nukesploit P4ck activity

followed the instruction for this, attempts occur every few minutes when online
the following logs were obtained;
OTL logfile created on: 14/09/2010 16:59:13 - Run 2
OTL by OldTimer - Version 3.2.12.0 Folder = C:\Users\terry\Documents\Documents\Downloads\Downloads\Downloads\Downloads\Downloads\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18943)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 27.00% Memory free
4.00 Gb Paging File | 2.00 Gb Available in Paging File | 55.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 142.49 Gb Total Space | 54.66 Gb Free Space | 38.36% Space Free | Partition Type: NTFS
Drive D: | 6.56 Gb Total Space | 2.36 Gb Free Space | 36.03% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HUNDRED14
Current User Name: terry
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\terry\Documents\Documents\Downloads\Downloads\Downloads\Downloads\Downloads\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
PRC - C:\Program Files\Norton 360\Engine\3.8.0.41\MCUI32.exe (Symantec Corporation)
PRC - C:\Program Files\Evidence Eliminator\Ee.exe (Robin Hood Software Ltd.)
PRC - C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (Yahoo! Inc)
PRC - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Megatech\MProtect\MPServ.exe ()
PRC - C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
PRC - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe ()
PRC - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe ()
PRC - C:\Program Files\Common Files\Logitech\QCDriver2\LVComS.exe (Logitech Inc.)
PRC - C:\Windows\System32\NILaunch.exe ()


========== Modules (SafeList) ==========

MOD - C:\Users\terry\Documents\Documents\Downloads\Downloads\Downloads\Downloads\Downloads\Downloads\OTL.exe (OldTimer Tools)
MOD - c:\Program Files\McAfee\SiteAdvisor\sahook.dll (McAfee, Inc.)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (Dnscache) – C:\Program Files\Common Files\dns.cert ()
SRV - (McAfee SiteAdvisor Service) – C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
SRV - (Lavasoft Ad-Aware Service) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (N360) – C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe (Symantec Corporation)
SRV - (SBSDWSCService) – C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (IAANTMON) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (Autodesk Licensing Service) – C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe (Autodesk)
SRV - (Symantec RemoteAssist) – C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (Symantec, Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (LVSrvLauncher) – C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe (Logitech Inc.)
SRV - (Megatech-Software-Protection) – C:\Program Files\Common Files\Megatech\MProtect\MPServ.exe ()
SRV - (Com4Qlb) – C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe (Hewlett-Packard Development Company, L.P.)
SRV - (MSCSPTISRV) – C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe (Sony Corporation)
SRV - (SPTISRV) – C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe (Sony Corporation)
SRV - (PACSPTISVR) – C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe ()
SRV - (ASBroker) – C:\Program Files\Bioscrypt\VeriSoft\Bin\ASWLNPkg.dll (Cognizance Corporation)
SRV - (ASChannel) – C:\Program Files\Bioscrypt\VeriSoft\Bin\ASChnl.dll (Cognizance Corporation)
SRV - (IDriverT) – C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (AdobeActiveFileMonitor) – C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe ()
SRV - (PhotoshopElementsDeviceConnect) – C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe ()


========== Driver Services (SafeList) ==========

DRV - (UIUSys) – C:\Windows\System32\DRIVERS\UIUSYS.SYS File not found
DRV - (NwlnkFwd) – C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (ndisrd) – C:\Windows\System32\DRIVERS\ndisrd.sys File not found
DRV - (LVPr2Mon) – C:\Windows\System32\DRIVERS\LVPr2Mon.sys File not found
DRV - (LVMVDrv) – C:\Windows\System32\DRIVERS\LVMVDrv.sys File not found
DRV - (IpInIp) – C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (blbdrive) – C:\Windows\System32\drivers\blbdrive.sys File not found
DRV - (srenum) – C:\Windows\System32\drivers\srenum.sys ()
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100913.048\NAVEX15.SYS (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100913.048\NAVENG.SYS (Symantec Corporation)
DRV - (pfc) – C:\Windows\System32\drivers\pfc.sys (Padus, Inc.)
DRV - (IDSVix86) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100910.001\IDSvix86.sys (Symantec Corporation)
DRV - (nmwcd) – C:\Windows\System32\drivers\ccdcmb.sys (Nokia)
DRV - (UsbserFilt) – C:\Windows\System32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (nmwcdc) – C:\Windows\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (upperdev) – C:\Windows\System32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (Lbd) – C:\Windows\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (SymEvent) – C:\Windows\System32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (ccHP) – C:\Windows\System32\Drivers\N360\0308000.029\ccHPx86.sys (Symantec Corporation)
DRV - (SymEFA) – C:\Windows\system32\drivers\N360\0308000.029\SYMEFA.SYS (Symantec Corporation)
DRV - (SRTSP) – C:\Windows\System32\Drivers\N360\0308000.029\SRTSP.SYS (Symantec Corporation)
DRV - (BHDrvx86) – C:\Windows\System32\Drivers\N360\0308000.029\BHDrvx86.sys (Symantec Corporation)
DRV - (SYMTDI) – C:\Windows\System32\Drivers\N360\0308000.029\SYMTDI.SYS (Symantec Corporation)
DRV - (SYMFW) – C:\Windows\System32\Drivers\N360\0308000.029\SYMFW.SYS (Symantec Corporation)
DRV - (SYMNDISV) – C:\Windows\System32\Drivers\N360\0308000.029\SYMNDISV.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\Windows\system32\drivers\N360\0308000.029\SRTSPX.SYS (Symantec Corporation)
DRV - (SymIM) – C:\Windows\System32\drivers\SymIMV.sys (Symantec Corporation)
DRV - (iaStor) – C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (NETw5v32) Intel® – C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)
DRV - (pccsmcfd) – C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (CnxtHdAudService) – C:\Windows\System32\drivers\CHDRT32.sys (Conexant Systems Inc.)
DRV - (igfx) – C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (ialm) – C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (yukonwlh) – C:\Windows\System32\drivers\yk60x86.sys (Marvell)
DRV - (NETw4v32) Intel® – C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation)
DRV - (LVUSBSta) – C:\Windows\System32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (PID_PEPI) Logitech QuickCam IM(PID_PEPI) – C:\Windows\System32\drivers\LV302V32.SYS (Logitech Inc.)
DRV - (pepifilter) – C:\Windows\System32\drivers\lv302af.sys (Logitech Inc.)
DRV - (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor) – C:\Windows\System32\drivers\atswpdrv.sys (AuthenTec, Inc.)
DRV - (HdAudAddService) – C:\Windows\System32\drivers\CHDART.sys (Conexant Systems Inc.)
DRV - (XAudio) – C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (HSF_DPV) – C:\Windows\System32\drivers\HSX_DPV.sys (Conexant Systems, Inc.)
DRV - (HSXHWAZL) – C:\Windows\System32\drivers\HSXHWAZL.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\Windows\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (ApfiltrService) – C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (ElRawDisk) – C:\Windows\System32\drivers\elrawdsk.sys (EldoS Corporation)
DRV - (NuidFltr) – C:\Windows\System32\drivers\nuidfltr.sys (Microsoft Corporation)
DRV - (btwavdt) – C:\Windows\System32\drivers\btwavdt.sys (Broadcom Corporation.)
DRV - (btwaudio) – C:\Windows\System32\drivers\btwaudio.sys (Broadcom Corporation.)
DRV - (btwrchid) – C:\Windows\System32\drivers\btwrchid.sys (Broadcom Corporation.)
DRV - (eabfiltr) – C:\Windows\System32\drivers\eabfiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (rimmptsk) – C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (rimsptsk) – C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (rismxdp) – C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) – C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (HSFHWAZL) – C:\Windows\System32\drivers\VSTAZL3.SYS (Conexant Systems, Inc.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (NETw3v32) Intel® – C:\Windows\System32\drivers\NETw3v32.sys (Intel® Corporation)
DRV - (E1G60) Intel® – C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (BCM43XV) – C:\Windows\System32\drivers\BCMWL6.SYS (Broadcom Corporation)
DRV - (MODBDA2) – C:\Windows\System32\drivers\yuanmodbda2.sys (DiBcom SA)
DRV - (HBtnKey) – C:\Windows\System32\drivers\CPQBttn.sys (Hewlett-Packard Development Company, L.P.)
DRV - (Ser2pl) – C:\Windows\System32\drivers\ser2pl.sys (Prolific Technology Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sky.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555

FF - HKLM\software\mozilla\Firefox\Extensions\\{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\ [2010/04/26 16:52:22 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2010/05/03 16:12:28 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/09/01 06:01:27 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{29BB2942-5461-4244-8099-88E005DF491B}: C:\Users\terry\AppData\Local\{29BB2942-5461-4244-8099-88E005DF491B} [2010/09/12 18:37:03 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2010/05/03 16:12:29 | 000,000,000 | —D | M]

[2010/07/04 11:56:55 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/01/31 23:09:23 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

O1 HOSTS File: ([2010/09/08 13:07:42 | 000,419,188 | R— | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 14466 more lines…
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\3.8.0.41\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (VeriSoft Access Manager) - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\Bioscrypt\VeriSoft\Bin\ItIEAddIn.dll (Bioscrypt Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [CognizanceTS] C:\Program Files\Bioscrypt\VeriSoft\Bin\ASTSVCC.dll (Cognizance Corporation)
O4 - HKLM..\Run: [Ctoni] C:\Users\terry\AppData\Local\ifesiqasoqe.DLL File not found
O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver2\LVComS.exe (Logitech Inc.)
O4 - HKLM..\Run: [Net-It Launcher] C:\Windows\System32\NILaunch.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (Yahoo! Inc)
O4 - HKCU..\Run: [] File not found
O4 - HKCU..\Run: [{F51FB64E-024A-CF09-A3C6-C9C4CEA94BC7}] C:\Users\terry\AppData\Roaming\Yrolap\duny.exe ()
O4 - HKCU..\Run: [Evidence Eliminator] C:\Program Files\Evidence Eliminator\EEStartupLauncher.exe ()
O4 - HKCU..\Run: [ISUSPM Startup] c:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (Yahoo! Inc)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (Yahoo! Inc)
O4 - HKLM..\RunOnce: [Launcher] C:\Windows\SMINST\Launcher.exe (soft thinks)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Send image to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Sky - {08E730A4-FB02-45BD-A900-01E4AD8016F6} - File not found
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog; This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (Intertrust Technologies, Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.hp.com/ediags/gmn2/inst…tDetection2.cab (GMNRev Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Users\terry\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\terry\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2005/09/11 16:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE – [ NTFS ]
O33 - MountPoints2\{2d91865a-23f9-11dc-a634-001a6b726d8c}\Shell - "" = AutoRun
O33 - MountPoints2\{2d91865a-23f9-11dc-a634-001a6b726d8c}\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found
O33 - MountPoints2\{2e925636-0a23-11dd-aa10-001a6b726d8c}\Shell\Auto\command - "" = infrom.exe
O33 - MountPoints2\{6bddb343-9e71-11dc-b736-001a6b726d8c}\Shell\Auto\command - "" = setup.exe
O33 - MountPoints2\{6bddb348-9e71-11dc-b736-001a6b726d8c}\Shell - "" = AutoRun
O33 - MountPoints2\{6bddb348-9e71-11dc-b736-001a6b726d8c}\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
O33 - MountPoints2\{9651da0c-d80b-11dc-bdba-001a6b726d8c}\Shell - "" = AutoRun
O33 - MountPoints2\{9651da0c-d80b-11dc-bdba-001a6b726d8c}\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found
O33 - MountPoints2\{9ceddf33-f1c6-11dc-b674-001a6b726d8c}\Shell\AutoRun\command - "" = h.cmd
O33 - MountPoints2\{9ceddf33-f1c6-11dc-b674-001a6b726d8c}\Shell\explore\Command - "" = h.cmd
O33 - MountPoints2\{9ceddf33-f1c6-11dc-b674-001a6b726d8c}\Shell\open\Command - "" = h.cmd
O33 - MountPoints2\{a70e64c4-f91e-11dd-9dfb-001a6b726d8c}\Shell - "" = AutoRun
O33 - MountPoints2\{a70e64c4-f91e-11dd-9dfb-001a6b726d8c}\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found
O33 - MountPoints2\{d6eab48a-b798-11dd-a675-001a6b726d8c}\Shell\AutoRun\command - "" = 9.cmd
O33 - MountPoints2\{d6eab48a-b798-11dd-a675-001a6b726d8c}\Shell\explore\Command - "" = 9.cmd
O33 - MountPoints2\{d6eab48a-b798-11dd-a675-001a6b726d8c}\Shell\open\Command - "" = 9.cmd
O33 - MountPoints2\{f5f249dd-0f3a-11df-b051-001a6b726d8c}\Shell\AutoRun\command - "" = vircure/vircure32.exe
O33 - MountPoints2\{f5f249dd-0f3a-11df-b051-001a6b726d8c}\Shell\explore\command - "" = vircure/vircure32.exe
O33 - MountPoints2\{f5f249dd-0f3a-11df-b051-001a6b726d8c}\Shell\open\command - "" = vircure/vircure32.exe
O33 - MountPoints2\{f5f249e2-0f3a-11df-b051-001a6b726d8c}\Shell - "" = AutoRun
O33 - MountPoints2\{f5f249e2-0f3a-11df-b051-001a6b726d8c}\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - File not found
Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.voxacm160 - C:\Windows\System32\vct3216.acm (Voxware, Inc.)
Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: VIDC.ACDV - C:\Windows\System32\ACDV.dll (ACD Systems)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.iv31 - C:\Windows\System32\ir32_32.dll (Intel® Corporation)
Drivers32: vidc.iv32 - C:\Windows\System32\ir32_32.dll (Intel® Corporation)
Drivers32: vidc.iv41 - C:\Windows\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\Windows\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.mxmc - C:\Windows\System32\MimicICM.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2010/09/14 14:12:51 | 000,000,000 | —D | C] – C:\Program Files\Common Files\ParetoLogic
[2010/09/14 14:12:50 | 000,000,000 | —D | C] – C:\Program Files\ParetoLogic
[2010/09/14 13:52:24 | 000,000,000 | —D | C] – C:\ProgramData\RegCure
[2010/09/14 13:52:22 | 000,000,000 | —D | C] – C:\Program Files\RegCure
[2010/09/12 18:38:14 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2010/09/12 18:37:03 | 000,000,000 | —D | C] – C:\Users\terry\AppData\Local\{29BB2942-5461-4244-8099-88E005DF491B}
[2010/09/11 22:29:11 | 003,356,989 | —- | C] (Macromedia, Inc.) – C:\Users\Public\Documents\MobileTV.exe
[2010/09/11 22:29:11 | 003,266,369 | —- | C] (Macromedia, Inc.) – C:\Users\Public\Documents\DVD.exe
[2010/09/11 22:29:10 | 003,347,890 | —- | C] (Macromedia, Inc.) – C:\Users\Public\Documents\MPV.exe
[2010/09/11 22:29:09 | 002,598,373 | —- | C] (Macromedia, Inc.) – C:\Users\Public\Documents\Karaoke.exe
[2010/09/11 22:29:09 | 002,430,849 | —- | C] (Macromedia, Inc.) – C:\Users\Public\Documents\Games.exe
[2010/09/11 22:29:08 | 000,000,000 | —D | C] – C:\Users\Public\Documents\ENU
[2010/09/11 22:04:55 | 000,000,000 | —D | C] – C:\Users\terry\AppData\Roaming\Uniblue
[2010/09/11 21:53:20 | 000,000,000 | —D | C] – C:\Users\terry\Documents\SpyDLLRemover_v3_2[1]
[2010/09/11 11:21:14 | 000,000,000 | —D | C] – C:\Users\terry\AppData\Local\QuickPlay
[2010/09/10 15:51:09 | 000,000,000 | —D | C] – C:\Users\terry\Documents\r1ptemp1
[2010/09/08 06:08:23 | 000,000,000 | —D | C] – C:\ProgramData\WindowsSearch
[2010/09/07 15:22:11 | 000,184,320 | —- | C] (SEIKO EPSON CORP.) – C:\Windows\System32\ESDTR.dll
[2010/09/07 15:22:11 | 000,126,976 | —- | C] (SEIKO EPSON CORP.) – C:\Windows\System32\Esint23.dll
[2010/09/07 15:22:11 | 000,090,112 | —- | C] (SEIKO EPSON CORP) – C:\Windows\System32\epcomdd.dll
[2010/09/07 15:22:11 | 000,077,824 | —- | C] (SEIKO EPSON CORP.) – C:\Windows\System32\Esintpl.dll
[2010/09/07 15:22:11 | 000,066,048 | —- | C] (SEIKO EPSON CORP.) – C:\Windows\System32\escwian.dll
[2010/09/07 15:22:11 | 000,061,952 | —- | C] (SEIKO EPSON CORP.) – C:\Windows\System32\escwiad.dll
[2010/09/07 15:22:11 | 000,053,248 | —- | C] (SEIKO EPSON Corp.) – C:\Windows\System32\ESICM.dll
[2010/09/07 15:22:11 | 000,044,544 | —- | C] (SEIKO EPSON CORP.) – C:\Windows\System32\escwiab.dll
[2010/09/07 15:22:11 | 000,003,584 | —- | C] (SEIKO EPSON CORP.) – C:\Windows\System32\eswiaml.dll
[2010/09/07 15:21:37 | 000,000,000 | —D | C] – C:\Users\terry\AppData\Roaming\InstallShield
[2010/09/03 06:16:37 | 000,000,000 | -HSD | C] – C:\found.001
[2010/09/01 14:26:18 | 000,000,000 | —D | C] – C:\Windows\Profiles
[2010/09/01 14:26:13 | 000,000,000 | —D | C] – C:\Users\terry\Documents\My eBooks
[2010/09/01 14:26:13 | 000,000,000 | —D | C] – C:\Users\terry\AppData\Roaming\InterTrust
[2010/09/01 14:26:13 | 000,000,000 | —D | C] – C:\Windows\System32\Adobe
[2010/08/29 20:44:20 | 000,177,664 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mpg2splt.ax
[2010/08/29 20:44:20 | 000,080,896 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MSNP.ax
[2010/08/29 20:44:16 | 000,293,376 | —- | C] (Microsoft Corporation) – C:\Windows\System32\psisdecd.dll
[2010/08/29 20:44:13 | 000,428,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\EncDec.dll
[2010/08/29 20:44:13 | 000,217,088 | —- | C] (Microsoft Corporation) – C:\Windows\System32\psisrndr.ax
[2010/08/29 20:32:00 | 000,295,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHost.exe
[2010/08/29 20:32:00 | 000,099,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHostProxy.dll
[2010/08/29 20:31:59 | 000,049,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netfxperf.dll
[2010/08/29 20:21:47 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2010/08/29 20:21:47 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2010/08/29 20:21:47 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2010/08/29 20:21:46 | 000,387,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2010/08/29 20:21:46 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2010/08/29 20:21:45 | 001,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2010/08/29 20:21:45 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2010/08/29 20:21:44 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2010/08/29 20:21:44 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2010/08/29 20:21:42 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2010/08/29 20:21:42 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2010/08/29 20:21:42 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2010/08/29 20:21:41 | 000,611,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2010/08/29 20:21:38 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2010/08/29 20:21:37 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2010/08/29 20:20:45 | 000,081,920 | —- | C] (Radius Inc.) – C:\Windows\System32\iccvid.dll
[2010/08/29 20:20:15 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Apphlpdm.dll
[2010/08/29 20:20:12 | 004,240,384 | —- | C] (Microsoft) – C:\Windows\System32\GameUXLegacyGDFs.dll
[2010/08/29 20:19:55 | 002,036,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2010/08/29 20:19:45 | 003,598,216 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2010/08/29 20:19:45 | 003,545,992 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2010/08/29 20:19:31 | 000,036,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rtutils.dll
[2010/08/29 20:13:31 | 001,314,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\quartz.dll
[2010/08/29 20:12:16 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/09/14 17:00:22 | 000,000,390 | —- | M] () – C:\Windows\tasks\RegCure Program Check.job
[2010/09/14 17:00:10 | 012,058,624 | -HS- | M] () – C:\Users\terry\ntuser.dat
[2010/09/14 16:36:25 | 000,000,418 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{45513001-7868-44F9-A6B6-9CFCD4D4CF7B}.job
[2010/09/14 16:12:05 | 000,000,884 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/09/14 15:17:14 | 000,000,444 | —- | M] () – C:\Windows\tasks\ParetoLogic Registration3.job
[2010/09/14 15:16:32 | 000,000,880 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/09/14 15:16:23 | 000,000,370 | —- | M] () – C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2010/09/14 15:16:23 | 000,000,370 | —- | M] () – C:\Windows\tasks\Ad-Aware Update (Daily 4).job
[2010/09/14 15:16:23 | 000,000,370 | —- | M] () – C:\Windows\tasks\Ad-Aware Update (Daily 3).job
[2010/09/14 15:16:23 | 000,000,370 | —- | M] () – C:\Windows\tasks\Ad-Aware Update (Daily 2).job
[2010/09/14 15:16:22 | 000,000,370 | —- | M] () – C:\Windows\tasks\Ad-Aware Update (Daily 1).job
[2010/09/14 15:14:25 | 000,003,296 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/09/14 15:14:25 | 000,003,296 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/09/14 15:14:19 | 000,000,446 | —- | M] () – C:\Windows\tasks\ParetoLogic Privacy Controls_{C7A976E8-C001-11DF-9877-001A6B726D8C}.job
[2010/09/14 15:14:19 | 000,000,418 | —- | M] () – C:\Windows\tasks\ParetoLogic Update Version3.job
[2010/09/14 15:14:19 | 000,000,372 | —- | M] () – C:\Windows\tasks\RegCure.job
[2010/09/14 15:14:18 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/09/14 15:14:11 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/09/14 15:14:09 | 2137,382,912 | -HS- | M] () – C:\hiberfil.sys
[2010/09/14 15:11:08 | 000,002,484 | —- | M] () – C:\Windows\bthservsdp.dat
[2010/09/14 15:10:41 | 000,524,288 | -HS- | M] () – C:\Users\terry\ntuser.dat{0fa60c8a-d50a-11dd-8a22-001a6b726d8c}.TMContainer00000000000000000002.regtrans-ms
[2010/09/14 15:10:41 | 000,065,536 | -HS- | M] () – C:\Users\terry\ntuser.dat{0fa60c8a-d50a-11dd-8a22-001a6b726d8c}.TM.blf
[2010/09/14 15:10:34 | 002,108,345 | -H– | M] () – C:\Users\terry\AppData\Local\IconCache.db
[2010/09/14 14:12:51 | 000,001,019 | —- | M] () – C:\Users\Public\Desktop\ParetoLogic Privacy Controls.lnk
[2010/09/14 13:52:25 | 000,000,784 | —- | M] () – C:\Users\Public\Desktop\RegCure.lnk
[2010/09/14 13:03:22 | 000,694,964 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/09/14 13:03:22 | 000,603,282 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/09/14 13:03:22 | 000,106,696 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/09/14 12:44:54 | 000,002,369 | —- | M] () – C:\Users\terry\Desktop\Skype.lnk
[2010/09/14 12:27:52 | 000,000,004 | —- | M] () – C:\Users\terry\AppData\Roaming\avdrn.dat
[2010/09/13 19:59:59 | 000,000,546 | —- | M] () – C:\Windows\tasks\Norton Internet Security - Run Full System Scan - terry.job
[2010/09/13 19:15:58 | 000,000,120 | —- | M] () – C:\Users\terry\AppData\Local\Ukuni.dat
[2010/09/13 05:39:36 | 000,001,887 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 8.lnk
[2010/09/13 05:26:33 | 000,000,000 | —- | M] () – C:\Users\terry\AppData\Local\Bqesiwu.bin
[2010/09/12 16:41:20 | 000,002,763 | —- | M] () – C:\Windows\System32\responseBody.xml
[2010/09/12 16:41:19 | 000,002,546 | —- | M] () – C:\Windows\System32\requestBody.xml
[2010/09/12 16:41:19 | 000,001,078 | —- | M] () – C:\Windows\System32\request.gzip
[2010/09/12 13:43:07 | 003,356,989 | —- | M] (Macromedia, Inc.) – C:\Users\Public\Documents\MobileTV.exe
[2010/09/11 22:29:11 | 003,266,369 | —- | M] (Macromedia, Inc.) – C:\Users\Public\Documents\DVD.exe
[2010/09/11 22:29:10 | 003,347,890 | —- | M] (Macromedia, Inc.) – C:\Users\Public\Documents\MPV.exe
[2010/09/11 22:29:09 | 002,598,373 | —- | M] (Macromedia, Inc.) – C:\Users\Public\Documents\Karaoke.exe
[2010/09/11 22:29:09 | 002,430,849 | —- | M] (Macromedia, Inc.) – C:\Users\Public\Documents\Games.exe
[2010/09/11 22:17:51 | 000,000,046 | —- | M] () – C:\Windows\System32\_WKERNEL.FRE
[2010/09/11 19:30:32 | 000,010,925 | —- | M] () – C:\Users\terry\Documents\Jessica's Titanic story.docx
[2010/09/11 14:54:16 | 000,123,904 | —- | M] () – C:\Users\terry\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/11 12:11:31 | 000,471,576 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2010/09/11 12:01:33 | 000,001,871 | —- | M] () – C:\Users\Public\Desktop\HP Help and Support.lnk
[2010/09/11 11:21:19 | 000,000,281 | —- | M] () – C:\Users\Public\Documents\hpqp.ini
[2010/09/10 19:49:42 | 000,046,976 | —- | M] () – C:\Windows\System32\drivers\srenum.sys
[2010/09/10 19:49:42 | 000,004,128 | —- | M] () – C:\Windows\System32\msrun.exe
[2010/09/10 07:05:41 | 000,044,032 | —- | M] () – C:\Users\terry\Documents\Salary_Increment_System.pps
[2010/09/08 22:02:56 | 000,018,847 | —- | M] () – C:\Users\terry\Documents\pspbrwse.jbf
[2010/09/08 22:01:44 | 000,088,205 | —- | M] () – C:\Users\terry\Documents\nasim(15).jpg
[2010/09/08 22:00:49 | 000,085,002 | —- | M] () – C:\Users\terry\Documents\cynthia(15).jpg
[2010/09/08 14:26:27 | 000,060,771 | —- | M] () – C:\Users\terry\Documents\terry.jpg
[2010/09/08 13:07:42 | 000,419,188 | R— | M] () – C:\Windows\System32\drivers\etc\Hosts
[2010/09/07 14:45:41 | 000,053,248 | —- | M] () – C:\Program Files\Common Files\dns.cert
[2010/09/03 19:42:30 | 000,017,408 | —- | M] () – C:\Users\terry\AppData\Local\WebpageIcons.db
[2010/09/02 08:51:25 | 000,417,828 | R— | M] () – C:\Windows\System32\drivers\etc\hosts.20100908-130742.backup
[2010/09/01 14:26:25 | 000,001,040 | —- | M] () – C:\Users\Public\Desktop\Acrobat Reader 5.0.lnk
[2010/08/28 05:57:09 | 000,000,804 | —- | M] () – C:\Users\terry\Desktop\CCleaner.lnk
[2010/08/28 03:00:00 | 000,000,328 | —- | M] () – C:\Windows\tasks\Spybot - Search & Destroy - Scheduled Task.job
[2010/08/27 17:22:44 | 000,083,668 | —- | M] () – C:\Users\terry\Documents\checkin.pdf
[2010/08/27 06:06:15 | 000,524,288 | -HS- | M] () – C:\Users\terry\ntuser.dat{0fa60c8a-d50a-11dd-8a22-001a6b726d8c}.TMContainer00000000000000000001.regtrans-ms
[2010/08/24 09:25:20 | 000,333,827 | —- | M] () – C:\Users\terry\Documents\aug4.PDF
[2010/08/24 09:22:49 | 000,338,540 | —- | M] () – C:\Users\terry\Documents\aug3.PDF
[2010/08/24 09:20:49 | 000,335,731 | —- | M] () – C:\Users\terry\Documents\aug2.PDF
[2010/08/24 09:19:14 | 000,333,586 | —- | M] () – C:\Users\terry\Documents\aug1.PDF
[2010/08/21 21:41:31 | 000,000,106 | —- | M] () – C:\Users\terry\Desktop\Sky Broadband (2).url
[2010/08/19 22:42:56 | 000,416,853 | R— | M] () – C:\Windows\System32\drivers\etc\hosts.20100902-085125.backup
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/14 15:17:14 | 000,000,444 | —- | C] () – C:\Windows\tasks\ParetoLogic Registration3.job
[2010/09/14 15:16:23 | 000,000,370 | —- | C] () – C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2010/09/14 15:16:23 | 000,000,370 | —- | C] () – C:\Windows\tasks\Ad-Aware Update (Daily 4).job
[2010/09/14 15:16:23 | 000,000,370 | —- | C] () – C:\Windows\tasks\Ad-Aware Update (Daily 3).job
[2010/09/14 15:16:22 | 000,000,370 | —- | C] () – C:\Windows\tasks\Ad-Aware Update (Daily 2).job
[2010/09/14 15:16:22 | 000,000,370 | —- | C] () – C:\Windows\tasks\Ad-Aware Update (Daily 1).job
[2010/09/14 14:12:54 | 000,000,418 | —- | C] () – C:\Windows\tasks\ParetoLogic Update Version3.job
[2010/09/14 14:12:53 | 000,000,446 | —- | C] () – C:\Windows\tasks\ParetoLogic Privacy Controls_{C7A976E8-C001-11DF-9877-001A6B726D8C}.job
[2010/09/14 14:12:51 | 000,001,019 | —- | C] () – C:\Users\Public\Desktop\ParetoLogic Privacy Controls.lnk
[2010/09/14 13:54:30 | 000,000,390 | —- | C] () – C:\Windows\tasks\RegCure Program Check.job
[2010/09/14 13:54:28 | 000,000,372 | —- | C] () – C:\Windows\tasks\RegCure.job
[2010/09/14 13:52:25 | 000,000,784 | —- | C] () – C:\Users\Public\Desktop\RegCure.lnk
[2010/09/14 12:27:52 | 000,000,004 | —- | C] () – C:\Users\terry\AppData\Roaming\avdrn.dat
[2010/09/12 18:41:50 | 000,001,887 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader 8.lnk
[2010/09/11 19:27:47 | 000,010,925 | —- | C] () – C:\Users\terry\Documents\Jessica's Titanic story.docx
[2010/09/11 12:01:33 | 000,001,871 | —- | C] () – C:\Users\Public\Desktop\HP Help and Support.lnk
[2010/09/10 19:49:42 | 000,046,976 | —- | C] () – C:\Windows\System32\drivers\srenum.sys
[2010/09/10 19:49:42 | 000,004,128 | —- | C] () – C:\Windows\System32\msrun.exe
[2010/09/10 07:05:34 | 000,044,032 | —- | C] () – C:\Users\terry\Documents\Salary_Increment_System.pps
[2010/09/09 19:54:22 | 000,000,120 | —- | C] () – C:\Users\terry\AppData\Local\Ukuni.dat
[2010/09/09 19:54:22 | 000,000,000 | —- | C] () – C:\Users\terry\AppData\Local\Bqesiwu.bin
[2010/09/08 22:01:44 | 000,088,205 | —- | C] () – C:\Users\terry\Documents\nasim(15).jpg
[2010/09/08 22:00:49 | 000,085,002 | —- | C] () – C:\Users\terry\Documents\cynthia(15).jpg
[2010/09/08 14:26:27 | 000,060,771 | —- | C] () – C:\Users\terry\Documents\terry.jpg
[2010/09/01 14:26:25 | 000,001,040 | —- | C] () – C:\Users\Public\Desktop\Acrobat Reader 5.0.lnk
[2010/08/27 17:22:43 | 000,083,668 | —- | C] () – C:\Users\terry\Documents\checkin.pdf
[2010/08/24 09:25:18 | 000,333,827 | —- | C] () – C:\Users\terry\Documents\aug4.PDF
[2010/08/24 09:22:48 | 000,338,540 | —- | C] () – C:\Users\terry\Documents\aug3.PDF
[2010/08/24 09:20:48 | 000,335,731 | —- | C] () – C:\Users\terry\Documents\aug2.PDF
[2010/08/24 09:19:12 | 000,333,586 | —- | C] () – C:\Users\terry\Documents\aug1.PDF
[2010/08/21 21:41:31 | 000,000,106 | —- | C] () – C:\Users\terry\Desktop\Sky Broadband (2).url
[2010/05/06 19:53:50 | 000,017,408 | —- | C] () – C:\Users\terry\AppData\Local\WebpageIcons.db
[2010/01/28 23:08:13 | 000,000,008 | —- | C] () – C:\ProgramData\sysReserve.ini
[2009/10/10 08:15:53 | 000,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2009/08/20 15:38:17 | 000,000,033 | —- | C] () – C:\Windows\LVMMail.INI
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/04/21 03:56:48 | 000,000,262 | —- | C] () – C:\Windows\wininit.ini
[2008/11/27 17:10:52 | 000,000,221 | —- | C] () – C:\Windows\NCLogConfig.ini
[2008/09/27 14:17:22 | 000,053,248 | —- | C] () – C:\Windows\System32\CommonDL.dll
[2008/09/27 14:17:22 | 000,002,412 | —- | C] () – C:\Windows\System32\lgAxconfig.ini
[2008/09/24 11:41:13 | 000,143,360 | —- | C] () – C:\Windows\System32\msndceo1d.dll
[2008/08/19 18:18:08 | 000,005,972 | —- | C] () – C:\Users\terry\AppData\Local\d3d9caps.dat
[2008/08/18 20:34:21 | 000,000,241 | —- | C] () – C:\Windows\QSync.INI
[2008/08/18 20:31:28 | 000,147,456 | —- | C] () – C:\Windows\System32\MimicICM.dll
[2008/08/18 19:41:08 | 000,000,031 | —- | C] () – C:\Windows\warhead.ini
[2008/07/13 19:24:35 | 000,059,500 | —- | C] () – C:\Windows\System32\lvcoinst.ini
[2008/06/13 17:14:36 | 000,045,056 | —- | C] () – C:\Windows\System32\MPDLL.DLL
[2008/06/13 17:14:35 | 000,000,085 | —- | C] () – C:\Windows\megapfad.ini
[2008/06/10 16:52:36 | 000,028,502 | —- | C] () – C:\ProgramData\hpzinstall.log
[2008/05/28 14:56:46 | 000,000,000 | —- | C] () – C:\Windows\Net-It Now! SE.INI
[2008/05/28 14:30:34 | 000,000,038 | —- | C] () – C:\Windows\Approach.ini
[2008/05/28 14:14:47 | 000,000,000 | —- | C] () – C:\Windows\winhelp.ini
[2008/05/07 14:51:04 | 000,000,029 | —- | C] () – C:\Windows\DEBUGSM.INI
[2008/04/26 03:08:18 | 000,131,072 | —- | C] () – C:\Windows\winfsysrn.dll
[2008/04/15 15:04:46 | 000,000,000 | —- | C] () – C:\Windows\WHECTM.INI
[2008/04/06 21:11:23 | 000,040,960 | —- | C] () – C:\Windows\System32\RDAccess.dll
[2008/02/25 19:16:08 | 000,005,050 | —- | C] () – C:\Windows\cdplayer.ini
[2008/02/11 19:55:18 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1437.dll
[2008/01/29 16:29:08 | 000,000,063 | -H– | C] () – C:\ProgramData\Ts_infos.ini
[2008/01/27 17:36:55 | 000,000,248 | —- | C] () – C:\Windows\phedit.ini
[2008/01/23 23:37:40 | 000,000,952 | -HS- | C] () – C:\Windows\System32\KGyGaAvL.sys
[2008/01/21 18:12:33 | 000,000,032 | —- | C] () – C:\ProgramData\ezsid.dat
[2008/01/02 16:57:36 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1409.dll
[2008/01/02 16:47:22 | 001,953,696 | —- | C] () – C:\Windows\System32\igklg400.dll
[2008/01/02 16:47:22 | 001,533,360 | —- | C] () – C:\Windows\System32\igklg450.dll
[2007/09/14 19:32:46 | 000,018,764 | —- | C] () – C:\Windows\System32\ddmon.dll
[2007/08/24 19:46:48 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1322.dll
[2007/08/24 19:38:54 | 001,238,832 | —- | C] () – C:\Windows\System32\igmedkrn.dll
[2007/08/24 19:38:54 | 000,104,636 | —- | C] () – C:\Windows\System32\igmedcompkrn.dll
[2007/08/16 22:51:38 | 000,015,954 | —- | C] () – C:\Users\terry\AppData\Roaming\UserTile.png
[2007/07/15 11:39:29 | 000,000,606 | —- | C] () – C:\Users\terry\AppData\Roaming\wklnhst.dat
[2007/06/28 06:05:04 | 000,000,011 | —- | C] () – C:\Windows\exchng.ini
[2007/06/28 06:05:03 | 000,000,745 | —- | C] () – C:\Windows\ODBC.INI
[2007/06/22 19:25:19 | 000,000,090 | —- | C] () – C:\Windows\UNWISE.INI
[2007/06/22 08:26:51 | 000,000,000 | —- | C] () – C:\Users\terry\AppData\Local\FnF4.txt
[2007/06/22 07:48:52 | 000,123,904 | —- | C] () – C:\Users\terry\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/06/21 19:28:36 | 000,000,000 | —- | C] () – C:\Users\terry\AppData\Local\QSwitch.txt
[2007/06/21 19:28:36 | 000,000,000 | —- | C] () – C:\Users\terry\AppData\Local\DSwitch.txt
[2007/06/21 19:28:36 | 000,000,000 | —- | C] () – C:\Users\terry\AppData\Local\AtStart.txt
[2007/02/22 11:14:38 | 000,204,800 | —- | C] () – C:\Windows\System32\igfxCoIn_v1214.dll
[2006/12/20 12:00:12 | 000,389,120 | —- | C] () – C:\Windows\System32\btwhidcs.dll
[2006/11/29 08:32:42 | 000,000,000 | —- | C] () – C:\Windows\System32\px.ini
[2006/11/02 13:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 13:34:36 | 000,020,491 | -H– | C] () – C:\Windows\System32\MFC421.dll
[2006/11/02 13:34:36 | 000,020,491 | —- | C] () – C:\Windows\System32\MFC421D.dll
[2006/11/02 12:18:33 | 000,053,248 | —- | C] () – C:\Program Files\Common Files\dns.cert
[2006/11/02 08:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/09/19 07:02:40 | 000,520,192 | —- | C] () – C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006/09/19 07:02:40 | 000,204,800 | —- | C] () – C:\Windows\System32\CddbFileTaggerRoxio.dll
[2006/07/16 13:25:48 | 000,009,847 | —- | C] () – C:\Windows\System32\mswdneo1e.dll
[2005/05/07 13:06:00 | 000,016,480 | —- | C] () – C:\Windows\System32\rixdicon.dll
[2005/04/03 22:30:00 | 000,110,592 | R— | C] () – C:\Windows\System32\scardsyn.dll
[2002/03/21 15:39:02 | 000,073,728 | —- | C] () – C:\Windows\System32\UNACEV2.DLL
[2001/11/14 12:56:00 | 001,802,240 | —- | C] () – C:\Windows\System32\lcppn21.dll
[2001/07/13 07:04:00 | 000,373,248 | —- | C] () – C:\Windows\EyeCand3.INI
[1999/03/10 02:23:00 | 000,222,928 | —- | C] () – C:\Windows\System32\lobas09.dll
[1999/01/27 13:39:06 | 000,065,024 | —- | C] () – C:\Windows\System32\indounin.dll
[1998/05/07 03:10:00 | 000,069,632 | R— | C] () – C:\Windows\System32\ODMA32.dll
[1998/03/18 02:23:00 | 000,096,256 | —- | C] () – C:\Windows\System32\nsqlc32.dll
[1998/01/13 02:23:00 | 000,047,104 | —- | C] () – C:\Windows\System32\lotrn13.dll
[1997/11/14 02:23:00 | 000,031,008 | —- | C] () – C:\Windows\System32\ivtrn09.dll
[1997/08/01 00:00:00 | 000,022,016 | —- | C] () – C:\Windows\System32\DOCOBJ.DLL
[1997/08/01 00:00:00 | 000,012,288 | —- | C] () – C:\Windows\System32\HLINKPRX.DLL
[1997/06/13 07:56:08 | 000,056,832 | —- | C] () – C:\Windows\System32\Iyvu9_32.dll
[1994/07/25 02:23:00 | 000,014,928 | —- | C] () – C:\Windows\System32\wingen.drv
[1994/04/07 02:23:00 | 000,000,462 | —- | C] () – C:\Windows\lodbf13.ini

========== LOP Check ==========

[2010/07/27 19:29:25 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\ACD Systems
[2008/01/29 07:58:18 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\Ashampoo Photo Commander 5
[2009/11/14 21:03:10 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\bifrost
[2009/01/26 14:16:51 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\CSA
[2007/09/14 19:36:48 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\deskPDF
[2007/09/13 19:48:06 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\EPSON
[2010/09/13 07:49:18 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\Ewygyr
[2010/06/14 10:29:54 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\Facebook
[2008/08/18 20:30:53 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\FotoWire
[2009/02/02 15:24:24 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\FTWeak
[2008/01/29 16:17:08 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\gtk-2.0
[2008/11/10 09:34:30 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\Image Zone Express
[2010/09/01 14:26:13 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\InterTrust
[2008/09/24 19:25:33 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\KeePass
[2008/02/20 04:36:19 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\MiniDm
[2009/10/30 19:51:34 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\Moyea
[2010/01/10 17:33:33 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\Nokia
[2010/01/10 17:33:36 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\Nokia Ovi Suite
[2008/01/30 23:26:12 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\ParetoLogic
[2009/09/01 21:05:56 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\PC Suite
[2009/12/31 02:56:36 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\PeerNetworking
[2008/06/10 17:35:13 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\Printer Info Cache
[2009/10/10 16:50:54 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\Serif
[2009/02/07 07:48:17 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\Sony
[2008/09/27 21:12:34 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\Sony Setup
[2010/07/03 11:59:00 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\Sorman
[2008/05/29 16:34:42 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\Steganos
[2007/07/15 11:39:30 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\Template
[2010/02/18 21:35:08 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\TuxPaint
[2010/09/11 22:04:55 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\Uniblue
[2009/07/12 00:38:15 | 000,000,000 | —D | M] – C:\Users\terry\AppData\Roaming\Yrolap
[2010/09/14 15:16:22 | 000,000,370 | —- | M] () – C:\Windows\Tasks\Ad-Aware Update (Daily 1).job
[2010/09/14 15:16:23 | 000,000,370 | —- | M] () – C:\Windows\Tasks\Ad-Aware Update (Daily 2).job
[2010/09/14 15:16:23 | 000,000,370 | —- | M] () – C:\Windows\Tasks\Ad-Aware Update (Daily 3).job
[2010/09/14 15:16:23 | 000,000,370 | —- | M] () – C:\Windows\Tasks\Ad-Aware Update (Daily 4).job
[2010/09/14 15:16:23 | 000,000,370 | —- | M] () – C:\Windows\Tasks\Ad-Aware Update (Weekly).job
[2010/09/14 15:14:19 | 000,000,446 | —- | M] () – C:\Windows\Tasks\ParetoLogic Privacy Controls_{C7A976E8-C001-11DF-9877-001A6B726D8C}.job
[2010/09/14 15:17:14 | 000,000,444 | —- | M] () – C:\Windows\Tasks\ParetoLogic Registration3.job
[2010/09/14 15:14:19 | 000,000,418 | —- | M] () – C:\Windows\Tasks\ParetoLogic Update Version3.job
[2010/09/14 17:00:22 | 000,000,390 | —- | M] () – C:\Windows\Tasks\RegCure Program Check.job
[2010/09/14 15:14:19 | 000,000,372 | —- | M] () – C:\Windows\Tasks\RegCure.job
[2010/09/14 15:11:00 | 000,032,600 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2010/09/14 16:36:25 | 000,000,418 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{45513001-7868-44F9-A6B6-9CFCD4D4CF7B}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/09/14 15:14:05 | 000,138,807 | —- | M] () – C:\aaw7boot.log
[2006/09/18 22:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2008/11/04 03:22:45 | 000,000,656 | —- | M] () – C:\bar.emf
[2008/01/19 08:45:45 | 000,333,203 | RHS- | M] () – C:\bootmgr
[2006/09/18 22:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:\eula.1028.txt
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:\eula.1031.txt
[2007/11/07 09:00:40 | 000,010,134 | —- | M] () – C:\eula.1033.txt
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:\eula.1036.txt
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:\eula.1040.txt
[2007/11/07 09:00:40 | 000,000,118 | —- | M] () – C:\eula.1041.txt
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:\eula.1042.txt
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:\eula.2052.txt
[2007/11/07 09:00:40 | 000,017,734 | —- | M] () – C:\eula.3082.txt
[2007/11/07 09:00:40 | 000,001,110 | —- | M] () – C:\globdata.ini
[2010/09/14 15:14:09 | 2137,382,912 | -HS- | M] () – C:\hiberfil.sys
[2007/11/07 09:03:18 | 000,562,688 | —- | M] (Microsoft Corporation) – C:\install.exe
[2007/11/07 09:00:40 | 000,000,843 | —- | M] () – C:\install.ini
[2007/11/07 09:03:18 | 000,076,304 | —- | M] (Microsoft Corporation) – C:\install.res.1028.dll
[2007/11/07 09:03:18 | 000,096,272 | —- | M] (Microsoft Corporation) – C:\install.res.1031.dll
[2007/11/07 09:03:18 | 000,091,152 | —- | M] (Microsoft Corporation) – C:\install.res.1033.dll
[2007/11/07 09:03:18 | 000,097,296 | —- | M] (Microsoft Corporation) – C:\install.res.1036.dll
[2007/11/07 09:03:18 | 000,095,248 | —- | M] (Microsoft Corporation) – C:\install.res.1040.dll
[2007/11/07 09:03:18 | 000,081,424 | —- | M] (Microsoft Corporation) – C:\install.res.1041.dll
[2007/11/07 09:03:18 | 000,079,888 | —- | M] (Microsoft Corporation) – C:\install.res.1042.dll
[2007/11/07 09:03:18 | 000,075,792 | —- | M] (Microsoft Corporation) – C:\install.res.2052.dll
[2007/11/07 09:03:18 | 000,096,272 | —- | M] (Microsoft Corporation) – C:\install.res.3082.dll
[2007/06/28 06:00:36 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2008/08/18 20:26:02 | 000,000,091 | —- | M] () – C:\LogiSetup.log
[2007/06/28 06:00:36 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2010/09/14 15:14:06 | 2451,165,184 | -HS- | M] () – C:\pagefile.sys
[2010/01/31 07:24:46 | 000,002,628 | —- | M] () – C:\pspbrwse.jbf
[2008/09/06 00:37:47 | 000,000,268 | -H– | M] () – C:\sqmdata00.sqm
[2008/09/06 16:46:16 | 000,000,268 | -H– | M] () – C:\sqmdata01.sqm
[2008/09/06 20:05:01 | 000,000,268 | -H– | M] () – C:\sqmdata02.sqm
[2008/09/07 13:48:43 | 000,000,268 | -H– | M] () – C:\sqmdata03.sqm
[2008/09/07 20:26:33 | 000,000,268 | -H– | M] () – C:\sqmdata04.sqm
[2008/09/07 21:15:02 | 000,000,268 | -H– | M] () – C:\sqmdata05.sqm
[2008/09/07 21:25:01 | 000,000,268 | -H– | M] () – C:\sqmdata06.sqm
[2008/09/08 22:17:01 | 000,000,268 | -H– | M] () – C:\sqmdata07.sqm
[2008/09/09 21:56:32 | 000,000,268 | -H– | M] () – C:\sqmdata08.sqm
[2008/09/10 17:14:12 | 000,000,268 | -H– | M] () – C:\sqmdata09.sqm
[2008/09/10 22:49:45 | 000,000,268 | -H– | M] () – C:\sqmdata10.sqm
[2008/09/11 08:24:26 | 000,000,268 | -H– | M] () – C:\sqmdata11.sqm
[2008/09/18 23:37:09 | 000,000,268 | -H– | M] () – C:\sqmdata12.sqm
[2008/09/19 23:24:26 | 000,000,268 | -H– | M] () – C:\sqmdata13.sqm
[2008/09/20 08:15:39 | 000,000,268 | -H– | M] () – C:\sqmdata14.sqm
[2008/09/20 18:47:38 | 000,000,268 | -H– | M] () – C:\sqmdata15.sqm
[2008/09/20 19:06:15 | 000,000,268 | -H– | M] () – C:\sqmdata16.sqm
[2008/09/20 19:24:29 | 000,000,268 | -H– | M] () – C:\sqmdata17.sqm
[2008/09/06 00:37:47 | 000,000,244 | -H– | M] () – C:\sqmnoopt00.sqm
[2008/09/06 16:46:16 | 000,000,244 | -H– | M] () – C:\sqmnoopt01.sqm
[2008/09/06 20:05:01 | 000,000,244 | -H– | M] () – C:\sqmnoopt02.sqm
[2008/09/07 13:48:43 | 000,000,244 | -H– | M] () – C:\sqmnoopt03.sqm
[2008/09/07 20:26:33 | 000,000,244 | -H– | M] () – C:\sqmnoopt04.sqm
[2008/09/07 21:15:02 | 000,000,244 | -H– | M] () – C:\sqmnoopt05.sqm
[2008/09/07 21:25:01 | 000,000,244 | -H– | M] () – C:\sqmnoopt06.sqm
[2008/09/08 22:17:01 | 000,000,244 | -H– | M] () – C:\sqmnoopt07.sqm
[2008/09/09 21:56:32 | 000,000,244 | -H– | M] () – C:\sqmnoopt08.sqm
[2008/09/10 17:14:11 | 000,000,244 | -H– | M] () – C:\sqmnoopt09.sqm
[2008/09/10 22:49:45 | 000,000,244 | -H– | M] () – C:\sqmnoopt10.sqm
[2008/09/11 08:24:26 | 000,000,244 | -H– | M] () – C:\sqmnoopt11.sqm
[2008/09/18 23:37:09 | 000,000,244 | -H– | M] () – C:\sqmnoopt12.sqm
[2008/09/19 23:24:26 | 000,000,244 | -H– | M] () – C:\sqmnoopt13.sqm
[2008/09/20 08:15:39 | 000,000,244 | -H– | M] () – C:\sqmnoopt14.sqm
[2008/09/20 18:47:38 | 000,000,244 | -H– | M] () – C:\sqmnoopt15.sqm
[2008/09/20 19:06:15 | 000,000,244 | -H– | M] () – C:\sqmnoopt16.sqm
[2008/09/20 19:24:29 | 000,000,244 | -H– | M] () – C:\sqmnoopt17.sqm
[2007/11/07 09:00:40 | 000,005,686 | —- | M] () – C:\vcredist.bmp
[2007/11/07 09:09:22 | 001,442,522 | —- | M] () – C:\VC_RED.cab
[2007/11/07 09:12:28 | 000,232,960 | —- | M] () – C:\VC_RED.MSI
[2007/08/19 14:27:01 | 000,000,416 | —- | M] () – C:\wcid0.log
[2007/06/22 08:03:58 | 000,000,158 | —- | M] () – C:\YServer.txt

< %systemroot%\Fonts\*.com >
[2006/11/02 13:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 13:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 13:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2006/11/02 13:37:12 | 000,030,808 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 22:37:34 | 000,000,065 | -H– | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/12/29 09:57:18 | 000,273,920 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\hpzpp4v2.dll
[2007/03/28 13:57:34 | 000,274,944 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\hpzpp5ha.dll
[1998/02/05 19:16:18 | 000,018,432 | —- | M] () – C:\Windows\System32\spool\prtprocs\w32x86\jDocPrc.dll
[2006/11/02 13:35:48 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 20:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2001/07/13 07:04:00 | 000,253,952 | —- | M] () – C:\Windows\Jasc Media Center Plus.scr
[2009/07/10 12:15:46 | 000,306,544 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/01/26 23:50:14 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 11:34:05 | 000,020,480 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 11:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 11:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/03/22 13:07:43 | 000,000,286 | -HS- | M] () – C:\Users\terry\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >
[2010/09/07 14:45:41 | 000,053,248 | —- | M] () – C:\Program Files\Common Files\dns.cert

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 223 bytes -> C:\ProgramData\TEMP:8927A071
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:D1B5B4F1
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:C39AA0B1
< End of report >


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:08:06, on 14/09/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18943)
Boot mode: Normal

Running processes:
C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Windows\System32\NILaunch.exe
C:\Program Files\Common Files\Logitech\QCDriver2\LVComS.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\PROGRA~1\EVIDEN~1\ee.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Norton 360\Engine\3.8.0.41\MCUI32.EXE
C:\Users\terry\Documents\Documents\Downloads\Downloads\Downloads\Downloads\Downloads\Downloads\OTL.exe
C:\Windows\notepad.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\terry\Documents\Documents\Downloads\Downloads\Downloads\Downloads\Downloads\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sky.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ie/defaul…earch.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided By Sky Broadband
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll
R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo;! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\3.8.0.41\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\3.8.0.41\IPSBHO.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: VeriSoft Access Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\Bioscrypt\VeriSoft\Bin\ItIEAddIn.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn5\yt.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.8.0.41\coIEPlg.dll
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Net-It Launcher] C:\Windows\system32\NILaunch.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver2\LVCOMS.EXE
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [Ctoni] rundll32.exe "C:\Users\terry\AppData\Local\ifesiqasoqe.dll",Startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [Evidence Eliminator] C:\Program Files\Evidence Eliminator\EEStartupLauncher.exe
O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~1\Yahoo!\MESSEN~1\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ISUSPM Startup] c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [{F51FB64E-024A-CF09-A3C6-C9C4CEA94BC7}] C:\Users\terry\AppData\Roaming\Yrolap\duny.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O8 - Extra context menu item: Send image to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Sky - {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.sky.com (file missing)
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog; This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…tDetection2.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.8.0.41\coIEPlg.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1ca198ca353ce6a) (gupdate1ca198ca353ce6a) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: Megatech-Software-Protection - Unknown owner - C:\Program Files\Common Files\Megatech\MProtect\MPSERV.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 15137 bytes



DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 17:11:10.43 on 14/09/2010
Internet Explorer: 8.0.6001.18943
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.44.1033.18.2038.487 [GMT 1:00]

SP: Spybot - Search and Destroy *enabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: SpywareBot *disabled* (Updated) {B78FA807-6C6E-41D2-B49E-E620128554AB}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\System32\svchost.exe -k Cognizance
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\Program Files\Common Files\Megatech\MProtect\MPSERV.EXE
C:\Windows\system32\rundll32.exe
C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\System32\svchost.exe -k NetworkService
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Windows\System32\NILaunch.exe
C:\Program Files\Common Files\Logitech\QCDriver2\LVComS.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehsched.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\PROGRA~1\EVIDEN~1\ee.exe
C:\Windows\ehome\ehRecvr.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Norton 360\Engine\3.8.0.41\MCUI32.EXE
C:\Users\terry\Documents\Documents\Downloads\Downloads\Downloads\Downloads\Downloads\Downloads\OTL.exe
C:\Windows\notepad.exe
C:\Users\terry\Documents\Documents\Downloads\Downloads\Downloads\Downloads\Downloads\Downloads\HiJackThis.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\terry\Documents\Documents\Downloads\Downloads\Downloads\Downloads\Downloads\Downloads\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://uk.yahoo.com/
uSearch Page =
uDefault_Search_URL = hxxp://www.google.com/ie
uWindow Title = Internet Explorer Provided By Sky Broadband
uDefault_Page_URL = hxxp://www.sky.com
mStart Page = hxxp://uk.yahoo.com
mDefault_Page_URL = hxxp://uk.yahoo.com
mDefault_Search_URL = hxxp://uk.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://uk.search.yahoo.com
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride =
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://uk.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://uk.search.yahoo.com
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn5\yt.dll
uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
mWinlogon: Userinit=c:\windows\system32\userinit.exe
BHO: &Yahoo;! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn5\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Spybot-S&D; IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton 360\engine\3.8.0.41\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton 360\engine\3.8.0.41\IPSBHO.DLL
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: VeriSoft Access Manager: {df21f1db-80c6-11d3-9483-b03d0ec10000} - c:\program files\bioscrypt\verisoft\bin\ItIEAddIn.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn5\yt.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton 360\engine\3.8.0.41\coIEPlg.dll
TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [YSearchProtection] c:\program files\yahoo!\search protection\SearchProtection.exe
uRun: [Evidence Eliminator] c:\program files\evidence eliminator\EEStartupLauncher.exe
uRun: [Search Protection] c:\program files\yahoo!\search protection\SearchProtection.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messen~1\YahooMessenger.exe" -quiet
uRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup
uRun: []
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [{F51FB64E-024A-CF09-A3C6-C9C4CEA94BC7}] c:\users\terry\appdata\roaming\yrolap\duny.exe
mRun: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
mRun: [CognizanceTS] rundll32.exe c:\progra~1\bioscr~1\verisoft\bin\ASTSVCC.dll,RegisterModule
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [Net-It Launcher] c:\windows\system32\NILaunch.exe
mRun: [LVCOMS] c:\program files\common files\logitech\qcdriver2\LVCOMS.EXE
mRun: [YSearchProtection] "c:\program files\yahoo!\search protection\SearchProtection.exe"
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe
mRun: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe
mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
mRun: [Ctoni] rundll32.exe "c:\users\terry\appdata\local\ifesiqasoqe.dll",Startup
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport; to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: Send image to &Bluetooth; Device… - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth; Device… - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.sky.com
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - c:\program files\norton 360\engine\3.8.0.41\CoIEPlg.dll
Notify: igfxcui - igfxdev.dll
LSA: Notification Packages = scecli ASWLNPkg

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-1-12 64288]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360\0308000.029\SymEFA.sys [2010-2-5 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\n360\0308000.029\BHDrvx86.sys [2010-2-5 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\n360\0308000.029\cchpx86.sys [2010-2-5 482432]
R1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\elrawdsk.sys [2008-4-6 20560]
R1 IDSVix86;IDSVix86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20100910.001\IDSvix86.sys [2010-9-14 344112]
R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\adobe\photoshop elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-4 98304]
R2 ASBroker;Logon Session Broker;c:\windows\system32\svchost.exe -k Cognizance [2008-8-29 21504]
R2 ASChannel;Local Communication Channel;c:\windows\system32\svchost.exe -k Cognizance [2008-8-29 21504]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-12-2 1181328]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2009-1-24 88176]
R2 Megatech-Software-Protection;Megatech-Software-Protection;c:\program files\common files\megatech\mprotect\MPServ.exe [2008-6-13 36864]
R2 N360;Norton 360;c:\program files\norton 360\engine\3.8.0.41\ccSvcHst.exe [2010-2-5 117640]
R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\adobe\photoshop elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-4 118784]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2010-1-2 1153368]
R2 YahooAUService;Yahoo! Updater;c:\program files\yahoo!\softwareupdate\YahooAUService.exe [2008-11-9 602392]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-9-7 102448]
R3 NETw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\NETw5v32.sys [2008-11-17 3668480]
R3 SYMNDISV;Symantec Network Filter Driver;c:\windows\system32\drivers\n360\0308000.029\symndisv.sys [2010-2-5 48688]
S2 gupdate1ca198ca353ce6a;Google Update Service (gupdate1ca198ca353ce6a);c:\program files\google\update\GoogleUpdate.exe [2009-8-10 133104]
S2 srenum;srenum;c:\windows\system32\drivers\srenum.sys [2010-9-10 46976]
S3 MODBDA2;DiBcom MOD3000 TV receiver;c:\windows\system32\drivers\yuanmodbda2.sys [2006-10-14 32256]

=============== Created Last 30 ================

2010-09-14 14:12 –d—– c:\program files\common files\ParetoLogic
2010-09-14 14:12 –d—– c:\program files\ParetoLogic
2010-09-14 13:52 –d—– c:\programdata\RegCure
2010-09-14 13:52 –d—– c:\progra~2\RegCure
2010-09-14 12:27 4 a——- c:\users\terry\appdata\roaming\avdrn.dat
2010-09-11 22:04 –d—– c:\users\terry\appdata\roaming\Uniblue
2010-09-10 19:49 46,976 a——- c:\windows\system32\drivers\srenum.sys
2010-09-10 19:49 4,128 a——- c:\windows\system32\msrun.exe
2010-09-08 06:08 –d—– c:\programdata\WindowsSearch
2010-09-07 15:22 184,320 a——- c:\windows\system32\ESDTR.dll
2010-09-07 15:22 126,976 a——- c:\windows\system32\Esint23.dll
2010-09-07 15:22 90,112 a——- c:\windows\system32\epcomdd.dll
2010-09-07 15:22 77,824 a——- c:\windows\system32\Esintpl.dll
2010-09-07 15:22 66,048 a——- c:\windows\system32\escwian.dll
2010-09-07 15:22 61,952 a——- c:\windows\system32\escwiad.dll
2010-09-07 15:22 53,248 a——- c:\windows\system32\ESICM.dll
2010-09-07 15:22 44,544 a——- c:\windows\system32\escwiab.dll
2010-09-07 15:22 3,584 a——- c:\windows\system32\eswiaml.dll
2010-09-03 06:16 –dsh— C:\found.001
2010-09-01 14:26 –d—– c:\windows\Profiles
2010-09-01 14:26 –d—– c:\windows\system32\Adobe
2010-08-29 20:44 177,664 a——- c:\windows\system32\mpg2splt.ax
2010-08-29 20:44 80,896 a——- c:\windows\system32\MSNP.ax
2010-08-29 20:44 293,376 a——- c:\windows\system32\psisdecd.dll
2010-08-29 20:44 428,544 a——- c:\windows\system32\EncDec.dll
2010-08-29 20:44 217,088 a——- c:\windows\system32\psisrndr.ax
2010-08-29 20:32 295,264 a——- c:\windows\system32\PresentationHost.exe
2010-08-29 20:32 99,176 a——- c:\windows\system32\PresentationHostProxy.dll
2010-08-29 20:31 297,808 a——- c:\windows\system32\mscoree.dll
2010-08-29 20:31 49,472 a——- c:\windows\system32\netfxperf.dll
2010-08-29 20:31 1,130,824 a——- c:\windows\system32\dfshim.dll
2010-08-29 20:20 81,920 a——- c:\windows\system32\iccvid.dll
2010-08-29 20:20 898,952 a——- c:\windows\system32\drivers\tcpip.sys
2010-08-29 20:20 28,672 a——- c:\windows\system32\Apphlpdm.dll
2010-08-29 20:20 4,240,384 a——- c:\windows\system32\GameUXLegacyGDFs.dll
2010-08-29 20:20 274,432 a——- c:\windows\system32\schannel.dll
2010-08-29 20:19 2,036,736 a——- c:\windows\system32\win32k.sys
2010-08-29 20:19 3,598,216 a——- c:\windows\system32\ntkrnlpa.exe
2010-08-29 20:19 3,545,992 a——- c:\windows\system32\ntoskrnl.exe
2010-08-29 20:19 302,080 a——- c:\windows\system32\drivers\srv.sys
2010-08-29 20:19 144,896 a——- c:\windows\system32\drivers\srv2.sys
2010-08-29 20:19 1,257,472 a——- c:\windows\system32\msxml3.dll
2010-08-29 20:19 36,352 a——- c:\windows\system32\rtutils.dll
2010-08-29 20:19 171,520 a——- c:\windows\system32\wintrust.dll
2010-08-29 20:13 1,314,816 a——- c:\windows\system32\quartz.dll
2010-08-29 20:12 2,048 a——- c:\windows\system32\tzres.dll

==================== Find3M ====================

2010-09-14 15:11 2,484 a——- c:\windows\bthservsdp.dat
2010-09-07 14:45 53,248 a——- c:\program files\common files\dns.cert
2010-09-01 16:44 143,360 a——- c:\windows\inf\infstrng.dat
2010-09-01 16:44 86,016 a——- c:\windows\inf\infpub.dat
2010-07-27 18:42 10,368 a——- c:\windows\system32\drivers\pfc.sys
2010-07-04 16:09 16,384 a–sh— c:\windows\help\oem\scripts\%appdata%\microsoft\windows\ietldcache\index.dat
2010-06-27 17:03 143,360 a——- c:\windows\inf\infstor.dat
2010-06-26 07:05 916,480 a——- c:\windows\system32\wininet.dll
2010-06-26 07:02 109,056 a——- c:\windows\system32\iesysprep.dll
2010-06-26 07:02 71,680 a——- c:\windows\system32\iesetup.dll
2010-06-26 05:25 133,632 a——- c:\windows\system32\ieUnatt.exe
2009-01-26 23:50 174 a–sh— c:\program files\desktop.ini
2009-01-26 23:30 665,600 a——- c:\windows\inf\drvindex.dat
2009-01-14 10:57 606 a——- c:\users\terry\appdata\roaming\wklnhst.dat
2008-06-07 03:05 4,170 a——- c:\users\terry\Searches.zip
2008-01-21 18:12 32 a——- c:\programdata\ezsid.dat
2008-01-21 18:12 32 a——- c:\progra~2\ezsid.dat
2006-11-02 13:42 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 13:42 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 13:42 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 13:42 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 10:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 10:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 10:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 10:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat
2009-06-05 11:15 16,384 a–sh— c:\windows\serviceprofiles\networkservice\appdata\local\temp\cookies\index.dat
2009-06-05 11:15 16,384 a–sh— c:\windows\serviceprofiles\networkservice\appdata\local\temp\history\history.ie5\index.dat
2009-06-05 11:15 32,768 a–sh— c:\windows\serviceprofiles\networkservice\appdata\local\temp\temporary internet files\content.ie5\index.dat
2007-06-21 22:34 22 a–sh— c:\windows\sminst\HPCD.sys
2009-02-04 08:28 952 a–sh— c:\windows\system32\KGyGaAvL.sys
2009-05-11 18:42 16,384 a–sh— c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\mshist012009051120090512\index.dat
2009-09-13 18:40 245,760 a–sh— c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat

============= FINISH: 17:12:37.09 ===============

RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows Vista
Version 6.0.6001 (Service Pack 1)
Number of processors #2
==============================================
>Drivers
==============================================
0x8D808000 C:\Windows\system32\DRIVERS\igdkmd32.sys 7057408 bytes (Intel Corporation, Intel Graphics Kernel Mode Driver)
0x8224A000 C:\Windows\system32\ntkrnlpa.exe 3903488 bytes (Microsoft Corporation, NT Kernel & System)
0x8224A000 PnpManager 3903488 bytes
0x8224A000 RAW 3903488 bytes
0x8224A000 WMIxWDM 3903488 bytes
0x8E00A000 C:\Windows\system32\DRIVERS\NETw5v32.sys 3706880 bytes (Intel Corporation, Intel® Wireless WiFi Link Driver)
0x818A0000 Win32k 2105344 bytes
0x818A0000 C:\Windows\System32\win32k.sys 2105344 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0x8FA0E000 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100916.002\NAVEX15.SYS 1359872 bytes (Symantec Corporation, AV Engine)
0x88407000 C:\Windows\System32\Drivers\Ntfs.sys 1110016 bytes (Microsoft Corporation, NT File System Driver)
0x88076000 C:\Windows\system32\drivers\ndis.sys 1093632 bytes (Microsoft Corporation, NDIS 6.0 wrapper driver)
0x8F290000 C:\Windows\system32\DRIVERS\HSX_DPV.sys 1060864 bytes (Conexant Systems, Inc., HSF_DP driver)
0x8820C000 C:\Windows\System32\drivers\tcpip.sys 954368 bytes (Microsoft Corporation, TCP/IP Driver)
0x806D1000 C:\Windows\system32\CI.dll 917504 bytes (Microsoft Corporation, Code Integrity Module)
0xB7AEB000 C:\Windows\system32\drivers\peauth.sys 909312 bytes (Microsoft Corporation, Protected Environment Authentication and Authorization Export Driver)
0x88310000 C:\Windows\System32\Drivers\dump_iaStor.sys 892928 bytes
0x87E0E000 C:\Windows\system32\DRIVERS\iaStor.sys 892928 bytes (Intel Corporation, Intel Matrix Storage Manager driver - ia32)
0x8F402000 C:\Windows\system32\DRIVERS\HSX_CNXT.sys 741376 bytes (Conexant Systems, Inc., HSF_CNXT driver)
0xB664A000 C:\Windows\system32\drivers\spsys.sys 716800 bytes (Microsoft Corporation, security processor)
0x8DEC3000 C:\Windows\System32\drivers\dxgkrnl.sys 651264 bytes (Microsoft Corporation, DirectX Graphics Kernel)
0x87C0C000 C:\Windows\system32\drivers\Wdf01000.sys 507904 bytes (Microsoft Corporation, WDF Dynamic)
0x91203000 C:\Windows\system32\drivers\btwaudio.sys 503808 bytes (Broadcom Corporation., Bluetooth Audio Device)
0x9773A000 C:\Windows\System32\Drivers\N360\0308000.029\ccHPx86.sys 503808 bytes (Symantec Corporation, Common Client Hash Provider Driver)
0x88005000 C:\Windows\System32\Drivers\ksecdd.sys 462848 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xB66F9000 C:\Windows\system32\drivers\HTTP.sys 446464 bytes (Microsoft Corporation, HTTP Protocol Stack)
0x8F393000 C:\Windows\system32\drivers\btwavdt.sys 421888 bytes (Broadcom Corporation., Broadcom Bluetooth AVDT Service)
0x80617000 C:\Windows\system32\mcupdate_GenuineIntel.dll 393216 bytes (Microsoft Corporation, Intel Microcode Update Library)
0x976A8000 C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys 385024 bytes (Symantec Corporation, Symantec Eraser Control Driver)
0x9764D000 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20100914.003\IDSvix86.sys 360448 bytes (Symantec Corporation, IDS Core Driver)
0x8F4C4000 C:\Windows\System32\Drivers\N360\0308000.029\SRTSP.SYS 339968 bytes (Symantec Corporation, Symantec AutoProtect)
0x8E400000 C:\Windows\system32\DRIVERS\rixdptsk.sys 331776 bytes (REDC, RICOH XD SM Driver)
0x87F69000 C:\Windows\system32\drivers\N360\0308000.029\SYMEFA.SYS 323584 bytes (Symantec Corporation, Symantec Extended File Attributes)
0xB7A81000 C:\Windows\System32\DRIVERS\srv.sys 319488 bytes (Microsoft Corporation, Server driver)
0x87DAD000 C:\Windows\system32\DRIVERS\yk60x86.sys 311296 bytes (Marvell, Miniport Driver for Marvell Yukon Ethernet Controller.)
0x87D3E000 C:\Windows\System32\drivers\volmgrx.sys 303104 bytes (Microsoft Corporation, Volume Manager Extension Driver)
0x91382000 C:\Windows\system32\drivers\afd.sys 294912 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0x87C95000 C:\Windows\system32\drivers\acpi.sys 286720 bytes (Microsoft Corporation, ACPI Driver for NT)
0x977B5000 C:\Windows\System32\Drivers\N360\0308000.029\BHDrvx86.sys 270336 bytes (Symantec Corporation, BASH Driver)
0x80690000 C:\Windows\system32\CLFS.SYS 266240 bytes (Microsoft Corporation, Common Log File System Driver)
0x8E4F6000 C:\Windows\system32\DRIVERS\storport.sys 266240 bytes (Microsoft Corporation, Microsoft Storage Port Driver)
0x8F252000 C:\Windows\system32\DRIVERS\HSXHWAZL.sys 253952 bytes (Conexant Systems, Inc., HSF_HWAZL WDM driver)
0x8DF7A000 C:\Windows\system32\DRIVERS\USBPORT.SYS 253952 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0x97607000 C:\Windows\system32\DRIVERS\rdbss.sys 245760 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0x8F53C000 C:\Windows\System32\Drivers\bthport.sys 237568 bytes (Microsoft Corporation, Bluetooth Bus Driver)
0x881AC000 C:\Windows\system32\drivers\NETIO.SYS 237568 bytes (Microsoft Corporation, Network I/O Subsystem)
0xB7A09000 C:\Windows\system32\DRIVERS\mrxsmb10.sys 233472 bytes (Microsoft Corporation, Longhorn SMB Downlevel SubRdr)
0x88516000 C:\Windows\system32\drivers\volsnap.sys 233472 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0x91317000 C:\Windows\System32\Drivers\N360\0308000.029\SYMTDI.SYS 212992 bytes (Symantec Corporation, Network Dispatch Driver)
0x87FC1000 C:\Windows\system32\DRIVERS\usbhub.sys 212992 bytes (Microsoft Corporation, Default Hub Driver for USB)
0x82217000 ACPI_HAL 208896 bytes
0x807B1000 C:\Windows\system32\drivers\CHDRT32.sys 208896 bytes (Conexant Systems Inc., High Definition Audio Function Driver)
0x82217000 C:\Windows\system32\hal.dll 208896 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0x87F18000 C:\Windows\system32\drivers\fltmgr.sys 204800 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0x913CA000 C:\Windows\System32\DRIVERS\netbt.sys 204800 bytes (Microsoft Corporation, MBT Transport driver)
0x8E4C8000 C:\Windows\system32\DRIVERS\msiscsi.sys 188416 bytes (Microsoft Corporation, Microsoft iSCSI Initiator Driver)
0x8F200000 C:\Windows\system32\drivers\portcls.sys 184320 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0x88181000 C:\Windows\system32\drivers\msrpc.sys 176128 bytes (Microsoft Corporation, Kernel Remote Procedure Call Provider)
0x8E5D1000 C:\Windows\system32\DRIVERS\ks.sys 172032 bytes (Microsoft Corporation, Kernel CSA Library)
0xB6603000 C:\Windows\system32\DRIVERS\nwifi.sys 172032 bytes (Microsoft Corporation, NativeWiFi Miniport Driver)
0x8E473000 C:\Windows\system32\DRIVERS\Apfiltr.sys 167936 bytes (Alps Electric Co., Ltd., Alps Touch Pad Driver)
0x88566000 C:\Windows\System32\drivers\ecache.sys 159744 bytes (Microsoft Corporation, Special Memory Device Cache)
0x87CEC000 C:\Windows\system32\drivers\pci.sys 159744 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0xB7A5A000 C:\Windows\System32\DRIVERS\srv2.sys 159744 bytes (Microsoft Corporation, Smb 2.0 Server driver)
0x8F22D000 C:\Windows\system32\drivers\drmk.sys 151552 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0x8FB63000 C:\Windows\system32\Drivers\SYMEVENT.SYS 151552 bytes (Symantec Corporation, Symantec Event Library)
0x8F517000 C:\Windows\system32\DRIVERS\ATSwpDrv.sys 143360 bytes (AuthenTec, Inc., Slide Fingerprint USB Driver)
0x8E564000 C:\Windows\system32\DRIVERS\ndiswan.sys 143360 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0x8859E000 C:\Windows\system32\drivers\CLASSPNP.SYS 135168 bytes (Microsoft Corporation, SCSI Class System Dll)
0x8FBC4000 C:\Windows\System32\Drivers\usbvideo.sys 135168 bytes (Microsoft Corporation, USB Video Class Driver)
0x912AE000 C:\Windows\System32\drivers\VIDEOPRT.SYS 135168 bytes (Microsoft Corporation, Video Port Driver)
0xB67B1000 C:\Windows\system32\drivers\mrxdav.sys 131072 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0xB67D1000 C:\Windows\system32\DRIVERS\mrxsmb.sys 126976 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0x87EF0000 C:\Windows\system32\drivers\ataport.SYS 122880 bytes (Microsoft Corporation, ATAPI Driver Extension)
0x97706000 C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys 118784 bytes (Symantec Corporation, Symantec Eraser Utility Driver)
0xB6766000 C:\Windows\System32\DRIVERS\srvnet.sys 118784 bytes (Microsoft Corporation, Server Network driver)
0x882F5000 C:\Windows\System32\drivers\fwpkclnt.sys 110592 bytes (Microsoft Corporation, FWP/IPsec Kernel-Mode API)
0x807E4000 C:\Windows\system32\drivers\luafv.sys 110592 bytes (Microsoft Corporation, LUA File Virtualization Filter Driver)
0x8F587000 C:\Windows\system32\DRIVERS\bthpan.sys 106496 bytes (Microsoft Corporation, Bluetooth Personal Area Networking)
0x8E3B1000 C:\Windows\system32\DRIVERS\sdbus.sys 106496 bytes (Microsoft Corporation, SecureDigital Bus Driver)
0xB6783000 C:\Windows\system32\DRIVERS\bowser.sys 102400 bytes (Microsoft Corporation, NT Lan Manager Datagram Receiver Driver)
0x8E4AA000 C:\Windows\system32\DRIVERS\cdrom.sys 98304 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0xB7A42000 C:\Windows\system32\DRIVERS\mrxsmb20.sys 98304 bytes (Microsoft Corporation, Longhorn SMB 2.0 Redirector)
0x97723000 C:\Windows\System32\Drivers\dfsc.sys 94208 bytes (Microsoft Corporation, DFS Namespace Client Driver)
0x8E542000 C:\Windows\system32\DRIVERS\rasl2tp.sys 94208 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0x8FBA4000 C:\Windows\system32\DRIVERS\usbccgp.sys 94208 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)
0xB7BE9000 C:\Windows\system32\DRIVERS\cdfs.sys 90112 bytes (Microsoft Corporation, CD-ROM File System Driver)
0x8F5A1000 C:\Windows\system32\DRIVERS\pacer.sys 90112 bytes (Microsoft Corporation, QoS Packet Scheduler)
0x91301000 C:\Windows\system32\DRIVERS\tdx.sys 90112 bytes (Microsoft Corporation, TDI Translation Driver)
0xB679C000 C:\Windows\System32\drivers\mpsdrv.sys 86016 bytes (Microsoft Corporation, Microsoft Protection Service Driver)
0x8E5AA000 C:\Windows\system32\DRIVERS\rassstp.sys 86016 bytes (Microsoft Corporation, RAS SSTP Miniport Call Manager)
0x91359000 C:\Windows\System32\Drivers\N360\0308000.029\SYMFW.SYS 86016 bytes (Symantec Corporation, Firewall Filter Driver)
0x8FB88000 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100916.002\NAVENG.SYS 81920 bytes (Symantec Corporation, AV Engine)
0x8E596000 C:\Windows\system32\DRIVERS\raspptp.sys 81920 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0x8E3D9000 C:\Windows\system32\DRIVERS\rimsptsk.sys 81920 bytes (REDC, RICOH MS Driver)
0x9136E000 C:\Windows\system32\DRIVERS\smb.sys 81920 bytes (Microsoft Corporation, SMB Transport driver)
0x8E455000 C:\Windows\system32\DRIVERS\i8042prt.sys 77824 bytes (Microsoft Corporation, i8042 Port Driver)
0xB6637000 C:\Windows\system32\DRIVERS\rspndr.sys 77824 bytes (Microsoft Corporation, Link-Layer Topology Responder Driver for NDIS 6)
0x8F5C5000 C:\Windows\system32\DRIVERS\wanarp.sys 77824 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0x8DFC7000 C:\Windows\system32\DRIVERS\HDAudBus.sys 73728 bytes (Microsoft Corporation, High Definition Audio Bus Driver)
0x8858D000 C:\Windows\system32\drivers\disk.sys 69632 bytes (Microsoft Corporation, PnP Disk Driver)
0x8DFEF000 C:\Windows\System32\Drivers\NDProxy.SYS 69632 bytes (Microsoft Corporation, NDIS Proxy)
0x80677000 C:\Windows\system32\PSHED.dll 69632 bytes (Microsoft Corporation, Platform Specific Hardware Error Driver)
0x8F576000 C:\Windows\system32\DRIVERS\rfcomm.sys 69632 bytes (Microsoft Corporation, Bluetooth RFCOMM Driver)
0x87F4A000 C:\Windows\system32\drivers\fileinfo.sys 65536 bytes (Microsoft Corporation, FileInfo Filter Driver)
0x883EA000 C:\Windows\system32\DRIVERS\HIDCLASS.SYS 65536 bytes (Microsoft Corporation, Hid Class Library)
0x881EF000 C:\Windows\system32\DRIVERS\lltdio.sys 65536 bytes (Microsoft Corporation, Link-Layer Topology Mapper I/O Driver)
0x87D9D000 C:\Windows\System32\drivers\mountmgr.sys 65536 bytes (Microsoft Corporation, Mount Point Manager)
0x8E393000 C:\Windows\system32\DRIVERS\ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver)
0x8E5BF000 C:\Windows\system32\DRIVERS\termdd.sys 65536 bytes (Microsoft Corporation, Terminal Server Driver)
0x885E9000 C:\Windows\system32\DRIVERS\intelppm.sys 61440 bytes (Microsoft Corporation, Processor Device Driver)
0x87F5A000 C:\Windows\system32\DRIVERS\Lbd.sys 61440 bytes (Lavasoft AB, Boot Driver)
0x8F5EF000 C:\Windows\system32\DRIVERS\monitor.sys 61440 bytes (Microsoft Corporation, Monitor Driver)
0x88557000 C:\Windows\System32\Drivers\mup.sys 61440 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0x87D13000 C:\Windows\System32\drivers\partmgr.sys 61440 bytes (Microsoft Corporation, Partition Management Driver)
0x8E587000 C:\Windows\system32\DRIVERS\raspppoe.sys 61440 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0x8DFB8000 C:\Windows\system32\DRIVERS\usbehci.sys 61440 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0x87D2F000 C:\Windows\system32\drivers\volmgr.sys 61440 bytes (Microsoft Corporation, Volume Manager Driver)
0x8E3A3000 C:\Windows\system32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver)
0x81AE0000 C:\Windows\System32\cdd.dll 57344 bytes (Microsoft Corporation, Canonical Display Driver)
0x8E3ED000 C:\Windows\system32\DRIVERS\circlass.sys 57344 bytes (Microsoft Corporation, Consumer IR Class Driver for eHome)
0x8F5B7000 C:\Windows\system32\DRIVERS\netbios.sys 57344 bytes (Microsoft Corporation, NetBIOS interface driver)
0x912EA000 C:\Windows\System32\Drivers\Npfs.SYS 57344 bytes (Microsoft Corporation, NPFS Driver)
0x87D8F000 C:\Windows\system32\DRIVERS\PCIIDEX.SYS 57344 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0x8E3CB000 C:\Windows\system32\DRIVERS\rimmptsk.sys 57344 bytes (REDC, RICOH MMC Driver)
0x9134B000 C:\Windows\System32\Drivers\N360\0308000.029\SYMNDISV.SYS 57344 bytes (Symantec Corporation, NDIS Filter Driver)
0x8F5D8000 C:\Windows\System32\Drivers\crashdmp.sys 53248 bytes (Microsoft Corporation, Crash Dump Driver)
0x8F4B7000 C:\Windows\system32\drivers\modem.sys 53248 bytes (Microsoft Corporation, Modem Device Driver)
0x8DFD9000 C:\Windows\system32\DRIVERS\umbus.sys 53248 bytes (Microsoft Corporation, User-Mode Bus Enumerator)
0x8DF62000 C:\Windows\System32\drivers\watchdog.sys 53248 bytes (Microsoft Corporation, Watchdog Driver)
0x87C88000 C:\Windows\system32\drivers\WDFLDR.SYS 53248 bytes (Microsoft Corporation, WDFLDR)
0x8FBE5000 C:\Windows\System32\Drivers\BTHUSB.sys 49152 bytes (Microsoft Corporation, Bluetooth Miniport Driver)
0xB7BD3000 C:\Windows\System32\drivers\tcpipreg.sys 49152 bytes (Microsoft Corporation, TCP/IP Registry Compatibility Driver)
0x912A2000 C:\Windows\System32\drivers\vga.sys 49152 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0x8E468000 C:\Windows\system32\DRIVERS\kbdclass.sys 45056 bytes (Microsoft Corporation, Keyboard Class Driver)
0x8E49C000 C:\Windows\system32\DRIVERS\mouclass.sys 45056 bytes (Microsoft Corporation, Mouse Class Driver)
0x912DF000 C:\Windows\System32\Drivers\Msfs.SYS 45056 bytes (Microsoft Corporation, Mailslot driver)
0x8E559000 C:\Windows\system32\DRIVERS\ndistapi.sys 45056 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0x8E537000 C:\Windows\system32\DRIVERS\TDI.SYS 45056 bytes (Microsoft Corporation, TDI Wrapper)
0x885D5000 C:\Windows\system32\DRIVERS\tunnel.sys 45056 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)
0x8DF6F000 C:\Windows\system32\DRIVERS\usbuhci.sys 45056 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0x87D25000 C:\Windows\system32\DRIVERS\BATTC.SYS 40960 bytes (Microsoft Corporation, Battery Class Driver)
0x8FBF1000 C:\Windows\system32\DRIVERS\BthEnum.sys 40960 bytes (Microsoft Corporation, Bluetooth Bus Extender)
0x8F5E5000 C:\Windows\System32\drivers\Dxapi.sys 40960 bytes (Microsoft Corporation, DirectX API Driver)
0x87F0E000 C:\Windows\system32\drivers\msahci.sys 40960 bytes (Microsoft Corporation, MS AHCI 1.0 Standard Driver)
0x8E000000 C:\Windows\system32\DRIVERS\mssmbios.sys 40960 bytes (Microsoft Corporation, System Management BIOS Driver)
0xB662D000 C:\Windows\system32\DRIVERS\ndisuio.sys 40960 bytes (Microsoft Corporation, NDIS User mode I/O driver)
0x97643000 C:\Windows\system32\drivers\nsiproxy.sys 40960 bytes (Microsoft Corporation, NSI Proxy)
0xB7BC9000 C:\Windows\System32\Drivers\secdrv.SYS 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver)
0x91281000 C:\Windows\system32\drivers\N360\0308000.029\SRTSPX.SYS 40960 bytes (Symantec Corporation, Symantec AutoProtect)
0x885BF000 C:\Windows\system32\drivers\crcdisk.sys 36864 bytes (Microsoft Corporation, Disk Block Verification Filter Driver)
0x9128B000 C:\Windows\System32\Drivers\Fs_Rec.SYS 36864 bytes (Microsoft Corporation, File System Recognizer Driver)
0x8FB5A000 C:\Windows\system32\DRIVERS\hidusb.sys 36864 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
0x8DFE6000 C:\Windows\system32\DRIVERS\kbdhid.sys 36864 bytes (Microsoft Corporation, HID Keyboard Filter Driver)
0x8FBBB000 C:\Windows\system32\drivers\LVUSBSta.sys 36864 bytes (Logitech Inc., USB Statistic Driver)
0xB7A00000 C:\Windows\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
0x87FB8000 C:\Windows\System32\Drivers\PxHelp20.sys 36864 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)
0x912F8000 C:\Windows\System32\DRIVERS\rasacd.sys 36864 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0x8FA00000 C:\Windows\system32\DRIVERS\SymIMv.sys 36864 bytes (Symantec Corporation, NDIS 6.0 Filter Driver for Windows Vista)
0x81AC0000 C:\Windows\System32\TSDDD.dll 36864 bytes (Microsoft Corporation, Framebuffer Display Driver)
0x885E0000 C:\Windows\system32\DRIVERS\tunmp.sys 36864 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)
0x88200000 C:\Windows\system32\DRIVERS\wmiacpi.sys 36864 bytes (Microsoft Corporation, Windows Management Interface for ACPI)
0x87CDB000 C:\Windows\system32\drivers\WMILIB.SYS 36864 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0x87EE8000 C:\Windows\system32\drivers\atapi.sys 32768 bytes (Microsoft Corporation, ATAPI IDE Miniport Driver)
0x80688000 C:\Windows\system32\BOOTVID.dll 32768 bytes (Microsoft Corporation, VGA Boot Driver)
0x8060F000 C:\Windows\system32\kdcom.dll 32768 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0x8FB9C000 C:\Windows\system32\DRIVERS\mouhid.sys 32768 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0x87CE4000 C:\Windows\system32\drivers\msisadrv.sys 32768 bytes (Microsoft Corporation, ISA Driver)
0x912CF000 C:\Windows\System32\DRIVERS\RDPCDD.sys 32768 bytes (Microsoft Corporation, RDP Miniport)
0x912D7000 C:\Windows\system32\drivers\rdpencdd.sys 32768 bytes (Microsoft Corporation, RDP Miniport)
0x8854F000 C:\Windows\System32\Drivers\spldr.sys 32768 bytes (Microsoft Corporation, loader for security processor)
0xB7BDF000 C:\Windows\system32\DRIVERS\xaudio.sys 32768 bytes (Conexant Systems, Inc., Modem Audio Device Driver)
0x9129B000 C:\Windows\System32\Drivers\Beep.SYS 28672 bytes (Microsoft Corporation, BEEP Driver)
0x88400000 C:\Windows\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0x91294000 C:\Windows\System32\Drivers\Null.SYS 28672 bytes (Microsoft Corporation, NULL Driver)
0x87D88000 C:\Windows\system32\DRIVERS\pciide.sys 28672 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
0x8E4C2000 C:\Windows\System32\Drivers\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter)
0x8E451000 C:\Windows\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver)
0xB7AE7000 C:\Windows\system32\DRIVERS\mdmxsdk.sys 16384 bytes (Conexant, Diagnostic Interface x86 Driver)
0x9127E000 C:\Windows\system32\DRIVERS\btwrchid.sys 12288 bytes (Broadcom Corporation., Bluetooth Remote Control HID Minidriver)
0x87D22000 C:\Windows\system32\DRIVERS\compbatt.sys 12288 bytes (Microsoft Corporation, Composite Battery Driver)
0x885F8000 C:\Windows\system32\DRIVERS\cpqbttn.sys 12288 bytes (Hewlett-Packard Development Company, L.P., HP Tablet PC Key Button HID Driver)
0x976A5000 C:\Windows\system32\drivers\elrawdsk.sys 12288 bytes (EldoS Corporation, RawDisk Driver. Allows write-access to raw disk sectors for user mode applications in Windows 2000, XP, 2003, Vista.)
0x8E4A7000 C:\Windows\system32\drivers\pfc.sys 12288 bytes (Padus, Inc., Padus® ASPI Shell)
0x913FC000 C:\Windows\system32\DRIVERS\eabfiltr.sys 8192 bytes (Hewlett-Packard Development Company, L.P., QLB PS/2 Keyboard filter driver)
0x8E5CF000 C:\Windows\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0x8F53A000 C:\Windows\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
==============================================
>Stealth
==============================================
0x00A70000 Hidden Image–>HP.ActiveSupportLibrary.dll [ EPROCESS 0x848813B0 ] PID: 4976, 110592 bytes
==============================================
>Files
==============================================
==============================================
>Hooks
==============================================
ntkrnlpa.exe+0x000B4EEA, Type: Inline - RelativeJump 0x822FEEEA–>822FEEF1 [ntkrnlpa.exe]
ntkrnlpa.exe+0x000B8A28, Type: Inline - RelativeJump 0x82302A28–>823029BF [ntkrnlpa.exe]
ntkrnlpa.exe+0x000B8C2C, Type: Inline - RelativeJump 0x82302C2C–>82302BDC [ntkrnlpa.exe]
ntkrnlpa.exe+0x000B8EA4, Type: Inline - RelativeJump 0x82302EA4–>82302E50 [ntkrnlpa.exe]
ntkrnlpa.exe+0x000B8FD8, Type: Inline - RelativeJump 0x82302FD8–>82302FBA [ntkrnlpa.exe]
[2124]rundll32.exe–>advapi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77C814BC–>00000000 [shimeng.dll]
[2124]rundll32.exe–>gdi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77B71170–>00000000 [shimeng.dll]
[2124]rundll32.exe–>shell32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x080E1414–>00000000 [shimeng.dll]
[2124]rundll32.exe–>user32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77D51300–>00000000 [shimeng.dll]
[2176]issch.exe–>advapi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77C814BC–>00000000 [shimeng.dll]
[2176]issch.exe–>gdi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77B71170–>00000000 [shimeng.dll]
[2176]issch.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x0040E020–>00000000 [shimeng.dll]
[2176]issch.exe–>shell32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x080E1414–>00000000 [shimeng.dll]
[2176]issch.exe–>user32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77D51300–>00000000 [shimeng.dll]
[2176]issch.exe–>ws2_32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x4B0D11E8–>00000000 [shimeng.dll]
[3184]YahooAUService.exe–>advapi32.dll–>CreateServiceW, Type: IAT modification 0x00467054–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>advapi32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x77C8151C–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>advapi32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77C816D0–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>advapi32.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x77C81664–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>advapi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77C814BC–>00000000 [shimeng.dll]
[3184]YahooAUService.exe–>advapi32.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x77C81668–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>advapi32.dll–>kernel32.dll–>OpenFile, Type: IAT modification 0x77C81514–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>advapi32.dll–>RegCreateKeyExW, Type: IAT modification 0x00467088–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>advapi32.dll–>RegDeleteValueW, Type: IAT modification 0x00467090–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>advapi32.dll–>RegOpenKeyExA, Type: IAT modification 0x00467004–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>advapi32.dll–>RegOpenKeyExW, Type: IAT modification 0x00467084–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>advapi32.dll–>RegSetValueExW, Type: IAT modification 0x0046707C–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>gdi32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x77B71130–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>gdi32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77B7119C–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>gdi32.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x77B711BC–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>gdi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77B71170–>00000000 [shimeng.dll]
[3184]YahooAUService.exe–>kernel32.dll–>CreateFileA, Type: IAT modification 0x00467138–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>kernel32.dll–>CreateFileW, Type: IAT modification 0x004670C8–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>kernel32.dll–>CreateProcessW, Type: IAT modification 0x004670D8–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>kernel32.dll–>DeleteFileA, Type: IAT modification 0x00467250–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x004670AC–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>kernel32.dll–>GetFileAttributesW, Type: IAT modification 0x00467108–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x004670F0–>00000000 [shimeng.dll]
[3184]YahooAUService.exe–>kernel32.dll–>MoveFileA, Type: IAT modification 0x00467254–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>shell32.dll–>advapi32.dll–>AccessCheck, Type: IAT modification 0x080E1BFC–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>shell32.dll–>advapi32.dll–>RegCreateKeyExW, Type: IAT modification 0x080E1B30–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>shell32.dll–>advapi32.dll–>RegCreateKeyW, Type: IAT modification 0x080E1CB0–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>shell32.dll–>advapi32.dll–>RegDeleteValueW, Type: IAT modification 0x080E1B50–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>shell32.dll–>advapi32.dll–>RegOpenKeyExA, Type: IAT modification 0x080E1CF4–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>shell32.dll–>advapi32.dll–>RegOpenKeyExW, Type: IAT modification 0x080E1B28–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>shell32.dll–>advapi32.dll–>RegSetValueExW, Type: IAT modification 0x080E1B2C–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>shell32.dll–>advapi32.dll–>RegSetValueW, Type: IAT modification 0x080E1B70–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>shell32.dll–>advapi32.dll–>SetFileSecurityW, Type: IAT modification 0x080E1CC0–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>shell32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x080E125C–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>shell32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x080E1460–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>shell32.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x080E13B4–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>shell32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x080E1414–>00000000 [shimeng.dll]
[3184]YahooAUService.exe–>shell32.dll–>kernel32.dll–>MoveFileExW, Type: IAT modification 0x080E13C0–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>shell32.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x080E130C–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>shell32.dll–>kernel32.dll–>SetFileAttributesW, Type: IAT modification 0x080E13B8–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>user32.dll–>advapi32.dll–>RegCreateKeyExW, Type: IAT modification 0x77D51548–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>user32.dll–>advapi32.dll–>RegOpenKeyExW, Type: IAT modification 0x77D51528–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>user32.dll–>advapi32.dll–>RegSetValueExW, Type: IAT modification 0x77D51550–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>user32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x77D511A8–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>user32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77D512B8–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>user32.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x77D511B0–>00000000 [AcGenral.dll]
[3184]YahooAUService.exe–>user32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77D51300–>00000000 [shimeng.dll]
[3184]YahooAUService.exe–>user32.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x77D511AC–>00000000 [AcGenral.dll]
[3564]NILaunch.exe–>advapi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77C814BC–>00000000 [shimeng.dll]
[3564]NILaunch.exe–>gdi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77B71170–>00000000 [shimeng.dll]
[3564]NILaunch.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x0040401C–>00000000 [shimeng.dll]
[3564]NILaunch.exe–>shell32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x080E1414–>00000000 [shimeng.dll]
[3564]NILaunch.exe–>user32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77D51300–>00000000 [shimeng.dll]
[3912]iexplore.exe–>user32.dll–>CallNextHookEx, Type: Inline - RelativeJump 0x77E48C33–>00000000 [ieframe.dll]
[3912]iexplore.exe–>user32.dll–>CreateWindowExW, Type: Inline - RelativeJump 0x77E53D67–>00000000 [ieframe.dll]
[3912]iexplore.exe–>user32.dll–>DialogBoxIndirectParamA, Type: Inline - RelativeJump 0x77E883DD–>00000000 [ieframe.dll]
[3912]iexplore.exe–>user32.dll–>DialogBoxIndirectParamW, Type: Inline - RelativeJump 0x77E4BD25–>00000000 [ieframe.dll]
[3912]iexplore.exe–>user32.dll–>DialogBoxParamA, Type: Inline - RelativeJump 0x77E880B2–>00000000 [ieframe.dll]
[3912]iexplore.exe–>user32.dll–>DialogBoxParamW, Type: Inline - RelativeJump 0x77E61FD5–>00000000 [ieframe.dll]
[3912]iexplore.exe–>user32.dll–>MessageBoxExA, Type: Inline - RelativeJump 0x77E9D5D1–>00000000 [ieframe.dll]
[3912]iexplore.exe–>user32.dll–>MessageBoxExW, Type: Inline - RelativeJump 0x77E9D5F5–>00000000 [ieframe.dll]
[3912]iexplore.exe–>user32.dll–>MessageBoxIndirectA, Type: Inline - RelativeJump 0x77E9D471–>00000000 [ieframe.dll]
[3912]iexplore.exe–>user32.dll–>MessageBoxIndirectW, Type: Inline - RelativeJump 0x77E9D56B–>00000000 [ieframe.dll]
[3912]iexplore.exe–>user32.dll–>SetWindowsHookExW, Type: Inline - RelativeJump 0x77E47B69–>00000000 [ieframe.dll]
[3912]iexplore.exe–>user32.dll–>UnhookWindowsHookEx, Type: Inline - RelativeJump 0x77E708BE–>00000000 [ieframe.dll]
[3912]iexplore.exe–>wininet.dll–>HttpOpenRequestA, Type: Inline - RelativeJump 0x76BDD508–>00000000 [McIEPlg.dll]
[3912]iexplore.exe–>wininet.dll–>InternetCloseHandle, Type: Inline - RelativeJump 0x76BD9088–>00000000 [McIEPlg.dll]
[3912]iexplore.exe–>wininet.dll–>InternetConnectA, Type: Inline - RelativeJump 0x76BDDEAE–>00000000 [McIEPlg.dll]
[3912]iexplore.exe–>wininet.dll–>InternetReadFile, Type: Inline - RelativeJump 0x76BD654B–>00000000 [McIEPlg.dll]
[4352]Ee.exe–>advapi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77C814BC–>00000000 [shimeng.dll]
[4352]Ee.exe–>gdi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77B71170–>00000000 [shimeng.dll]
[4352]Ee.exe–>shell32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x080E1414–>00000000 [shimeng.dll]
[4352]Ee.exe–>user32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77D51300–>00000000 [shimeng.dll]
[5904]Ymsgr_tray.exe–>gdi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77B71170–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>gdi32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x77B7111C–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>gdi32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x77B71110–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>gdi32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x77B71174–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x0040C0E4–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x0040C0E0–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x0040C0B0–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x0040C0B8–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>shell32.dll–>gdi32.dll–>GetStockObject, Type: IAT modification 0x080E166C–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>shell32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x080E1414–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>shell32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x080E14DC–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>shell32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x080E1284–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>shell32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x080E1448–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>shell32.dll–>user32.dll–>AnimateWindow, Type: IAT modification 0x080E1AC4–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>shell32.dll–>user32.dll–>DefWindowProcW, Type: IAT modification 0x080E1A50–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>shell32.dll–>user32.dll–>GetSysColor, Type: IAT modification 0x080E19F0–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>shell32.dll–>user32.dll–>GetSysColorBrush, Type: IAT modification 0x080E19A8–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>shell32.dll–>user32.dll–>TrackPopupMenu, Type: IAT modification 0x080E1914–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>shell32.dll–>user32.dll–>TrackPopupMenuEx, Type: IAT modification 0x080E1714–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>user32.dll–>DefWindowProcW, Type: IAT modification 0x0040C268–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>user32.dll–>gdi32.dll–>GetStockObject, Type: IAT modification 0x77D5145C–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>user32.dll–>GetSysColor, Type: IAT modification 0x0040C2A4–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>user32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77D51300–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>user32.dll–>kernel32.dll–>LoadLibraryA, Type: IAT modification 0x77D51250–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>user32.dll–>kernel32.dll–>LoadLibraryExW, Type: IAT modification 0x77D5115C–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>user32.dll–>kernel32.dll–>LoadLibraryW, Type: IAT modification 0x77D512FC–>00000000 [yui.dll]
[5904]Ymsgr_tray.exe–>user32.dll–>TrackPopupMenu, Type: IAT modification 0x0040C29C–>00000000 [yui.dll]
[5960]iexplore.exe–>user32.dll–>CreateWindowExW, Type: Inline - RelativeJump 0x77E53D67–>00000000 [ieframe.dll]
[5960]iexplore.exe–>user32.dll–>DialogBoxIndirectParamA, Type: Inline - RelativeJump 0x77E883DD–>00000000 [ieframe.dll]
[5960]iexplore.exe–>user32.dll–>DialogBoxIndirectParamW, Type: Inline - RelativeJump 0x77E4BD25–>00000000 [ieframe.dll]
[5960]iexplore.exe–>user32.dll–>DialogBoxParamA, Type: Inline - RelativeJump 0x77E880B2–>00000000 [ieframe.dll]
[5960]iexplore.exe–>user32.dll–>DialogBoxParamW, Type: Inline - RelativeJump 0x77E61FD5–>00000000 [ieframe.dll]
[5960]iexplore.exe–>user32.dll–>MessageBoxExA, Type: Inline - RelativeJump 0x77E9D5D1–>00000000 [ieframe.dll]
[5960]iexplore.exe–>user32.dll–>MessageBoxExW, Type: Inline - RelativeJump 0x77E9D5F5–>00000000 [ieframe.dll]
[5960]iexplore.exe–>user32.dll–>MessageBoxIndirectA, Type: Inline - RelativeJump 0x77E9D471–>00000000 [ieframe.dll]
[5960]iexplore.exe–>user32.dll–>MessageBoxIndirectW, Type: Inline - RelativeJump 0x77E9D56B–>00000000 [ieframe.dll]
[6004]iexplore.exe–>user32.dll–>CallNextHookEx, Type: Inline - RelativeJump 0x77E48C33–>00000000 [ieframe.dll]
[6004]iexplore.exe–>user32.dll–>CreateWindowExW, Type: Inline - RelativeJump 0x77E53D67–>00000000 [ieframe.dll]
[6004]iexplore.exe–>user32.dll–>DialogBoxIndirectParamA, Type: Inline - RelativeJump 0x77E883DD–>00000000 [ieframe.dll]
[6004]iexplore.exe–>user32.dll–>DialogBoxIndirectParamW, Type: Inline - RelativeJump 0x77E4BD25–>00000000 [ieframe.dll]
[6004]iexplore.exe–>user32.dll–>DialogBoxParamA, Type: Inline - RelativeJump 0x77E880B2–>00000000 [ieframe.dll]
[6004]iexplore.exe–>user32.dll–>DialogBoxParamW, Type: Inline - RelativeJump 0x77E61FD5–>00000000 [ieframe.dll]
[6004]iexplore.exe–>user32.dll–>MessageBoxExA, Type: Inline - RelativeJump 0x77E9D5D1–>00000000 [ieframe.dll]
[6004]iexplore.exe–>user32.dll–>MessageBoxExW, Type: Inline - RelativeJump 0x77E9D5F5–>00000000 [ieframe.dll]
[6004]iexplore.exe–>user32.dll–>MessageBoxIndirectA, Type: Inline - RelativeJump 0x77E9D471–>00000000 [ieframe.dll]
[6004]iexplore.exe–>user32.dll–>MessageBoxIndirectW, Type: Inline - RelativeJump 0x77E9D56B–>00000000 [ieframe.dll]
[6004]iexplore.exe–>user32.dll–>SetWindowsHookExW, Type: Inline - RelativeJump 0x77E47B69–>00000000 [ieframe.dll]
[6004]iexplore.exe–>user32.dll–>UnhookWindowsHookEx, Type: Inline - RelativeJump 0x77E708BE–>00000000 [ieframe.dll]
[6004]iexplore.exe–>wininet.dll–>HttpOpenRequestA, Type: Inline - RelativeJump 0x76BDD508–>00000000 [McIEPlg.dll]
[6004]iexplore.exe–>wininet.dll–>InternetCloseHandle, Type: Inline - RelativeJump 0x76BD9088–>00000000 [McIEPlg.dll]
[6004]iexplore.exe–>wininet.dll–>InternetConnectA, Type: Inline - RelativeJump 0x76BDDEAE–>00000000 [McIEPlg.dll]
[6004]iexplore.exe–>wininet.dll–>InternetReadFile, Type: Inline - RelativeJump 0x76BD654B–>00000000 [McIEPlg.dll]


!!POSSIBLE ROOTKIT ACTIVITY DETECTED!! =)

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Ctoni not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\{F51FB64E-024A-CF09-A3C6-C9C4CEA94BC7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F51FB64E-024A-CF09-A3C6-C9C4CEA94BC7}\ not found.
File C:\Users\terry\AppData\Roaming\Yrolap\duny.exe not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08E730A4-FB02-45BD-A900-01E4AD8016F6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08E730A4-FB02-45BD-A900-01E4AD8016F6}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2d91865a-23f9-11dc-a634-001a6b726d8c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2d91865a-23f9-11dc-a634-001a6b726d8c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2d91865a-23f9-11dc-a634-001a6b726d8c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2d91865a-23f9-11dc-a634-001a6b726d8c}\ not found.
File F:\LaunchU3.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2e925636-0a23-11dd-aa10-001a6b726d8c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2e925636-0a23-11dd-aa10-001a6b726d8c}\ not found.
File infrom.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6bddb343-9e71-11dc-b736-001a6b726d8c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6bddb343-9e71-11dc-b736-001a6b726d8c}\ not found.
File setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6bddb348-9e71-11dc-b736-001a6b726d8c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6bddb348-9e71-11dc-b736-001a6b726d8c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6bddb348-9e71-11dc-b736-001a6b726d8c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6bddb348-9e71-11dc-b736-001a6b726d8c}\ not found.
File G:\LaunchU3.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9651da0c-d80b-11dc-bdba-001a6b726d8c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9651da0c-d80b-11dc-bdba-001a6b726d8c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9651da0c-d80b-11dc-bdba-001a6b726d8c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9651da0c-d80b-11dc-bdba-001a6b726d8c}\ not found.
File F:\LaunchU3.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9ceddf33-f1c6-11dc-b674-001a6b726d8c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9ceddf33-f1c6-11dc-b674-001a6b726d8c}\ not found.
File h.cmd not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9ceddf33-f1c6-11dc-b674-001a6b726d8c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9ceddf33-f1c6-11dc-b674-001a6b726d8c}\ not found.
File h.cmd not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9ceddf33-f1c6-11dc-b674-001a6b726d8c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9ceddf33-f1c6-11dc-b674-001a6b726d8c}\ not found.
File h.cmd not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a70e64c4-f91e-11dd-9dfb-001a6b726d8c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a70e64c4-f91e-11dd-9dfb-001a6b726d8c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a70e64c4-f91e-11dd-9dfb-001a6b726d8c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a70e64c4-f91e-11dd-9dfb-001a6b726d8c}\ not found.
File F:\LaunchU3.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d6eab48a-b798-11dd-a675-001a6b726d8c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d6eab48a-b798-11dd-a675-001a6b726d8c}\ not found.
File 9.cmd not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d6eab48a-b798-11dd-a675-001a6b726d8c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d6eab48a-b798-11dd-a675-001a6b726d8c}\ not found.
File 9.cmd not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d6eab48a-b798-11dd-a675-001a6b726d8c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d6eab48a-b798-11dd-a675-001a6b726d8c}\ not found.
File 9.cmd not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f5f249dd-0f3a-11df-b051-001a6b726d8c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f5f249dd-0f3a-11df-b051-001a6b726d8c}\ not found.
File vircure/vircure32.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f5f249dd-0f3a-11df-b051-001a6b726d8c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f5f249dd-0f3a-11df-b051-001a6b726d8c}\ not found.
File vircure/vircure32.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f5f249dd-0f3a-11df-b051-001a6b726d8c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f5f249dd-0f3a-11df-b051-001a6b726d8c}\ not found.
File vircure/vircure32.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f5f249e2-0f3a-11df-b051-001a6b726d8c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f5f249e2-0f3a-11df-b051-001a6b726d8c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f5f249e2-0f3a-11df-b051-001a6b726d8c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f5f249e2-0f3a-11df-b051-001a6b726d8c}\ not found.
File F:\LaunchU3.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ not found.
File F:\LaunchU3.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ not found.
File G:\LaunchU3.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H\ not found.
File H:\LaunchU3.exe not found.
Folder C:\Users\terry\AppData\Local\{29BB2942-5461-4244-8099-88E005DF491B}\ not found.
File/Folder C:\Windows\*.tmp not found.
File C:\Users\terry\AppData\Local\Ukuni.dat not found.
File C:\Users\terry\AppData\Local\Bqesiwu.bin not found.
File C:\Windows\System32\drivers\etc\hosts.20100908-130742.backup not found.
File C:\Windows\System32\drivers\etc\hosts.20100902-085125.backup not found.
File C:\Users\terry\AppData\Local\Ukuni.dat not found.
File C:\Users\terry\AppData\Local\Bqesiwu.bin not found.
========== REGISTRY ==========
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Could not flush the DNS Resolver Cache: Function failed during execution.
C:\Users\terry\Documents\Documents\Downloads\Downloads\Downloads\Downloads\Downloads\Downloads\cmd.bat deleted successfully.
C:\Users\terry\Documents\Documents\Downloads\Downloads\Downloads\Downloads\Downloads\Downloads\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully


[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes

User: Public

User: terry
->Temp folder emptied: 288629 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 1103 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1812 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 0.00 mb


[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Public

User: terry
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.12.0 log created on 09162010_152543

Files\Folders moved on Reboot…
C:\Users\terry\AppData\Local\Temp\ehmsas.txt moved successfully.
File\Folder C:\Users\terry\AppData\Local\Temp\~DF6513.tmp not found!
File\Folder C:\Users\terry\AppData\Local\Temp\~DF6522.tmp not found!
File\Folder C:\Users\terry\AppData\Local\Temp\~DF6575.tmp not found!
File\Folder C:\Users\terry\AppData\Local\Temp\~DF6584.tmp not found!
File\Folder C:\Users\terry\AppData\Local\Temp\~DF65CF.tmp not found!
File\Folder C:\Users\terry\AppData\Local\Temp\~DF65DE.tmp not found!
File\Folder C:\Users\terry\AppData\Local\Temp\~DF6628.tmp not found!
File\Folder C:\Users\terry\AppData\Local\Temp\~DF6637.tmp not found!
C:\Users\terry\AppData\Local\Temp\~DFA01D.tmp moved successfully.
C:\Users\terry\AppData\Local\Temp\~DFD051.tmp moved successfully.
File\Folder C:\Windows\temp\JET2377.tmp not found!

Registry entries deleted on Reboot…


MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 1 (build 6001), 32-bit
Base Board Manufacturer: Wistron
BIOS Manufacturer: Phoenix
System Manufacturer: Hewlett-Packard
System Product Name: HP Pavilion dv2500 Notebook PC
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 182):
0x8224A000 \SystemRoot\system32\ntkrnlpa.exe
0x82217000 \SystemRoot\system32\hal.dll
0x8060F000 \SystemRoot\system32\kdcom.dll
0x80617000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x80677000 \SystemRoot\system32\PSHED.dll
0x80688000 \SystemRoot\system32\BOOTVID.dll
0x80690000 \SystemRoot\system32\CLFS.SYS
0x806D1000 \SystemRoot\system32\CI.dll
0x87C0C000 \SystemRoot\system32\drivers\Wdf01000.sys
0x87C88000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x87C95000 \SystemRoot\system32\drivers\acpi.sys
0x87CDB000 \SystemRoot\system32\drivers\WMILIB.SYS
0x87CE4000 \SystemRoot\system32\drivers\msisadrv.sys
0x87CEC000 \SystemRoot\system32\drivers\pci.sys
0x87D13000 \SystemRoot\System32\drivers\partmgr.sys
0x87D22000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x87D25000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x87D2F000 \SystemRoot\system32\drivers\volmgr.sys
0x87D3E000 \SystemRoot\System32\drivers\volmgrx.sys
0x87D88000 \SystemRoot\system32\DRIVERS\pciide.sys
0x87D8F000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x87D9D000 \SystemRoot\System32\drivers\mountmgr.sys
0x87E0E000 \SystemRoot\system32\DRIVERS\iaStor.sys
0x87EE8000 \SystemRoot\system32\drivers\atapi.sys
0x87EF0000 \SystemRoot\system32\drivers\ataport.SYS
0x87F0E000 \SystemRoot\system32\drivers\msahci.sys
0x87F18000 \SystemRoot\system32\drivers\fltmgr.sys
0x87F4A000 \SystemRoot\system32\drivers\fileinfo.sys
0x87F5A000 \SystemRoot\system32\DRIVERS\Lbd.sys
0x87F69000 \SystemRoot\system32\drivers\N360\0308000.029\SYMEFA.SYS
0x87FB8000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x88005000 \SystemRoot\System32\Drivers\ksecdd.sys
0x88076000 \SystemRoot\system32\drivers\ndis.sys
0x88181000 \SystemRoot\system32\drivers\msrpc.sys
0x881AC000 \SystemRoot\system32\drivers\NETIO.SYS
0x8820C000 \SystemRoot\System32\drivers\tcpip.sys
0x882F5000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x88407000 \SystemRoot\System32\Drivers\Ntfs.sys
0x88516000 \SystemRoot\system32\drivers\volsnap.sys
0x8854F000 \SystemRoot\System32\Drivers\spldr.sys
0x88557000 \SystemRoot\System32\Drivers\mup.sys
0x88566000 \SystemRoot\System32\drivers\ecache.sys
0x8858D000 \SystemRoot\system32\drivers\disk.sys
0x8859E000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x885BF000 \SystemRoot\system32\drivers\crcdisk.sys
0x885D5000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x885E0000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x885E9000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x885F8000 \SystemRoot\system32\DRIVERS\cpqbttn.sys
0x883EA000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x88400000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x88200000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x8D808000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
0x8DEC3000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8DF62000 \SystemRoot\System32\drivers\watchdog.sys
0x8DF6F000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8DF7A000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8DFB8000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8DFC7000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x87DAD000 \SystemRoot\system32\DRIVERS\yk60x86.sys
0x8E00A000 \SystemRoot\system32\DRIVERS\NETw5v32.sys
0x8E393000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x8E3A3000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x8E3B1000 \SystemRoot\system32\DRIVERS\sdbus.sys
0x8E3CB000 \SystemRoot\system32\DRIVERS\rimmptsk.sys
0x8E3D9000 \SystemRoot\system32\DRIVERS\rimsptsk.sys
0x8E400000 \SystemRoot\system32\DRIVERS\rixdptsk.sys
0x8E451000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x8E455000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8E468000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8E473000 \SystemRoot\system32\DRIVERS\Apfiltr.sys
0x8E49C000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8E4A7000 \SystemRoot\system32\drivers\pfc.sys
0x8E4AA000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8E4C2000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0x8E4C8000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8E4F6000 \SystemRoot\system32\DRIVERS\storport.sys
0x8E537000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8E542000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8E559000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8E564000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8E587000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8E596000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8E5AA000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x8E5BF000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8E5CF000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8E5D1000 \SystemRoot\system32\DRIVERS\ks.sys
0x8E3ED000 \SystemRoot\system32\DRIVERS\circlass.sys
0x8E000000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8DFD9000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8DFE6000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x87FC1000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8DFEF000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x807B1000 \SystemRoot\system32\drivers\CHDRT32.sys
0x8F200000 \SystemRoot\system32\drivers\portcls.sys
0x8F22D000 \SystemRoot\system32\drivers\drmk.sys
0x8F252000 \SystemRoot\system32\DRIVERS\HSXHWAZL.sys
0x8F290000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys
0x8F402000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys
0x8F4B7000 \SystemRoot\system32\drivers\modem.sys
0x8F4C4000 \SystemRoot\System32\Drivers\N360\0308000.029\SRTSP.SYS
0x8F517000 \SystemRoot\system32\DRIVERS\ATSwpDrv.sys
0x8F53A000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8FA0E000 \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100916.002\NAVEX15.SYS
0x8FB5A000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x8FB63000 \??\C:\Windows\system32\Drivers\SYMEVENT.SYS
0x8FB88000 \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100916.002\NAVENG.SYS
0x8FB9C000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x8FBA4000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x8FBBB000 \SystemRoot\system32\drivers\LVUSBSta.sys
0x8FBC4000 \SystemRoot\System32\Drivers\usbvideo.sys
0x8FBE5000 \SystemRoot\System32\Drivers\BTHUSB.sys
0x8F53C000 \SystemRoot\System32\Drivers\bthport.sys
0x8F576000 \SystemRoot\system32\DRIVERS\rfcomm.sys
0x8FBF1000 \SystemRoot\system32\DRIVERS\BthEnum.sys
0x8F587000 \SystemRoot\system32\DRIVERS\bthpan.sys
0x8F393000 \SystemRoot\system32\drivers\btwavdt.sys
0x91203000 \SystemRoot\system32\drivers\btwaudio.sys
0x9127E000 \SystemRoot\system32\DRIVERS\btwrchid.sys
0x91281000 \SystemRoot\system32\drivers\N360\0308000.029\SRTSPX.SYS
0x9128B000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x91294000 \SystemRoot\System32\Drivers\Null.SYS
0x9129B000 \SystemRoot\System32\Drivers\Beep.SYS
0x912A2000 \SystemRoot\System32\drivers\vga.sys
0x912AE000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x912CF000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x912D7000 \SystemRoot\system32\drivers\rdpencdd.sys
0x912DF000 \SystemRoot\System32\Drivers\Msfs.SYS
0x912EA000 \SystemRoot\System32\Drivers\Npfs.SYS
0x912F8000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x91301000 \SystemRoot\system32\DRIVERS\tdx.sys
0x91317000 \SystemRoot\System32\Drivers\N360\0308000.029\SYMTDI.SYS
0x9134B000 \SystemRoot\System32\Drivers\N360\0308000.029\SYMNDISV.SYS
0x91359000 \SystemRoot\System32\Drivers\N360\0308000.029\SYMFW.SYS
0x9136E000 \SystemRoot\system32\DRIVERS\smb.sys
0x91382000 \SystemRoot\system32\drivers\afd.sys
0x913CA000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8F5A1000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8FA00000 \SystemRoot\system32\DRIVERS\SymIMv.sys
0x8F5B7000 \SystemRoot\system32\DRIVERS\netbios.sys
0x913FC000 \SystemRoot\system32\DRIVERS\eabfiltr.sys
0x8F5C5000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x97607000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x97643000 \SystemRoot\system32\drivers\nsiproxy.sys
0x9764D000 \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20100914.003\IDSvix86.sys
0x976A5000 \??\C:\Windows\system32\drivers\elrawdsk.sys
0x976A8000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
0x97706000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
0x97723000 \SystemRoot\System32\Drivers\dfsc.sys
0x9773A000 \SystemRoot\System32\Drivers\N360\0308000.029\ccHPx86.sys
0x977B5000 \SystemRoot\System32\Drivers\N360\0308000.029\BHDrvx86.sys
0x8F5D8000 \SystemRoot\System32\Drivers\crashdmp.sys
0x88310000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x818A0000 \SystemRoot\System32\win32k.sys
0x8F5E5000 \SystemRoot\System32\drivers\Dxapi.sys
0x8F5EF000 \SystemRoot\system32\DRIVERS\monitor.sys
0x81AC0000 \SystemRoot\System32\TSDDD.dll
0x81AE0000 \SystemRoot\System32\cdd.dll
0x807E4000 \SystemRoot\system32\drivers\luafv.sys
0x881EF000 \SystemRoot\system32\DRIVERS\lltdio.sys
0xB6603000 \SystemRoot\system32\DRIVERS\nwifi.sys
0xB662D000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB6637000 \SystemRoot\system32\DRIVERS\rspndr.sys
0xB664A000 \SystemRoot\system32\drivers\spsys.sys
0xB66F9000 \SystemRoot\system32\drivers\HTTP.sys
0xB6766000 \SystemRoot\System32\DRIVERS\srvnet.sys
0xB6783000 \SystemRoot\system32\DRIVERS\bowser.sys
0xB679C000 \SystemRoot\System32\drivers\mpsdrv.sys
0xB67B1000 \SystemRoot\system32\drivers\mrxdav.sys
0xB67D1000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xB7A09000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0xB7A42000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xB7A5A000 \SystemRoot\System32\DRIVERS\srv2.sys
0xB7A81000 \SystemRoot\System32\DRIVERS\srv.sys
0xB7AE7000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xB7AEB000 \SystemRoot\system32\drivers\peauth.sys
0xB7BC9000 \SystemRoot\System32\Drivers\secdrv.SYS
0xB7BD3000 \SystemRoot\System32\drivers\tcpipreg.sys
0xB7BDF000 \SystemRoot\system32\DRIVERS\xaudio.sys
0xB7BE9000 \SystemRoot\system32\DRIVERS\cdfs.sys
0xB7A00000 \SystemRoot\System32\Drivers\Normandy.SYS
0x77C80000 \Windows\System32\ntdll.dll

Processes (total 95):
0 System Idle Process
4 System
524 C:\Windows\System32\smss.exe
644 csrss.exe
688 C:\Windows\System32\wininit.exe
700 csrss.exe
736 C:\Windows\System32\winlogon.exe
772 C:\Windows\System32\services.exe
788 C:\Windows\System32\lsass.exe
800 C:\Windows\System32\lsm.exe
932 C:\Windows\System32\svchost.exe
976 C:\Windows\System32\svchost.exe
1036 C:\Windows\System32\svchost.exe
1072 C:\Windows\System32\svchost.exe
1204 C:\Windows\System32\svchost.exe
1236 C:\Windows\System32\svchost.exe
1248 C:\Windows\System32\svchost.exe
1332 C:\Windows\System32\audiodg.exe
1356 C:\Windows\System32\svchost.exe
1380 C:\Windows\System32\SLsvc.exe
1404 C:\Windows\System32\svchost.exe
1800 C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
1884 C:\Windows\System32\spoolsv.exe
1928 C:\Windows\System32\svchost.exe
396 C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
600 C:\Program Files\Bonjour\mDNSResponder.exe
604 C:\Windows\System32\svchost.exe
1516 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
1028 C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
2056 C:\Program Files\Common Files\Megatech\MProtect\MPServ.exe
2112 C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe
2124 C:\Windows\System32\rundll32.exe
2188 C:\Windows\System32\svchost.exe
2208 C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
2224 C:\Windows\System32\svchost.exe
2240 C:\Windows\System32\svchost.exe
2260 C:\Program Files\Hp\QuickPlay\Kernel\TV\QPCapSvc.exe
2680 dllhost.exe
3044 C:\Windows\System32\svchost.exe
3072 C:\Windows\System32\svchost.exe
3100 C:\Windows\System32\SearchIndexer.exe
3152 C:\Windows\System32\drivers\XAudio.exe
3184 C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
3204 C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
3232 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
3312 C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
3584 C:\Windows\System32\dwm.exe
3604 C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe
3648 C:\Windows\System32\taskeng.exe
3680 C:\Windows\explorer.exe
3828 C:\Windows\System32\taskeng.exe
2832 C:\Program Files\Hp\QuickPlay\Kernel\TV\QPSched.exe
2968 C:\Windows\System32\svchost.exe
3808 unsecapp.exe
3732 WmiPrvSE.exe
1188 C:\Windows\notepad.exe
1172 C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
2176 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
3564 C:\Windows\System32\NILaunch.exe
4092 C:\Program Files\Common Files\Logitech\QCDriver2\LVComS.exe
3080 C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
2792 C:\Windows\System32\hkcmd.exe
3888 C:\Windows\System32\igfxpers.exe
2592 C:\Program Files\Windows Defender\MSASCui.exe
3320 C:\Program Files\Apoint2K\Apoint.exe
3536 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
904 C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
1168 C:\Program Files\Windows Sidebar\sidebar.exe
1580 C:\Windows\ehome\ehtray.exe
2496 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
2516 C:\Program Files\Windows Media Player\wmpnscfg.exe
4240 C:\Windows\System32\igfxsrvc.exe
4352 C:\PROGRA~1\EVIDEN~1\Ee.exe
4384 C:\Windows\ehome\ehmsas.exe
4464 C:\Program Files\Windows Media Player\wmpnetwk.exe
4640 C:\Windows\ehome\ehsched.exe
4736 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
4832 C:\Windows\ehome\ehrecvr.exe
4908 C:\Program Files\Windows Sidebar\sidebar.exe
4976 C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
5064 C:\Program Files\Apoint2K\ApMsgFwd.exe
5492 C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
5552 C:\Program Files\Apoint2K\ApntEx.exe
5904 C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe
5960 C:\Program Files\Internet Explorer\iexplore.exe
6004 C:\Program Files\Internet Explorer\iexplore.exe
3912 C:\Program Files\Internet Explorer\iexplore.exe
4512 RKUnhookerLE[1].EXE
2808 C:\Windows\System32\wuauclt.exe
3752 C:\Windows\System32\wercon.exe
4520 C:\Windows\System32\notepad.exe
3444 C:\Windows\System32\SearchProtocolHost.exe
908 C:\Program Files\Internet Explorer\iexplore.exe
4272 C:\Windows\System32\SearchFilterHost.exe
3768 C:\Users\terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RAKDA9N6\MBRCheck[1].exe

\\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: –> \\.\PhysicalDrive0 at offset 0x00000023`9f6ad200 (NTFS)

PhysicalDrive0 Model Number: WDCWD1600BEVS-60RST0, Rev: 04.01G04

Size Device Name MBR Status
——————————————–
149 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: D94F393960D1CD66C2071F2D7260A5196DF105AC


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!

have done the combofix scan, log is attached, had to do an additional re-boot as IE wouldn't start immediately after completing the scan, but has come on now. I much appreciate your help, thank you, best wishes, Uncle Terry ComboFix 10-09-17.04 - terry 18/09/2010 6:38.1.2 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.44.1033.18.2038.503 [GMT 1:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22} SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9} SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\install.exe c:\programdata\sysReserve.ini c:\users\terry\AppData\Roaming\avdrn.dat c:\users\terry\AppData\Roaming\Bifrost c:\users\terry\AppData\Roaming\MiniDm c:\users\terry\AppData\Roaming\MiniDm\conf.ini c:\users\terry\AppData\Roaming\MiniDm\history.dat c:\windows\system32\AutoRun.inf c:\windows\system32\drivers\srenum.sys c:\windows\system32\msrun.exe c:\windows\winhelp.ini . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . ——-\Service_ndisrd ——-\Service_srenum ((((((((((((((((((((((((( Files Created from 2010-08-18 to 2010-09-18 ))))))))))))))))))))))))))))))) . 2010-09-16 07:31 . 2010-09-16 07:31 ——– d—–w- C:\_OTL 2010-09-14 13:12 . 2010-09-14 13:12 ——– d—–w- c:\program files\Common Files\ParetoLogic 2010-09-14 13:12 . 2010-09-14 13:12 ——– d—–w- c:\program files\ParetoLogic 2010-09-14 12:52 . 2010-09-14 14:09 ——– d—–w- c:\programdata\RegCure 2010-09-14 12:52 . 2010-09-14 13:04 ——– d—–w- c:\program files\RegCure 2010-09-11 21:04 . 2010-09-11 21:04 ——– d—–w- c:\users\terry\AppData\Roaming\Uniblue 2010-09-11 10:21 . 2010-09-12 12:43 ——– d—–w- c:\users\terry\AppData\Local\QuickPlay 2010-09-08 05:08 . 2010-09-08 05:08 ——– d—–w- c:\programdata\WindowsSearch 2010-09-07 14:22 . 2006-12-27 23:00 66048 —-a-w- c:\windows\system32\escwian.dll 2010-09-07 14:22 . 2006-10-12 23:00 61952 —-a-w- c:\windows\system32\escwiad.dll 2010-09-07 14:22 . 2006-10-12 23:00 44544 —-a-w- c:\windows\system32\escwiab.dll 2010-09-07 14:22 . 2006-03-09 23:00 3584 —-a-w- c:\windows\system32\eswiaml.dll 2010-09-07 14:22 . 2002-09-03 23:00 90112 —-a-w- c:\windows\system32\epcomdd.dll 2010-09-07 14:22 . 2002-08-08 23:00 184320 —-a-w- c:\windows\system32\ESDTR.dll 2010-09-07 14:22 . 2002-01-30 23:00 126976 —-a-w- c:\windows\system32\Esint23.dll 2010-09-07 14:22 . 2001-05-20 23:00 77824 —-a-w- c:\windows\system32\Esintpl.dll 2010-09-07 14:22 . 2000-10-10 23:00 53248 —-a-w- c:\windows\system32\ESICM.dll 2010-09-07 14:21 . 2010-09-07 14:21 ——– d—–w- c:\users\terry\AppData\Roaming\InstallShield 2010-09-03 05:16 . 2010-09-03 11:22 ——– d—–w- C:\found.001 2010-09-01 13:26 . 2010-09-01 13:26 ——– d—–w- c:\windows\Profiles 2010-09-01 13:26 . 2010-09-01 13:26 ——– d—–w- c:\windows\system32\Adobe 2010-09-01 13:26 . 2010-09-01 13:26 ——– d—–w- c:\users\terry\AppData\Roaming\InterTrust 2010-08-29 19:44 . 2010-04-14 17:47 293376 —-a-w- c:\windows\system32\psisdecd.dll 2010-08-29 19:44 . 2010-04-14 17:46 428544 —-a-w- c:\windows\system32\EncDec.dll 2010-08-29 19:32 . 2009-11-08 09:55 99176 —-a-w- c:\windows\system32\PresentationHostProxy.dll 2010-08-29 19:32 . 2009-11-08 09:55 295264 —-a-w- c:\windows\system32\PresentationHost.exe 2010-08-29 19:31 . 2009-11-08 09:55 49472 —-a-w- c:\windows\system32\netfxperf.dll 2010-08-29 19:31 . 2009-11-08 09:55 297808 —-a-w- c:\windows\system32\mscoree.dll 2010-08-29 19:31 . 2009-11-08 09:55 1130824 —-a-w- c:\windows\system32\dfshim.dll 2010-08-29 19:20 . 2010-05-27 19:16 81920 —-a-w- c:\windows\system32\iccvid.dll 2010-08-29 19:20 . 2010-06-16 15:59 898952 —-a-w- c:\windows\system32\drivers\tcpip.sys 2010-08-29 19:20 . 2010-04-16 16:05 28672 —-a-w- c:\windows\system32\Apphlpdm.dll 2010-08-29 19:20 . 2010-04-16 14:17 4240384 —-a-w- c:\windows\system32\GameUXLegacyGDFs.dll 2010-08-29 19:20 . 2010-06-11 15:31 274432 —-a-w- c:\windows\system32\schannel.dll 2010-08-29 19:19 . 2010-06-21 13:18 2036736 —-a-w- c:\windows\system32\win32k.sys 2010-08-29 19:19 . 2010-06-08 17:00 3598216 —-a-w- c:\windows\system32\ntkrnlpa.exe 2010-08-29 19:19 . 2010-06-08 17:00 3545992 —-a-w- c:\windows\system32\ntoskrnl.exe 2010-08-29 19:19 . 2010-06-18 14:43 302080 —-a-w- c:\windows\system32\drivers\srv.sys 2010-08-29 19:19 . 2010-06-18 14:43 144896 —-a-w- c:\windows\system32\drivers\srv2.sys 2010-08-29 19:19 . 2010-06-11 15:30 1257472 —-a-w- c:\windows\system32\msxml3.dll 2010-08-29 19:19 . 2010-06-18 16:43 36352 —-a-w- c:\windows\system32\rtutils.dll 2010-08-29 19:19 . 2009-12-23 12:43 171520 —-a-w- c:\windows\system32\wintrust.dll 2010-08-29 19:13 . 2010-04-16 16:10 1314816 —-a-w- c:\windows\system32\quartz.dll 2010-08-29 19:12 . 2010-04-23 13:55 2048 —-a-w- c:\windows\system32\tzres.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-09-18 05:56 . 2007-05-19 07:34 2484 —-a-w- c:\windows\bthservsdp.dat 2010-09-17 07:12 . 2007-06-21 18:54 ——– d—–w- c:\users\terry\AppData\Roaming\Skype 2010-09-17 07:03 . 2008-01-21 17:12 ——– d—–w- c:\users\terry\AppData\Roaming\skypePM 2010-09-17 05:43 . 2007-12-29 16:18 ——– d—–w- c:\users\terry\AppData\Roaming\U3 2010-09-16 07:31 . 2009-07-11 23:38 ——– d—–w- c:\users\terry\AppData\Roaming\Yrolap 2010-09-15 21:15 . 2007-08-06 15:18 ——– d—–w- c:\programdata\Spybot - Search & Destroy 2010-09-14 13:12 . 2008-01-30 22:25 ——– d—–w- c:\programdata\ParetoLogic 2010-09-13 06:49 . 2009-05-18 16:47 ——– d—–w- c:\users\terry\AppData\Roaming\Ewygyr 2010-09-13 06:24 . 2007-12-07 14:39 ——– d—–w- c:\program files\Common Files\Real 2010-09-12 17:41 . 2007-05-19 08:37 ——– d—–w- c:\program files\Common Files\Adobe 2010-09-11 21:19 . 2010-07-03 10:56 ——– d—–w- c:\program files\SplitVision AERO 2010-09-11 21:18 . 2007-09-14 18:32 ——– d—–w- c:\program files\Docudesk 2010-09-11 11:39 . 2007-05-19 07:58 ——– d—–w- c:\program files\Common Files\InstallShield 2010-09-11 11:39 . 2010-01-30 16:13 ——– d—–w- c:\program files\WinUtilities 2010-09-11 11:39 . 2007-05-19 08:00 ——– d—–w- c:\program files\Hp 2010-09-11 11:39 . 2007-05-19 07:59 ——– d–h–w- c:\program files\InstallShield Installation Information 2010-09-11 10:40 . 2007-06-21 18:14 ——– d—–w- c:\users\terry\AppData\Roaming\Hewlett-Packard 2010-09-11 10:40 . 2007-05-19 07:55 ——– d—–w- c:\program files\Hewlett-Packard 2010-09-07 13:57 . 2007-09-13 18:27 ——– d—–w- c:\program files\EPSON 2010-09-07 13:45 . 2006-11-02 11:18 53248 —-a-w- c:\program files\Common Files\dns.cert 2010-09-04 07:48 . 2009-06-04 11:34 ——– d—–w- c:\users\terry\AppData\Roaming\CorelHomeOffice 2010-09-01 05:02 . 2008-07-30 04:05 ——– d—–w- c:\program files\McAfee 2010-08-29 20:01 . 2008-01-23 19:58 ——– d—–w- c:\program files\Microsoft Silverlight 2010-08-29 19:51 . 2007-11-28 13:45 ——– d—–w- c:\programdata\Microsoft Help 2010-08-29 19:27 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail 2010-08-28 04:57 . 2009-06-16 20:13 ——– d—–w- c:\program files\CCleaner 2010-08-03 04:16 . 2007-08-23 18:53 ——– d—–w- c:\program files\Common Files\ACD Systems 2010-07-27 18:29 . 2010-07-27 18:29 ——– d—–w- c:\users\terry\AppData\Roaming\ACD Systems 2010-07-27 17:42 . 2007-08-23 18:49 10368 —-a-w- c:\windows\system32\drivers\pfc.sys 2010-07-15 01:33 . 2007-06-21 18:28 135376 —-a-w- c:\users\terry\AppData\Local\GDIPFONTCACHEV1.DAT 2010-07-09 08:42 . 2009-12-17 15:16 69222840 —-a-w- c:\users\terry\AppData\Roaming\Nokia\Ovi Suite\Software Updater\NokiaOviSuite2Installer.exe 2010-06-26 06:05 . 2010-08-29 19:21 916480 —-a-w- c:\windows\system32\wininet.dll 2010-06-26 06:02 . 2010-08-29 19:21 71680 —-a-w- c:\windows\system32\iesetup.dll 2010-06-26 06:02 . 2010-08-29 19:21 109056 —-a-w- c:\windows\system32\iesysprep.dll 2010-06-26 04:25 . 2010-08-29 19:21 133632 —-a-w- c:\windows\system32\ieUnatt.exe 2007-06-21 21:34 . 2007-06-21 21:34 22 –sha-w- c:\windows\SMINST\HPCD.sys 2009-02-04 07:28 . 2008-01-23 22:37 952 –sha-w- c:\windows\System32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952] "YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856] "Evidence Eliminator"="c:\program files\Evidence Eliminator\EEStartupLauncher.exe" [2009-11-10 19720] "Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-26 39408] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] "Messenger (Yahoo!)"="c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe" [2010-03-19 5248312] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2005-02-16 221184] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 159744] "CognizanceTS"="c:\progra~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll" [2003-12-22 17920] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920] "Net-It Launcher"="c:\windows\system32\NILaunch.exe" [1998-02-05 24576] "LVCOMS"="c:\program files\Common Files\Logitech\QCDriver2\LVCOMS.EXE" [2002-09-20 90112] "YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-11 141848] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-11 166424] "Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-11 133656] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184] "HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008] "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-03-11 159744] "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 480560] "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-12-04 186904] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2010-06-17 40368] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-08 44128] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux6"=wdmaud.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys] @="FSFilter Activity Monitor" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "Windows Defender"=%ProgramFiles%\Windows Defender\MSASCui.exe -hide "Apoint"=c:\program files\Apoint2K\Apoint.exe "QPService"="c:\program files\HP\QuickPlay\QPService.exe" "LogitechGalleryRepair"=c:\program files\Logitech\ImageStudio\ISStart.exe "LogitechImageStudioTray"=c:\program files\Logitech\ImageStudio\LogiTray.exe "Ad-Watch"=c:\program files\Lavasoft\Ad-Aware\AAWTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 R2 gupdate1ca198ca353ce6a;Google Update Service (gupdate1ca198ca353ce6a);c:\program files\Google\Update\GoogleUpdate.exe [2009-08-10 133104] R3 MODBDA2;DiBcom MOD3000 TV receiver;c:\windows\system32\Drivers\yuanmodbda2.sys [2006-10-14 32256] S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-12-02 64288] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0308000.029\SYMEFA.SYS [2009-09-27 310320] S1 BHDrvx86;Symantec Heuristics Driver;c:\windows\System32\Drivers\N360\0308000.029\BHDrvx86.sys [2009-09-27 259632] S1 ccHP;Symantec Hash Provider;c:\windows\System32\Drivers\N360\0308000.029\ccHPx86.sys [2009-09-27 482432] S1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\elrawdsk.sys [2007-03-22 20560] S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20100917.001\IDSvix86.sys [2010-05-28 344112] S2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-04 98304] S2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe [2008-01-19 21504] S2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe [2008-01-19 21504] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-02-10 1181328] S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2010-05-20 88176] S2 Megatech-Software-Protection;Megatech-Software-Protection;c:\program files\Common Files\Megatech\MProtect\MPSERV.EXE [2007-01-10 36864] S2 N360;Norton 360;c:\program files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe [2009-09-27 117640] S2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-04 118784] S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368] S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-09-04 102448] S3 NETw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-11-17 3668480] S3 SYMNDISV;Symantec Network Filter Driver;c:\windows\System32\Drivers\N360\0308000.029\SYMNDISV.SYS [2009-09-27 48688] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ Cognizance REG_MULTI_SZ ASBroker ASChannel HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}] 2009-03-08 11:32 128512 —-a-w- c:\windows\System32\advpack.dll . Contents of the 'Scheduled Tasks' folder 2010-09-18 c:\windows\Tasks\Ad-Aware Update (Daily 1).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 19:58] 2010-09-18 c:\windows\Tasks\Ad-Aware Update (Daily 2).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 19:58] 2010-09-18 c:\windows\Tasks\Ad-Aware Update (Daily 3).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 19:58] 2010-09-18 c:\windows\Tasks\Ad-Aware Update (Daily 4).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 19:58] 2010-09-18 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 19:58] 2010-09-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-08-10 07:31] 2010-09-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-08-10 07:31] 2010-09-14 c:\windows\Tasks\ParetoLogic Privacy Controls_{C7A976E8-C001-11DF-9877-001A6B726D8C}.job - c:\program files\ParetoLogic\Privacy Controls\Pareto_PC.exe [2010-04-23 23:09] 2010-09-14 c:\windows\Tasks\ParetoLogic Registration3.job - c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2009-08-04 18:19] 2010-09-17 c:\windows\Tasks\ParetoLogic Update Version3.job - c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2009-08-04 18:19] 2010-09-17 c:\windows\Tasks\RegCure Program Check.job - c:\program files\RegCure\RegCure.exe [2010-05-19 23:20] 2010-09-14 c:\windows\Tasks\RegCure.job - c:\program files\RegCure\RegCure.exe [2010-05-19 23:20] 2010-08-28 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job - c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2010-01-02 14:31] 2008-12-26 c:\windows\Tasks\Spybot - Search & Destroy Updater - Scheduled Task.job - c:\program files\Spybot - Search & Destroy\SDUpdate.exe [2010-01-02 14:31] 2010-09-18 c:\windows\Tasks\User_Feed_Synchronization-{45513001-7868-44F9-A6B6-9CFCD4D4CF7B}.job - c:\windows\system32\msfeedssync.exe [2010-08-29 04:24] . . ——- Supplementary Scan ——- . uStart Page = hxxp://uk.yahoo.com/ uDefault_Search_URL = hxxp://www.google.com/ie mStart Page = hxxp://uk.yahoo.com uInternet Settings,ProxyOverride = uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://uk.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://uk.search.yahoo.com IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html IE: Send image to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll . - - - - ORPHANS REMOVED - - - - WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) ************************************************************************** scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\N360] "ImagePath"="\"c:\program files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\3.8.0.41\diMaster.dll\" /prefetch:1" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Dnscache] "ServiceDll"="%CommonProgramFiles%\dns.cert" . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.032" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 10.0.abr" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.ani" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 10.0.arw" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.bay" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.bmp" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.bw" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.cr2" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.crw" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.cs1" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.cur" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.dcr" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.dcx" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.dib" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.djv" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.djvu" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.dng" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.emf" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.eps" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.erf" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.fff" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.fpx" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.gif" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 10.0.hdr" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.icl" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.icn" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.ico" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.iff" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.ilbm" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.int" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.inta" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.iw4" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.j2c" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.j2k" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 10.0.jbr" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.jfif" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.jif" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.jp2" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.jpc" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.jpe" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.jpeg" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.jpg" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.jpk" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.jpx" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 10.0.kdc" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.lbm" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 10.0.mef" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.mos" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.mrw" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.nef" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.orf" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbm\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.pbm" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 10.0.pbr" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcd\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.pcd" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.pct" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcx\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.pcx" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.pef" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.pgm" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.pic" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.pict" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.pix" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.png" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppm\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.ppm" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.psd" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.psp" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 10.0.pspbrush" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 10.0.pspimage" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.raf" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.ras" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.raw" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.rgb" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.rgba" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.rle" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.rsb" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.sgi" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.sr2" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.srf" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tga\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.tga" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.thm" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.tif" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.tiff" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.ttc" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.ttf" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.wbm" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.wbmp" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.wmf" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xbm\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.xbm" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.xif" [HKEY_USERS\S-1-5-21-3869398498-673548423-838661324-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice] @Denied: (2) (LocalSystem) "Progid"="ACDSee 9.0.xpm" [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . ——————— DLLs Loaded Under Running Processes ——————— - - - - - - - > 'Explorer.exe'(5812) c:\progra~1\mcafee\SITEAD~1\saHook.dll c:\windows\system32\btncopy.dll c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_eng.nlr c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr . ———————— Other Running Processes ———————— . c:\program files\Bonjour\mDNSResponder.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\windows\system32\rundll32.exe c:\program files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe c:\windows\system32\DRIVERS\xaudio.exe c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe c:\windows\system32\DllHost.exe c:\program files\HP\QuickPlay\Kernel\TV\QPSched.exe c:\windows\system32\wbem\unsecapp.exe c:\windows\system32\igfxsrvc.exe c:\windows\ehome\ehsched.exe c:\windows\ehome\ehRecvr.exe c:\progra~1\EVIDEN~1\ee.exe c:\program files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE c:\windows\ehome\ehmsas.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\program files\Apoint2K\ApMsgFwd.exe c:\program files\Apoint2K\Apntex.exe c:\program files\Yahoo!\Messenger\ymsgr_tray.exe c:\windows\system32\WerCon.exe . ************************************************************************** . Completion time: 2010-09-18 07:14:45 - machine was rebooted ComboFix-quarantined-files.txt 2010-09-18 06:14 Pre-Run: 54,303,080,448 bytes free Post-Run: 54,066,507,776 bytes free - - End Of File - - 5F0C918D5742871CF1395C39C014274E