MountPoints2\{95555e1a-c1d5-11db-9f01-0018de75179a}\Shell\AutoRun\command - "" = G:\wd_windows_tools\setup.exe – File not found
O33 - MountPoints2\{9aae1040-ddf5-11de-9fe0-0016d456f5f6}\Shell - "" = AutoRun
O33 - MountPoints2\{9aae1040-ddf5-11de-9fe0-0016d456f5f6}\Shell\AutoRun\command - "" = G:\AutoRun.exe – File not found
O33 - MountPoints2\{c1d841eb-5767-11dd-9f75-0018de75179a}\Shell - "" = AutoRun
O33 - MountPoints2\{c1d841eb-5767-11dd-9f75-0018de75179a}\Shell\AutoRun\command - "" = G:\AutoRun.exe – File not found
O33 - MountPoints2\{c1d841ec-5767-11dd-9f75-0018de75179a}\Shell - "" = AutoRun
O33 - MountPoints2\{c1d841ec-5767-11dd-9f75-0018de75179a}\Shell\AutoRun\command - "" = G:\AutoRun.exe – File not found
O33 - MountPoints2\{d137e2dc-908b-11dd-9f82-0018de75179a}\Shell - "" = AutoRun
O33 - MountPoints2\{d137e2dc-908b-11dd-9f82-0018de75179a}\Shell\AutoRun\command - "" = G:\AutoRun.exe – File not found
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\AutoRun.exe – File not found
O34 - HKLM BootExecute: (PDBoot.exe) - C:\WINDOWS\System32\PDBoot.exe (Raxco Software, Inc.)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

Drivers32: aux - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.ac3acm - C:\WINDOWS\System32\AC3ACM.acm (fccHandler)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - File not found
Drivers32: msacm.mkdmp3enc - C:\PROGRA~1\Acer\ACERAR~1\Kernel\Burner\MKDMP3Enc.ACM File not found
Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\WINDOWS\System32\lvcodec2.dll (Logitech)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.IYUV - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation)
Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: VIDC.UYVY - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.XVID - C:\WINDOWS\System32\xvidvfw.dll ()
Drivers32: VIDC.YUY2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVU9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave2 - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (56027131116781568)

========== Files/Folders - Created Within 30 Days ==========

[2010/07/23 22:36:24 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\OTL.exe
[2010/07/23 22:08:22 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\HiJackThis.exe
[2010/07/23 20:47:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Thomas\Application Data\SUPERAntiSpyware.com
[2010/07/23 20:47:15 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2010/07/23 20:47:09 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2010/07/22 10:55:25 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2010/07/18 15:05:27 | 000,744,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\helpsvc.exe
[2010/07/08 19:54:06 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hidserv.dll
[2010/07/08 19:54:01 | 000,014,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhid.sys
[2010/06/28 03:39:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\s206
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\*.tmp files -> C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/07/23 22:39:52 | 021,495,808 | -H– | M] () – C:\Documents and Settings\Thomas\NTUSER.DAT
[2010/07/23 22:36:36 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\OTL.exe
[2010/07/23 22:08:28 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\HiJackThis.exe
[2010/07/23 22:05:04 | 000,000,496 | —- | M] () – C:\WINDOWS\System32\eRLog.ini
[2010/07/23 22:04:12 | 000,051,048 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2010/07/23 22:02:36 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/07/23 22:01:54 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/07/23 22:00:24 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/07/23 22:00:14 | 2145,505,280 | -HS- | M] () – C:\hiberfil.sys
[2010/07/23 21:53:54 | 000,000,012 | —- | M] () – C:\WINDOWS\bthservsdp.dat
[2010/07/23 21:53:52 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Thomas\ntuser.ini
[2010/07/23 21:08:16 | 000,000,069 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2010/07/23 20:47:12 | 000,001,586 | —- | M] () – C:\Documents and Settings\All Users\Επιφάνεια εργασίας\SUPERAntiSpyware Free Edition.lnk
[2010/07/23 20:22:56 | 003,742,303 | —- | M] () – C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\ComboFix.exe
[2010/07/23 05:23:44 | 000,039,434 | —- | M] () – C:\WINDOWS\System32\userinit.exe
[2010/07/23 05:01:18 | 000,000,518 | —- | M] () – C:\WINDOWS\win.ini
[2010/07/22 10:57:44 | 000,000,622 | —- | M] () – C:\Documents and Settings\Thomas\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2010/07/22 10:56:12 | 001,137,302 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/07/22 10:56:12 | 000,554,434 | —- | M] () – C:\WINDOWS\System32\perfh008.dat
[2010/07/22 10:56:12 | 000,444,454 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/07/22 10:56:12 | 000,097,396 | —- | M] () – C:\WINDOWS\System32\perfc008.dat
[2010/07/22 10:56:12 | 000,073,144 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/07/22 01:31:40 | 000,203,264 | —- | M] () – C:\Documents and Settings\Thomas\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/12 02:01:56 | 000,006,007 | —- | M] () – C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\members.sql
[2010/07/08 19:00:16 | 003,072,054 | —- | M] () – C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\hotel!.bmp
[2010/07/04 03:26:20 | 175,131,444 | —- | M] () – C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\PS3UPDAT.PUP
[2010/06/27 17:58:24 | 000,044,251 | —- | M] () – C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\113124.zip
[2010/06/24 16:24:48 | 001,313,331 | —- | M] () – C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\simeiwseis_dialeksewn.pdf
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\*.tmp files -> C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/07/23 20:47:11 | 000,001,586 | —- | C] () – C:\Documents and Settings\All Users\Επιφάνεια εργασίας\SUPERAntiSpyware Free Edition.lnk
[2010/07/23 20:22:55 | 003,742,303 | —- | C] () – C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\ComboFix.exe
[2010/07/23 16:30:38 | 2145,505,280 | -HS- | C] () – C:\hiberfil.sys
[2010/07/12 01:41:43 | 000,006,007 | —- | C] () – C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\members.sql
[2010/07/08 19:00:14 | 003,072,054 | —- | C] () – C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\hotel!.bmp
[2010/07/04 03:26:18 | 175,131,444 | —- | C] () – C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\PS3UPDAT.PUP
[2010/06/27 17:58:23 | 000,044,251 | —- | C] () – C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\113124.zip
[2010/06/24 16:24:45 | 001,313,331 | —- | C] () – C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\simeiwseis_dialeksewn.pdf
[2009/05/25 16:27:26 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\RemoveDevice.dll
[2008/01/14 00:43:17 | 000,716,272 | —- | C] () – C:\WINDOWS\System32\drivers\sptd.sys
[2007/12/20 00:11:09 | 000,022,328 | —- | C] () – C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2007/12/18 16:49:43 | 000,000,466 | —- | C] () – C:\WINDOWS\XMailer.INI
[2007/12/13 20:08:37 | 000,000,193 | —- | C] () – C:\WINDOWS\mailer.INI
[2007/11/04 17:45:46 | 000,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2007/03/13 13:35:17 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2006/12/17 22:09:29 | 000,765,952 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2006/12/17 22:09:29 | 000,180,224 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2006/11/30 17:49:08 | 000,000,496 | —- | C] () – C:\WINDOWS\System32\eRLog.ini
[2006/11/30 17:45:27 | 000,000,719 | R— | C] () – C:\WINDOWS\System32\InstExec.ini
[2006/11/30 17:42:20 | 000,053,299 | —- | C] () – C:\WINDOWS\System32\pthreadVC.dll
[2006/08/31 03:53:56 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/08/30 06:53:46 | 000,001,024 | RH– | C] () – C:\WINDOWS\System32\NTIBUN4.dll
[2006/08/30 06:52:30 | 000,001,024 | RH– | C] () – C:\WINDOWS\System32\NTIMPEG2.dll
[2006/08/30 06:52:30 | 000,001,024 | RH– | C] () – C:\WINDOWS\System32\NTIMP3.dll
[2006/08/30 06:52:30 | 000,001,024 | RH– | C] () – C:\WINDOWS\System32\NTIFCD3.dll
[2006/08/30 06:52:30 | 000,001,024 | RH– | C] () – C:\WINDOWS\System32\NTICDMK7.dll
[2006/06/23 10:40:58 | 002,400,128 | —- | C] () – C:\WINDOWS\System32\drivers\LVMVdrv.sys
[2006/06/23 10:40:58 | 000,016,768 | —- | C] () – C:\WINDOWS\System32\drivers\LVPrcMon.sys
[2006/06/19 11:59:24 | 000,013,227 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2006/06/16 19:17:32 | 000,356,352 | —- | C] () – C:\WINDOWS\EMCRI.dll
[2006/06/12 16:11:00 | 001,662,976 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2006/06/12 16:11:00 | 001,470,464 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2006/06/12 16:11:00 | 001,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2006/06/12 16:11:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2006/06/12 16:11:00 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2006/03/10 14:15:44 | 000,037,706 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2006/01/17 10:31:30 | 000,090,112 | —- | C] () – C:\WINDOWS\System32\btprn2k.dll
[2005/12/27 15:50:26 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\APISlice.dll
[2005/12/27 15:50:26 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\SC_res.dll
[2005/12/27 15:50:26 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\EN_res.dll
[2005/12/27 15:50:26 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\TC_res.dll
[2005/12/27 15:50:26 | 000,010,752 | —- | C] () – C:\WINDOWS\System32\MSNChatHook.dll
[2005/12/14 20:59:52 | 000,000,038 | —- | C] () – C:\WINDOWS\Acer.ini
[2005/10/31 18:17:38 | 000,135,168 | —- | C] () – C:\WINDOWS\System32\RtlCPAPI.dll
[2005/05/02 12:13:42 | 000,009,600 | —- | C] () – C:\WINDOWS\System32\drivers\NETMNT.sys
[2005/03/28 15:45:26 | 000,000,081 | —- | C] () – C:\WINDOWS\ALaunch.ini
[2005/02/17 11:41:32 | 000,000,603 | —- | C] () – C:\WINDOWS\System32\BTNeighborhood.dll.manifest
[2005/02/17 11:41:30 | 000,000,593 | —- | C] () – C:\WINDOWS\System32\btcss.dll.manifest
[2004/12/17 17:14:44 | 000,013,952 | —- | C] () – C:\WINDOWS\System32\drivers\UBHelper.sys
[2004/09/07 20:00:00 | 000,003,341 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2003/12/29 20:45:08 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\ServiceControl.dll
[2002/10/16 00:54:04 | 000,153,088 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2001/12/26 16:12:30 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\multiplex_vcd.dll
[2001/11/14 12:56:00 | 001,802,240 | —- | C] () – C:\WINDOWS\System32\lcppn21.dll
[2001/09/03 23:46:38 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\Hmpg12.dll
[2001/07/30 16:33:56 | 000,118,784 | —- | C] () – C:\WINDOWS\System32\HMPV2_ENC.dll
[2001/07/23 22:04:36 | 000,118,784 | —- | C] () – C:\WINDOWS\System32\HMPV2_ENC_MMX.dll
[1999/01/27 13:39:06 | 000,065,024 | —- | C] () – C:\WINDOWS\System32\indounin.dll
[1997/06/14 04:56:08 | 000,056,832 | —- | C] () – C:\WINDOWS\System32\Iyvu9_32.dll

========== LOP Check ==========

[2006/08/30 06:58:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Acer
[2007/02/21 20:04:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NtiDvdCopy
[2008/01/31 11:22:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Azureus
[2008/02/03 11:14:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ESET
[2008/02/06 13:49:24 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EPSON
[2008/03/23 01:19:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2008/08/11 19:19:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ubisoft
[2009/06/01 23:05:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/07/13 16:09:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\acccore
[2009/12/16 00:51:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Birdstep Technology
[2010/05/17 17:06:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GlobalSCAPE
[2010/05/23 15:34:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Fenrir & Co
[2006/08/30 07:01:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Thomas\Application Data\Acer
[2007/12/26 18:36:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Thomas\Application Data\Opera
[2008/01/10 00:13:26 | 000,000,000 | —D | M] – C:\Documents and Settings\Thomas\Application Data\uTorrent
[2008/01/11 16:12:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Thomas\Application Data\UseNeXT
[2008/01/11 16:47:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Thomas\Application Data\LimeWire
[2008/01/19 18:18:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Thomas\Application Data\DAEMON Tools
[2008/01/31 11:22:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Thomas\Application Data\Azureus
[2008/03/23 01:20:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Thomas\Application Data\acccore
[2008/07/07 11:26:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Thomas\Application Data\Thunderbird
[2008/08/14 15:16:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Thomas\Application Data\Wippien
[2008/09/19 12:35:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Thomas\Application Data\FileZilla
[2009/06/16 02:39:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Thomas\Application Data\Viewpoint
[2010/05/17 16:53:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Thomas\Application Data\GlobalSCAPE
[2010/05/23 15:49:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Thomas\Application Data\K-Meleon

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/07/13 16:09:36 | 000,001,184 | -H– | M] () – C:\IPH.PH
[2004/09/07 20:00:00 | 000,004,952 | RHS- | M] () – C:\Bootfont.bin
[2008/07/31 11:20:42 | 000,252,256 | RHS- | M] () – C:\ntldr
[2004/09/07 20:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2010/06/03 04:15:06 | 000,000,211 | RHS- | M] () – C:\boot.ini
[2006/08/30 06:31:50 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2006/08/30 06:53:20 | 000,000,050 | —- | M] () – C:\AUTOEXEC.BAT
[2006/08/30 06:31:50 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2006/08/30 06:31:50 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2006/08/30 06:44:56 | 000,000,519 | —- | M] () – C:\RHDSetup.log
[2006/08/31 04:04:00 | 000,000,077 | RHS- | M] () – C:\Preload.aaa
[1999/11/11 00:17:54 | 000,000,049 | —- | M] () – C:\XPH.TAG
[2010/07/23 22:00:14 | 2145,386,496 | -HS- | M] () – C:\pagefile.sys
[2010/07/23 22:00:14 | 2145,505,280 | -HS- | M] () – C:\hiberfil.sys
[2006/11/30 17:34:34 | 000,000,166 | —- | M] () – C:\Arcade.log
[2007/01/06 16:00:58 | 000,028,434 | —- | M] () – C:\debug.log
[2007/08/24 18:14:02 | 000,000,003 | —- | M] () – C:\TCPCheckResult.txt
[2008/01/04 23:18:42 | 000,000,000 | —- | M] () – C:\exit_o-g.jpg
[2008/01/04 23:18:42 | 000,000,000 | —- | M] () – C:\exit_c-g.jpg
[2008/01/04 23:18:42 | 000,000,000 | —- | M] () – C:\save_o-g.jpg
[2008/01/04 23:18:42 | 000,000,000 | —- | M] () – C:\save_c-g.jpg
[2008/01/04 23:18:42 | 000,000,000 | —- | M] () – C:\home_o-g.jpg
[2008/01/04 23:18:42 | 000,000,000 | —- | M] () – C:\home_c-g.jpg
[2008/01/04 23:18:42 | 000,000,000 | —- | M] () – C:\uk_c.bmp
[2008/01/04 23:18:42 | 000,000,000 | —- | M] () – C:\uk_o.bmp

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/08/30 06:31:24 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2008/07/06 15:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.scr >
[2005/12/14 20:56:06 | 000,187,392 | —- | M] () – C:\WINDOWS\Acer.scr
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2006/12/08 22:55:46 | 000,001,578 | -H– | M] () – C:\Documents and Settings\Thomas\Application Data\Microsoft\LastFlashConfig.WFC

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2008/04/14 19:29:28 | 000,205,312 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtrans.dll
[2008/04/14 19:29:28 | 000,357,888 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dxtmsft.dll
[4 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2006/08/30 06:20:36 | 000,442,368 | —- | M] () – C:\WINDOWS\system32\config\system.sav
[2006/08/30 06:20:36 | 000,643,072 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2006/08/30 06:20:36 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav

< %systemroot%\system32\user32.dll /md5 >
[2008/04/14 19:30:08 | 000,580,608 | —- | M] (Microsoft Corporation) MD5=5BB2A1C2290E910AE145C80DF491B600 – C:\WINDOWS\system32\user32.dll
[4 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/04/14 19:30:12 | 000,082,432 | —- | M] (Microsoft Corporation) MD5=EC57996DC47ADF15ECD1C65E6AB5613F – C:\WINDOWS\system32\ws2_32.dll
[4 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\ws2help.dll /md5 >
[2008/04/14 19:30:12 | 000,019,968 | —- | M] (Microsoft Corporation) MD5=2AFC6866F8E07625D38CDE0991B20B4E – C:\WINDOWS\system32\ws2help.dll
[4 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-07-22 07:59:59
< End of report >

OTL Extras logfile created on: 7/23/2010 10:38:19 PM - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Thomas\Επιφάνεια εργασίας
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: Ηνωμένες Πολιτείες | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 68.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 84.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 71.82 Gb Total Space | 4.01 Gb Free Space | 5.59% Space Free | Partition Type: FAT32
Drive D: | 72.33 Gb Total Space | 0.64 Gb Free Space | 0.88% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: NWS-LAPTOP
Current User Name: Thomas
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – C:\Program Files\VideoLAN\VLC\vlc.exe –started-from-file –playlist-enqueue "%1" ()
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – C:\Program Files\VideoLAN\VLC\vlc.exe –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"3724:TCP" = 3724:TCP:*:Enabled:Blizzard Downloader: 3724

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Messenger\livecall.exe" = C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone) – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Acer\Acer Arcade\PCMService.exe" = C:\Program Files\Acer\Acer Arcade\PCMService.exe:*:Enabled:CyberLink PowerCinema Resident Program – (CyberLink Corp.)
"D:\Games\Microsoft Games\Age of Empires II\Age2_X1\age2_x1.Exe" = D:\Games\Microsoft Games\Age of Empires II\Age2_X1\age2_x1.Exe:*:Enabled:Age of Empires II Expansion – (Microsoft Corporation)
"C:\WINDOWS\System32\dplaysvr.exe" = C:\WINDOWS\System32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper – (Microsoft Corporation)
"C:\wamp\Apache2\bin\httpd.exe" = C:\wamp\Apache2\bin\httpd.exe:*:Enabled:Apache HTTP Server – (Apache Software Foundation)
"D:\Games\World of Warcraft\WoW-1.12.0-enGB-downloader.exe" = D:\Games\World of Warcraft\WoW-1.12.0-enGB-downloader.exe:*:Enabled:Blizzard Downloader – File not found
"D:\Games\World of Warcraft\WoW-1.12.x-to-2.0.1-enGB-patch-downloader.exe" = D:\Games\World of Warcraft\WoW-1.12.x-to-2.0.1-enGB-patch-downloader.exe:*:Enabled:Blizzard Downloader – File not found
"C:\Program Files\Intuwave\Shared\mRouterRunTime\mRouterRuntime.exe" = C:\Program Files\Intuwave\Shared\mRouterRunTime\mRouterRuntime.exe:*:Enabled:mRouterRuntime – (Intuwave Ltd.)
"C:\Documents and Settings\Thomas\Local Settings\Temp\Rar$EX01.453\pol_6.2\Pokemon Online.exe" = C:\Documents and Settings\Thomas\Local Settings\Temp\Rar$EX01.453\pol_6.2\Pokemon Online.exe:*:Enabled:Multimedia Fusion Stand Alone Application – File not found
"C:\Documents and Settings\Thomas\Local Settings\Temp\Rar$EX04.094\pol_6.2\Pokemon Online.exe" = C:\Documents and Settings\Thomas\Local Settings\Temp\Rar$EX04.094\pol_6.2\Pokemon Online.exe:*:Enabled:Multimedia Fusion Stand Alone Application – File not found
"C:\Program Files\Free SMTP Server\localsrv.exe" = C:\Program Files\Free SMTP Server\localsrv.exe:*:Enabled:localsrv – File not found
"D:\Games\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe" = D:\Games\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:*:Enabled:Crysis_32 – (Crytek GmbH)
"D:\Games\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe" = D:\Games\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:*:Enabled:CrysisDedicatedServer_32 – (Crytek GmbH)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)
"C:\Program Files\Steam\steamapps\nws\counter-strike\hl.exe" = C:\Program Files\Steam\steamapps\nws\counter-strike\hl.exe:*:Enabled:Half-Life Launcher – (Valve)
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox – (Mozilla Corporation)
"D:\Games\World of Warcraft\Repair.exe" = D:\Games\World of Warcraft\Repair.exe:*:Enabled:Blizzard Repair Utility – (Blizzard Entertainment, Inc.)
"C:\Program Files\CyEngine\Pokemon Online\CyClient.exe" = C:\Program Files\CyEngine\Pokemon Online\CyClient.exe:*:Enabled:CyClient – (Cyrus Game)
"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader – (AOL LLC)
"C:\Program Files\AIM6\aim6.exe" = C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM – (AOL LLC)
"C:\Program Files\Windows Live\Messenger\livecall.exe" = C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone) – (Microsoft Corporation)
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire – (Lime Wire, LLC)
"C:\Program Files\Steam\steamapps\nws\condition zero deleted scenes\hl.exe" = C:\Program Files\Steam\steamapps\nws\condition zero deleted scenes\hl.exe:*:Enabled:Half-Life Launcher – (Valve)
"C:\Program Files\Steam\steamapps\nws\condition zero\hl.exe" = C:\Program Files\Steam\steamapps\nws\condition zero\hl.exe:*:Enabled:Half-Life Launcher – (Valve)
"C:\Program Files\SmartFTP Client\SmartFTP_backup.exe" = C:\Program Files\SmartFTP Client\SmartFTP_backup.exe:*:Enabled:SmartFTP Client 3.0 – (SmartSoft Ltd.)
"D:\Games\World of Warcraft\BackgroundDownloader.exe" = D:\Games\World of Warcraft\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader – (Blizzard Entertainment)
"C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\Pokemon_World_Online_9021\Pokemon Game.exe" = C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\Pokemon_World_Online_9021\Pokemon Game.exe:*:Enabled:Pokemon Game – File not found
"C:\Program Files\mIRC\mirc.exe" = C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC – (mIRC Co. Ltd.)
"C:\Documents and Settings\Thomas\Local Settings\Temp\Blizzard Launcher Temporary - 7f73fb28\Launcher.exe" = C:\Documents and Settings\Thomas\Local Settings\Temp\Blizzard Launcher Temporary - 7f73fb28\Launcher.exe:*:Enabled:Blizzard Launcher – File not found
"C:\Program Files\Java\jre6\bin\java.exe" = C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java™ Platform SE binary – (Sun Microsystems, Inc.)
"D:\Games\World of Warcraft\Launcher.exe" = D:\Games\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher – (Blizzard Entertainment)
"C:\Program Files\SmartFTP Client\SmartFTP.exe" = C:\Program Files\SmartFTP Client\SmartFTP.exe:*:Enabled:SmartFTP Client 3.0 – (SmartSoft Ltd.)
"D:\Games\World of Warcraft\WoW-3.1.3.9947-to-3.2.0.10192-enGB-downloader.exe" = D:\Games\World of Warcraft\WoW-3.1.3.9947-to-3.2.0.10192-enGB-downloader.exe:*:Enabled:Blizzard Downloader – File not found
"D:\Games\World of Warcraft\WoW-3.2.0.10192-to-3.2.0.10314-enGB-downloader.exe" = D:\Games\World of Warcraft\WoW-3.2.0.10192-to-3.2.0.10314-enGB-downloader.exe:*:Enabled:Blizzard Downloader – File not found
"C:\Program Files\Wippien\Wippien.exe" = C:\Program Files\Wippien\Wippien.exe:*:Disabled:Wippien – File not found
"D:\Games\World of Warcraft\WoW-3.2.0.10314-to-3.2.2.10482-enGB-downloader.exe" = D:\Games\World of Warcraft\WoW-3.2.0.10314-to-3.2.2.10482-enGB-downloader.exe:*:Enabled:Blizzard Downloader – File not found
"D:\Games\World of Warcraft\WoW-3.2.2.10482-to-3.2.2.10505-enGB-downloader.exe" = D:\Games\World of Warcraft\WoW-3.2.2.10482-to-3.2.2.10505-enGB-downloader.exe:*:Enabled:Blizzard Downloader – File not found
"C:\Program Files\Opera\Opera.exe" = C:\Program Files\Opera\Opera.exe:*:Enabled:Opera Internet Browser – (Opera Software)
"C:\Program Files\Java\JRE6\BIN\javaw.exe" = C:\Program Files\Java\JRE6\BIN\javaw.exe:*:Enabled:Java™ Platform SE binary – (Sun Microsystems, Inc.)
"" = :*:Enabled:ldrsoft
"C:\Documents and Settings\Thomas\Local Settings\Temp\8387137.exe" = C:\Documents and Settings\Thomas\Local Settings\Temp\8387137.exe:*:Disabled:8387137 – ()
"C:\Documents and Settings\Thomas\Local Settings\Temp\2472479.exe" = C:\Documents and Settings\Thomas\Local Settings\Temp\2472479.exe:*:Disabled:2472479 – ()

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{000E79B7-E725-4F01-870A-C12942B7F8E4}" = Crysis®
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{08C5815C-2C6E-44f8-8748-0E61BC9AFB68}" = Symantec KB-DocID:2003093015493306
"{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}" = WD Diagnostics
"{0DD140D3-9563-481E-AA75-BA457CBDAEF2}" = PC Inspector File Recovery
"{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"{15B70821-7893-4607-805A-BB80F3EA8279}" = Acer Empowering Technology framework
"{184E7118-0295-43C4-B72C-1D54AA75AAF7}" = Windows Live Mail
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java™ 6 Update 20
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java™ SE Runtime Environment 6 Update 1
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java™ 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{350C9408-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3D9E9EB7-B14F-4AE4-8C1F-1AD4CF3093BE}" = Microsoft .NET Framework 1.1 Greek Language Pack
"{3F4EC965-28EF-45C3-B063-04B25D4E9679}" = WIDCOMM Bluetooth Software
"{48948338-3777-41EB-AB05-DF48D3A59591}" = SeePassword
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4DA416AE-6D1C-40D6-BCA3-A65A59DD60FC}" = Acer eDataSecurity Management
"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{604931C3-071E-458F-BB5A-738C32C9D32B}" = U.S. Robotics EasyConfigurator
"{624499AB-179E-4659-9760-C1EB38BC212E}" = PC Suite for Nokia 6600
"{6A28AB0B-22B1-494C-AF61-B386EA1736C0}" = LightScribe 1.4.97.1
"{6CA897D0-67F5-4F75-8261-DC8BFCA6DA42}" = Acer eLock Management
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76AC1AEB-1167-4ABC-8861-4E58392A5B7F}" = Acer OrbiCam Software
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7924F96E-93F9-49F5-905F-444D96DCFC91}" = Windows Live Messenger
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{90120000-00D1-0409-0000-0000000FF1CE}" = Microsoft Office Access database engine 2007 (English)
"{91F34319-08DE-457a-99C0-0BCDFAC145B9}" = CuteFTP 8 Professional
"{985818E9-F444-4271-A614-C7DF8394DB2E}" = SmartFTP Client
"{9977BB98-D0E6-4850-A3BF-2BD8CFB9D794}" = Βοηθός εισόδου του Windows Live
"{9CC89556-3578-48DD-8408-04E66EBEF401}" = mXML
"{9CD89DD7-234A-4801-9D87-3DE352E146A0}" = TMPGEnc DVD Author 1.6
"{A2A60894-E3ED-46FE-9A6A-7CF7A87572A0}" = Opera 9.64
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}" = Windows Live installer
"{AC76BA86-7AD7-1033-7B44-A70900000002}" = Adobe Reader 7.0.9
"{B06B842F-2450-494F-BBDE-217CDC151A37}" = NTI Backup NOW! 4.5
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B7607FC8-72AD-486D-B6B7-A402D5876309}" = PerfectDisk 11 Server
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{B944FA21-81AF-4A77-8328-CE4F4CC51032}" = Nero 8
"{C06554A1-2C1E-4D20-B613-EE62C79927CC}" = Acer eNet Management
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D1D4C9A3-060B-472A-88B7-B313CD622381}" = Windows Marketplace upgrade options tool
"{D458BBDC-0363-42E0-8FF9-4736E3CB3CA2}" = Acer Screensaver
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{DEE08946-40F0-4890-853E-60A6C3306041}" = Acer ePerformance Management
"{E38BC648-883B-4EE5-966C-94C4B7AB3E0B}" = Acer eSettings Management
"{E431C518-2EE2-471E-9234-BE995C36D513}" = Acer eDataSecurity Management 1.00.26
"{E81667C6-2856-46D6-ABEA-6A2F42166779}" = mCore
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2E36994-BCB8-4035-B45A-4F37D64BFC8F}" = Jiffy Gmail Creator
"{F8582C8F-8717-2456-8164-CE0FA5FC16E3}" = Happy Tree Friends - False Alarm
"{FBA7473C-51C5-4036-A878-D048BEA11A75}" = Pokemon Online
"{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe
"{FE9C13F6-6BBD-47D3-B939-F7E061BC4930}" = ESET NOD32 Antivirus
"AC3ACM" = AC-3 ACM Codec
"AcerOrbiCamDrv" = Acer OrbiCam Driver
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Age of Empires" = Microsoft Age of Empires
"Age of Empires 2.0" = Microsoft Age of Empires II
"Age of Empires Expansion 1.0" = Microsoft Age of Empires Expansion
"Age of Empires II: The Conquerors Expansion 1.0" = Microsoft Age of Empires II: The Conquerors Expansion
"AIM_6" = AIM 6
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV;_2BFA&SUBSYS;_1025007F" = HDAUDIO Soft Data Fax Modem with SmartCP
"Crimson Editor" = Crimson Editor (remove only)
"DVD Shrink_is1" = DVD Shrink 3.2
"ePresentation" = Acer ePresentation Management
"EPSON Printer and Utilities" = EPSON Printer Software
"EPSON Scanner" = EPSON Scan
"FAST Defrag Freeware_is1" = FAST Defrag Freeware 2.3
"FileZilla Client" = FileZilla Client [removed]
"Free FLV Converter_is1" = Free FLV Converter V 4.8
"GridVista" = Acer GridVista
"Hamachi" = Hamachi 1.0.2.5
"Huawei Modems" = Huawei Modems
"Image Grabber II" = Image Grabber II
"InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"InstallShield_{15B70821-7893-4607-805A-BB80F3EA8279}" = Acer Empowering Technology framework
"InstallShield_{6CA897D0-67F5-4F75-8261-DC8BFCA6DA42}" = Acer eLock Management
"InstallShield_{DEE08946-40F0-4890-853E-60A6C3306041}" = Acer ePerformance Management
"InstallShield_{E38BC648-883B-4EE5-966C-94C4B7AB3E0B}" = Acer eSettings Management
"K-Meleon" = K-Meleon 1.5.4 en-US (remove only)
"LimeWire" = LimeWire 5.5.8
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"mIRC" = mIRC
"Mozilla Firefox (2.0.0.13)" = Mozilla Firefox (2.0.0.13)
"Mozilla Thunderbird (2.0.0.14)" = Mozilla Thunderbird (2.0.0.14)
"NOD32 v3.x FiX 1.1 by TemDono_is1" = NOD32 v3.x FiX 1.1 by TemDono (Free Updates - Expire in 2050)
"NVIDIA Drivers" = NVIDIA Drivers
"ProInst" = Intel® PROSet/Wireless Software
"PunkBusterSvc" = PunkBuster Services
"QuicktimeAlt_is1" = QuickTime Alternative 1.76
"RealAlt_is1" = Real Alternative 1.51
"Registry Mechanic_is1" = Registry Mechanic 8.0
"SmartFTP Client 2.5 Setup Files" = SmartFTP Client 2.5 Setup Files (remove only)
"SmartFTP Client 3.0 Setup Files" = SmartFTP Client 3.0 Setup Files (remove only)
"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.5.2.20
"Spyware Doctor" = Spyware Doctor 6.0
"Steam App 10" = Counter-Strike
"Steam App 100" = Condition Zero Deleted Scenes
"Steam App 80" = Condition Zero
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"The KMPlayer" = The KMPlayer (remove only)
"TheMostCustomizableBrowser_is1" = Sleipnir Version 2.9.4
"Thunderbird-Tray" = Thunderbird-Tray
"UseNeXT_is1" = UseNeXT
"ViewpointMediaPlayer" = Viewpoint Media Player
"VLC media player" = VideoLAN VLC media player 0.8.6d
"VobSub" = VobSub v2.23 (Remove Only)
"WAMP5_is1" = WAMP5 1.7.2
"WinAVIVideoConverter_is1" = WinAVIVideoConverter
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"World of Warcraft" = World of Warcraft
"Xvid_is1" = Xvid 1.1.2 final uninstall
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Toolbar" = Yahoo! Toolbar
"ZTE_MF636_LEGACY_DRIVER_2.1040.0.3" = ZTE_MF636_USB_MODEM_2.1040.0.3

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"TimeAdjuster" = Time Adjuster STANDARD 3.1
"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/8/2010 11:51:43 AM | Computer Name = NWS-LAPTOP | Source = Application Error | ID = 1000
Description = Ελαττωματική εφαρμογή perfectdisk.exe, έκδοση [removed], ελαττωματική
λειτουργική μονάδα qtgui4.dll, έκδοση 4.5.3.0, ελαττωματική διεύθυνση 0x00258347.

Error - 7/11/2010 4:32:29 PM | Computer Name = NWS-LAPTOP | Source = PDEngine | ID = 23
Description = SMARTPlacement defragmentation ran out of free space while defragmenting
drive D:\.

Error - 7/11/2010 6:32:45 PM | Computer Name = NWS-LAPTOP | Source = crypt32 | ID = 131083
Description = Αποτυχημένη εξαγωγή από το αρχείο cab αυτόματης ενημέρωσης, της ριζικής
λίστας άλλου κατασκευαστή: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
με σφάλμα: Ένα απαιτούμενο πιστοποιητικό δεν είναι εντός της περιόδου ισχύος του,
κατά την επαλήθευση με βάση το τρέχον ρολόι συστήματος ή τη χρονική σήμανση στο
υπογεγραμμένο αρχείο.

Error - 7/11/2010 6:32:45 PM | Computer Name = NWS-LAPTOP | Source = crypt32 | ID = 131083
Description = Αποτυχημένη εξαγωγή από το αρχείο cab αυτόματης ενημέρωσης, της ριζικής
λίστας άλλου κατασκευαστή: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
με σφάλμα: Ένα απαιτούμενο πιστοποιητικό δεν είναι εντός της περιόδου ισχύος του,
κατά την επαλήθευση με βάση το τρέχον ρολόι συστήματος ή τη χρονική σήμανση στο
υπογεγραμμένο αρχείο.

Error - 7/18/2010 6:13:53 AM | Computer Name = NWS-LAPTOP | Source = Application Error | ID = 1000
Description = Ελαττωματική εφαρμογή opera.exe, έκδοση 9.64.10487.0, ελαττωματική
λειτουργική μονάδα npswf32.dll, έκδοση 10.1.53.64, ελαττωματική διεύθυνση 0x000554a2.

Error - 7/19/2010 4:42:43 AM | Computer Name = NWS-LAPTOP | Source = Application Error | ID = 1000
Description = Ελαττωματική εφαρμογή opera.exe, έκδοση 9.64.10487.0, ελαττωματική
λειτουργική μονάδα opera.dll, έκδοση 9.64.10487.0, ελαττωματική διεύθυνση 0x002acffc.

Error - 7/19/2010 4:46:11 AM | Computer Name = NWS-LAPTOP | Source = Application Error | ID = 1000
Description = Ελαττωματική εφαρμογή opera.exe, έκδοση 9.64.10487.0, ελαττωματική
λειτουργική μονάδα opera.dll, έκδοση 9.64.10487.0, ελαττωματική διεύθυνση 0x002acffc.

[ System Events ]
Error - 7/23/2010 6:57:38 AM | Computer Name = NWS-LAPTOP | Source = Service Control Manager | ID = 7026
Description = Απέτυχε η φόρτωση των ακόλουθων προγραμμάτων οδήγησης της εκκίνησης
του υπολογιστή ή της εκκίνησης του συστήματος: AFD ehdrv epfwtdir Fips intelppm IPSec
MRxSmb
NetBIOS
NetBT
RasAcd
Rdbss
Tcpip

Error - 7/23/2010 7:00:29 AM | Computer Name = NWS-LAPTOP | Source = DCOM | ID = 10005
Description = Παρουσιάστηκε σφάλμα "%1084" στο διακομιστή DCOM κατά την προσπάθεια
εκκίνησης της υπηρεσίας netman με ορίσματα "" ώστε να λειτουργήσει ο διακομιστής:
{BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 7/23/2010 9:29:39 AM | Computer Name = NWS-LAPTOP | Source = DCOM | ID = 10005
Description = Παρουσιάστηκε σφάλμα "%1084" στο διακομιστή DCOM κατά την προσπάθεια
εκκίνησης της υπηρεσίας EventSystem με ορίσματα "" ώστε να λειτουργήσει ο διακομιστής:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 7/23/2010 9:30:44 AM | Computer Name = NWS-LAPTOP | Source = sr | ID = 1
Description = Το φίλτρο Επαναφοράς Συστήματος αντιμετώπισε το μη αναμενόμενο σφάλμα
"0xC0000001" κατά την επεξεργασία του αρχείου "" στον τόμο "HarddiskVolume2".
Η εποπτεία του τόμου διακόπηκε.

Error - 7/23/2010 9:32:21 AM | Computer Name = NWS-LAPTOP | Source = Service Control Manager | ID = 7026
Description = Απέτυχε η φόρτωση των ακόλουθων προγραμμάτων οδήγησης της εκκίνησης
του υπολογιστή ή της εκκίνησης του συστήματος: abp480n5 adpu160m agp440 agpCPQ Aha154x
aic78u2
aic78xx
AliIde
alim1541
amdagp
amsint
asc
asc3350p
asc3550
cbidf
cd20xrnt
CmdIde
Cpqarray
dac2w2k
dac960nt
dpti2o
hpn
i2omp
ini910u
IntelIde
mraid35x
perc2
perc2hib
ql1080
Ql10wnt
ql12160
ql1240
ql1280
sisagp
Sparrow
symc810
symc8xx
sym_hi
sym_u3
TosIde
ultra
viaagp
ViaIde

Error - 7/23/2010 9:32:21 AM | Computer Name = NWS-LAPTOP | Source = Service Control Manager | ID = 7034
Description = Η λειτουργία της υπηρεσίας NVIDIA Display Driver Service τερματίστηκε
αναπάντεχα. Αυτό συνέβη 1 φορά(ές).

Error - 7/23/2010 2:34:09 PM | Computer Name = NWS-LAPTOP | Source = sr | ID = 1
Description = Το φίλτρο Επαναφοράς Συστήματος αντιμετώπισε το μη αναμενόμενο σφάλμα
"0xC0000001" κατά την επεξεργασία του αρχείου "" στον τόμο "HarddiskVolume2".
Η εποπτεία του τόμου διακόπηκε.

Error - 7/23/2010 2:35:48 PM | Computer Name = NWS-LAPTOP | Source = Service Control Manager | ID = 7026
Description = Απέτυχε η φόρτωση των ακόλουθων προγραμμάτων οδήγησης της εκκίνησης
του υπολογιστή ή της εκκίνησης του συστήματος: abp480n5 adpu160m agp440 agpCPQ Aha154x
aic78u2
aic78xx
AliIde
alim1541
amdagp
amsint
asc
asc3350p
asc3550
cbidf
cd20xrnt
CmdIde
Cpqarray
dac2w2k
dac960nt
dpti2o
hpn
i2omp
ini910u
IntelIde
mraid35x
perc2
perc2hib
ql1080
Ql10wnt
ql12160
ql1240
ql1280
sisagp
Sparrow
symc810
symc8xx
sym_hi
sym_u3
TosIde
ultra
viaagp
ViaIde

Error - 7/23/2010 3:00:37 PM | Computer Name = NWS-LAPTOP | Source = sr | ID = 1
Description = Το φίλτρο Επαναφοράς Συστήματος αντιμετώπισε το μη αναμενόμενο σφάλμα
"0xC0000001" κατά την επεξεργασία του αρχείου "" στον τόμο "HarddiskVolume2".
Η εποπτεία του τόμου διακόπηκε.

Error - 7/23/2010 3:02:21 PM | Computer Name = NWS-LAPTOP | Source = Service Control Manager | ID = 7026
Description = Απέτυχε η φόρτωση των ακόλουθων προγραμμάτων οδήγησης της εκκίνησης
του υπολογιστή ή της εκκίνησης του συστήματος: abp480n5 adpu160m agp440 agpCPQ Aha154x
aic78u2
aic78xx
AliIde
alim1541
amdagp
amsint
asc
asc3350p
asc3550
cbidf
cd20xrnt
CmdIde
Cpqarray
dac2w2k
dac960nt
dpti2o
hpn
i2omp
ini910u
IntelIde
mraid35x
perc2
perc2hib
ql1080
Ql10wnt
ql12160
ql1240
ql1280
sisagp
Sparrow
symc810
symc8xx
sym_hi
sym_u3
TosIde
ultra
viaagp
ViaIde

< End of report >

jsmith

Post #4July 23, 2010, 9:31 PM UTC

GMER logs: (first fast scan and second in depth)

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-07-24 00:06:57
Windows 5.1.2600 Service Pack 3
Running: 3qc1pxow.exe; Driver: C:\DOCUME~1\Thomas\LOCALS~1\Temp\uxloqkow.sys

—- System - GMER 1.0.15 —-

SSDT sphr.sys ZwEnumerateKey [0xB9EC8CA2]
SSDT sphr.sys ZwEnumerateValueKey [0xB9EC9030]

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Ntfs \Ntfs 8A8D61F8

AttachedDevice \FileSystem\Ntfs \Ntfs OsaFsLoc.sys (Filesystem Lock driver/OSA Technologies)
AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)

Device \FileSystem\Fastfat \Fat 8ACC41F8

AttachedDevice \FileSystem\Fastfat \Fat OsaFsLoc.sys (Filesystem Lock driver/OSA Technologies)
AttachedDevice \FileSystem\Fastfat \Fat eamon.sys (Amon monitor/ESET)
AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdir.sys (ESET Antivirus Network Redirector/ESET)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

—- EOF - GMER 1.0.15 —-

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-07-24 00:16:33
Windows 5.1.2600 Service Pack 3
Running: 3qc1pxow.exe; Driver: C:\DOCUME~1\Thomas\LOCALS~1\Temp\uxloqkow.sys

—- System - GMER 1.0.15 —-

SSDT 8A45E580 ZwAssignProcessToJobObject
SSDT sphr.sys ZwCreateKey [0xB9EAB0E0]
SSDT 8A45F100 ZwDebugActiveProcess
SSDT 8A45EB30 ZwDuplicateObject
SSDT sphr.sys ZwEnumerateKey [0xB9EC8CA2]
SSDT sphr.sys ZwEnumerateValueKey [0xB9EC9030]
SSDT sphr.sys ZwOpenKey [0xB9EAB0C0]
SSDT 8A45DCC0 ZwOpenProcess
SSDT 8A45DFC0 ZwOpenThread
SSDT 8A45E9C0 ZwProtectVirtualMemory
SSDT sphr.sys ZwQueryKey [0xB9EC9108]
SSDT sphr.sys ZwQueryValueKey [0xB9EC8F88]
SSDT 8A45E860 ZwSetContextThread
SSDT 8A45E6E0 ZwSetInformationThread
SSDT 8A45B700 ZwSetSecurityObject
SSDT sphr.sys ZwSetValueKey [0xB9EC919A]
SSDT 8A45E420 ZwSuspendProcess
SSDT 8A45E2C0 ZwSuspendThread
SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xB6AB7620]
SSDT 8A45E150 ZwTerminateThread
SSDT 8A45EF50 ZwWriteVirtualMemory

INT 0x62 ? 8ACD8BF8
INT 0x63 ? 8AA34E60
INT 0x73 ? 8AA34E60
INT 0x82 ? 8ACD8BF8
INT 0x83 ? 8AA34E60
INT 0x84 ? 8AA34E60

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwCallbackReturn + 2DF4 80504690 4 Bytes JMP 683CD0DA
.text ntkrnlpa.exe!ZwCallbackReturn + 2F24 805047C0 4 Bytes CALL DFE6D20A
? sphr.sys Δεν είναι δυνατή η εύρεση του καθορισμένου αρχείου από το σύστημα. !
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB985F360, 0x2255BD, 0xE8000020]
.text USBPORT.SYS!DllUnload B97EF8AC 5 Bytes JMP 8AA34440
.text aosyzqmh.SYS B9568384 1 Byte [20]
.text aosyzqmh.SYS B9568384 37 Bytes [20, 00, 00, 68, 00, 00, 00, …]
.text aosyzqmh.SYS B95683AA 24 Bytes [00, 00, 20, 00, 00, E0, 00, …]
.text aosyzqmh.SYS B95683C4 3 Bytes [00, 00, 00]
.text aosyzqmh.SYS B95683C9 1 Byte [00]
.text …

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1880] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 4 Bytes [C2, 04, 00, 00]

—- Kernel IAT/EAT - GMER 1.0.15 —-

IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [B9EAC040] sphr.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [B9EAC13C] sphr.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [B9EAC0BE] sphr.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [B9EAC7FC] sphr.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [B9EAC6D2] sphr.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [B9EBBD92] sphr.sys
IAT \SystemRoot\System32\Drivers\aosyzqmh.SYS[HAL.dll!KfAcquireSpinLock] 000000AD
IAT \SystemRoot\System32\Drivers\aosyzqmh.SYS[HAL.dll!READ_PORT_UCHAR] 000000D4
IAT \SystemRoot\System32\Drivers\aosyzqmh.SYS[HAL.dll!KeGetCurrentIrql] 000000A2
IAT \SystemRoot\System32\Drivers\aosyzqmh.SYS[HAL.dll!KfRaiseIrql] 000000AF
IAT \SystemRoot\System32\Drivers\aosyzqmh.SYS[HAL.dll!KfLowerIrql] 0000009C
IAT \SystemRoot\System32\Drivers\aosyzqmh.SYS[HAL.dll!HalGetInterruptVector] 000000A4
IAT \SystemRoot\System32\Drivers\aosyzqmh.SYS[HAL.dll!HalTranslateBusAddress] 00000072
IAT \SystemRoot\System32\Drivers\aosyzqmh.SYS[HAL.dll!KeStallExecutionProcessor] 000000C0
IAT \SystemRoot\System32\Drivers\aosyzqmh.SYS[HAL.dll!KfReleaseSpinLock] 000000B7
IAT \SystemRoot\System32\Drivers\aosyzqmh.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] 000000FD
IAT \SystemRoot\System32\Drivers\aosyzqmh.SYS[HAL.dll!READ_PORT_USHORT] 00000093
IAT \SystemRoot\System32\Drivers\aosyzqmh.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 00000026
IAT \SystemRoot\System32\Drivers\aosyzqmh.SYS[HAL.dll!WRITE_PORT_UCHAR] 00000036
IAT \SystemRoot\System32\Drivers\aosyzqmh.SYS[WMILIB.SYS!WmiSystemControl] 000000F7
IAT \SystemRoot\System32\Drivers\aosyzqmh.SYS[WMILIB.SYS!WmiCompleteRequest] 000000CC

—- User IAT/EAT - GMER 1.0.15 —-

IAT C:\DOCUME~1\Thomas\LOCALS~1\Temp\RtkBtMnt.exe[1688] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [10002E40] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\DOCUME~1\Thomas\LOCALS~1\Temp\RtkBtMnt.exe[1688] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [10002C10] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\DOCUME~1\Thomas\LOCALS~1\Temp\RtkBtMnt.exe[1688] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [10002C30] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\DOCUME~1\Thomas\LOCALS~1\Temp\RtkBtMnt.exe[1688] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [10002C20] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\explorer.exe[2868] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [10002E40] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\explorer.exe[2868] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [10002C10] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\explorer.exe[2868] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [10002C30] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\explorer.exe[2868] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [10002C20] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\3qc1pxow.exe[2968] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [10002E40] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\3qc1pxow.exe[2968] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [10002C10] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\3qc1pxow.exe[2968] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [10002C30] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\3qc1pxow.exe[2968] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [10002C20] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\wscntfy.exe[3044] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [10002E40] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\wscntfy.exe[3044] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [10002C10] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\wscntfy.exe[3044] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [10002C30] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\wscntfy.exe[3044] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [10002C20] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\rundll32.exe[3064] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [10002E40] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\rundll32.exe[3064] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [10002C10] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\rundll32.exe[3064] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [10002C30] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\rundll32.exe[3064] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [10002C20] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\RTHDCPL.EXE[3140] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [10002E40] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\RTHDCPL.EXE[3140] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [10002C10] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\RTHDCPL.EXE[3140] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [10002C30] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\RTHDCPL.EXE[3140] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [10002C20] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3280] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [10002E40] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3280] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [10002C10] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3280] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [10002C30] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3280] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [10002C20] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Acer\Empowering Technology\admtray.exe[3312] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00F72E40] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Acer\Empowering Technology\admtray.exe[3312] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00F72C10] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Acer\Empowering Technology\admtray.exe[3312] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00F72C30] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Acer\Empowering Technology\admtray.exe[3312] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00F72C20] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe[3328] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00AD2E40] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe[3328] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00AD2C10] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe[3328] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00AD2C30] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe[3328] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00AD2C20] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Acer\Empowering Technology\eRecovery\Monitor.exe[3344] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00BA2E40] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Acer\Empowering Technology\eRecovery\Monitor.exe[3344] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00BA2C10] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Acer\Empowering Technology\eRecovery\Monitor.exe[3344] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00BA2C30] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Acer\Empowering Technology\eRecovery\Monitor.exe[3344] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00BA2C20] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\RUNDLL32.EXE[3476] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [10002E40] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\RUNDLL32.EXE[3476] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [10002C10] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\RUNDLL32.EXE[3476] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [10002C30] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\RUNDLL32.EXE[3476] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [10002C20] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\Acer\Acer Arcade\PCMService.exe[3500] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [10002E40] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\Acer\Acer Arcade\PCMService.exe[3500] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [10002C10] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\Acer\Acer Arcade\PCMService.exe[3500] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [10002C30] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\Acer\Acer Arcade\PCMService.exe[3500] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [10002C20] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Acer\Empowering Technology\ePower\ePower_DMC.exe[3516] @ C:\WINDOWS\system32\KERNEL32.dll [ntdll.dll!NtCreateFile] [10002E40] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Acer\Empowering Technology\ePower\ePower_DMC.exe[3516] @ C:\WINDOWS\system32\KERNEL32.dll [ntdll.dll!NtDeviceIoControlFile] [10002C10] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Acer\Empowering Technology\ePower\ePower_DMC.exe[3516] @ C:\WINDOWS\system32\KERNEL32.dll [ntdll.dll!NtClose] [10002C30] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Acer\Empowering Technology\ePower\ePower_DMC.exe[3516] @ C:\WINDOWS\system32\KERNEL32.dll [ntdll.dll!NtDuplicateObject] [10002C20] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\PROGRA~1\LAUNCH~1\LManager.exe[3616] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00CF2E40] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\PROGRA~1\LAUNCH~1\LManager.exe[3616] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00CF2C10] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\PROGRA~1\LAUNCH~1\LManager.exe[3616] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00CF2C30] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\PROGRA~1\LAUNCH~1\LManager.exe[3616] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00CF2C20] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\LVCOMSX.EXE[3684] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [10002E40] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\LVCOMSX.EXE[3684] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [10002C10] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\LVCOMSX.EXE[3684] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [10002C30] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\LVCOMSX.EXE[3684] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [10002C20] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\Acer\OrbiCam\CameraAssistant.exe[3748] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00AD2E40] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\Acer\OrbiCam\CameraAssistant.exe[3748] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00AD2C10] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\Acer\OrbiCam\CameraAssistant.exe[3748] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00AD2C30] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\Acer\OrbiCam\CameraAssistant.exe[3748] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00AD2C20] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\ElkCtrl.exe[3784] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [10002E40] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\ElkCtrl.exe[3784] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [10002C10] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\ElkCtrl.exe[3784] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [10002C30] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\ElkCtrl.exe[3784] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [10002C20] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[3796] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [10002E40] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[3796] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [10002C10] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[3796] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [10002C30] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[3796] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [10002C20] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\Common Files\Java\Java Update\jusched.exe[3852] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [10002E40] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\Common Files\Java\Java Update\jusched.exe[3852] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [10002C10] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\Common Files\Java\Java Update\jusched.exe[3852] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [10002C30] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\Common Files\Java\Java Update\jusched.exe[3852] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [10002C20] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\ctfmon.exe[3896] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [10002E40] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\ctfmon.exe[3896] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [10002C10] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\ctfmon.exe[3896] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [10002C30] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\ctfmon.exe[3896] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [10002C20] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe[3916] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00C32E40] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe[3916] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00C32C10] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe[3916] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00C32C30] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe[3916] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00C32C20] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\wbem\unsecapp.exe[3944] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [10002E40] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\wbem\unsecapp.exe[3944] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [10002C10] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\wbem\unsecapp.exe[3944] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [10002C30] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\WINDOWS\system32\wbem\unsecapp.exe[3944] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [10002C20] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4044] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00BF2E40] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4044] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00BF2C10] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4044] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00BF2C30] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)
IAT C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4044] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00BF2C20] C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll (Logitech Helper Library./Logitech)

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Ntfs \Ntfs 8A8D61F8

AttachedDevice \FileSystem\Ntfs \Ntfs OsaFsLoc.sys (Filesystem Lock driver/OSA Technologies)
AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)

Device \FileSystem\Fastfat \FatCdrom 8ACC41F8

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

Device \Driver\usbuhci \Device\USBPDO-0 8AA30460
Device \Driver\usbuhci \Device\USBPDO-1 8AA30460
Device \Driver\usbuhci \Device\USBPDO-2 8AA30460
Device \Driver\NetBT \Device\NetBT_Tcpip_{DD74476C-2453-478D-B98A-EB8BCF8F9047} 8A8DE1F8
Device \Driver\usbuhci \Device\USBPDO-3 8AA30460
Device \Driver\usbehci \Device\USBPDO-4 8A9CB1F8

AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdir.sys (ESET Antivirus Network Redirector/ESET)

Device \Driver\Ftdisk \Device\HarddiskVolume1 8ACD91F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 8ACD91F8
Device \Driver\Cdrom \Device\CdRom0 OsaFsLoc.sys (Filesystem Lock driver/OSA Technologies)
Device \Driver\Cdrom \Device\CdRom0 8A7C71F8
Device \Driver\Ftdisk \Device\HarddiskVolume3 8ACD91F8
Device \Driver\Cdrom \Device\CdRom1 OsaFsLoc.sys (Filesystem Lock driver/OSA Technologies)
Device \Driver\Cdrom \Device\CdRom1 8A7C71F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 [B9E06B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort0 [B9E06B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort1 [B9E06B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e [B9E06B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\NetBT \Device\NetBt_Wins_Export 8A8DE1F8
Device \Driver\NetBT \Device\NetbiosSmb 8A8DE1F8
Device \Driver\PCI_PNP8030 \Device\00000089 sphr.sys
Device \Driver\sptd \Device\1090875530 sphr.sys
Device \Driver\usbuhci \Device\USBFDO-0 8AA30460
Device \Driver\usbuhci \Device\USBFDO-1 8AA30460
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 8AA15468
Device \Driver\usbuhci \Device\USBFDO-2 8AA30460
Device \FileSystem\MRxSmb \Device\LanmanRedirector 8AA15468
Device \Driver\usbuhci \Device\USBFDO-3 8AA30460
Device \Driver\Ftdisk \Device\FtControl 8ACD91F8
Device \Driver\usbehci \Device\USBFDO-4 8A9CB1F8
Device \Driver\aosyzqmh \Device\Scsi\aosyzqmh1Port2Path0Target0Lun0 8A7411F8
Device \Driver\aosyzqmh \Device\Scsi\aosyzqmh1 8A7411F8
Device \FileSystem\Fastfat \Fat 8ACC41F8

AttachedDevice \FileSystem\Fastfat \Fat OsaFsLoc.sys (Filesystem Lock driver/OSA Technologies)
AttachedDevice \FileSystem\Fastfat \Fat eamon.sys (Amon monitor/ESET)

Device \FileSystem\Cdfs \Cdfs 8A8551F8

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x49 0x6C 0x76 0xC1 …
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xB6 0xBF 0x79 0x20 …
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xE4 0x92 0x6E 0xB5 …
Reg HKLM\SYSTEM\ControlSet002\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@\x98\3 1?
Reg HKLM\SYSTEM\ControlSet002\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@\x2018\3 1?
Reg HKLM\SYSTEM\ControlSet002\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@\xa0\3\xb1\3 1?2?3?4?
Reg HKLM\SYSTEM\ControlSet002\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@\x2018\3 1?
Reg HKLM\SYSTEM\ControlSet002\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@\xa0\3 1?
Reg HKLM\SYSTEM\ControlSet002\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@\xa3\3 1?
Reg HKLM\SYSTEM\ControlSet002\Services\lanmanserver\Shares@\xa6\3\xac\3 CSCFlags=0?MaxUses=4294967295?Path=D:\????????Permissions=0?Remark=?Type=0?
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x49 0x6C 0x76 0xC1 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xB6 0xBF 0x79 0x20 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x6B 0x36 0xDA 0x77 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x49 0x6C 0x76 0xC1 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xB6 0xBF 0x79 0x20 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xC8 0x87 0xD0 0xF1 …
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@\x98\3 1?
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@\x2018\3 1?
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@\xa0\3\xb1\3 1?2?3?4?
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@\x2018\3 1?
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@\xa0\3 1?
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@\xa3\3 1?
Reg HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\Shares@\xa6\3\xac\3 CSCFlags=0?MaxUses=4294967295?Path=D:\????????Permissions=0?Remark=?Type=0?
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x49 0x6C 0x76 0xC1 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xB6 0xBF 0x79 0x20 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x6B 0x36 0xDA 0x77 …
Reg HKLM\SYSTEM\ControlSet005\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@\x98\3 1?
Reg HKLM\SYSTEM\ControlSet005\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@\x2018\3 1?
Reg HKLM\SYSTEM\ControlSet005\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@\xa0\3\xb1\3 1?2?3?4?
Reg HKLM\SYSTEM\ControlSet005\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@\x2018\3 1?
Reg HKLM\SYSTEM\ControlSet005\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@\xa0\3 1?
Reg HKLM\SYSTEM\ControlSet005\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@\xa3\3 1?
Reg HKLM\SYSTEM\ControlSet005\Services\lanmanserver\Shares@\xa6\3\xac\3 CSCFlags=0?MaxUses=4294967295?Path=D:\????????Permissions=0?Remark=?Type=0?
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x49 0x6C 0x76 0xC1 …
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xB6 0xBF 0x79 0x20 …
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x6B 0x36 0xDA 0x77 …

—- EOF - GMER 1.0.15 —-

SweetTech

Post #5July 23, 2010, 9:46 PM UTC

Hello,

OTL Fix

We need to run an OTL Fix

Please reopen [external image: Posted Image] on your desktop.

Copy and Paste the following code into the [external image: Posted Image] textbox. Do not include the word "Code"

:Services
:OTL
PRC - C:\Documents and Settings\Thomas\Local Settings\Temp\svcnost.exe ()
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\WINDOWS\System32\ADOBE\SHOCKW~1\SWHELP~2.EXE -Update -1100465 -Mozilla\4.0 ( File not found
O16 - DPF: {00000055-9980-0010-8000-00AA00389B71} http://codecs.microsoft.com/codecs/i386/fhg.CAB (Reg Error: Key error.)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O20 - AppInit_DLLs: (C:\DOCUME~1\Thomas\LOCALS~1\Temp\620kou.dll) - C:\DOCUME~1\Thomas\LOCALS~1\Temp\620kou.dll File not found
O33 - MountPoints2\{1e76cc37-c21a-11dc-9f51-0016d456f5f6}\Shell\AutoRun\command - "" = G:\wd_windows_tools\setup.exe – File not found
O33 - MountPoints2\{324fabe3-8cfb-11dd-9f7e-eec3f598a194}\Shell - "" = AutoRun
O33 - MountPoints2\{324fabe3-8cfb-11dd-9f7e-eec3f598a194}\Shell\AutoRun\command - "" = G:\AutoRun.exe – File not found
O33 - MountPoints2\{543005f6-57d8-11dd-9f76-0018de75179a}\Shell - "" = AutoRun
O33 - MountPoints2\{543005f6-57d8-11dd-9f76-0018de75179a}\Shell\AutoRun\command - "" = H:\AutoRun.exe – File not found
O33 - MountPoints2\{54300603-57d8-11dd-9f76-0018de75179a}\Shell - "" = AutoRun
O33 - MountPoints2\{54300603-57d8-11dd-9f76-0018de75179a}\Shell\AutoRun\command - "" = G:\AutoRun.exe – File not found
O33 - MountPoints2\{95555e1a-c1d5-11db-9f01-0018de75179a}\Shell\AutoRun\command - "" = G:\wd_windows_tools\setup.exe – File not found
O33 - MountPoints2\{9aae1040-ddf5-11de-9fe0-0016d456f5f6}\Shell - "" = AutoRun
O33 - MountPoints2\{9aae1040-ddf5-11de-9fe0-0016d456f5f6}\Shell\AutoRun\command - "" = G:\AutoRun.exe – File not found
O33 - MountPoints2\{c1d841eb-5767-11dd-9f75-0018de75179a}\Shell - "" = AutoRun
O33 - MountPoints2\{c1d841eb-5767-11dd-9f75-0018de75179a}\Shell\AutoRun\command - "" = G:\AutoRun.exe – File not found
O33 - MountPoints2\{c1d841ec-5767-11dd-9f75-0018de75179a}\Shell - "" = AutoRun
O33 - MountPoints2\{c1d841ec-5767-11dd-9f75-0018de75179a}\Shell\AutoRun\command - "" = G:\AutoRun.exe – File not found
O33 - MountPoints2\{d137e2dc-908b-11dd-9f82-0018de75179a}\Shell - "" = AutoRun
O33 - MountPoints2\{d137e2dc-908b-11dd-9f82-0018de75179a}\Shell\AutoRun\command - "" = G:\AutoRun.exe – File not found
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\AutoRun.exe – File not found

:Reg

:Files

:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[start explorer]
[Reboot]

Push [external image: Posted Image]
OTL may ask to reboot the machine. Please do so if asked.
Click [external image: Posted Image].
A report will open. Copy and Paste that report in your next reply.
If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

NEXT:

Running ComboFix
Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your Anti-Virus and Anti-Spyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the ComboFix log in your next reply as well as describe how your computer is running now

jsmith

Post #6July 23, 2010, 10:31 PM UTC

Hello again, Ok so now I post from another PC.. After the OTL fix, like you said, it wanted to restart etc etc but now for around 15' it stuck at the stage that says "Writing non saved files on drive" (I have no idea if this is being said in the english version I just translated what I read). What should I do? Wait more or force close and reopen? Thanks!

SweetTech

Post #7July 23, 2010, 10:37 PM UTC

I'm going under the assumption that this is being displayed for OTL. If this is the case please force it closed, by exiting out of it. Go ahead and proceed with the ComboFix instructions.

jsmith

Post #8July 23, 2010, 10:38 PM UTC last edited July 23, 2010, 10:39 PM UTC

I'm going under the assumption that this is being displayed for OTL. If this is the case please force it closed, by exiting out of it.

Go ahead and proceed with the ComboFix instructions.

Nope this is from Windows.. It is an Acer laptop and it always does that (the way it closes down, some time stucks like this for w/e reason) :/

SweetTech

Post #9July 23, 2010, 10:40 PM UTC

I don't think it should be taking 15 minutes to save files to a disc, before restarting, so I'd say go ahead and force the restart, and upon reboot proceed with the ComboFix instructions.

jsmith

Post #10July 23, 2010, 11:00 PM UTC

Ok so I did a restart, manually run explorer.exe (as always) and got the log file. Run the Combofix (tried at least) and it disabled a ton of stuff and wanted to restart.. After that restart I couldn't even open the Task Manager.. :/ I manually turned off the laptop once again and I am waiting now to see if I will be able to login this time or not..

SweetTech

Post #11July 23, 2010, 11:08 PM UTC

Okay. Thanks for the update.

jsmith

Post #12July 23, 2010, 11:34 PM UTC

Hello again, Ok after I run the ComboFix the explorer.exe loaded by itself at the start. It asked me though for a couple of stuff and problems regarding registry.. Did this cleaned the whole registry?.. :/ Here are the logs: All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== No active process named svcnost.exe was found! Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}\ not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Shockwave Updater deleted successfully. Starting removal of ActiveX control {00000055-9980-0010-8000-00AA00389B71} C:\WINDOWS\Downloaded Program Files\fhg.inf moved successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{00000055-9980-0010-8000-00AA00389B71}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000055-9980-0010-8000-00AA00389B71}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{00000055-9980-0010-8000-00AA00389B71}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000055-9980-0010-8000-00AA00389B71}\ not found. Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found. Starting removal of ActiveX control {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found. Starting removal of ActiveX control {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found. Starting removal of ActiveX control {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found. Starting removal of ActiveX control {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found. Starting removal of ActiveX control {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:C:\DOCUME~1\Thomas\LOCALS~1\Temp\620kou.dll deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1e76cc37-c21a-11dc-9f51-0016d456f5f6}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1e76cc37-c21a-11dc-9f51-0016d456f5f6}\ not found. File G:\wd_windows_tools\setup.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{324fabe3-8cfb-11dd-9f7e-eec3f598a194}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{324fabe3-8cfb-11dd-9f7e-eec3f598a194}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{324fabe3-8cfb-11dd-9f7e-eec3f598a194}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{324fabe3-8cfb-11dd-9f7e-eec3f598a194}\ not found. File G:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{543005f6-57d8-11dd-9f76-0018de75179a}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{543005f6-57d8-11dd-9f76-0018de75179a}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{543005f6-57d8-11dd-9f76-0018de75179a}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{543005f6-57d8-11dd-9f76-0018de75179a}\ not found. File H:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{54300603-57d8-11dd-9f76-0018de75179a}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{54300603-57d8-11dd-9f76-0018de75179a}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{54300603-57d8-11dd-9f76-0018de75179a}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{54300603-57d8-11dd-9f76-0018de75179a}\ not found. File G:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{95555e1a-c1d5-11db-9f01-0018de75179a}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95555e1a-c1d5-11db-9f01-0018de75179a}\ not found. File G:\wd_windows_tools\setup.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9aae1040-ddf5-11de-9fe0-0016d456f5f6}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9aae1040-ddf5-11de-9fe0-0016d456f5f6}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9aae1040-ddf5-11de-9fe0-0016d456f5f6}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9aae1040-ddf5-11de-9fe0-0016d456f5f6}\ not found. File G:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c1d841eb-5767-11dd-9f75-0018de75179a}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c1d841eb-5767-11dd-9f75-0018de75179a}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c1d841eb-5767-11dd-9f75-0018de75179a}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c1d841eb-5767-11dd-9f75-0018de75179a}\ not found. File G:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c1d841ec-5767-11dd-9f75-0018de75179a}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c1d841ec-5767-11dd-9f75-0018de75179a}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c1d841ec-5767-11dd-9f75-0018de75179a}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c1d841ec-5767-11dd-9f75-0018de75179a}\ not found. File G:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d137e2dc-908b-11dd-9f82-0018de75179a}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d137e2dc-908b-11dd-9f82-0018de75179a}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d137e2dc-908b-11dd-9f82-0018de75179a}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d137e2dc-908b-11dd-9f82-0018de75179a}\ not found. File G:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H\ not found. File H:\AutoRun.exe not found. ========== REGISTRY ========== ========== FILES ========== ========== COMMANDS ========== [EMPTYTEMP] User: Default User ->Temp folder emptied: 507904 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: All Users User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 65984 bytes ->Temporary Internet Files folder emptied: 2545021 bytes User: Thomas ->Temp folder emptied: 584028189 bytes ->Temporary Internet Files folder emptied: 1281801 bytes ->Java cache emptied: 83554470 bytes ->FireFox cache emptied: 52323719 bytes ->Opera cache emptied: 62292381 bytes ->Flash cache emptied: 1930136 bytes User: NetworkService.NT AUTHORITY ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 134 bytes User: LocalService.NT AUTHORITY ->Temp folder emptied: 65984 bytes ->Temporary Internet Files folder emptied: 134 bytes User: Owner ->Temp folder emptied: 507904 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: NetworkService.NT AUTHORITY.000 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 134 bytes User: LocalService.NT AUTHORITY.000 ->Temp folder emptied: 65984 bytes ->Temporary Internet Files folder emptied: 134 bytes User: Owner.ACER-BDE796E815 ->Temp folder emptied: 507904 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: Administrator ->Temp folder emptied: 507904 bytes ->Temporary Internet Files folder emptied: 32902 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 19569 bytes %systemroot%\System32 .tmp files removed: 1414046 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 103512 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 13494218 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 76105660 bytes Total Files Cleaned = 841.00 mb [EMPTYFLASH] User: Default User User: All Users User: NetworkService User: LocalService User: Thomas ->Flash cache emptied: 0 bytes User: NetworkService.NT AUTHORITY User: LocalService.NT AUTHORITY User: Owner User: NetworkService.NT AUTHORITY.000 User: LocalService.NT AUTHORITY.000 User: Owner.ACER-BDE796E815 User: Administrator Total Flash Files Cleaned = 0.00 mb OTL by OldTimer - Version 3.2.9.1 log created on 07242010_010055 Files\Folders moved on Reboot… File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\R5R3MC9W\;tile=3;sz=300x250,300x600,160x600,120x600,11x1;p=tr;dom=com;g=th;id=tt0488 352;tt=tv;k=p;g=dr;g=hi;k=c;coo=usa;bpx=1;s=342;s=341;s=344;s=343;s=338;s=337;s=3 40;s=493;s=284;[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\R5R3MC9W\;tile=3;sz=300x250,300x600,160x600,120x600,11x1;p=tr;dom=com;g=th;id=tt0488 352;tt=tv;k=p;g=dr;g=hi;k=c;coo=usa;bpx=1;s=342;s=341;s=344;s=343;s=338;s=337;s=3 40;s=493;s=284;[3] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\TMG2VTPK\default;sz=300x250;k21=1;kr=F;kgender=m;kga=1001;kar=3;klg=en;kage=23;kgg=1 ;kt=U;kw=butt+problem;kcr=us;dc_dedup=1;kmyd=ad_creative_1;tile=1;dcopt=ist;ord=3 420321115015588[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\TMG2VTPK\maindetails;tile=3;sz=300x250,11x1;p=tr;dom=com;g=th;id=tt0488352;tt=tv;k=p ;g=dr;g=hi;k=c;coo=usa;bpx=1;s=342;s=341;s=344;s=343;s=338;s=337;s=340;s=493;s=28 4;s=283;s=333;s[1] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\TMG2VTPK\maindetails;tile=1;sz=1x1,4x1;p=f1;ifb=pf;dom=com;g=th;id=tt0488352;tt=tv;k =p;g=dr;g=hi;k=c;coo=usa;bpx=1;s=342;s=341;s=344;s=343;s=338;s=337;s=340;s=493;s= 284;s=283;s=333[1] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\TMG2VTPK\maindetails;tile=5;sz=728x90,2x1;p=b;dom=com;g=th;tt=tv;k=p;id=tt1292837;g= dr;g=hi;k=c;coo=usa;bpx=1;s=342;s=341;s=344;s=343;s=338;s=337;s=340;s=493;s=284;s =283;s=333;s=10[1] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\LNHR1ERP\main_6;sz=450x60;mpvid=AASB30NquyRLj_Fq;!c=6;k2=68;kgender=m;kvid=4pXfHLUlZf4;shortform=1;kpid=6;kga=1001;kar=3;kgg=1 ;kcr=us;khd=1;ytexp=900080;klg=en;kpu=thelonelyisland;[1].asx not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\LNHR1ERP\maindetails;tile=2;sz=728x90,1008x150,1008x200,9x1;p=t;p=top;dom=com;g=th;i d=tt0488352;tt=tv;k=p;g=dr;g=hi;k=c;coo=usa;bpx=1;s=342;s=341;s=344;s=343;s=338;s =337;s=340;s=49[1] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\LNHR1ERP\_sid=1279872070&ga_hid=521875010&ga_fc=0&u_tz=180&u_his=10&u_java=1&u_h=800&u_w=1280&u_ah=770&u_aw=1280&u_cd=32&u_nplug=0&u_nmime=0&biw=1259&bih=631&ifk=25451901&fu=4&ifi=1&dtd=31 not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\LNHR1ERP\id=1279872089&ga_hid=901534187&ga_fc=0&u_tz=180&u_his=11&u_java=1&u_h=800&u_w=1280&u_ah=770&u_aw=1280&u_cd=32&u_nplug=0&u_nmime=0&biw=1259&bih=631&ifk=2720262309&fu=4&ifi=1&dtd=15 not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\LNHR1ERP\main_3389;sz=450x60;mpvid=AASBwNrB8fIt-ZCw;!c=3389;kgender=m;kvid=cd7IR004tls;shortform=1;kpid=3389;kga=1001;kar=3;kgg=1 ;kcr=us;khd=1;ytexp=900080;klg=en;kpu=nigahiga;k21=[1].asx not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\KDGBWBOZ\2426791_250x250[2].com%2Fdocs%2F21961910%2FWOW-schools-gold-cap-course&rfkwd=wow-schools%2Bdownload&s=g&fmt=250x250&id=2426791&fv=1&fo=json&mt=WOW%20schools%20gold%20cap%20course not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\KDGBWBOZ\pops;id=18629649,18634144,18588370,18588387,18585931,18559569,18559515,1856 6260,18559508,18559432,18559422,18539201,18539236,18535863,18535536,18535358,1853 5455,18534735,1[1].xml not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\KDGBWBOZ\maindetails;tile=1;sz=1x1,4x1;p=f1;ifb=pf;dom=com;g=th;id=tt0488352;tt=tv;k =p;g=dr;g=hi;k=c;coo=usa;bpx=1;s=342;s=341;s=344;s=343;s=338;s=337;s=340;s=493;s= 284;s=283;s=333[1] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\KDGBWBOZ\;tile=2;sz=728x90,1008x150,1008x200,9x1;p=t;p=top;dom=com;g=th;id=tt0488352 ;tt=tv;k=p;g=dr;g=hi;k=c;coo=usa;bpx=1;s=342;s=341;s=344;s=343;s=338;s=337;s=340; s=493;s=284;s=2[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\CXUR4X6F\main_1961;sz=300x250;mpvid=AAR9YIy2LpPgWiV5;!c=1961;k2=806;kgender=m;kvid=mC-PQca6FJU;shortform=1;kpid=1961;kga=1001;kar=3;kgg=1;kcr=us;khd=0;ytexp=900080;kl g=en;kpu=Insid[1].htm not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\CXUR4X6F\default;sz=300x250;k21=1;kr=F;kgender=m;kga=1001;kar=3;klg=en;kage=23;kgg=1 ;kt=U;kw=nissan+gtr;kcr=us;dc_dedup=1;kmyd=ad_creative_1;tile=1;dcopt=ist;ord=172 1025646240073[2].5 not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\CXUR4X6F\main_10534;sz=450x60;mpvid=AAR9YLimi7ntqtTs;!c=10534;k2=855;kgender=m;kvid=BwPMWdMrg7g;shortform=1;kpid=10534;kga=1001;ka r=3;kgg=1;kcr=us;khd=0;ytexp=900080;klg=en;kpu=iMO[1].asx not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\CXUR4X6F\professionalphotovideoservices;sz=300x250;k21=1;kr=F;kgender=m;kga=1001;kar =3;klg=en;kage=23;kgg=1;kt=U;kw=17+gigapixel;kcr=us;dc_dedup=1;kmyd=ad_creative_1 ;tile=1;dcopt=i[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\CXUR4X6F\main_86;sz=300x250;mpvid=AAR9X-m5_U2RTUik;!c=86;k2=552;kgender=m;kvid=cM7Tr1koShs;shortform=1;kpid=86;kga=1001;kar=3;kg g=1;kcr=us;khd=1;ytexp=900080;klg=en;kpu=smosh;kr=F;[1].htm not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\CXUR4X6F\main_134;sz=300x60,300x250;mpvid=AAR9YACMrUUCxYws;!c=134;ytexp=900080;k21=1;kvid=J1Qif6ZeRRY;kpu=MondoMedia;kr=A;kgender=m;ko=p ;kpid=134;kga=1001;kar=3;klg=en;kage=23;kgg=[1].htm not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\CXUR4X6F\main_433;sz=300x250;mpvid=AAR9YP5f4VHLr7jW;!c=433;ytexp=900080;k21=1;kvid=nKVJ9-_9g5A;kpu=lockergnome;kr=N;kgender=m;ko=p;kpid=433;kga=1001;kar=3;klg=en;kage=23 ;kgg=1;kt=U[1].htm not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\0HEBSTYN\regionalcontent_centraleasterneurope;sz=300x250;k21=1;kr=F;kgender=m;kga=10 01;kar=3;klg=en;kage=23;kgg=1;kt=U;kw=macedonia+greek;kcr=us;dc_dedup=1;kmyd=ad_c reative_1;tile=[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\0HEBSTYN\main_7953;sz=450x60;mpvid=AAR9YIJrMy8j3U9_;!c=7953;k2=806;kgender=m;kvid=xEP3ew1MPXA;shortform=1;kpid=7953;kga=1001;kar= 3;kgg=1;kcr=us;khd=0;ytexp=900080;klg=en;kpu=motort[1].asx not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\O56JGXMR\jquery-digg_jquery-cookie_jquery-scrollTo_jquery-color_jquery-pxtoem_spellChecker_Class_throttle_comments_dialog_App_PermaLink,PermaLink_App_P ermaLink,PermaLinkThrottle_Ap[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\O56JGXMR\main_7953;sz=480x70;mpvid=AAR9YIJrMy8j3U9_;!c=7953;k2=806;kgender=m;kvid=xEP3ew1MPXA;shortform=1;kpid=7953;kga=1001;kar= 3;kgg=1;kcr=us;khd=0;ytexp=900080;klg=en;kpu=motort[1].asx not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\O56JGXMR\main_86;sz=480x70;mpvid=AAR9X-m5_U2RTUik;!c=86;k2=552;kgender=m;kvid=cM7Tr1koShs;shortform=1;kpid=86;kga=1001;kar=3;kg g=1;kcr=us;khd=1;ytexp=900080;klg=en;kpu=smosh;kr=F;k[1].asx not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\O56JGXMR\main_134;sz=480x70,480x360;mpvid=AAR9YACMrUUCxYws;!c=134;ytexp=900080;k21=1;kvid=J1Qif6ZeRRY;kpu=MondoMedia;kr=A;kgender=m;ko=p ;kpid=134;kga=1001;kar=3;klg=en;kage=23;kgg=[1].asx not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\O56JGXMR\main_10534;sz=480x70,480x360;mpvid=AAR9YLimi7ntqtTs;!c=10534;k2=855;kgender=m;kvid=BwPMWdMrg7g;shortform=1;kpid=10534;kga=1001;ka r=3;kgg=1;kcr=us;khd=0;ytexp=900080;klg=en[1].asx not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\O56JGXMR\main_1138;sz=450x60;mpvid=AAR9YBMZ1HMWx4An;!c=1138;k2=182;kgender=m;kvid=CR0URUyxZfQ;shortform=1;kpid=1138;kga=1001;kar= 3;kgg=1;kcr=us;khd=1;ytexp=900080;klg=en;kpu=edbass[1].asx not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\O56JGXMR\main_1138;sz=450x60;mpvid=AAR9YBSqINoaBc0p;!c=1138;k2=182;kgender=m;kvid=Uk_axjZ78wU;shortform=1;kpid=1138;kga=1001;kar= 3;kgg=1;kcr=us;khd=1;ytexp=900080;klg=en;kpu=edbass[1].asx not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\O56JGXMR\main_10534;sz=300x60,300x250;mpvid=AAR9YLimi7ntqtTs;!c=10534;k2=855;kgender=m;kvid=BwPMWdMrg7g;shortform=1;kpid=10534;kga=1001;ka r=3;kgg=1;kcr=us;khd=0;ytexp=900080;klg=en[1].htm not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\O56JGXMR\main_7953;sz=450x60;mpvid=AAR9YHVFc8T34IDS;!c=7953;k2=806;kgender=m;kvid=fO42M44uMls;shortform=1;kpid=7953;kga=1001;kar= 3;kgg=1;kcr=us;khd=0;ytexp=900080;klg=en;kpu=motort[1].asx not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\UVANQL6Z\main_1961;sz=450x60;mpvid=AAR9YIy2LpPgWiV5;!c=1961;k2=806;kgender=m;kvid=mC-PQca6FJU;shortform=1;kpid=1961;kga=1001;kar=3;kgg=1;kcr=us;khd=0;ytexp=900080;kl g=en;kpu=Inside[1].asx not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\UVANQL6Z\main_433;sz=480x70;mpvid=AAR9YP5f4VHLr7jW;!c=433;ytexp=900080;k21=1;kvid=nKVJ9-_9g5A;kpu=lockergnome;kr=N;kgender=m;ko=p;kpid=433;kga=1001;kar=3;klg=en;kage=23 ;kgg=1;kt=U;[1].asx not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\UVANQL6Z\main_1138;sz=480x70;mpvid=AAR9YBMZ1HMWx4An;!c=1138;k2=182;kgender=m;kvid=CR0URUyxZfQ;shortform=1;kpid=1138;kga=1001;kar= 3;kgg=1;kcr=us;khd=1;ytexp=900080;klg=en;kpu=edbass[1].asx not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\UVANQL6Z\main_1138;sz=300x250;mpvid=AAR9YBMZ1HMWx4An;!c=1138;k2=182;kgender=m;kvid=CR0URUyxZfQ;shortform=1;kpid=1138;kga=1001;kar= 3;kgg=1;kcr=us;khd=1;ytexp=900080;klg=en;kpu=edbas[1].htm not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\UVANQL6Z\main_1138;sz=300x250;mpvid=AAR9YBSqINoaBc0p;!c=1138;k2=182;kgender=m;kvid=Uk_axjZ78wU;shortform=1;kpid=1138;kga=1001;kar= 3;kgg=1;kcr=us;khd=1;ytexp=900080;klg=en;kpu=edbas[1].htm not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\UVANQL6Z\regionalcontent_centraleasterneurope;sz=300x250;k21=1;kr=F;kgender=m;kga=10 01;kar=3;klg=en;kage=23;kgg=1;kt=U;kw=skylos+viastis;kcr=us;dc_dedup=1;kmyd=ad_cr eative_1;tile=1[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\KNTFE2ZP\main_7953;sz=480x70;mpvid=AAR9YHVFc8T34IDS;!c=7953;k2=806;kgender=m;kvid=fO42M44uMls;shortform=1;kpid=7953;kga=1001;kar= 3;kgg=1;kcr=us;khd=0;ytexp=900080;klg=en;kpu=motort[1].asx not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\KNTFE2ZP\main_1961;sz=480x70;mpvid=AAR9YIy2LpPgWiV5;!c=1961;k2=806;kgender=m;kvid=mC-PQca6FJU;shortform=1;kpid=1961;kga=1001;kar=3;kgg=1;kcr=us;khd=0;ytexp=900080;kl g=en;kpu=Inside[1].asx not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\KNTFE2ZP\maindetails;tile=2;sz=728x90,1008x150,1008x200,9x1;p=t;p=top;dom=com;g=th;i d=tt0488352;tt=tv;k=p;g=dr;g=hi;k=c;coo=usa;bpx=1;s=342;s=341;s=344;s=343;s=338;s =337;s=340;s=49[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\KNTFE2ZP\attractionsactivities;sz=300x250;k21=1;kr=R;kgender=m;kga=1001;kar=3;klg=en ;kage=23;kgg=1;kt=U;kw=gamietai+i+tourkia;kcr=us;dc_dedup=1;kmyd=ad_creative_1;ti le=1;dcopt=ist;[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\KNTFE2ZP\main_9194;sz=480x70;mpvid=AAR9YOs01Aj5cqUp;!c=9194;k2=143;kgender=m;kvid=0BcAxgcuTRY;shortform=1;kpid=9194;kga=1001;kar= 3;kgg=1;kcr=us;khd=0;ytexp=900080;klg=en;kpu=Michel[1].asx not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\KNTFE2ZP\maindetails;tile=5;sz=728x90,2x1;p=b;g=th;k=m;g=ac;m=R;g=sf;tt=f;b=t250;b=t 250a;id=tt0103064;coo=fr;coo=usa;g=baa;k=c;s=342;s=341;s=344;s=343;s=338;s=337;s= 340;s=284;s=283[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\KNTFE2ZP\find;tile=4;sz=300x250,300x600,160x600,120x600,11x1;p=tr;s=342;s=341;s=344; s=343;s=338;s=337;s=340;s=284;s=283;s=333;s=334;s=335;s=336;s=32;;ord=36393661858 15696[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\KNTFE2ZP\id=1263558264&ga_hid=1875542264&ga_fc=0&u_tz=120&u_his=3&u_java=1&u_h=800&u_w=1280&u_ah=770&u_aw=1280&u_cd=32&u_nplug=0&u_nmime=0&biw=1259&bih=604&ifk=2132334226&fu=0&ifi=1&dtd=16 not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\NZDBJ90K\sid=1279872054&ga_hid=395856376&ga_fc=0&u_tz=180&u_his=9&u_java=1&u_h=800&u_w=1280&u_ah=770&u_aw=1280&u_cd=32&u_nplug=0&u_nmime=0&biw=1259&bih=631&ifk=2720262309&fu=4&ifi=1&dtd=15 not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\NZDBJ90K\;tile=4;sz=300x250,300x600,11x1;p=tr;g=th;g=ac;m=R;g=sf;tt=f;b=smgb;id=ch00 00931;coo=de;coo=usa;k=c;id=nm0000216;id=tt0181852;g=baa;coo=uk;s=342;s=341;s=344 ;s=343;s=338;s=[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\NZDBJ90K\default;sz=300x250;k21=1;kr=F;kgender=m;kga=1001;kar=3;klg=en;kage=23;kgg=1 ;kt=U;kw=Nissan+gtr;kcr=us;dc_dedup=1;kmyd=ad_creative_1;tile=1;dcopt=ist;ord=270 1649088284989[2].5 not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\NZDBJ90K\sid=1263509148&ga_hid=278793411&ga_fc=0&u_tz=120&u_his=2&u_java=1&u_h=800&u_w=1280&u_ah=770&u_aw=1280&u_cd=32&u_nplug=0&u_nmime=0&biw=1259&bih=604&ifk=1873280526&fu=0&ifi=1&dtd=31 not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\NZDBJ90K\maindetails;tile=3;sz=300x250,300x600,160x600,120x600,11x1;p=tr;g=th;g=ac;m =R;g=sf;tt=f;coo=de;coo=usa;id=tt0181852;g=baa;k=c;coo=uk;s=342;s=341;s=344;s=343 ;s=338;s=337;s=[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\NZDBJ90K\;tile=2;sz=728x90,1008x150,1008x200,9x1;p=t;g=th;g=ac;m=R;g=sf;tt=f;b=smgb; id=ch0000931;coo=de;coo=usa;k=c;id=nm0000216;id=tt0181852;g=baa;coo=uk;s=342;s=34 1;s=344;s=343;s[1] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\O5W9MN0D\main_7953;sz=300x250;mpvid=AAR9YHVFc8T34IDS;!c=7953;k2=806;kgender=m;kvid=fO42M44uMls;shortform=1;kpid=7953;kga=1001;kar= 3;kgg=1;kcr=us;khd=0;ytexp=900080;klg=en;kpu=motor[1].htm not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\O5W9MN0D\main_7953;sz=300x250;mpvid=AAR9YIJrMy8j3U9_;!c=7953;k2=806;kgender=m;kvid=xEP3ew1MPXA;shortform=1;kpid=7953;kga=1001;kar= 3;kgg=1;kcr=us;khd=0;ytexp=900080;klg=en;kpu=motor[1].htm not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\O5W9MN0D\;tile=1;sz=1x1,4x1;p=f1;ifb=pf;dom=com;g=th;id=tt0488352;tt=tv;k=p;g=dr;g=h i;k=c;coo=usa;bpx=1;s=342;s=341;s=344;s=343;s=338;s=337;s=340;s=493;s=284;s=283;s =333;s=1009;s=3[1] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\O5W9MN0D\maindetails;tile=3;sz=300x250,11x1;p=tr;dom=com;g=th;tt=tv;k=p;id=tt1292837 ;g=dr;g=hi;k=c;coo=usa;bpx=1;s=342;s=341;s=344;s=343;s=338;s=337;s=340;s=493;s=28 4;s=283;s=333;s[1] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\O5W9MN0D\id=1279872087&ga_hid=680684959&ga_fc=0&u_tz=180&u_his=11&u_java=1&u_h=800&u_w=1280&u_ah=770&u_aw=1280&u_cd=32&u_nplug=0&u_nmime=0&biw=1259&bih=631&ifk=1028601364&fu=4&ifi=1&dtd=31 not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\IJE7ITIJ\main_9194;sz=450x60;mpvid=AAR9YOs01Aj5cqUp;!c=9194;k2=143;kgender=m;kvid=0BcAxgcuTRY;shortform=1;kpid=9194;kga=1001;kar= 3;kgg=1;kcr=us;khd=0;ytexp=900080;klg=en;kpu=Michel[1].asx not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\IJE7ITIJ\main_433;sz=450x60;mpvid=AAR9YP5f4VHLr7jW;!c=433;ytexp=900080;k21=1;kvid=nKVJ9-_9g5A;kpu=lockergnome;kr=N;kgender=m;ko=p;kpid=433;kga=1001;kar=3;klg=en;kage=23 ;kgg=1;kt=U;[1].asx not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\8LGRGNSJ\newsnetworks;sz=300x250;k21=1;kr=R;kgender=m;kga=1001;kar=3;klg=en;kage=23; kgg=1;kt=U;kw=yahoo+news+butt;kcr=us;dc_dedup=1;kmyd=ad_creative_1;tile=1;dcopt=i st;ord=83326896[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\8LGRGNSJ\music_rockpop;sz=300x250;k21=1;kr=F;kgender=m;kw64=Z3JlZWNlIGV1cm92aXNpb24g MjAxMA%3D%3D;kga=1001;kar=3;klg=en;kage=23;kgg=1;kt=U;kw=greece+eurovision+2010;kcr=us;dc_ dedup=[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\8LGRGNSJ\default;sz=300x250;k21=1;kr=F;kgender=m;kga=1001;kar=3;klg=en;kage=23;kgg=1 ;kt=U;kw=gamw+tin+athina;kcr=us;dc_dedup=1;kmyd=ad_creative_1;tile=1;dcopt=ist;or d=241733483081234[2].5 not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\8LGRGNSJ\nigahiga;sz=1x1;!c=3389;k2=16;k2=154;kgender=m;kvid=cd7IR004tls;shortform=1;k4=154;kpid=3389; kga=1001;kar=3;kgg=1;kcr=us;khd=1;ytexp=900080;klg=en;kpu=nigahiga;kr=F;k21=1;[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\8LGRGNSJ\id=1279872041&ga_hid=808257832&ga_fc=0&u_tz=180&u_his=7&u_java=1&u_h=800&u_w=1280&u_ah=770&u_aw=1280&u_cd=32&u_nplug=0&u_nmime=0&biw=1259&bih=631&ifk=1881350483&fu=4&ifi=1&dtd=187 not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\8LGRGNSJ\maindetails;tile=1;sz=1x1,4x1;p=f1;ifb=pf;dom=com;g=th;id=tt0488352;tt=tv;k =p;g=dr;g=hi;k=c;coo=usa;bpx=1;s=342;s=341;s=344;s=343;s=338;s=337;s=340;s=493;s= 284;s=283;s=333[1] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\8LGRGNSJ\sid=1279872045&ga_hid=311009609&ga_fc=0&u_tz=180&u_his=8&u_java=1&u_h=800&u_w=1280&u_ah=770&u_aw=1280&u_cd=32&u_nplug=0&u_nmime=0&biw=1259&bih=631&ifk=1998601048&fu=4&ifi=1&dtd=16 not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\8LGRGNSJ\id=1279872050&ga_hid=1321564089&ga_fc=0&u_tz=180&u_his=9&u_java=1&u_h=800&u_w=1280&u_ah=770&u_aw=1280&u_cd=32&u_nplug=0&u_nmime=0&biw=1259&bih=631&ifk=1028601364&fu=4&ifi=1&dtd=32 not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\8LGRGNSJ\id=1279872070&ga_hid=369468883&ga_fc=0&u_tz=180&u_his=10&u_java=1&u_h=800&u_w=1280&u_ah=770&u_aw=1280&u_cd=32&u_nplug=0&u_nmime=0&biw=1259&bih=631&ifk=2720262309&fu=4&ifi=1&dtd=16 not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\LBRN554A\2422251_728x90[2].com%2Fdocs%2F21961910%2FWOW-schools-gold-cap-course&rfkwd=wow-schools%2Bdownload&s=g&fmt=728x90&id=2422251&fv=1&fo=json&mt=WOW%20schools%20gold%20cap%20course not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\LBRN554A\main_134;sz=450x60;mpvid=AASCndnMzQnTOJzo;!c=134;ytexp=900080;k21=1;kvid=PxOvIbZRGcs;kpu=MondoMedia;kr=N;kgender=m;ko=p ;kpid=134;kga=1001;kar=3;klg=en;kage=23;kgg=1;kt=U;u[1].asx not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\LBRN554A\main_134;sz=300x60,300x250;mpvid=AASCndnMzQnTOJzo;!c=134;ytexp=900080;k21=1;kvid=PxOvIbZRGcs;kpu=MondoMedia;kr=N;kgender=m;ko=p ;kpid=134;kga=1001;kar=3;klg=en;kage=23;kgg=[1].htm not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\LBRN554A\default;sz=300x250;k21=1;kgender=m;kga=1001;kar=3;klg=en;kage=23;time=all;k gg=1;kt=U;kcr=us;dc_dedup=1;kmyd=ad_creative_1;tile=1;dcopt=ist;ord=2538871416534 288[2].5 not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\LBRN554A\main_3389;sz=300x250;mpvid=AASCnd9jBwYDzZCo;!c=3389;k2=16;k2=154;kgender=m;kvid=cd7IR004tls;shortform=1;k4=154;kpid=3389; kga=1001;kar=3;kgg=1;kcr=us;khd=1;ytexp=900080;klg[1].htm not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\LBRN554A\id=1279872045&ga_hid=1195384339&ga_fc=0&u_tz=180&u_his=8&u_java=1&u_h=800&u_w=1280&u_ah=770&u_aw=1280&u_cd=32&u_nplug=0&u_nmime=0&biw=1259&bih=631&ifk=2720262309&fu=4&ifi=1&dtd=16 not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\LBRN554A\id=1279872067&ga_hid=1633905474&ga_fc=0&u_tz=180&u_his=9&u_java=1&u_h=800&u_w=1280&u_ah=770&u_aw=1280&u_cd=32&u_nplug=0&u_nmime=0&biw=1259&bih=631&ifk=1028601364&fu=4&ifi=1&dtd=32 not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\LBRN554A\;tile=2;sz=728x90,1008x150,1008x200,9x1;p=t;p=top;dom=com;g=th;id=tt0488352 ;tt=tv;k=p;g=dr;g=hi;k=c;coo=usa;bpx=1;s=342;s=341;s=344;s=343;s=338;s=337;s=340; s=493;s=284;s=2[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\LBRN554A\id=1263493284&ga_hid=1116877969&ga_fc=0&u_tz=120&u_his=8&u_java=1&u_h=800&u_w=1280&u_ah=770&u_aw=1280&u_cd=32&u_nplug=0&u_nmime=0&biw=1259&bih=604&ifk=2720262309&fu=0&ifi=1&dtd=16 not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\LBRN554A\maindetails;tile=2;sz=728x90,1008x150,1008x200,9x1;p=t;b=smgb;id=nm0000216; s=342;s=341;s=344;s=343;s=338;s=337;s=340;s=284;s=283;s=333;s=334;s=335;s=336;s=3 2;;ord=80333033[1] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\Q15U3UXO\default;sz=300x250;k21=1;kgender=m;kga=1001;kar=3;klg=en;kage=23;time=all;k gg=1;kt=U;kcr=us;dc_dedup=1;kmyd=ad_creative_1;tile=1;dcopt=ist;ord=6588028350100 821[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\Q15U3UXO\mostsubscribed;sz=120x90;k21=1;kgender=m;kga=1001;kar=3;klg=en;kage=23;time =all;kgg=1;kt=U;kcr=us;dc_dedup=1;kmyd=ad_creative_2;tile=2;ord=7832451221542124[ 1].htm not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\Q15U3UXO\;tile=5;sz=728x90,2x1;p=b;dom=com;g=th;id=tt0488352;tt=tv;k=p;g=dr;g=hi;k=c ;coo=usa;bpx=1;s=342;s=341;s=344;s=343;s=338;s=337;s=340;s=493;s=284;s=283;s=333; s=1009;s=334;s=[1] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\Q15U3UXO\;tile=5;sz=728x90,2x1;p=b;dom=com;g=th;id=tt0488352;tt=tv;k=p;g=dr;g=hi;k=c ;coo=usa;bpx=1;s=342;s=341;s=344;s=343;s=338;s=337;s=340;s=493;s=284;s=283;s=333; s=1009;s=334;s=[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\Q15U3UXO\id=1263558285&ga_hid=1491823345&ga_fc=0&u_tz=120&u_his=4&u_java=1&u_h=800&u_w=1280&u_ah=770&u_aw=1280&u_cd=32&u_nplug=0&u_nmime=0&biw=1259&bih=604&ifk=2720262309&fu=0&ifi=1&dtd=16 not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\Q15U3UXO\sid=1263558347&ga_hid=1676075784&ga_fc=0&u_tz=120&u_his=5&u_java=1&u_h=800&u_w=1280&u_ah=770&u_aw=1280&u_cd=32&u_nplug=0&u_nmime=0&biw=1259&bih=604&ifk=556590435&fu=0&ifi=1&dtd=31 not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\Q15U3UXO\maindetails;tile=2;sz=728x90,1008x150,1008x200,9x1;p=t;id=nm0518085;s=342;s =341;s=344;s=343;s=338;s=337;s=340;s=284;s=283;s=333;s=334;s=335;s=336;s=32;;ord= 518116330454964[1] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\Q15U3UXO\attractionsactivities;sz=300x250;k21=1;kr=R;kgender=m;kga=1001;kar=3;klg=en ;kage=23;kgg=1;kt=U;kw=gamietai+i+toyrkia;kcr=us;dc_dedup=1;kmyd=ad_creative_1;ti le=1;dcopt=ist;[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\HGC7TP49\regionalcontent_centraleasterneurope;sz=300x250;k21=1;kr=F;kgender=m;kga=10 01;kar=3;klg=en;kage=23;kgg=1;kt=U;kw=macedonia;kcr=us;dc_dedup=1;kmyd=ad_creativ e_1;tile=1;dcop[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\HGC7TP49\mostsubscribed;sz=120x90;k21=1;kgender=m;kga=1001;kar=3;klg=en;kage=23;time =all;kgg=1;kt=U;kcr=us;dc_dedup=1;kmyd=ad_creative_2;tile=2;ord=1401650183136397[ 1].htm not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\HGC7TP49\music_countryfolk;sz=300x250;k21=1;kr=F;kgender=m;kga=1001;kar=3;klg=en;kag e=23;kgg=1;kt=U;kw=Kristian+leontiou+fast+car;kcr=us;dc_dedup=1;kmyd=ad_creative_ 1;tile=1;dcopt=[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\HGC7TP49\main_134;sz=450x60;mpvid=AASCndX8PCZljGmq;!c=134;ytexp=900080;k21=1;kvid=vcSS5sHmH9o;kpu=MondoMedia;kr=A;kgender=m;ko=p ;kpid=134;kga=1001;kar=3;klg=en;kage=23;kgg=1;kt=U;u[1].asx not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\HGC7TP49\main_134;sz=480x70,480x360;mpvid=AASCndnMzQnTOJzo;!c=134;ytexp=900080;k21=1;kvid=PxOvIbZRGcs;kpu=MondoMedia;kr=N;kgender=m;ko=p ;kpid=134;kga=1001;kar=3;klg=en;kage=23;kgg=[1].asx not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\HGC7TP49\main_3389;sz=450x60;mpvid=AASCnd9jBwYDzZCo;!c=3389;k2=16;k2=154;kgender=m;kvid=cd7IR004tls;shortform=1;k4=154;kpid=3389; kga=1001;kar=3;kgg=1;kcr=us;khd=1;ytexp=900080;klg=[1].asx not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\HGC7TP49\d=1279872059&ga_hid=2125926004&ga_fc=0&u_tz=180&u_his=10&u_java=1&u_h=800&u_w=1280&u_ah=770&u_aw=1280&u_cd=32&u_nplug=0&u_nmime=0&biw=1259&bih=631&ifk=2720262309&fu=4&ifi=1&dtd=32 not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\HGC7TP49\;tile=5;sz=728x90,2x1;p=b;dom=com;g=th;id=tt0488352;tt=tv;k=p;g=dr;g=hi;k=c ;coo=usa;bpx=1;s=342;s=341;s=344;s=343;s=338;s=337;s=340;s=493;s=284;s=283;s=333; s=1009;s=334;s=[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\HGC7TP49\;tile=3;sz=300x250,300x600,160x600,120x600,11x1;p=tr;dom=com;g=th;id=tt0488 352;tt=tv;k=p;g=dr;g=hi;k=c;coo=usa;bpx=1;s=342;s=341;s=344;s=343;s=338;s=337;s=3 40;s=493;s=284;[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\HGC7TP49\maindetails;tile=2;sz=728x90,1008x150,1008x200,9x1;p=t;id=nm0001598;s=342;s =341;s=344;s=343;s=338;s=337;s=340;s=284;s=283;s=333;s=334;s=335;s=336;s=32;;ord= 650560827029333[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\0Y6MSUUZ\main_134;sz=480x70;mpvid=AASCndX8PCZljGmq;!c=134;ytexp=900080;k21=1;kvid=vcSS5sHmH9o;kpu=MondoMedia;kr=A;kgender=m;ko=p ;kpid=134;kga=1001;kar=3;klg=en;kage=23;kgg=1;kt=U;u[1].asx not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\0Y6MSUUZ\main_3389;sz=480x70;mpvid=AASCnd9jBwYDzZCo;!c=3389;k2=16;k2=154;kgender=m;kvid=cd7IR004tls;shortform=1;k4=154;kpid=3389; kga=1001;kar=3;kgg=1;kcr=us;khd=1;ytexp=900080;klg=[1].asx not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\0Y6MSUUZ\;tile=2;sz=728x90,1008x150,1008x200,9x1;p=t;p=top;dom=com;g=th;id=tt0488352 ;tt=tv;k=p;g=dr;g=hi;k=c;coo=usa;bpx=1;s=342;s=341;s=344;s=343;s=338;s=337;s=340; s=493;s=284;s=2[1] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\0Y6MSUUZ\maindetails;tile=2;sz=728x90,1008x150,1008x200,9x1;p=t;p=top;dom=com;g=th;t t=tv;k=p;id=tt1292837;g=dr;g=hi;k=c;coo=usa;bpx=1;s=342;s=341;s=344;s=343;s=338;s =337;s=340;s=49[1] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\0Y6MSUUZ\id=1263558371&ga_hid=1012979549&ga_fc=0&u_tz=120&u_his=7&u_java=1&u_h=800&u_w=1280&u_ah=770&u_aw=1280&u_cd=32&u_nplug=0&u_nmime=0&biw=1259&bih=604&ifk=2720262309&fu=0&ifi=1&dtd=15 not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\0XQ3W96Z\maindetails;tile=2;sz=728x90,1008x150,1008x200,9x1;p=t;g=th;k=m;g=ac;m=R;g= sf;tt=f;b=t250;b=t250a;id=tt0103064;coo=fr;coo=usa;g=baa;k=c;s=342;s=341;s=344;s= 343;s=338;s=337[1] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\0XQ3W96Z\;tile=1;sz=1x1,4x1;p=f1;ifb=pf;dom=com;g=th;id=tt0488352;tt=tv;k=p;g=dr;g=h i;k=c;coo=usa;bpx=1;s=342;s=341;s=344;s=343;s=338;s=337;s=340;s=493;s=284;s=283;s =333;s=1009;s=3[1] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\0XQ3W96Z\;tile=1;sz=1x1,4x1;p=f1;ifb=pf;dom=com;g=th;id=tt0488352;tt=tv;k=p;g=dr;g=h i;k=c;coo=usa;bpx=1;s=342;s=341;s=344;s=343;s=338;s=337;s=340;s=493;s=284;s=283;s =333;s=1009;s=3[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\0XQ3W96Z\maindetails;tile=2;sz=728x90,1008x150,1008x200,9x1;p=t;p=top;dom=com;g=th;i d=tt0488352;tt=tv;k=p;g=dr;g=hi;k=c;coo=usa;bpx=1;s=342;s=341;s=344;s=343;s=338;s =337;s=340;s=49[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\0XQ3W96Z\maindetails;tile=1;sz=1x1,4x1;p=f1;ifb=pf;dom=com;g=th;tt=tv;k=p;id=tt12928 37;g=dr;g=hi;k=c;coo=usa;bpx=1;s=342;s=341;s=344;s=343;s=338;s=337;s=340;s=493;s= 284;s=283;s=333[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\0XQ3W96Z\regionalcontent_centraleasterneurope;sz=300x250;k21=1;kr=F;kgender=m;kga=10 01;kar=3;klg=en;kage=23;kgg=1;kt=U;kw=macedonia+greek;kcr=us;dc_dedup=1;kmyd=ad_c reative_1;tile=1;[2].2 not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\KXURG1QB\televisions_video;subcat=flat_panel_televisions;brand=lg;product=lg_42lc2d_ 42_in_hdtv_lcd_television;ptype=thread;make=lg;channel=2849999023%2b2438490332%2b4447185069%2b47[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\KXURG1QB\maindetails;tile=5;sz=728x90,2x1;p=b;dom=com;g=th;id=tt0488352;tt=tv;k=p;g= dr;g=hi;k=c;coo=usa;bpx=1;s=342;s=341;s=344;s=343;s=338;s=337;s=340;s=493;s=284;s =283;s=333;s=10[2] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\KXURG1QB\maindetails;tile=1;sz=1x1,4x1;p=f1;ifb=pf;g=th;k=m;g=ac;m=R;g=sf;tt=f;b=t25 0;b=t250a;id=tt0103064;coo=fr;coo=usa;g=baa;k=c;s=342;s=341;s=344;s=343;s=338;s=3 37;s=340;s=284;[1] not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\KXURG1QB\maindetails;tile=3;sz=300x250,300x600,160x600,120x600,11x1;p=tr;id=nm000041 1;s=342;s=341;s=344;s=343;s=338;s=337;s=340;s=284;s=283;s=333;s=334;s=335;s=336;s =32;;ord=24364050[2].1 not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\KXURG1QB\attractionsactivities;sz=300x250;k21=1;kr=F;kgender=m;kga=1001;kar=3;klg=en ;kage=23;kgg=1;kt=U;kw=gamietai+i+thessaloniki;kcr=us;dc_dedup=1;kmyd=ad_creative _1;tile=1;dcopt=i[2].5 not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\C1AVGTUZ\main_134;sz=300x250;mpvid=AASCndX8PCZljGmq;!c=134;ytexp=900080;k21=1;kvid=vcSS5sHmH9o;kpu=MondoMedia;kr=A;kgender=m;ko=p ;kpid=134;kga=1001;kar=3;klg=en;kage=23;kgg=1;kt=U;[1].htm not found! File\Folder C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Internet Files\Content.IE5\C1AVGTUZ\education_lessonplansteachingresources;sz=300x250;k21=1;kr=F;kgender=m;kga= 1001;kar=3;klg=en;kage=23;kgg=1;kt=U;kw=k+gourouni;kcr=us;dc_dedup=1;kmyd=ad_crea tive_1;tile=1;d[2] not found! C:\Documents and Settings\Thomas\Local Settings\Temporary Internet files\Content.IE5\SFSVMNSH\index[1].php moved successfully. C:\Documents and Settings\Thomas\Local Settings\Temporary Internet files\Content.IE5\SFSVMNSH\like[2].php moved successfully. Registry entries deleted on Reboot… ComboFix 10-07-23.01 - Thomas 07/24/2010 2:12.1.2 - FAT32x86 Microsoft Windows XP Home Edition 5.1.2600.3.1253.30.1032.18.2046.1486 [GMT 3:00] Running from: c:\documents and settings\[removed]\Επιφάνεια εργασίας\ComboFix.exe AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} . The following files were disabled during the run: c:\program files\Common Files\Logitech\LVMVFM\LVPrcInj.dll ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\WinPCap c:\program files\WinPCap\daemon_mgm.exe c:\program files\WinPCap\npf_mgm.exe c:\program files\WinPCap\rpcapd.exe c:\windows\system32\_000011_.tmp.dll c:\windows\system32\drivers\npf.sys c:\windows\system32\Packet.dll c:\windows\system32\pthreadVC.dll c:\windows\system32\WanPacket.dll c:\windows\system32\wpcap.dll Infected copy of c:\windows\system32\userinit.exe was found and disinfected Restored copy from - c:\windows\ServicePackFiles\i386\userinit.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . ——-\Legacy_NPF ——-\Service_NPF ((((((((((((((((((((((((( Files Created from 2010-06-23 to 2010-07-23 ))))))))))))))))))))))))))))))) . 2010-07-23 22:00 . 2010-07-23 22:00 ——– d—–w- C:\_OTL 2010-07-23 17:48 . 2010-07-23 17:48 63488 —-a-w- c:\documents and settings\Thomas\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll 2010-07-23 17:48 . 2010-07-23 17:48 52224 —-a-w- c:\documents and settings\Thomas\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll 2010-07-23 17:48 . 2010-07-23 17:48 117760 —-a-w- c:\documents and settings\Thomas\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL 2010-07-23 17:47 . 2010-07-23 17:47 ——– d—–w- c:\documents and settings\Thomas\Application Data\SUPERAntiSpyware.com 2010-07-23 17:47 . 2010-07-23 17:47 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2010-07-23 17:47 . 2010-07-23 17:47 ——– d—–w- c:\program files\SUPERAntiSpyware 2010-07-18 12:05 . 2010-06-14 14:31 744448 ——w- c:\windows\system32\dllcache\helpsvc.exe 2010-07-08 16:54 . 2008-04-14 16:29 21504 —-a-w- c:\windows\system32\hidserv.dll 2010-07-08 16:54 . 2008-04-14 16:29 21504 —-a-w- c:\windows\system32\dllcache\hidserv.dll 2010-07-08 16:54 . 2004-09-07 17:00 14976 —-a-w- c:\windows\system32\drivers\kbdhid.sys 2010-07-08 16:54 . 2004-09-07 17:00 14976 —-a-w- c:\windows\system32\dllcache\kbdhid.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-07-23 23:20 . 2006-08-31 00:54 12 —-a-w- c:\windows\bthservsdp.dat 2010-07-22 07:56 . 2006-08-31 00:39 97396 —-a-w- c:\windows\system32\perfc008.dat 2010-07-22 07:56 . 2006-08-31 00:39 554434 —-a-w- c:\windows\system32\perfh008.dat 2010-06-20 09:09 . 2010-06-20 09:09 ——– d—–w- c:\documents and settings\All Users\Application Data\Raxco 2010-06-20 09:08 . 2010-06-20 09:08 ——– d—–w- c:\program files\Raxco 2010-06-14 14:31 . 2004-09-07 17:00 744448 —-a-w- c:\windows\pchealth\helpctr\binaries\HelpSvc.exe 2010-05-23 12:19 . 2010-05-23 12:19 61440 —-a-w- c:\documents and settings\Thomas\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-11bd4f09-n\decora-sse.dll 2010-05-23 12:19 . 2010-05-23 12:19 503808 —-a-w- c:\documents and settings\Thomas\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-30e6fb21-n\msvcp71.dll 2010-05-23 12:19 . 2010-05-23 12:19 499712 —-a-w- c:\documents and settings\Thomas\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-30e6fb21-n\jmc.dll 2010-05-23 12:19 . 2010-05-23 12:19 348160 —-a-w- c:\documents and settings\Thomas\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-30e6fb21-n\msvcr71.dll 2010-05-23 12:19 . 2010-05-23 12:19 12800 —-a-w- c:\documents and settings\Thomas\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-11bd4f09-n\decora-d3d.dll 2010-05-02 08:07 . 2004-09-07 18:00 1851520 —-a-w- c:\windows\system32\win32k.sys 2010-04-29 12:39 . 2009-08-18 19:41 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-04-29 12:39 . 2009-08-18 19:41 20952 —-a-w- c:\windows\system32\drivers\mbam.sys 2008-03-31 10:32 . 2007-12-26 15:50 67696 —-a-w- c:\program files\mozilla firefox\components\jar50.dll 2008-03-31 10:32 . 2007-12-26 15:50 54376 —-a-w- c:\program files\mozilla firefox\components\jsd3250.dll 2008-03-31 10:32 . 2007-12-26 15:50 34952 —-a-w- c:\program files\mozilla firefox\components\myspell.dll 2008-03-31 10:32 . 2007-12-26 15:50 46720 —-a-w- c:\program files\mozilla firefox\components\spellchk.dll 2008-03-31 10:32 . 2007-12-26 15:50 172144 —-a-w- c:\program files\mozilla firefox\components\xpinstal.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LaunchApp"="Alaunch" [X] "igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784] "BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592] "RTHDCPL"="RTHDCPL.EXE" [2006-06-28 16248320] "SkyTel"="SkyTel.EXE" [2006-05-16 2879488] "AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-12-21 53248] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 761946] "ADMTray.exe"="c:\acer\Empowering Technology\admtray.exe" [2005-10-24 2462208] "eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2005-12-27 69632] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-09-07 208952] "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-09-07 59392] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-09-07 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-09-07 455168] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-20 7581696] "nwiz"="nwiz.exe" [2006-07-21 1519616] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-07-21 86016] "PCMService"="c:\program files\Acer\Acer Arcade\PCMService.exe" [2006-08-09 151552] "ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-08-10 352256] "Acer ePower Management"="c:\acer\Empowering Technology\ePower\Acer ePower Management.exe" [2006-05-22 3080704] "LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2006-07-20 593920] "eRecoveryService"="c:\acer\Empowering Technology\eRecovery\Monitor.exe" [2006-01-24 397312] "LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2006-06-23 225280] "WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-09-23 61440] "LogitechCameraAssistant"="c:\program files\Acer\OrbiCam\CameraAssistant.exe" [2006-06-26 331776] "LogitechVideo[inspector]"="c:\program files\Acer\OrbiCam\InstallHelper.exe" [2006-06-26 12:55 73728] "LogitechCameraService(E)"="c:\windows\system32\ElkCtrl.exe" [2004-11-01 262144] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-03-19 2029640] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2009-09-03 22:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ PDBoot.exe\0autocheck autochk *\0lsdelete [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Προγράμματα^Εκκίνηση^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Προγράμματα\Εκκίνηση\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Προγράμματα^Εκκίνηση^PCSuiteForNokia6600 Detect.lnk] path=c:\documents and settings\All Users\Start Menu\Προγράμματα\Εκκίνηση\PCSuiteForNokia6600 Detect.lnk backup=c:\windows\pss\PCSuiteForNokia6600 Detect.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Προγράμματα^Εκκίνηση^PCSuiteForNokia6600 TS.lnk] path=c:\documents and settings\All Users\Start Menu\Προγράμματα\Εκκίνηση\PCSuiteForNokia6600 TS.lnk backup=c:\windows\pss\PCSuiteForNokia6600 TS.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Προγράμματα^Εκκίνηση^TB-Tray.lnk] path=c:\documents and settings\All Users\Start Menu\Προγράμματα\Εκκίνηση\TB-Tray.lnk backup=c:\windows\pss\TB-Tray.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Προγράμματα^Εκκίνηση^Update Agent.lnk] path=c:\documents and settings\All Users\Start Menu\Προγράμματα\Εκκίνηση\Update Agent.lnk backup=c:\windows\pss\Update Agent.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Thomas^Start Menu^Προγράμματα^Εκκίνηση^K-Meleon Loader.lnk] path=c:\documents and settings\Thomas\Start Menu\Προγράμματα\Εκκίνηση\K-Meleon Loader.lnk backup=c:\windows\pss\K-Meleon Loader.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] 2007-09-20 12:35 202024 —-a-w- c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] 2008-01-17 15:51 486856 —-a-w- c:\program files\DAEMON Tools Lite\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] 2007-09-20 07:35 1077032 —-a-w- c:\program files\Nero\Nero8\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan] 2007-09-20 06:51 1836328 —-a-w- c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2007-03-01 12:57 153136 —-a-w- c:\program files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ntiMUI] 2006-05-15 08:15 45056 —-a-w- c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic] 2008-07-08 14:41 2828184 —-a-w- c:\program files\Registry Mechanic\RegMech.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc] 2007-09-20 07:36 2044712 —-a-w- c:\program files\Nero\Nero8\InCD\NBHGui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SeePassword] 2005-06-25 15:18 1347584 —-a-w- c:\program files\SeePassword\SeePassword.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] 2008-03-27 22:06 1271032 —-a-w- c:\program files\Steam\Steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] 2006-03-30 13:45 313472 —-a-r- c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Acer\\Acer Arcade\\PCMService.exe"= "d:\\Games\\Microsoft Games\\Age of Empires II\\Age2_X1\\age2_x1.Exe"= "c:\\WINDOWS\\System32\\dplaysvr.exe"= "c:\\wamp\\Apache2\\bin\\httpd.exe"= "c:\\Program Files\\Intuwave\\Shared\\mRouterRunTime\\mRouterRuntime.exe"= "d:\\Games\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"= "d:\\Games\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"= "c:\\WINDOWS\\System32\\PnkBstrA.exe"= "c:\\WINDOWS\\System32\\PnkBstrB.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Steam\\steamapps\\nws\\counter-strike\\hl.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "d:\\Games\\World of Warcraft\\Repair.exe"= "c:\\Program Files\\CyEngine\\Pokemon Online\\CyClient.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\Steam\\steamapps\\nws\\condition zero deleted scenes\\hl.exe"= "c:\\Program Files\\Steam\\steamapps\\nws\\condition zero\\hl.exe"= "c:\\Program Files\\SmartFTP Client\\SmartFTP_backup.exe"= "d:\\Games\\World of Warcraft\\BackgroundDownloader.exe"= "c:\\Documents and Settings\\Thomas\\Επιφάνεια εργασίας\\Pokemon_World_Online_9021\\Pokemon Game.exe"= "c:\\Program Files\\mIRC\\mirc.exe"= "c:\\Program Files\\Java\\jre6\\bin\\java.exe"= "d:\\Games\\World of Warcraft\\Launcher.exe"= "c:\\Program Files\\SmartFTP Client\\SmartFTP.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Opera\\Opera.exe"= "c:\\Program Files\\Java\\JRE6\\BIN\\javaw.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [3/19/2009 11:44 AM 107256] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [12/21/2007 8:21 AM 93848] R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 9:25 PM 12872] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 9:41 PM 67656] R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [3/19/2009 11:44 AM 731840] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [3/23/2008 1:19 AM 24652] R3 lv321av;Logitech USB PC Camera (VC0321);c:\windows\system32\drivers\lv321av.sys [6/19/2006 12:20 PM 1097728] S0 ihevwz;ihevwz; [x] S3 EverestDriver;Lavalys EVEREST Kernel Driver;\??\c:\documents and settings\Thomas\Επιφάνεια εργασίας\EverestUltimate4\kerneld.wnt –> c:\documents and settings\Thomas\Επιφάνεια εργασίας\EverestUltimate4\kerneld.wnt [?] S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [4/27/2009 2:00 PM 9728] S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [6/1/2009 11:05 PM 356920] S3 wip0204;Wippien Network Adapter 2.4;c:\windows\system32\drivers\wip0204.sys [8/14/2008 3:16 PM 23480] S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [1/14/2008 12:43 AM 716272] . . ——- Supplementary Scan ——- . uStart Page = hxxp://el.intl.acer.yahoo.com/ mStart Page = hxxp://el.intl.acer.yahoo.com uSearchURL,(Default) = hxxp://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com IE: Send to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm FF - ProfilePath - c:\documents and settings\Thomas\Application Data\Mozilla\Firefox\Profiles\7aahy7j2.default\ FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll FF - component: c:\program files\Mozilla Firefox\extensions\[removed]\components\qfaservices.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ . - - - - ORPHANS REMOVED - - - - AddRemove-Age of Empires II: The Conquerors Expansion 1.0 - d:\games\Microsoft Games\Age of Empires II\UNINSTALX.EXE ************************************************************************** scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet004\Services\EverestDriver] "ImagePath"="\??\c:\documents and settings\Thomas\?p?f??e?a e??as?a?\EverestUltimate4\kerneld.wnt" . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_USERS\S-1-5-21-393435228-1875524237-890505537-1006\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:41,d6,45,8a,23,fe,8c,8f,25,ae,c4,4f,9b,30,61,d8,23,05,9d,7b,9c,37,d0, e4,c1,b1,46,7b,9f,c0,45,ce,33,93,06,e8,fc,8c,ce,09,9c,77,c6,b9,05,c3,65,71,\ "??"=hex:49,d2,4a,db,a9,68,a1,c6,59,44,8a,d8,01,00,83,a5 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" [HKEY_LOCAL_MACHINE\software\ESET\ESET Security\CurrentVersion\Info] @Denied: (2) (LocalSystem) "AppDataDir"="c:\\Documents and Settings\\All Users\\Application Data\\ESET\\ESET NOD32 Antivirus\\" "DataDir"="ESET\\ESET NOD32 Antivirus\\" "EditionName"="TemDono FiX 1.1 (Free Updates - Expire in 2050)" "InstallDir"="c:\\Program Files\\ESET\\ESET NOD32 Antivirus\\" "LanguageId"=dword:00000409 "PackageTag"=dword:6090e758 "ProductBase"=dword:00000000 "ProductCode"="{FE9C13F6-6BBD-47D3-B939-F7E061BC4930}" "ProductName"="ESET NOD32 Antivirus" "ProductType"="eav" "ProductVersion"="4.0.417.0" "UniqueId"="004D13044A12D917" "ScannerBuild"=dword:0000121d "ScannerVersionId"=dword:00000f6c "ScannerVersion"="Open window for status." "FixId"=dword:00000006 . ——————— DLLs Loaded Under Running Processes ——————— - - - - - - - > 'winlogon.exe'(536) c:\program files\SUPERAntiSpyware\SASWINLO.DLL - - - - - - - > 'explorer.exe'(7996) c:\program files\Common Files\Logitech\LVMVFM\LVPrcInj.dll c:\windows\system32\MSNChatHook.dll c:\windows\system32\sysenv.dll c:\windows\system32\MSVCR71.dll c:\program files\SmartFTP Client\en-US\sfShellTools.dll.mui c:\acer\Empowering Technology\ePower\SysHook.dll . ———————— Other Running Processes ———————— . c:\program files\Intel\Wireless\Bin\EvtEng.exe c:\program files\Intel\Wireless\Bin\S24EvMon.exe c:\program files\Lavasoft\Ad-Aware\aawservice.exe c:\windows\system32\rundll32.exe c:\windows\RTHDCPL.EXE c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe c:\acer\Empowering Technology\admServ.exe c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe c:\program files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe c:\program files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe c:\program files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe c:\program files\Nero\Nero8\InCD\InCDsrv.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe c:\windows\system32\nvsvc32.exe c:\program files\Raxco\PerfectDisk\PDAgent.exe c:\windows\system32\PnkBstrA.exe c:\windows\system32\PnkBstrB.exe c:\program files\Intel\Wireless\Bin\RegSrvc.exe c:\program files\CyberLink\Shared Files\RichVideo.exe c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe c:\windows\system32\wdfmgr.exe c:\program files\Acer\Acer Arcade\Kernel\TV\CLSched.exe c:\program files\Raxco\PerfectDisk\PDEngine.exe c:\windows\system32\wbem\unsecapp.exe c:\windows\system32\wbem\wmiapsrv.exe c:\docume~1\Thomas\LOCALS~1\Temp\RtkBtMnt.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Completion time: 2010-07-24 02:27:50 - machine was rebooted ComboFix-quarantined-files.txt 2010-07-23 23:27 Pre-Run: 5,697,896,448 διαθέσιμα byte Post-Run: 5,552,963,584 διαθέσιμα byte WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect Current=4 Default=4 Failed=2 LastKnownGood=5 Sets=1,2,3,4,5 - - End Of File - - DDD2F6101D489FDD00FD952DA93654BB Thank you!

SweetTech

Post #13July 24, 2010, 12:01 AM UTC

Hello,

I see that you have ESET NOD32 instaled on your computer. NOD32, is a great program to use, but it appears that the version you are currently using on this P.C. is an illegal pirated version.

Before we continue, I must insist that you remove the following programs:

Remove Program

We need to remove a program. To do this please do the following:

Click Start
Go to Control Panel
Go to Add/Remove Programs
Find and click Remove for the following (if present):
NOD32 v3.x FiX 1.1 by TemDono (Free Updates - Expire in 2050)
NOD32 v3.x FiX 1.1 by TemDono_is1
ESET NOD32 Antivirus

NEXT:

Please download and run the ESET Uninstaller tool.

Link: Eset Uninstaller

After downloading the tool to your desktop, run it and restart your computer after running it.

NEXT:

Please download Rooter.exe and save to your desktop.
alternate download link

Double-click on Rooter.exe to start the tool. If using Vista, right-click and Run as Administrator…
Click the Scan button to begin.
Once the scan is complete, Notepad will open with a report named Rooter_#.txt (where # is the number assigned to the report).
A folder will be created at the %systemdrive% (usually, C:\Rooter$) where the log will be saved.
Rooter will automatically close. If it doesn't, just press the Close button.
Copy and paste the contents of Rooter_#.txt in your next reply.

Important: Before performing a scan it is recommended to do the following to ensure more accurate results and avoid common issues that may cause false detections.

Disconnect from the Internet or physically unplug you Internet cable connection.
Clean out your temporary files.
Close all open programs, scheduling/updating tasks and background processes that might activate during the scan including the screensaver.
Temporarily disable your anti-virus and real-time anti-spyware protection.
After starting the scan, do not use the computer until the scan has completed.
When finished, re-enable your anti-virus/anti-malware (or reboot) and then you can reconnect to the Internet.

jsmith

Post #14July 24, 2010, 12:16 AM UTC

Hello again, Thank you for the suggestion but I am not willing to remove NOD for any reason.. Here is the log: Rooter.exe (v1.0.2) by Eric_71 . SeDebugPrivilege granted successfully … . Windows XP Home Edition (5.1.2600) Service Pack 3 [32_bits] - x86 Family 6 Model 15 Stepping 6, GenuineIntel . [wscsvc] (Security Center) RUNNING (state:4) [SharedAccess] RUNNING (state:4) Windows Firewall -> Enabled . Internet Explorer 6.0.2900.5512 . C:\ [Fixed-FAT32] .. ( Total:71 Go - Free:5 Go ) D:\ [Fixed-NTFS] .. ( Total:0 Go - Free:0 Go ) E:\ [CD_Rom] . Scan : 03:11.07 Path : C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\Rooter.exe User : Thomas ( Administrator -> YES ) . ———————-\\ Processes . Locked [System Process] (0) ______ System (4) ______ \SystemRoot\System32\smss.exe (436) ______ \??\C:\WINDOWS\system32\csrss.exe (504) ______ \??\C:\WINDOWS\system32\winlogon.exe (536) ______ C:\WINDOWS\system32\services.exe (580) ______ C:\WINDOWS\system32\lsass.exe (592) ______ C:\WINDOWS\system32\svchost.exe (756) ______ C:\WINDOWS\system32\svchost.exe (824) ______ C:\WINDOWS\System32\svchost.exe (864) ______ C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (920) ______ C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (956) ______ C:\WINDOWS\system32\svchost.exe (996) ______ C:\WINDOWS\system32\svchost.exe (1052) ______ C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (1136) ______ C:\WINDOWS\system32\rundll32.exe (644) ______ C:\WINDOWS\RTHDCPL.EXE (1016) ______ C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (1616) ______ C:\Acer\Empowering Technology\admtray.exe (1724) ______ C:\Acer\Empowering Technology\eRecovery\Monitor.exe (1696) ______ C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe (1784) ______ C:\Program Files\Acer\Acer Arcade\PCMService.exe (176) ______ C:\Acer\Empowering Technology\ePower\ePower_DMC.exe (272) ______ C:\PROGRA~1\LAUNCH~1\LManager.exe (388) ______ C:\WINDOWS\system32\LVCOMSX.EXE (724) ______ C:\Program Files\Acer\OrbiCam\CameraAssistant.exe (1440) ______ C:\WINDOWS\system32\ElkCtrl.exe (1548) ______ C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (1560) ______ C:\Program Files\Common Files\Java\Java Update\jusched.exe (1700) ______ C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (1832) ______ C:\WINDOWS\system32\spoolsv.exe (1936) ______ c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe (1988) ______ C:\WINDOWS\system32\svchost.exe (1176) ______ C:\Acer\Empowering Technology\admServ.exe (192) ______ C:\WINDOWS\system32\svchost.exe (464) ______ c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe (1448) ______ C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe (1024) ______ C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe (304) ______ C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (1416) ______ C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe (1436) ______ C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe (728) ______ C:\Program Files\Java\jre6\bin\jqs.exe (1552) ______ C:\Program Files\Common Files\LightScribe\LSSrvc.exe (1680) ______ C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (916) ______ C:\WINDOWS\system32\nvsvc32.exe (1596) ______ C:\Program Files\Raxco\PerfectDisk\PDAgent.exe (2092) ______ C:\WINDOWS\system32\PnkBstrA.exe (2104) ______ C:\WINDOWS\system32\PnkBstrB.exe (2148) ______ C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (2240) ______ C:\Program Files\CyberLink\Shared Files\RichVideo.exe (2264) ______ C:\WINDOWS\system32\svchost.exe (2312) ______ C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (2328) ______ C:\WINDOWS\system32\wdfmgr.exe (2376) ______ C:\Program Files\Viewpoint\Common\ViewpointService.exe (2396) ______ C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe (2440) ______ C:\WINDOWS\system32\wbem\wmiprvse.exe (2848) ______ C:\Program Files\Raxco\PerfectDisk\PDEngine.exe (3040) ______ C:\WINDOWS\system32\wbem\wmiprvse.exe (3304) ______ C:\WINDOWS\system32\wbem\unsecapp.exe (3456) ______ C:\WINDOWS\System32\alg.exe (3524) ______ C:\WINDOWS\system32\wbem\wmiapsrv.exe (3652) ______ C:\DOCUME~1\Thomas\LOCALS~1\Temp\RtkBtMnt.exe (3848) ______ C:\WINDOWS\explorer.exe (7996) ______ C:\Program Files\Internet Explorer\iexplore.exe (7964) ______ C:\Program Files\Raxco\PerfectDisk\PDAgentS1.exe (1492) ______ C:\WINDOWS\system32\DllHost.exe (6160) ______ C:\Documents and Settings\Thomas\Επιφάνεια εργασίας\Rooter.exe (1132) ______ C:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe (7676) . ———————-\\ Device\Harddisk0\ . \Device\Harddisk0 [Sectors : 63 x 512 Bytes] . \Device\Harddisk0\Partition1 (Start_Offset:32256 | Length:5239471104) \Device\Harddisk0\Partition2 –[ MBR ]– (Start_Offset:5239503360 | Length:77136675840) \Device\Harddisk0\Partition3 (Start_Offset:82376179200 | Length:77663093760) . ———————-\\ Scheduled Tasks . C:\WINDOWS\Tasks\desktop.ini C:\WINDOWS\Tasks\SA.DAT . ———————-\\ Registry . . ———————-\\ Files & Folders . ———————-\\ Scan completed at 03:11.10 . C:\Rooter$\Rooter_1.txt - (24/07/2010 | 03:11.11) Thank you!

SweetTech

Post #15July 24, 2010, 12:28 AM UTC last edited July 24, 2010, 12:30 AM UTC

Hello,

In that case, I'm afraid that I can no longer be of assistance to you any further.

We do not support the use of illegal Pirated/Warez/Cracked software.

Helping a person who insists on using such software, could be construed in the eyes of the law to be aiding and abetting a crime. Therefore you will be asked to remove any cracked programs and in the case of your operating system, to obtain a valid licensed copy.

You will be asked to remove any such software before receiving any help.

Source: http://forums.whatthetech.com/index.php?showtopic=92526

I wish you the best of luck, in getting your computer cleaned up.

======

In accordance with this forums Terms of Use policy, and the policy linked to above, this thread will now be closed.

If you wish to discuss this decision further then please send a PM to an Administrator.

======

Thread Closed.

Cheers,
SweetTech.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Spyware/Malware Problem..

✨ Ask AI

Ask AI