Spyware / Malware / Virus Removal

What's going on?

13 min read

Looking for the outcome? Ask AI

boggler Topic Starter

Post #1September 23, 2010, 10:05 AM UTC

Hi,

My browser hs been going crazy recently. randomly not connecting to pages and sometimes diverting to insurance advert sites. This is my hijack this log. Any advice would be very gratefully received

Thansk in advance

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:02:11, on 23/09/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18943)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Samsung\Samsung Recovery Solution II\WCScheduler.exe
C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe
C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\System32\rundll32.exe
C:\PROGRA~1\samsung\SAMSUN~2\SUPNOT~1.EXE
C:\Windows\system32\rundll32.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20100915223815.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
O2 - BHO: Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\tbVuze.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\tbVuze.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [B2C_AGENT] C:\ProgramData\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe
O4 - HKLM\..\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [userinit] C:\Users\Kwab\AppData\Roaming\sdra64.exe
O4 - HKCU\..\Run: [VeohPlugin] "C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"
O4 - HKCU\..\Run: [{1FA587A4-ECD0-796A-8ECD-1000E364F10B}] C:\Users\Kwab\AppData\Roaming\Otduco\biwit.exe
O4 - HKCU\..\Run: [Iyidodadodexa] rundll32.exe "C:\Users\Kwab\AppData\Local\ZLTVSVCD.dll",Startup
O4 - HKCU\..\Run: [dfrgsnapnt.exe] C:\Users\Kwab\AppData\Local\Temp\dfrgsnapnt.exe
O4 - HKCU\..\Run: [Ghidede] rundll32.exe "C:\Users\Kwab\AppData\Local\elatuqicacepepa.dll",Startup
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O8 - Extra context menu item: Send image to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O16 - DPF: Garmin Communicator Plug-In - https://static.garmincdn.com/gcp/ie/2.9.2.0…inAxControl.CAB
O16 - DPF: {0972B098-DEE9-4279-AC7E-4BAAA029102D} (PhotoboxPhotowaysUploader5 Control) - http://assets.photobox.com/assets/aurigma/…?20100805101937
O16 - DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} (UploadListView Class) - http://picasaweb.google.com/s/v/63.27/uploader2.cab
O16 - DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} (Egg Money Manager Digital Safe) - https://moneymanager.egg.com/Pinsafe/accounttracking.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B9DCD0A7-6902-427E-8440-A8D25E7635D9}: NameServer = 93.188.162.82,93.188.161.222
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 93.188.162.82,93.188.161.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.162.82,93.188.161.222
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\599\G2AWinLogon.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\599\g2aservice.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee Personal Firewall Service (McMPFSvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McAfee VirusScan Announcer (McNaiAnn) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McShield - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe
O23 - Service: McAfee Firewall Core Service (mfefire) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
O23 - Service: McAfee Total Protection Agent Service (myAgtSvc) - McAfee, Inc. - C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

–
End of file - 15559 bytes

Satchfan

Post #2September 23, 2010, 1:55 PM UTC

Hello boggler and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem. Please read the following guidelines which will help to make cleaning your machine easier:
• Please do not install/uninstall any programs unless asked to.
• Please do not run any scans other than those requested
• Please follow all instructions in the order posted
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• If you don't understand something, please don't hesitate to ask for clarification before proceeding
• The fixes are specific to your problem and should only be used for this issue on this machine.
• Please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!
Please note that I am still in training and my replies need to be checked by an expert in order for you to receive the best possible advice. This may result in a small delay between my posts but I shall try to keep this to a minimum.

I am looking through your log now and will reply as soon as possible.

Satchfan

boggler

Post #3September 23, 2010, 5:03 PM UTC

Thanks, I think that my browser has been hijacked. My bank just called me and it seems someone tried to transfer money out of my account this morning………

Satchfan

Post #4September 23, 2010, 10:06 PM UTC

Hello again boggler

As you have had these alerts, it's possible that your computer has been infected by a backdoor trojan. These programs have the ability to steal passwords and other information from your system. If you use your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:• Use another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use.
• Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account.
• Consider what other private information could possibly have been taken from your computer and take appropriate steps
This infection can almost certainly be cleaned, but as the malware could be configured to run any program a remote attacker requires, it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting the system partition and reinstalling Windows as this is the only 100% sure answer.

If you wish to reformat then please let me know in your next response. If not, please follow these instructions:

P2P - I see you have P2P software, (Vuze), installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infection. If your computer is infected, it likely contributed to your current situation.

This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P file-sharing as a major conduit to spread their wares.

Please see this topic for more information:

Perils of P2P File Sharing.

I would strongly recommend that you uninstall it now. You can do so via Control Panel, Programs, and then Programs and Features.

Should you decide to keep it, please don’t use it until we have finished up here.

OTL Custom Scan

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click on Minimal Output at the top
Download the following file scan.txt to your Desktop. Click here to download it. You may need to right click on it and select "Save"
Double click inside the Custom Scan box at the bottom
A window will appear saying "Click OK to load a custom scan from a file or Cancel to cancel"
Click the Ok button and navigate to the file scan.txt which we just saved to your desktop
Select scan.txt and click Open. Writing will now appear under the Custom Scan box
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan won’t take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic

Please download DeFogger to your desktop.

Double click DeFogger to run the tool.

The application window will appear
Click the Disable button to disable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.

Do not re-enable these drivers until otherwise instructed

Download the GMER Rootkit Scanner

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it

In the right panel, you will see several boxes that have been checked. Uncheck the following …
IAT/EAT
All drives/partitions except C:\)
Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.

Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

Logs to include with next post:

OTL.txt
Extras.txt
Gmer.txt

Thanks

Satchfan

boggler

Post #5September 25, 2010, 6:57 PM UTC

Thanks I'll do the OTL, Extras and Gmer and let you know how I get on

boggler

Post #6September 25, 2010, 9:04 PM UTC

I have pasted the otl and extras txt below. The gmer keeps crashing when I try to run it. I get this message afterwards:

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.0.6002.2.2.0.768.3
Locale ID: 2057

Additional information about the problem:
BCCode: f4
BCP1: 00000003
BCP2: 8101EB80
BCP3: 8101ECCC
BCP4: 829EEDC0
OS Version: 6_0_6002
Service Pack: 2_0
Product: 768_1

Files that help describe the problem:
C:\Windows\Minidump\Mini092510-04.dmp
C:\Users\Kwab\AppData\Local\Temp\WER-44975-0.sysdata.xml
C:\Users\Kwab\AppData\Local\Temp\WERA18B.tmp.version.txt

Read our privacy statement:
http://go.microsoft.com/fwlink/?linkid=501…mp;clcid=0x0409

I will try to run it again and paste it later. Should I renable the stuff I disabled with defogger?

Thanks so much for the help so far

OTL logfile created on: 25/09/2010 20:06:13 - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Users\Kwab\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18943)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 59.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 111.88 Gb Total Space | 19.98 Gb Free Space | 17.86% Space Free | Partition Type: NTFS
Drive D: | 111.00 Gb Total Space | 101.31 Gb Free Space | 91.27% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: KWAB-PC
Current User Name: Kwab
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Users\Kwab\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\Samsung\Samsung Update Plus\SUPNotifier.exe ()
PRC - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
PRC - C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe (Google Inc.)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)
PRC - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files\Kontiki\KService.exe (Kontiki Inc.)
PRC - C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
PRC - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation)
PRC - C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe (SAMSUNG Electronics)
PRC - C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Program Files\Samsung\Samsung Recovery Solution II\WCScheduler.exe ()
PRC - C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe (SAMSUNG Electronics co., LTD.)
PRC - C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)
PRC - C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe (McAfee, Inc.)

========== Modules (SafeList) ==========

MOD - C:\Users\Kwab\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\WindowsCodecs.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_d1c738ec43578ea
1\ATL80.dll (Microsoft Corporation)
MOD - C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll (Microsoft Corporation)
MOD - C:\Windows\System32\networkexplorer.dll (Microsoft Corporation)
MOD - C:\Windows\System32\SLC.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msshsq.dll (Microsoft Corporation)
MOD - C:\Windows\System32\EhStorShell.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cscapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\rsaenh.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4016_none_d0893820442e7fe
4\msvcr80.dll (Microsoft Corporation)
MOD - C:\Program Files\Microsoft Office\Office12\GrooveUtil.dll (Microsoft Corporation)
MOD - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
MOD - C:\Program Files\Microsoft Office\Office12\GrooveNew.dll (Microsoft Corporation)
MOD - C:\Windows\System32\thumbcache.dll (Microsoft Corporation)
MOD - C:\Windows\System32\duser.dll (Microsoft Corporation)
MOD - C:\Windows\System32\actxprxy.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (mfefire) – C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV - (mfevtp) – C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe (McAfee, Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (WPFFontCache_v0400) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (McProxy) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNASvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNaiAnn) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McMPFSvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (GoToAssist) – C:\Program Files\Citrix\GoToAssist\599\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (FontCache) – C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (btwdins) – C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)
SRV - (MSSQL$MSSMLBIZ) SQL Server (MSSMLBIZ) – C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (SBSDWSCService) – C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (KService) – C:\Program Files\Kontiki\KService.exe (Kontiki Inc.)
SRV - (SQLWriter) – C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
SRV - (SQLBrowser) – C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
SRV - (MSSQLServerADHelper) – C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (BcmSqlStartupSvc) – C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation)
SRV - (HauppaugeTVServer) – C:\Program Files\WinTV\HCWTVServer.exe (Hauppauge Computer Works)
SRV - (AgereModemAudio) – C:\Windows\System32\agrsmsvc.exe (Agere Systems)
SRV - (EPGService) – C:\Program Files\WinTV\EPG Services\System\EPGService.exe (Hauppauge Computer Works)
SRV - (myAgtSvc) – C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe (McAfee, Inc.)

========== Driver Services (SafeList) ==========

DRV - (NwlnkFwd) – C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) – C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (blbdrive) – C:\Windows\System32\drivers\blbdrive.sys File not found
DRV - (ADDMEM) – C:\Users\Kwab\AppData\Local\Temp\__Samsung_Update\ADDMEM.SYS File not found
DRV - (mfehidk) – C:\Windows\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfefirek) – C:\Windows\System32\drivers\mfefirek.sys (McAfee, Inc.)
DRV - (mfewfpk) – C:\Windows\System32\drivers\mfewfpk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\Windows\System32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mferkdet) – C:\Windows\System32\drivers\mferkdet.sys (McAfee, Inc.)
DRV - (mfenlfk) – C:\Windows\System32\drivers\mfenlfk.sys (McAfee, Inc.)
DRV - (cfwids) – C:\Windows\System32\drivers\cfwids.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (UsbDiag) – C:\Windows\System32\drivers\lgusbdiag.sys (LG Electronics Inc.)
DRV - (USBModem) – C:\Windows\System32\drivers\lgusbmodem.sys (LG Electronics Inc.)
DRV - (usbbus) – C:\Windows\System32\drivers\lgusbbus.sys (LG Electronics Inc.)
DRV - (btwavdt) – C:\Windows\System32\drivers\btwavdt.sys (Broadcom Corporation.)
DRV - (btwaudio) – C:\Windows\System32\drivers\btwaudio.sys (Broadcom Corporation.)
DRV - (btwl2cap) – C:\Windows\System32\drivers\btwl2cap.sys (Broadcom Corporation.)
DRV - (btwrchid) – C:\Windows\System32\drivers\btwrchid.sys (Broadcom Corporation.)
DRV - (WSDPrintDevice) – C:\Windows\System32\drivers\WSDPrint.sys (Microsoft Corporation)
DRV - (hcw95rc) – C:\Windows\System32\drivers\hcw95rc.sys (Hauppauge Computer Works, Inc.)
DRV - (hcw95bda) – C:\Windows\System32\drivers\hcw95bda.sys (Hauppauge Computer Works, Inc.)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (NETw4v32) Intel® – C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation)
DRV - (yukonwlh) – C:\Windows\System32\drivers\yk60x86.sys (Marvell)
DRV - (SynTP) – C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (AgereSoftModem) – C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (KMDFMEMIO) – C:\Windows\System32\drivers\KMDFMEMIO.sys (SAMSUNG ELECTRONICS CO., LTD.)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) – C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (R300) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (NETw2v32) Intel® – C:\Windows\System32\drivers\NETw2v32.sys (Intel® Corporation)
DRV - (RTL8023xp) – C:\Windows\System32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation )
DRV - (E1G60) Intel® – C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://msn.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: ([2009/09/20 09:46:18 | 000,331,165 | R— | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 11344 more lines…
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20100915223815.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [B2C_AGENT] C:\ProgramData\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe (LG Electronics)
O4 - HKLM..\Run: [Google Quick Search Box] C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe (Google Inc.)
O4 - HKLM..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PPort11reminder] C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Append to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O8 - Extra context menu item: Send image to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: flybmi.com ([www] https in Trusted sites)
O16 - DPF: {0972B098-DEE9-4279-AC7E-4BAAA029102D} http://assets.photobox.com/assets/aurigma/…?20100805101937 (PhotoboxPhotowaysUploader5 Control)
O16 - DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} http://picasaweb.google.com/s/v/63.27/uploader2.cab (UploadListView Class)
O16 - DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} https://moneymanager.egg.com/Pinsafe/accounttracking.cab (Egg Money Manager Digital Safe)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_10)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_10)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_10)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/2.9.2.0…inAxControl.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\myrm {4D034FC3-013F-4b95-B544-44D49ABE3E76} - C:\Program Files\McAfee\Managed VirusScan\Agent\MyRmProt4.0.0.358.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\599\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\599\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{3ad979a8-c334-11de-a386-00137767692d}\Shell\open\command - "" = G:\CA-20089\CA-20089\CA-200898ya0.exe – File not found
O33 - MountPoints2\{3ad979ae-c334-11de-a386-00137767692d}\Shell\open\command - "" = H:\CA-20089\CA-20089\CA-200898ya0.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.clmp3enc - C:\Program Files\CyberLink\Power2Go\CLMP3Enc.ACM (CyberLink Corp.)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.GEOX - C:\Windows\System32\GeoCodec.dll (GeoVision)
Drivers32: vidc.mpg2 - C:\Windows\mpg4c32.dll (Microsoft Corporation)
Drivers32: vidc.mpg3 - C:\Windows\mpg4c32.dll (Microsoft Corporation)
Drivers32: vidc.mpg4 - C:\Windows\mpg4c32.dll (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 90 Days ==========

[2010/09/25 20:03:30 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Users\Kwab\Desktop\OTL.exe
[2010/09/23 18:14:18 | 000,000,000 | —D | C] – C:\Users\Kwab\AppData\Roaming\Malwarebytes
[2010/09/23 18:14:09 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/09/23 18:14:07 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/09/23 18:14:05 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/09/23 18:14:05 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/09/23 08:38:17 | 000,000,000 | —D | C] – C:\Users\Kwab\AppData\Local\{FB0BE041-599A-4BA1-8060-7A09DA6722AD}
[2010/09/18 21:10:19 | 000,000,000 | —D | C] – C:\Users\Kwab\Desktop\Bookings
[2010/09/18 13:23:59 | 000,000,000 | —D | C] – C:\Users\Kwab\AppData\Roaming\AA Pass Your Test
[2010/09/18 13:08:24 | 000,000,000 | —D | C] – C:\Users\Kwab\Desktop\Makiko AA Disc
[2010/08/21 21:44:20 | 000,000,000 | —D | C] – C:\Program Files\Veoh Networks
[2010/08/15 11:01:19 | 000,000,000 | —D | C] – C:\Program Files\Trojan Remover
[2010/08/15 11:01:19 | 000,000,000 | —D | C] – C:\Users\Kwab\AppData\Roaming\Simply Super Software
[2010/08/15 11:01:19 | 000,000,000 | —D | C] – C:\ProgramData\Simply Super Software
[2010/08/10 22:00:24 | 000,000,000 | —D | C] – C:\Program Files\AA Pass Your Test
[2010/08/10 21:50:12 | 000,000,000 | —D | C] – C:\Users\Kwab\Documents\Makiko AA Disc
[2010/07/25 06:53:48 | 000,009,344 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\mfeclnk.sys
[2010/07/25 06:53:06 | 000,386,712 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\mfehidk.sys
[2010/07/25 06:53:06 | 000,312,904 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\mfefirek.sys
[2010/07/25 06:53:06 | 000,164,808 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\mfewfpk.sys
[2010/07/25 06:53:06 | 000,152,992 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\mfeavfk.sys
[2010/07/25 06:53:06 | 000,095,600 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\mfeapfk.sys
[2010/07/25 06:53:06 | 000,084,264 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\mferkdet.sys
[2010/07/25 06:53:06 | 000,064,304 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\mfenlfk.sys
[2010/07/25 06:53:06 | 000,055,840 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\cfwids.sys
[2010/07/25 06:53:06 | 000,052,104 | —- | C] (McAfee, Inc.) – C:\Windows\System32\drivers\mfebopk.sys
[2010/07/21 12:02:37 | 000,000,000 | —D | C] – C:\Program Files\Conduit
[2010/07/21 11:08:59 | 000,000,000 | —D | C] – C:\Program Files\BBC iPlayer Desktop
[2010/07/19 19:08:29 | 000,000,000 | —D | C] – C:\Users\Kwab\AppData\Roaming\GARMIN
[2010/07/11 11:31:09 | 000,413,696 | R— | C] (GeoVision) – C:\Windows\GeoCodec.dll
[2010/07/11 11:31:09 | 000,413,696 | —- | C] (GeoVision) – C:\Windows\System32\GeoCodec.dll
[2010/07/11 11:31:09 | 000,000,000 | —D | C] – C:\Windows\v6100
[2010/07/08 13:57:44 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Skype
[2009/08/01 05:54:03 | 000,201,728 | —- | C] (Iosif Adrian) – C:\Users\Kwab\AppData\Local\elatuqicacepepa.dll_old
[2006/11/24 23:14:44 | 000,139,264 | —- | C] ( ) – C:\Windows\System32\MACSSDK_wiz.dll
[2006/11/24 23:14:44 | 000,126,976 | —- | C] ( ) – C:\Windows\System32\MACSSDK.dll

========== Files - Modified Within 90 Days ==========

[2010/09/25 20:06:11 | 008,126,464 | -HS- | M] () – C:\Users\Kwab\NTUSER.DAT
[2010/09/25 20:05:18 | 000,000,416 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{5C210700-6543-4646-B781-D7D2BE24CDBB}.job
[2010/09/25 20:03:36 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Users\Kwab\Desktop\OTL.exe
[2010/09/25 19:53:00 | 000,000,884 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/09/25 18:32:46 | 000,003,168 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/09/25 18:32:46 | 000,003,168 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/09/25 17:53:01 | 000,000,880 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/09/25 08:36:38 | 000,027,744 | —- | M] () – C:\Users\Kwab\AppData\Roaming\nvModes.dat
[2010/09/25 08:36:38 | 000,027,744 | —- | M] () – C:\Users\Kwab\AppData\Roaming\nvModes.001
[2010/09/25 08:32:42 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/09/25 02:02:56 | 000,000,416 | -H– | M] () – C:\Windows\tasks\SupBackGroundTask.job
[2010/09/25 01:32:28 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/09/25 01:32:18 | 2145,837,056 | -HS- | M] () – C:\hiberfil.sys
[2010/09/24 17:57:24 | 000,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2010/09/24 17:57:20 | 000,524,288 | -HS- | M] () – C:\Users\Kwab\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
[2010/09/24 17:57:20 | 000,065,536 | -HS- | M] () – C:\Users\Kwab\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010/09/24 17:57:10 | 002,359,038 | -H– | M] () – C:\Users\Kwab\AppData\Local\IconCache.db
[2010/09/23 20:27:22 | 000,000,120 | —- | M] () – C:\Users\Kwab\AppData\Local\Swofubadisuvubo.dat
[2010/09/23 18:14:12 | 000,000,818 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/09/23 10:57:58 | 000,002,521 | —- | M] () – C:\Users\Kwab\Desktop\HiJackThis.lnk
[2010/09/23 08:38:20 | 000,000,000 | —- | M] () – C:\Users\Kwab\AppData\Local\Nritahixoweto.bin
[2010/09/20 22:52:48 | 000,773,504 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/09/20 22:52:48 | 000,659,398 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/09/20 22:52:48 | 000,127,628 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/09/14 08:40:42 | 000,026,624 | —- | M] () – C:\Users\Kwab\Documents\boiler graham 48.doc
[2010/09/13 19:29:02 | 000,497,884 | —- | M] () – C:\Users\Kwab\Documents\Nao Amur 1.jpg
[2010/09/13 19:26:58 | 000,464,489 | —- | M] () – C:\Users\Kwab\Documents\Nao Amur.jpg
[2010/09/13 19:24:39 | 000,408,141 | —- | M] () – C:\Users\Kwab\Documents\Nana BoardingDocument_Page_3.jpg
[2010/09/13 19:24:38 | 000,381,612 | —- | M] () – C:\Users\Kwab\Documents\Nana BoardingDocument_Page_2.jpg
[2010/09/13 19:24:36 | 000,235,893 | —- | M] () – C:\Users\Kwab\Documents\Nana BoardingDocument_Page_1.jpg
[2010/09/13 07:58:04 | 000,078,848 | —- | M] () – C:\Users\Kwab\Documents\Staff Permit[1].doc
[2010/09/09 11:44:48 | 000,050,176 | —- | M] () – C:\Users\Kwab\Desktop\Lan samples.doc
[2010/09/08 10:02:10 | 000,048,128 | —- | M] () – C:\Users\Kwab\Documents\Lan samples.doc
[2010/09/02 14:04:36 | 000,121,442 | —- | M] () – C:\Users\Kwab\Documents\Nana BoardingDocument.pdf
[2010/09/02 11:54:00 | 000,020,992 | —- | M] () – C:\Users\Kwab\Desktop\2010 Semester 1 LAN Timetable.xls
[2010/09/02 10:38:33 | 000,028,672 | —- | M] () – C:\Users\Kwab\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/08/24 14:57:38 | 000,386,712 | —- | M] (McAfee, Inc.) – C:\Windows\System32\drivers\mfehidk.sys
[2010/08/24 14:57:38 | 000,312,904 | —- | M] (McAfee, Inc.) – C:\Windows\System32\drivers\mfefirek.sys
[2010/08/24 14:57:38 | 000,164,808 | —- | M] (McAfee, Inc.) – C:\Windows\System32\drivers\mfewfpk.sys
[2010/08/24 14:57:38 | 000,152,992 | —- | M] (McAfee, Inc.) – C:\Windows\System32\drivers\mfeavfk.sys
[2010/08/24 14:57:38 | 000,095,600 | —- | M] (McAfee, Inc.) – C:\Windows\System32\drivers\mfeapfk.sys
[2010/08/24 14:57:38 | 000,084,264 | —- | M] (McAfee, Inc.) – C:\Windows\System32\drivers\mferkdet.sys
[2010/08/24 14:57:38 | 000,064,304 | —- | M] (McAfee, Inc.) – C:\Windows\System32\drivers\mfenlfk.sys
[2010/08/24 14:57:38 | 000,055,840 | —- | M] (McAfee, Inc.) – C:\Windows\System32\drivers\cfwids.sys
[2010/08/24 14:57:38 | 000,052,104 | —- | M] (McAfee, Inc.) – C:\Windows\System32\drivers\mfebopk.sys
[2010/08/24 14:57:38 | 000,009,344 | —- | M] (McAfee, Inc.) – C:\Windows\System32\drivers\mfeclnk.sys
[2010/08/21 21:44:24 | 000,001,186 | —- | M] () – C:\Users\Kwab\Desktop\Veoh.com.lnk
[2010/08/15 11:01:26 | 000,000,906 | —- | M] () – C:\Users\Public\Desktop\Trojan Remover.lnk
[2010/08/12 19:42:58 | 000,381,856 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2010/07/28 15:53:15 | 000,037,888 | —- | M] () – C:\Users\Kwab\Documents\2010 2011 key dates and tasks.doc
[2010/07/26 01:15:07 | 000,006,524 | —- | M] () – C:\Users\Kwab\Documents\sc_config_eyeballchat.xml
[2010/07/21 11:51:53 | 000,047,104 | —- | M] () – C:\Users\Kwab\Desktop\Prefoundation courses in London[1].doc
[2010/07/21 11:08:59 | 000,000,862 | —- | M] () – C:\Users\Public\Desktop\BBC iPlayer Desktop.lnk
[2010/07/18 23:09:16 | 000,524,288 | -HS- | M] () – C:\Users\Kwab\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010/07/18 19:43:12 | 000,153,164 | —- | M] () – C:\Users\Kwab\Documents\northpoint 2009.pdf
[2010/07/18 19:41:43 | 000,314,368 | —- | M] () – C:\Users\Kwab\Documents\northpoint 2009.doc
[2010/07/13 18:23:03 | 000,967,230 | —- | M] () – C:\Users\Kwab\Desktop\Hotels_com - Deals & Discounts for Hotel Reservations from Luxury Hotels to Budget Accommodations.mht
[2010/07/11 11:27:29 | 000,936,135 | —- | M] () – C:\Users\Kwab\Desktop\Gmail - LateRooms_com Booking Confirmation - 9969039R - kwabasare@gmail_com.mht
[2010/07/01 20:34:32 | 000,023,552 | —- | M] () – C:\Users\Kwab\Documents\mamaki hertfordshire.doc

========== Files Created - No Company Name ==========

[2010/09/23 18:14:12 | 000,000,818 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/09/23 08:38:20 | 000,000,000 | —- | C] () – C:\Users\Kwab\AppData\Local\Nritahixoweto.bin
[2010/09/23 08:38:19 | 000,000,120 | —- | C] () – C:\Users\Kwab\AppData\Local\Swofubadisuvubo.dat
[2010/09/14 08:33:51 | 000,026,624 | —- | C] () – C:\Users\Kwab\Documents\boiler graham 48.doc
[2010/09/13 19:29:01 | 000,497,884 | —- | C] () – C:\Users\Kwab\Documents\Nao Amur 1.jpg
[2010/09/13 19:26:29 | 000,464,489 | —- | C] () – C:\Users\Kwab\Documents\Nao Amur.jpg
[2010/09/13 19:24:38 | 000,408,141 | —- | C] () – C:\Users\Kwab\Documents\Nana BoardingDocument_Page_3.jpg
[2010/09/13 19:24:37 | 000,381,612 | —- | C] () – C:\Users\Kwab\Documents\Nana BoardingDocument_Page_2.jpg
[2010/09/13 19:24:33 | 000,235,893 | —- | C] () – C:\Users\Kwab\Documents\Nana BoardingDocument_Page_1.jpg
[2010/09/13 07:58:03 | 000,078,848 | —- | C] () – C:\Users\Kwab\Documents\Staff Permit[1].doc
[2010/09/09 11:39:58 | 000,050,176 | —- | C] () – C:\Users\Kwab\Desktop\Lan samples.doc
[2010/09/08 10:02:10 | 000,048,128 | —- | C] () – C:\Users\Kwab\Documents\Lan samples.doc
[2010/09/02 14:04:36 | 000,121,442 | —- | C] () – C:\Users\Kwab\Documents\Nana BoardingDocument.pdf
[2010/09/02 11:53:59 | 000,020,992 | —- | C] () – C:\Users\Kwab\Desktop\2010 Semester 1 LAN Timetable.xls
[2010/08/21 21:44:24 | 000,001,186 | —- | C] () – C:\Users\Kwab\Desktop\Veoh.com.lnk
[2010/08/15 11:01:26 | 000,000,906 | —- | C] () – C:\Users\Public\Desktop\Trojan Remover.lnk
[2010/08/15 11:01:21 | 000,162,304 | —- | C] () – C:\Windows\System32\ztvunrar36.dll
[2010/08/15 11:01:21 | 000,153,088 | —- | C] () – C:\Windows\System32\UNRAR3.dll
[2010/08/15 11:01:21 | 000,077,312 | —- | C] () – C:\Windows\System32\ztvunace26.dll
[2010/08/15 11:01:21 | 000,075,264 | —- | C] () – C:\Windows\System32\unacev2.dll
[2010/07/28 15:36:20 | 000,037,888 | —- | C] () – C:\Users\Kwab\Documents\2010 2011 key dates and tasks.doc
[2010/07/21 10:39:15 | 000,047,104 | —- | C] () – C:\Users\Kwab\Desktop\Prefoundation courses in London[1].doc
[2010/07/18 19:43:12 | 000,153,164 | —- | C] () – C:\Users\Kwab\Documents\northpoint 2009.pdf
[2010/07/18 19:41:41 | 000,314,368 | —- | C] () – C:\Users\Kwab\Documents\northpoint 2009.doc
[2010/07/13 18:23:02 | 000,967,230 | —- | C] () – C:\Users\Kwab\Desktop\Hotels_com - Deals & Discounts for Hotel Reservations from Luxury Hotels to Budget Accommodations.mht
[2010/07/11 11:31:09 | 000,073,935 | —- | C] () – C:\Windows\Stable_6100.xml
[2010/07/11 11:31:09 | 000,012,045 | —- | C] () – C:\Windows\buzzer.wav
[2010/07/11 11:27:27 | 000,936,135 | —- | C] () – C:\Users\Kwab\Desktop\Gmail - LateRooms_com Booking Confirmation - 9969039R - kwabasare@gmail_com.mht
[2010/07/01 20:11:00 | 000,023,552 | —- | C] () – C:\Users\Kwab\Documents\mamaki hertfordshire.doc
[2010/05/15 18:47:37 | 000,000,000 | —- | C] () – C:\Windows\System32\sys_dll.dll
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/01 05:54:05 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/06/07 17:36:55 | 000,000,680 | —- | C] () – C:\Users\Kwab\AppData\Local\d3d9caps.dat
[2009/05/19 11:20:35 | 000,053,248 | —- | C] () – C:\Windows\System32\CommonDL.dll
[2009/05/19 11:20:35 | 000,002,413 | —- | C] () – C:\Windows\System32\lgAxconfig.ini
[2009/03/14 13:53:57 | 000,027,744 | —- | C] () – C:\Users\Kwab\AppData\Roaming\nvModes.001
[2009/03/14 13:53:54 | 000,027,744 | —- | C] () – C:\Users\Kwab\AppData\Roaming\nvModes.dat
[2009/01/13 18:48:58 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2008/09/26 00:28:11 | 000,000,031 | -H– | C] () – C:\Windows\UKCpInfo.sys
[2008/05/26 19:44:39 | 000,106,496 | —- | C] () – C:\Windows\System32\BrMuSNMP.dll
[2008/05/12 17:51:55 | 000,000,419 | —- | C] () – C:\Windows\BRWMARK.INI
[2008/05/12 17:51:55 | 000,000,027 | —- | C] () – C:\Windows\BRPP2KA.INI
[2008/05/12 17:45:39 | 000,031,567 | —- | C] () – C:\Windows\maxlink.ini
[2008/04/29 18:28:32 | 000,000,030 | —- | C] () – C:\Windows\System32\UNWISE.INI
[2008/04/29 18:28:07 | 000,032,133 | —- | C] () – C:\Windows\Irremote.ini
[2008/04/29 18:27:56 | 000,065,536 | —- | C] () – C:\Windows\System32\dmcrypto.dll
[2008/04/29 18:27:33 | 000,000,135 | —- | C] () – C:\Windows\ODBC.INI
[2008/04/29 18:27:32 | 000,163,840 | —- | C] () – C:\Windows\System32\hcwChDB.dll
[2008/04/29 18:27:19 | 000,006,538 | —- | C] () – C:\Windows\HCWPNP.INI
[2008/04/14 13:11:44 | 000,233,472 | —- | C] () – C:\Windows\System32\KvpUpCom.dll
[2008/02/14 19:07:46 | 000,000,032 | —- | C] () – C:\ProgramData\ezsid.dat
[2008/02/14 16:07:27 | 000,028,672 | —- | C] () – C:\Users\Kwab\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/12/11 18:01:34 | 000,000,135 | R— | C] () – C:\Windows\System32\lngEng.ini
[2007/12/11 18:01:34 | 000,000,117 | —- | C] () – C:\Windows\System32\lngKor.ini
[2007/12/11 17:40:56 | 001,060,424 | —- | C] () – C:\Windows\System32\WdfCoInstaller01000.dll
[2007/09/05 04:52:04 | 000,389,120 | —- | C] () – C:\Windows\System32\btwhidcs.dll
[2007/06/27 09:00:00 | 001,777,664 | —- | C] () – C:\Windows\System32\ZHP1600R.DLL
[2007/06/27 09:00:00 | 000,749,568 | —- | C] () – C:\Windows\System32\AGI1600.DLL
[2007/05/10 09:15:34 | 000,028,672 | —- | C] () – C:\Windows\System32\ISP_crgen.dll
[2007/02/16 01:51:02 | 000,274,432 | —- | C] () – C:\Windows\System32\NDADLL.dll
[2006/11/30 02:00:28 | 000,307,200 | —- | C] () – C:\Windows\System32\LDBGenWizView.dll
[2006/11/02 13:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 11:25:44 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/11/02 08:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/10/09 19:01:28 | 000,061,440 | —- | C] () – C:\Windows\System32\AVSAudioWideStereoDMO.dll
[2005/10/25 14:27:12 | 000,327,680 | —- | C] () – C:\Windows\System32\QFClient2.dll
[2005/06/29 19:45:44 | 000,708,096 | —- | C] () – C:\Windows\System32\INIcrypto20.dll

========== LOP Check ==========

[2010/09/20 23:25:36 | 000,000,000 | —D | M] – C:\Users\Kwab\AppData\Roaming\AA Pass Your Test
[2010/09/23 09:04:18 | 000,000,000 | —D | M] – C:\Users\Kwab\AppData\Roaming\Acbe
[2010/07/21 13:47:56 | 000,000,000 | —D | M] – C:\Users\Kwab\AppData\Roaming\Azureus
[2009/09/20 18:40:29 | 000,000,000 | —D | M] – C:\Users\Kwab\AppData\Roaming\BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1
[2010/05/16 08:38:22 | 000,000,000 | —D | M] – C:\Users\Kwab\AppData\Roaming\EyeballChatAvatars
[2010/06/01 21:32:25 | 000,000,000 | —D | M] – C:\Users\Kwab\AppData\Roaming\EyeballChatUserData
[2010/07/19 19:17:30 | 000,000,000 | —D | M] – C:\Users\Kwab\AppData\Roaming\GARMIN
[2009/05/19 21:12:28 | 000,000,000 | —D | M] – C:\Users\Kwab\AppData\Roaming\ICAClient
[2009/04/15 16:56:34 | 000,000,000 | —D | M] – C:\Users\Kwab\AppData\Roaming\LG Electronics
[2010/05/31 08:51:06 | 000,000,000 | -HSD | M] – C:\Users\Kwab\AppData\Roaming\lowsec
[2008/06/20 17:02:01 | 000,000,000 | —D | M] – C:\Users\Kwab\AppData\Roaming\oess
[2010/09/23 21:32:18 | 000,000,000 | —D | M] – C:\Users\Kwab\AppData\Roaming\Otduco
[2010/08/15 11:01:19 | 000,000,000 | —D | M] – C:\Users\Kwab\AppData\Roaming\Simply Super Software
[2009/12/28 23:35:26 | 000,000,000 | —D | M] – C:\Users\Kwab\AppData\Roaming\StreamTorrent
[2010/09/24 17:57:24 | 000,032,646 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2010/09/25 02:02:56 | 000,000,416 | -H– | M] () – C:\Windows\Tasks\SupBackGroundTask.job
[2010/09/25 20:05:18 | 000,000,416 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{5C210700-6543-4646-B781-D7D2BE24CDBB}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/09/18 22:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/04/11 07:36:36 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2006/11/16 11:39:29 | 000,008,192 | R-S- | M] () – C:\BOOTSECT.BAK
[2006/09/18 22:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2010/09/25 01:32:18 | 2145,837,056 | -HS- | M] () – C:\hiberfil.sys
[2008/01/09 03:20:42 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2008/01/09 03:20:42 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2010/09/25 01:32:16 | 2459,635,712 | -HS- | M] () – C:\pagefile.sys
[2007/04/26 08:45:58 | 000,000,631 | —- | M] () – C:\PDVD.iss
[2007/12/11 17:55:45 | 000,000,366 | —- | M] () – C:\RHDSetup.log
[2007/12/11 18:54:47 | 000,000,086 | —- | M] () – C:\Setup.log
[2009/08/15 19:20:43 | 000,000,000 | —- | M] () – C:\Tech_Vista.log
[2008/02/15 09:10:47 | 000,000,158 | —- | M] () – C:\YServer.txt

< %systemroot%\Fonts\*.com >
[2006/11/02 13:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 13:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 13:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/10/21 23:06:22 | 000,037,665 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 22:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/11/02 13:35:48 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 19:58:12 | 000,030,512 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\mdippr.dll
[2006/10/26 20:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll
[2007/06/27 09:00:00 | 000,057,344 | —- | M] (Zenographics, Inc.) – C:\Windows\System32\spool\prtprocs\w32x86\zIMFPRNT.DLL

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2009/07/10 13:15:46 | 000,306,544 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/01/20 20:29:17 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 11:34:05 | 000,020,480 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 11:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 11:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/10/15 10:46:27 | 000,000,221 | -HS- | M] () – C:\Users\Kwab\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010/09/25 20:03:36 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Users\Kwab\Desktop\OTL.exe
[2009/12/06 18:12:47 | 003,823,704 | —- | M] () – C:\Users\Kwab\Desktop\veetle-0.9.15.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >
[2009/11/22 20:15:20 | 000,103,784 | —- | M] () – C:\Users\Kwab\GoToAssistDownloadHelper.exe
[2008/07/22 15:53:14 | 009,463,225 | —- | M] (HalfBaked ) – C:\Users\Kwab\setup_hotpot_6251.exe

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2008/02/14 16:06:32 | 000,000,402 | -HS- | M] () – C:\Users\Kwab\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >
[2007/06/27 19:34:58 | 000,600,328 | —- | M] (Intel Corporation) – C:\Windows\Installer\iProInst.exe

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.exe >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< %USERPROFILE%\Templates\*.tmp >

< %SYSTEMDRIVE%\explorexxx.exe\*.* >

< %Windir%\Installer\*.tmp >

< %systemroot%\System32\*.xco >

< %ProgramFiles%\system32\*.* >

< %systemroot%\System32\windos\*.* >

< %SystemRoot%\system32\sandbox\*.* >

< %SystemRoot%\system32\*.amo >

< %SystemRoot%\system32\Windows Live\*.* >

< %ProgramFiles%\logs\*.* >

< %ProgramFiles%\Bifrost\*.* >

< %SystemRoot%\system32\*.goo >

< %systemroot%\system32\IME\*.* >

< %systemroot%\BackUp\*.* >

< %systemroot%\system32\*.ico >
[2006/09/18 22:31:55 | 000,107,620 | —- | M] () – C:\Windows\System32\acwizard.ico

< %systemroot%\system\*.dat >

< %systemroot%\system\*.exe >

< %AppData%\Macromedia\Common\*.* >

< %SYSTEMDRIVE%\dir\*.* /s >

< %systemroot%\system32\ras\*.exe >

< %SYSTEMDRIVE%\MFILES\*.* >

< %SYSTEMDRIVE%\mDNSRespon.exe\*.* >

< %systemroot%\system32\services\*.* >

< %systemroot%\Spooler\*.* >

< %ProgramFiles%\system32\*.* >

< %systemroot%\system32\Setup\*.dll /x >

< %systemroot%\system32\*.mine >

< %SYSTEMDRIVE%\cleansweep.exe\*.* >

< %systemroot%\system32\ras\*.dll >

< %systemroot%\system32\ras\*.drv >

< %systemroot%\*.iq >

< %systemroot%\system32\XP\*.* >

< %SYSTEMDRIVE%\Extracted\*.* >

< %systemroot%\system32\windows\*.* >

< %systemroot%\logs\*.* >

< %SYSTEMDRIVE%\Win.Msi\*.* >

< %systemroot%\regedit\*.* >

< %systemroot%\system32\skype\*.* >

< %AppData%\Adobe\dlluplwin25\*.* >

< %UserProfile%\*.dat >
[2010/09/25 20:12:06 | 008,126,464 | -HS- | M] () – C:\Users\Kwab\NTUSER.DAT

< %UserProfile%\*.dll >

< %systemroot%\system32\*.sxo >

< %SYSTEMDRIVE%\Gazma\*.* /s >

< %systemroot%\system32\spynet\*.* >

< %systemroot%\system32\System\*.* >

< %appdata%\Microsoft\Windows\*.* >

< %systemroot%\system32\WinDir\*.* >

< %systemroot%\_\*.* >

< %systemroot%\system32\windows32\*.* >

< %ProgramFiles%\win\*.* >

< %AppData%\Microsoft\CD Burning\*.* >

< %systemroot%\*.cab >

< %systemroot%\K.Backup\*.* >

< %ProgramFiles%\Massenger\*.* >

< %systemroot%\System32\*.doc >

< %systemroot%\Office12\*.* >

< %systemroot%\System32\Rundl32.exe\*.* >

< %ProgramFiles%\yahoo.net\*.* >

< %systemroot%\system32\*.igo >

< %systemroot%\*.rew >

< %systemroot%\System32\spool\DRIVERS\W32X86\3\*.exe >
[2007/01/26 03:06:00 | 000,116,544 | —- | M] (Brother Industries Ltd.) – C:\Windows\System32\spool\drivers\w32x86\3\brqikmon.exe
[2007/06/27 09:00:00 | 000,352,256 | —- | M] () – C:\Windows\System32\spool\drivers\w32x86\3\ZSHP1600.EXE

< %USERPROFILE%\.COMMgr\*.* >

< %USERPROFILE%\Desktop\*.bat >

< %PROGRAMFILES%\Common Files\Real\visualizations\*.* >
[2008/04/06 15:58:14 | 000,043,008 | —- | M] (RealNetworks, Inc.) – C:\Program Files\Common Files\Real\Visualizations\Annabelle.rpv
[2008/04/06 15:58:14 | 000,080,384 | —- | M] () – C:\Program Files\Common Files\Real\Visualizations\CosmicBelt.rpv
[2008/04/06 15:58:14 | 000,007,168 | —- | M] (RealNetworks, Inc.) – C:\Program Files\Common Files\Real\Visualizations\Fire.rpv
[2008/04/06 15:58:14 | 000,007,680 | —- | M] (RealNetworks, Inc.) – C:\Program Files\Common Files\Real\Visualizations\FreqBands.rpv
[2008/04/06 15:58:14 | 000,069,632 | —- | M] () – C:\Program Files\Common Files\Real\Visualizations\Nebula.rpv

< %PROGRAMFILES%\Internet Explorer\*.Jmp >

< %PROGRAMFILES%\Windows NT\system\*.dll >

< %systemroot%\system32\*.ext >

< %systemroot%\system32\Com\*.cfg >

< %systemroot%\system32\btz\*.* >

< %systemroot%\system32\EMP\*.* >

< %systemroot%\system32\expo\*.* >

< %systemroot%\system32\inet2\*.* >

< %systemroot%\system32\xrem\*.* >

< %ProgramFiles%\Microsoft\*.* >

< %systemroot%\usgwmt\*.* >

< %ProgramFiles%\B\*.* >

< %SYSTEMDRIVE%\lspp\*.* >

< %systemroot%\Kral\*.* >

< %SYSTEMDRIVE%\windowsdvd.exe\*.* >

< %systemroot%\system32\*.ipo >

< %SYSTEMDRIVE%\usxxxxxxxx.exe\*.* >

< %systemroot%\system32\*.mof >

< %systemroot%\*.atm >

< %systemroot%\system32\svhost\*.* >

< %ProgramFiles%\system32\*.* >

< %ProgramFiles%\Docmentt\*.* >

< %systemroot%\Help\*.vbs >

< %ProgramFiles%\Windows WinSxs\*.* /s >

< %ProgramFiles%\Outlook Express\IDT\*.* /s >

< %ProgramFiles%\Microsoft Office\365\*.* /s >

< %ProgramFiles%\Windows Live\*.* >

< %systemroot%\system32\win32\*.* >

< %SYSTEMDRIVE%\RECYCLER\*.* >

< %systemroot%\Fresh1\*.* >

< %ProgramFiles%\Kekj\*.* /s >

< %systemroot%\GDU\*.* >

< %systemroot%\KA\*.* >

< %systemroot%\R\*.* >

< %systemroot%\system32\*.fyo >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-09-16 02:11:15

========== Alternate Data Streams ==========

@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:CB0AACC9
< End of report >

OTL Extras logfile created on: 25/09/2010 20:06:13 - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Users\Kwab\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18943)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 59.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 111.88 Gb Total Space | 19.98 Gb Free Space | 17.86% Space Free | Partition Type: NTFS
Drive D: | 111.00 Gb Total Space | 101.31 Gb Free Space | 91.27% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: KWAB-PC
Current User Name: Kwab
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] – C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04D9EE89-2D85-4321-980A-71EB73C25580}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{C7401F28-DF48-4124-93AD-D591B4FDB418}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{FCE59703-9BD3-4D91-A01B-67CA88A3B172}" = lport=2869 | protocol=6 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05B868ED-E94C-4EF8-ABE1-FE543E010EAF}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{06A9690D-01ED-4F3E-A3C5-B42EE1390468}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{0E97A045-925D-4911-AC88-20F3861B7924}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{0F97A6A5-939E-418B-A267-EA15E29FEB5F}" = protocol=6 | dir=in | app=c:\program files\talktalk\agent\bin\bcont.exe |
"{11086902-77E2-46E9-8A07-8F73BD4D9188}" = protocol=17 | dir=in | app=c:\program files\azureus\azureus.exe |
"{112EFA86-E2EF-44AB-8F9A-88AE467423CA}" = protocol=6 | dir=in | app=c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe |
"{1D446FA6-39F3-4D9B-AFAE-F53463202700}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{2133C7F1-A71A-4D48-9088-678F4134C257}" = protocol=17 | dir=in | app=c:\program files\kontiki\kservice.exe |
"{238F105B-F95C-44DF-9A5F-3D40BAFF90F5}" = protocol=6 | dir=in | app=c:\program files\kontiki\kservice.exe |
"{2F35901F-7CC5-4779-847E-18B48EABAB10}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{3629810E-2BAC-481A-8808-8752E7500A05}" = protocol=6 | dir=in | app=c:\program files\common files\supportsoft\bin\tgsrvc.exe |
"{3B900689-97E9-45D8-B7C7-A8F798B79135}" = protocol=6 | dir=in | app=c:\program files\talktalk\agent\bin\bcont_nm.exe |
"{4218CDF6-B074-426B-B19F-5875DE491639}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{44435216-3E0E-449E-9556-07CDEF48A036}" = protocol=6 | dir=in | app=c:\program files\kontiki\kservice.exe |
"{44859FE5-BF80-4C89-84D3-3813E65F3375}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{5CC75033-716D-46AA-BEB2-12E44B2A5697}" = dir=in | app=c:\program files\cyberlink\powerdvd\powerdvd.exe |
"{64F52585-C846-47CD-8E3A-27B9B7A69803}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |
"{6D1EE68F-E48F-46A4-80AA-D7F4CBA47117}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{6D973598-EB9E-4A09-936B-1CE54B1273DE}" = protocol=17 | dir=in | app=c:\program files\common files\supportsoft\bin\tgsrvc.exe |
"{708F2C0D-DDFD-4EFB-A454-2CB2E8ABCD47}" = protocol=6 | dir=in | app=c:\program files\azureus\azureus.exe |
"{70F76EEF-9E83-4831-86EA-0F69AB6EA35D}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{7BE7CE12-7315-4CA5-8979-4ECBB5780E8D}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe |
"{801D1E39-BD62-48DB-8C19-475C88CB6118}" = protocol=6 | dir=in | app=c:\program files\talktalk\bin\sprtcmd.exe |
"{91CC2A89-6E1D-483F-8B4F-8BF4717324C4}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{A695826F-3A92-42EC-8C8A-2D8B94CC7B12}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{ABFFBDD9-4ADF-4CFE-995C-07043A84A506}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |
"{B0AC003F-CED5-4A74-8229-95D9C8BA37A3}" = dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{C01A7848-502C-4875-A9A0-EE4351FFF203}" = protocol=17 | dir=in | app=c:\program files\mcafee\managed virusscan\agent\myagtsvc.exe |
"{C5C99F84-A759-4195-BA34-4ABAAD852081}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{C6A93F15-3017-45BB-B6C3-A26D2AD207BF}" = protocol=17 | dir=in | app=c:\program files\talktalk\agent\bin\bcont_nm.exe |
"{CDE9BFE1-5071-42D4-A52F-49837D1B0945}" = protocol=17 | dir=in | app=c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe |
"{D31E1101-23E2-4690-9A1E-F1249059927C}" = protocol=17 | dir=in | app=c:\program files\kontiki\kservice.exe |
"{D3E44F00-CF38-4446-8725-1126359B4FDD}" = dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{DD034EA3-B6B4-489C-9510-7DEC80B90133}" = protocol=6 | dir=in | app=c:\program files\mcafee\managed virusscan\agent\myagtsvc.exe |
"{E047066A-7387-437F-8BDC-436464403782}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E8C57B99-5D1E-47F2-A001-B32CFFA10DD2}" = protocol=17 | dir=in | app=c:\program files\talktalk\agent\bin\bcont.exe |
"{EADD1C65-6FA4-4D6C-8100-3EE5B0CE6BBF}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{FD06DEFC-1F92-439F-8E36-EA85A31C7F3D}" = protocol=17 | dir=in | app=c:\program files\talktalk\bin\sprtcmd.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00AF10C1-44BD-4862-9D7F-24E6BA3E87FD}" = imagine digital freedom - Samsung
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution II
"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1E04F83B-2AB9-4301-9EF7-E86307F79C72}" = Google Earth
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = DVD Suite
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{2227E1FA-01F5-483C-AB0E-2A308E900B3D}" = InterVideo FilterSDK for Hauppauge
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216010FF}" = Java™ 6 Update 10
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}" = Samsung Magic Doctor
"{332CC6BF-E6C7-48EE-BA3D-435E576AD67F}" = PaperPort Image Printer
"{36BEAD11-8577-49AD-9250-E06A50AE87B0}" = Microsoft SOAP Toolkit 2.0 SP2
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D5044A5-97B8-45C0-B956-BB2376569188}" = Windows Live Movie Maker
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go 5.0
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4E4F8163-9889-4BAB-B2E7-DBAAE248C1EB}" = LG Android Driver
"{4EA8EA5D-8E46-4698-9BF7-2F2AD8E1C185}" = Easy Network Manager 3.0
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{56B4002F-671C-49F4-984C-C760FE3806B5}" = Microsoft SQL Server VSS Writer
"{593AFFA4-D08E-4272-BABB-420949D32A10}" = QUICKfind
"{5EFCBB42-36AB-4FF9-B90C-E78C7B9EE7B3}" = iTunes
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6F730513-8688-4C3C-90A3-6B9792CE2EF3}" = Easy Battery Manager
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78225D0F-D12C-09E4-5D6D-A64D763E8982}" = BBC iPlayer Desktop
"{804F1285-8CBF-408D-8CDC-D4D40003B2E4}" = PlayCamera
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0015-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90A40409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{955597D8-E5E1-474D-B647-60AC44566D24}" = Play AVStation
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}" = WIDCOMM Bluetooth Software
"{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}" = mDriver
"{A1521775-175C-4C89-860D-337E6619DF61}" = ConnectGoV5Update
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}" = Brother MFL-Pro Suite
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A5F483F0-2D79-4FCA-AE09-D0D96E23EBF7}" = Samsung Update Plus
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{AC76BA86-1033-F400-7760-000000000003}" = Adobe Acrobat 8 Professional - English, Français, Deutsch
"{AC76BA86-7AD7-1033-7B44-A82000000003}" = Adobe Reader 8.2.0
"{AFA20D47-69C3-4030-8DF8-D37466E70F13}" = Apple Mobile Device Support
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B32C4059-6E7A-41EF-AD20-56DF1872B923}" = Business Contact Manager for Outlook 2007 SP2
"{B395BC1D-CC06-425E-9049-4CD985EFF004}" = LightScribe 1.8.15.1
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B6C89654-A6A2-477C-873B-724EC1C56407}" = ScanSoft PaperPort 11
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide
"{BD68F46D-8A82-4664-8E68-F87C55BDEFD4}" = Microsoft SQL Server Native Client
"{C3ABE126-2BB2-4246-BFE1-6797679B3579}" = LG USB Modem Driver
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint 2.0
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{E2AE8456-CCFE-46C0-8629-71CC507660FC}" = LG SP USB Driver
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{EF367AA4-070B-493C-9575-85BE59D789C9}" = Easy SpeedUp Manager
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{FBA0CA60-8BF2-4381-B819-74F020E165A9}" = LG USB WML Modem Driver
"{FDE9FAF8-E1EA-4EBC-A10C-A730F45C7258}" = Eyeball Chat
"AAPassYourTest" = AA Pass Your Test - (Remove only)
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Acrobat 8 Professional - English, Français, Deutsch" = Adobe Acrobat 8.1.3 Professional
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Autorun Eater_is1" = Autorun Eater v2.5
"BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1" = BBC iPlayer Desktop
"Business Contact Manager" = Business Contact Manager for Outlook 2007 SP2
"CCleaner" = CCleaner (remove only)
"Coupon Printer2.0" = Coupon Printer
"DoulosSIL" = DoulosSIL 4.104
"ENTERPRISE" = Microsoft Office Enterprise 2007
"GoToAssist" = GoToAssist Corporate
"Hauppauge WinTV" = Hauppauge WinTV
"Hauppauge WinTV DVB-T EPG Service" = Hauppauge WinTV DVB-T EPG Service
"Hauppauge WinTV Infrared Remote" = Hauppauge WinTV Infrared Remote
"Hauppauge WinTV Scheduler" = Hauppauge WinTV Scheduler
"Hauppauge WinTV TV Services" = Hauppauge WinTV TV Services
"HijackThis" = HijackThis 2.0.2
"InstallShield_{4EA8EA5D-8E46-4698-9BF7-2F2AD8E1C185}" = Easy Network Manager 3.0
"InstallShield_{955597D8-E5E1-474D-B647-60AC44566D24}" = Play AVStation
"InstallShield_{A5F483F0-2D79-4FCA-AE09-D0D96E23EBF7}" = Samsung Update Plus
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"MSC" = McAfee SecurityCenter
"NVIDIA Drivers" = NVIDIA Drivers
"Picasa 3" = Picasa 3
"PROHYBRIDR" = 2007 Microsoft Office system
"ProInst" = Intel® PROSet/Wireless Software
"RealPlayer 6.0" = RealPlayer
"SopCast" = SopCast 2.0.4
"StreamTorrent 1.0" = StreamTorrent 1.0
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Trojan Remover_is1" = Trojan Remover 6.8.2
"TVUPlayer" = TVUPlayer [removed]
"Veetle TV" = Veetle TV 0.9.15
"Veoh Web Player Beta" = Veoh Web Player
"VLC media player" = VideoLAN VLC media player 0.8.6e
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"XPayMPI" = XPayMPI [removed]
"Yahoo! Messenger" = Yahoo! Messenger

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 31/05/2009 11:33:06 | Computer Name = Kwab-PC | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6001.18226, time stamp
0x49ac95d6, faulting module kernel32.dll, version 6.0.6001.18215, time stamp 0x49953395,
exception code 0xe06d7363, fault offset 0x000442eb, process id 0xa2c, application
start time 0x01c9e204f839d23d.

Error - 01/06/2009 19:56:06 | Computer Name = Kwab-PC | Source = Application Hang | ID = 1002
Description = The program YAHOOM~1.EXE version 8.1.0.421 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 133c Start Time: 01c9e30be6bf7430 Termination Time: 57

Error - 02/06/2009 04:05:15 | Computer Name = Kwab-PC | Source = Microsoft Office 12 | ID = 2000
Description = Accepted Safe Mode action : Microsoft Office Outlook.

Error - 02/06/2009 13:41:11 | Computer Name = Kwab-PC | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6001.18226, time stamp
0x49ac95d6, faulting module Flash9f.ocx, version 9.0.124.0, time stamp 0x47e8643e,
exception code 0xc0000005, fault offset 0x00125873, process id 0x1b0c, application
start time 0x01c9e3a588ca8063.

Error - 06/06/2009 16:37:43 | Computer Name = Kwab-PC | Source = Application Error | ID = 1000
Description = Faulting application Acrobat.exe, version 8.1.0.137, time stamp 0x46444c82,
faulting module Acrobat.dll, version 8.1.0.137, time stamp 0x46444932, exception
code 0xc0000409, fault offset 0x00332e82, process id 0x1684, application start time
0x01c9e6e66af29d7e.

Error - 06/06/2009 16:38:19 | Computer Name = Kwab-PC | Source = Application Hang | ID = 1002
Description = The program iexplore.exe version 7.0.6001.18226 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 608 Start Time: 01c9e6d1189882ce Termination Time: 0

Error - 07/06/2009 12:36:11 | Computer Name = Kwab-PC | Source = Application Hang | ID = 1002
Description = The program iexplore.exe version 7.0.6001.18226 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 136c Start Time: 01c9e77fb2f6f36b Termination Time: 131

Error - 07/06/2009 12:43:56 | Computer Name = Kwab-PC | Source = Application Hang | ID = 1002
Description = The program WinRAR.exe version 3.71.0.0 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Problem Reports and Solutions control panel. Process
ID: 1c90 Start Time: 01c9e78f0d33b2ab Termination Time: 16

Error - 09/06/2009 13:03:54 | Computer Name = Kwab-PC | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6001.18226, time stamp
0x49ac95d6, faulting module Flash9f.ocx, version 9.0.124.0, time stamp 0x47e8643e,
exception code 0xc0000005, fault offset 0x002381c3, process id 0x1198, application
start time 0x01c9e90d1d583025.

Error - 14/06/2009 20:13:52 | Computer Name = Kwab-PC | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6001.18248, time stamp
0x49f1c24f, faulting module Flash9f.ocx, version 9.0.124.0, time stamp 0x47e8643e,
exception code 0xc0000005, fault offset 0x00096a4b, process id 0x17a0, application
start time 0x01c9ed47a3ec88bc.

[ Media Center Events ]
Error - 18/04/2008 18:40:59 | Computer Name = Kwab-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight.

[ OSession Events ]
Error - 27/03/2008 13:42:44 | Computer Name = Kwab-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 879
seconds with 420 seconds of active time. This session ended with a crash.

Error - 20/12/2008 10:49:30 | Computer Name = Kwab-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6316.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 799
seconds with 300 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 23/09/2010 17:00:35 | Computer Name = Kwab-PC | Source = DCOM | ID = 10016
Description =

Error - 23/09/2010 17:48:23 | Computer Name = Kwab-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 23/09/2010 17:49:18 | Computer Name = Kwab-PC | Source = DCOM | ID = 10016
Description =

Error - 24/09/2010 12:07:33 | Computer Name = Kwab-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 24/09/2010 12:08:41 | Computer Name = Kwab-PC | Source = DCOM | ID = 10016
Description =

Error - 24/09/2010 12:44:52 | Computer Name = Kwab-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 24/09/2010 12:45:54 | Computer Name = Kwab-PC | Source = DCOM | ID = 10016
Description =

Error - 24/09/2010 20:32:36 | Computer Name = Kwab-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 24/09/2010 20:33:40 | Computer Name = Kwab-PC | Source = DCOM | ID = 10016
Description =

Error - 25/09/2010 05:28:56 | Computer Name = Kwab-PC | Source = bowser | ID = 8003
Description =

< End of report >

boggler

Post #7September 26, 2010, 5:07 PM UTC

THis is what I managed to copy from GMER before it crashed:

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-09-25 23:38:52
Windows 6.0.6002 Service Pack 2
Running: gmer.exe; Driver: C:\Users\Kwab\AppData\Local\Temp\kxldqpog.sys

—- System - GMER 1.0.15 —-

Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwMapViewOfSection [0x88442068]
Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwTerminateProcess [0x88442092]
Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0x8844207E]
Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwYieldExecution [0x88442054]
Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtMapViewOfSection

—- Kernel code sections - GMER 1.0.15 —-

.text ntoskrnl.exe!ZwYieldExecution 82875C0E 5 Bytes JMP 88442058 \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwUnmapViewOfSection 82A4C510 5 Bytes JMP 88442082 \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtMapViewOfSection 82A4C899 7 Bytes JMP 8844206C \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwTerminateProcess 82A5C04F 5 Bytes JMP 88442096 \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
.text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x8D40A360, 0x35BDD2, 0xE8000020]

—- User code sections - GMER 1.0.15 —-

.text C:\Windows\system32\svchost.exe[380] ntdll.dll!NtCreateFile 77B943D4 5 Bytes JMP 000A0000
.text C:\Windows\system32\svchost.exe[380] ntdll.dll!NtCreateProcess 77B94494 5 Bytes JMP 000A0FE5
.text C:\Windows\system32\svchost.exe[380] ntdll.dll!NtProtectVirtualMemory 77B94D34 5 Bytes JMP 000A001B
.text C:\Windows\system32\svchost.exe[380] kernel32.dll!GetStartupInfoW 77611929 5 Bytes JMP 00090F43
.text C:\Windows\system32\svchost.exe[380] kernel32.dll!GetStartupInfoA 776119C9 5 Bytes JMP 00090F5E
.text C:\Windows\system32\svchost.exe[380] kernel32.dll!CreateProcessW 77611BF3 5 Bytes JMP 00090F06
.text C:\Windows\system32\svchost.exe[380] kernel32.dll!CreateProcessA 77611C28 5 Bytes JMP 00090F17
.text C:\Windows\system32\svchost.exe[380] kernel32.dll!VirtualProtect 77611DC3 5 Bytes JMP 00090F94
.text C:\Windows\system32\svchost.exe[380] kernel32.dll!CreateNamedPipeA 77612EF5 5 Bytes JMP 00090000
.text C:\Windows\system32\svchost.exe[380] kernel32.dll!CreateNamedPipeW 77615C0C 5 Bytes JMP 00090011
.text C:\Windows\system32\svchost.exe[380] kernel32.dll!CreatePipe 77638E6E 5 Bytes JMP 00090F6F
.text C:\Windows\system32\svchost.exe[380] kernel32.dll!LoadLibraryExW 77639109 5 Bytes JMP 00090062
.text C:\Windows\system32\svchost.exe[380] kernel32.dll!LoadLibraryW 77639362 5 Bytes JMP 0009003D
.text C:\Windows\system32\svchost.exe[380] kernel32.dll!LoadLibraryExA 776394B4 5 Bytes JMP 00090FA5
.text C:\Windows\system32\svchost.exe[380] kernel32.dll!LoadLibraryA 776394DC 5 Bytes JMP 0009002C
.text C:\Windows\system32\svchost.exe[380] kernel32.dll!VirtualProtectEx 7763DBDA 5 Bytes JMP 00090089
.text C:\Windows\system32\svchost.exe[380] kernel32.dll!GetProcAddress 7765903B 5 Bytes JMP 00090EEB
.text C:\Windows\system32\svchost.exe[380] kernel32.dll!CreateFileW 7765AECB 5 Bytes JMP 00090FCA
.text C:\Windows\system32\svchost.exe[380] kernel32.dll!CreateFileA 7765CE5F 5 Bytes JMP 00090FEF
.text C:\Windows\system32\svchost.exe[380] kernel32.dll!WinExec 776A5CF7 5 Bytes JMP 00090F28
.text C:\Windows\system32\svchost.exe[380] msvcrt.dll!_wsystem 767E7F2F 5 Bytes JMP 000B0F7A
.text C:\Windows\system32\svchost.exe[380] msvcrt.dll!system 767E804B 5 Bytes JMP 000B0F9F
.text C:\Windows\system32\svchost.exe[380] msvcrt.dll!_creat 767EBBE1 5 Bytes JMP 000B0FC1
.text C:\Windows\system32\svchost.exe[380] msvcrt.dll!_open 767ED106 5 Bytes JMP 000B0FE3
.text C:\Windows\system32\svchost.exe[380] msvcrt.dll!_wcreat 767ED326 5 Bytes JMP 000B0FB0
.text C:\Windows\system32\svchost.exe[380] msvcrt.dll!_wopen 767ED501 5 Bytes JMP 000B0FD2
.text C:\Windows\system32\svchost.exe[380] ADVAPI32.dll!RegCreateKeyExA 773739AB 5 Bytes JMP 000C0F8D
.text C:\Windows\system32\svchost.exe[380] ADVAPI32.dll!RegCreateKeyA 77373BA9 5 Bytes JMP 000C001E
.text C:\Windows\system32\svchost.exe[380] ADVAPI32.dll!RegOpenKeyA 773789C7 5 Bytes JMP 000C0FEF
.text C:\Windows\system32\svchost.exe[380] ADVAPI32.dll!RegCreateKeyW 7738391E 5 Bytes JMP 000C002F
.text C:\Windows\system32\svchost.exe[380] ADVAPI32.dll!RegCreateKeyExW 773841F1 5 Bytes JMP 000C0F72
.text C:\Windows\system32\svchost.exe[380] ADVAPI32.dll!RegOpenKeyExA 77387C42 5 Bytes JMP 000C0FC3
.text C:\Windows\system32\svchost.exe[380] ADVAPI32.dll!RegOpenKeyW 7738E2B5 5 Bytes JMP 000C0FDE
.text C:\Windows\system32\svchost.exe[380] ADVAPI32.dll!RegOpenKeyExW 77397BA1 5 Bytes JMP 000C0FB2
.text C:\Windows\system32\svchost.exe[380] WS2_32.dll!socket 775E36D1 5 Bytes JMP 001E0000
.text C:\Windows\system32\svchost.exe[392] ntdll.dll!NtCreateFile 77B943D4 5 Bytes JMP 00720000
.text C:\Windows\system32\svchost.exe[392] ntdll.dll!NtCreateProcess 77B94494 5 Bytes JMP 00720022
.text C:\Windows\system32\svchost.exe[392] ntdll.dll!NtProtectVirtualMemory 77B94D34 5 Bytes JMP 00720011
.text C:\Windows\system32\svchost.exe[392] kernel32.dll!GetStartupInfoW 77611929 5 Bytes JMP 00150F5C
.text C:\Windows\system32\svchost.exe[392] kernel32.dll!GetStartupInfoA 776119C9 5 Bytes JMP 001500A2
.text C:\Windows\system32\svchost.exe[392] kernel32.dll!CreateProcessW 77611BF3 5 Bytes JMP 00150F15
.text C:\Windows\system32\svchost.exe[392] kernel32.dll!CreateProcessA 77611C28 5 Bytes JMP 00150F30
.text C:\Windows\system32\svchost.exe[392] kernel32.dll!VirtualProtect 77611DC3 5 Bytes JMP 00150065
.text C:\Windows\system32\svchost.exe[392] kernel32.dll!CreateNamedPipeA 77612EF5 5 Bytes JMP 00150FCD
.text C:\Windows\system32\svchost.exe[392] kernel32.dll!CreateNamedPipeW 77615C0C 5 Bytes JMP 0015001E
.text C:\Windows\system32\svchost.exe[392] kernel32.dll!CreatePipe 77638E6E 5 Bytes JMP 00150091
.text C:\Windows\system32\svchost.exe[392] kernel32.dll!LoadLibraryExW 77639109 5 Bytes JMP 00150F97
.text C:\Windows\system32\svchost.exe[392] kernel32.dll!LoadLibraryW 77639362 5 Bytes JMP 00150FA8
.text C:\Windows\system32\svchost.exe[392] kernel32.dll!LoadLibraryExA 776394B4 5 Bytes JMP 0015004A
.text C:\Windows\system32\svchost.exe[392] kernel32.dll!LoadLibraryA 776394DC 5 Bytes JMP 0015002F
.text C:\Windows\system32\svchost.exe[392] kernel32.dll!VirtualProtectEx 7763DBDA 5 Bytes JMP 00150076
.text C:\Windows\system32\svchost.exe[392] kernel32.dll!GetProcAddress 7765903B 5 Bytes JMP 00150F04
.text C:\Windows\system32\svchost.exe[392] kernel32.dll!CreateFileW 7765AECB 5 Bytes JMP 00150FDE
.text C:\Windows\system32\svchost.exe[392] kernel32.dll!CreateFileA 7765CE5F 5 Bytes JMP 00150FEF
.text C:\Windows\system32\svchost.exe[392] kernel32.dll!WinExec 776A5CF7 5 Bytes JMP 00150F41
.text C:\Windows\system32\svchost.exe[392] msvcrt.dll!_wsystem 767E7F2F 5 Bytes JMP 00740FB2
.text C:\Windows\system32\svchost.exe[392] msvcrt.dll!system 767E804B 5 Bytes JMP 00740FCD
.text C:\Windows\system32\svchost.exe[392] msvcrt.dll!_creat 767EBBE1 5 Bytes JMP 00740033
.text C:\Windows\system32\svchost.exe[392] msvcrt.dll!_open 767ED106 5 Bytes JMP 0074000C
.text C:\Windows\system32\svchost.exe[392] msvcrt.dll!_wcreat 767ED326 5 Bytes JMP 00740FDE
.text C:\Windows\system32\svchost.exe[392] msvcrt.dll!_wopen 767ED501 5 Bytes JMP 00740FEF
.text C:\Windows\system32\svchost.exe[392] ADVAPI32.dll!RegCreateKeyExA 773739AB 5 Bytes JMP 00C20F72
.text C:\Windows\system32\svchost.exe[392] ADVAPI32.dll!RegCreateKeyA 77373BA9 5 Bytes JMP 00C20014
.text C:\Windows\system32\svchost.exe[392] ADVAPI32.dll!RegOpenKeyA 773789C7 5 Bytes JMP 00C20FEF
.text C:\Windows\system32\svchost.exe[392] ADVAPI32.dll!RegCreateKeyW 7738391E 5 Bytes JMP 00C20F83
.text C:\Windows\system32\svchost.exe[392] ADVAPI32.dll!RegCreateKeyExW 773841F1 5 Bytes JMP 00C20F61
.text C:\Windows\system32\svchost.exe[392] ADVAPI32.dll!RegOpenKeyExA 77387C42 5 Bytes JMP 00C20FCD
.text C:\Windows\system32\svchost.exe[392] ADVAPI32.dll!RegOpenKeyW 7738E2B5 5 Bytes JMP 00C20FDE
.text C:\Windows\system32\svchost.exe[392] ADVAPI32.dll!RegOpenKeyExW 77397BA1 5 Bytes JMP 00C20FA8
.text C:\Windows\system32\svchost.exe[392] WS2_32.dll!socket 775E36D1 5 Bytes JMP 00C30FEF
.text C:\Windows\system32\services.exe[744] ntdll.dll!NtCreateFile 77B943D4 5 Bytes JMP 0045000A
.text C:\Windows\system32\services.exe[744] ntdll.dll!NtCreateProcess 77B94494 5 Bytes JMP 00450FD4
.text C:\Windows\system32\services.exe[744] ntdll.dll!NtProtectVirtualMemory 77B94D34 5 Bytes JMP 00450FEF
.text C:\Windows\system32\services.exe[744] kernel32.dll!GetStartupInfoW 77611929 5 Bytes JMP 00D300CE
.text C:\Windows\system32\services.exe[744] kernel32.dll!GetStartupInfoA 776119C9 5 Bytes JMP 00D300B3
.text C:\Windows\system32\services.exe[744] kernel32.dll!CreateProcessW 77611BF3 5 Bytes JMP 00D30104
.text C:\Windows\system32\services.exe[744] kernel32.dll!CreateProcessA 77611C28 5 Bytes JMP 00D300F3
.text C:\Windows\system32\services.exe[744] kernel32.dll!VirtualProtect 77611DC3 5 Bytes JMP 00D3008E
.text C:\Windows\system32\services.exe[744] kernel32.dll!CreateNamedPipeA 77612EF5 5 Bytes JMP 00D30022
.text C:\Windows\system32\services.exe[744] kernel32.dll!CreateNamedPipeW 77615C0C 5 Bytes JMP 00D30FDB
.text C:\Windows\system32\services.exe[744] kernel32.dll!CreatePipe 77638E6E 5 Bytes JMP 00D30F7E
.text C:\Windows\system32\services.exe[744] kernel32.dll!LoadLibraryExW 77639109 5 Bytes JMP 00D30FB6
.text C:\Windows\system32\services.exe[744] kernel32.dll!LoadLibraryW 77639362 5 Bytes JMP 00D30058
.text C:\Windows\system32\services.exe[744] kernel32.dll!LoadLibraryExA 776394B4 5 Bytes JMP 00D30069
.text C:\Windows\system32\services.exe[744] kernel32.dll!LoadLibraryA 776394DC 5 Bytes JMP 00D30047
.text C:\Windows\system32\services.exe[744] kernel32.dll!VirtualProtectEx 7763DBDA 5 Bytes JMP 00D30F99
.text C:\Windows\system32\services.exe[744] kernel32.dll!GetProcAddress 7765903B 5 Bytes JMP 00D30115
.text C:\Windows\system32\services.exe[744] kernel32.dll!CreateFileW 7765AECB 5 Bytes JMP 00D30011
.text C:\Windows\system32\services.exe[744] kernel32.dll!CreateFileA 7765CE5F 5 Bytes JMP 00D30000
.text C:\Windows\system32\services.exe[744] kernel32.dll!WinExec 776A5CF7 5 Bytes JMP 00D30F6D
.text C:\Windows\system32\services.exe[744] ADVAPI32.dll!RegCreateKeyExA 773739AB 5 Bytes JMP 0098005B
.text C:\Windows\system32\services.exe[744] ADVAPI32.dll!RegCreateKeyA 77373BA9 5 Bytes JMP 00980040
.text C:\Windows\system32\services.exe[744] ADVAPI32.dll!RegOpenKeyA 773789C7 5 Bytes JMP 00980FEF
.text C:\Windows\system32\services.exe[744] ADVAPI32.dll!RegCreateKeyW 7738391E 5 Bytes JMP 00980FC3
.text C:\Windows\system32\services.exe[744] ADVAPI32.dll!RegCreateKeyExW 773841F1 5 Bytes JMP 00980080
.text C:\Windows\system32\services.exe[744] ADVAPI32.dll!RegOpenKeyExA 77387C42 5 Bytes JMP 00980014
.text C:\Windows\system32\services.exe[744] ADVAPI32.dll!RegOpenKeyW 7738E2B5 5 Bytes JMP 00980FDE
.text C:\Windows\system32\services.exe[744] ADVAPI32.dll!RegOpenKeyExW 77397BA1 5 Bytes JMP 00980025
.text C:\Windows\system32\services.exe[744] msvcrt.dll!_wsystem 767E7F2F 5 Bytes JMP 00460069
.text C:\Windows\system32\services.exe[744] msvcrt.dll!system 767E804B 5 Bytes JMP 0046004E
.text C:\Windows\system32\services.exe[744] msvcrt.dll!_creat 767EBBE1 5 Bytes JMP 00460FEF
.text C:\Windows\system32\services.exe[744] msvcrt.dll!_open 767ED106 5 Bytes JMP 0046000C
.text C:\Windows\system32\services.exe[744] msvcrt.dll!_wcreat 767ED326 5 Bytes JMP 00460FDE
.text C:\Windows\system32\services.exe[744] msvcrt.dll!_wopen 767ED501 5 Bytes JMP 00460029
.text C:\Windows\system32\services.exe[744] WS2_32.dll!socket 775E36D1 5 Bytes JMP 00990FEF
.text C:\Windows\system32\lsass.exe[776] ntdll.dll!NtCreateFile 77B943D4 5 Bytes JMP 0022000A
.text C:\Windows\system32\lsass.exe[776] ntdll.dll!NtCreateProcess 77B94494 5 Bytes JMP 00220036
.text C:\Windows\system32\lsass.exe[776] ntdll.dll!NtProtectVirtualMemory 77B94D34 5 Bytes JMP 00220025
.text C:\Windows\system32\lsass.exe[776] kernel32.dll!GetStartupInfoW 77611929 5 Bytes JMP 00510F2F
.text C:\Windows\system32\lsass.exe[776] kernel32.dll!GetStartupInfoA 776119C9 5 Bytes JMP 00510F40
.text C:\Windows\system32\lsass.exe[776] kernel32.dll!CreateProcessW 77611BF3 5 Bytes JMP 0051009A
.text C:\Windows\system32\lsass.exe[776] kernel32.dll!CreateProcessA 77611C28 5 Bytes JMP 00510F03
.text C:\Windows\system32\lsass.exe[776] kernel32.dll!VirtualProtect 77611DC3 5 Bytes JMP 00510064
.text C:\Windows\system32\lsass.exe[776] kernel32.dll!CreateNamedPipeA 77612EF5 5 Bytes JMP 00510FD1
.text C:\Windows\system32\lsass.exe[776] kernel32.dll!CreateNamedPipeW 77615C0C 5 Bytes JMP 00510022
.text C:\Windows\system32\lsass.exe[776] kernel32.dll!CreatePipe 77638E6E 5 Bytes JMP 00510F65
.text C:\Windows\system32\lsass.exe[776] kernel32.dll!LoadLibraryExW 77639109 5 Bytes JMP 00510F8A
.text C:\Windows\system32\lsass.exe[776] kernel32.dll!LoadLibraryW 77639362 5 Bytes JMP 00510F9B
.text C:\Windows\system32\lsass.exe[776] kernel32.dll!LoadLibraryExA 776394B4 5 Bytes JMP 0051003D
.text C:\Windows\system32\lsass.exe[776] kernel32.dll!LoadLibraryA 776394DC 5 Bytes JMP 00510FB6
.text C:\Windows\system32\lsass.exe[776] kernel32.dll!VirtualProtectEx 7763DBDA 5 Bytes JMP 00510075
.text C:\Windows\system32\lsass.exe[776] kernel32.dll!GetProcAddress 7765903B 5 Bytes JMP 005100AB
.text C:\Windows\system32\lsass.exe[776] kernel32.dll!CreateFileW 7765AECB 5 Bytes JMP 00510011
.text C:\Windows\system32\lsass.exe[776] kernel32.dll!CreateFileA 7765CE5F 5 Bytes JMP 00510000
.text C:\Windows\system32\lsass.exe[776] kernel32.dll!WinExec 776A5CF7 5 Bytes JMP 00510F1E
.text C:\Windows\system32\lsass.exe[776] ADVAPI32.dll!RegCreateKeyExA 773739AB 5 Bytes JMP 00240FC3
.text C:\Windows\system32\lsass.exe[776] ADVAPI32.dll!RegCreateKeyA 77373BA9 5 Bytes JMP 0024005B
.text C:\Windows\system32\lsass.exe[776] ADVAPI32.dll!RegOpenKeyA 773789C7 5 Bytes JMP 00240000
.text C:\Windows\system32\lsass.exe[776] ADVAPI32.dll!RegCreateKeyW 7738391E 5 Bytes JMP 00240FD4
.text C:\Windows\system32\lsass.exe[776] ADVAPI32.dll!RegCreateKeyExW 773841F1 5 Bytes JMP 00240080
.text C:\Windows\system32\lsass.exe[776] ADVAPI32.dll!RegOpenKeyExA 77387C42 5 Bytes JMP 00240025
.text C:\Windows\system32\lsass.exe[776] ADVAPI32.dll!RegOpenKeyW 7738E2B5 5 Bytes JMP 00240FEF
.text C:\Windows\system32\lsass.exe[776] ADVAPI32.dll!RegOpenKeyExW 77397BA1 5 Bytes JMP 0024004A
.text C:\Windows\system32\lsass.exe[776] msvcrt.dll!_wsystem 767E7F2F 5 Bytes JMP 00230042
.text C:\Windows\system32\lsass.exe[776] msvcrt.dll!system 767E804B 5 Bytes JMP 00230031
.text C:\Windows\system32\lsass.exe[776] msvcrt.dll!_creat 767EBBE1 5 Bytes JMP 00230FD2
.text C:\Windows\system32\lsass.exe[776] msvcrt.dll!_open 767ED106 5 Bytes JMP 00230000
.text C:\Windows\system32\lsass.exe[776] msvcrt.dll!_wcreat 767ED326 5 Bytes JMP 00230FC1
.text C:\Windows\system32\lsass.exe[776] msvcrt.dll!_wopen 767ED501 5 Bytes JMP 00230FE3
.text C:\Windows\system32\lsass.exe[776] WS2_32.dll!socket 775E36D1 5 Bytes JMP 004C0FE5
.text C:\Windows\system32\svchost.exe[960] ntdll.dll!NtCreateFile 77B943D4 5 Bytes JMP 0077000A
.text C:\Windows\system32\svchost.exe[960] ntdll.dll!NtCreateProcess 77B94494 5 Bytes JMP 00770025
.text C:\Windows\system32\svchost.exe[960] ntdll.dll!NtProtectVirtualMemory 77B94D34 5 Bytes JMP 00770FEF
.text C:\Windows\system32\svchost.exe[960] kernel32.dll!GetStartupInfoW 77611929 5 Bytes JMP 008300A2
.text C:\Windows\system32\svchost.exe[960] kernel32.dll!GetStartupInfoA 776119C9 5 Bytes JMP 00830F5C
.text C:\Windows\system32\svchost.exe[960] kernel32.dll!CreateProcessW 77611BF3 5 Bytes JMP 00830F26
.text C:\Windows\system32\svchost.exe[960] kernel32.dll!CreateProcessA 77611C28 5 Bytes JMP 00830F37
.text C:\Windows\system32\svchost.exe[960] kernel32.dll!VirtualProtect 77611DC3 5 Bytes JMP 0083006C
.text C:\Windows\system32\svchost.exe[960] kernel32.dll!CreateNamedPipeA 77612EF5 5 Bytes JMP 00830FDB
.text C:\Windows\system32\svchost.exe[960] kernel32.dll!CreateNamedPipeW 77615C0C 5 Bytes JMP 00830036
.text C:\Windows\system32\svchost.exe[960] kernel32.dll!CreatePipe 77638E6E 5 Bytes JMP 00830F6D
.text C:\Windows\system32\svchost.exe[960] kernel32.dll!LoadLibraryExW 77639109 5 Bytes JMP 0083005B
.text C:\Windows\system32\svchost.exe[960] kernel32.dll!LoadLibraryW 77639362 5 Bytes JMP 00830FB9
.text C:\Windows\system32\svchost.exe[960] kernel32.dll!LoadLibraryExA 776394B4 5 Bytes JMP 00830F9E
.text C:\Windows\system32\svchost.exe[960] kernel32.dll!LoadLibraryA 776394DC 5 Bytes JMP 00830FCA
.text C:\Windows\system32\svchost.exe[960] kernel32.dll!VirtualProtectEx 7763DBDA 5 Bytes JMP 0083007D
.text C:\Windows\system32\svchost.exe[960] kernel32.dll!GetProcAddress 7765903B 5 Bytes JMP 00830F0B
.text C:\Windows\system32\svchost.exe[960] kernel32.dll!CreateFileW 7765AECB 5 Bytes JMP 00830011
.text C:\Windows\system32\svchost.exe[960] kernel32.dll!CreateFileA 7765CE5F 5 Bytes JMP 00830000
.text C:\Windows\system32\svchost.exe[960] kernel32.dll!WinExec 776A5CF7 5 Bytes JMP 008300B3
.text C:\Windows\system32\svchost.exe[960] msvcrt.dll!_wsystem 767E7F2F 5 Bytes JMP 00780FBC
.text C:\Windows\system32\svchost.exe[960] msvcrt.dll!system 767E804B 5 Bytes JMP 00780FCD
.text C:\Windows\system32\svchost.exe[960] msvcrt.dll!_creat 767EBBE1 5 Bytes JMP 00780022
.text C:\Windows\system32\svchost.exe[960] msvcrt.dll!_open 767ED106 5 Bytes JMP 00780000
.text C:\Windows\system32\svchost.exe[960] msvcrt.dll!_wcreat 767ED326 5 Bytes JMP 0078003D
.text C:\Windows\system32\svchost.exe[960] msvcrt.dll!_wopen 767ED501 5 Bytes JMP 00780011
.text C:\Windows\system32\svchost.exe[960] ADVAPI32.dll!RegCreateKeyExA 773739AB 5 Bytes JMP 0079005B
.text C:\Windows\system32\svchost.exe[960] ADVAPI32.dll!RegCreateKeyA 77373BA9 5 Bytes JMP 00790FD4
.text C:\Windows\system32\svchost.exe[960] ADVAPI32.dll!RegOpenKeyA 773789C7 5 Bytes JMP 00790000
.text C:\Windows\system32\svchost.exe[960] ADVAPI32.dll!RegCreateKeyW 7738391E 5 Bytes JMP 00790FC3
.text C:\Windows\system32\svchost.exe[960] ADVAPI32.dll!RegCreateKeyExW 773841F1 5 Bytes JMP 00790F9E
.text C:\Windows\system32\svchost.exe[960] ADVAPI32.dll!RegOpenKeyExA 77387C42 5 Bytes JMP 00790036
.text C:\Windows\system32\svchost.exe[960] ADVAPI32.dll!RegOpenKeyW 7738E2B5 5 Bytes JMP 0079001B
.text C:\Windows\system32\svchost.exe[960] ADVAPI32.dll!RegOpenKeyExW 77397BA1 5 Bytes JMP 00790FE5
.text C:\Windows\system32\svchost.exe[960] WS2_32.dll!socket 775E36D1 5 Bytes JMP 007A0FE5
.text C:\Windows\system32\svchost.exe[1020] ntdll.dll!NtCreateFile 77B943D4 5 Bytes JMP 002A0000
.text C:\Windows\system32\svchost.exe[1020] ntdll.dll!NtCreateProcess 77B94494 5 Bytes JMP 002A0FE5
.text C:\Windows\system32\svchost.exe[1020] ntdll.dll!NtProtectVirtualMemory 77B94D34 5 Bytes JMP 002A0011
.text C:\Windows\system32\svchost.exe[1020] kernel32.dll!GetStartupInfoW 77611929 5 Bytes JMP 002E0F83
.text C:\Windows\system32\svchost.exe[1020] kernel32.dll!GetStartupInfoA 776119C9 5 Bytes JMP 002E0F9E
.text C:\Windows\system32\svchost.exe[1020] kernel32.dll!CreateProcessW 77611BF3 5 Bytes JMP 002E0F43
.text C:\Windows\system32\svchost.exe[1020] kernel32.dll!CreateProcessA 77611C28 5 Bytes JMP 002E0F68
.text C:\Windows\system32\svchost.exe[1020] kernel32.dll!VirtualProtect 77611DC3 5 Bytes JMP 002E00A7
.text C:\Windows\system32\svchost.exe[1020] kernel32.dll!CreateNamedPipeA 77612EF5 5 Bytes JMP 002E0036
.text C:\Windows\system32\svchost.exe[1020] kernel32.dll!CreateNamedPipeW 77615C0C 5 Bytes JMP 002E0FE5
.text C:\Windows\system32\svchost.exe[1020] kernel32.dll!CreatePipe 77638E6E 5 Bytes JMP 002E00C9
.text C:\Windows\system32\svchost.exe[1020] kernel32.dll!LoadLibraryExW 77639109 5 Bytes JMP 002E008C
.text C:\Windows\system32\svchost.exe[1020] kernel32.dll!LoadLibraryW 77639362 5 Bytes JMP 002E0FD4
.text C:\Windows\system32\svchost.exe[1020] kernel32.dll!LoadLibraryExA 776394B4 5 Bytes JMP 002E0FC3
.text C:\Windows\system32\svchost.exe[1020] kernel32.dll!LoadLibraryA 776394DC 5 Bytes JMP 002E0051
.text C:\Windows\system32\svchost.exe[1020] kernel32.dll!VirtualProtectEx 7763DBDA 5 Bytes JMP 002E00B8
.text C:\Windows\system32\svchost.exe[1020] kernel32.dll!GetProcAddress 7765903B 5 Bytes JMP 002E0F32
.text C:\Windows\system32\svchost.exe[1020] kernel32.dll!CreateFileW 7765AECB 5 Bytes JMP 002E0025
.text C:\Windows\system32\svchost.exe[1020] kernel32.dll!CreateFileA 7765CE5F 5 Bytes JMP 002E000A
.text C:\Windows\system32\svchost.exe[1020] kernel32.dll!WinExec 776A5CF7 5 Bytes JMP 002E00DA
.text C:\Windows\system32\svchost.exe[1020] msvcrt.dll!_wsystem 767E7F2F 5 Bytes JMP 002B0027
.text C:\Windows\system32\svchost.exe[1020] msvcrt.dll!system 767E804B 5 Bytes JMP 002B0FA6
.text C:\Windows\system32\svchost.exe[1020] msvcrt.dll!_creat 767EBBE1 5 Bytes JMP 002B0FD2
.text C:\Windows\system32\svchost.exe[1020] msvcrt.dll!_open 767ED106 5 Bytes JMP 002B0000
.text C:\Windows\system32\svchost.exe[1020] msvcrt.dll!_wcreat 767ED326 5 Bytes JMP 002B0FC1
.text C:\Windows\system32\svchost.exe[1020] msvcrt.dll!_wopen 767ED501 5 Bytes JMP 002B0FE3
.text C:\Windows\system32\svchost.exe[1020] ADVAPI32.dll!RegCreateKeyExA 773739AB 5 Bytes JMP 002C0F94
.text C:\Windows\system32\svchost.exe[1020] ADVAPI32.dll!RegCreateKeyA 77373BA9 5 Bytes JMP 002C002C
.text C:\Windows\system32\svchost.exe[1020] ADVAPI32.dll!RegOpenKeyA 773789C7 5 Bytes JMP 002C0FEF
.text C:\Windows\system32\svchost.exe[1020] ADVAPI32.dll!RegCreateKeyW 7738391E 5 Bytes JMP 002C0FA5
.text C:\Windows\system32\svchost.exe[1020] ADVAPI32.dll!RegCreateKeyExW 773841F1 5 Bytes JMP 002C0F79
.text C:\Windows\system32\svchost.exe[1020] ADVAPI32.dll!RegOpenKeyExA 77387C42 5 Bytes JMP 002C0FD4
.text C:\Windows\system32\svchost.exe[1020] ADVAPI32.dll!RegOpenKeyW 7738E2B5 5 Bytes JMP 002C0000
.text C:\Windows\system32\svchost.exe[1020] ADVAPI32.dll!RegOpenKeyExW 77397BA1 5 Bytes JMP 002C001B
.text C:\Windows\system32\svchost.exe[1020] WS2_32.dll!socket 775E36D1 5 Bytes JMP 002D0000
.text C:\Windows\System32\svchost.exe[1156] ntdll.dll!NtCreateFile 77B943D4 5 Bytes JMP 00E90FEF
.text C:\Windows\System32\svchost.exe[1156] ntdll.dll!NtCreateProcess 77B94494 5 Bytes JMP 00E90FDE
.text C:\Windows\System32\svchost.exe[1156] ntdll.dll!NtProtectVirtualMemory 77B94D34 5 Bytes JMP 00E9000A
.text C:\Windows\System32\svchost.exe[1156] kernel32.dll!GetStartupInfoW 77611929 5 Bytes JMP 00E800B3
.text C:\Windows\System32\svchost.exe[1156] kernel32.dll!GetStartupInfoA 776119C9 5 Bytes JMP 00E80F6D
.text C:\Windows\System32\svchost.exe[1156] kernel32.dll!CreateProcessW 77611BF3 5 Bytes JMP 00E80F3E
.text C:\Windows\System32\svchost.exe[1156] kernel32.dll!CreateProcessA 77611C28 5 Bytes JMP 00E800D5
.text C:\Windows\System32\svchost.exe[1156] kernel32.dll!VirtualProtect 77611DC3 5 Bytes JMP 00E80FB4
.text C:\Windows\System32\svchost.exe[1156] kernel32.dll!CreateNamedPipeA 77612EF5 5 Bytes JMP 00E80011
.text C:\Windows\System32\svchost.exe[1156] kernel32.dll!CreateNamedPipeW 77615C0C 5 Bytes JMP 00E80022
.text C:\Windows\System32\svchost.exe[1156] kernel32.dll!CreatePipe 77638E6E 5 Bytes JMP 00E80F7E
.text C:\Windows\System32\svchost.exe[1156] kernel32.dll!LoadLibraryExW 77639109 5 Bytes JMP 00E8008E
.text C:\Windows\System32\svchost.exe[1156] kernel32.dll!LoadLibraryW 77639362 5 Bytes JMP 00E80062
.text C:\Windows\System32\svchost.exe[1156] kernel32.dll!LoadLibraryExA 776394B4 5 Bytes JMP 00E80073
.text C:\Windows\System32\svchost.exe[1156] kernel32.dll!LoadLibraryA 776394DC 5 Bytes JMP 00E80047
.text C:\Windows\System32\svchost.exe[1156] kernel32.dll!VirtualProtectEx 7763DBDA 5 Bytes JMP 00E80FA3
.text C:\Windows\System32\svchost.exe[1156] kernel32.dll!GetProcAddress 7765903B 5 Bytes JMP 00E800F0
.text C:\Windows\System32\svchost.exe[1156] kernel32.dll!CreateFileW 7765AECB 5 Bytes JMP 00E80FDB
.text C:\Windows\System32\svchost.exe[1156] kernel32.dll!CreateFileA 7765CE5F 5 Bytes JMP 00E80000
.text C:\Windows\System32\svchost.exe[1156] kernel32.dll!WinExec 776A5CF7 5 Bytes JMP 00E800C4
.text C:\Windows\System32\svchost.exe[1156] msvcrt.dll!_wsystem 767E7F2F 5 Bytes JMP 00F20036
.text C:\Windows\System32\svchost.exe[1156] msvcrt.dll!system 767E804B 5 Bytes JMP 00F20025
.text C:\Windows\System32\svchost.exe[1156] msvcrt.dll!_creat 767EBBE1 5 Bytes JMP 00F20FC6
.text C:\Windows\System32\svchost.exe[1156] msvcrt.dll!_open 767ED106 5 Bytes JMP 00F20000
.text C:\Windows\System32\svchost.exe[1156] msvcrt.dll!_wcreat 767ED326 5 Bytes JMP 00F20FAB
.text C:\Windows\System32\svchost.exe[1156] msvcrt.dll!_wopen 767ED501 5 Bytes JMP 00F20FE3
.text C:\Windows\System32\svchost.exe[1156] ADVAPI32.dll!RegCreateKeyExA 773739AB 5 Bytes JMP 00F30FC0
.text C:\Windows\System32\svchost.exe[1156] ADVAPI32.dll!RegCreateKeyA 77373BA9 5 Bytes JMP 00F30047
.text C:\Windows\System32\svchost.exe[1156] ADVAPI32.dll!RegOpenKeyA 773789C7 5 Bytes JMP 00F30000
.text C:\Windows\System32\svchost.exe[1156] ADVAPI32.dll!RegCreateKeyW 7738391E 5 Bytes JMP 00F30058
.text C:\Windows\System32\svchost.exe[1156] ADVAPI32.dll!RegCreateKeyExW 773841F1 5 Bytes JMP 00F3007D
.text C:\Windows\System32\svchost.exe[1156] ADVAPI32.dll!RegOpenKeyExA 77387C42 5 Bytes JMP 00F30022
.text C:\Windows\System32\svchost.exe[1156] ADVAPI32.dll!RegOpenKeyW 7738E2B5 5 Bytes JMP 00F30011
.text C:\Windows\System32\svchost.exe[1156] ADVAPI32.dll!RegOpenKeyExW 77397BA1 5 Bytes JMP 00F30FDB
.text C:\Windows\System32\svchost.exe[1156] WS2_32.dll!socket 775E36D1 5 Bytes JMP 00F50FEF
.text C:\Windows\System32\svchost.exe[1192] ntdll.dll!NtCreateFile 77B943D4 5 Bytes JMP 009C0FEF
.text C:\Windows\System32\svchost.exe[1192] ntdll.dll!NtCreateProcess 77B94494 5 Bytes JMP 009C000A
.text C:\Windows\System32\svchost.exe[1192] ntdll.dll!NtProtectVirtualMemory 77B94D34 5 Bytes JMP 009C0FCA
.text C:\Windows\System32\svchost.exe[1192] kernel32.dll!GetStartupInfoW 77611929 5 Bytes JMP 00950F2E
.text C:\Windows\System32\svchost.exe[1192] kernel32.dll!GetStartupInfoA 776119C9 5 Bytes JMP 0095007E
.text C:\Windows\System32\svchost.exe[1192] kernel32.dll!CreateProcessW 77611BF3 5 Bytes JMP 00950F02
.text C:\Windows\System32\svchost.exe[1192] kernel32.dll!CreateProcessA 77611C28 5 Bytes JMP 00950099
.text C:\Windows\System32\svchost.exe[1192] kernel32.dll!VirtualProtect 77611DC3 5 Bytes JMP 00950F64
.text C:\Windows\System32\svchost.exe[1192] kernel32.dll!CreateNamedPipeA 77612EF5 5 Bytes JMP 00950FC3
.text C:\Windows\System32\svchost.exe[1192] kernel32.dll!CreateNamedPipeW 77615C0C 5 Bytes JMP 00950FB2
.text C:\Windows\System32\svchost.exe[1192] kernel32.dll!CreatePipe 77638E6E 5 Bytes JMP 00950063
.text C:\Windows\System32\svchost.exe[1192] kernel32.dll!LoadLibraryExW 77639109 5 Bytes JMP 00950032
.text C:\Windows\System32\svchost.exe[1192] kernel32.dll!LoadLibraryW 77639362 5 Bytes JMP 00950F90
.text C:\Windows\System32\svchost.exe[1192] kernel32.dll!LoadLibraryExA 776394B4 5 Bytes JMP 00950F7F
.text C:\Windows\System32\svchost.exe[1192] kernel32.dll!LoadLibraryA 776394DC 5 Bytes JMP 00950FA1
.text C:\Windows\System32\svchost.exe[1192] kernel32.dll!VirtualProtectEx 7763DBDA 5 Bytes JMP 00950F53
.text C:\Windows\System32\svchost.exe[1192] kernel32.dll!GetProcAddress 7765903B 5 Bytes JMP 00950EE7
.text C:\Windows\System32\svchost.exe[1192] kernel32.dll!CreateFileW 7765AECB 5 Bytes JMP 00950FD4
.text C:\Windows\System32\svchost.exe[1192] kernel32.dll!CreateFileA 7765CE5F 5 Bytes JMP 00950FEF
.text C:\Windows\System32\svchost.exe[1192] kernel32.dll!WinExec 776A5CF7 5 Bytes JMP 00950F1D
.text C:\Windows\System32\svchost.exe[1192] msvcrt.dll!_wsystem 767E7F2F 5 Bytes JMP 00D60025
.text C:\Windows\System32\svchost.exe[1192] msvcrt.dll!system 767E804B 5 Bytes JMP 00D60F90
.text C:\Windows\System32\svchost.exe[1192] msvcrt.dll!_creat 767EBBE1 5 Bytes JMP 00D60FC6
.text C:\Windows\System32\svchost.exe[1192] msvcrt.dll!_open 767ED106 5 Bytes JMP 00D60000
.text C:\Windows\System32\svchost.exe[1192] msvcrt.dll!_wcreat 767ED326 5 Bytes JMP 00D60FAB
.text C:\Windows\System32\svchost.exe[1192] msvcrt.dll!_wopen 767ED501 5 Bytes JMP 00D60FE3
.text C:\Windows\System32\svchost.exe[1192] ADVAPI32.dll!RegCreateKeyExA 773739AB 5 Bytes JMP 00D7006C
.text C:\Windows\System32\svchost.exe[1192] ADVAPI32.dll!RegCreateKeyA 77373BA9 5 Bytes JMP 00D70047
.text C:\Windows\System32\svchost.exe[1192] ADVAPI32.dll!RegOpenKeyA 773789C7 5 Bytes JMP 00D7000A
.text C:\Windows\System32\svchost.exe[1192] ADVAPI32.dll!RegCreateKeyW 7738391E 5 Bytes JMP 00D70FC0
.text C:\Windows\System32\svchost.exe[1192] ADVAPI32.dll!RegCreateKeyExW 773841F1 5 Bytes JMP 00D7007D
.text C:\Windows\System32\svchost.exe[1192] ADVAPI32.dll!RegOpenKeyExA 77387C42 5 Bytes JMP 00D70FE5
.text C:\Windows\System32\svchost.exe[1192] ADVAPI32.dll!RegOpenKeyW 7738E2B5 5 Bytes JMP 00D7001B
.text C:\Windows\System32\svchost.exe[1192] ADVAPI32.dll!RegOpenKeyExW 77397BA1 5 Bytes JMP 00D70036
.text C:\Windows\System32\svchost.exe[1192] WS2_32.dll!socket 775E36D1 5 Bytes JMP 00E40FE5
.text C:\Windows\system32\svchost.exe[1228] ntdll.dll!NtCreateFile 77B943D4 5 Bytes JMP 01400000
.text C:\Windows\system32\svchost.exe[1228] ntdll.dll!NtCreateProcess 77B94494 5 Bytes JMP 0140002C
.text C:\Windows\system32\svchost.exe[1228] ntdll.dll!NtProtectVirtualMemory 77B94D34 5 Bytes JMP 0140001B
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!GetStartupInfoW 77611929 5 Bytes JMP 00FE00CB
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!GetStartupInfoA 776119C9 5 Bytes JMP 00FE0F8F
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!CreateProcessW 77611BF3 5 Bytes JMP 00FE0F59
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!CreateProcessA 77611C28 5 Bytes JMP 00FE00F0
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!VirtualProtect 77611DC3 5 Bytes JMP 00FE008E
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!CreateNamedPipeA 77612EF5 5 Bytes JMP 00FE0025
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!CreateNamedPipeW 77615C0C 5 Bytes JMP 00FE0FD4
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!CreatePipe 77638E6E 5 Bytes JMP 00FE00BA
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!LoadLibraryExW 77639109 5 Bytes JMP 00FE007D
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!LoadLibraryW 77639362 5 Bytes JMP 00FE005B
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!LoadLibraryExA 776394B4 5 Bytes JMP 00FE006C
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!LoadLibraryA 776394DC 5 Bytes JMP 00FE004A
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!VirtualProtectEx 7763DBDA 5 Bytes JMP 00FE009F
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!GetProcAddress 7765903B 5 Bytes JMP 00FE0F3E
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!CreateFileW 7765AECB 5 Bytes JMP 00FE0000
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!CreateFileA 7765CE5F 5 Bytes JMP 00FE0FEF
.text C:\Windows\system32\svchost.exe[1228] kernel32.dll!WinExec 776A5CF7 5 Bytes JMP 00FE0F74
.text C:\Windows\system32\svchost.exe[1228] msvcrt.dll!_wsystem 767E7F2F 5 Bytes JMP 014F0044
.text C:\Windows\system32\svchost.exe[1228] msvcrt.dll!system 767E804B 5 Bytes JMP 014F0FB9
.text C:\Windows\system32\svchost.exe[1228] msvcrt.dll!_creat 767EBBE1 5 Bytes JMP 014F0018
.text C:\Windows\system32\svchost.exe[1228] msvcrt.dll!_open 767ED106 5 Bytes JMP 014F0FEF
.text C:\Windows\system32\svchost.exe[1228] msvcrt.dll!_wcreat 767ED326 5 Bytes JMP 014F0029
.text C:\Windows\system32\svchost.exe[1228] msvcrt.dll!_wopen 767ED501 5 Bytes JMP 014F0FDE
.text C:\Windows\system32\svchost.exe[1228] ADVAPI32.dll!RegCreateKeyExA 773739AB 5 Bytes JMP 01540062
.text C:\Windows\system32\svchost.exe[1228] ADVAPI32.dll!RegCreateKeyA 77373BA9 5 Bytes JMP 01540FCA
.text C:\Windows\system32\svchost.exe[1228] ADVAPI32.dll!RegOpenKeyA 773789C7 5 Bytes JMP 01540FE5
.text C:\Windows\system32\svchost.exe[1228] ADVAPI32.dll!RegCreateKeyW 7738391E 5 Bytes JMP 01540051
.text C:\Windows\system32\svchost.exe[1228] ADVAPI32.dll!RegCreateKeyExW 773841F1 5 Bytes JMP 01540FA5
.text C:\Windows\system32\svchost.exe[1228] ADVAPI32.dll!RegOpenKeyExA 77387C42 5 Bytes JMP 01540011
.text C:\Windows\system32\svchost.exe[1228] ADVAPI32.dll!RegOpenKeyW 7738E2B5 5 Bytes JMP 01540000
.text C:\Windows\system32\svchost.exe[1228] ADVAPI32.dll!RegOpenKeyExW 77397BA1 5 Bytes JMP 01540036
.text C:\Windows\system32\svchost.exe[1228] WS2_32.dll!socket 775E36D1 5 Bytes JMP 01550FEF
.text C:\Windows\system32\svchost.exe[1332] ntdll.dll!NtCreateFile 77B943D4 5 Bytes JMP 0027000A
.text C:\Windows\system32\svchost.exe[1332] ntdll.dll!NtCreateProcess 77B94494 5 Bytes JMP 00270FDE
.text C:\Windows\system32\svchost.exe[1332] ntdll.dll!NtProtectVirtualMemory 77B94D34 5 Bytes JMP 00270FEF
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!GetStartupInfoW 77611929 5 Bytes JMP 00260089
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!GetStartupInfoA 776119C9 5 Bytes JMP 00260F43
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!CreateProcessW 77611BF3 5 Bytes JMP 00260F0D
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!CreateProcessA 77611C28 5 Bytes JMP 002600A4
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!VirtualProtect 77611DC3 5 Bytes JMP 0026004C
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!CreateNamedPipeA 77612EF5 5 Bytes JMP 00260FB9
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!CreateNamedPipeW 77615C0C 5 Bytes JMP 00260000
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!CreatePipe 77638E6E 5 Bytes JMP 00260078
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!LoadLibraryExW 77639109 5 Bytes JMP 00260F68
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!LoadLibraryW 77639362 5 Bytes JMP 00260025
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!LoadLibraryExA 776394B4 5 Bytes JMP 00260F83
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!LoadLibraryA 776394DC 5 Bytes JMP 00260F9E
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!VirtualProtectEx 7763DBDA 5 Bytes JMP 0026005D
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!GetProcAddress 7765903B 5 Bytes JMP 002600BF
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!CreateFileW 7765AECB 5 Bytes JMP 00260FCA
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!CreateFileA 7765CE5F 5 Bytes JMP 00260FEF
.text C:\Windows\system32\svchost.exe[1332] kernel32.dll!WinExec 776A5CF7 5 Bytes JMP 00260F1E
.text C:\Windows\system32\svchost.exe[1332] msvcrt.dll!_wsystem 767E7F2F 5 Bytes JMP 00280FA6
.text C:\Windows\system32\svchost.exe[1332] msvcrt.dll!system 767E804B 5 Bytes JMP 00280031
.text C:\Windows\system32\svchost.exe[1332] msvcrt.dll!_creat 767EBBE1 5 Bytes JMP 00280FD2
.text C:\Windows\system32\svchost.exe[1332] msvcrt.dll!_open 767ED106 5 Bytes JMP 00280FEF
.text C:\Windows\system32\svchost.exe[1332] msvcrt.dll!_wcreat 767ED326 5 Bytes JMP 00280FC1
.text C:\Windows\system32\svchost.exe[1332] msvcrt.dll!_wopen 767ED501 5 Bytes JMP 0028000C
.text C:\Windows\system32\svchost.exe[1332] ADVAPI32.dll!RegCreateKeyExA 773739AB 5 Bytes JMP 002A0F57
.text C:\Windows\system32\svchost.exe[1332] ADVAPI32.dll!RegCreateKeyA 77373BA9 5 Bytes JMP 002A0F8D
.text C:\Windows\system32\svchost.exe[1332] ADVAPI32.dll!RegOpenKeyA 773789C7 5 Bytes JMP 002A0FE5
.text C:\Windows\system32\svchost.exe[1332] ADVAPI32.dll!RegCreateKeyW 7738391E 5 Bytes JMP 002A0F68
.text C:\Windows\system32\svchost.exe[1332] ADVAPI32.dll!RegCreateKeyExW 773841F1 5 Bytes JMP 002A0014
.text C:\Windows\system32\svchost.exe[1332] ADVAPI32.dll!RegOpenKeyExA 77387C42 5 Bytes JMP 002A0FB9
.text C:\Windows\system32\svchost.exe[1332] ADVAPI32.dll!RegOpenKeyW 7738E2B5 5 Bytes JMP 002A0FD4
.text C:\Windows\system32\svchost.exe[1332] ADVAPI32.dll!RegOpenKeyExW 77397BA1 5 Bytes JMP 002A0FA8
.text C:\Windows\system32\svchost.exe[1332] WS2_32.dll!socket 775E36D1 5 Bytes JMP 002B0000
.text C:\Windows\system32\svchost.exe[1396] ntdll.dll!NtCreateFile 77B943D4 5 Bytes JMP 00F40000
.text C:\Windows\system32\svchost.exe[1396] ntdll.dll!NtCreateProcess 77B94494 5 Bytes JMP 00F40011
.text C:\Windows\system32\svchost.exe[1396] ntdll.dll!NtProtectVirtualMemory 77B94D34 5 Bytes JMP 00F40FDB
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!GetStartupInfoW 77611929 5 Bytes JMP 000A0F4B
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!GetStartupInfoA 776119C9 5 Bytes JMP 000A0F5C
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!CreateProcessW 77611BF3 5 Bytes JMP 000A00C7
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!CreateProcessA 77611C28 5 Bytes JMP 000A0F30
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!VirtualProtect 77611DC3 5 Bytes JMP 000A0F99
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!CreateNamedPipeA 77612EF5 5 Bytes JMP 000A0000
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!CreateNamedPipeW 77615C0C 5 Bytes JMP 000A0025
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!CreatePipe 77638E6E 5 Bytes JMP 000A0F77
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!LoadLibraryExW 77639109 5 Bytes JMP 000A007D
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!LoadLibraryW 77639362 5 Bytes JMP 000A0047
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!LoadLibraryExA 776394B4 5 Bytes JMP 000A006C
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!LoadLibraryA 776394DC 5 Bytes JMP 000A0036
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!VirtualProtectEx 7763DBDA 5 Bytes JMP 000A0F88
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!GetProcAddress 7765903B 5 Bytes JMP 000A00D8
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!CreateFileW 7765AECB 5 Bytes JMP 000A0FD4
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!CreateFileA 7765CE5F 5 Bytes JMP 000A0FEF
.text C:\Windows\system32\svchost.exe[1396] kernel32.dll!WinExec 776A5CF7 5 Bytes JMP 000A00AC
.text C:\Windows\system32\svchost.exe[1396] msvcrt.dll!_wsystem 767E7F2F 5 Bytes JMP 00F5004B
.text C:\Windows\system32\svchost.exe[1396] msvcrt.dll!system 767E804B 5 Bytes JMP 00F5003A
.text C:\Windows\system32\svchost.exe[1396] msvcrt.dll!_creat 767EBBE1 5 Bytes JMP 00F50018
.text C:\Windows\system32\svchost.exe[1396] msvcrt.dll!_open 767ED106 5 Bytes JMP 00F50FEF
.text C:\Windows\system32\svchost.exe[1396] msvcrt.dll!_wcreat 767ED326 5 Bytes JMP 00F50029
.text C:\Windows\system32\svchost.exe[1396] msvcrt.dll!_wopen 767ED501 5 Bytes JMP 00F50FDE
.text C:\Windows\system32\svchost.exe[1396] ADVAPI32.dll!RegCreateKeyExA 773739AB 5 Bytes JMP 00F60F97
.text C:\Windows\system32\svchost.exe[1396] ADVAPI32.dll!RegCreateKeyA 77373BA9 5 Bytes JMP 00F60FB9
.text C:\Windows\system32\svchost.exe[1396] ADVAPI32.dll!RegOpenKeyA 773789C7 5 Bytes JMP 00F6000A
.text C:\Windows\system32\svchost.exe[1396] ADVAPI32.dll!RegCreateKeyW 7738391E 5 Bytes JMP 00F60FA8
.text C:\Windows\system32\svchost.exe[1396] ADVAPI32.dll!RegCreateKeyExW 773841F1 5 Bytes JMP 00F60054
.text C:\Windows\system32\svchost.exe[1396] ADVAPI32.dll!RegOpenKeyExA 77387C42 5 Bytes JMP 00F60FD4
.text C:\Windows\system32\svchost.exe[1396] ADVAPI32.dll!RegOpenKeyW 7738E2B5 5 Bytes JMP 00F60FEF
.text C:\Windows\system32\svchost.exe[1396] ADVAPI32.dll!RegOpenKeyExW 77397BA1 5 Bytes JMP 00F60025
.text C:\Windows\system32\svchost.exe[1396] WS2_32.dll!socket 775E36D1 5 Bytes JMP 01D00FEF
.text C:\Windows\system32\svchost.exe[1396] WinInet.dll!InternetOpenA 7747D690 5 Bytes JMP 00F70000
.text C:\Windows\system32\svchost.exe[1396] WinInet.dll!InternetOpenW 7747DB09 5 Bytes JMP 00F7001B
.text C:\Windows\system32\svchost.exe[1396] WinInet.dll!InternetOpenUrlA 7747F3A4 5 Bytes JMP 00F70FDB
.text C:\Windows\system32\svchost.exe[1396] WinInet.dll!InternetOpenUrlW 774C6DDF 5 Bytes JMP 00F70036
.text C:\Windows\system32\svchost.exe[1580] ntdll.dll!NtCreateFile 77B943D4 5 Bytes JMP 01070000
.text C:\Windows\system32\svchost.exe[1580] ntdll.dll!NtCreateProcess 77B94494 5 Bytes JMP 01070036
.text C:\Windows\system32\svchost.exe[1580] ntdll.dll!NtProtectVirtualMemory 77B94D34 5 Bytes JMP 0107001B
.text C:\Windows\system32\svchost.exe[1580] kernel32.dll!GetStartupInfoW 77611929 5 Bytes JMP 010600C2
.text C:\Windows\system32\svchost.exe[1580] kernel32.dll!GetStartupInfoA 776119C9 5 Bytes JMP 01060F86
.text C:\Windows\system32\svchost.exe[1580] kernel32.dll!CreateProcessW 77611BF3 5 Bytes JMP 01060F46
.text C:\Windows\system32\svchost.exe[1580] kernel32.dll!CreateProcessA 77611C28 5 Bytes JMP 01060F61
.text C:\Windows\system32\svchost.exe[1580] kernel32.dll!VirtualProtect 77611DC3 5 Bytes JMP 01060F97
.text C:\Windows\system32\svchost.exe[1580] kernel32.dll!CreateNamedPipeA 77612EF5 5 Bytes JMP 01060FEF
.text C:\Windows\system32\svchost.exe[1580] kernel32.dll!CreateNamedPipeW 77615C0C 5 Bytes JMP 01060FDE
.text C:\Windows\system32\svchost.exe[1580] kernel32.dll!CreatePipe 77638E6E 5 Bytes JMP 010600B1
.text C:\Windows\system32\svchost.exe[1580] kernel32.dll!LoadLibraryExW 77639109 5 Bytes JMP 01060071
.text C:\Windows\system32\svchost.exe[1580] kernel32.dll!LoadLibraryW 77639362 5 Bytes JMP 01060FB2
.text C:\Windows\system32\svchost.exe[1580] kernel32.dll!LoadLibraryExA 776394B4 5 Bytes JMP 01060054
.text C:\Windows\system32\svchost.exe[1580] kernel32.dll!LoadLibraryA 776394DC 5 Bytes JMP 01060FCD
.text C:\Windows\system32\svchost.exe[1580] kernel32.dll!VirtualProtectEx 7763DBDA 5 Bytes JMP 01060096
.text C:\Windows\system32\svchost.exe[1580] kernel32.dll!GetProcAddress 7765903B 5 Bytes JMP 010600F8
.text C:\Windows\system32\svchost.exe[1580] kernel32.dll!CreateFileW 7765AECB 5 Bytes JMP 0106001B
.text C:\Windows\system32\svchost.exe[1580] kernel32.dll!CreateFileA 7765CE5F 5 Bytes JMP 0106000A
.text C:\Windows\system32\svchost.exe[1580] kernel32.dll!WinExec 776A5CF7 5 Bytes JMP 010600D3
.text C:\Windows\system32\svchost.exe[1580] msvcrt.dll!_wsystem 767E7F2F 1 Byte [E9]
.text C:\Windows\system32\svchost.exe[1580] msvcrt.dll!_wsystem 767E7F2F 5 Bytes JMP 010C0033
.text C:\Windows\system32\svchost.exe[1580] msvcrt.dll!system 767E804B 5 Bytes JMP 010C0022
.text C:\Windows\system32\svchost.exe[1580] msvcrt.dll!_creat 767EBBE1 5 Bytes JMP 010C0FC6
.text C:\Windows\system32\svchost.exe[1580] msvcrt.dll!_open 767ED106 5 Bytes JMP 010C0000
.text C:\Windows\system32\svchost.exe[1580] msvcrt.dll!_wcreat 767ED326 5 Bytes JMP 010C0011
.text C:\Windows\system32\svchost.exe[1580] msvcrt.dll!_wopen 767ED501 5 Bytes JMP 010C0FE3
.text C:\Windows\system32\svchost.exe[1580] ADVAPI32.dll!RegCreateKeyExA 773739AB 5 Bytes JMP 01110054
.text C:\Windows\system32\svchost.exe[1580] ADVAPI32.dll!RegCreateKeyA 77373BA9 5 Bytes JMP 01110FCD
.text C:\Windows\system32\svchost.exe[1580] ADVAPI32.dll!RegOpenKeyA 773789C7 5 Bytes JMP 0111000A
.text C:\Windows\system32\svchost.exe[1580] ADVAPI32.dll!RegCreateKeyW 7738391E 5 Bytes JMP 01110FB2
.text C:\Windows\system32\svchost.exe[1580] ADVAPI32.dll!RegCreateKeyExW 773841F1 5 Bytes JMP 01110F97
.text C:\Windows\system32\svchost.exe[1580] ADVAPI32.dll!RegOpenKeyExA 77387C42 5 Bytes JMP 01110025
.text C:\Windows\system32\svchost.exe[1580] ADVAPI32.dll!RegOpenKeyW 7738E2B5 5 Bytes JMP 01110FEF
.text C:\Windows\system32\svchost.exe[1580] ADVAPI32.dll!RegOpenKeyExW 77397BA1 5 Bytes JMP 01110FDE
.text C:\Windows\system32\svchost.exe[1580] WS2_32.dll!socket 775E36D1 5 Bytes JMP 01120000
.text C:\Windows\system32\svchost.exe[1800] ntdll.dll!NtCreateFile 77B943D4 5 Bytes JMP 00730000
.text C:\Windows\system32\svchost.exe[1800] ntdll.dll!NtCreateProcess 77B94494 5 Bytes JMP 00730FE5
.text C:\Windows\system32\svchost.exe[1800] ntdll.dll!NtProtectVirtualMemory 77B94D34 5 Bytes JMP 0073001B
.text C:\Windows\system32\svchost.exe[1800] kernel32.dll!GetStartupInfoW 77611929 5 Bytes JMP 00720F60
.text C:\Windows\system32\svchost.exe[1800] kernel32.dll!GetStartupInfoA 776119C9 5 Bytes JMP 007200B0
.text C:\Windows\system32\svchost.exe[1800] kernel32.dll!CreateProcessW 77611BF3 5 Bytes JMP 00720F2A
.text C:\Windows\system32\svchost.exe[1800] kernel32.dll!CreateProcessA 77611C28 5 Bytes JMP 00720F3B
.text C:\Windows\system32\svchost.exe[1800] kernel32.dll!VirtualProtect 77611DC3 5 Bytes JMP 00720F8F
.text C:\Windows\system32\svchost.exe[1800] kernel32.dll!CreateNamedPipeA 77612EF5 5 Bytes JMP 00720022
.text C:\Windows\system32\svchost.exe[1800] kernel32.dll!CreateNamedPipeW 77615C0C 5 Bytes JMP 00720033
.text C:\Windows\system32\svchost.exe[1800] kernel32.dll!CreatePipe 77638E6E 5 Bytes JMP 0072009F
.text C:\Windows\system32\svchost.exe[1800] kernel32.dll!LoadLibraryExW 77639109 5 Bytes JMP 00720FA0
.text C:\Windows\system32\svchost.exe[1800] kernel32.dll!LoadLibraryW 77639362 5 Bytes JMP 00720055
.text C:\Windows\system32\svchost.exe[1800] kernel32.dll!LoadLibraryExA 776394B4 5 Bytes JMP 00720FBD
.text C:\Windows\system32\svchost.exe[1800] kernel32.dll!LoadLibraryA 776394DC 5 Bytes JMP 00720044
.text C:\Windows\system32\svchost.exe[1800] kernel32.dll!VirtualProtectEx 7763DBDA 5 Bytes JMP 00720084
.text C:\Windows\system32\svchost.exe[1800] kernel32.dll!GetProcAddress 7765903B 5 Bytes JMP 007200DC
.text C:\Windows\system32\svchost.exe[1800] kernel32.dll!CreateFileW 7765AECB 5 Bytes JMP 00720011
.text C:\Windows\system32\svchost.exe[1800] kernel32.dll!CreateFileA 7765CE5F 5 Bytes JMP 00720000
.text C:\Windows\system32\svchost.exe[1800] kernel32.dll!WinExec 776A5CF7 5 Bytes JMP 007200C1
.text C:\Windows\system32\svchost.exe[1800] msvcrt.dll!_wsystem 767E7F2F 5 Bytes JMP 0074006E
.text C:\Windows\system32\svchost.exe[1800] msvcrt.dll!system 767E804B 5 Bytes JMP 0074005D
.text C:\Windows\system32\svchost.exe[1800] msvcrt.dll!_creat 767EBBE1 5 Bytes JMP 00740027
.text C:\Windows\system32\svchost.exe[1800] msvcrt.dll!_open 767ED106 5 Bytes JMP 00740FE3
.text C:\Windows\system32\svchost.exe[1800] msvcrt.dll!_wcreat 767ED326 5 Bytes JMP 00740038
.text C:\Windows\system32\svchost.exe[1800] msvcrt.dll!_wopen 767ED501 5 Bytes JMP 00740000
.text C:\Windows\system32\svchost.exe[1800] ADVAPI32.dll!RegCreateKeyExA 773739AB 5 Bytes JMP 00750073
.text C:\Windows\system32\svchost.exe[1800] ADVAPI32.dll!RegCreateKeyA 77373BA9 5 Bytes JMP 00750051
.text C:\Windows\system32\svchost.exe[1800] ADVAPI32.dll!RegOpenKeyA 773789C7 5 Bytes JMP 00750FEF
.text C:\Windows\system32\svchost.exe[1800] ADVAPI32.dll!RegCreateKeyW 7738391E 5 Bytes JMP 00750062
.text C:\Windows\system32\svchost.exe[1800] ADVAPI32.dll!RegCreateKeyExW 773841F1 5 Bytes JMP 0075008E
.text C:\Windows\system32\svchost.exe[1800] ADVAPI32.dll!RegOpenKeyExA 77387C42 5 Bytes JMP 0075001B
.text C:\Windows\system32\svchost.exe[1800] ADVAPI32.dll!RegOpenKeyW 7738E2B5 5 Bytes JMP 00750000
.text C:\Windows\system32\svchost.exe[1800] ADVAPI32.dll!RegOpenKeyExW 77397BA1 5 Bytes JMP 0075002C
.text C:\Windows\system32\svchost.exe[1800] WS2_32.dll!socket 775E36D1 5 Bytes JMP 007A0000

Satchfan

Post #8September 26, 2010, 7:05 PM UTC

Thanks for the additional information boggler. I'll be in touch as soon as I have looked through it all. Satchfan

boggler

Post #9September 27, 2010, 9:37 AM UTC

Thanks

Satchfan

Post #10September 27, 2010, 7:22 PM UTC

Hello again boggler

Should I renable the stuff I disabled with defogger

Not until we are finished as it could interfere with tools we might use.

Uninstall Java

The versions you have are old and therefore vulnerable to infections.

Remove all versions of Java or JRE environment:
1. From the Start menu, select Control Panel.
2. In Classic View, double-click Programs and Features. In Control Panel Home view, under "Programs", click Uninstall a program.
3. Select the program you want to remove, and click Uninstall. Alternatively, right-click the program and select Uninstall.

Install the latest version of Java from here

Download ComboFix from the following location:

Link

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See this Link for programs that need to be disabled and instruction on how to disable them.
Remember to re-enable them when we're done.
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

Note: Do not mouse-click combofix's window while it is running. That may cause it to stall.

When finished, it will produce a log. Please include the ComboFix.txt in your next reply. It can be found at C:\ComboFix.txt

Thanks

Satchfan

boggler

Post #11September 27, 2010, 10:03 PM UTC

OK, Here's the Combifix txt:

ComboFix 10-09-27.03 - Kwab 27/09/2010 22:39:48.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2046.1106 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Kwab\AppData\Local\{FB0BE041-599A-4BA1-8060-7A09DA6722AD}
c:\users\Kwab\AppData\Local\{FB0BE041-599A-4BA1-8060-7A09DA6722AD}\chrome.manifest
c:\users\Kwab\AppData\Local\{FB0BE041-599A-4BA1-8060-7A09DA6722AD}\chrome\content\_cfg.js
c:\users\Kwab\AppData\Local\{FB0BE041-599A-4BA1-8060-7A09DA6722AD}\chrome\content\overlay.xul
c:\users\Kwab\AppData\Local\{FB0BE041-599A-4BA1-8060-7A09DA6722AD}\install.rdf
c:\users\Kwab\AppData\Local\elatuqicacepepa.dll_old
c:\users\Kwab\GoToAssistDownloadHelper.exe
c:\windows\SEC
c:\windows\SEC\172100logo.bmp
c:\windows\SEC\banner.png
c:\windows\SEC\Computer.png
c:\windows\SEC\Media _S_ Logo.png
c:\windows\SEC\Samsung.png
c:\windows\SEC\Samsung2.png
c:\windows\SEC\SamsungLogo.png
c:\windows\SEC\Wallpapers\wallpaper.jpg
c:\windows\SEC\Wallpapers\wallpaper1.jpg
c:\windows\SEC\Wallpapers\Wallpaper2.jpg

.
((((((((((((((((((((((((( Files Created from 2010-08-27 to 2010-09-27 )))))))))))))))))))))))))))))))
.

2010-09-27 21:51 . 2010-09-27 21:51 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-09-27 21:30 . 2010-09-27 21:30 ——– d—–w- c:\program files\Common Files\Java
2010-09-27 21:29 . 2010-09-27 21:29 423656 —-a-w- c:\windows\system32\deployJava1.dll
2010-09-23 17:14 . 2010-09-23 17:14 ——– d—–w- c:\users\Kwab\AppData\Roaming\Malwarebytes
2010-09-23 17:14 . 2010-04-29 14:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-23 17:14 . 2010-09-23 17:14 ——– d—–w- c:\programdata\Malwarebytes
2010-09-23 17:14 . 2010-09-23 20:32 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-09-23 17:14 . 2010-04-29 14:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-09-23 09:53 . 2010-09-23 09:53 388096 —-a-r- c:\users\Kwab\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-09-23 07:38 . 2010-09-23 07:38 0 —-a-w- c:\users\Kwab\AppData\Local\Nritahixoweto.bin
2010-09-23 07:38 . 2010-09-23 19:27 120 —-a-w- c:\users\Kwab\AppData\Local\Swofubadisuvubo.dat
2010-09-18 12:23 . 2010-09-20 22:25 ——– d—–w- c:\users\Kwab\AppData\Roaming\AA Pass Your Test
2010-09-15 21:45 . 2010-04-16 16:46 502272 —-a-w- c:\windows\system32\usp10.dll
2010-09-15 21:45 . 2010-08-17 14:11 128000 —-a-w- c:\windows\system32\spoolsv.exe
2010-09-15 21:45 . 2010-04-05 17:02 317952 —-a-w- c:\windows\system32\MP4SDECD.DLL
2010-09-15 21:45 . 2010-05-27 20:08 739328 —-a-w- c:\windows\system32\inetcomm.dll
2010-09-01 16:34 . 2010-09-01 16:34 1361192 —-a-w- c:\windows\system32\ISPPopUpDlg.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-27 21:53 . 2008-02-19 22:02 ——– d—–w- c:\programdata\Kontiki
2010-09-27 21:21 . 2008-02-26 12:09 ——– d—–w- c:\program files\Java
2010-09-27 11:24 . 2007-12-11 16:48 12 —-a-w- c:\windows\bthservsdp.dat
2010-09-25 21:21 . 2008-08-20 06:30 ——– d—–w- c:\programdata\Spybot - Search & Destroy
2010-09-25 18:58 . 2008-03-15 19:56 ——– d—–w- c:\program files\Azureus
2010-09-25 07:36 . 2009-03-14 12:53 27744 —-a-w- c:\users\Kwab\AppData\Roaming\nvModes.dat
2010-09-23 20:32 . 2008-06-23 03:22 ——– d—–w- c:\users\Kwab\AppData\Roaming\Otduco
2010-09-23 17:31 . 2010-06-05 06:55 ——– d—–w- c:\program files\Autorun Eater
2010-09-23 08:04 . 2008-12-24 05:18 ——– d—–w- c:\users\Kwab\AppData\Roaming\Acbe
2010-09-18 12:23 . 2010-08-10 21:00 ——– d—–w- c:\program files\AA Pass Your Test
2010-09-16 02:10 . 2007-12-11 18:27 ——– d—–w- c:\programdata\Microsoft Help
2010-09-16 02:04 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2010-09-14 20:31 . 2010-03-12 22:33 ——– d—–w- c:\program files\Microsoft Silverlight
2010-08-24 13:57 . 2010-07-25 05:53 9344 —-a-w- c:\windows\system32\drivers\mfeclnk.sys
2010-08-24 13:57 . 2010-07-25 05:53 95600 —-a-w- c:\windows\system32\drivers\mfeapfk.sys
2010-08-24 13:57 . 2010-07-25 05:53 84264 —-a-w- c:\windows\system32\drivers\mferkdet.sys
2010-08-24 13:57 . 2010-07-25 05:53 64304 —-a-w- c:\windows\system32\drivers\mfenlfk.sys
2010-08-24 13:57 . 2010-07-25 05:53 55840 —-a-w- c:\windows\system32\drivers\cfwids.sys
2010-08-24 13:57 . 2010-07-25 05:53 52104 —-a-w- c:\windows\system32\drivers\mfebopk.sys
2010-08-24 13:57 . 2010-07-25 05:53 386712 —-a-w- c:\windows\system32\drivers\mfehidk.sys
2010-08-24 13:57 . 2010-07-25 05:53 312904 —-a-w- c:\windows\system32\drivers\mfefirek.sys
2010-08-24 13:57 . 2010-07-25 05:53 164808 —-a-w- c:\windows\system32\drivers\mfewfpk.sys
2010-08-24 13:57 . 2010-07-25 05:53 152992 —-a-w- c:\windows\system32\drivers\mfeavfk.sys
2010-08-22 22:07 . 2008-02-14 18:06 ——– d—–w- c:\users\Kwab\AppData\Roaming\Skype
2010-08-22 19:40 . 2008-02-14 18:07 ——– d—–w- c:\users\Kwab\AppData\Roaming\skypePM
2010-08-21 20:44 . 2010-08-21 20:44 ——– d—–w- c:\program files\Veoh Networks
2010-08-15 10:05 . 2010-08-15 10:01 ——– d—–w- c:\program files\Trojan Remover
2010-08-15 10:02 . 2010-08-15 10:02 715152 —-a-w- c:\programdata\Simply Super Software\Trojan Remover\Data\trunins.exe
2010-08-15 10:01 . 2010-08-15 10:01 ——– d—–w- c:\users\Kwab\AppData\Roaming\Simply Super Software
2010-08-15 10:01 . 2010-08-15 10:01 ——– d—–w- c:\programdata\Simply Super Software
2010-07-21 11:04 . 2008-03-25 23:04 180 —-a-w- c:\users\Kwab\AppData\Roaming\Azureus\restart.bat
2010-07-21 10:07 . 2009-09-20 17:40 38784 —-a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-07-18 451872]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-13 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-23 857648]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 52256]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-29 30248]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-29 46632]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-10-24 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-24 8501792]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-10-24 81920]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-10-15 122880]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2009-12-18 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-10-14 623992]
"B2C_AGENT"="c:\programdata\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe" [2010-05-20 317368]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-06-24 1193848]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2009-11-22 19:15 13672 —-a-w- c:\program files\Citrix\GoToAssist\599\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer3"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrojanScanner]
2010-08-15 10:02 1167808 —-a-w- c:\program files\Trojan Remover\Trjscan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VeohPlugin]
2010-07-06 14:01 2634048 —-a-w- c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 135664]
R3 ADDMEM;ADDMEM;c:\users\Kwab\AppData\Local\Temp\__Samsung_Update\ADDMEM.SYS [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-08-31 29472]
R3 hcw95bda;Hauppauge MOD7700 Tuner Driver;c:\windows\system32\Drivers\hcw95bda.sys [2007-10-25 487424]
R3 hcw95rc;Hauppauge MOD7700 IR Driver;c:\windows\system32\DRIVERS\hcw95rc.sys [2007-10-25 15488]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-08-24 84264]
R3 NETw2v32;Intel® PRO/Wireless 2915ABG Network Connection Driver for Windows Vista;c:\windows\system32\DRIVERS\NETw2v32.sys [2006-11-02 2589184]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2008-01-19 16896]
R4 EPGService;EPGService;c:\progra~1\WinTV\EPG Services\System\EPGService.exe [2006-07-19 435200]
S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [2010-08-24 64304]
S1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2010-08-24 164808]
S2 KMDFMEMIO;SAMSUNG Kernel Driver;c:\windows\system32\DRIVERS\kmdfmemio.sys [2006-11-14 13312]
S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2010-03-10 271480]
S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2010-03-10 271480]
S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2010-08-24 188136]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe [2010-08-24 141792]
S2 myAgtSvc;McAfee Total Protection Agent Service;c:\program files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe [2006-05-04 120392]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-08-24 55840]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-08-24 312904]

— Other Services/Drivers In Memory —

*Deregistered* - mfeavfk01

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-07-18 08:53 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-09-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 09:37]

2010-09-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 09:37]

2010-09-27 c:\windows\Tasks\SupBackGroundTask.job
- c:\program files\Samsung\Samsung Update Plus\SUPBackGround.exe [2008-10-27 13:26]

2010-09-27 c:\windows\Tasks\User_Feed_Synchronization-{5C210700-6543-4646-B781-D7D2BE24CDBB}.job
- c:\windows\system32\msfeedssync.exe [2010-08-11 04:24]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://msn.co.uk/
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: Send image to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: flybmi.com\www
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CAB
DPF: {0972B098-DEE9-4279-AC7E-4BAAA029102D} - hxxp://assets.photobox.com/assets/aurigma/ImageUploader5.cab?20100805101937
DPF: {20BBA18F-5BC8-47B5-8FC9-5DFCA8E56A4B} - hxxp://mpi.dacom.net/XMPI/js/LGTelecom_XMPI_20100420.cab
DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} - hxxp://picasaweb.google.com/s/v/63.27/uploader2.cab
DPF: {48ECCD73-123C-4C25-A64C-76E8E8A30CAF} - hxxp://mpi.dacom.net/XPayMPI/XPayMPI.cab
DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} - hxxps://moneymanager.egg.com/Pinsafe/accounttracking.cab
DPF: {E78928A6-3D2A-4BF7-A100-F3FBAA351B49} - hxxps://www.vpay.co.kr/kvpfiles_vista/KVPISPCTLD_VISTA.cab
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-{1FA587A4-ECD0-796A-8ECD-1000E364F10B} - c:\users\Kwab\AppData\Roaming\Otduco\biwit.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-27 22:52
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-09-27 22:58:53
ComboFix-quarantined-files.txt 2010-09-27 21:58

Pre-Run: 22,537,924,608 bytes free
Post-Run: 22,453,227,520 bytes free

- - End Of File - - 269503E89052745517FB116D05B67B84

Satchfan

Post #12September 27, 2010, 10:17 PM UTC

Hi boggler Thanks for the log. I see you are logged in but I have to look at this log and then get the approval of an expert before replying so it won't be tonight. Thanks for your patience Satchfan

boggler

Post #13September 28, 2010, 7:03 AM UTC

Thanks for that.

Satchfan

Post #14September 28, 2010, 2:54 PM UTC

Hi boggler

Open ComboFix

Please do the following:
• Close any open browsers.
• Close/disable all anti virus and anti malware programs so that they do not interfere with the running of ComboFix.
• Open notepad and copy/paste the text in the codebox below into it:
File:: c:\users\Kwab\AppData\Local\Nritahixoweto.bin c:\users\Kwab\AppData\Local\Swofubadisuvubo.dat c:\users\Kwab\AppData\Roaming\Azureus\restart.bat

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it produces a log at C:\ComboFix.txt. Post the contents of Combofix.txt in your next reply.

Run Malwarebytes’ Anti-Malware

I noticed that you had MBAM on your system: if you no longer have it, you can download it from here: • Start Malwarebytes-Anti-Malware and update it, (“Update” tab}
• Once it is updated, click on “Scanner” tab, select Perform quick scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.
NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

**Vista users - right click on the IE icon and run as administrator

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.

Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.

[external image: Posted Image]
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

Please tell me how your computer is running now and if there are any problems.

Logs to include in your reply:

ComboFix.txt
Mbam.txt
Kaspersky text file

Thanks

Satchfan

boggler

Post #15September 29, 2010, 9:58 PM UTC

Ok, here are my 3 reports:

ComboFix 10-09-27.05 - Kwab 28/09/2010 22:50:01.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2046.1235 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Kwab\Desktop\CFScript.txt
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Resident AV is active

FILE ::
"c:\users\Kwab\AppData\Local\Nritahixoweto.bin"
"c:\users\Kwab\AppData\Local\Swofubadisuvubo.dat"
"c:\users\Kwab\AppData\Roaming\Azureus\restart.bat"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Kwab\AppData\Local\Nritahixoweto.bin
c:\users\Kwab\AppData\Local\Swofubadisuvubo.dat
c:\users\Kwab\AppData\Roaming\Azureus\restart.bat

.
((((((((((((((((((((((((( Files Created from 2010-08-28 to 2010-09-28 )))))))))))))))))))))))))))))))
.

2010-09-28 22:00 . 2010-09-28 22:00 ——– d—–w- c:\users\Public\AppData\Local\temp
2010-09-28 22:00 . 2010-09-28 22:00 ——– d—–w- c:\users\Default\AppData\Local\temp
2010-09-27 21:30 . 2010-09-27 21:30 ——– d—–w- c:\program files\Common Files\Java
2010-09-27 21:29 . 2010-09-27 21:29 423656 —-a-w- c:\windows\system32\deployJava1.dll
2010-09-23 17:14 . 2010-09-23 17:14 ——– d—–w- c:\users\Kwab\AppData\Roaming\Malwarebytes
2010-09-23 17:14 . 2010-04-29 14:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-23 17:14 . 2010-09-23 17:14 ——– d—–w- c:\programdata\Malwarebytes
2010-09-23 17:14 . 2010-09-23 20:32 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-09-23 17:14 . 2010-04-29 14:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-09-23 09:53 . 2010-09-23 09:53 388096 —-a-r- c:\users\Kwab\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-09-18 12:23 . 2010-09-20 22:25 ——– d—–w- c:\users\Kwab\AppData\Roaming\AA Pass Your Test
2010-09-15 21:45 . 2010-04-16 16:46 502272 —-a-w- c:\windows\system32\usp10.dll
2010-09-15 21:45 . 2010-08-17 14:11 128000 —-a-w- c:\windows\system32\spoolsv.exe
2010-09-15 21:45 . 2010-04-05 17:02 317952 —-a-w- c:\windows\system32\MP4SDECD.DLL
2010-09-15 21:45 . 2010-05-27 20:08 739328 —-a-w- c:\windows\system32\inetcomm.dll
2010-09-01 16:34 . 2010-09-01 16:34 1361192 —-a-w- c:\windows\system32\ISPPopUpDlg.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-28 22:01 . 2008-02-19 22:02 ——– d—–w- c:\programdata\Kontiki
2010-09-28 21:59 . 2008-03-15 20:03 ——– d—–w- c:\users\Kwab\AppData\Roaming\Azureus
2010-09-28 11:03 . 2007-12-11 16:48 12 —-a-w- c:\windows\bthservsdp.dat
2010-09-27 22:10 . 2010-08-10 21:00 ——– d—–w- c:\program files\AA Pass Your Test
2010-09-27 21:21 . 2008-02-26 12:09 ——– d—–w- c:\program files\Java
2010-09-25 21:21 . 2008-08-20 06:30 ——– d—–w- c:\programdata\Spybot - Search & Destroy
2010-09-25 18:58 . 2008-03-15 19:56 ——– d—–w- c:\program files\Azureus
2010-09-25 07:36 . 2009-03-14 12:53 27744 —-a-w- c:\users\Kwab\AppData\Roaming\nvModes.dat
2010-09-23 20:32 . 2008-06-23 03:22 ——– d—–w- c:\users\Kwab\AppData\Roaming\Otduco
2010-09-23 17:31 . 2010-06-05 06:55 ——– d—–w- c:\program files\Autorun Eater
2010-09-23 08:04 . 2008-12-24 05:18 ——– d—–w- c:\users\Kwab\AppData\Roaming\Acbe
2010-09-16 02:10 . 2007-12-11 18:27 ——– d—–w- c:\programdata\Microsoft Help
2010-09-16 02:04 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2010-09-14 20:31 . 2010-03-12 22:33 ——– d—–w- c:\program files\Microsoft Silverlight
2010-08-24 13:57 . 2010-07-25 05:53 9344 —-a-w- c:\windows\system32\drivers\mfeclnk.sys
2010-08-24 13:57 . 2010-07-25 05:53 95600 —-a-w- c:\windows\system32\drivers\mfeapfk.sys
2010-08-24 13:57 . 2010-07-25 05:53 84264 —-a-w- c:\windows\system32\drivers\mferkdet.sys
2010-08-24 13:57 . 2010-07-25 05:53 64304 —-a-w- c:\windows\system32\drivers\mfenlfk.sys
2010-08-24 13:57 . 2010-07-25 05:53 55840 —-a-w- c:\windows\system32\drivers\cfwids.sys
2010-08-24 13:57 . 2010-07-25 05:53 52104 —-a-w- c:\windows\system32\drivers\mfebopk.sys
2010-08-24 13:57 . 2010-07-25 05:53 386712 —-a-w- c:\windows\system32\drivers\mfehidk.sys
2010-08-24 13:57 . 2010-07-25 05:53 312904 —-a-w- c:\windows\system32\drivers\mfefirek.sys
2010-08-24 13:57 . 2010-07-25 05:53 164808 —-a-w- c:\windows\system32\drivers\mfewfpk.sys
2010-08-24 13:57 . 2010-07-25 05:53 152992 —-a-w- c:\windows\system32\drivers\mfeavfk.sys
2010-08-22 22:07 . 2008-02-14 18:06 ——– d—–w- c:\users\Kwab\AppData\Roaming\Skype
2010-08-22 19:40 . 2008-02-14 18:07 ——– d—–w- c:\users\Kwab\AppData\Roaming\skypePM
2010-08-21 20:44 . 2010-08-21 20:44 ——– d—–w- c:\program files\Veoh Networks
2010-08-15 10:05 . 2010-08-15 10:01 ——– d—–w- c:\program files\Trojan Remover
2010-08-15 10:02 . 2010-08-15 10:02 715152 —-a-w- c:\programdata\Simply Super Software\Trojan Remover\Data\trunins.exe
2010-08-15 10:01 . 2010-08-15 10:01 ——– d—–w- c:\users\Kwab\AppData\Roaming\Simply Super Software
2010-08-15 10:01 . 2010-08-15 10:01 ——– d—–w- c:\programdata\Simply Super Software
2010-07-21 10:07 . 2009-09-20 17:40 38784 —-a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
.

((((((((((((((((((((((((((((( SnapShot@2010-09-27_21.52.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-12-11 18:58 . 2010-09-28 21:27 80032 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2010-09-28 21:27 67928 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-02-14 15:06 . 2010-09-27 17:57 19106 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1161669828-1643011427-663113239-1003_UserData.bin
+ 2008-02-14 15:06 . 2010-09-28 21:27 19106 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1161669828-1643011427-663113239-1003_UserData.bin
+ 2008-02-14 15:00 . 2010-09-28 21:33 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-02-14 15:00 . 2010-09-27 21:16 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-02-14 15:00 . 2010-09-27 21:16 81920 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-02-14 15:00 . 2010-09-28 21:33 81920 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-02-14 15:00 . 2010-09-27 21:16 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-02-14 15:00 . 2010-09-28 21:33 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-09-27 17:54 . 2010-09-27 17:54 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2010-09-28 21:18 . 2010-09-28 21:18 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2010-09-28 21:18 . 2010-09-28 21:18 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2010-09-27 17:54 . 2010-09-27 17:54 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-10-15 09:44 . 2010-09-28 21:18 262144 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-10-15 09:44 . 2010-09-27 21:16 262144 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-07-18 451872]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-13 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-23 857648]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 52256]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-29 30248]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-29 46632]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-10-24 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-24 8501792]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-10-24 81920]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-10-15 122880]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2009-12-18 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-10-14 623992]
"B2C_AGENT"="c:\programdata\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe" [2010-05-20 317368]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-06-24 1193848]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2009-11-22 19:15 13672 —-a-w- c:\program files\Citrix\GoToAssist\599\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer3"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrojanScanner]
2010-08-15 10:02 1167808 —-a-w- c:\program files\Trojan Remover\Trjscan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VeohPlugin]
2010-07-06 14:01 2634048 —-a-w- c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 135664]
R3 ADDMEM;ADDMEM;c:\users\Kwab\AppData\Local\Temp\__Samsung_Update\ADDMEM.SYS [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-08-31 29472]
R3 hcw95bda;Hauppauge MOD7700 Tuner Driver;c:\windows\system32\Drivers\hcw95bda.sys [2007-10-25 487424]
R3 hcw95rc;Hauppauge MOD7700 IR Driver;c:\windows\system32\DRIVERS\hcw95rc.sys [2007-10-25 15488]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-08-24 84264]
R3 NETw2v32;Intel® PRO/Wireless 2915ABG Network Connection Driver for Windows Vista;c:\windows\system32\DRIVERS\NETw2v32.sys [2006-11-02 2589184]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2008-01-19 16896]
R4 EPGService;EPGService;c:\progra~1\WinTV\EPG Services\System\EPGService.exe [2006-07-19 435200]
S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [2010-08-24 64304]
S1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2010-08-24 164808]
S2 KMDFMEMIO;SAMSUNG Kernel Driver;c:\windows\system32\DRIVERS\kmdfmemio.sys [2006-11-14 13312]
S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe [2010-03-10 271480]
S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2010-03-10 271480]
S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2010-08-24 188136]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe [2010-08-24 141792]
S2 myAgtSvc;McAfee Total Protection Agent Service;c:\program files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe [2006-05-04 120392]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-08-24 55840]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-08-24 312904]

— Other Services/Drivers In Memory —

*Deregistered* - mfeavfk01

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-07-18 08:53 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-09-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 09:37]

2010-09-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 09:37]

2010-09-28 c:\windows\Tasks\SupBackGroundTask.job
- c:\program files\Samsung\Samsung Update Plus\SUPBackGround.exe [2008-10-27 13:26]

2010-09-28 c:\windows\Tasks\User_Feed_Synchronization-{5C210700-6543-4646-B781-D7D2BE24CDBB}.job
- c:\windows\system32\msfeedssync.exe [2010-08-11 04:24]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://msn.co.uk/
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: Send image to &Bluetooth; Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth; Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: flybmi.com\www
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CAB
DPF: {0972B098-DEE9-4279-AC7E-4BAAA029102D} - hxxp://assets.photobox.com/assets/aurigma/ImageUploader5.cab?20100805101937
DPF: {20BBA18F-5BC8-47B5-8FC9-5DFCA8E56A4B} - hxxp://mpi.dacom.net/XMPI/js/LGTelecom_XMPI_20100420.cab
DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} - hxxp://picasaweb.google.com/s/v/63.27/uploader2.cab
DPF: {48ECCD73-123C-4C25-A64C-76E8E8A30CAF} - hxxp://mpi.dacom.net/XPayMPI/XPayMPI.cab
DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} - hxxps://moneymanager.egg.com/Pinsafe/accounttracking.cab
DPF: {E78928A6-3D2A-4BF7-A100-F3FBAA351B49} - hxxps://www.vpay.co.kr/kvpfiles_vista/KVPISPCTLD_VISTA.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-28 23:00
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-09-28 23:04:48
ComboFix-quarantined-files.txt 2010-09-28 22:04
ComboFix2.txt 2010-09-27 21:58

Pre-Run: 21,653,585,920 bytes free
Post-Run: 21,605,261,312 bytes free

- - End Of File - - C8FB73EA474AB31E3697CC74E888B80B

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4678

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18943

28/09/2010 23:16:53
mbam-log-2010-09-28 (23-16-53).txt

Scan type: Quick scan
Objects scanned: 144149
Time elapsed: 9 minute(s), 11 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

KASPERSKY ONLINE SCANNER 7.0: scan report
Wednesday, September 29, 2010
Operating system: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 2 (build 6002)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Tuesday, September 28, 2010 17:08:33
Records in database: 4250989
——————————————————————————–

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Objects scanned: 205869
Threats found: 3
Infected objects found: 3
Suspicious objects found: 0
Scan duration: 06:12:32

File name / Threat / Threats count
C:\Users\Kwab\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\49c90790-7272410f Infected: Trojan-Downloader.Java.Agent.gr 1
C:\Users\Kwab\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\49c90790-7272410f Infected: Trojan-Downloader.Java.Agent.gs 1
C:\Users\Kwab\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\49c90790-7272410f Infected: Trojan-Downloader.Java.Agent.gt 1

Selected area has been scanned.

Thanks for the continued help

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

What's going on?

✨ Ask AI

Ask AI