What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

I think I have a trojan virus

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hi, yesterday I was browsing the web and became suspicious of malware and decided to run some virus scans.I ran the usual Malware Bytes and Super Anti-Spyware.I also ran my avast virus scan and Dr.web cure-it,they all said my pc was clean.I then ran SDfix and it gave me a report saying 2 trojans found and that it was unable to remove them.I had a look for these trojans online and it said something about it being called sub-seven.
can anyone help? here is the results of the sdfix scan >
SDFix: Version 1.240
Run by [removed] on 03/09/2010 at 05:20

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:



Could Not Remove C:\WINDOWS\rundll16.exe
Could Not Remove C:\WINDOWS\rundl132.exe



Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-03 05:24:04
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden services & system hive …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
"C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"="C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe:*:Enabled:vsmon"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files :

C:\WINDOWS\rundll16.exe Found
C:\WINDOWS\rundl132.exe Found

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Sun 6 Jul 2008 147,456 …H. — "C:\b5f1b7c57c4314f7d02d1dba5776\amd64\filterpipelineprintproc.dll"
Sun 6 Jul 2008 748,032 …H. — "C:\b5f1b7c57c4314f7d02d1dba5776\amd64\mxdwdrv.dll"
Sun 6 Jul 2008 2,936,832 …H. — "C:\b5f1b7c57c4314f7d02d1dba5776\amd64\xpssvcs.dll"
Sun 6 Jul 2008 89,088 …H. — "C:\b5f1b7c57c4314f7d02d1dba5776\i386\filterpipelineprintproc.dll"
Sun 6 Jul 2008 765,440 …H. — "C:\b5f1b7c57c4314f7d02d1dba5776\i386\mxdwdrv.dll"
Sun 6 Jul 2008 1,676,288 …H. — "C:\b5f1b7c57c4314f7d02d1dba5776\i386\xpssvcs.dll"
Sun 8 Mar 2009 638,816 A.SH. — "C:\Program Files\Internet Explorer\iexplore.exe"
Mon 14 Apr 2008 1,695,232 ..SH. — "C:\Program Files\Messenger\msmsgs.exe"
Mon 14 Apr 2008 60,416 A.SH. — "C:\Program Files\Outlook Express\msimn.exe"
Wed 10 Feb 2010 1,977 …HR — "C:\Documents and Settings\AlistairGC\Application Data\SecuROM\UserData\securom_v7_01.bak"

Finished!
Post #2
Hi,

:welcome:

My name is NoodleTech. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
As I'm still in training at What The Tech, all my posts needs to be checked by an expert first. This may cause a delay, but I will do my best to keep it as short as possible.
Post #3
Hi, thanks for taking the time to help Noodletech.My PC has started going sluggish these last few days,slow to boot etc.As I said,I started to suspect malware and ran some scans and they all gave the all clear except for sdfix which reported two trojans.I then had a look for info online an got a bit worried as one of them shows as a back door trojan.Any help and info you could provide would be great thanks!
Post #4
Here are my OTL scan results >

OTL logfile created on: 05/09/2010 14:49:46 - Run 1
OTL by OldTimer - Version 3.2.11.0 Folder = C:\Documents and Settings\AlistairGC\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 84.00% Memory free
5.00 Gb Paging File | 5.00 Gb Available in Paging File | 93.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 204.50 Gb Free Space | 87.82% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ALISTAIR-DFB05C
Current User Name: AlistairGC
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\AlistairGC\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\HostsMan\hm.exe (abelhadigital.com)
PRC - C:\Program Files\HostsMan\hostssrv.exe (abelhadigital.com)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\RocketDock\RocketDock.exe ()


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\AlistairGC\My Documents\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\Program Files\RocketDock\RocketDock.dll ()


========== Win32 Services (SafeList) ==========

SRV - (gupdate) Google Update Service (gupdate) – C:\Program Files\Google\Update\GoogleUpdate.exe File not found
SRV - (nosGetPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper_3004.dll (NOS Microsystems Ltd.)
SRV - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (vsmon) – C:\WINDOWS\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
SRV - (getPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (PCPitstop Scheduling) – C:\Program Files\PCPitstop\PCPitstopScheduleService.exe (PC Pitstop LLC)


========== Driver Services (SafeList) ==========

DRV - (MEMSWEEP2) – C:\WINDOWS\System32\DE.tmp File not found
DRV - (catchme) – C:\DOCUME~1\ALISTA~1\LOCALS~1\Temp\catchme.sys File not found
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (ALWIL Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (ALWIL Software)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (PSI) – C:\WINDOWS\system32\drivers\psi_mf.sys (Secunia)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (vsdatant) – C:\WINDOWS\system32\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASENUM) – C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (Monfilt) – C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)
DRV - (Ambfilt) – C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)
DRV - (L6TPortGX) – C:\WINDOWS\system32\drivers\L6TPortGX.sys (Line 6)
DRV - (RTHDMIAzAudService) – C:\WINDOWS\system32\drivers\RtKHDMI.sys (Realtek Semiconductor Corp.)
DRV - (nvnetbus) – C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (EIO_XP) – C:\WINDOWS\system32\drivers\EIO_XP.sys (ASUSTeK Computer Inc.)
DRV - (MTsensor) – C:\WINDOWS\system32\drivers\ASACPI.sys ()
DRV - (SBKUPNT) – C:\WINDOWS\system32\drivers\SBKUPNT.SYS ()
DRV - (giveio) – C:\WINDOWS\system32\giveio.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://uk.msn.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = about:blank

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://uk.yahoo.com/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.2
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.1.30
FF - prefs.js..extensions.enabledItems: [removed]:1.0


FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/08/24 14:09:08 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/08/24 14:09:12 | 000,000,000 | —D | M]

[2010/02/02 00:25:23 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\Mozilla\Extensions
[2010/09/04 22:24:24 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\Mozilla\Firefox\Profiles\tz4zjgec.default\extensions
[2010/08/31 19:02:59 | 000,000,000 | —D | M] (FlashGot) – C:\Documents and Settings\AlistairGC\Application Data\Mozilla\Firefox\Profiles\tz4zjgec.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2010/08/18 05:33:01 | 000,000,000 | —D | M] (Adblock Plus) – C:\Documents and Settings\AlistairGC\Application Data\Mozilla\Firefox\Profiles\tz4zjgec.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/03/04 08:22:36 | 000,002,255 | —- | M] () – C:\Documents and Settings\AlistairGC\Application Data\Mozilla\Firefox\Profiles\tz4zjgec.default\searchplugins\askcom.xml
[2010/07/13 05:57:19 | 000,001,196 | —- | M] () – C:\Documents and Settings\AlistairGC\Application Data\Mozilla\Firefox\Profiles\tz4zjgec.default\searchplugins\winamp-search.xml
[2010/08/07 21:28:56 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/07/29 20:23:12 | 000,423,656 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/07/14 04:16:02 | 000,075,208 | —- | M] (Foxit Software Company) – C:\Program Files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
[2010/07/12 17:33:56 | 000,012,800 | —- | M] (Nullsoft, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npwachk.dll
[2007/03/10 00:16:44 | 000,189,496 | —- | M] (Yahoo! Inc.) – C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll
[2010/04/03 20:02:21 | 000,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/04/03 20:02:22 | 000,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/04/03 20:02:22 | 000,000,769 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/04/03 20:02:22 | 000,001,135 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2010/09/03 05:42:17 | 000,836,821 | —- | M]) - C:\WINDOWS\system32\drivers\etc\HOSTS
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 fr.a2dfp.net
O1 - Hosts: 127.0.0.1 m.fr.a2dfp.net
O1 - Hosts: 127.0.0.1 ad.a8.net
O1 - Hosts: 127.0.0.1 asy.a8ww.net
O1 - Hosts: 127.0.0.1 abcstats.com
O1 - Hosts: 127.0.0.1 a.abv.bg
O1 - Hosts: 127.0.0.1 adserver.abv.bg
O1 - Hosts: 127.0.0.1 adv.abv.bg
O1 - Hosts: 127.0.0.1 bimg.abv.bg
O1 - Hosts: 127.0.0.1 ca.abv.bg
O1 - Hosts: 127.0.0.1 www2.a-counter.kiev.ua
O1 - Hosts: 127.0.0.1 track.acclaimnetwork.com
O1 - Hosts: 127.0.0.1 accuserveadsystem.com
O1 - Hosts: 127.0.0.1 www.accuserveadsystem.com
O1 - Hosts: 127.0.0.1 achmedia.com
O1 - Hosts: 127.0.0.1 aconti.net
O1 - Hosts: 127.0.0.1 secure.aconti.net
O1 - Hosts: 127.0.0.1 www.aconti.net #[Dialer.Aconti]
O1 - Hosts: 127.0.0.1 ads.active.com
O1 - Hosts: 127.0.0.1 am1.activemeter.com
O1 - Hosts: 127.0.0.1 www.activemeter.com #[Tracking.Cookie]
O1 - Hosts: 127.0.0.1 ads.activepower.net
O1 - Hosts: 127.0.0.1 stat.active24stats.nl #[Tracking.Cookie]
O1 - Hosts: 127.0.0.1 ad2games.com
O1 - Hosts: 25625 more lines…
O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
O2 - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O2 - BHO: (FDMIECookiesBHO Class) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll ()
O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKCU\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
O3 - HKCU\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [EPSON SX410 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIFCE.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [HostsMan] C:\Program Files\HostsMan\hm.exe (abelhadigital.com)
O4 - HKCU..\Run: [HostsServer] C:\Program Files\HostsMan\hostssrv.exe (abelhadigital.com)
O4 - HKCU..\Run: [RocketDock] C:\Program Files\RocketDock\RocketDock.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 153
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 153
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoUserNameInStartMenu = 01 00 00 00 [binary data]
O8 - Extra context menu item: Download all with Free Download Manager - C:\Program Files\Free Download Manager\dlall.htm ()
O8 - Extra context menu item: Download selected with Free Download Manager - C:\Program Files\Free Download Manager\dlselected.htm ()
O8 - Extra context menu item: Download video with Free Download Manager - C:\Program Files\Free Download Manager\dlfvideo.htm ()
O8 - Extra context menu item: Download with Free Download Manager - C:\Program Files\Free Download Manager\dllink.htm ()
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (PokerStars)
O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - Reg Error: Value error. File not found
O15 - HKCU\..Trusted Domains: line6.net ([]* in Trusted sites)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab (PCPitstop Utility)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/…lscbase6770.cab (Windows Live Safety Center Base Module)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} http://ax.emsisoft.com/asquared.cab (a-squared Scanner)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\AlistairGC\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\AlistairGC\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/02/01 22:56:50 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.ac3filter - C:\WINDOWS\System32\ac3filter.acm ()
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Error starting restore point: System Restore is disabled.
Error closing restore point: System Restore is disabled.

========== Files/Folders - Created Within 30 Days ==========

[2010/09/05 04:00:32 | 000,000,000 | RH-D | C] – C:\Documents and Settings\AlistairGC\Recent
[2010/09/05 02:55:46 | 000,000,000 | —D | C] – C:\Program Files\Adobe
[2010/09/03 05:19:30 | 000,000,000 | —D | C] – C:\WINDOWS\ERUNT
[2010/09/03 05:14:43 | 000,000,000 | —D | C] – C:\SDFix
[2010/09/01 16:09:51 | 000,000,000 | —D | C] – C:\Program Files\SpywareBlaster
[2010/08/31 19:55:51 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\PCPitstopDat
[2010/08/30 18:42:08 | 000,000,000 | —D | C] – C:\Program Files\Pazeera
[2010/08/29 11:19:55 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Documents\HostsMan Backups
[2010/08/29 11:19:55 | 000,000,000 | —D | C] – C:\Documents and Settings\AlistairGC\Application Data\abelhadigital.com
[2010/08/29 11:19:54 | 000,000,000 | —D | C] – C:\Program Files\HostsMan
[2010/08/29 09:04:29 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2010/08/26 23:46:39 | 000,000,000 | —D | C] – C:\Documents and Settings\AlistairGC\Local Settings\Application Data\WebEndPointScan
[2010/08/26 23:33:11 | 000,000,000 | —D | C] – C:\WINDOWS\System32\Adobe
[2010/08/24 14:09:48 | 000,000,000 | —D | C] – C:\Documents and Settings\AlistairGC\Local Settings\Application Data\Apple Computer
[2010/08/24 14:07:51 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Apple Computer
[2010/08/24 14:07:49 | 000,180,224 | —- | C] (Apple Inc.) – C:\WINDOWS\System32\QTCF.dll
[2010/08/24 14:07:49 | 000,094,208 | —- | C] (Apple Inc.) – C:\WINDOWS\System32\QuickTimeVR.qtx
[2010/08/24 14:07:49 | 000,069,632 | —- | C] (Apple Inc.) – C:\WINDOWS\System32\QuickTime.qts
[2010/08/24 14:07:46 | 000,000,000 | —D | C] – C:\Program Files\QT Lite
[2010/08/19 20:12:15 | 000,000,000 | —D | C] – C:\Documents and Settings\AlistairGC\Local Settings\Application Data\Yahoo!
[2010/08/09 05:51:05 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\NSS
[2010/08/09 05:51:05 | 000,000,000 | —D | C] – C:\Program Files\Norton Security Scan
[2010/08/09 05:51:05 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\NSS\0207030.022
[2010/08/09 05:51:03 | 000,000,000 | —D | C] – C:\Program Files\NortonInstaller
[2010/08/09 05:01:04 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2010/08/07 20:34:03 | 000,000,000 | —D | C] – C:\Documents and Settings\AlistairGC\Application Data\OpenOffice.org
[2010/08/07 20:32:33 | 000,000,000 | —D | C] – C:\Program Files\JRE
[2010/08/07 20:32:29 | 000,000,000 | —D | C] – C:\Program Files\OpenOffice.org 3
[2010/08/07 20:30:40 | 000,000,000 | —D | C] – C:\openofficeinstallfiles
[2010/02/03 01:32:44 | 000,047,360 | —- | C] (VSO Software) – C:\Documents and Settings\AlistairGC\Application Data\pcouffin.sys

========== Files - Modified Within 30 Days ==========

[2010/09/05 14:38:28 | 000,000,322 | —- | M] () – C:\WINDOWS\tasks\GlaryInitialize.job
[2010/09/05 14:38:27 | 000,000,890 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/09/05 14:38:25 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/09/05 14:37:29 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/09/05 04:44:30 | 006,291,456 | —- | M] () – C:\Documents and Settings\AlistairGC\NTUSER.DAT
[2010/09/05 04:44:30 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\AlistairGC\ntuser.ini
[2010/09/05 04:44:23 | 028,376,662 | -H– | M] () – C:\Documents and Settings\AlistairGC\Local Settings\Application Data\IconCache.db
[2010/09/05 04:21:00 | 000,000,894 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/09/04 23:16:21 | 000,001,041 | —- | M] () – C:\Documents and Settings\AlistairGC\Application Data\vso_ts_preview.xml
[2010/09/04 18:51:33 | 000,088,064 | —- | M] () – C:\Documents and Settings\AlistairGC\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/04 16:50:31 | 000,000,484 | -H– | M] () – C:\WINDOWS\tasks\Norton Security Scan for AlistairGC.job
[2010/09/04 12:58:32 | 000,000,096 | —- | M] () – C:\WINDOWS\System32\w3data.vss
[2010/09/04 12:58:32 | 000,000,096 | —- | M] () – C:\WINDOWS\System32\msvcsv60.dll
[2010/09/04 12:58:32 | 000,000,096 | —- | M] () – C:\WINDOWS\msocreg32.dat
[2010/09/03 05:42:17 | 000,836,821 | —- | M] () – C:\WINDOWS\System32\drivers\etc\HOSTS
[2010/08/26 23:34:53 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/08/21 02:51:04 | 000,782,289 | R— | M] () – C:\WINDOWS\System32\drivers\etc\HOSTS.bak
[2010/08/12 19:22:54 | 002,020,664 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/08/12 19:21:10 | 000,501,020 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/08/12 19:21:10 | 000,440,820 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/08/12 19:21:10 | 000,071,138 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/08/10 04:15:58 | 000,094,208 | —- | M] (Apple Inc.) – C:\WINDOWS\System32\QuickTimeVR.qtx
[2010/08/10 04:15:58 | 000,069,632 | —- | M] (Apple Inc.) – C:\WINDOWS\System32\QuickTime.qts
[2010/08/10 04:15:50 | 000,180,224 | —- | M] (Apple Inc.) – C:\WINDOWS\System32\QTCF.dll
[2010/08/09 05:51:05 | 000,000,172 | —- | M] () – C:\WINDOWS\System32\drivers\NSS\0207030.022\isolate.ini
[2010/08/07 21:27:44 | 000,023,760 | —- | M] () – C:\Documents and Settings\AlistairGC\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

========== Files Created - No Company Name ==========

[2010/08/09 05:51:07 | 000,000,484 | -H– | C] () – C:\WINDOWS\tasks\Norton Security Scan for AlistairGC.job
[2010/08/09 05:51:05 | 000,000,172 | —- | C] () – C:\WINDOWS\System32\drivers\NSS\0207030.022\isolate.ini
[2010/06/22 22:00:35 | 000,000,036 | —- | C] () – C:\Documents and Settings\AlistairGC\Local Settings\Application Data\housecall.guid.cache
[2010/03/05 02:24:22 | 000,014,976 | —- | C] () – C:\WINDOWS\System32\drivers\SBKUPNT.SYS
[2010/03/05 02:24:22 | 000,000,543 | —- | C] () – C:\WINDOWS\SWISV3.INI
[2010/03/05 02:22:48 | 000,000,351 | —- | C] () – C:\WINDOWS\SKNIFE.INI
[2010/03/05 02:22:38 | 000,002,799 | —- | C] () – C:\WINDOWS\SKLANG.INI
[2010/02/08 12:28:46 | 000,138,184 | —- | C] () – C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2010/02/07 08:17:59 | 000,129,024 | —- | C] () – C:\WINDOWS\System32\AVERM.dll
[2010/02/07 08:17:59 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\AVEQT.dll
[2010/02/05 08:56:17 | 000,000,096 | —- | C] () – C:\WINDOWS\System32\msvcsv60.dll
[2010/02/05 08:02:05 | 000,000,032 | —- | C] () – C:\WINDOWS\GearBox.ini
[2010/02/03 19:40:19 | 000,000,010 | —- | C] () – C:\WINDOWS\WININIT.INI
[2010/02/03 08:17:25 | 000,327,168 | —- | C] () – C:\WINDOWS\System32\cutil32.dll
[2010/02/03 01:33:09 | 000,001,041 | —- | C] () – C:\Documents and Settings\AlistairGC\Application Data\vso_ts_preview.xml
[2010/02/03 01:32:44 | 000,087,608 | —- | C] () – C:\Documents and Settings\AlistairGC\Application Data\inst.exe
[2010/02/03 01:32:44 | 000,007,887 | —- | C] () – C:\Documents and Settings\AlistairGC\Application Data\pcouffin.cat
[2010/02/03 01:32:44 | 000,001,144 | —- | C] () – C:\Documents and Settings\AlistairGC\Application Data\pcouffin.inf
[2010/02/02 19:21:04 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\vusetup.dll
[2010/02/02 19:11:27 | 000,000,097 | —- | C] () – C:\WINDOWS\System32\PICSDK.ini
[2010/02/02 03:22:39 | 000,088,064 | —- | C] () – C:\Documents and Settings\AlistairGC\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/01 23:00:57 | 000,005,810 | R— | C] () – C:\WINDOWS\System32\drivers\ASACPI.sys
[2010/02/01 23:00:56 | 000,010,855 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2010/02/01 23:00:44 | 000,012,536 | —- | C] () – C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[1996/04/03 20:33:26 | 000,005,248 | —- | C] () – C:\WINDOWS\System32\giveio.sys

========== LOP Check ==========

[2010/08/29 11:20:43 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\abelhadigital.com
[2010/06/07 02:56:49 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\CCS64
[2010/06/01 16:06:11 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\Cloanto
[2010/02/07 11:54:20 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\Desktop Sidebar
[2010/02/13 12:19:11 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\DMCache
[2010/02/05 04:30:11 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\EPSON
[2010/02/06 03:45:01 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\fltk.org
[2010/02/02 15:51:48 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\Foxit
[2010/07/14 04:14:53 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\Foxit Software
[2010/09/05 02:54:33 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\Free Download Manager
[2010/06/11 01:08:55 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\GlarySoft
[2010/07/09 09:38:29 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\gtk-2.0
[2010/02/04 03:35:59 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\IconTweaker
[2010/05/28 22:19:15 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\IObit
[2010/07/09 05:07:43 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\JLC's Software
[2010/02/08 11:58:29 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\Leadertech
[2010/02/05 08:05:20 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\Line 6
[2010/07/01 21:12:08 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\Mc & RENOX
[2010/05/28 22:22:07 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\Mp3tag
[2010/03/30 02:21:25 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\NetStat Agent
[2010/08/07 20:34:03 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\OpenOffice.org
[2010/07/09 09:36:27 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\Participatory Culture Foundation
[2010/07/09 09:42:10 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\PCF-VLC
[2010/02/05 12:04:55 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\PhotoFiltre
[2010/07/14 04:44:15 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\PhotoScape
[2010/03/30 01:16:26 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\QuickScan
[2010/06/01 15:19:31 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\Stella
[2010/02/04 05:01:37 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\Styler
[2010/02/10 01:02:01 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\SystemRequirementsLab
[2010/07/26 14:18:27 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\TweakNow RegCleaner
[2010/09/05 02:52:30 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\uTorrent
[2010/09/04 23:16:21 | 000,000,000 | —D | M] – C:\Documents and Settings\AlistairGC\Application Data\Vso
[2010/08/29 11:19:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\abelhadigital.com
[2010/07/08 05:53:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/07/31 18:33:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\CA
[2010/06/23 22:37:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Cloanto
[2010/02/08 12:02:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Electronic Arts
[2010/02/02 19:15:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EPSON
[2010/05/23 19:43:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\F-Secure
[2010/07/14 04:18:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FreeDownloadManager.ORG
[2010/02/04 03:35:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\IconTweaker
[2010/02/23 13:39:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\IObit
[2010/02/05 08:02:05 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Line 6
[2010/07/31 03:43:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MicroWorld
[2010/08/31 20:00:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCPitstop
[2010/08/31 19:55:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCPitstopDat
[2010/06/30 01:07:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Readon
[2010/02/14 14:41:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sonoma Wire Works
[2010/02/13 12:50:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SpeedBit
[2010/02/12 19:45:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Stardock
[2010/09/01 16:10:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/03/11 23:30:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\UDL
[2010/02/05 22:31:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\vsosdk
[2010/09/05 14:38:28 | 000,000,322 | —- | M] () – C:\WINDOWS\Tasks\GlaryInitialize.job
[2010/02/12 17:44:44 | 000,000,474 | —- | M] () – C:\WINDOWS\Tasks\Wise Registry Cleaner 4.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/02/01 22:56:50 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2010/02/01 22:52:51 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2010/02/01 22:56:50 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2010/02/01 22:56:50 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/02/01 22:56:50 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/04 13:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2010/02/01 23:42:11 | 000,250,048 | RHS- | M] () – C:\ntldr
[2010/09/05 14:37:19 | 2145,386,496 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2006/04/18 16:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 15:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 16:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 15:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2010/02/01 22:56:32 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 13:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/07/06 11:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/06/28 21:57:33 | 000,038,848 | —- | M] (ALWIL Software) – C:\WINDOWS\avastSS.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2010/02/01 22:45:08 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2010/02/01 22:45:08 | 000,634,880 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2010/02/01 22:45:07 | 000,929,792 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >
[2010/07/10 13:54:59 | 000,000,000 | —D | M] – C:\Program Files\IObit\Advanced SystemCare 3\Bak

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2010/02/01 23:44:25 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/02/01 22:59:47 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\AlistairGC\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >
[2010/04/08 19:21:44 | 000,000,698 | —- | M] () – C:\WINDOWS\AppPatch\Custom\{a9264802-8a7a-40fe-a135-5c6d204aed7a}.sdb

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-08-12 18:21:52

========== Alternate Data Streams ==========

@Alternate Data Stream - 95 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
@Alternate Data Stream - 134 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CB0AACC9
< End of report >
Post #5
Here is OTL Extras Scan results > OTL Extras logfile created on: 05/09/2010 14:49:46 - Run 1
OTL by OldTimer - Version 3.2.11.0 Folder = C:\Documents and Settings\AlistairGC\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 84.00% Memory free
5.00 Gb Paging File | 5.00 Gb Available in Paging File | 93.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 204.50 Gb Free Space | 87.82% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ALISTAIR-DFB05C
Current User Name: AlistairGC
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = htmlfile] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] – "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] – "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] – "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)
"C:\WINDOWS\system32\ZoneLabs\vsmon.exe" = C:\WINDOWS\system32\ZoneLabs\vsmon.exe:*:Enabled:vsmon – (Check Point Software Technologies LTD)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{036778E0-D3CE-40AC-94E7-F5AF42F3245D}" = System Requirements Lab
"{0928B2C5-0B16-C2FB-7BAE-A25901414687}" = ATI Catalyst Install Manager
"{11083C7A-D0D6-4DA4-8C3A-74B8389EC07B}" = ATI Catalyst Registration
"{1774C3D2-30FF-70EE-A1AF-1B771E2D2D33}" = ccc-utility
"{1BA7B068-4719-42A3-B553-D4ED97434F92}" = ASUS Utilities
"{1E99F5D7-4262-4C7C-9135-F066E7485811}" = System Requirements Lab
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FE9594B-E51F-9845-0466-C0D1D915FBB5}" = Catalyst Control Center InstallProxy
"{21E77392-C30A-4AA2-8CA7-5728316939D6}" = AmpliTube X-GEAR
"{26A24AE4-039D-4CA4-87B4-2F83216020F0}" = Java™ 6 Update 20
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java™ 6 Update 21
"{31DDEBE2-0F7D-A4AA-B8A9-9E1FD795FC2A}" = CCC Help English
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5A13987D-55F4-4271-A40E-76AC9B1B38FD}" = OpenOffice.org 3.2
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{66BA35B0-1911-47EF-B170-1DCFFDA362F1}" = AmpliTube Jimi Hendrix
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6B3CA80E-6AC0-4725-BABF-9B0FEF880CB3}" = Power Tab Editor 1.7
"{6ED53E0C-EAC0-4F0F-947D-6BA817E4C8C3}" = HostsMan 3.2.73
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}" = EPSON Web-To-Page
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{87323561-58BA-4D5B-BADA-A791B69D1705}" = Catalyst Control Center - Branding
"{87C2248A-C7DD-49ED-9BCD-B312A9D0819E}" = Epson Easy Photo Print 2
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ACC73AA-6511-7C55-B1A9-8E5D1DEAFAA3}" = The Lord of the Rings FREE Trial
"{95120000-003F-0409-0000-0000000FF1CE}" = Microsoft Office Excel Viewer
"{9901E703-D169-7139-1EA3-11AA788D09E6}" = EA Download Manager UI
"{9EDEF5B1-B740-4DFF-AC16-E2428E1713E8}" = AmpliTube Metal
"{9F84955E-69AF-458E-80ED-11815CE7339B}" = Amiga Forever
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{a9264802-8a7a-40fe-a135-5c6d204aed7a}.sdb" = Internet Explorer (Enable DEP)
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{B7B5A370-3DFF-4F0E-AE11-FD267C4938AA}" = CCS64 V3.8
"{BEAED2F4-04C7-95C4-7D8F-500EFE6CD1F9}" = ccc-core-static
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C95AACD4-9507-4F5C-9D53-22B1ACCFECD1}" = AmpliTube2
"{CB0888EE-96D8-4713-84DC-36462C33AEB4}" = Bazooka Scanner
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE567716-7997-E0AE-DD81-1A5D49A5FB25}" = Catalyst Control Center Graphics Previews Common
"{CF1D7323-8A0A-49C7-83B0-088DB90721E2}" = AmpegSVX
"{DB6AB705-C9BD-40E3-8929-2EA57F36A4FF}_is1" = ConvertXtoDVD 4.0.9.322
"{E07B7A31-E160-466D-A003-3BB7B8989D52}" = Full Tilt Poker.Net
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E6D22FE1-AB5F-42CA-9480-6F70B96DDD88}" = Need for Speed™ Undercover
"{EA4FA30B-7321-4428-90E9-28B088EC8DC9}" = Runtime 8.0 Libraries
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"1F0E20D8CBC90AE0A7D8D4BE19DA2B828EA87737" = Windows Driver Package - Realtek Semiconductor Corp. HD Audio Driver (04/06/2010 5.10.0.6083)
"68B5B659620BA71C88432828271F056F69D0C6DE" = Windows Driver Package - Realtek Semiconductor Corp. HD Audio Driver (12/25/2009 5.10.0.6013)
"7-Zip" = 7-Zip 4.65
"ActiveScan 2.0" = Panda ActiveScan 2.0
"AD9BEB3DAB1038EFFD54D6304D1EF6AD77B00CF3" = Windows Driver Package - NVIDIA (nvnetbus) NVIDIA Network Bus Enumerator (08/01/2008 67.8.9)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Advanced SystemCare 3_is1" = Advanced SystemCare 3
"Allok Video Joiner_is1" = Allok Video Joiner 4.4.1117
"ASIO4ALL" = ASIO4ALL
"avast5" = avast! Free Antivirus
"CCleaner" = CCleaner
"CodecInstaller" = CodecInstaller 2.10.2
"com.ea.Vault.919CACB699904AC5D41B606703500DD39747C02D.1" = EA Download Manager UI
"CompuApps SwissKnife V3" = CompuApps SwissKnife V3
"D5F4FEC618ADFEC3DDD071D03C748C1FCCAF2AF9" = Windows Driver Package - Realtek Semiconductor Corp. HD Audio Driver (06/24/2009 5.10.0.5880)
"D7D7FC245514D8A73514D0C1533247DF9D582CF9" = Windows Driver Package - Realtek Semiconductor Corp. HD Audio Driver (03/13/2010 5.10.0.6066)
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX Setup
"EA Download Manager" = EA Download Manager
"EPSON Scanner" = EPSON Scan
"Epson Stylus SX210_SX410_TX210_TX410 User’s Guide" = Epson Stylus SX210_SX410_TX210_TX410 Manual
"ESET Online Scanner" = ESET Online Scanner v3
"Foxit Reader" = Foxit Reader
"Free Download Manager_is1" = Free Download Manager 3.0
"Game Booster_is1" = Game Booster
"Glary Utilities_is1" = Glary Utilities 2.26.0.956
"Guitar Pro 5_is1" = Guitar Pro 5.2
"ie8" = Windows Internet Explorer 8
"Line 6 Uninstaller" = Line 6 Uninstaller
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"Mp3tag" = Mp3tag v2.45a
"NSS" = Norton Security Scan
"NVIDIA Drivers" = NVIDIA Drivers
"P2PFilter" = P2PFilter 3.0.5
"PC Matic_is1" = PC Matic 1.0.0.0
"PC Wizard 2010_is1" = PC Wizard 2010.1.93
"PhotoScape" = PhotoScape
"PokerStars" = PokerStars
"quicktime_lite_is1" = QT Lite 4.0.0
"Revo Uninstaller" = Revo Uninstaller 1.89
"RocketDock_is1" = RocketDock 1.3.5
"Secunia PSI" = Secunia PSI
"Smart Defrag_is1" = Smart Defrag
"Sophos-AntiRootkit" = Sophos Anti-Rootkit 1.5.0
"SpywareBlaster_is1" = SpywareBlaster 4.4
"Stella_is1" = Stella 3.1.2
"The KMPlayer" = The KMPlayer (remove only)
"Tweak UI 2.10" = Tweak UI
"UnderCoverXP_is1" = UnderCoverXP 1.23
"uTorrent" = µTorrent
"Veetle TV" = Veetle TV 0.9.17
"Winamp" = Winamp
"Winamp Toolbar" = Winamp Toolbar
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.6.8
"ZoneAlarm" = ZoneAlarm

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"IconTweaker" = IconTweaker 1.11
"PhotoFiltre" = PhotoFiltre
"Winamp Detect" = Winamp Detector Plug-in
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.9.8

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 07/07/2010 11:54:40 | Computer Name = ALISTAIR-DFB05C | Source = MatSvc | ID = 262153
Description =

Error - 07/07/2010 11:54:40 | Computer Name = ALISTAIR-DFB05C | Source = MatSvc | ID = 262154
Description =

Error - 07/07/2010 11:54:40 | Computer Name = ALISTAIR-DFB05C | Source = MatSvc | ID = 262159
Description =

Error - 08/07/2010 23:28:09 | Computer Name = ALISTAIR-DFB05C | Source = Application Error | ID = 1000
Description = Faulting application internet tv.exe, version 0.0.0.0, faulting module
quartz.dll, version 6.5.2600.5933, fault address 0x0009622e.

Error - 09/07/2010 00:06:02 | Computer Name = ALISTAIR-DFB05C | Source = Application Error | ID = 1000
Description = Faulting application internet tv.exe, version 0.0.0.0, faulting module
quartz.dll, version 6.5.2600.5933, fault address 0x0009622e.

Error - 09/07/2010 00:07:23 | Computer Name = ALISTAIR-DFB05C | Source = Application Error | ID = 1000
Description = Faulting application internet tv.exe, version 0.0.0.0, faulting module
ntdll.dll, version 5.1.2600.5755, fault address 0x00010a19.

Error - 09/07/2010 02:30:02 | Computer Name = ALISTAIR-DFB05C | Source = MsiInstaller | ID = 1002
Description = Unexpected or missing value (name: 'PackageName', value: '') in key
'HKLM\Software\Classes\Installer\Products\D139E7FE48CDB174D86B8A3385904547\SourceList'

Error - 09/07/2010 03:16:39 | Computer Name = ALISTAIR-DFB05C | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x04649290.

Error - 13/07/2010 02:53:52 | Computer Name = ALISTAIR-DFB05C | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module shell32.dll, version 6.0.2900.5622, fault address 0x0005c259.

Error - 14/07/2010 00:00:51 | Computer Name = ALISTAIR-DFB05C | Source = Application Error | ID = 1000
Description = Faulting application plugin-container.exe, version 1.9.2.3828, faulting
module ntdll.dll, version 5.1.2600.5755, fault address 0x0000100b.

[ System Events ]
Error - 04/09/2010 12:47:29 | Computer Name = ALISTAIR-DFB05C | Source = SRService | ID = 104
Description = The System Restore initialization process failed.

Error - 04/09/2010 12:47:34 | Computer Name = ALISTAIR-DFB05C | Source = Service Control Manager | ID = 7023
Description = The System Restore Service service terminated with the following error:
%%2

Error - 04/09/2010 15:49:39 | Computer Name = ALISTAIR-DFB05C | Source = SRService | ID = 104
Description = The System Restore initialization process failed.

Error - 04/09/2010 15:49:45 | Computer Name = ALISTAIR-DFB05C | Source = Service Control Manager | ID = 7023
Description = The System Restore Service service terminated with the following error:
%%2

Error - 04/09/2010 17:12:47 | Computer Name = ALISTAIR-DFB05C | Source = SRService | ID = 104
Description = The System Restore initialization process failed.

Error - 04/09/2010 17:12:48 | Computer Name = ALISTAIR-DFB05C | Source = Service Control Manager | ID = 7023
Description = The System Restore Service service terminated with the following error:
%%2

Error - 05/09/2010 09:38:32 | Computer Name = ALISTAIR-DFB05C | Source = SRService | ID = 104
Description = The System Restore initialization process failed.

Error - 05/09/2010 09:38:36 | Computer Name = ALISTAIR-DFB05C | Source = Service Control Manager | ID = 7023
Description = The System Restore Service service terminated with the following error:
%%2

Error - 05/09/2010 09:50:03 | Computer Name = ALISTAIR-DFB05C | Source = SRService | ID = 104
Description = The System Restore initialization process failed.

Error - 05/09/2010 09:50:03 | Computer Name = ALISTAIR-DFB05C | Source = Service Control Manager | ID = 7023
Description = The System Restore Service service terminated with the following error:
%%2


< End of report >
Post #6
Thanks for the OTL. I'm looking it over now.

Can you please run GMER and post the results?

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

===================================================


In your next reply please post :
GMER log
Post #7
Hi Noodletech, I have tried to scan with gmer 4 times now and everytime it finishes scanning,it seems to freeze and will not let me save a logfile.On one run it also restarted my PC while scanning. :pullhair:
Post #8
Hi Ally,

Let's try Rootkit Unhooker instead.

Please download Rootkit Unhooker and save it on your desktop.
  • Disable your security programs
  • Double click RKUnhookerLE.exe to run it
  • Click the Report tab, then click Scan
  • Check Drivers and Stealth Code,
  • Uncheck the rest, then click OK
  • When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
  • Wait till the scanner has finished then go File > Save Report
  • Save the report somewhere you can find it. Click Close
  • Copy the entire contents of the report and paste it in your next reply.
Note - You may get this warning, it is ok, just ignore it:

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

Post #10
Hi Noodltech, Sorry for the delay in replying.I got knocked off-line the same night I ran all those gmer scans.I got in touch with my local pc guy and it was not just a malware issue I had but also my hard drive was failing.I have not had access to a pc until now, I apologize for wasting your time! The old HD has been disposed of and My Pc has a new HD and fresh install of windows although I did lose all my programs etc. Again Sorry for taking so long to get back to you and sorry for wasting your time. Regards,Ally.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI