samjones
Topic Starter
My Dad gave me his dell laptop today to try and help as it's full of viruses and trojens, it keeps bring up a anti virus software saying to click to get rid. I have managed to download malwarebytes and do a full run which seemed to clear out quite alot, but the trouble still seems to be there.
here are the files requested:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:41:50, on 27/07/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18470)
Boot mode: Safe mode with network support
Running processes:
C:\Windows\Explorer.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Java\jre6\bin\jp2launcher.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Users\tom\Desktop\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://inboxtoolbar.com/search/dispatcher….d&%language
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://inboxtoolbar.com/search/ie.aspx?tbid=80150
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://inboxtoolbar.com/help/sa_customize.aspx?tbid=80150
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://inboxtoolbar.com/search/ie.aspx?tbid=80150
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://inboxtoolbar.com/help/sa_customize.aspx?tbid=80150
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.search.yahoo.com/search?fr=mcafee&p=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\PROGRA~1\INBOXT~1\Inbox.dll
R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O2 - BHO: (no name) - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\PROGRA~1\INBOXT~1\Inbox.dll
O2 - BHO: (no name) - {DB35C569-5624-4CFC-8043-E5139F55A073} - C:\PROGRA~1\Crawler\Shared\CShared.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: &Inbox Toolbar - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\PROGRA~1\INBOXT~1\Inbox.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [BTHelena_McciTrayApp] C:\Program Files\BBDesktopHelpUpgradeAdvisor\McciTrayApp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [CSmileys] "C:\Program Files\Crawler\Smileys\CSmileysIM.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\tom\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [CSmileys] "C:\Program Files\Crawler\Smileys\CSmileysIM.exe"
O4 - HKCU\..\Run: [{233F3715-8B38-CA66-A4CA-35E43239075A}] C:\Users\tom\AppData\Roaming\Inza\yxiqu.exe
O4 - HKCU\..\Run: [QNB2EB90WX] C:\Users\tom\AppData\Local\Temp\Szp.exe
O4 - HKCU\..\Run: [59bd25aa-ce9e-4677-ac13-c9c29895f59a_42] rundll32.exe "C:\Users\tom\AppData\Roaming\59bd25aa-ce9e-4677-ac13-c9c29895f59a_42.avi", start
O4 - HKCU\..\RunOnce: [755456660] "C:\Users\tom\AppData\Local\755456660.exe" 0 34
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Adobe Media Player.lnk = C:\Program Files\Adobe Media Player\Adobe Media Player.exe
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: QuickSet.lnk = ?
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: inbox - {37540F19-DD4C-478B-B2DF-C19281BCAF27} - C:\PROGRA~1\INBOXT~1\Inbox.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Filter: x-sdch - (no CLSID) - (no file)
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate1ca0dff3e0136e8) (gupdate1ca0dff3e0136e8) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
–
End of file - 10982 bytes
OTL logfile created on: 27/07/2010 21:42:45 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\tom\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy
2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 59.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 78.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 136.43 Gb Total Space | 108.18 Gb Free Space | 79.29% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.84 Gb Free Space | 58.39% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: TOM-PC
Current User Name: tom
Logged in as Administrator.
Current Boot Mode: SafeMode with Networking
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
========== Processes (SafeList) ==========
PRC - [2010/07/27 21:36:37 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\tom\Desktop\OTL.exe
PRC - [2010/07/27 16:31:04 | 000,139,264 | —- | M] (Kaspersky Lab.) – C:\Users\tom\AppData\Local\Temp\jkos-tom\binaries\ScanningProcess.exe
PRC - [2010/06/10 06:58:32 | 000,865,832 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee\MSC\mcmscsvc.exe
PRC - [2010/04/12 17:29:28 | 000,023,328 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Java\jre6\bin\jp2launcher.exe
PRC - [2010/04/12 17:29:25 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Java\jre6\bin\java.exe
PRC - [2009/10/29 07:54:44 | 001,218,008 | —- | M] (McAfee, Inc.) – c:\Program Files\McAfee.com\Agent\mcagent.exe
PRC - [2009/10/27 12:19:46 | 000,895,696 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee\MPF\MpfSrv.exe
PRC - [2008/10/29 07:29:41 | 002,927,104 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
========== Modules (SafeList) ==========
MOD - [2010/07/27 21:36:37 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\tom\Desktop\OTL.exe
MOD - [2008/01/19 08:33:00 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msscript.ocx
MOD - [2008/01/19 08:26:34 | 001,684,480 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll
========== Win32 Services (SafeList) ==========
SRV - [2010/07/20 16:45:01 | 000,030,192 | —- | M] (Google) [On_Demand | Stopped] – C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe – (GoogleDesktopManager-051210-111108)
SRV - [2010/06/10 06:58:32 | 000,865,832 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\McAfee\MSC\mcmscsvc.exe – (mcmscsvc)
SRV - [2010/03/26 11:16:04 | 000,093,320 | —- | M] (McAfee, Inc.) [Auto | Stopped] – C:\Program Files\McAfee\SiteAdvisor\McSACore.exe – (McAfee SiteAdvisor Service)
SRV - [2010/03/18 13:16:28 | 000,753,504 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe – (WPFFontCache_v0400)
SRV - [2010/03/18 13:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2009/10/27 12:19:46 | 000,895,696 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\McAfee\MPF\MPFSrv.exe – (MpfService)
SRV - [2009/09/16 11:23:32 | 000,365,072 | —- | M] (McAfee, Inc.) [On_Demand | Stopped] – C:\Program Files\McAfee\VirusScan\mcods.exe – (McODS)
SRV - [2009/09/16 10:22:08 | 000,144,704 | —- | M] (McAfee, Inc.) [Unknown | Stopped] – C:\Program Files\McAfee\VirusScan\Mcshield.exe – (McShield)
SRV - [2009/09/16 09:28:38 | 000,606,736 | —- | M] (McAfee, Inc.) [On_Demand | Stopped] – C:\Program Files\McAfee\VirusScan\mcsysmon.exe – (McSysmon)
SRV - [2009/07/08 14:48:48 | 000,026,640 | —- | M] (McAfee, Inc.) [Auto | Stopped] – C:\Program Files\McAfee\MSK\MskSrver.exe – (MSK80Service)
SRV - [2009/07/08 11:54:34 | 000,359,952 | —- | M] (McAfee, Inc.) [Auto | Stopped] – c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe – (McProxy)
SRV - [2009/07/07 19:10:02 | 002,482,848 | —- | M] (McAfee, Inc.) [Auto | Stopped] – c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe – (McNASvc)
SRV - [2008/01/19 08:38:24 | 000,272,952 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2007/09/07 19:25:12 | 000,102,400 | —- | M] (IDT, Inc.) [Auto | Stopped] – C:\Windows\System32\stacsv.exe – (STacSV)
SRV - [2007/08/29 22:25:16 | 000,073,728 | —- | M] (Andrea Electronics Corporation) [Auto | Stopped] – C:\Windows\System32\AEstSrv.exe – (AESTFilters)
SRV - [2007/05/31 10:21:24 | 000,379,784 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\WindowsMobile\wcescomm.dll – (WcesComm)
SRV - [2007/05/31 10:21:18 | 000,183,688 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\WindowsMobile\rapimgr.dll – (RapiMgr)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\System32\DRIVERS\nwlnkfwd.sys – (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\System32\DRIVERS\nwlnkflt.sys – (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\System32\DRIVERS\ipinip.sys – (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] – C:\Windows\System32\drivers\blbdrive.sys – (blbdrive)
DRV - [2010/07/15 15:18:22 | 000,130,424 | —- | M] (McAfee, Inc.) [Kernel | System | Running] – C:\Windows\System32\drivers\Mpfp.sys – (MPFP)
DRV - [2009/09/16 10:22:48 | 000,214,664 | —- | M] (McAfee, Inc.) [Kernel | System | Stopped] – C:\Windows\System32\drivers\mfehidk.sys – (mfehidk)
DRV - [2009/09/16 10:22:48 | 000,079,816 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mfeavfk.sys – (mfeavfk)
DRV - [2009/09/16 10:22:48 | 000,040,552 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mfesmfk.sys – (mfesmfk)
DRV - [2009/09/16 10:22:48 | 000,035,272 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mfebopk.sys – (mfebopk)
DRV - [2009/09/16 10:22:14 | 000,034,248 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mferkdk.sys – (mferkdk)
DRV - [2008/02/02 23:43:17 | 000,020,152 | —- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\viaide.sys – (viaide)
DRV - [2008/02/02 23:43:17 | 000,019,128 | —- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\cmdide.sys – (cmdide)
DRV - [2008/02/02 23:43:17 | 000,017,592 | —- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\aliide.sys – (aliide)
DRV - [2007/09/26 11:47:24 | 001,899,008 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\igdkmd32.sys – (igfx)
DRV - [2007/09/24 10:27:26 | 000,155,136 | —- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\Apfiltr.sys – (ApfiltrService)
DRV - [2007/09/07 19:26:04 | 000,330,240 | —- | M] (IDT, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\stwrt.sys – (STHDA)
DRV - [2007/03/21 20:33:54 | 000,534,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\BCMWL6.SYS – (BCM43XX)
DRV - [2007/02/12 22:36:54 | 000,277,784 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\Windows\system32\drivers\iastor.sys – (iaStor)
DRV - [2006/11/27 08:48:46 | 000,037,376 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rixdptsk.sys – (rismxdp)
DRV - [2006/11/27 08:48:44 | 000,043,520 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rimsptsk.sys – (rimsptsk)
DRV - [2006/11/27 08:48:44 | 000,032,256 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rimmptsk.sys – (rimmptsk)
DRV - [2006/11/21 13:25:44 | 000,045,568 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\bcm4sbxp.sys – (bcm4sbxp)
DRV - [2006/11/03 03:43:30 | 000,986,624 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\HSX_DPV.sys – (HSF_DPV)
DRV - [2006/11/03 03:42:18 | 000,206,848 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\HSXHWAZL.sys – (HSXHWAZL)
DRV - [2006/11/03 03:42:08 | 000,659,968 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\HSX_CNXT.sys – (winachsf)
DRV - [2006/11/02 10:51:45 | 000,900,712 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ql2300.sys – (ql2300)
DRV - [2006/11/02 10:51:38 | 000,420,968 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adp94xx.sys – (adp94xx)
DRV - [2006/11/02 10:51:34 | 000,316,520 | —- | M] (Emulex) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\elxstor.sys – (elxstor)
DRV - [2006/11/02 10:51:32 | 000,297,576 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpahci.sys – (adpahci)
DRV - [2006/11/02 10:51:25 | 000,235,112 | —- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\uliahci.sys – (uliahci)
DRV - [2006/11/02 10:51:25 | 000,232,040 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\Windows\system32\drivers\iastorv.sys – (iaStorV)
DRV - [2006/11/02 10:51:00 | 000,147,048 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpu320.sys – (adpu320)
DRV - [2006/11/02 10:50:45 | 000,115,816 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ulsata2.sys – (ulsata2)
DRV - [2006/11/02 10:50:41 | 000,112,232 | —- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\vsmraid.sys – (vsmraid)
DRV - [2006/11/02 10:50:35 | 000,106,088 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ql40xx.sys – (ql40xx)
DRV - [2006/11/02 10:50:35 | 000,098,408 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ulsata.sys – (UlSata)
DRV - [2006/11/02 10:50:35 | 000,098,408 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpu160m.sys – (adpu160m)
DRV - [2006/11/02 10:50:24 | 000,088,680 | —- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nvraid.sys – (nvraid)
DRV - [2006/11/02 10:50:19 | 000,045,160 | —- | M] (IBM Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nfrd960.sys – (nfrd960)
DRV - [2006/11/02 10:50:17 | 000,041,576 | —- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iirsp.sys – (iirsp)
DRV - [2006/11/02 10:50:16 | 000,071,784 | —- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sisraid4.sys – (SiSRaid4)
DRV - [2006/11/02 10:50:13 | 000,040,040 | —- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nvstor.sys – (nvstor)
DRV - [2006/11/02 10:50:11 | 000,071,272 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\djsvs.sys – (aic78xx)
DRV - [2006/11/02 10:50:10 | 000,067,688 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\arcsas.sys – (arcsas)
DRV - [2006/11/02 10:50:10 | 000,065,640 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_scsi.sys – (LSI_SCSI)
DRV - [2006/11/02 10:50:10 | 000,038,504 | —- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sisraid2.sys – (SiSRaid2)
DRV - [2006/11/02 10:50:10 | 000,037,480 | —- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\hpcisss.sys – (HpCISSs)
DRV - [2006/11/02 10:50:09 | 000,067,688 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\arc.sys – (arc)
DRV - [2006/11/02 10:50:09 | 000,035,944 | —- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iteraid.sys – (iteraid)
DRV - [2006/11/02 10:50:07 | 000,035,944 | —- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iteatapi.sys – (iteatapi)
DRV - [2006/11/02 10:50:05 | 000,065,640 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_sas.sys – (LSI_SAS)
DRV - [2006/11/02 10:50:05 | 000,035,944 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\symc8xx.sys – (Symc8xx)
DRV - [2006/11/02 10:50:04 | 000,065,640 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_fc.sys – (LSI_FC)
DRV - [2006/11/02 10:50:03 | 000,034,920 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sym_u3.sys – (Sym_u3)
DRV - [2006/11/02 10:49:59 | 000,033,384 | —- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\mraid35x.sys – (Mraid35x)
DRV - [2006/11/02 10:49:56 | 000,031,848 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sym_hi.sys – (Sym_hi)
DRV - [2006/11/02 10:49:53 | 000,028,776 | —- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\megasas.sys – (megasas)
DRV - [2006/11/02 09:25:24 | 000,071,808 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brserid.sys – (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 09:24:47 | 000,011,904 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brusbser.sys – (BrUsbSer)
DRV - [2006/11/02 09:24:46 | 000,005,248 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brfiltup.sys – (BrFiltUp)
DRV - [2006/11/02 09:24:45 | 000,013,568 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brfiltlo.sys – (BrFiltLo)
DRV - [2006/11/02 09:24:44 | 000,062,336 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brserwdm.sys – (BrSerWdm)
DRV - [2006/11/02 09:24:44 | 000,012,160 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brusbmdm.sys – (BrUsbMdm)
DRV - [2006/11/02 08:36:50 | 000,020,608 | —- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ntrigdigi.sys – (ntrigdigi)
DRV - [2006/11/02 08:36:43 | 002,028,032 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\atikmdag.sys – (R300)
DRV - [2006/11/02 08:30:55 | 000,200,704 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\e1e6032.sys – (e1express) Intel®
DRV - [2006/11/02 08:30:54 | 000,117,760 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\E1G60I32.sys – (E1G60) Intel®
DRV - [2006/08/05 01:39:10 | 000,008,192 | —- | M] (Conexant Systems, Inc.) [Kernel | Auto | Stopped] – C:\Windows\System32\drivers\XAudio.sys – (XAudio)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://inboxtoolbar.com/help/sa_customize.aspx?tbid=80150
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://inboxtoolbar.com/search/ie.aspx?tbid=80150
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\..\URLSearchHook: {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/07/04 19:13:38 | 000,000,000 | —D | M]
O1 HOSTS File: ([2006/09/18 22:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\McAfee\MSK\mskapbho.dll ()
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O2 - BHO: () - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O2 - BHO: () - {DB35C569-5624-4CFC-8043-E5139F55A073} - C:\Program Files\Crawler\Shared\CShared.dll (Crawler.com)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (&Inbox Toolbar) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [BTHelena_McciTrayApp] C:\Program Files\BBDesktopHelpUpgradeAdvisor\McciTrayApp.exe (Motive Communications, Inc.)
O4 - HKLM..\Run: [CSmileys] C:\Program Files\Crawler\Smileys\CSmileysIM.exe (Crawler.com)
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe File not found
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (Macrovision Corporation)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [PCMService] C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [{233F3715-8B38-CA66-A4CA-35E43239075A}] C:\Users\tom\AppData\Roaming\Inza\yxiqu.exe ()
O4 - HKCU..\Run: [CSmileys] C:\Program Files\Crawler\Smileys\CSmileysIM.exe (Crawler.com)
O4 - HKCU..\Run: [QNB2EB90WX] C:\Users\tom\AppData\Local\Temp\Szp.exe File not found
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\RunOnce: [755456660] C:\Users\tom\AppData\Local\755456660.exe ()
O4 - Startup: C:\Users\tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Media Player.lnk = C:\Program Files\Adobe Media Player\Adobe Media Player.exe ()
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\inbox {37540F19-DD4C-478B-B2DF-C19281BCAF27} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Filter\application/x-internet-signup {A173B69A-1F9B-4823-9FDA-412F641E65D6} - C:\Program Files\Tiscali\Tiscali Internet\dlls\tiscalifilter.dll ()
O18 - Protocol\Filter\x-sdch - No CLSID value found
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - File not found
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img22.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img22.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2010/07/27 21:37:54 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\tom\Desktop\HiJackThis.exe
[2010/07/27 21:36:30 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Users\tom\Desktop\OTL.exe
[2010/07/27 16:30:27 | 000,000,000 | —D | C] – C:\Windows\Sun
[2010/07/27 12:41:24 | 000,000,000 | —D | C] – C:\Users\tom\AppData\Roaming\Malwarebytes
[2010/07/27 12:41:16 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/07/27 12:41:15 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/07/27 12:41:15 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/07/27 12:41:14 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/07/19 22:42:25 | 000,000,000 | —D | C] – C:\Program Files\NoAdware5.0
[2010/07/13 16:50:46 | 000,000,000 | —D | C] – C:\Users\tom\AppData\Local\{66E10716-938F-4CD2-9D89-FC086088602B}
[2010/07/04 19:03:09 | 000,000,000 | —D | C] – C:\Windows\49FA793C785E47E993DFBD442B0B45D1.TMP
[2010/07/04 19:03:03 | 000,000,000 | —D | C] – C:\Windows\8F1A20DC251D47B091B7DCA2523EE6C9.TMP
[2010/06/30 10:19:23 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2010/07/27 21:42:47 | 002,359,296 | -HS- | M] () – C:\Users\tom\ntuser.dat
[2010/07/27 21:38:09 | 000,359,929 | —- | M] () – C:\Users\tom\Desktop\dds.scr
[2010/07/27 21:37:56 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\tom\Desktop\HiJackThis.exe
[2010/07/27 21:36:37 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\tom\Desktop\OTL.exe
[2010/07/27 21:33:10 | 000,017,249 | —- | M] () – C:\Users\tom\Documents\virusfile.html
[2010/07/27 16:30:27 | 000,006,540 | —- | M] () – C:\Users\tom\AppData\Local\d3d9caps.dat
[2010/07/27 16:24:31 | 000,027,461 | —- | M] () – C:\Windows\System32\Config.MPF
[2010/07/27 16:12:35 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/07/27 16:11:31 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/07/27 16:11:31 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/07/27 16:11:22 | 000,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2010/07/27 16:11:21 | 000,008,212 | —- | M] () – C:\Windows\mfebcdata
[2010/07/27 16:11:21 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/07/27 16:11:17 | 000,524,288 | -HS- | M] () – C:\Users\tom\ntuser.dat{4a06b48e-98a4-11df-a753-93f7887e72aa}.TMContainer00000000000000000001.regtrans-ms
[2010/07/27 16:11:17 | 000,065,536 | -HS- | M] () – C:\Users\tom\ntuser.dat{4a06b48e-98a4-11df-a753-93f7887e72aa}.TM.blf
[2010/07/27 16:11:11 | 002,688,644 | -H– | M] () – C:\Users\tom\AppData\Local\IconCache.db
[2010/07/27 16:11:06 | 000,000,878 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/27 16:11:00 | 000,000,874 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/27 15:52:02 | 000,000,278 | -H– | M] () – C:\Windows\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2010/07/27 15:42:28 | 000,000,890 | —- | M] () – C:\Users\tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Media Player.lnk
[2010/07/27 15:39:36 | 000,613,338 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/07/27 15:39:36 | 000,110,616 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/07/27 15:39:35 | 000,709,582 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/07/27 15:37:03 | 000,000,868 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2010/07/27 15:18:00 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1750052908-3844407195-769297430-1000UA.job
[2010/07/27 12:41:18 | 000,000,820 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/27 12:36:53 | 000,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
[2010/07/26 22:17:17 | 000,524,288 | -HS- | M] () – C:\Users\tom\ntuser.dat{4a06b48e-98a4-11df-a753-93f7887e72aa}.TMContainer00000000000000000002.regtrans-ms
[2010/07/26 19:51:19 | 001,180,672 | —- | M] () – C:\Users\tom\AppData\Local\755456660.exe
[2010/07/26 16:18:00 | 000,000,846 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1750052908-3844407195-769297430-1000Core.job
[2010/07/26 12:22:36 | 000,524,288 | -HS- | M] () – C:\Users\tom\ntuser.dat{c837a10e-8ff0-11df-a6df-9c29fc9287a8}.TMContainer00000000000000000001.regtrans-ms
[2010/07/26 12:22:36 | 000,065,536 | -HS- | M] () – C:\Users\tom\ntuser.dat{c837a10e-8ff0-11df-a6df-9c29fc9287a8}.TM.blf
[2010/07/24 09:19:25 | 000,002,034 | —- | M] () – C:\Users\tom\Desktop\Google Chrome.lnk
[2010/07/24 09:19:25 | 000,001,996 | —- | M] () – C:\Users\tom\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/07/19 22:44:55 | 000,000,834 | —- | M] () – C:\Users\tom\Desktop\NoAdware.lnk
[2010/07/19 22:22:18 | 186,322,975 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/07/15 15:18:22 | 000,130,424 | —- | M] (McAfee, Inc.) – C:\Windows\System32\drivers\Mpfp.sys
[2010/07/15 11:45:58 | 000,524,288 | -HS- | M] () – C:\Users\tom\ntuser.dat{c837a10e-8ff0-11df-a6df-9c29fc9287a8}.TMContainer00000000000000000002.regtrans-ms
[2010/07/15 11:02:28 | 000,006,786 | —- | M] () – C:\Users\tom\Documents\TC 2009 CV.rtf
[2010/07/15 10:39:57 | 000,000,118 | —- | M] () – C:\Windows\System32\MRT.INI
[2010/07/15 10:14:33 | 000,524,288 | -HS- | M] () – C:\Users\tom\ntuser.dat{c817bf46-d06f-11de-82e3-001d09c73bc2}.TMContainer00000000000000000001.regtrans-ms
[2010/07/15 10:14:33 | 000,065,536 | -HS- | M] () – C:\Users\tom\ntuser.dat{c817bf46-d06f-11de-82e3-001d09c73bc2}.TM.blf
[2010/07/14 19:15:58 | 000,000,120 | —- | M] () – C:\Users\tom\AppData\Local\Lbijiro.dat
[2010/07/14 13:00:11 | 000,000,000 | —- | M] () – C:\Users\tom\AppData\Local\Bnenadujo.bin
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files Created - No Company Name ==========
[2010/07/27 21:38:07 | 000,359,929 | —- | C] () – C:\Users\tom\Desktop\dds.scr
[2010/07/27 21:33:10 | 000,017,249 | —- | C] () – C:\Users\tom\Documents\virusfile.html
[2010/07/27 16:11:21 | 000,008,212 | —- | C] () – C:\Windows\mfebcdata
[2010/07/27 12:41:18 | 000,000,820 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/27 12:36:53 | 000,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
[2010/07/26 19:51:19 | 001,180,672 | —- | C] () – C:\Users\tom\AppData\Local\755456660.exe
[2010/07/26 12:25:47 | 000,524,288 | -HS- | C] () – C:\Users\tom\ntuser.dat{4a06b48e-98a4-11df-a753-93f7887e72aa}.TMContainer00000000000000000002.regtrans-ms
[2010/07/26 12:25:47 | 000,524,288 | -HS- | C] () – C:\Users\tom\ntuser.dat{4a06b48e-98a4-11df-a753-93f7887e72aa}.TMContainer00000000000000000001.regtrans-ms
[2010/07/26 12:25:47 | 000,065,536 | -HS- | C] () – C:\Users\tom\ntuser.dat{4a06b48e-98a4-11df-a753-93f7887e72aa}.TM.blf
[2010/07/19 22:42:26 | 000,000,834 | —- | C] () – C:\Users\tom\Desktop\NoAdware.lnk
[2010/07/15 10:39:57 | 000,000,118 | —- | C] () – C:\Windows\System32\MRT.INI
[2010/07/15 10:20:17 | 000,524,288 | -HS- | C] () – C:\Users\tom\ntuser.dat{c837a10e-8ff0-11df-a6df-9c29fc9287a8}.TMContainer00000000000000000002.regtrans-ms
[2010/07/15 10:20:17 | 000,524,288 | -HS- | C] () – C:\Users\tom\ntuser.dat{c837a10e-8ff0-11df-a6df-9c29fc9287a8}.TMContainer00000000000000000001.regtrans-ms
[2010/07/15 10:20:17 | 000,065,536 | -HS- | C] () – C:\Users\tom\ntuser.dat{c837a10e-8ff0-11df-a6df-9c29fc9287a8}.TM.blf
[2010/07/13 16:50:53 | 000,000,000 | —- | C] () – C:\Users\tom\AppData\Local\Bnenadujo.bin
[2010/07/13 16:50:51 | 000,000,120 | —- | C] () – C:\Users\tom\AppData\Local\Lbijiro.dat
[2010/06/28 15:24:58 | 000,000,278 | -H– | C] () – C:\Windows\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2008/02/02 23:43:52 | 001,238,832 | —- | C] () – C:\Windows\System32\igmedkrn.dll
[2008/02/02 23:43:52 | 000,249,856 | —- | C] () – C:\Windows\System32\igfxTMM.dll
[2008/02/02 23:43:52 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1322.dll
[2008/02/02 23:43:52 | 000,104,636 | —- | C] () – C:\Windows\System32\igmedcompkrn.dll
[2008/02/02 23:43:45 | 000,016,480 | —- | C] () – C:\Windows\System32\rixdicon.dll
[2008/02/02 16:07:58 | 000,065,536 | —- | C] () – C:\Windows\System32\bcmwlrmt.dll
[2006/11/07 20:25:58 | 000,000,000 | —- | C] () – C:\Windows\System32\px.ini
[2006/11/02 13:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 11:25:44 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/11/02 08:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/09/17 00:36:50 | 000,520,192 | —- | C] () – C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006/09/17 00:36:50 | 000,204,800 | —- | C] () – C:\Windows\System32\CddbFileTaggerRoxio.dll
========== Alternate Data Streams ==========
@Alternate Data Stream - 76 bytes -> C:\Users\tom\Documents\Downloads:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\tom\Desktop\Adobe Reader 9 Installer:Roxio EMC Stream
@Alternate Data Stream - 1005 bytes -> C:\Users\tom\Documents\Gateway Enrolment Notification.eml:OECustomProperty
< End of report >
SRV - [2010/07/20 16:45:01 | 000,030,192 | —- | M] (Google) [On_Demand | Stopped] – C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe – (GoogleDesktopManager-051210-111108)
SRV - [2010/06/10 06:58:32 | 000,865,832 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\McAfee\MSC\mcmscsvc.exe – (mcmscsvc)
SRV - [2010/03/26 11:16:04 | 000,093,320 | —- | M] (McAfee, Inc.) [Auto | Stopped] – C:\Program Files\McAfee\SiteAdvisor\McSACore.exe – (McAfee SiteAdvisor Service)
SRV - [2010/03/18 13:16:28 | 000,753,504 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe – (WPFFontCache_v0400)
SRV - [2010/03/18 13:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2009/10/27 12:19:46 | 000,895,696 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\McAfee\MPF\MPFSrv.exe – (MpfService)
SRV - [2009/09/16 11:23:32 | 000,365,072 | —- | M] (McAfee, Inc.) [On_Demand | Stopped] – C:\Program Files\McAfee\VirusScan\mcods.exe – (McODS)
SRV - [2009/09/16 10:22:08 | 000,144,704 | —- | M] (McAfee, Inc.) [Unknown | Stopped] – C:\Program Files\McAfee\VirusScan\Mcshield.exe – (McShield)
SRV - [2009/09/16 09:28:38 | 000,606,736 | —- | M] (McAfee, Inc.) [On_Demand | Stopped] – C:\Program Files\McAfee\VirusScan\mcsysmon.exe – (McSysmon)
SRV - [2009/07/08 14:48:48 | 000,026,640 | —- | M] (McAfee, Inc.) [Auto | Stopped] – C:\Program Files\McAfee\MSK\MskSrver.exe – (MSK80Service)
SRV - [2009/07/08 11:54:34 | 000,359,952 | —- | M] (McAfee, Inc.) [Auto | Stopped] – c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe – (McProxy)
SRV - [2009/07/07 19:10:02 | 002,482,848 | —- | M] (McAfee, Inc.) [Auto | Stopped] – c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe – (McNASvc)
SRV - [2008/01/19 08:38:24 | 000,272,952 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2007/09/07 19:25:12 | 000,102,400 | —- | M] (IDT, Inc.) [Auto | Stopped] – C:\Windows\System32\stacsv.exe – (STacSV)
SRV - [2007/08/29 22:25:16 | 000,073,728 | —- | M] (Andrea Electronics Corporation) [Auto | Stopped] – C:\Windows\System32\AEstSrv.exe – (AESTFilters)
SRV - [2007/05/31 10:21:24 | 000,379,784 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\WindowsMobile\wcescomm.dll – (WcesComm)
SRV - [2007/05/31 10:21:18 | 000,183,688 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\WindowsMobile\rapimgr.dll – (RapiMgr)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\System32\DRIVERS\nwlnkfwd.sys – (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\System32\DRIVERS\nwlnkflt.sys – (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\System32\DRIVERS\ipinip.sys – (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] – C:\Windows\System32\drivers\blbdrive.sys – (blbdrive)
DRV - [2010/07/15 15:18:22 | 000,130,424 | —- | M] (McAfee, Inc.) [Kernel | System | Running] – C:\Windows\System32\drivers\Mpfp.sys – (MPFP)
DRV - [2009/09/16 10:22:48 | 000,214,664 | —- | M] (McAfee, Inc.) [Kernel | System | Stopped] – C:\Windows\System32\drivers\mfehidk.sys – (mfehidk)
DRV - [2009/09/16 10:22:48 | 000,079,816 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mfeavfk.sys – (mfeavfk)
DRV - [2009/09/16 10:22:48 | 000,040,552 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mfesmfk.sys – (mfesmfk)
DRV - [2009/09/16 10:22:48 | 000,035,272 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mfebopk.sys – (mfebopk)
DRV - [2009/09/16 10:22:14 | 000,034,248 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mferkdk.sys – (mferkdk)
DRV - [2008/02/02 23:43:17 | 000,020,152 | —- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\viaide.sys – (viaide)
DRV - [2008/02/02 23:43:17 | 000,019,128 | —- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\cmdide.sys – (cmdide)
DRV - [2008/02/02 23:43:17 | 000,017,592 | —- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\aliide.sys – (aliide)
DRV - [2007/09/26 11:47:24 | 001,899,008 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\igdkmd32.sys – (igfx)
DRV - [2007/09/24 10:27:26 | 000,155,136 | —- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\Apfiltr.sys – (ApfiltrService)
DRV - [2007/09/07 19:26:04 | 000,330,240 | —- | M] (IDT, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\stwrt.sys – (STHDA)
DRV - [2007/03/21 20:33:54 | 000,534,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\BCMWL6.SYS – (BCM43XX)
DRV - [2007/02/12 22:36:54 | 000,277,784 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\Windows\system32\drivers\iastor.sys – (iaStor)
DRV - [2006/11/27 08:48:46 | 000,037,376 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rixdptsk.sys – (rismxdp)
DRV - [2006/11/27 08:48:44 | 000,043,520 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rimsptsk.sys – (rimsptsk)
DRV - [2006/11/27 08:48:44 | 000,032,256 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rimmptsk.sys – (rimmptsk)
DRV - [2006/11/21 13:25:44 | 000,045,568 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\bcm4sbxp.sys – (bcm4sbxp)
DRV - [2006/11/03 03:43:30 | 000,986,624 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\HSX_DPV.sys – (HSF_DPV)
DRV - [2006/11/03 03:42:18 | 000,206,848 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\HSXHWAZL.sys – (HSXHWAZL)
DRV - [2006/11/03 03:42:08 | 000,659,968 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\HSX_CNXT.sys – (winachsf)
DRV - [2006/11/02 10:51:45 | 000,900,712 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ql2300.sys – (ql2300)
DRV - [2006/11/02 10:51:38 | 000,420,968 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adp94xx.sys – (adp94xx)
DRV - [2006/11/02 10:51:34 | 000,316,520 | —- | M] (Emulex) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\elxstor.sys – (elxstor)
DRV - [2006/11/02 10:51:32 | 000,297,576 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpahci.sys – (adpahci)
DRV - [2006/11/02 10:51:25 | 000,235,112 | —- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\uliahci.sys – (uliahci)
DRV - [2006/11/02 10:51:25 | 000,232,040 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\Windows\system32\drivers\iastorv.sys – (iaStorV)
DRV - [2006/11/02 10:51:00 | 000,147,048 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpu320.sys – (adpu320)
DRV - [2006/11/02 10:50:45 | 000,115,816 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ulsata2.sys – (ulsata2)
DRV - [2006/11/02 10:50:41 | 000,112,232 | —- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\vsmraid.sys – (vsmraid)
DRV - [2006/11/02 10:50:35 | 000,106,088 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ql40xx.sys – (ql40xx)
DRV - [2006/11/02 10:50:35 | 000,098,408 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ulsata.sys – (UlSata)
DRV - [2006/11/02 10:50:35 | 000,098,408 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpu160m.sys – (adpu160m)
DRV - [2006/11/02 10:50:24 | 000,088,680 | —- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nvraid.sys – (nvraid)
DRV - [2006/11/02 10:50:19 | 000,045,160 | —- | M] (IBM Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nfrd960.sys – (nfrd960)
DRV - [2006/11/02 10:50:17 | 000,041,576 | —- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iirsp.sys – (iirsp)
DRV - [2006/11/02 10:50:16 | 000,071,784 | —- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sisraid4.sys – (SiSRaid4)
DRV - [2006/11/02 10:50:13 | 000,040,040 | —- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nvstor.sys – (nvstor)
DRV - [2006/11/02 10:50:11 | 000,071,272 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\djsvs.sys – (aic78xx)
DRV - [2006/11/02 10:50:10 | 000,067,688 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\arcsas.sys – (arcsas)
DRV - [2006/11/02 10:50:10 | 000,065,640 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_scsi.sys – (LSI_SCSI)
DRV - [2006/11/02 10:50:10 | 000,038,504 | —- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sisraid2.sys – (SiSRaid2)
DRV - [2006/11/02 10:50:10 | 000,037,480 | —- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\hpcisss.sys – (HpCISSs)
DRV - [2006/11/02 10:50:09 | 000,067,688 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\arc.sys – (arc)
DRV - [2006/11/02 10:50:09 | 000,035,944 | —- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iteraid.sys – (iteraid)
DRV - [2006/11/02 10:50:07 | 000,035,944 | —- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iteatapi.sys – (iteatapi)
DRV - [2006/11/02 10:50:05 | 000,065,640 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_sas.sys – (LSI_SAS)
DRV - [2006/11/02 10:50:05 | 000,035,944 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\symc8xx.sys – (Symc8xx)
DRV - [2006/11/02 10:50:04 | 000,065,640 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_fc.sys – (LSI_FC)
DRV - [2006/11/02 10:50:03 | 000,034,920 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sym_u3.sys – (Sym_u3)
DRV - [2006/11/02 10:49:59 | 000,033,384 | —- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\mraid35x.sys – (Mraid35x)
DRV - [2006/11/02 10:49:56 | 000,031,848 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sym_hi.sys – (Sym_hi)
DRV - [2006/11/02 10:49:53 | 000,028,776 | —- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\megasas.sys – (megasas)
DRV - [2006/11/02 09:25:24 | 000,071,808 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brserid.sys – (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 09:24:47 | 000,011,904 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brusbser.sys – (BrUsbSer)
DRV - [2006/11/02 09:24:46 | 000,005,248 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brfiltup.sys – (BrFiltUp)
DRV - [2006/11/02 09:24:45 | 000,013,568 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brfiltlo.sys – (BrFiltLo)
DRV - [2006/11/02 09:24:44 | 000,062,336 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brserwdm.sys – (BrSerWdm)
DRV - [2006/11/02 09:24:44 | 000,012,160 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brusbmdm.sys – (BrUsbMdm)
DRV - [2006/11/02 08:36:50 | 000,020,608 | —- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ntrigdigi.sys – (ntrigdigi)
DRV - [2006/11/02 08:36:43 | 002,028,032 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\atikmdag.sys – (R300)
DRV - [2006/11/02 08:30:55 | 000,200,704 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\e1e6032.sys – (e1express) Intel®
DRV - [2006/11/02 08:30:54 | 000,117,760 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\E1G60I32.sys – (E1G60) Intel®
DRV - [2006/08/05 01:39:10 | 000,008,192 | —- | M] (Conexant Systems, Inc.) [Kernel | Auto | Stopped] – C:\Windows\System32\drivers\XAudio.sys – (XAudio)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://inboxtoolbar.com/help/sa_customize.aspx?tbid=80150
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://inboxtoolbar.com/search/ie.aspx?tbid=80150
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\..\URLSearchHook: {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/07/04 19:13:38 | 000,000,000 | —D | M]
O1 HOSTS File: ([2006/09/18 22:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\McAfee\MSK\mskapbho.dll ()
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O2 - BHO: () - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O2 - BHO: () - {DB35C569-5624-4CFC-8043-E5139F55A073} - C:\Program Files\Crawler\Shared\CShared.dll (Crawler.com)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (&Inbox Toolbar) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [BTHelena_McciTrayApp] C:\Program Files\BBDesktopHelpUpgradeAdvisor\McciTrayApp.exe (Motive Communications, Inc.)
O4 - HKLM..\Run: [CSmileys] C:\Program Files\Crawler\Smileys\CSmileysIM.exe (Crawler.com)
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe File not found
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (Macrovision Corporation)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [PCMService] C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [{233F3715-8B38-CA66-A4CA-35E43239075A}] C:\Users\tom\AppData\Roaming\Inza\yxiqu.exe ()
O4 - HKCU..\Run: [CSmileys] C:\Program Files\Crawler\Smileys\CSmileysIM.exe (Crawler.com)
O4 - HKCU..\Run: [QNB2EB90WX] C:\Users\tom\AppData\Local\Temp\Szp.exe File not found
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\RunOnce: [755456660] C:\Users\tom\AppData\Local\755456660.exe ()
O4 - Startup: C:\Users\tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Media Player.lnk = C:\Program Files\Adobe Media Player\Adobe Media Player.exe ()
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\inbox {37540F19-DD4C-478B-B2DF-C19281BCAF27} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Filter\application/x-internet-signup {A173B69A-1F9B-4823-9FDA-412F641E65D6} - C:\Program Files\Tiscali\Tiscali Internet\dlls\tiscalifilter.dll ()
O18 - Protocol\Filter\x-sdch - No CLSID value found
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - File not found
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img22.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img22.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2010/07/27 21:37:54 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\tom\Desktop\HiJackThis.exe
[2010/07/27 21:36:30 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Users\tom\Desktop\OTL.exe
[2010/07/27 16:30:27 | 000,000,000 | —D | C] – C:\Windows\Sun
[2010/07/27 12:41:24 | 000,000,000 | —D | C] – C:\Users\tom\AppData\Roaming\Malwarebytes
[2010/07/27 12:41:16 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/07/27 12:41:15 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/07/27 12:41:15 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/07/27 12:41:14 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/07/19 22:42:25 | 000,000,000 | —D | C] – C:\Program Files\NoAdware5.0
[2010/07/13 16:50:46 | 000,000,000 | —D | C] – C:\Users\tom\AppData\Local\{66E10716-938F-4CD2-9D89-FC086088602B}
[2010/07/04 19:03:09 | 000,000,000 | —D | C] – C:\Windows\49FA793C785E47E993DFBD442B0B45D1.TMP
[2010/07/04 19:03:03 | 000,000,000 | —D | C] – C:\Windows\8F1A20DC251D47B091B7DCA2523EE6C9.TMP
[2010/06/30 10:19:23 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2010/07/27 21:42:47 | 002,359,296 | -HS- | M] () – C:\Users\tom\ntuser.dat
[2010/07/27 21:38:09 | 000,359,929 | —- | M] () – C:\Users\tom\Desktop\dds.scr
[2010/07/27 21:37:56 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\tom\Desktop\HiJackThis.exe
[2010/07/27 21:36:37 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\tom\Desktop\OTL.exe
[2010/07/27 21:33:10 | 000,017,249 | —- | M] () – C:\Users\tom\Documents\virusfile.html
[2010/07/27 16:30:27 | 000,006,540 | —- | M] () – C:\Users\tom\AppData\Local\d3d9caps.dat
[2010/07/27 16:24:31 | 000,027,461 | —- | M] () – C:\Windows\System32\Config.MPF
[2010/07/27 16:12:35 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/07/27 16:11:31 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/07/27 16:11:31 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/07/27 16:11:22 | 000,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2010/07/27 16:11:21 | 000,008,212 | —- | M] () – C:\Windows\mfebcdata
[2010/07/27 16:11:21 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/07/27 16:11:17 | 000,524,288 | -HS- | M] () – C:\Users\tom\ntuser.dat{4a06b48e-98a4-11df-a753-93f7887e72aa}.TMContainer00000000000000000001.regtrans-ms
[2010/07/27 16:11:17 | 000,065,536 | -HS- | M] () – C:\Users\tom\ntuser.dat{4a06b48e-98a4-11df-a753-93f7887e72aa}.TM.blf
[2010/07/27 16:11:11 | 002,688,644 | -H– | M] () – C:\Users\tom\AppData\Local\IconCache.db
[2010/07/27 16:11:06 | 000,000,878 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/27 16:11:00 | 000,000,874 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/27 15:52:02 | 000,000,278 | -H– | M] () – C:\Windows\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2010/07/27 15:42:28 | 000,000,890 | —- | M] () – C:\Users\tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Media Player.lnk
[2010/07/27 15:39:36 | 000,613,338 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/07/27 15:39:36 | 000,110,616 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/07/27 15:39:35 | 000,709,582 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/07/27 15:37:03 | 000,000,868 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2010/07/27 15:18:00 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1750052908-3844407195-769297430-1000UA.job
[2010/07/27 12:41:18 | 000,000,820 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/27 12:36:53 | 000,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
[2010/07/26 22:17:17 | 000,524,288 | -HS- | M] () – C:\Users\tom\ntuser.dat{4a06b48e-98a4-11df-a753-93f7887e72aa}.TMContainer00000000000000000002.regtrans-ms
[2010/07/26 19:51:19 | 001,180,672 | —- | M] () – C:\Users\tom\AppData\Local\755456660.exe
[2010/07/26 16:18:00 | 000,000,846 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1750052908-3844407195-769297430-1000Core.job
[2010/07/26 12:22:36 | 000,524,288 | -HS- | M] () – C:\Users\tom\ntuser.dat{c837a10e-8ff0-11df-a6df-9c29fc9287a8}.TMContainer00000000000000000001.regtrans-ms
[2010/07/26 12:22:36 | 000,065,536 | -HS- | M] () – C:\Users\tom\ntuser.dat{c837a10e-8ff0-11df-a6df-9c29fc9287a8}.TM.blf
[2010/07/24 09:19:25 | 000,002,034 | —- | M] () – C:\Users\tom\Desktop\Google Chrome.lnk
[2010/07/24 09:19:25 | 000,001,996 | —- | M] () – C:\Users\tom\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/07/19 22:44:55 | 000,000,834 | —- | M] () – C:\Users\tom\Desktop\NoAdware.lnk
[2010/07/19 22:22:18 | 186,322,975 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/07/15 15:18:22 | 000,130,424 | —- | M] (McAfee, Inc.) – C:\Windows\System32\drivers\Mpfp.sys
[2010/07/15 11:45:58 | 000,524,288 | -HS- | M] () – C:\Users\tom\ntuser.dat{c837a10e-8ff0-11df-a6df-9c29fc9287a8}.TMContainer00000000000000000002.regtrans-ms
[2010/07/15 11:02:28 | 000,006,786 | —- | M] () – C:\Users\tom\Documents\TC 2009 CV.rtf
[2010/07/15 10:39:57 | 000,000,118 | —- | M] () – C:\Windows\System32\MRT.INI
[2010/07/15 10:14:33 | 000,524,288 | -HS- | M] () – C:\Users\tom\ntuser.dat{c817bf46-d06f-11de-82e3-001d09c73bc2}.TMContainer00000000000000000001.regtrans-ms
[2010/07/15 10:14:33 | 000,065,536 | -HS- | M] () – C:\Users\tom\ntuser.dat{c817bf46-d06f-11de-82e3-001d09c73bc2}.TM.blf
[2010/07/14 19:15:58 | 000,000,120 | —- | M] () – C:\Users\tom\AppData\Local\Lbijiro.dat
[2010/07/14 13:00:11 | 000,000,000 | —- | M] () – C:\Users\tom\AppData\Local\Bnenadujo.bin
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files Created - No Company Name ==========
[2010/07/27 21:38:07 | 000,359,929 | —- | C] () – C:\Users\tom\Desktop\dds.scr
[2010/07/27 21:33:10 | 000,017,249 | —- | C] () – C:\Users\tom\Documents\virusfile.html
[2010/07/27 16:11:21 | 000,008,212 | —- | C] () – C:\Windows\mfebcdata
[2010/07/27 12:41:18 | 000,000,820 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/27 12:36:53 | 000,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
[2010/07/26 19:51:19 | 001,180,672 | —- | C] () – C:\Users\tom\AppData\Local\755456660.exe
[2010/07/26 12:25:47 | 000,524,288 | -HS- | C] () – C:\Users\tom\ntuser.dat{4a06b48e-98a4-11df-a753-93f7887e72aa}.TMContainer00000000000000000002.regtrans-ms
[2010/07/26 12:25:47 | 000,524,288 | -HS- | C] () – C:\Users\tom\ntuser.dat{4a06b48e-98a4-11df-a753-93f7887e72aa}.TMContainer00000000000000000001.regtrans-ms
[2010/07/26 12:25:47 | 000,065,536 | -HS- | C] () – C:\Users\tom\ntuser.dat{4a06b48e-98a4-11df-a753-93f7887e72aa}.TM.blf
[2010/07/19 22:42:26 | 000,000,834 | —- | C] () – C:\Users\tom\Desktop\NoAdware.lnk
[2010/07/15 10:39:57 | 000,000,118 | —- | C] () – C:\Windows\System32\MRT.INI
[2010/07/15 10:20:17 | 000,524,288 | -HS- | C] () – C:\Users\tom\ntuser.dat{c837a10e-8ff0-11df-a6df-9c29fc9287a8}.TMContainer00000000000000000002.regtrans-ms
[2010/07/15 10:20:17 | 000,524,288 | -HS- | C] () – C:\Users\tom\ntuser.dat{c837a10e-8ff0-11df-a6df-9c29fc9287a8}.TMContainer00000000000000000001.regtrans-ms
[2010/07/15 10:20:17 | 000,065,536 | -HS- | C] () – C:\Users\tom\ntuser.dat{c837a10e-8ff0-11df-a6df-9c29fc9287a8}.TM.blf
[2010/07/13 16:50:53 | 000,000,000 | —- | C] () – C:\Users\tom\AppData\Local\Bnenadujo.bin
[2010/07/13 16:50:51 | 000,000,120 | —- | C] () – C:\Users\tom\AppData\Local\Lbijiro.dat
[2010/06/28 15:24:58 | 000,000,278 | -H– | C] () – C:\Windows\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2008/02/02 23:43:52 | 001,238,832 | —- | C] () – C:\Windows\System32\igmedkrn.dll
[2008/02/02 23:43:52 | 000,249,856 | —- | C] () – C:\Windows\System32\igfxTMM.dll
[2008/02/02 23:43:52 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1322.dll
[2008/02/02 23:43:52 | 000,104,636 | —- | C] () – C:\Windows\System32\igmedcompkrn.dll
[2008/02/02 23:43:45 | 000,016,480 | —- | C] () – C:\Windows\System32\rixdicon.dll
[2008/02/02 16:07:58 | 000,065,536 | —- | C] () – C:\Windows\System32\bcmwlrmt.dll
[2006/11/07 20:25:58 | 000,000,000 | —- | C] () – C:\Windows\System32\px.ini
[2006/11/02 13:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 11:25:44 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/11/02 08:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/09/17 00:36:50 | 000,520,192 | —- | C] () – C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006/09/17 00:36:50 | 000,204,800 | —- | C] () – C:\Windows\System32\CddbFileTaggerRoxio.dll
========== Alternate Data Streams ==========
@Alternate Data Stream - 76 bytes -> C:\Users\tom\Documents\Downloads:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\tom\Desktop\Adobe Reader 9 Installer:Roxio EMC Stream
@Alternate Data Stream - 1005 bytes -> C:\Users\tom\Documents\Gateway Enrolment Notification.eml:OECustomProperty
< End of report >
DDS (Ver_09-06-26.01) - NTFSx86 NETWORK
Run by [removed] at 21:49:40.85 on 27/07/2010
Internet Explorer: 7.0.6001.18000
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.44.1033.18.2037.1117 [GMT 1:00]
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\Explorer.EXE
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Java\jre6\bin\jp2launcher.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Users\tom\AppData\Local\Temp\jkos-tom\binaries\ScanningProcess.exe
C:\Users\tom\AppData\Local\Temp\jkos-tom\binaries\ScanningProcess.exe
C:\Windows\notepad.exe
C:\Windows\notepad.exe
C:\Users\tom\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe
============== Pseudo HJT Report ===============
uLocal Page = \blank.htm
uStart Page = hxxp://www.google.co.uk/
uWindow Title = Internet Explorer provided by Dell
uSearch Bar = hxxp://inboxtoolbar.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=%tb_id&%language
uSearchURL,(Default) = hxxp://uk.search.yahoo.com/search?fr=mcafee&p=%s
mSearchAssistant = hxxp://inboxtoolbar.com/search/ie.aspx?tbid=80150
mCustomizeSearch = hxxp://inboxtoolbar.com/help/sa_customize.aspx?tbid=80150
uURLSearchHooks: N/A: {d3d233d5-9f6d-436c-b6c7-e63f77503b30} - c:\progra~1\inboxt~1\Inbox.dll
uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dll
BHO: : {d3d233d5-9f6d-436c-b6c7-e63f77503b30} - c:\progra~1\inboxt~1\Inbox.dll
BHO: : {db35c569-5624-4cfc-8043-e5139f55a073} - c:\progra~1\crawler\shared\CShared.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: &Inbox Toolbar: {d7e97865-918f-41e4-9cd0-25ab1c574ce8} - c:\progra~1\inboxt~1\Inbox.dll
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [Google Update] "c:\users\tom\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [CSmileys] "c:\program files\crawler\smileys\CSmileysIM.exe"
uRun: [{233F3715-8B38-CA66-A4CA-35E43239075A}] c:\users\tom\appdata\roaming\inza\yxiqu.exe
uRun: [QNB2EB90WX] c:\users\tom\appdata\local\temp\Szp.exe
uRun: [59bd25aa-ce9e-4677-ac13-c9c29895f59a_42] rundll32.exe "c:\users\tom\appdata\roaming\59bd25aa-ce9e-4677-ac13-c9c29895f59a_42.avi", start
uRunOnce: [755456660] "c:\users\tom\appdata\local\755456660.exe" 0 34
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [ECenter] c:\dell\e-center\EULALauncher.exe
mRun: [Apoint] c:\program files\delltpad\Apoint.exe
mRun: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: []
mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"
mRun: [PCMService] "c:\program files\dell\mediadirect\PCMService.exe"
mRun: [BTHelena_McciTrayApp] c:\program files\bbdesktophelpupgradeadvisor\McciTrayApp.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [CSmileys] "c:\program files\crawler\smileys\CSmileysIM.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
StartupFolder: c:\users\tom\appdata\roaming\micros~1\windows\startm~1\programs\startup\adobem~1.lnk - c:\program files\adobe media player\Adobe Media Player.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickset.lnk - c:\windows\installer\{7f0c4457-8e64-491b-8d7b-991504365d1e}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Filter: application/x-internet-signup - {A173B69A-1F9B-4823-9FDA-412F641E65D6} - c:\program files\tiscali\tiscali internet\dlls\tiscalifilter.dll
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: inbox - {37540F19-DD4C-478B-B2DF-C19281BCAF27} - c:\progra~1\inboxt~1\Inbox.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: c:\progra~1\google\google~2\GOEC62~1.DLL
============= SERVICES / DRIVERS ===============
S2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\AEstSrv.exe [2008-2-2 73728]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate1ca0dff3e0136e8;Google Update Service (gupdate1ca0dff3e0136e8);c:\program files\google\update\GoogleUpdate.exe [2009-7-26 133104]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2008-10-29 93320]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2008-2-2 30192]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
=============== Created Last 30 ================
2010-07-27 16:11 8,212 a——- c:\windows\mfebcdata
2010-07-27 12:41 –d—– c:\users\tom\appdata\roaming\Malwarebytes
2010-07-27 12:41 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-27 12:41 20,952 a——- c:\windows\system32\drivers\mbam.sys
2010-07-27 12:41 –d—– c:\programdata\Malwarebytes
2010-07-27 12:41 –d—– c:\progra~2\Malwarebytes
2010-07-27 12:41 –d—– c:\program files\Malwarebytes' Anti-Malware
2010-07-27 12:36 0 a—h— c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2010-07-19 22:42 –d—– c:\program files\NoAdware5.0
2010-07-15 10:39 118 a——- c:\windows\system32\MRT.INI
2010-07-04 19:03 –d—– c:\windows\49FA793C785E47E993DFBD442B0B45D1.TMP
2010-07-04 19:03 –d—– c:\windows\8F1A20DC251D47B091B7DCA2523EE6C9.TMP
==================== Find3M ====================
2010-07-15 15:18 130,424 a——- c:\windows\system32\drivers\Mpfp.sys
2010-05-26 17:16 34,304 a——- c:\windows\system32\atmlib.dll
2010-05-26 15:25 289,792 a——- c:\windows\system32\atmfd.dll
2010-05-21 14:14 221,568 ——– c:\windows\system32\MpSigStub.exe
2010-05-04 19:42 833,024 a——- c:\windows\system32\wininet.dll
2010-05-04 19:37 78,336 a——- c:\windows\system32\ieencode.dll
2010-05-04 17:53 26,624 a——- c:\windows\system32\ieUnatt.exe
2010-05-01 14:53 2,036,224 a——- c:\windows\system32\win32k.sys
2008-10-31 16:09 174 a–sh— c:\program files\desktop.ini
2008-10-31 16:00 143,360 a——- c:\windows\inf\infstrng.dat
2008-10-31 16:00 86,016 a——- c:\windows\inf\infstor.dat
2008-10-31 16:00 51,200 a——- c:\windows\inf\infpub.dat
2008-10-30 18:39 665,600 a——- c:\windows\inf\drvindex.dat
2008-03-21 16:25 61,480 a——- c:\users\tom\GoToAssistDownloadHelper.exe
2006-11-02 13:42 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 13:42 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 13:42 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 13:42 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 10:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 10:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 10:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 10:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat
2008-02-02 23:43 8,192 a–sh— c:\windows\users\default\NTUSER.DAT
============= FINISH: 21:51:42.46 ===============
here are the files requested:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:41:50, on 27/07/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18470)
Boot mode: Safe mode with network support
Running processes:
C:\Windows\Explorer.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Java\jre6\bin\jp2launcher.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Users\tom\Desktop\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://inboxtoolbar.com/search/dispatcher….d&%language
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://inboxtoolbar.com/search/ie.aspx?tbid=80150
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://inboxtoolbar.com/help/sa_customize.aspx?tbid=80150
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://inboxtoolbar.com/search/ie.aspx?tbid=80150
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://inboxtoolbar.com/help/sa_customize.aspx?tbid=80150
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.search.yahoo.com/search?fr=mcafee&p=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\PROGRA~1\INBOXT~1\Inbox.dll
R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O2 - BHO: (no name) - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\PROGRA~1\INBOXT~1\Inbox.dll
O2 - BHO: (no name) - {DB35C569-5624-4CFC-8043-E5139F55A073} - C:\PROGRA~1\Crawler\Shared\CShared.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: &Inbox Toolbar - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\PROGRA~1\INBOXT~1\Inbox.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [BTHelena_McciTrayApp] C:\Program Files\BBDesktopHelpUpgradeAdvisor\McciTrayApp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [CSmileys] "C:\Program Files\Crawler\Smileys\CSmileysIM.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\tom\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [CSmileys] "C:\Program Files\Crawler\Smileys\CSmileysIM.exe"
O4 - HKCU\..\Run: [{233F3715-8B38-CA66-A4CA-35E43239075A}] C:\Users\tom\AppData\Roaming\Inza\yxiqu.exe
O4 - HKCU\..\Run: [QNB2EB90WX] C:\Users\tom\AppData\Local\Temp\Szp.exe
O4 - HKCU\..\Run: [59bd25aa-ce9e-4677-ac13-c9c29895f59a_42] rundll32.exe "C:\Users\tom\AppData\Roaming\59bd25aa-ce9e-4677-ac13-c9c29895f59a_42.avi", start
O4 - HKCU\..\RunOnce: [755456660] "C:\Users\tom\AppData\Local\755456660.exe" 0 34
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Adobe Media Player.lnk = C:\Program Files\Adobe Media Player\Adobe Media Player.exe
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: QuickSet.lnk = ?
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: inbox - {37540F19-DD4C-478B-B2DF-C19281BCAF27} - C:\PROGRA~1\INBOXT~1\Inbox.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Filter: x-sdch - (no CLSID) - (no file)
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate1ca0dff3e0136e8) (gupdate1ca0dff3e0136e8) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
–
End of file - 10982 bytes
OTL logfile created on: 27/07/2010 21:42:45 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\tom\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy
2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 59.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 78.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 136.43 Gb Total Space | 108.18 Gb Free Space | 79.29% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.84 Gb Free Space | 58.39% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: TOM-PC
Current User Name: tom
Logged in as Administrator.
Current Boot Mode: SafeMode with Networking
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
========== Processes (SafeList) ==========
PRC - [2010/07/27 21:36:37 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\tom\Desktop\OTL.exe
PRC - [2010/07/27 16:31:04 | 000,139,264 | —- | M] (Kaspersky Lab.) – C:\Users\tom\AppData\Local\Temp\jkos-tom\binaries\ScanningProcess.exe
PRC - [2010/06/10 06:58:32 | 000,865,832 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee\MSC\mcmscsvc.exe
PRC - [2010/04/12 17:29:28 | 000,023,328 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Java\jre6\bin\jp2launcher.exe
PRC - [2010/04/12 17:29:25 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Java\jre6\bin\java.exe
PRC - [2009/10/29 07:54:44 | 001,218,008 | —- | M] (McAfee, Inc.) – c:\Program Files\McAfee.com\Agent\mcagent.exe
PRC - [2009/10/27 12:19:46 | 000,895,696 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee\MPF\MpfSrv.exe
PRC - [2008/10/29 07:29:41 | 002,927,104 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
========== Modules (SafeList) ==========
MOD - [2010/07/27 21:36:37 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\tom\Desktop\OTL.exe
MOD - [2008/01/19 08:33:00 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msscript.ocx
MOD - [2008/01/19 08:26:34 | 001,684,480 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll
========== Win32 Services (SafeList) ==========
SRV - [2010/07/20 16:45:01 | 000,030,192 | —- | M] (Google) [On_Demand | Stopped] – C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe – (GoogleDesktopManager-051210-111108)
SRV - [2010/06/10 06:58:32 | 000,865,832 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\McAfee\MSC\mcmscsvc.exe – (mcmscsvc)
SRV - [2010/03/26 11:16:04 | 000,093,320 | —- | M] (McAfee, Inc.) [Auto | Stopped] – C:\Program Files\McAfee\SiteAdvisor\McSACore.exe – (McAfee SiteAdvisor Service)
SRV - [2010/03/18 13:16:28 | 000,753,504 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe – (WPFFontCache_v0400)
SRV - [2010/03/18 13:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2009/10/27 12:19:46 | 000,895,696 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\McAfee\MPF\MPFSrv.exe – (MpfService)
SRV - [2009/09/16 11:23:32 | 000,365,072 | —- | M] (McAfee, Inc.) [On_Demand | Stopped] – C:\Program Files\McAfee\VirusScan\mcods.exe – (McODS)
SRV - [2009/09/16 10:22:08 | 000,144,704 | —- | M] (McAfee, Inc.) [Unknown | Stopped] – C:\Program Files\McAfee\VirusScan\Mcshield.exe – (McShield)
SRV - [2009/09/16 09:28:38 | 000,606,736 | —- | M] (McAfee, Inc.) [On_Demand | Stopped] – C:\Program Files\McAfee\VirusScan\mcsysmon.exe – (McSysmon)
SRV - [2009/07/08 14:48:48 | 000,026,640 | —- | M] (McAfee, Inc.) [Auto | Stopped] – C:\Program Files\McAfee\MSK\MskSrver.exe – (MSK80Service)
SRV - [2009/07/08 11:54:34 | 000,359,952 | —- | M] (McAfee, Inc.) [Auto | Stopped] – c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe – (McProxy)
SRV - [2009/07/07 19:10:02 | 002,482,848 | —- | M] (McAfee, Inc.) [Auto | Stopped] – c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe – (McNASvc)
SRV - [2008/01/19 08:38:24 | 000,272,952 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2007/09/07 19:25:12 | 000,102,400 | —- | M] (IDT, Inc.) [Auto | Stopped] – C:\Windows\System32\stacsv.exe – (STacSV)
SRV - [2007/08/29 22:25:16 | 000,073,728 | —- | M] (Andrea Electronics Corporation) [Auto | Stopped] – C:\Windows\System32\AEstSrv.exe – (AESTFilters)
SRV - [2007/05/31 10:21:24 | 000,379,784 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\WindowsMobile\wcescomm.dll – (WcesComm)
SRV - [2007/05/31 10:21:18 | 000,183,688 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\WindowsMobile\rapimgr.dll – (RapiMgr)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\System32\DRIVERS\nwlnkfwd.sys – (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\System32\DRIVERS\nwlnkflt.sys – (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\System32\DRIVERS\ipinip.sys – (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] – C:\Windows\System32\drivers\blbdrive.sys – (blbdrive)
DRV - [2010/07/15 15:18:22 | 000,130,424 | —- | M] (McAfee, Inc.) [Kernel | System | Running] – C:\Windows\System32\drivers\Mpfp.sys – (MPFP)
DRV - [2009/09/16 10:22:48 | 000,214,664 | —- | M] (McAfee, Inc.) [Kernel | System | Stopped] – C:\Windows\System32\drivers\mfehidk.sys – (mfehidk)
DRV - [2009/09/16 10:22:48 | 000,079,816 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mfeavfk.sys – (mfeavfk)
DRV - [2009/09/16 10:22:48 | 000,040,552 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mfesmfk.sys – (mfesmfk)
DRV - [2009/09/16 10:22:48 | 000,035,272 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mfebopk.sys – (mfebopk)
DRV - [2009/09/16 10:22:14 | 000,034,248 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mferkdk.sys – (mferkdk)
DRV - [2008/02/02 23:43:17 | 000,020,152 | —- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\viaide.sys – (viaide)
DRV - [2008/02/02 23:43:17 | 000,019,128 | —- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\cmdide.sys – (cmdide)
DRV - [2008/02/02 23:43:17 | 000,017,592 | —- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\aliide.sys – (aliide)
DRV - [2007/09/26 11:47:24 | 001,899,008 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\igdkmd32.sys – (igfx)
DRV - [2007/09/24 10:27:26 | 000,155,136 | —- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\Apfiltr.sys – (ApfiltrService)
DRV - [2007/09/07 19:26:04 | 000,330,240 | —- | M] (IDT, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\stwrt.sys – (STHDA)
DRV - [2007/03/21 20:33:54 | 000,534,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\BCMWL6.SYS – (BCM43XX)
DRV - [2007/02/12 22:36:54 | 000,277,784 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\Windows\system32\drivers\iastor.sys – (iaStor)
DRV - [2006/11/27 08:48:46 | 000,037,376 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rixdptsk.sys – (rismxdp)
DRV - [2006/11/27 08:48:44 | 000,043,520 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rimsptsk.sys – (rimsptsk)
DRV - [2006/11/27 08:48:44 | 000,032,256 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rimmptsk.sys – (rimmptsk)
DRV - [2006/11/21 13:25:44 | 000,045,568 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\bcm4sbxp.sys – (bcm4sbxp)
DRV - [2006/11/03 03:43:30 | 000,986,624 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\HSX_DPV.sys – (HSF_DPV)
DRV - [2006/11/03 03:42:18 | 000,206,848 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\HSXHWAZL.sys – (HSXHWAZL)
DRV - [2006/11/03 03:42:08 | 000,659,968 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\HSX_CNXT.sys – (winachsf)
DRV - [2006/11/02 10:51:45 | 000,900,712 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ql2300.sys – (ql2300)
DRV - [2006/11/02 10:51:38 | 000,420,968 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adp94xx.sys – (adp94xx)
DRV - [2006/11/02 10:51:34 | 000,316,520 | —- | M] (Emulex) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\elxstor.sys – (elxstor)
DRV - [2006/11/02 10:51:32 | 000,297,576 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpahci.sys – (adpahci)
DRV - [2006/11/02 10:51:25 | 000,235,112 | —- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\uliahci.sys – (uliahci)
DRV - [2006/11/02 10:51:25 | 000,232,040 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\Windows\system32\drivers\iastorv.sys – (iaStorV)
DRV - [2006/11/02 10:51:00 | 000,147,048 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpu320.sys – (adpu320)
DRV - [2006/11/02 10:50:45 | 000,115,816 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ulsata2.sys – (ulsata2)
DRV - [2006/11/02 10:50:41 | 000,112,232 | —- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\vsmraid.sys – (vsmraid)
DRV - [2006/11/02 10:50:35 | 000,106,088 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ql40xx.sys – (ql40xx)
DRV - [2006/11/02 10:50:35 | 000,098,408 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ulsata.sys – (UlSata)
DRV - [2006/11/02 10:50:35 | 000,098,408 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpu160m.sys – (adpu160m)
DRV - [2006/11/02 10:50:24 | 000,088,680 | —- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nvraid.sys – (nvraid)
DRV - [2006/11/02 10:50:19 | 000,045,160 | —- | M] (IBM Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nfrd960.sys – (nfrd960)
DRV - [2006/11/02 10:50:17 | 000,041,576 | —- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iirsp.sys – (iirsp)
DRV - [2006/11/02 10:50:16 | 000,071,784 | —- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sisraid4.sys – (SiSRaid4)
DRV - [2006/11/02 10:50:13 | 000,040,040 | —- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nvstor.sys – (nvstor)
DRV - [2006/11/02 10:50:11 | 000,071,272 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\djsvs.sys – (aic78xx)
DRV - [2006/11/02 10:50:10 | 000,067,688 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\arcsas.sys – (arcsas)
DRV - [2006/11/02 10:50:10 | 000,065,640 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_scsi.sys – (LSI_SCSI)
DRV - [2006/11/02 10:50:10 | 000,038,504 | —- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sisraid2.sys – (SiSRaid2)
DRV - [2006/11/02 10:50:10 | 000,037,480 | —- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\hpcisss.sys – (HpCISSs)
DRV - [2006/11/02 10:50:09 | 000,067,688 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\arc.sys – (arc)
DRV - [2006/11/02 10:50:09 | 000,035,944 | —- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iteraid.sys – (iteraid)
DRV - [2006/11/02 10:50:07 | 000,035,944 | —- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iteatapi.sys – (iteatapi)
DRV - [2006/11/02 10:50:05 | 000,065,640 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_sas.sys – (LSI_SAS)
DRV - [2006/11/02 10:50:05 | 000,035,944 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\symc8xx.sys – (Symc8xx)
DRV - [2006/11/02 10:50:04 | 000,065,640 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_fc.sys – (LSI_FC)
DRV - [2006/11/02 10:50:03 | 000,034,920 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sym_u3.sys – (Sym_u3)
DRV - [2006/11/02 10:49:59 | 000,033,384 | —- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\mraid35x.sys – (Mraid35x)
DRV - [2006/11/02 10:49:56 | 000,031,848 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sym_hi.sys – (Sym_hi)
DRV - [2006/11/02 10:49:53 | 000,028,776 | —- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\megasas.sys – (megasas)
DRV - [2006/11/02 09:25:24 | 000,071,808 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brserid.sys – (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 09:24:47 | 000,011,904 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brusbser.sys – (BrUsbSer)
DRV - [2006/11/02 09:24:46 | 000,005,248 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brfiltup.sys – (BrFiltUp)
DRV - [2006/11/02 09:24:45 | 000,013,568 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brfiltlo.sys – (BrFiltLo)
DRV - [2006/11/02 09:24:44 | 000,062,336 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brserwdm.sys – (BrSerWdm)
DRV - [2006/11/02 09:24:44 | 000,012,160 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brusbmdm.sys – (BrUsbMdm)
DRV - [2006/11/02 08:36:50 | 000,020,608 | —- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ntrigdigi.sys – (ntrigdigi)
DRV - [2006/11/02 08:36:43 | 002,028,032 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\atikmdag.sys – (R300)
DRV - [2006/11/02 08:30:55 | 000,200,704 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\e1e6032.sys – (e1express) Intel®
DRV - [2006/11/02 08:30:54 | 000,117,760 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\E1G60I32.sys – (E1G60) Intel®
DRV - [2006/08/05 01:39:10 | 000,008,192 | —- | M] (Conexant Systems, Inc.) [Kernel | Auto | Stopped] – C:\Windows\System32\drivers\XAudio.sys – (XAudio)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://inboxtoolbar.com/help/sa_customize.aspx?tbid=80150
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://inboxtoolbar.com/search/ie.aspx?tbid=80150
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\..\URLSearchHook: {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/07/04 19:13:38 | 000,000,000 | —D | M]
O1 HOSTS File: ([2006/09/18 22:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\McAfee\MSK\mskapbho.dll ()
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O2 - BHO: () - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O2 - BHO: () - {DB35C569-5624-4CFC-8043-E5139F55A073} - C:\Program Files\Crawler\Shared\CShared.dll (Crawler.com)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (&Inbox Toolbar) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [BTHelena_McciTrayApp] C:\Program Files\BBDesktopHelpUpgradeAdvisor\McciTrayApp.exe (Motive Communications, Inc.)
O4 - HKLM..\Run: [CSmileys] C:\Program Files\Crawler\Smileys\CSmileysIM.exe (Crawler.com)
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe File not found
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (Macrovision Corporation)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [PCMService] C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [{233F3715-8B38-CA66-A4CA-35E43239075A}] C:\Users\tom\AppData\Roaming\Inza\yxiqu.exe ()
O4 - HKCU..\Run: [CSmileys] C:\Program Files\Crawler\Smileys\CSmileysIM.exe (Crawler.com)
O4 - HKCU..\Run: [QNB2EB90WX] C:\Users\tom\AppData\Local\Temp\Szp.exe File not found
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\RunOnce: [755456660] C:\Users\tom\AppData\Local\755456660.exe ()
O4 - Startup: C:\Users\tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Media Player.lnk = C:\Program Files\Adobe Media Player\Adobe Media Player.exe ()
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\inbox {37540F19-DD4C-478B-B2DF-C19281BCAF27} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Filter\application/x-internet-signup {A173B69A-1F9B-4823-9FDA-412F641E65D6} - C:\Program Files\Tiscali\Tiscali Internet\dlls\tiscalifilter.dll ()
O18 - Protocol\Filter\x-sdch - No CLSID value found
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - File not found
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img22.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img22.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2010/07/27 21:37:54 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\tom\Desktop\HiJackThis.exe
[2010/07/27 21:36:30 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Users\tom\Desktop\OTL.exe
[2010/07/27 16:30:27 | 000,000,000 | —D | C] – C:\Windows\Sun
[2010/07/27 12:41:24 | 000,000,000 | —D | C] – C:\Users\tom\AppData\Roaming\Malwarebytes
[2010/07/27 12:41:16 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/07/27 12:41:15 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/07/27 12:41:15 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/07/27 12:41:14 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/07/19 22:42:25 | 000,000,000 | —D | C] – C:\Program Files\NoAdware5.0
[2010/07/13 16:50:46 | 000,000,000 | —D | C] – C:\Users\tom\AppData\Local\{66E10716-938F-4CD2-9D89-FC086088602B}
[2010/07/04 19:03:09 | 000,000,000 | —D | C] – C:\Windows\49FA793C785E47E993DFBD442B0B45D1.TMP
[2010/07/04 19:03:03 | 000,000,000 | —D | C] – C:\Windows\8F1A20DC251D47B091B7DCA2523EE6C9.TMP
[2010/06/30 10:19:23 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2010/07/27 21:42:47 | 002,359,296 | -HS- | M] () – C:\Users\tom\ntuser.dat
[2010/07/27 21:38:09 | 000,359,929 | —- | M] () – C:\Users\tom\Desktop\dds.scr
[2010/07/27 21:37:56 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\tom\Desktop\HiJackThis.exe
[2010/07/27 21:36:37 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\tom\Desktop\OTL.exe
[2010/07/27 21:33:10 | 000,017,249 | —- | M] () – C:\Users\tom\Documents\virusfile.html
[2010/07/27 16:30:27 | 000,006,540 | —- | M] () – C:\Users\tom\AppData\Local\d3d9caps.dat
[2010/07/27 16:24:31 | 000,027,461 | —- | M] () – C:\Windows\System32\Config.MPF
[2010/07/27 16:12:35 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/07/27 16:11:31 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/07/27 16:11:31 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/07/27 16:11:22 | 000,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2010/07/27 16:11:21 | 000,008,212 | —- | M] () – C:\Windows\mfebcdata
[2010/07/27 16:11:21 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/07/27 16:11:17 | 000,524,288 | -HS- | M] () – C:\Users\tom\ntuser.dat{4a06b48e-98a4-11df-a753-93f7887e72aa}.TMContainer00000000000000000001.regtrans-ms
[2010/07/27 16:11:17 | 000,065,536 | -HS- | M] () – C:\Users\tom\ntuser.dat{4a06b48e-98a4-11df-a753-93f7887e72aa}.TM.blf
[2010/07/27 16:11:11 | 002,688,644 | -H– | M] () – C:\Users\tom\AppData\Local\IconCache.db
[2010/07/27 16:11:06 | 000,000,878 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/27 16:11:00 | 000,000,874 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/27 15:52:02 | 000,000,278 | -H– | M] () – C:\Windows\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2010/07/27 15:42:28 | 000,000,890 | —- | M] () – C:\Users\tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Media Player.lnk
[2010/07/27 15:39:36 | 000,613,338 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/07/27 15:39:36 | 000,110,616 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/07/27 15:39:35 | 000,709,582 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/07/27 15:37:03 | 000,000,868 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2010/07/27 15:18:00 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1750052908-3844407195-769297430-1000UA.job
[2010/07/27 12:41:18 | 000,000,820 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/27 12:36:53 | 000,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
[2010/07/26 22:17:17 | 000,524,288 | -HS- | M] () – C:\Users\tom\ntuser.dat{4a06b48e-98a4-11df-a753-93f7887e72aa}.TMContainer00000000000000000002.regtrans-ms
[2010/07/26 19:51:19 | 001,180,672 | —- | M] () – C:\Users\tom\AppData\Local\755456660.exe
[2010/07/26 16:18:00 | 000,000,846 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1750052908-3844407195-769297430-1000Core.job
[2010/07/26 12:22:36 | 000,524,288 | -HS- | M] () – C:\Users\tom\ntuser.dat{c837a10e-8ff0-11df-a6df-9c29fc9287a8}.TMContainer00000000000000000001.regtrans-ms
[2010/07/26 12:22:36 | 000,065,536 | -HS- | M] () – C:\Users\tom\ntuser.dat{c837a10e-8ff0-11df-a6df-9c29fc9287a8}.TM.blf
[2010/07/24 09:19:25 | 000,002,034 | —- | M] () – C:\Users\tom\Desktop\Google Chrome.lnk
[2010/07/24 09:19:25 | 000,001,996 | —- | M] () – C:\Users\tom\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/07/19 22:44:55 | 000,000,834 | —- | M] () – C:\Users\tom\Desktop\NoAdware.lnk
[2010/07/19 22:22:18 | 186,322,975 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/07/15 15:18:22 | 000,130,424 | —- | M] (McAfee, Inc.) – C:\Windows\System32\drivers\Mpfp.sys
[2010/07/15 11:45:58 | 000,524,288 | -HS- | M] () – C:\Users\tom\ntuser.dat{c837a10e-8ff0-11df-a6df-9c29fc9287a8}.TMContainer00000000000000000002.regtrans-ms
[2010/07/15 11:02:28 | 000,006,786 | —- | M] () – C:\Users\tom\Documents\TC 2009 CV.rtf
[2010/07/15 10:39:57 | 000,000,118 | —- | M] () – C:\Windows\System32\MRT.INI
[2010/07/15 10:14:33 | 000,524,288 | -HS- | M] () – C:\Users\tom\ntuser.dat{c817bf46-d06f-11de-82e3-001d09c73bc2}.TMContainer00000000000000000001.regtrans-ms
[2010/07/15 10:14:33 | 000,065,536 | -HS- | M] () – C:\Users\tom\ntuser.dat{c817bf46-d06f-11de-82e3-001d09c73bc2}.TM.blf
[2010/07/14 19:15:58 | 000,000,120 | —- | M] () – C:\Users\tom\AppData\Local\Lbijiro.dat
[2010/07/14 13:00:11 | 000,000,000 | —- | M] () – C:\Users\tom\AppData\Local\Bnenadujo.bin
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files Created - No Company Name ==========
[2010/07/27 21:38:07 | 000,359,929 | —- | C] () – C:\Users\tom\Desktop\dds.scr
[2010/07/27 21:33:10 | 000,017,249 | —- | C] () – C:\Users\tom\Documents\virusfile.html
[2010/07/27 16:11:21 | 000,008,212 | —- | C] () – C:\Windows\mfebcdata
[2010/07/27 12:41:18 | 000,000,820 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/27 12:36:53 | 000,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
[2010/07/26 19:51:19 | 001,180,672 | —- | C] () – C:\Users\tom\AppData\Local\755456660.exe
[2010/07/26 12:25:47 | 000,524,288 | -HS- | C] () – C:\Users\tom\ntuser.dat{4a06b48e-98a4-11df-a753-93f7887e72aa}.TMContainer00000000000000000002.regtrans-ms
[2010/07/26 12:25:47 | 000,524,288 | -HS- | C] () – C:\Users\tom\ntuser.dat{4a06b48e-98a4-11df-a753-93f7887e72aa}.TMContainer00000000000000000001.regtrans-ms
[2010/07/26 12:25:47 | 000,065,536 | -HS- | C] () – C:\Users\tom\ntuser.dat{4a06b48e-98a4-11df-a753-93f7887e72aa}.TM.blf
[2010/07/19 22:42:26 | 000,000,834 | —- | C] () – C:\Users\tom\Desktop\NoAdware.lnk
[2010/07/15 10:39:57 | 000,000,118 | —- | C] () – C:\Windows\System32\MRT.INI
[2010/07/15 10:20:17 | 000,524,288 | -HS- | C] () – C:\Users\tom\ntuser.dat{c837a10e-8ff0-11df-a6df-9c29fc9287a8}.TMContainer00000000000000000002.regtrans-ms
[2010/07/15 10:20:17 | 000,524,288 | -HS- | C] () – C:\Users\tom\ntuser.dat{c837a10e-8ff0-11df-a6df-9c29fc9287a8}.TMContainer00000000000000000001.regtrans-ms
[2010/07/15 10:20:17 | 000,065,536 | -HS- | C] () – C:\Users\tom\ntuser.dat{c837a10e-8ff0-11df-a6df-9c29fc9287a8}.TM.blf
[2010/07/13 16:50:53 | 000,000,000 | —- | C] () – C:\Users\tom\AppData\Local\Bnenadujo.bin
[2010/07/13 16:50:51 | 000,000,120 | —- | C] () – C:\Users\tom\AppData\Local\Lbijiro.dat
[2010/06/28 15:24:58 | 000,000,278 | -H– | C] () – C:\Windows\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2008/02/02 23:43:52 | 001,238,832 | —- | C] () – C:\Windows\System32\igmedkrn.dll
[2008/02/02 23:43:52 | 000,249,856 | —- | C] () – C:\Windows\System32\igfxTMM.dll
[2008/02/02 23:43:52 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1322.dll
[2008/02/02 23:43:52 | 000,104,636 | —- | C] () – C:\Windows\System32\igmedcompkrn.dll
[2008/02/02 23:43:45 | 000,016,480 | —- | C] () – C:\Windows\System32\rixdicon.dll
[2008/02/02 16:07:58 | 000,065,536 | —- | C] () – C:\Windows\System32\bcmwlrmt.dll
[2006/11/07 20:25:58 | 000,000,000 | —- | C] () – C:\Windows\System32\px.ini
[2006/11/02 13:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 11:25:44 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/11/02 08:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/09/17 00:36:50 | 000,520,192 | —- | C] () – C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006/09/17 00:36:50 | 000,204,800 | —- | C] () – C:\Windows\System32\CddbFileTaggerRoxio.dll
========== Alternate Data Streams ==========
@Alternate Data Stream - 76 bytes -> C:\Users\tom\Documents\Downloads:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\tom\Desktop\Adobe Reader 9 Installer:Roxio EMC Stream
@Alternate Data Stream - 1005 bytes -> C:\Users\tom\Documents\Gateway Enrolment Notification.eml:OECustomProperty
< End of report >
SRV - [2010/07/20 16:45:01 | 000,030,192 | —- | M] (Google) [On_Demand | Stopped] – C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe – (GoogleDesktopManager-051210-111108)
SRV - [2010/06/10 06:58:32 | 000,865,832 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\McAfee\MSC\mcmscsvc.exe – (mcmscsvc)
SRV - [2010/03/26 11:16:04 | 000,093,320 | —- | M] (McAfee, Inc.) [Auto | Stopped] – C:\Program Files\McAfee\SiteAdvisor\McSACore.exe – (McAfee SiteAdvisor Service)
SRV - [2010/03/18 13:16:28 | 000,753,504 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe – (WPFFontCache_v0400)
SRV - [2010/03/18 13:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2009/10/27 12:19:46 | 000,895,696 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\McAfee\MPF\MPFSrv.exe – (MpfService)
SRV - [2009/09/16 11:23:32 | 000,365,072 | —- | M] (McAfee, Inc.) [On_Demand | Stopped] – C:\Program Files\McAfee\VirusScan\mcods.exe – (McODS)
SRV - [2009/09/16 10:22:08 | 000,144,704 | —- | M] (McAfee, Inc.) [Unknown | Stopped] – C:\Program Files\McAfee\VirusScan\Mcshield.exe – (McShield)
SRV - [2009/09/16 09:28:38 | 000,606,736 | —- | M] (McAfee, Inc.) [On_Demand | Stopped] – C:\Program Files\McAfee\VirusScan\mcsysmon.exe – (McSysmon)
SRV - [2009/07/08 14:48:48 | 000,026,640 | —- | M] (McAfee, Inc.) [Auto | Stopped] – C:\Program Files\McAfee\MSK\MskSrver.exe – (MSK80Service)
SRV - [2009/07/08 11:54:34 | 000,359,952 | —- | M] (McAfee, Inc.) [Auto | Stopped] – c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe – (McProxy)
SRV - [2009/07/07 19:10:02 | 002,482,848 | —- | M] (McAfee, Inc.) [Auto | Stopped] – c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe – (McNASvc)
SRV - [2008/01/19 08:38:24 | 000,272,952 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2007/09/07 19:25:12 | 000,102,400 | —- | M] (IDT, Inc.) [Auto | Stopped] – C:\Windows\System32\stacsv.exe – (STacSV)
SRV - [2007/08/29 22:25:16 | 000,073,728 | —- | M] (Andrea Electronics Corporation) [Auto | Stopped] – C:\Windows\System32\AEstSrv.exe – (AESTFilters)
SRV - [2007/05/31 10:21:24 | 000,379,784 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\WindowsMobile\wcescomm.dll – (WcesComm)
SRV - [2007/05/31 10:21:18 | 000,183,688 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\WindowsMobile\rapimgr.dll – (RapiMgr)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\System32\DRIVERS\nwlnkfwd.sys – (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\System32\DRIVERS\nwlnkflt.sys – (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\System32\DRIVERS\ipinip.sys – (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] – C:\Windows\System32\drivers\blbdrive.sys – (blbdrive)
DRV - [2010/07/15 15:18:22 | 000,130,424 | —- | M] (McAfee, Inc.) [Kernel | System | Running] – C:\Windows\System32\drivers\Mpfp.sys – (MPFP)
DRV - [2009/09/16 10:22:48 | 000,214,664 | —- | M] (McAfee, Inc.) [Kernel | System | Stopped] – C:\Windows\System32\drivers\mfehidk.sys – (mfehidk)
DRV - [2009/09/16 10:22:48 | 000,079,816 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mfeavfk.sys – (mfeavfk)
DRV - [2009/09/16 10:22:48 | 000,040,552 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mfesmfk.sys – (mfesmfk)
DRV - [2009/09/16 10:22:48 | 000,035,272 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mfebopk.sys – (mfebopk)
DRV - [2009/09/16 10:22:14 | 000,034,248 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mferkdk.sys – (mferkdk)
DRV - [2008/02/02 23:43:17 | 000,020,152 | —- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\viaide.sys – (viaide)
DRV - [2008/02/02 23:43:17 | 000,019,128 | —- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\cmdide.sys – (cmdide)
DRV - [2008/02/02 23:43:17 | 000,017,592 | —- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\aliide.sys – (aliide)
DRV - [2007/09/26 11:47:24 | 001,899,008 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\igdkmd32.sys – (igfx)
DRV - [2007/09/24 10:27:26 | 000,155,136 | —- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\Apfiltr.sys – (ApfiltrService)
DRV - [2007/09/07 19:26:04 | 000,330,240 | —- | M] (IDT, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\stwrt.sys – (STHDA)
DRV - [2007/03/21 20:33:54 | 000,534,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\BCMWL6.SYS – (BCM43XX)
DRV - [2007/02/12 22:36:54 | 000,277,784 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\Windows\system32\drivers\iastor.sys – (iaStor)
DRV - [2006/11/27 08:48:46 | 000,037,376 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rixdptsk.sys – (rismxdp)
DRV - [2006/11/27 08:48:44 | 000,043,520 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rimsptsk.sys – (rimsptsk)
DRV - [2006/11/27 08:48:44 | 000,032,256 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rimmptsk.sys – (rimmptsk)
DRV - [2006/11/21 13:25:44 | 000,045,568 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\bcm4sbxp.sys – (bcm4sbxp)
DRV - [2006/11/03 03:43:30 | 000,986,624 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\HSX_DPV.sys – (HSF_DPV)
DRV - [2006/11/03 03:42:18 | 000,206,848 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\HSXHWAZL.sys – (HSXHWAZL)
DRV - [2006/11/03 03:42:08 | 000,659,968 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\HSX_CNXT.sys – (winachsf)
DRV - [2006/11/02 10:51:45 | 000,900,712 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ql2300.sys – (ql2300)
DRV - [2006/11/02 10:51:38 | 000,420,968 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adp94xx.sys – (adp94xx)
DRV - [2006/11/02 10:51:34 | 000,316,520 | —- | M] (Emulex) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\elxstor.sys – (elxstor)
DRV - [2006/11/02 10:51:32 | 000,297,576 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpahci.sys – (adpahci)
DRV - [2006/11/02 10:51:25 | 000,235,112 | —- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\uliahci.sys – (uliahci)
DRV - [2006/11/02 10:51:25 | 000,232,040 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\Windows\system32\drivers\iastorv.sys – (iaStorV)
DRV - [2006/11/02 10:51:00 | 000,147,048 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpu320.sys – (adpu320)
DRV - [2006/11/02 10:50:45 | 000,115,816 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ulsata2.sys – (ulsata2)
DRV - [2006/11/02 10:50:41 | 000,112,232 | —- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\vsmraid.sys – (vsmraid)
DRV - [2006/11/02 10:50:35 | 000,106,088 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ql40xx.sys – (ql40xx)
DRV - [2006/11/02 10:50:35 | 000,098,408 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ulsata.sys – (UlSata)
DRV - [2006/11/02 10:50:35 | 000,098,408 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpu160m.sys – (adpu160m)
DRV - [2006/11/02 10:50:24 | 000,088,680 | —- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nvraid.sys – (nvraid)
DRV - [2006/11/02 10:50:19 | 000,045,160 | —- | M] (IBM Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nfrd960.sys – (nfrd960)
DRV - [2006/11/02 10:50:17 | 000,041,576 | —- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iirsp.sys – (iirsp)
DRV - [2006/11/02 10:50:16 | 000,071,784 | —- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sisraid4.sys – (SiSRaid4)
DRV - [2006/11/02 10:50:13 | 000,040,040 | —- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nvstor.sys – (nvstor)
DRV - [2006/11/02 10:50:11 | 000,071,272 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\djsvs.sys – (aic78xx)
DRV - [2006/11/02 10:50:10 | 000,067,688 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\arcsas.sys – (arcsas)
DRV - [2006/11/02 10:50:10 | 000,065,640 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_scsi.sys – (LSI_SCSI)
DRV - [2006/11/02 10:50:10 | 000,038,504 | —- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sisraid2.sys – (SiSRaid2)
DRV - [2006/11/02 10:50:10 | 000,037,480 | —- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\hpcisss.sys – (HpCISSs)
DRV - [2006/11/02 10:50:09 | 000,067,688 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\arc.sys – (arc)
DRV - [2006/11/02 10:50:09 | 000,035,944 | —- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iteraid.sys – (iteraid)
DRV - [2006/11/02 10:50:07 | 000,035,944 | —- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iteatapi.sys – (iteatapi)
DRV - [2006/11/02 10:50:05 | 000,065,640 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_sas.sys – (LSI_SAS)
DRV - [2006/11/02 10:50:05 | 000,035,944 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\symc8xx.sys – (Symc8xx)
DRV - [2006/11/02 10:50:04 | 000,065,640 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_fc.sys – (LSI_FC)
DRV - [2006/11/02 10:50:03 | 000,034,920 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sym_u3.sys – (Sym_u3)
DRV - [2006/11/02 10:49:59 | 000,033,384 | —- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\mraid35x.sys – (Mraid35x)
DRV - [2006/11/02 10:49:56 | 000,031,848 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sym_hi.sys – (Sym_hi)
DRV - [2006/11/02 10:49:53 | 000,028,776 | —- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\megasas.sys – (megasas)
DRV - [2006/11/02 09:25:24 | 000,071,808 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brserid.sys – (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 09:24:47 | 000,011,904 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brusbser.sys – (BrUsbSer)
DRV - [2006/11/02 09:24:46 | 000,005,248 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brfiltup.sys – (BrFiltUp)
DRV - [2006/11/02 09:24:45 | 000,013,568 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brfiltlo.sys – (BrFiltLo)
DRV - [2006/11/02 09:24:44 | 000,062,336 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brserwdm.sys – (BrSerWdm)
DRV - [2006/11/02 09:24:44 | 000,012,160 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brusbmdm.sys – (BrUsbMdm)
DRV - [2006/11/02 08:36:50 | 000,020,608 | —- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ntrigdigi.sys – (ntrigdigi)
DRV - [2006/11/02 08:36:43 | 002,028,032 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\atikmdag.sys – (R300)
DRV - [2006/11/02 08:30:55 | 000,200,704 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\e1e6032.sys – (e1express) Intel®
DRV - [2006/11/02 08:30:54 | 000,117,760 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\E1G60I32.sys – (E1G60) Intel®
DRV - [2006/08/05 01:39:10 | 000,008,192 | —- | M] (Conexant Systems, Inc.) [Kernel | Auto | Stopped] – C:\Windows\System32\drivers\XAudio.sys – (XAudio)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://inboxtoolbar.com/help/sa_customize.aspx?tbid=80150
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://inboxtoolbar.com/search/ie.aspx?tbid=80150
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\..\URLSearchHook: {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/07/04 19:13:38 | 000,000,000 | —D | M]
O1 HOSTS File: ([2006/09/18 22:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\McAfee\MSK\mskapbho.dll ()
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O2 - BHO: () - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O2 - BHO: () - {DB35C569-5624-4CFC-8043-E5139F55A073} - C:\Program Files\Crawler\Shared\CShared.dll (Crawler.com)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (&Inbox Toolbar) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [BTHelena_McciTrayApp] C:\Program Files\BBDesktopHelpUpgradeAdvisor\McciTrayApp.exe (Motive Communications, Inc.)
O4 - HKLM..\Run: [CSmileys] C:\Program Files\Crawler\Smileys\CSmileysIM.exe (Crawler.com)
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe File not found
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (Macrovision Corporation)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [PCMService] C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [{233F3715-8B38-CA66-A4CA-35E43239075A}] C:\Users\tom\AppData\Roaming\Inza\yxiqu.exe ()
O4 - HKCU..\Run: [CSmileys] C:\Program Files\Crawler\Smileys\CSmileysIM.exe (Crawler.com)
O4 - HKCU..\Run: [QNB2EB90WX] C:\Users\tom\AppData\Local\Temp\Szp.exe File not found
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\RunOnce: [755456660] C:\Users\tom\AppData\Local\755456660.exe ()
O4 - Startup: C:\Users\tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Media Player.lnk = C:\Program Files\Adobe Media Player\Adobe Media Player.exe ()
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\inbox {37540F19-DD4C-478B-B2DF-C19281BCAF27} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Filter\application/x-internet-signup {A173B69A-1F9B-4823-9FDA-412F641E65D6} - C:\Program Files\Tiscali\Tiscali Internet\dlls\tiscalifilter.dll ()
O18 - Protocol\Filter\x-sdch - No CLSID value found
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - File not found
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img22.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img22.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2010/07/27 21:37:54 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\tom\Desktop\HiJackThis.exe
[2010/07/27 21:36:30 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Users\tom\Desktop\OTL.exe
[2010/07/27 16:30:27 | 000,000,000 | —D | C] – C:\Windows\Sun
[2010/07/27 12:41:24 | 000,000,000 | —D | C] – C:\Users\tom\AppData\Roaming\Malwarebytes
[2010/07/27 12:41:16 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/07/27 12:41:15 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/07/27 12:41:15 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/07/27 12:41:14 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/07/19 22:42:25 | 000,000,000 | —D | C] – C:\Program Files\NoAdware5.0
[2010/07/13 16:50:46 | 000,000,000 | —D | C] – C:\Users\tom\AppData\Local\{66E10716-938F-4CD2-9D89-FC086088602B}
[2010/07/04 19:03:09 | 000,000,000 | —D | C] – C:\Windows\49FA793C785E47E993DFBD442B0B45D1.TMP
[2010/07/04 19:03:03 | 000,000,000 | —D | C] – C:\Windows\8F1A20DC251D47B091B7DCA2523EE6C9.TMP
[2010/06/30 10:19:23 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2010/07/27 21:42:47 | 002,359,296 | -HS- | M] () – C:\Users\tom\ntuser.dat
[2010/07/27 21:38:09 | 000,359,929 | —- | M] () – C:\Users\tom\Desktop\dds.scr
[2010/07/27 21:37:56 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\tom\Desktop\HiJackThis.exe
[2010/07/27 21:36:37 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\tom\Desktop\OTL.exe
[2010/07/27 21:33:10 | 000,017,249 | —- | M] () – C:\Users\tom\Documents\virusfile.html
[2010/07/27 16:30:27 | 000,006,540 | —- | M] () – C:\Users\tom\AppData\Local\d3d9caps.dat
[2010/07/27 16:24:31 | 000,027,461 | —- | M] () – C:\Windows\System32\Config.MPF
[2010/07/27 16:12:35 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/07/27 16:11:31 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/07/27 16:11:31 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/07/27 16:11:22 | 000,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2010/07/27 16:11:21 | 000,008,212 | —- | M] () – C:\Windows\mfebcdata
[2010/07/27 16:11:21 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/07/27 16:11:17 | 000,524,288 | -HS- | M] () – C:\Users\tom\ntuser.dat{4a06b48e-98a4-11df-a753-93f7887e72aa}.TMContainer00000000000000000001.regtrans-ms
[2010/07/27 16:11:17 | 000,065,536 | -HS- | M] () – C:\Users\tom\ntuser.dat{4a06b48e-98a4-11df-a753-93f7887e72aa}.TM.blf
[2010/07/27 16:11:11 | 002,688,644 | -H– | M] () – C:\Users\tom\AppData\Local\IconCache.db
[2010/07/27 16:11:06 | 000,000,878 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/27 16:11:00 | 000,000,874 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/27 15:52:02 | 000,000,278 | -H– | M] () – C:\Windows\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2010/07/27 15:42:28 | 000,000,890 | —- | M] () – C:\Users\tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Media Player.lnk
[2010/07/27 15:39:36 | 000,613,338 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/07/27 15:39:36 | 000,110,616 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/07/27 15:39:35 | 000,709,582 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/07/27 15:37:03 | 000,000,868 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2010/07/27 15:18:00 | 000,000,898 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1750052908-3844407195-769297430-1000UA.job
[2010/07/27 12:41:18 | 000,000,820 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/27 12:36:53 | 000,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
[2010/07/26 22:17:17 | 000,524,288 | -HS- | M] () – C:\Users\tom\ntuser.dat{4a06b48e-98a4-11df-a753-93f7887e72aa}.TMContainer00000000000000000002.regtrans-ms
[2010/07/26 19:51:19 | 001,180,672 | —- | M] () – C:\Users\tom\AppData\Local\755456660.exe
[2010/07/26 16:18:00 | 000,000,846 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1750052908-3844407195-769297430-1000Core.job
[2010/07/26 12:22:36 | 000,524,288 | -HS- | M] () – C:\Users\tom\ntuser.dat{c837a10e-8ff0-11df-a6df-9c29fc9287a8}.TMContainer00000000000000000001.regtrans-ms
[2010/07/26 12:22:36 | 000,065,536 | -HS- | M] () – C:\Users\tom\ntuser.dat{c837a10e-8ff0-11df-a6df-9c29fc9287a8}.TM.blf
[2010/07/24 09:19:25 | 000,002,034 | —- | M] () – C:\Users\tom\Desktop\Google Chrome.lnk
[2010/07/24 09:19:25 | 000,001,996 | —- | M] () – C:\Users\tom\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/07/19 22:44:55 | 000,000,834 | —- | M] () – C:\Users\tom\Desktop\NoAdware.lnk
[2010/07/19 22:22:18 | 186,322,975 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/07/15 15:18:22 | 000,130,424 | —- | M] (McAfee, Inc.) – C:\Windows\System32\drivers\Mpfp.sys
[2010/07/15 11:45:58 | 000,524,288 | -HS- | M] () – C:\Users\tom\ntuser.dat{c837a10e-8ff0-11df-a6df-9c29fc9287a8}.TMContainer00000000000000000002.regtrans-ms
[2010/07/15 11:02:28 | 000,006,786 | —- | M] () – C:\Users\tom\Documents\TC 2009 CV.rtf
[2010/07/15 10:39:57 | 000,000,118 | —- | M] () – C:\Windows\System32\MRT.INI
[2010/07/15 10:14:33 | 000,524,288 | -HS- | M] () – C:\Users\tom\ntuser.dat{c817bf46-d06f-11de-82e3-001d09c73bc2}.TMContainer00000000000000000001.regtrans-ms
[2010/07/15 10:14:33 | 000,065,536 | -HS- | M] () – C:\Users\tom\ntuser.dat{c817bf46-d06f-11de-82e3-001d09c73bc2}.TM.blf
[2010/07/14 19:15:58 | 000,000,120 | —- | M] () – C:\Users\tom\AppData\Local\Lbijiro.dat
[2010/07/14 13:00:11 | 000,000,000 | —- | M] () – C:\Users\tom\AppData\Local\Bnenadujo.bin
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files Created - No Company Name ==========
[2010/07/27 21:38:07 | 000,359,929 | —- | C] () – C:\Users\tom\Desktop\dds.scr
[2010/07/27 21:33:10 | 000,017,249 | —- | C] () – C:\Users\tom\Documents\virusfile.html
[2010/07/27 16:11:21 | 000,008,212 | —- | C] () – C:\Windows\mfebcdata
[2010/07/27 12:41:18 | 000,000,820 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/07/27 12:36:53 | 000,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
[2010/07/26 19:51:19 | 001,180,672 | —- | C] () – C:\Users\tom\AppData\Local\755456660.exe
[2010/07/26 12:25:47 | 000,524,288 | -HS- | C] () – C:\Users\tom\ntuser.dat{4a06b48e-98a4-11df-a753-93f7887e72aa}.TMContainer00000000000000000002.regtrans-ms
[2010/07/26 12:25:47 | 000,524,288 | -HS- | C] () – C:\Users\tom\ntuser.dat{4a06b48e-98a4-11df-a753-93f7887e72aa}.TMContainer00000000000000000001.regtrans-ms
[2010/07/26 12:25:47 | 000,065,536 | -HS- | C] () – C:\Users\tom\ntuser.dat{4a06b48e-98a4-11df-a753-93f7887e72aa}.TM.blf
[2010/07/19 22:42:26 | 000,000,834 | —- | C] () – C:\Users\tom\Desktop\NoAdware.lnk
[2010/07/15 10:39:57 | 000,000,118 | —- | C] () – C:\Windows\System32\MRT.INI
[2010/07/15 10:20:17 | 000,524,288 | -HS- | C] () – C:\Users\tom\ntuser.dat{c837a10e-8ff0-11df-a6df-9c29fc9287a8}.TMContainer00000000000000000002.regtrans-ms
[2010/07/15 10:20:17 | 000,524,288 | -HS- | C] () – C:\Users\tom\ntuser.dat{c837a10e-8ff0-11df-a6df-9c29fc9287a8}.TMContainer00000000000000000001.regtrans-ms
[2010/07/15 10:20:17 | 000,065,536 | -HS- | C] () – C:\Users\tom\ntuser.dat{c837a10e-8ff0-11df-a6df-9c29fc9287a8}.TM.blf
[2010/07/13 16:50:53 | 000,000,000 | —- | C] () – C:\Users\tom\AppData\Local\Bnenadujo.bin
[2010/07/13 16:50:51 | 000,000,120 | —- | C] () – C:\Users\tom\AppData\Local\Lbijiro.dat
[2010/06/28 15:24:58 | 000,000,278 | -H– | C] () – C:\Windows\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2008/02/02 23:43:52 | 001,238,832 | —- | C] () – C:\Windows\System32\igmedkrn.dll
[2008/02/02 23:43:52 | 000,249,856 | —- | C] () – C:\Windows\System32\igfxTMM.dll
[2008/02/02 23:43:52 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1322.dll
[2008/02/02 23:43:52 | 000,104,636 | —- | C] () – C:\Windows\System32\igmedcompkrn.dll
[2008/02/02 23:43:45 | 000,016,480 | —- | C] () – C:\Windows\System32\rixdicon.dll
[2008/02/02 16:07:58 | 000,065,536 | —- | C] () – C:\Windows\System32\bcmwlrmt.dll
[2006/11/07 20:25:58 | 000,000,000 | —- | C] () – C:\Windows\System32\px.ini
[2006/11/02 13:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 11:25:44 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/11/02 08:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/09/17 00:36:50 | 000,520,192 | —- | C] () – C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006/09/17 00:36:50 | 000,204,800 | —- | C] () – C:\Windows\System32\CddbFileTaggerRoxio.dll
========== Alternate Data Streams ==========
@Alternate Data Stream - 76 bytes -> C:\Users\tom\Documents\Downloads:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\tom\Desktop\Adobe Reader 9 Installer:Roxio EMC Stream
@Alternate Data Stream - 1005 bytes -> C:\Users\tom\Documents\Gateway Enrolment Notification.eml:OECustomProperty
< End of report >
DDS (Ver_09-06-26.01) - NTFSx86 NETWORK
Run by [removed] at 21:49:40.85 on 27/07/2010
Internet Explorer: 7.0.6001.18000
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.44.1033.18.2037.1117 [GMT 1:00]
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\Explorer.EXE
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Java\jre6\bin\jp2launcher.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Users\tom\AppData\Local\Temp\jkos-tom\binaries\ScanningProcess.exe
C:\Users\tom\AppData\Local\Temp\jkos-tom\binaries\ScanningProcess.exe
C:\Windows\notepad.exe
C:\Windows\notepad.exe
C:\Users\tom\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe
============== Pseudo HJT Report ===============
uLocal Page = \blank.htm
uStart Page = hxxp://www.google.co.uk/
uWindow Title = Internet Explorer provided by Dell
uSearch Bar = hxxp://inboxtoolbar.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=%tb_id&%language
uSearchURL,(Default) = hxxp://uk.search.yahoo.com/search?fr=mcafee&p=%s
mSearchAssistant = hxxp://inboxtoolbar.com/search/ie.aspx?tbid=80150
mCustomizeSearch = hxxp://inboxtoolbar.com/help/sa_customize.aspx?tbid=80150
uURLSearchHooks: N/A: {d3d233d5-9f6d-436c-b6c7-e63f77503b30} - c:\progra~1\inboxt~1\Inbox.dll
uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dll
BHO: : {d3d233d5-9f6d-436c-b6c7-e63f77503b30} - c:\progra~1\inboxt~1\Inbox.dll
BHO: : {db35c569-5624-4cfc-8043-e5139f55a073} - c:\progra~1\crawler\shared\CShared.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: &Inbox Toolbar: {d7e97865-918f-41e4-9cd0-25ab1c574ce8} - c:\progra~1\inboxt~1\Inbox.dll
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [Google Update] "c:\users\tom\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [CSmileys] "c:\program files\crawler\smileys\CSmileysIM.exe"
uRun: [{233F3715-8B38-CA66-A4CA-35E43239075A}] c:\users\tom\appdata\roaming\inza\yxiqu.exe
uRun: [QNB2EB90WX] c:\users\tom\appdata\local\temp\Szp.exe
uRun: [59bd25aa-ce9e-4677-ac13-c9c29895f59a_42] rundll32.exe "c:\users\tom\appdata\roaming\59bd25aa-ce9e-4677-ac13-c9c29895f59a_42.avi", start
uRunOnce: [755456660] "c:\users\tom\appdata\local\755456660.exe" 0 34
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [ECenter] c:\dell\e-center\EULALauncher.exe
mRun: [Apoint] c:\program files\delltpad\Apoint.exe
mRun: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: []
mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"
mRun: [PCMService] "c:\program files\dell\mediadirect\PCMService.exe"
mRun: [BTHelena_McciTrayApp] c:\program files\bbdesktophelpupgradeadvisor\McciTrayApp.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [CSmileys] "c:\program files\crawler\smileys\CSmileysIM.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
StartupFolder: c:\users\tom\appdata\roaming\micros~1\windows\startm~1\programs\startup\adobem~1.lnk - c:\program files\adobe media player\Adobe Media Player.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickset.lnk - c:\windows\installer\{7f0c4457-8e64-491b-8d7b-991504365d1e}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Filter: application/x-internet-signup - {A173B69A-1F9B-4823-9FDA-412F641E65D6} - c:\program files\tiscali\tiscali internet\dlls\tiscalifilter.dll
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: inbox - {37540F19-DD4C-478B-B2DF-C19281BCAF27} - c:\progra~1\inboxt~1\Inbox.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: c:\progra~1\google\google~2\GOEC62~1.DLL
============= SERVICES / DRIVERS ===============
S2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\AEstSrv.exe [2008-2-2 73728]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate1ca0dff3e0136e8;Google Update Service (gupdate1ca0dff3e0136e8);c:\program files\google\update\GoogleUpdate.exe [2009-7-26 133104]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2008-10-29 93320]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2008-2-2 30192]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
=============== Created Last 30 ================
2010-07-27 16:11 8,212 a——- c:\windows\mfebcdata
2010-07-27 12:41 –d—– c:\users\tom\appdata\roaming\Malwarebytes
2010-07-27 12:41 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-27 12:41 20,952 a——- c:\windows\system32\drivers\mbam.sys
2010-07-27 12:41 –d—– c:\programdata\Malwarebytes
2010-07-27 12:41 –d—– c:\progra~2\Malwarebytes
2010-07-27 12:41 –d—– c:\program files\Malwarebytes' Anti-Malware
2010-07-27 12:36 0 a—h— c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2010-07-19 22:42 –d—– c:\program files\NoAdware5.0
2010-07-15 10:39 118 a——- c:\windows\system32\MRT.INI
2010-07-04 19:03 –d—– c:\windows\49FA793C785E47E993DFBD442B0B45D1.TMP
2010-07-04 19:03 –d—– c:\windows\8F1A20DC251D47B091B7DCA2523EE6C9.TMP
==================== Find3M ====================
2010-07-15 15:18 130,424 a——- c:\windows\system32\drivers\Mpfp.sys
2010-05-26 17:16 34,304 a——- c:\windows\system32\atmlib.dll
2010-05-26 15:25 289,792 a——- c:\windows\system32\atmfd.dll
2010-05-21 14:14 221,568 ——– c:\windows\system32\MpSigStub.exe
2010-05-04 19:42 833,024 a——- c:\windows\system32\wininet.dll
2010-05-04 19:37 78,336 a——- c:\windows\system32\ieencode.dll
2010-05-04 17:53 26,624 a——- c:\windows\system32\ieUnatt.exe
2010-05-01 14:53 2,036,224 a——- c:\windows\system32\win32k.sys
2008-10-31 16:09 174 a–sh— c:\program files\desktop.ini
2008-10-31 16:00 143,360 a——- c:\windows\inf\infstrng.dat
2008-10-31 16:00 86,016 a——- c:\windows\inf\infstor.dat
2008-10-31 16:00 51,200 a——- c:\windows\inf\infpub.dat
2008-10-30 18:39 665,600 a——- c:\windows\inf\drvindex.dat
2008-03-21 16:25 61,480 a——- c:\users\tom\GoToAssistDownloadHelper.exe
2006-11-02 13:42 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 13:42 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 13:42 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 13:42 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 10:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 10:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 10:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 10:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat
2008-02-02 23:43 8,192 a–sh— c:\windows\users\default\NTUSER.DAT
============= FINISH: 21:51:42.46 ===============
