What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Trojan.Agent/Gen-zbot

19 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello everyone, it has been very long time since I have been here, but I need you help again. It was only just yesterday I ran a scan with SuperAnti-spywre and found a Trojan.Agent/Gen-zbot in the System Volume Information folder which I know cannot do any harm to my computer unless it had been restored by system restore. However , I read up about this Trojan and realized that it could compromise my computer. Therefore if this Trojan was on my system (before) being put in the system volume information folder (restore point) I wanted to make sure it didn't (or if it did) any harm on my computer while it was active. I haven't had any problems however and nothing weird had shown up as if I knew about the infection beforehand before this infection.

Anyway here is th HijackThis log n the log from SuperAnt-Spyware with the infecte file. thank you.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:46:36 AM, on 9/25/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\CNYHKey.exe
C:\Program Files\Digital Media Reader\readericon45G.exe
C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\OpenDNS Updater\OpenDNSUpdater.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe
C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe
C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\WinPcap\rpcapd.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Owner.amarlowe\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
O2 - BHO: (no name) - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll
O2 - BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [showwnd] showwnd.exe
O4 - HKLM\..\Run: [readericon] C:\Program Files\Digital Media Reader\readericon45G.exe
O4 - HKLM\..\Run: [IntelAudioStudio] "C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" TRAY
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [CCUTRAYICON] C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [InstaLAN] "C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" startup
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OpenDNS Updater] "C:\Program Files\OpenDNS Updater\OpenDNSUpdater.exe" /autostart
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ie_banner_deny.htm
O9 - Extra button: &Virtual Keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O9 - Extra button: (no name) - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: &KeyScrambler Options - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Billeo - {97ED3A9F-CD6F-473A-8FE1-7505C1B844C3} - C:\WINDOWS\system32\shdocvw.dll (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {B9F79165-A264-4C4A-A211-133A5E8D647F} - http://support.f-secure.com/enu/home/onlin…/fshc/fscax.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} -
O17 - HKLM\System\CCS\Services\Tcpip\..\{BB122B61-EA9A-4AD1-994F-C5627F64764E}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - Unknown owner - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (file missing)
O23 - Service: AffinegyService - Affinegy, Inc. - C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe
O23 - Service: Intel® Alert Service (AlertService) - Intel Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: Kaspersky Anti-Virus Service (AVP) - Kaspersky Lab ZAO - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
O23 - Service: Intel® Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: Intel® Software Services Manager (ISSM) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel® Viiv™ Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel® Application Tracker (MCLServiceATL) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Intel® Remoting Service (Remote UI Service) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

–
End of file - 9230 bytes


SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 09/24/2010 at 08:39 PM

Application Version : 4.41.1000

Core Rules Database Version : 5577
Trace Rules Database Version: 3389

Scan type : Complete Scan
Total Scan Time : 01:05:38

Memory items scanned : 515
Memory threats detected : 0
Registry items scanned : 7211
Registry threats detected : 0
File items scanned : 75141
File threats detected : 1

Trojan.Agent/Gen-Zbot
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4E015214-6BB0-4181-B365-456CF1DEC069}\RP262\A0014765.DLL
Post #2
Hello Angel of the Moon and welcome back to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem. Please read the following guidelines which will help to make cleaning your machine easier:
• Please do not install/uninstall any programs unless asked to.
• Please do not run any scans other than those requested
• Please follow all instructions in the order posted
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• If you don't understand something, please don't hesitate to ask for clarification before proceeding
• The fixes are specific to your problem and should only be used for this issue on this machine.
• Please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!
Please note that I am still in training and my replies need to be checked by an expert in order for you to receive the best possible advice. This may result in a small delay between my posts but I shall try to keep this to a minimum.


I am looking through your log now and will reply as soon as possible.

Satchfan
Post #3
Hello again Angel of the Moon

OTL Custom Scan

Download OTL to your Desktop
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Click on Minimal Output at the top
  • Download the following file scan.txt to your Desktop. Click here to download it. You may need to right click on it and select "Save"
  • Double click inside the Custom Scan box at the bottom
  • A window will appear saying "Click OK to load a custom scan from a file or Cancel to cancel"
  • Click the OK button and navigate to the file scan.txt which we just saved to your desktop
  • Select scan.txt and click Open. Writing will now appear under the Custom Scan box
  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan won’t take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic

Please download DeFogger to your desktop.

Double click DeFogger to run the tool.
  • The application window will appear
  • Click the Disable button to disable your CD Emulation drivers
  • Click Yes to continue
  • A 'Finished!' message will appear
  • Click OK
  • DeFogger will now ask to reboot the machine - click OK
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.

Do not re-enable these drivers until otherwise instructed.


Download the GMER Rootkit Scanner

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • All drives/partitions except C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

Logs to include with next post:

OTL.txt
Extras.txt
Gmer.txt

Thanks

Satchfan
Post #4
OK, first of all I want to say thank you for your help, it's much appreciated, however I did have problems with gimer which I would address after I address with the other two instructions.

1. OTL went fine and smoothly so no problem there

2. DeFogger ran as instructed but did not asked me to reboot the computer so I manually reboot it myself and the defogger_disable log appeared on my desktop which I would post after I talk about the last instructions, including with all of the other logs.

Finally 3. With Gimer was probably the most difficult. The first time I ran it, nothing appeared with these instructions:

If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.


The program ran fine however and when it was finished I clicked the save button, only for it to freeze my computer up, I had to do a hard reboot.

The second time I did it the same exact thing happened only this time it froze while it was scanning. So I cannot produce a log for you with gimer.

Anyway here is all the other logs and thank you once again.

OTL logfile created on: 9/26/2010 7:26:12 AM - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Documents and Settings\Owner.amarlowe\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 73.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 89.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 292.74 Gb Total Space | 276.02 Gb Free Space | 94.29% Space Free | Partition Type: NTFS
Drive D: | 5.33 Gb Total Space | 1.73 Gb Free Space | 32.48% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 232.83 Gb Total Space | 227.17 Gb Free Space | 97.57% Space Free | Partition Type: FAT32

Computer Name: AMARLOWE
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Owner.amarlowe\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe (Kaspersky Lab ZAO)
PRC - C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe (Affinegy, Inc.)
PRC - C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe (Affinegy, Inc.)
PRC - C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe (Affinegy, Inc.)
PRC - C:\Program Files\OpenDNS Updater\OpenDNSUpdater.exe ()
PRC - C:\Program Files\Secunia\PSI\psi.exe (Secunia)
PRC - C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS (New Boundary Technologies, Inc.)
PRC - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe (Intel Corporation)
PRC - C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files\Digital Media Reader\readericon45G.exe (Alcor Micro, Corp.)
PRC - C:\WINDOWS\arservice.exe (Microsoft)
PRC - C:\WINDOWS\mHotkey.exe ()
PRC - C:\WINDOWS\CNYHKey.exe (Chicony)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Owner.amarlowe\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (ACDaemon) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe File not found
SRV - (AVP) – C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe (Kaspersky Lab ZAO)
SRV - (AffinegyService) – C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe (Affinegy, Inc.)
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies)
SRV - (PrismXL) – C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS (New Boundary Technologies, Inc.)
SRV - (AlertService) Intel® – C:\Program Files\Intel\IntelDH\CCU\AlertService.exe (Intel Corporation)
SRV - (Remote UI Service) Intel® – C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe (Intel Corporation)
SRV - (MCLServiceATL) Intel® – C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe (Intel Corporation)
SRV - (ELService) Intel® – C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\ELService.exe (Intel Corporation)
SRV - (ISSM) Intel® – C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe (Intel Corporation)
SRV - (M1 Server) Intel® Viiv™ – C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe ()
SRV - (IAANTMON) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (ARSVC) – C:\WINDOWS\arservice.exe (Microsoft)


========== Driver Services (SafeList) ==========

DRV - (cpuz130) – C:\DOCUME~1\OWNER~1.AMA\LOCALS~1\Temp\cpuz130\cpuz_x32.sys File not found
DRV - (AFGMp50) – C:\WINDOWS\System32\Drivers\AFGMp50.sys File not found
DRV - (KLIF) – C:\WINDOWS\system32\drivers\klif.sys (Kaspersky Lab)
DRV - (kl2) – C:\WINDOWS\system32\drivers\kl2.sys (Kaspersky Lab ZAO)
DRV - (KL1) – C:\WINDOWS\system32\DRIVERS\kl1.sys (Kaspersky Lab ZAO)
DRV - (PSI) – C:\WINDOWS\system32\drivers\psi_mf.sys (Secunia)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (klim5) – C:\WINDOWS\system32\drivers\klim5.sys (Kaspersky Lab ZAO)
DRV - (AFGSp50) – C:\WINDOWS\system32\drivers\AFGSp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (NPF) – C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (KeyScrambler) – C:\WINDOWS\system32\drivers\keyscrambler.sys (QFX Software Corporation)
DRV - (klmouflt) – C:\WINDOWS\system32\drivers\klmouflt.sys (Kaspersky Lab)
DRV - (amdagp) – C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) – C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (GoProto) – C:\WINDOWS\system32\drivers\goprot51.sys (Gteko Ltd.)
DRV - (TSHWMDTCP) – C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.sys ()
DRV - (e1express) Intel® – C:\WINDOWS\system32\drivers\e1e5132.sys (Intel Corporation)
DRV - (ELacpi) – C:\WINDOWS\system32\drivers\ELacpi.sys (Intel Corporation)
DRV - (ELmon) – C:\WINDOWS\system32\drivers\Elmon.sys (Intel Corporation)
DRV - (ELkbd) – C:\WINDOWS\system32\drivers\Elkbd.sys (Intel Corporation)
DRV - (ELmou) – C:\WINDOWS\system32\drivers\Elmou.sys (Intel Corporation)
DRV - (ELhid) – C:\WINDOWS\system32\drivers\Elhid.sys (Intel Corporation)
DRV - (iaStor) – C:\WINDOWS\SYSTEM32\DRIVERS\IASTOR.SYS (Intel Corporation)
DRV - (HECI) Intel® – C:\WINDOWS\system32\drivers\HECI.sys (Intel Corporation)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (hcwPP2) – C:\WINDOWS\system32\drivers\hcwPP2.sys (Hauppauge Computer Works, Inc.)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (sfng32) – C:\WINDOWS\system32\drivers\sfng32.sys (Sonic Focus, Inc)
DRV - (HSF_DPV) – C:\WINDOWS\system32\drivers\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (HSFHWBS2) – C:\WINDOWS\system32\drivers\HSFHWBS2.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (Cdralw2k) – C:\WINDOWS\System32\drivers\cdralw2k.sys (Roxio)
DRV - (Cdr4_xp) – C:\WINDOWS\System32\drivers\cdr4_xp.sys (Roxio)
DRV - (Ser2pl) – C:\WINDOWS\system32\drivers\ser2pl.sys (Prolific Technology Inc.)
DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)
DRV - (Sparrow) – C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) – C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) – C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) – C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) – C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (ultra) – C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) – C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) – C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) – C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) – C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) – C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) – C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) – C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) – C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (CmdIde) – C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (Aspi32) – C:\WINDOWS\System32\drivers\aspi32.sys (Adaptec)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/webhp?hl=en
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = A4 2D 2F D4 FE 45 CB 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "about:blank"
FF - prefs.js..extensions.enabledItems: [removed]:11.0.1.400
FF - prefs.js..extensions.enabledItems: [removed]:11.0.1.400
FF - prefs.js..extensions.enabledItems: [removed]:1.0.6
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: {35106bca-6c78-48c7-ac28-56df30b51d2a}:1.3.8
FF - prefs.js..extensions.enabledItems: {35106bca-6c78-48c7-ac28-56df30b51d2c}:0.6.4
FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.11
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:[removed]
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100908
FF - prefs.js..extensions.enabledItems: {ada4b710-8346-4b82-8199-5de2b400a6ae}:[removed]
FF - prefs.js..extensions.enabledItems: {c07d1a49-9894-49ff-a594-38960ede8fb9}:3.1.3
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.2
FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.48.3
FF - prefs.js..extensions.enabledItems: {DCBD1271-D228-4082-9FBC-36D9B7660B03}:[removed]
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..extensions.enabledItems: {FDD8ECF0-451A-414D-8C8F-7B7F78B0ECD3}:1.3.5
FF - prefs.js..extensions.enabledItems: {1a278477-6ffd-4c99-af57-813c6d05511c}:0.3.3
FF - prefs.js..extensions.enabledItems: yetanothersmoothscrolling@kataho:3.0.14
FF - prefs.js..extensions.enabledItems: [removed]:2.23b2
FF - prefs.js..extensions.enabledItems: {097d3191-e6fa-4728-9826-b533d755359d}:0.7.11
FF - prefs.js..extensions.enabledItems: {FD61379B-066A-4afc-89DE-89FB24D907C2}:0.6.2010043001
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: {1de0de3c-0b5c-4f67-90c6-689623894991}:0.3
FF - prefs.js..extensions.enabledItems: {57068FBE-1506-42ee-AB02-BD183E7999E4}:3.1.1
FF - prefs.js..extensions.enabledItems: {1280606b-2510-4fe0-97ef-9b5a22eafe41}:1.0.9
FF - prefs.js..extensions.enabledItems: [removed]:0.0.10
FF - prefs.js..extensions.enabledItems: [removed]:1.0.5
FF - prefs.js..extensions.enabledItems: [removed]:0.4.1
FF - prefs.js..extensions.enabledItems: [removed]:2.1.20100427


FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Documents and Settings\All Users\Application Data\Mozilla Firefox\components [2010/09/15 22:59:40 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Documents and Settings\All Users\Application Data\Mozilla Firefox\plugins [2010/09/21 07:38:05 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\THBExt [2010/09/07 19:15:27 | 000,000,000 | —D | M]

[2010/08/28 18:48:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Extensions
[2010/08/28 18:48:48 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Extensions\{a463f10c-3994-11da-9945-000d60ca027b}
[2010/09/23 09:39:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions
[2010/09/19 21:34:24 | 000,000,000 | —D | M] (All-in-One Sidebar) – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\{097d3191-e6fa-4728-9826-b533d755359d}
[2010/09/20 07:55:17 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe41}
[2010/09/19 21:26:06 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\{1a278477-6ffd-4c99-af57-813c6d05511c}
[2010/09/19 22:32:17 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\{1de0de3c-0b5c-4f67-90c6-689623894991}
[2010/09/13 09:25:48 | 000,000,000 | —D | M] (Linkification) – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\{35106bca-6c78-48c7-ac28-56df30b51d2a}
[2010/09/13 09:25:48 | 000,000,000 | —D | M] (Organize Status Bar) – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\{35106bca-6c78-48c7-ac28-56df30b51d2c}
[2010/09/13 09:25:50 | 000,000,000 | —D | M] (Stylish) – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
[2010/09/20 07:47:23 | 000,000,000 | —D | M] (Compact Menu 2) – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\{57068FBE-1506-42ee-AB02-BD183E7999E4}
[2010/09/22 10:49:42 | 000,000,000 | —D | M] (NoScript) – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010/09/13 09:25:50 | 000,000,000 | —D | M] (WOT) – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010/09/13 09:25:50 | 000,000,000 | —D | M] (ReminderFox) – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\{ada4b710-8346-4b82-8199-5de2b400a6ae}
[2010/09/13 09:25:50 | 000,000,000 | —D | M] (Update Scanner) – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\{c07d1a49-9894-49ff-a594-38960ede8fb9}
[2010/09/13 09:25:50 | 000,000,000 | —D | M] (Adblock Plus) – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/09/13 09:25:50 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}
[2010/09/13 09:25:51 | 000,000,000 | —D | M] () – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\{DCBD1271-D228-4082-9FBC-36D9B7660B03}
[2010/09/13 09:25:51 | 000,000,000 | —D | M] (Greasemonkey) – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010/09/19 21:34:23 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\{FD61379B-066A-4afc-89DE-89FB24D907C2}
[2010/09/13 09:39:38 | 000,000,000 | —D | M] (IE View Lite) – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\{FDD8ECF0-451A-414D-8C8F-7B7F78B0ECD3}
[2010/09/20 09:11:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\[removed]
[2010/09/13 09:39:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\[removed]
[2010/09/19 21:26:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\[removed]
[2010/09/13 09:25:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\[removed]
[2010/09/20 09:31:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\[removed]
[2010/09/20 07:52:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\[removed]
[2010/09/20 07:52:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\[removed]
[2010/09/19 22:05:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\[removed]
[2010/09/22 10:49:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\yetanothersmoothscrolling@kataho
[2010/09/20 19:42:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla\Firefox\Profiles\5flo5h6d.Default User\extensions\[removed]

O1 HOSTS File: ([2010/09/23 09:19:19 | 000,515,651 | —- | M]) - C:\WINDOWS\system32\drivers\etc\HOSTS
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 fr.a2dfp.net
O1 - Hosts: 127.0.0.1 m.fr.a2dfp.net
O1 - Hosts: 127.0.0.1 ad.a8.net
O1 - Hosts: 127.0.0.1 asy.a8ww.net
O1 - Hosts: 127.0.0.1 abcstats.com
O1 - Hosts: 127.0.0.1 a.abv.bg
O1 - Hosts: 127.0.0.1 adserver.abv.bg
O1 - Hosts: 127.0.0.1 adv.abv.bg
O1 - Hosts: 127.0.0.1 bimg.abv.bg
O1 - Hosts: 127.0.0.1 ca.abv.bg
O1 - Hosts: 127.0.0.1 www2.a-counter.kiev.ua
O1 - Hosts: 127.0.0.1 track.acclaimnetwork.com
O1 - Hosts: 127.0.0.1 accuserveadsystem.com
O1 - Hosts: 127.0.0.1 www.accuserveadsystem.com
O1 - Hosts: 127.0.0.1 achmedia.com
O1 - Hosts: 127.0.0.1 aconti.net
O1 - Hosts: 127.0.0.1 secure.aconti.net
O1 - Hosts: 127.0.0.1 www.aconti.net #[Dialer.Aconti]
O1 - Hosts: 127.0.0.1 ads.active.com
O1 - Hosts: 127.0.0.1 am1.activemeter.com
O1 - Hosts: 127.0.0.1 www.activemeter.com #[Tracking.Cookie]
O1 - Hosts: 127.0.0.1 ads.activepower.net
O1 - Hosts: 127.0.0.1 stat.active24stats.nl #[Tracking.Cookie]
O1 - Hosts: 127.0.0.1 ad2games.com
O1 - Hosts: 14746 more lines…
O2 - BHO: (no name) - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - Reg Error: Value error. File not found
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - Reg Error: Value error. File not found
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (WOT Helper) - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O3 - HKLM\..\Toolbar: (WOT) - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {23B0D39A-E245-41B7-BF86-1238CF62625E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (WOT) - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
O4 - HKLM..\Run: [AlwaysReady Power Message APP] C:\WINDOWS\arpwrmsg.exe (Microsoft)
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [CCUTRAYICON] C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [CHotkey] C:\WINDOWS\mHotkey.exe ()
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [InstaLAN] C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe (Affinegy, Inc.)
O4 - HKLM..\Run: [IntelAudioStudio] C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe (Intel Corporation)
O4 - HKLM..\Run: [ledpointer] C:\WINDOWS\CNYHKey.exe (Chicony)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [readericon] C:\Program Files\Digital Media Reader\readericon45G.exe (Alcor Micro, Corp.)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [showwnd] C:\WINDOWS\ShowWnd.exe ()
O4 - HKCU..\Run: [OpenDNS Updater] C:\Program Files\OpenDNS Updater\OpenDNSUpdater.exe ()
O4 - Startup: C:\Documents and Settings\Owner.amarlowe\Start Menu\Programs\Startup\Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe (Secunia)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme File not found
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ie_banner_deny.htm ()
O9 - Extra Button: &Virtual; Keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra 'Tools' menuitem : &KeyScrambler; Options - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - Reg Error: Value error. File not found
O9 - Extra Button: URLs c&heck; - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Reg Error: Key error.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {B9F79165-A264-4C4A-A211-133A5E8D647F} http://support.f-secure.com/enu/home/onlin…/fshc/fscax.cab (Reg Error: Key error.)
O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} http://office.microsoft.com/officeupdate/content/opuc4.cab (Office Update Installation Engine)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} Reg Error: Value error. (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\wot {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\mzvkbd3.dll (Kaspersky Lab ZAO)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\kloehk.dll (Kaspersky Lab ZAO)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab ZAO)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner.amarlowe\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner.amarlowe\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {4F07DA45-8170-4859-9B5F-037EF2970034} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/06/17 05:41:16 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2006/08/08 09:59:46 | 000,000,000 | —D | M] - J:\autorun – [ FAT32 ]
O33 - MountPoints2\{12093205-a542-11dd-8eb1-001676dfe735}\Shell - "" = AutoRun
O33 - MountPoints2\{12093205-a542-11dd-8eb1-001676dfe735}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{12093205-a542-11dd-8eb1-001676dfe735}\Shell\AutoRun\command - "" = K:\LaunchU3.exe – File not found
O33 - MountPoints2\K\Shell - "" = AutoRun
O33 - MountPoints2\K\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\K\Shell\AutoRun\command - "" = K:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.clmp3enc - C:\PROGRA~1\CYBERL~1\Power2Go\CLMP3Enc.ACM File not found
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (17746534284132352)

========== Files/Folders - Created Within 90 Days ==========

[2010/09/26 07:24:48 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Owner.amarlowe\Recent
[2010/09/26 07:22:06 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner.amarlowe\Desktop\OTL.exe
[2010/09/25 08:44:21 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Owner.amarlowe\Desktop\HiJackThis.exe
[2010/09/22 20:34:10 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.amarlowe\Local Settings\Application Data\Agenda
[2010/09/22 20:32:09 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.amarlowe\Local Settings\Application Data\multiWeather
[2010/09/22 19:43:23 | 000,737,280 | —- | C] (Indigo Rose Corporation) – C:\WINDOWS\iun6002.exe
[2010/09/22 14:21:59 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.amarlowe\Local Settings\Application Data\Opera
[2010/09/22 14:21:59 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.amarlowe\Application Data\Opera
[2010/09/22 14:21:42 | 000,000,000 | —D | C] – C:\Program Files\Opera
[2010/09/17 22:51:18 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.amarlowe\Application Data\acccore
[2010/09/17 22:51:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.amarlowe\Local Settings\Application Data\AIM
[2010/09/17 22:51:12 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AIM
[2010/09/17 22:51:07 | 000,000,000 | —D | C] – C:\Program Files\AIM
[2010/09/17 22:40:10 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2010/09/16 17:53:19 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2010/09/16 17:52:49 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Apple
[2010/09/16 17:52:32 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Apple
[2010/09/13 07:27:48 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.amarlowe\Application Data\vlc
[2010/09/12 16:17:47 | 000,471,432 | -H– | C] (SpeedyFox) – C:\Documents and Settings\Owner.amarlowe\My Documents\speedyfox.exe
[2010/09/07 19:14:53 | 000,000,000 | —D | C] – C:\Program Files\Kaspersky Lab
[2010/09/07 19:14:53 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
[2010/09/07 19:14:30 | 000,475,736 | —- | C] (Kaspersky Lab) – C:\WINDOWS\System32\drivers\klif.sys
[2010/09/07 19:12:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
[2010/09/06 14:57:47 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.amarlowe\Application Data\Auslogics
[2010/09/06 14:56:19 | 000,000,000 | —D | C] – C:\Program Files\Auslogics
[2010/09/03 11:04:35 | 000,000,000 | —D | C] – C:\Program Files\VideoLAN
[2010/09/02 16:12:21 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2010/09/02 16:11:01 | 000,000,000 | —D | C] – C:\Program Files\SpywareBlaster
[2010/08/31 10:49:50 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.amarlowe\Application Data\Apple Computer
[2010/08/31 09:23:58 | 000,000,000 | —D | C] – C:\Program Files\WOT
[2010/08/30 15:31:04 | 000,114,952 | —- | C] (QFX Software Corporation) – C:\WINDOWS\System32\drivers\keyscrambler.sys
[2010/08/30 15:31:04 | 000,000,000 | —D | C] – C:\Program Files\KeyScrambler
[2010/08/26 19:25:09 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.amarlowe\Local Settings\Application Data\Mozilla
[2010/08/26 19:25:09 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.amarlowe\Application Data\Mozilla
[2010/08/26 19:24:56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Mozilla Firefox
[2010/08/18 09:43:12 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Apple Computer
[2010/08/18 09:42:09 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.amarlowe\Local Settings\Application Data\Apple Computer
[2010/08/13 00:18:57 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/08/13 00:18:24 | 000,000,000 | —D | C] – C:\Program Files\Java
[2010/08/06 13:07:36 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.amarlowe\Application Data\Foxit Software
[2010/08/06 13:06:44 | 000,000,000 | —D | C] – C:\Program Files\Foxit Software
[2010/07/31 08:18:00 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.amarlowe\Application Data\SUPERAntiSpyware.com
[2010/07/31 08:18:00 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2010/07/31 08:17:30 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2010/07/29 10:16:14 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.amarlowe\My Documents\Registry backup
[2010/07/20 14:22:03 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Belkin
[2010/07/20 14:17:37 | 000,027,072 | —- | C] (Printing Communications Assoc., Inc. (PCAUSA)) – C:\WINDOWS\System32\drivers\AFGSp50.sys
[2010/07/20 14:17:18 | 000,032,512 | —- | C] (CACE Technologies) – C:\WINDOWS\System32\drivers\npf.sys
[2010/07/20 14:17:17 | 000,233,472 | —- | C] (CACE Technologies) – C:\WINDOWS\System32\wpcap.dll
[2010/07/20 14:17:17 | 000,081,920 | —- | C] (CACE Technologies) – C:\WINDOWS\System32\packet.dll
[2010/07/20 14:17:17 | 000,061,440 | —- | C] (CACE Technologies) – C:\WINDOWS\System32\wanpacket.dll
[2010/07/20 14:17:17 | 000,000,000 | —D | C] – C:\Program Files\WinPcap
[2010/07/20 14:17:12 | 000,000,000 | —D | C] – C:\Program Files\Belkin
[2010/07/20 14:17:12 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Affinegy
[2010/07/20 07:05:59 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Adobe
[2010/07/20 07:04:41 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.amarlowe\Local Settings\Application Data\Adobe
[2010/07/16 22:28:56 | 000,000,000 | —D | C] – C:\Program Files\GIMP-2.0
[2010/07/15 07:54:41 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.amarlowe\Application Data\OpenDNS Updater
[2010/07/15 07:54:34 | 000,000,000 | —D | C] – C:\Program Files\OpenDNS Updater
[2010/07/07 16:59:04 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.amarlowe\My Documents\Boost Mobile
[2010/07/06 14:37:38 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.amarlowe\My Documents\Web
[2010/07/01 21:35:12 | 000,228,024 | —- | C] (Kaspersky Lab ZAO) – C:\WINDOWS\System32\klogon.dll
[2010/06/30 22:01:00 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.amarlowe\My Documents\rent prospect st
[2010/06/28 19:26:05 | 000,000,000 | —D | C] – C:\WINDOWS\System32\appmgmt
[2010/06/28 12:23:58 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.amarlowe\Local Settings\Application Data\PCHealth
[2010/06/28 12:23:56 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\PCHealth

========== Files - Modified Within 90 Days ==========

[2010/09/26 07:22:06 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner.amarlowe\Desktop\OTL.exe
[2010/09/26 07:18:12 | 000,000,392 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{406DD865-D8AB-4400-9774-7CDE1C72CD42}.job
[2010/09/26 07:16:25 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/09/26 07:15:49 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/09/26 07:15:43 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/09/26 07:15:41 | 2128,384,000 | -HS- | M] () – C:\hiberfil.sys
[2010/09/26 01:13:43 | 018,350,080 | —- | M] () – C:\Documents and Settings\Owner.amarlowe\ntuser.dat
[2010/09/26 01:13:43 | 000,000,278 | -HS- | M] () – C:\Documents and Settings\Owner.amarlowe\ntuser.ini
[2010/09/25 17:44:06 | 000,000,495 | —- | M] () – C:\WINDOWS\lexstat.ini
[2010/09/25 08:44:21 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Owner.amarlowe\Desktop\HiJackThis.exe
[2010/09/23 09:19:19 | 000,515,651 | —- | M] () – C:\WINDOWS\System32\drivers\etc\HOSTS
[2010/09/22 19:43:07 | 000,737,280 | —- | M] (Indigo Rose Corporation) – C:\WINDOWS\iun6002.exe
[2010/09/22 14:21:43 | 000,000,592 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Opera.lnk
[2010/09/17 22:51:16 | 000,002,602 | -H– | M] () – C:\IPH.PH
[2010/09/17 22:51:11 | 000,001,594 | —- | M] () – C:\Documents and Settings\Owner.amarlowe\Application Data\Microsoft\Internet Explorer\Quick Launch\AIM.lnk
[2010/09/17 12:15:18 | 000,093,408 | -H– | M] () – C:\WINDOWS\System32\mlfcache.dat
[2010/09/15 08:38:55 | 000,001,185 | —- | M] () – C:\WINDOWS\win.ini
[2010/09/14 14:16:13 | 000,475,736 | —- | M] (Kaspersky Lab) – C:\WINDOWS\System32\drivers\klif.sys
[2010/09/12 16:17:48 | 000,471,432 | -H– | M] (SpeedyFox) – C:\Documents and Settings\Owner.amarlowe\My Documents\speedyfox.exe
[2010/09/11 23:41:44 | 018,350,080 | —- | M] () – C:\Documents and Settings\Owner.amarlowe\ntuser.bak
[2010/09/11 19:08:47 | 000,005,164 | —- | M] () – C:\Documents and Settings\Owner.amarlowe\.recently-used.xbel
[2010/09/07 19:16:05 | 000,113,933 | —- | M] () – C:\WINDOWS\System32\drivers\klin.dat
[2010/09/07 19:16:05 | 000,097,549 | —- | M] () – C:\WINDOWS\System32\drivers\klick.dat
[2010/08/29 15:26:46 | 000,277,095 | —- | M] () – C:\Documents and Settings\Owner.amarlowe\My Documents\Maggie Moo coupons.png
[2010/08/26 19:24:59 | 000,001,984 | —- | M] () – C:\Documents and Settings\Owner.amarlowe\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/08/26 19:24:59 | 000,001,940 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/08/24 19:29:23 | 000,024,576 | —- | M] () – C:\Documents and Settings\Owner.amarlowe\My Documents\Roliana hangout code.doc
[2010/08/18 17:18:06 | 000,514,680 | —- | M] () – C:\WINDOWS\System32\drivers\etc\HOSTS.bak
[2010/08/11 17:47:02 | 000,794,752 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/08/11 17:39:20 | 000,540,332 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/08/11 17:39:20 | 000,468,570 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/08/11 17:39:20 | 000,082,502 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/07/28 16:11:53 | 000,318,010 | —- | M] () – C:\Documents and Settings\Owner.amarlowe\My Documents\Famous Dave menu.PDF
[2010/07/28 14:17:23 | 000,111,616 | —- | M] () – C:\Documents and Settings\Owner.amarlowe\My Documents\oldBay Coupons.doc
[2010/07/20 14:20:37 | 000,000,089 | —- | M] () – C:\WINDOWS\System32\drivers\etc\lmhosts
[2010/07/01 21:35:12 | 000,228,024 | —- | M] (Kaspersky Lab ZAO) – C:\WINDOWS\System32\klogon.dll
[2010/06/30 22:01:21 | 000,001,308 | —- | M] () – C:\Documents and Settings\Owner.amarlowe\Application Data\wklnhst.dat
[2010/06/29 08:51:20 | 000,084,480 | —- | M] () – C:\Documents and Settings\Owner.amarlowe\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/28 19:19:19 | 000,000,815 | —- | M] () – C:\Documents and Settings\Owner.amarlowe\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

========== Files Created - No Company Name ==========

[2010/09/22 14:21:43 | 000,000,592 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Opera.lnk
[2010/09/17 22:51:11 | 000,001,594 | —- | C] () – C:\Documents and Settings\Owner.amarlowe\Application Data\Microsoft\Internet Explorer\Quick Launch\AIM.lnk
[2010/09/17 12:15:18 | 000,093,408 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2010/09/11 23:41:28 | 000,028,672 | -H– | C] () – C:\Documents and Settings\Owner.amarlowe\ntuser.tmp.LOG
[2010/09/11 19:08:47 | 000,005,164 | —- | C] () – C:\Documents and Settings\Owner.amarlowe\.recently-used.xbel
[2010/09/11 14:29:31 | 018,350,080 | —- | C] () – C:\Documents and Settings\Owner.amarlowe\ntuser.dat
[2010/09/07 19:16:05 | 000,113,933 | —- | C] () – C:\WINDOWS\System32\drivers\klin.dat
[2010/09/07 19:16:05 | 000,097,549 | —- | C] () – C:\WINDOWS\System32\drivers\klick.dat
[2010/08/29 15:26:44 | 000,277,095 | —- | C] () – C:\Documents and Settings\Owner.amarlowe\My Documents\Maggie Moo coupons.png
[2010/08/26 19:24:59 | 000,001,984 | —- | C] () – C:\Documents and Settings\Owner.amarlowe\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/08/26 19:24:59 | 000,001,940 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/08/16 23:06:18 | 2128,384,000 | -HS- | C] () – C:\hiberfil.sys
[2010/07/28 16:12:18 | 000,318,010 | —- | C] () – C:\Documents and Settings\Owner.amarlowe\My Documents\Famous Dave menu.PDF
[2010/07/28 14:17:23 | 000,111,616 | —- | C] () – C:\Documents and Settings\Owner.amarlowe\My Documents\oldBay Coupons.doc
[2010/07/20 14:17:17 | 000,057,395 | —- | C] () – C:\WINDOWS\System32\pthreadVC.dll
[2010/07/19 07:44:57 | 018,350,080 | —- | C] () – C:\Documents and Settings\Owner.amarlowe\ntuser.bak
[2010/03/27 13:44:28 | 000,043,520 | —- | C] () – C:\WINDOWS\System32\CmdLineExt03.dll
[2010/01/30 15:44:02 | 000,000,088 | RHS- | C] () – C:\Documents and Settings\All Users\Application Data\76449CB090.sys
[2010/01/30 15:44:01 | 000,002,516 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
[2009/12/10 16:26:38 | 000,041,047 | —- | C] () – C:\WINDOWS\System32\ActPanel.dll
[2009/09/24 09:29:26 | 000,000,066 | —- | C] () – C:\WINDOWS\wininit.ini
[2009/05/29 18:47:13 | 000,000,130 | —- | C] () – C:\WINDOWS\cfplogvw.INI
[2009/05/01 00:31:06 | 001,466,368 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2009/03/20 21:13:08 | 000,168,208 | —- | C] () – C:\WINDOWS\System32\guard32(2)(2).dll
[2009/03/20 21:12:36 | 000,000,120 | —- | C] () – C:\WINDOWS\CIS_Setup_3.5.57173.439_XP_Vista_x32.INI
[2008/12/19 15:11:52 | 000,000,000 | —- | C] () – C:\WINDOWS\WB.ini
[2008/01/04 22:47:51 | 000,000,038 | —- | C] () – C:\WINDOWS\3D Text Factory.INI
[2007/12/02 18:09:59 | 000,000,031 | -H– | C] () – C:\WINDOWS\uccspecc.sys
[2007/11/04 22:02:47 | 000,000,019 | —- | C] () – C:\WINDOWS\addrem.ini
[2007/09/29 20:14:00 | 000,001,308 | —- | C] () – C:\Documents and Settings\Owner.amarlowe\Application Data\wklnhst.dat
[2007/06/09 19:24:00 | 000,000,126 | —- | C] () – C:\WINDOWS\srxAdmin.INI
[2007/06/07 17:24:41 | 000,002,560 | —- | C] () – C:\Documents and Settings\Owner.amarlowe\Application Data\Default.cls
[2007/06/07 17:20:19 | 000,002,560 | —- | C] () – C:\Documents and Settings\Owner.amarlowe\Application Data\AceFTP Storage.ftp
[2007/06/07 17:18:56 | 000,014,336 | —- | C] () – C:\Documents and Settings\Owner.amarlowe\Application Data\Settings.cfg
[2007/05/26 20:56:57 | 000,084,480 | —- | C] () – C:\Documents and Settings\Owner.amarlowe\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/05/26 19:01:56 | 000,023,552 | —- | C] () – C:\WINDOWS\System32\jesterss.dll
[2007/05/26 18:52:08 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2007/05/26 18:50:20 | 000,532,544 | —- | C] () – C:\WINDOWS\PIC.dll
[2007/05/26 18:50:20 | 000,049,152 | —- | C] () – C:\WINDOWS\CNYUSB.dll
[2007/05/26 18:50:20 | 000,024,576 | —- | C] () – C:\WINDOWS\HKNTDLL.dll
[2007/05/26 18:50:20 | 000,011,776 | —- | C] () – C:\WINDOWS\HIDMNT.dll
[2007/05/26 18:50:20 | 000,005,120 | —- | C] () – C:\WINDOWS\HKCYDLL.dll
[2007/05/26 18:50:20 | 000,000,360 | —- | C] () – C:\WINDOWS\CNYHKey.ini
[2007/05/26 18:31:22 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2007/05/26 18:22:39 | 000,102,400 | —- | C] () – C:\WINDOWS\System32\hcwXDS.dll
[2007/05/26 17:50:03 | 000,000,137 | —- | C] () – C:\Documents and Settings\Owner.amarlowe\Local Settings\Application Data\fusioncache.dat
[2007/05/26 16:34:35 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2007/05/26 16:26:05 | 000,000,495 | —- | C] () – C:\WINDOWS\lexstat.ini
[2007/03/05 14:34:28 | 000,676,224 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.DLL
[2006/06/21 05:48:15 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/06/17 05:24:58 | 000,001,280 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2006/06/17 05:24:57 | 000,000,522 | —- | C] () – C:\WINDOWS\System32\emver.ini
[2006/01/04 21:28:00 | 001,662,976 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2006/01/04 21:28:00 | 001,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2006/01/04 21:28:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2005/10/14 16:04:44 | 000,019,968 | —- | C] () – C:\WINDOWS\System32\cpuinf32.dll
[2005/08/06 00:01:54 | 000,235,008 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2005/08/02 19:19:16 | 000,050,176 | —- | C] () – C:\WINDOWS\armcex.dll
[2003/03/26 10:19:44 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\LXBLLCNP.DLL
[2003/01/07 18:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/11/13 11:40:22 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxblvs.dll
[1996/02/23 17:34:48 | 000,014,629 | —- | C] () – C:\WINDOWS\System32\Declw.dll
[1996/02/22 15:09:20 | 000,032,256 | —- | C] () – C:\WINDOWS\System32\Decln.dll

========== LOP Check ==========

[2010/03/06 21:55:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\abelhadigital.com
[2009/05/21 21:15:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\acccore
[2009/03/19 16:35:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\acccore(2)
[2010/09/23 17:40:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Affinegy
[2010/09/17 22:51:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AIM
[2010/07/20 14:22:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Belkin
[2009/01/01 20:20:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Broderbund Software
[2007/06/06 20:36:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GlobalSCAPE
[2008/08/11 11:14:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MailFrontier
[2009/11/13 19:21:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PlayFirst
[2010/09/24 08:42:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2007/06/09 19:14:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Titan
[2010/03/06 21:55:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\abelhadigital.com
[2010/09/17 22:51:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\acccore
[2009/03/20 17:41:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\acccore(2)
[2010/09/06 14:57:47 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Auslogics
[2007/06/07 17:18:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Dynamic
[2008/08/21 22:43:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Fingerfox (SE)
[2010/03/02 21:01:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\FireShot
[2010/08/06 13:07:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Foxit Software
[2010/08/24 15:52:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\gtk-2.0
[2008/10/12 21:42:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Leadertech
[2009/09/22 10:27:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\MiniDm
[2009/05/31 10:29:26 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\OfficeUpdate12
[2010/07/15 07:54:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\OpenDNS Updater
[2010/09/24 16:24:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Opera
[2009/11/13 19:21:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\PlayFirst
[2008/08/21 20:46:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Popular Sites
[2009/06/22 14:13:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Sony
[2007/09/29 20:14:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner.amarlowe\Application Data\Template
[2010/09/26 07:18:12 | 000,000,392 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{406DD865-D8AB-4400-9774-7CDE1C72CD42}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2007/05/26 18:49:51 | 000,000,002 | —- | M] () – C:\AUDIT_INSTALL_IN_PROGRESS
[2006/06/17 05:41:16 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2007/05/26 16:19:33 | 000,000,209 | —- | M] () – C:\Boot.bak
[2009/06/08 05:19:06 | 000,000,279 | RHS- | M] () – C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | —- | M] () – C:\cmldr
[2006/06/17 05:41:16 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2010/09/26 07:15:41 | 2128,384,000 | -HS- | M] () – C:\hiberfil.sys
[2006/06/17 05:41:16 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/09/17 22:51:16 | 000,002,602 | -H– | M] () – C:\IPH.PH
[2006/06/17 05:41:16 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/10 15:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/05/09 22:33:38 | 000,250,048 | RHS- | M] () – C:\ntldr
[2010/09/26 07:15:39 | 2145,386,496 | -HS- | M] () – C:\pagefile.sys
[2007/05/26 19:08:21 | 000,000,000 | —- | M] () – C:\REQUEST_OEMRESET_ENDUSER
[2007/05/26 18:42:23 | 000,000,002 | RHS- | M] () – C:\USER
[2007/11/07 09:09:22 | 001,442,522 | —- | M] () – C:\VC_RED.cab

< %systemroot%\Fonts\*.com >
[2006/04/18 16:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 15:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 16:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 15:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/06/17 05:40:30 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 08:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2003/07/29 05:36:00 | 000,078,336 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\LXBLPP5C.DLL
[2007/04/09 13:23:54 | 000,028,552 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 06:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2006/10/31 22:32:30 | 001,559,056 | —- | M] (XMLAuthor Inc.) – C:\WINDOWS\screengenie.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/06/16 22:30:11 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2006/06/16 22:30:11 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2006/06/16 22:30:11 | 000,897,024 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2008/05/09 22:37:34 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2007/05/26 16:19:57 | 000,000,170 | -HS- | M] () – C:\Documents and Settings\Owner.amarlowe\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2006/06/17 05:46:25 | 000,000,079 | —- | M] () – C:\Documents and Settings\Owner.amarlowe\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2010/09/25 08:44:21 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Owner.amarlowe\Desktop\HiJackThis.exe
[2010/09/26 07:22:06 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner.amarlowe\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >
[2010/09/12 16:17:48 | 000,471,432 | -H– | M] (SpeedyFox) – C:\Documents and Settings\Owner.amarlowe\My Documents\speedyfox.exe

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2007/05/26 16:19:56 | 000,000,122 | -HS- | M] () – C:\Documents and Settings\Owner.amarlowe\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2009/03/24 20:40:38 | 000,000,440 | RHS- | M] () – C:\Documents and Settings\All Users\ntuser.pol

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >
No captured output from command…

< dir /b "%systemroot%\*.exe" | find /i " " /c >
No captured output from command…

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2010/08/27 11:44:15 | 000,000,067 | -HS- | M] () – C:\Documents and Settings\Owner.amarlowe\Cookies\desktop.ini
[2010/09/26 07:31:16 | 000,032,768 | —- | M] () – C:\Documents and Settings\Owner.amarlowe\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2007/06/26 22:10:26 | 000,317,440 | —- | M] (Microsoft Corporation) – C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.exe >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >
[1999/09/10 07:06:00 | 000,004,672 | —- | M] (Adaptec) – C:\WINDOWS\system\wowpost.exe

< %USERPROFILE%\Templates\*.tmp >

< %SYSTEMDRIVE%\explorexxx.exe\*.* >

< %Windir%\Installer\*.tmp >
[205 C:\WINDOWS\Installer\*.tmp files -> C:\WINDOWS\Installer\*.tmp -> ]

< %systemroot%\System32\*.xco >

< %ProgramFiles%\system32\*.* >

< %systemroot%\System32\windos\*.* >

< %SystemRoot%\system32\sandbox\*.* >

< %SystemRoot%\system32\*.amo >

< %SystemRoot%\system32\Windows Live\*.* >

< %ProgramFiles%\logs\*.* >

< %ProgramFiles%\Bifrost\*.* >

< %SystemRoot%\system32\*.goo >

< %systemroot%\system32\IME\*.* >

< %systemroot%\BackUp\*.* >

< %systemroot%\system32\*.ico >
[2006/04/21 12:50:03 | 000,001,150 | —- | M] () – C:\WINDOWS\system32\gtw.ico
[2007/12/30 10:59:44 | 000,001,406 | —- | M] () – C:\WINDOWS\system32\Help.ico
[2007/12/30 10:59:44 | 000,002,550 | —- | M] () – C:\WINDOWS\system32\Uninstall.ico

< %systemroot%\system\*.dat >

< %systemroot%\system\*.exe >
[1999/09/10 07:06:00 | 000,004,672 | —- | M] (Adaptec) – C:\WINDOWS\system\wowpost.exe

< %AppData%\Macromedia\Common\*.* >

< %SYSTEMDRIVE%\dir\*.* /s >

< %systemroot%\system32\ras\*.exe >

< %SYSTEMDRIVE%\MFILES\*.* >

< %SYSTEMDRIVE%\mDNSRespon.exe\*.* >

< %systemroot%\system32\services\*.* >

< %systemroot%\Spooler\*.* >

< %ProgramFiles%\system32\*.* >

< %systemroot%\system32\Setup\*.dll /x >

< %systemroot%\system32\*.mine >

< %SYSTEMDRIVE%\cleansweep.exe\*.* >

< %systemroot%\system32\ras\*.dll >

< %systemroot%\system32\ras\*.drv >

< %systemroot%\*.iq >

< %systemroot%\system32\XP\*.* >

< %SYSTEMDRIVE%\Extracted\*.* >

< %systemroot%\system32\windows\*.* >

< %systemroot%\logs\*.* >

< %SYSTEMDRIVE%\Win.Msi\*.* >

< %systemroot%\regedit\*.* >

< %systemroot%\system32\skype\*.* >

< %AppData%\Adobe\dlluplwin25\*.* >

< %UserProfile%\*.dat >
[2010/09/26 01:13:43 | 018,350,080 | —- | M] () – C:\Documents and Settings\Owner.amarlowe\ntuser.dat

< %UserProfile%\*.dll >

< %systemroot%\system32\*.sxo >

< %SYSTEMDRIVE%\Gazma\*.* /s >

< %systemroot%\system32\spynet\*.* >

< %systemroot%\system32\System\*.* >

< %appdata%\Microsoft\Windows\*.* >

< %systemroot%\system32\WinDir\*.* >

< %systemroot%\_\*.* >

< %systemroot%\system32\windows32\*.* >

< %ProgramFiles%\win\*.* >

< %AppData%\Microsoft\CD Burning\*.* >

< %systemroot%\*.cab >

< %systemroot%\K.Backup\*.* >

< %ProgramFiles%\Massenger\*.* >

< %systemroot%\System32\*.doc >

< %systemroot%\Office12\*.* >

< %systemroot%\System32\Rundl32.exe\*.* >

< %ProgramFiles%\yahoo.net\*.* >

< %systemroot%\system32\*.igo >

< %systemroot%\*.rew >

< %systemroot%\System32\spool\DRIVERS\W32X86\3\*.exe >
[2001/01/19 11:50:20 | 000,040,960 | —- | M] () – C:\WINDOWS\system32\spool\drivers\w32x86\3\INSTMON.EXE
[2003/08/29 09:54:16 | 000,307,200 | —- | M] (Lexmark International, Inc.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\LEXBCES.EXE
[2000/02/09 04:35:42 | 000,170,496 | —- | M] (Lexmark International, Inc.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\lexdrvin.exe
[2002/05/09 10:25:40 | 000,024,576 | —- | M] () – C:\WINDOWS\system32\spool\drivers\w32x86\3\lexgo.EXE
[2003/08/29 10:07:48 | 000,155,648 | —- | M] (Lexmark International, Inc.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\LEXPING.EXE
[2003/08/29 09:50:24 | 000,174,592 | —- | M] (Lexmark International, Inc.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\LEXPPS.EXE
[2003/03/26 10:22:52 | 000,126,976 | —- | M] (Lexmark International, Inc.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\LXBLCFG.EXE
[2003/03/26 10:23:46 | 000,086,016 | —- | M] () – C:\WINDOWS\system32\spool\drivers\w32x86\3\LXBLIH.EXE
[2003/03/26 13:11:14 | 000,073,728 | —- | M] () – C:\WINDOWS\system32\spool\drivers\w32x86\3\LXBLJSWX.EXE
[2003/03/26 10:27:22 | 000,544,768 | —- | M] (Lexmark International, Inc.) – C:\WINDOWS\system32\spool\drivers\w32x86\3\LXBLLSNT.EXE
[2003/03/20 11:53:30 | 000,110,592 | —- | M] () – C:\WINDOWS\system32\spool\drivers\w32x86\3\LXBLPSWX.EXE
[2003/09/10 00:15:04 | 000,100,864 | —- | M] () – C:\WINDOWS\system32\spool\drivers\w32x86\3\LXBLUN5C.EXE
[2003/09/10 00:14:47 | 000,053,248 | —- | M] () – C:\WINDOWS\system32\spool\drivers\w32x86\3\lxblweb.exe
[2002/07/30 20:00:00 | 000,311,612 | —- | M] () – C:\WINDOWS\system32\spool\drivers\w32x86\3\WAVS.EXE

< %USERPROFILE%\.COMMgr\*.* >

< %USERPROFILE%\Desktop\*.bat >

< %PROGRAMFILES%\Common Files\Real\visualizations\*.* >

< %PROGRAMFILES%\Internet Explorer\*.Jmp >

< %PROGRAMFILES%\Windows NT\system\*.dll >

< %systemroot%\system32\*.ext >

< %systemroot%\system32\Com\*.cfg >

< %systemroot%\system32\btz\*.* >

< %systemroot%\system32\EMP\*.* >

< %systemroot%\system32\expo\*.* >

< %systemroot%\system32\inet2\*.* >

< %systemroot%\system32\xrem\*.* >

< %ProgramFiles%\Microsoft\*.* >

< %systemroot%\usgwmt\*.* >

< %ProgramFiles%\B\*.* >

< %SYSTEMDRIVE%\lspp\*.* >

< %systemroot%\Kral\*.* >

< %SYSTEMDRIVE%\windowsdvd.exe\*.* >

< %systemroot%\system32\*.ipo >

< %SYSTEMDRIVE%\usxxxxxxxx.exe\*.* >

< %systemroot%\system32\*.mof >

< %systemroot%\*.atm >

< %systemroot%\system32\svhost\*.* >

< %ProgramFiles%\system32\*.* >

< %ProgramFiles%\Docmentt\*.* >

< %systemroot%\Help\*.vbs >

< %ProgramFiles%\Windows WinSxs\*.* /s >

< %ProgramFiles%\Outlook Express\IDT\*.* /s >

< %ProgramFiles%\Microsoft Office\365\*.* /s >

< %ProgramFiles%\Windows Live\*.* >

< %systemroot%\system32\win32\*.* >

< %SYSTEMDRIVE%\RECYCLER\*.* >

< %systemroot%\Fresh1\*.* >

< %ProgramFiles%\Kekj\*.* /s >

< %systemroot%\GDU\*.* >

< %systemroot%\KA\*.* >

< %systemroot%\R\*.* >

< %systemroot%\system32\*.fyo >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-09-15 12:38:58

========== Alternate Data Streams ==========

@Alternate Data Stream - 99 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:84098FD3
@Alternate Data Stream - 95 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1CA73D29
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B3D74A13
< End of report >

OTL Extras logfile created on: 9/26/2010 7:26:12 AM - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Documents and Settings\Owner.amarlowe\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 73.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 89.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 292.74 Gb Total Space | 276.02 Gb Free Space | 94.29% Space Free | Partition Type: NTFS
Drive D: | 5.33 Gb Total Space | 1.73 Gb Free Space | 32.48% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 232.83 Gb Total Space | 227.17 Gb Free Space | 97.57% Space Free | Partition Type: FAT32

Computer Name: AMARLOWE
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = Opera.HTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] – Reg Error: Value error.
https [open] – Reg Error: Value error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe" = C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe:LocalSubNet:Enabled:Belkin Setup – (Affinegy, Inc.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader – (AOL LLC)
"C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AIM – (AOL Inc.)
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser – (Opera Software)
"C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe" = C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe:LocalSubNet:Enabled:Belkin Setup – (Affinegy, Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java™ 6 Update 21
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{44397CF9-315D-4535-8585-DCD2EE47B966}" = Opera 10.62
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{66F1F013-008F-4875-B283-5A814B820347}" = Kaspersky Internet Security 2011
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{6ED53E0C-EAC0-4F0F-947D-6BA817E4C8C3}" = HostsMan 3.2.73
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{91120409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{B7DE81A4-71D5-4F22-9D72-84AC8A266F43}" = Sony Vegas Movie Studio 6.0b
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{EBD9A954-6C1A-4E9F-A098-C98653035381}" = PrintMaster Platinum 18
"{F99520C7-7EE6-472E-8DD8-E60003A9292F}" = WOT for Internet Explorer
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AIM_7" = AIM 7
"Belkin Setup and Router Monitor_is1" = Belkin Setup and Router Monitor
"CCleaner" = CCleaner
"Diner Dash 2" = Diner Dash 2
"ERUNT_is1" = ERUNT 1.1j
"Foxit Reader" = Foxit Reader
"getPlus®_ocx" = getPlus®_ocx
"ie8" = Windows Internet Explorer 8
"InstallWIX_{66F1F013-008F-4875-B283-5A814B820347}" = Kaspersky Internet Security 2011
"KeyScrambler" = KeyScrambler
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MozBackup" = MozBackup 1.4.10
"Mozilla Firefox (3.6.10)" = Mozilla Firefox (3.6.10)
"OpenDNS Updater" = OpenDNS Updater 2.2.1
"Revo Uninstaller" = Revo Uninstaller 1.89
"Secunia PSI" = Secunia PSI
"SpywareBlaster_is1" = SpywareBlaster 4.4
"VLC media player" = VLC media player 1.1.4
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.6.10

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Agenda" = Agenda
"multiWeather" = multiWeather

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 9/1/2010 4:06:25 PM | Computer Name = AMARLOWE | Source = Application Error | ID = 1000
Description = Faulting application iron.exe, version 0.0.0.0, faulting module iron.dll,
version 5.0.382.0, fault address 0x000058c8.

Error - 9/1/2010 4:06:36 PM | Computer Name = AMARLOWE | Source = Application Error | ID = 1000
Description = Faulting application iron.exe, version 0.0.0.0, faulting module iron.dll,
version 5.0.382.0, fault address 0x000058c8.

Error - 9/1/2010 4:09:36 PM | Computer Name = AMARLOWE | Source = Application Error | ID = 1000
Description = Faulting application iron.exe, version 0.0.0.0, faulting module iron.dll,
version 5.0.382.0, fault address 0x000058c8.

Error - 9/1/2010 4:11:02 PM | Computer Name = AMARLOWE | Source = Application Error | ID = 1000
Description = Faulting application iron.exe, version 0.0.0.0, faulting module iron.dll,
version 5.0.382.0, fault address 0x000058c8.

Error - 9/1/2010 4:13:53 PM | Computer Name = AMARLOWE | Source = Application Error | ID = 1000
Description = Faulting application iron.exe, version 0.0.0.0, faulting module iron.dll,
version 5.0.382.0, fault address 0x000058c8.

Error - 9/1/2010 4:14:15 PM | Computer Name = AMARLOWE | Source = Application Error | ID = 1000
Description = Faulting application iron.exe, version 0.0.0.0, faulting module iron.dll,
version 5.0.382.0, fault address 0x000058c8.

Error - 9/1/2010 4:14:49 PM | Computer Name = AMARLOWE | Source = Application Error | ID = 1000
Description = Faulting application iron.exe, version 0.0.0.0, faulting module iron.dll,
version 5.0.382.0, fault address 0x000058c8.

Error - 9/2/2010 1:49:46 PM | Computer Name = AMARLOWE | Source = Application Error | ID = 1000
Description = Faulting application iron.exe, version 0.0.0.0, faulting module iron.dll,
version 5.0.382.0, fault address 0x008dbca3.

Error - 9/10/2010 3:27:59 PM | Computer Name = AMARLOWE | Source = Application Error | ID = 1000
Description = Faulting application avp.exe, version 11.0.1.400, faulting module
ntdll.dll, version 5.1.2600.5755, fault address 0x00010a19.

Error - 9/20/2010 5:49:15 PM | Computer Name = AMARLOWE | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This operation returned because the timeout period expired.

[ IntelDH Events ]
Error - 9/24/2010 8:40:22 AM | Computer Name = AMARLOWE | Source = CCU_Engine | ID = 15
Description = A CCU internal function detected an error: CCUEngine failed to create
the DataManager

Error - 9/24/2010 8:40:22 AM | Computer Name = AMARLOWE | Source = TrayIcon | ID = 15
Description = A CCU internal function detected an error: CCU_TrayIcon::Could not
create ICCUEngine interface pointer

Error - 9/24/2010 8:43:40 PM | Computer Name = AMARLOWE | Source = CCU_Engine | ID = 15
Description = A CCU internal function detected an error: CCUEngine failed to hook
to the DataManager (data store updates)

Error - 9/24/2010 8:43:40 PM | Computer Name = AMARLOWE | Source = TrayIcon | ID = 15
Description = A CCU internal function detected an error: CCU_TrayIcon::Could not
create ICCUEngine interface pointer

Error - 9/24/2010 11:18:18 PM | Computer Name = AMARLOWE | Source = CCU_Engine | ID = 15
Description = A CCU internal function detected an error: CCUEngine failed to hook
to the DataManager (data store updates)

Error - 9/24/2010 11:18:19 PM | Computer Name = AMARLOWE | Source = TrayIcon | ID = 15
Description = A CCU internal function detected an error: CCU_TrayIcon::Could not
create ICCUEngine interface pointer

Error - 9/25/2010 7:58:05 AM | Computer Name = AMARLOWE | Source = CCU_Engine | ID = 15
Description = A CCU internal function detected an error: CCUEngine failed to hook
to the DataManager (data store updates)

Error - 9/25/2010 7:58:06 AM | Computer Name = AMARLOWE | Source = TrayIcon | ID = 15
Description = A CCU internal function detected an error: CCU_TrayIcon::Could not
create ICCUEngine interface pointer

Error - 9/26/2010 7:16:20 AM | Computer Name = AMARLOWE | Source = CCU_Engine | ID = 15
Description = A CCU internal function detected an error: CCUEngine failed to hook
to the DataManager (data store updates)

Error - 9/26/2010 7:16:20 AM | Computer Name = AMARLOWE | Source = TrayIcon | ID = 15
Description = A CCU internal function detected an error: CCU_TrayIcon::Could not
create ICCUEngine interface pointer

[ System Events ]
Error - 9/25/2010 7:57:57 AM | Computer Name = AMARLOWE | Source = Service Control Manager | ID = 7000
Description = The Intel® Application Tracker service failed to start due to the
following error: %%5

Error - 9/25/2010 7:57:57 AM | Computer Name = AMARLOWE | Source = Service Control Manager | ID = 7001
Description = The Intel® Remoting Service service depends on the Intel® Application
Tracker service which failed to start because of the following error: %%5

Error - 9/26/2010 7:16:08 AM | Computer Name = AMARLOWE | Source = Service Control Manager | ID = 7000
Description = The Intel® Quick Resume technology service failed to start due to
the following error: %%5

Error - 9/26/2010 7:16:08 AM | Computer Name = AMARLOWE | Source = Service Control Manager | ID = 7000
Description = The Intel® Software Services Manager service failed to start due
to the following error: %%5

Error - 9/26/2010 7:16:08 AM | Computer Name = AMARLOWE | Source = Service Control Manager | ID = 7001
Description = The Intel® Viiv™ Media Server service depends on the Intel®
Software Services Manager service which failed to start because of the following
error: %%5

Error - 9/26/2010 7:16:08 AM | Computer Name = AMARLOWE | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Intel® Application
Tracker service to connect.

Error - 9/26/2010 7:16:08 AM | Computer Name = AMARLOWE | Source = Service Control Manager | ID = 7000
Description = The Intel® Application Tracker service failed to start due to the
following error: %%1053

Error - 9/26/2010 7:16:08 AM | Computer Name = AMARLOWE | Source = Service Control Manager | ID = 7001
Description = The Intel® Remoting Service service depends on the Intel® Application
Tracker service which failed to start because of the following error: %%1053

Error - 9/26/2010 7:16:11 AM | Computer Name = AMARLOWE | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
abp480n5 ACPIEC adpu160m agp440 agpCPQ Aha154x aic78u2 aic78xx AliIde alim1541 amdagp amsint
asc
asc3350p
asc3550
cbidf
cd20xrnt
CmdIde
Cpqarray
dac2w2k
dac960nt
dpti2o
hpn
i2omp
ini910u
IntelIde
mraid35x
Pcmcia
perc2
perc2hib
ql1080
Ql10wnt
ql12160
ql1240
ql1280
sisagp
Sparrow
symc810
symc8xx
sym_hi
sym_u3
TosIde
ultra
viaagp
ViaIde

Error - 9/26/2010 7:16:11 AM | Computer Name = AMARLOWE | Source = Service Control Manager | ID = 7034
Description = The NVIDIA Display Driver Service service terminated unexpectedly.
It has done this 1 time(s).


< End of report >


defogger_disable by jpshortstuff (23.02.10.1)
Log created at 08:29 on 26/09/2010 (Owner)

Checking for autostart values…
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers…


-=E.O.F=-
Post #5
Hi Angel of the Moon

The issue you mentioned is probably a remnant of a previous infection which will be removed when we tidy up. Apart from that, I don’t see any problems in your log, but let's just be thorough and run a couple more scans.

Run OTL

  • Double click on the icon to run it.
  • Copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:OTL
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {23B0D39A-E245-41B7-BF86-1238CF62625E} - No CLSID value found.
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme File not found
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Reg Error: Key error.)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Key error.)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {B9F79165-A264-4C4A-A211-133A5E8D647F} http://support.f-secure.com/enu/home/onlin.../fshc/fscax.cab (Reg
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} Reg Error: Value error. (Reg Error: Key error.)
O28 - HKLM ShellExecuteHooks: {4F07DA45-8170-4859-9B5F-037EF2970034} - Reg Error: Key error. File not found
@Alternate Data Stream - 99 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:84098FD3
@Alternate Data Stream - 95 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1CA73D29
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B3D74A13

:Commands
[emptytemp]
[CLEARALLRESTOREPOINTS]
[Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post a new OTL log (don't check the boxes beside LOP Check or Purity this time)

  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.


Try running Gmer again and un-check devices. Ideally, we'd like to run GMER in normal mode, but if it still won't run in normal mode please do the following:

Boot your computer in Safe Mode• Turn the computer on or Restart the computer
• Start tapping the F8 key.
• The Windows Advanced Options Menu appears (If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again)
• Use the arrow keys to select the Safe Mode menu option.
• Press Enter.
• The computer then begins to start in Safe mode.
• Log into your usual account
Then try running GMER with just sections and the C: drive checked, leave everything else blank. After running it, reboot into normal mode.

If you still can't get it to run, please let me know.

Please include the OTL, MBAM and Gmer logs in your next post

Thanks

Satchfan
Post #6
OK Satchfan, I ran everything and it ran smoothly, although I have to admit I had trouble with gmer again until a did it in safe mode and it ran as normal. Although there was nothing detected my gmer I would need to attach the log since I can't really post a log with gmer if nothing was there and you wanted to see the log. Thank you, Angel of the Moon, here are the logs you requested. Edit: I can't attach the log either I am afraid since, I get an error message that I haven't select a file to attach, even though I actually select a file. So how do you want me to give you the gmer.txt? All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{23B0D39A-E245-41B7-BF86-1238CF62625E} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23B0D39A-E245-41B7-BF86-1238CF62625E}\ not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\InstallVisualStyle deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\InstallTheme deleted successfully. Starting removal of ActiveX control {166B1BCA-3F9C-11CF-8075-444553540000} C:\WINDOWS\Downloaded Program Files\setup.inf not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{166B1BCA-3F9C-11CF-8075-444553540000}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{166B1BCA-3F9C-11CF-8075-444553540000}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{166B1BCA-3F9C-11CF-8075-444553540000}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{166B1BCA-3F9C-11CF-8075-444553540000}\ not found. Starting removal of ActiveX control {67DABFBF-D0AB-41FA-9C46-CC0F21721616} C:\WINDOWS\Downloaded Program Files\DivXPlugin.inf moved successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ not found. Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found. Starting removal of ActiveX control {B9F79165-A264-4C4A-A211-133A5E8D647F} C:\WINDOWS\Downloaded Program Files\fscax.inf moved successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{B9F79165-A264-4C4A-A211-133A5E8D647F}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B9F79165-A264-4C4A-A211-133A5E8D647F}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{B9F79165-A264-4C4A-A211-133A5E8D647F}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B9F79165-A264-4C4A-A211-133A5E8D647F}\ not found. Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7} Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\DownloadInformation\\INF . Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{4F07DA45-8170-4859-9B5F-037EF2970034} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4F07DA45-8170-4859-9B5F-037EF2970034}\ not found. ADS C:\Documents and Settings\All Users\Application Data\TEMP:84098FD3 deleted successfully. ADS C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34 deleted successfully. ADS C:\Documents and Settings\All Users\Application Data\TEMP:1CA73D29 deleted successfully. ADS C:\Documents and Settings\All Users\Application Data\TEMP:B3D74A13 deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 115003 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: IUSR_NMPR ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 16786 bytes User: NetworkService ->Temp folder emptied: 17844 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: Owner User: Owner.amarlowe ->Temp folder emptied: 524288 bytes ->Temporary Internet Files folder emptied: 784200 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 45677297 bytes ->Opera cache emptied: 240 bytes ->Flash cache emptied: 990 bytes User: OWNER~1~AMA User: TEMP ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Java cache emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 307152 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 45.00 mb Restore points cleared and new OTL Restore Point set! OTL by OldTimer - Version 3.2.14.1 log created on 09282010_070629 Files\Folders moved on Reboot… File\Folder C:\WINDOWS\temp\kls9E3A.tmp not found! Registry entries deleted on Reboot… Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4710 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 9/28/2010 7:23:51 AM mbam-log-2010-09-28 (07-23-51).txt Scan type: Quick scan Objects scanned: 165862 Time elapsed: 8 minute(s), 58 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
Post #7
Angel of the Moon

As you are having a problem with Gmer, we'll try another.

Please download RootRepeal to your desktop.• Physically disconnect your machine from the internet as your system will be unprotected.
• Unzip it to it's own folder, close all other programs especially your security programs (anti-spyware, anti-virus, and firewall) and run RootRepeal.exe
• Click the Report tab at the bottom and then the Scan button.
• A box will pop up, check the boxes beside Drivers, Files, Processes SSDT and click OK.
• Another box will open, check the boxes beside all the drives, eg: C:\ , then click OK.
• The scan will take a little while to run, so let it go unhindered.
• Once it is done, click the Save Report button, call it RepealScan and save the log to your desktop.
• Reconnect to the internet
• Post the log here in your reply.
Satchfan
Post #8 last edited
Alright, now I feel really bad right now, but the scan crashed as it went to the processes part of the scan, everything else was great but, gave me a warning and closed down, so I couldn't finish. I don't know if you want the crash report, but if you do here it is. ROOTREPEAL CRASH REPORT ————————- Windows Version: Windows XP Media Center Edition SP3 Exception Code: 0xc0000005 Exception Address: 0x76bf3a76 Attempt to read from address: 0x76bf3a76 I'll be waiting for further instructions :unsure:
Post #9
Hi Angel of the Moon

Is your CD emulation software still disabled or did you enable it again with DeFogger? If so, please disable it again.

Whether or not you re-enabled it, please do the following:

Disable Windows Media Center Receiver Service • Click Start
• Select Adminastrative Tools
• Select Services
• From the “Name” column, double click Media Center Receiver Service
• From the Startup type drop down list, select Disabled
• Click Apply
• Click OK
• Close the Services window
Temporarily disable your anti-virus and real-time anti-spyware protection.


Scan With RKUnHooker• Please Download Rootkit Unhooker Save it to your desktop
• Double-click on RKUnhookerLE.exe to run it
• Click the Report tab, then click Scan
• Check (tick) Drivers, Stealth. Uncheck the rest. then Click OK
• Wait till the scanner has finished and then click File, Save Report
• Save the report somewhere where you can find it. Click Close
Copy the entire contents of the report and paste it in a reply here.

Note** you may get this warning:

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

It is ok, just ignore it

Thanks

Satchfan
Post #10 last edited
Actually no Satchfan, I did not enable the CD emulation with Defrogger, I never even touch Defrogger since the first time you told me to run it. Anyway I did everything you said in the post and here is the log you requested (no problem) with the program, but from your link it was rar file so I needed to download and install win rar to open the file. RkUnhooker report generator v0.7 ============================================== Rootkit Unhooker kernel version: 3.7.300.509 ============================================== Windows Major Version: 5 Windows Minor Version: 1 Windows Build Number: 2600 ============================================== >Drivers Driver: kl1.sys Address: 0xB9A85000 Size: 5382144 bytes Driver: C:\WINDOWS\System32\nv4_disp.dll Address: 0xBF012000 Size: 3956736 bytes Driver: C:\WINDOWS\system32\DRIVERS\nv4_mini.sys Address: 0xB875E000 Size: 3620864 bytes Driver: C:\WINDOWS\system32\ntkrnlpa.exe Address: 0x804D7000 Size: 2150400 bytes Driver: PnpManager Address: 0x804D7000 Size: 2150400 bytes Driver: RAW Address: 0x804D7000 Size: 2150400 bytes Driver: WMIxWDM Address: 0x804D7000 Size: 2150400 bytes Driver: Win32k Address: 0xBF800000 Size: 1855488 bytes Driver: C:\WINDOWS\System32\win32k.sys Address: 0xBF800000 Size: 1855488 bytes Driver: C:\WINDOWS\system32\drivers\sthda.sys Address: 0xB5106000 Size: 1134592 bytes Driver: C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys Address: 0xB8545000 Size: 1036288 bytes Driver: C:\WINDOWS\System32\Drivers\dump_iaStor.sys Address: 0xA4189000 Size: 749568 bytes Driver: IASTOR.SYS Address: 0xB9914000 Size: 749568 bytes Driver: C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys Address: 0xB8498000 Size: 708608 bytes Driver: Ntfs.sys Address: 0xB97CE000 Size: 577536 bytes Driver: C:\WINDOWS\system32\DRIVERS\klif.sys Address: 0xB0ED7000 Size: 520192 bytes Driver: C:\WINDOWS\system32\DRIVERS\mrxsmb.sys Address: 0xADEED000 Size: 458752 bytes Driver: C:\WINDOWS\system32\DRIVERS\update.sys Address: 0xB83DF000 Size: 385024 bytes Driver: C:\WINDOWS\system32\DRIVERS\tcpip.sys Address: 0xAE042000 Size: 364544 bytes Driver: C:\WINDOWS\system32\DRIVERS\srv.sys Address: 0xA2B86000 Size: 356352 bytes Driver: C:\WINDOWS\System32\ATMFD.DLL Address: 0xBFFA0000 Size: 286720 bytes Driver: C:\WINDOWS\System32\Drivers\HTTP.sys Address: 0xA2CCD000 Size: 266240 bytes Driver: C:\WINDOWS\system32\DRIVERS\e1e5132.sys Address: 0xB8711000 Size: 233472 bytes Driver: C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys Address: 0xB8642000 Size: 225280 bytes Driver: C:\WINDOWS\system32\DRIVERS\rdpdr.sys Address: 0xB843D000 Size: 196608 bytes Driver: ACPI.sys Address: 0xB9A57000 Size: 188416 bytes Driver: C:\WINDOWS\system32\DRIVERS\mrxdav.sys Address: 0xA2E26000 Size: 184320 bytes Driver: NDIS.sys Address: 0xB97A1000 Size: 184320 bytes Driver: C:\WINDOWS\system32\drivers\kmixer.sys Address: 0xA3125000 Size: 176128 bytes Driver: C:\WINDOWS\system32\DRIVERS\rdbss.sys Address: 0xADF85000 Size: 176128 bytes Driver: C:\WINDOWS\system32\DRIVERS\hcwPP2.sys Address: 0xB8679000 Size: 167936 bytes Driver: C:\WINDOWS\system32\DRIVERS\HDAudBus.sys Address: 0xB86C5000 Size: 163840 bytes Driver: C:\WINDOWS\system32\DRIVERS\netbt.sys Address: 0xADFF4000 Size: 163840 bytes Driver: dmio.sys Address: 0xB99E3000 Size: 155648 bytes Driver: C:\WINDOWS\system32\DRIVERS\ipnat.sys Address: 0xAE01C000 Size: 155648 bytes Driver: C:\WINDOWS\System32\Drivers\Fastfat.SYS Address: 0xA4240000 Size: 147456 bytes Driver: C:\WINDOWS\system32\drivers\portcls.sys Address: 0xB50E2000 Size: 147456 bytes Driver: C:\WINDOWS\system32\DRIVERS\USBPORT.SYS Address: 0xB86ED000 Size: 147456 bytes Driver: C:\WINDOWS\system32\DRIVERS\ks.sys Address: 0xB86A2000 Size: 143360 bytes Driver: C:\WINDOWS\System32\drivers\afd.sys Address: 0xADFD2000 Size: 139264 bytes Driver: C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS Address: 0xADFB0000 Size: 139264 bytes Driver: ACPI_HAL Address: 0x806E4000 Size: 134400 bytes Driver: C:\WINDOWS\system32\hal.dll Address: 0x806E4000 Size: 134400 bytes Driver: fltmgr.sys Address: 0xB9897000 Size: 131072 bytes Driver: ftdisk.sys Address: 0xB9A09000 Size: 126976 bytes Driver: C:\WINDOWS\System32\drivers\keyscrambler.sys Address: 0xACC66000 Size: 110592 bytes Driver: Mup.sys Address: 0xB9787000 Size: 106496 bytes Driver: atapi.sys Address: 0xB98FC000 Size: 98304 bytes Driver: C:\WINDOWS\system32\DRIVERS\SCSIPORT.SYS Address: 0xB99CB000 Size: 98304 bytes Driver: KSecDD.sys Address: 0xB986E000 Size: 94208 bytes Driver: C:\WINDOWS\system32\DRIVERS\ndiswan.sys Address: 0xB846D000 Size: 94208 bytes Driver: C:\WINDOWS\system32\drivers\wdmaud.sys Address: 0xA3173000 Size: 86016 bytes Driver: C:\WINDOWS\system32\DRIVERS\parport.sys Address: 0xB8484000 Size: 81920 bytes Driver: C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS Address: 0xB874A000 Size: 81920 bytes Driver: C:\WINDOWS\system32\DRIVERS\ipsec.sys Address: 0xAE13B000 Size: 77824 bytes Driver: WudfPf.sys Address: 0xB985B000 Size: 77824 bytes Driver: C:\WINDOWS\System32\drivers\dxg.sys Address: 0xBF000000 Size: 73728 bytes Driver: sr.sys Address: 0xB9885000 Size: 73728 bytes Driver: pci.sys Address: 0xB9A46000 Size: 69632 bytes Driver: C:\WINDOWS\System32\Drivers\Cdfs.SYS Address: 0xB8B1A000 Size: 65536 bytes Driver: C:\WINDOWS\system32\DRIVERS\cdrom.sys Address: 0xBA2F8000 Size: 65536 bytes Driver: C:\WINDOWS\system32\DRIVERS\nic1394.sys Address: 0xBA318000 Size: 65536 bytes Driver: ohci1394.sys Address: 0xBA0B8000 Size: 65536 bytes Driver: C:\WINDOWS\system32\DRIVERS\serial.sys Address: 0xB9777000 Size: 65536 bytes Driver: C:\WINDOWS\system32\DRIVERS\arp1394.sys Address: 0xAE97D000 Size: 61440 bytes Driver: C:\WINDOWS\system32\drivers\drmk.sys Address: 0xBA138000 Size: 61440 bytes Driver: C:\WINDOWS\system32\DRIVERS\redbook.sys Address: 0xBA308000 Size: 61440 bytes Driver: C:\WINDOWS\system32\drivers\sysaudio.sys Address: 0xADA03000 Size: 61440 bytes Driver: C:\WINDOWS\system32\DRIVERS\usbhub.sys Address: 0xBA128000 Size: 61440 bytes Driver: C:\WINDOWS\system32\DRIVERS\1394BUS.SYS Address: 0xBA0C8000 Size: 57344 bytes Driver: C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS Address: 0xBA188000 Size: 53248 bytes Driver: C:\WINDOWS\system32\DRIVERS\rasl2tp.sys Address: 0xB9757000 Size: 53248 bytes Driver: VolSnap.sys Address: 0xBA0E8000 Size: 53248 bytes Driver: C:\WINDOWS\system32\DRIVERS\raspptp.sys Address: 0xB9737000 Size: 49152 bytes Driver: C:\WINDOWS\System32\Drivers\Cdr4_xp.SYS Address: 0xBA2E8000 Size: 45056 bytes Driver: C:\WINDOWS\System32\Drivers\Fips.SYS Address: 0xAE96D000 Size: 45056 bytes Driver: C:\WINDOWS\system32\DRIVERS\HECI.sys Address: 0xBA2C8000 Size: 45056 bytes Driver: C:\WINDOWS\system32\DRIVERS\imapi.sys Address: 0xBA2D8000 Size: 45056 bytes Driver: MountMgr.sys Address: 0xBA0D8000 Size: 45056 bytes Driver: C:\WINDOWS\system32\DRIVERS\raspppoe.sys Address: 0xB9747000 Size: 45056 bytes Driver: C:\WINDOWS\system32\drivers\sfng32.sys Address: 0xBA148000 Size: 45056 bytes Driver: isapnp.sys Address: 0xBA0A8000 Size: 40960 bytes Driver: C:\WINDOWS\system32\DRIVERS\klim5.sys Address: 0xB9767000 Size: 40960 bytes Driver: C:\WINDOWS\System32\Drivers\NDProxy.SYS Address: 0xB8B2A000 Size: 40960 bytes Driver: C:\WINDOWS\system32\DRIVERS\secdrv.sys Address: 0xA2C15000 Size: 40960 bytes Driver: C:\WINDOWS\system32\DRIVERS\termdd.sys Address: 0xB9727000 Size: 40960 bytes Driver: disk.sys Address: 0xBA178000 Size: 36864 bytes Driver: C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS Address: 0xAE321000 Size: 36864 bytes Driver: C:\WINDOWS\system32\DRIVERS\intelppm.sys Address: 0xBA2B8000 Size: 36864 bytes Driver: C:\WINDOWS\system32\DRIVERS\klmouflt.sys Address: 0xADC35000 Size: 36864 bytes Driver: C:\WINDOWS\system32\DRIVERS\msgpc.sys Address: 0xAE9AD000 Size: 36864 bytes Driver: C:\WINDOWS\system32\DRIVERS\netbios.sys Address: 0xAE98D000 Size: 36864 bytes Driver: C:\WINDOWS\system32\DRIVERS\wanarp.sys Address: 0xAE99D000 Size: 36864 bytes Driver: C:\WINDOWS\system32\DRIVERS\ELacpi.sys Address: 0xBA3C8000 Size: 32768 bytes Driver: C:\WINDOWS\System32\Drivers\Modem.SYS Address: 0xBA3C0000 Size: 32768 bytes Driver: C:\WINDOWS\system32\drivers\npf.sys Address: 0xBA410000 Size: 32768 bytes Driver: C:\WINDOWS\System32\Drivers\Npfs.SYS Address: 0xB0E87000 Size: 32768 bytes Driver: C:\WINDOWS\system32\DRIVERS\usbccgp.sys Address: 0xB036D000 Size: 32768 bytes Driver: C:\WINDOWS\system32\DRIVERS\usbehci.sys Address: 0xBA4B0000 Size: 32768 bytes Driver: C:\WINDOWS\System32\Drivers\Cdralw2k.SYS Address: 0xBA3A8000 Size: 28672 bytes Driver: C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS Address: 0xB0E9F000 Size: 28672 bytes Driver: C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS Address: 0xBA328000 Size: 28672 bytes Driver: C:\WINDOWS\system32\DRIVERS\usbprint.sys Address: 0xB5273000 Size: 28672 bytes Driver: C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS Address: 0xAF33B000 Size: 28672 bytes Driver: C:\WINDOWS\system32\DRIVERS\kbdclass.sys Address: 0xBA3E8000 Size: 24576 bytes Driver: C:\WINDOWS\system32\DRIVERS\kl2.sys Address: 0xB0375000 Size: 24576 bytes Driver: C:\WINDOWS\system32\DRIVERS\mouclass.sys Address: 0xBA3F0000 Size: 24576 bytes Driver: C:\WINDOWS\System32\Drivers\rkhdrv40.SYS Address: 0xB0EB7000 Size: 24576 bytes Driver: C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS Address: 0xAF343000 Size: 24576 bytes Driver: C:\WINDOWS\system32\DRIVERS\usbuhci.sys Address: 0xBA4A0000 Size: 24576 bytes Driver: C:\WINDOWS\System32\drivers\vga.sys Address: 0xB0E8F000 Size: 24576 bytes Driver: C:\WINDOWS\System32\Drivers\Msfs.SYS Address: 0xB0EA7000 Size: 20480 bytes Driver: PartMgr.sys Address: 0xBA330000 Size: 20480 bytes Driver: C:\WINDOWS\system32\DRIVERS\ptilink.sys Address: 0xBA3D8000 Size: 20480 bytes Driver: PxHelp20.sys Address: 0xBA398000 Size: 20480 bytes Driver: C:\WINDOWS\system32\DRIVERS\raspti.sys Address: 0xBA3E0000 Size: 20480 bytes Driver: C:\WINDOWS\system32\DRIVERS\TDI.SYS Address: 0xBA3D0000 Size: 20480 bytes Driver: C:\WINDOWS\System32\watchdog.sys Address: 0xA4274000 Size: 20480 bytes Driver: C:\WINDOWS\System32\Drivers\Aspi32.SYS Address: 0xA2EF3000 Size: 16384 bytes Driver: C:\WINDOWS\system32\DRIVERS\BATTC.SYS Address: 0xBA4C0000 Size: 16384 bytes Driver: C:\WINDOWS\system32\DRIVERS\kbdhid.sys Address: 0xAE166000 Size: 16384 bytes Driver: C:\WINDOWS\system32\DRIVERS\mssmbios.sys Address: 0xB967E000 Size: 16384 bytes Driver: C:\WINDOWS\system32\DRIVERS\ndisuio.sys Address: 0xA4CDF000 Size: 16384 bytes Driver: C:\WINDOWS\system32\DRIVERS\serenum.sys Address: 0xB96AF000 Size: 16384 bytes Driver: C:\WINDOWS\system32\DRIVERS\arpolicy.sys Address: 0xB96AB000 Size: 12288 bytes Driver: C:\WINDOWS\system32\BOOTVID.dll Address: 0xBA4B8000 Size: 12288 bytes Driver: compbatt.sys Address: 0xBA4BC000 Size: 12288 bytes Driver: C:\WINDOWS\System32\drivers\Dxapi.sys Address: 0xB246D000 Size: 12288 bytes Driver: C:\WINDOWS\System32\Drivers\Elhid.sys Address: 0xB247D000 Size: 12288 bytes Driver: C:\WINDOWS\system32\DRIVERS\hidusb.sys Address: 0xB0E0F000 Size: 12288 bytes Driver: C:\WINDOWS\System32\Drivers\i2omgmt.SYS Address: 0xB5A70000 Size: 12288 bytes Driver: C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys Address: 0xA2DE6000 Size: 12288 bytes Driver: C:\WINDOWS\system32\DRIVERS\mouhid.sys Address: 0xAE162000 Size: 12288 bytes Driver: C:\WINDOWS\system32\DRIVERS\ndistapi.sys Address: 0xB96A3000 Size: 12288 bytes Driver: C:\WINDOWS\system32\DRIVERS\rasacd.sys Address: 0xB0E0B000 Size: 12288 bytes Driver: C:\WINDOWS\System32\Drivers\beep.sys Address: 0xBA5E8000 Size: 8192 bytes Driver: dmload.sys Address: 0xBA5B6000 Size: 8192 bytes Driver: C:\WINDOWS\System32\Drivers\Elkbd.sys Address: 0xBA602000 Size: 8192 bytes Driver: C:\WINDOWS\System32\Drivers\Elmon.sys Address: 0xBA600000 Size: 8192 bytes Driver: C:\WINDOWS\System32\Drivers\Elmou.sys Address: 0xBA5FC000 Size: 8192 bytes Driver: C:\WINDOWS\System32\Drivers\Fs_Rec.SYS Address: 0xBA5E2000 Size: 8192 bytes Driver: C:\WINDOWS\system32\KDCOM.DLL Address: 0xBA5A8000 Size: 8192 bytes Driver: C:\WINDOWS\System32\Drivers\mnmdd.SYS Address: 0xBA5F2000 Size: 8192 bytes Driver: C:\WINDOWS\system32\drivers\MSPQM.sys Address: 0xA48AA000 Size: 8192 bytes Driver: C:\WINDOWS\System32\Drivers\ParVdm.SYS Address: 0xA6471000 Size: 8192 bytes Driver: C:\WINDOWS\system32\DRIVERS\psi_mf.sys Address: 0xBA642000 Size: 8192 bytes Driver: C:\WINDOWS\System32\DRIVERS\RDPCDD.sys Address: 0xBA5F4000 Size: 8192 bytes Driver: C:\WINDOWS\system32\DRIVERS\swenum.sys Address: 0xBA60A000 Size: 8192 bytes Driver: C:\WINDOWS\system32\DRIVERS\USBD.SYS Address: 0xBA62A000 Size: 8192 bytes Driver: C:\WINDOWS\system32\DRIVERS\WMILIB.SYS Address: 0xBA5AA000 Size: 8192 bytes Driver: C:\WINDOWS\system32\DRIVERS\audstub.sys Address: 0xBA684000 Size: 4096 bytes Driver: C:\WINDOWS\System32\drivers\dxgthk.sys Address: 0xBA742000 Size: 4096 bytes Driver: C:\WINDOWS\System32\Drivers\Null.SYS Address: 0xAFD5F000 Size: 4096 bytes Driver: C:\WINDOWS\system32\DRIVERS\OPRGHDLR.SYS Address: 0xBA671000 Size: 4096 bytes Driver: pciide.sys Address: 0xBA670000 Size: 4096 bytes ============================================== >Stealth Thank you, Angel of the Moon
Post #11
Angel of the Moon

It is always a good idea to get things checked out by an expert and I would say that we’ve checked everything out pretty thoroughly here and you can be confident that we have purged the bad entry that you were concerned about and everything seems to be good.

We just need to tidy up a bit.

Delete RootRepeal from your desktop.


Uninstall OTL
• Double-click OTL.exe
• Click the CleanUp! button.
• Select Yes when the Begin cleanup Process? prompt appears.
• If you are prompted to reboot during the cleanup, select Yes.
• The tool will delete itself once it finishes, if not delete it by yourself.
NOTE: If you receive a warning from your firewall or other security programs regarding OTL attempting to contact the internet, please allow it to do so.


Re-enable Emulation drivers

To re-enable your Emulation drivers, double click DeFogger to run the tool.
  • The application window will appear
  • Click the Re-enable button to re-enable your CD Emulation drivers
  • Click Yes to continue
  • A 'Finished!' message will appear
  • Click OK
  • DeFogger will now ask to reboot the machine - click OK
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.


It’s good that you check back with us when you have a doubt as there are very many new infections around and they are becoming more dangerous, so when in doubt, please continue to do so.

Safe computing

Satchfan
Post #12
Thank you very much once again Satchfan, I always like to check with an expert so that is why, I came here in the first place, just to check. ^_^ . I did everything you said, but when I ran the cleanup from OTL it cleaned up DeFrogger as well, so I had to download it back in and it produce me a log so as per your instructions I would post it. The DeFrogger didn't ask me to reboot in case you ae wondering about that. Also for the rest of the applications that didn't get cleaned up by OTL, can I just delete into the recycle bin? Thank you, Angel of the Moon defogger_enable by jpshortstuff (23.02.10.1) Log created at 07:59 on 01/10/2010 (Owner) Parsing file… -=E.O.F=-
Post #13
Angel of the Moon OTL Cleanup doesn’t “clean up” DeFogger so I don’t know what happened there. However, you have re-enabled so that’s OK. As far as the other tools are concerned, yes you can delete HJT and RKUnhooker. Malwarebytes you very wisely already had on your system and is an excellent tool. I would imagine I don’t have to tell you that it should be updated and run regularly. Regards Satchfan
Post #14 last edited
Alright, thank you very much, I don't know why OTL cleaned up DeFrogger either but knowing everything is now OK, I will delete the remaining tools and logs that was created. Also…no you don't have to tell me to run and/or update Malwrebytes regularly since, I've been updating Malarebytes every morning and doing a scan every week. Anyway; my computer is not having any problems right now but I will if something arises. Thank you again and good luck with your completion of your class at What The Tech. Angel of the Moon.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI