Olmarik.AJL trojan

Since yesterday I've been getting this message from time to time :

Alert:

Object : MBR sector of the 0. physical disk

Threat : Win32/Olmarik.AJL trojan

Here are the results from OTL

OTL.txt

OTL logfile created on: 24/12/2010 12:38:44 - Run 1
OTL by OldTimer - Version 3.2.18.0 Folder = C:\Users\Boy\Downloads
64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 51.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 298.09 Gb Total Space | 77.77 Gb Free Space | 26.09% Space Free | Partition Type: NTFS
Drive D: | 465.76 Gb Total Space | 269.44 Gb Free Space | 57.85% Space Free | Partition Type: NTFS
Drive E: | 931.51 Gb Total Space | 99.64 Gb Free Space | 10.70% Space Free | Partition Type: NTFS
Drive G: | 6.76 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: LIBERTY_PRIME | User Name: Boy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Boy\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files (x86)\MSI\DualCoreCenter\DualCoreCenter.exe ()
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
PRC - C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe ()
PRC - C:\Program Files\Logitech\GamePanel Software\Applets\ColorOnly\LCDYT.exe (Logitech Inc.)
PRC - C:\Program Files\Logitech\GamePanel Software\Applets\ColorOnly\LCDMovieViewer.exe (Logitech Inc.)
PRC - C:\Program Files\Logitech\GamePanel Software\Applets\LCDMedia.exe (Logitech Inc.)
PRC - C:\Fraps\fraps.exe (Beepa P/L)
PRC - C:\Windows\SysWOW64\wbem\WmiPrvSE.exe (Microsoft Corporation)
PRC - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe (ESET)
PRC - C:\Everest\everest.exe (Lavalys, Inc.)


========== Modules (SafeList) ==========

MOD - C:\Users\Boy\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)
MOD - C:\Fraps\fraps32.dll (Beepa P/L)


========== Win32 Services (SafeList) ==========

SRV:64bit: - (PnkBstrA) – C:\Windows\SysNative\PnkBstrA.exe File not found
SRV:64bit: - (KMService) – C:\Windows\SysNative\srvany.exe File not found
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) – C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV:64bit: - (EhttpSrv) – C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe (ESET)
SRV:64bit: - (ekrn) – C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe (ESET)
SRV - (Hamachi2Svc) – C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (KMService) – C:\Windows\SysWOW64\srvany.exe ()
SRV - (Apple Mobile Device) – C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Serviio) – C:\Program Files (x86)\Serviio\bin\ServiioService.exe ()
SRV - (PnkBstrA) – C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (NMSAccess) – C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe ()
SRV - (DAUpdaterSvc) – B:\Dragon Age\bin_ship\daupdatersvc.service.exe (BioWare)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (atksgt) – C:\Windows\SysNative\drivers\atksgt.sys ()
DRV:64bit: - (lirsgt) – C:\Windows\SysNative\drivers\lirsgt.sys ()
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (LGVirHid) – C:\Windows\SysNative\drivers\LGVirHid.sys (Logitech Inc.)
DRV:64bit: - (LGBusEnum) – C:\Windows\SysNative\drivers\LGBusEnum.sys (Logitech Inc.)
DRV:64bit: - (sptd) – C:\Windows\SysNative\drivers\sptd.sys ()
DRV:64bit: - (hamachi) – C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV:64bit: - (xusb21) – C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (atikmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (LGPBTDD) – C:\Windows\SysNative\drivers\LGPBTDD.sys (Logitech Inc.)
DRV:64bit: - (LMouFilt) – C:\Windows\SysNative\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV:64bit: - (LHidFilt) – C:\Windows\SysNative\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV:64bit: - (Ntfs) – C:\Windows\SysNative\wbem\ntfs.mof ()
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (epfwwfpr) – C:\Windows\SysNative\drivers\epfwwfpr.sys (ESET)
DRV:64bit: - (ehdrv) – C:\Windows\SysNative\drivers\ehdrv.sys (ESET)
DRV:64bit: - (eamon) – C:\Windows\SysNative\drivers\eamon.sys (ESET)
DRV:64bit: - (RTL8167) – C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation )
DRV:64bit: - (DCamUSBSTK02N) – C:\Windows\SysNative\drivers\STK02NW2.sys (Syntek Ltd.)
DRV - (DualCoreCenter) – C:\Program Files (x86)\MSI\DualCoreCenter\NTGLM7X64.sys (MICRO-STAR INT'L CO., LTD.)
DRV - (StarOpen) – C:\Windows\SysWow64\drivers\StarOpen.sys ()
DRV - (RushTopDevice2) – C:\Program Files (x86)\MSI\DualCoreCenter\RushTop64.sys (Your Corporation)
DRV - (EverestDriver) – C:\Everest\kerneld.amd64 ()
DRV - (DCamUSBSTK02N) – C:\Windows\SysWOW64\drivers\STK02NW2.sys (Syntek Ltd.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 8A 86 73 2A 52 62 CA 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.nl/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {9e1d7c80-43d1-11db-b0de-0800200c9a66}:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:4.1.8
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/12/14 18:09:05 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010/12/12 01:01:33 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2009/11/10 23:56:13 | 000,000,000 | —D | M]

[2009/11/10 23:23:02 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\Mozilla\Extensions
[2010/12/23 17:44:53 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\Mozilla\Firefox\Profiles\ttctpqjx.default\extensions
[2009/11/15 23:49:01 | 000,000,000 | —D | M] (No name found) – C:\Users\Boy\AppData\Roaming\Mozilla\Firefox\Profiles\ttctpqjx.default\extensions\{9e1d7c80-43d1-11db-b0de-0800200c9a66}
[2010/12/23 17:44:47 | 000,000,000 | —D | M] (Adblock Plus) – C:\Users\Boy\AppData\Roaming\Mozilla\Firefox\Profiles\ttctpqjx.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/05/31 18:08:11 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\Mozilla\Firefox\Profiles\ttctpqjx.default\extensions\[removed]
[2010/11/11 11:52:35 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\Mozilla\Firefox\Profiles\ttctpqjx.default\extensions\[removed]
[2010/12/23 17:44:53 | 000,000,000 | —D | M] – C:\Program Files (x86)\Mozilla Firefox\extensions
[2010/09/04 14:31:50 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/11/23 11:25:29 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010/09/15 04:50:38 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
[2009/03/25 11:42:28 | 000,114,688 | —- | M] (Zylom) – C:\Program Files (x86)\Mozilla Firefox\plugins\npzylomgamesplayer.dll
[2010/04/03 00:03:38 | 000,001,892 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\bolcom-nl.xml
[2010/04/03 00:03:38 | 000,004,558 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\marktplaats-nl.xml
[2010/04/03 00:03:38 | 000,001,111 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\vandale-nl.xml
[2010/04/03 00:03:38 | 000,001,049 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\wikipedia-nl.xml
[2010/04/03 00:03:38 | 000,001,106 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo-nl.xml

O1 HOSTS File: ([2010/12/15 20:38:57 | 000,000,932 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 5.225.181.110 mercs2-pc.fesl.ea.com
O1 - Hosts: 5.225.181.110 mercs2-pc.fesl.ea.com
O1 - Hosts: 5.225.181.110 mercs2-pc.fesl.ea.com
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (QUICKfind BHO Object) - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\Program Files (x86)\IDM\QUICKfind\PlugIns\IEHelp.dll ()
O4:64bit: - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4:64bit: - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [Launch LCDMon] C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [Launch LGDCore] C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [Launch LgDeviceAgent] C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [DelReg] C:\Program Files (x86)\MSI\DualCoreCenter\DelReg.exe ()
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\RunOnce: [EVEREST AutoStart] C:\Everest\everest.exe (Lavalys, Inc.)
O4 - Startup: C:\Users\Boy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sid Registration.lnk = G:\ATR1.exe File not found
O4 - Startup: C:\Users\Boy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\The Matrix_ Path of Neo Registration.lnk = C:\Users\Boy\AppData\Local\Temp\{3E55C866-1554-4152-9734-797852C7A02A}\{E571E8B1-9771-465D-9DE0-3BA2D1BDAE99}\ATR1.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/09/21 08:23:57 | 000,054,544 | R— | M] (Electronic Arts) - G:\Autorun.exe – [ UDF ]
O32 - AutoRun File - [2010/06/27 10:12:50 | 000,000,049 | R— | M] () - G:\Autorun.inf – [ UDF ]
O33 - MountPoints2\{c0d33efd-ce50-11de-b4b6-0019db4790ed}\Shell - "" = AutoRun
O33 - MountPoints2\{c0d33efd-ce50-11de-b4b6-0019db4790ed}\Shell\AutoRun\command - "" = G:\Autorun.exe – [2010/09/21 08:23:57 | 000,054,544 | R— | M] (Electronic Arts)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

Drivers32:64bit: msacm.ac3filter - ac3filter64.acm ()
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: VIDC.FPS1 - frapsv64.dll (Beepa P/L)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\SysWow64\ff_vfw.dll ()
Drivers32: VIDC.FPS1 - C:\Windows\SysWow64\frapsvid.dll (Beepa P/L)
Drivers32: vidc.iv50 - C:\Windows\SysWow64\ir50_32.dll (Intel Corporation)
Drivers32: vidc.VP60 - C:\Windows\SysWOW64\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\Windows\SysWOW64\vp6vfw.dll (On2.com)
Drivers32: vidc.XVID - C:\Windows\SysWow64\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2010/12/24 12:22:39 | 000,000,000 | —D | C] – C:\Users\Boy\AppData\Roaming\Malwarebytes
[2010/12/24 12:22:35 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010/12/24 12:22:34 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/12/24 12:22:32 | 000,024,152 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2010/12/24 12:22:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010/12/15 17:42:02 | 001,169,408 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskschd.dll
[2010/12/15 17:42:02 | 000,524,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wmicmiplugin.dll
[2010/12/15 17:42:02 | 000,496,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\taskschd.dll
[2010/12/15 17:42:02 | 000,473,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskcomp.dll
[2010/12/15 17:42:02 | 000,464,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskeng.exe
[2010/12/15 17:42:02 | 000,285,696 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\schtasks.exe
[2010/12/15 17:42:01 | 000,305,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\taskcomp.dll
[2010/12/15 17:42:01 | 000,179,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\schtasks.exe
[2010/12/15 17:41:58 | 000,367,104 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysNative\atmfd.dll
[2010/12/15 17:41:57 | 000,294,400 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysWow64\atmfd.dll
[2010/12/15 17:41:57 | 000,046,080 | —- | C] (Adobe Systems) – C:\Windows\SysNative\atmlib.dll
[2010/12/15 17:41:57 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\SysWow64\atmlib.dll
[2010/12/15 17:41:53 | 000,395,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\webio.dll
[2010/12/15 17:41:53 | 000,314,368 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\webio.dll
[2010/12/15 17:41:50 | 000,112,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\consent.exe
[2010/12/15 17:41:40 | 000,703,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2010/12/15 17:41:39 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeeds.dll
[2010/12/15 17:41:39 | 000,256,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll
[2010/12/15 17:41:39 | 000,247,808 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2010/12/15 17:41:39 | 000,185,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2010/12/15 17:41:39 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2010/12/15 17:41:39 | 000,097,280 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2010/12/15 17:41:39 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2010/12/15 17:41:39 | 000,057,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\licmgr10.dll
[2010/12/15 17:41:39 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\licmgr10.dll
[2010/12/15 17:41:39 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2010/12/15 17:41:39 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeedssync.exe
[2010/12/15 17:41:38 | 000,482,816 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\html.iec
[2010/12/15 17:41:38 | 000,386,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2010/12/12 01:07:00 | 000,000,000 | —D | C] – C:\Program Files (x86)\LogMeIn Hamachi
[2010/12/11 11:12:31 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Skype
[2010/12/07 17:35:46 | 000,000,000 | —D | C] – C:\Users\Boy\AppData\Roaming\Chime
[2010/12/07 17:35:12 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft XNA
[2010/12/07 15:26:28 | 000,000,000 | —D | C] – C:\Users\Boy\Documents\Telltale Games
[2010/12/07 15:26:13 | 000,527,192 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAudio2_7.dll
[2010/12/07 15:26:13 | 000,518,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAudio2_7.dll
[2010/12/07 15:26:13 | 000,239,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\xactengine3_7.dll
[2010/12/07 15:26:13 | 000,176,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\xactengine3_7.dll
[2010/12/07 15:26:13 | 000,077,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XAPOFX1_5.dll
[2010/12/07 15:26:13 | 000,074,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XAPOFX1_5.dll
[2010/12/07 15:26:12 | 002,526,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DCompiler_43.dll
[2010/12/07 15:26:12 | 002,106,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DCompiler_43.dll
[2010/12/07 15:26:12 | 001,907,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dcsx_43.dll
[2010/12/07 15:26:12 | 001,868,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dcsx_43.dll
[2010/12/07 15:26:11 | 000,511,328 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx10_43.dll
[2010/12/07 15:26:11 | 000,470,880 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx10_43.dll
[2010/12/07 15:26:11 | 000,276,832 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3dx11_43.dll
[2010/12/07 15:26:11 | 000,248,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3dx11_43.dll
[2010/12/07 15:26:10 | 002,401,112 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\D3DX9_43.dll
[2010/12/07 15:26:10 | 001,998,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\D3DX9_43.dll
[2010/12/07 00:38:30 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft Chart Controls
[2010/12/06 18:30:01 | 000,000,000 | —D | C] – C:\ProgramData\PopCap Games
[2010/12/06 18:29:59 | 000,000,000 | —D | C] – C:\Users\Boy\AppData\Roaming\Zylom
[2010/12/06 18:29:52 | 000,000,000 | —D | C] – C:\ProgramData\Zylom
[2010/12/04 16:27:41 | 000,000,000 | —D | C] – C:\Users\Boy\AppData\Local\FOMM
[2010/12/04 16:27:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\GeMM
[2010/11/25 15:26:01 | 000,000,000 | —D | C] – C:\ProgramData\EA Core
[5 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[2 C:\Users\Boy\Desktop\*.tmp files -> C:\Users\Boy\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/12/24 12:38:03 | 000,014,832 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/12/24 12:38:03 | 000,014,832 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/12/24 12:30:50 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/12/24 12:30:47 | 3220,664,320 | -HS- | M] () – C:\hiberfil.sys
[2010/12/23 15:46:50 | 001,562,438 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2010/12/23 15:46:50 | 000,703,676 | —- | M] () – C:\Windows\SysNative\perfh013.dat
[2010/12/23 15:46:50 | 000,628,082 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2010/12/23 15:46:50 | 000,135,190 | —- | M] () – C:\Windows\SysNative\perfc013.dat
[2010/12/23 15:46:50 | 000,108,260 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2010/12/20 18:09:00 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010/12/20 18:08:40 | 000,024,152 | —- | M] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2010/12/17 22:55:48 | 111,937,804 | —- | M] () – C:\Users\Boy\Desktop\Need for Speed 4.rar
[2010/12/16 10:11:08 | 000,427,744 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2010/12/16 00:22:25 | 000,319,950 | —- | M] () – C:\Users\Boy\Desktop\Dit word em.png
[2010/12/10 19:31:31 | 000,013,504 | —- | M] () – C:\Users\Boy\Documents\Vincent Surprise.docx
[2010/12/05 01:41:46 | 000,000,566 | —- | M] () – C:\Users\Boy\Desktop\MLoader - Shortcut.lnk
[2010/12/05 01:41:33 | 000,000,583 | —- | M] () – C:\Users\Boy\Desktop\mercs2server - Shortcut.lnk
[2010/12/04 21:08:09 | 000,018,202 | —- | M] () – C:\Users\Boy\Desktop\Books NV.docx
[5 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[2 C:\Users\Boy\Desktop\*.tmp files -> C:\Users\Boy\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/12/17 22:51:25 | 111,937,804 | —- | C] () – C:\Users\Boy\Desktop\Need for Speed 4.rar
[2010/12/16 00:22:24 | 000,319,950 | —- | C] () – C:\Users\Boy\Desktop\Dit word em.png
[2010/12/10 19:29:30 | 000,013,504 | —- | C] () – C:\Users\Boy\Documents\Vincent Surprise.docx
[2010/12/05 00:33:22 | 000,000,566 | —- | C] () – C:\Users\Boy\Desktop\MLoader - Shortcut.lnk
[2010/12/05 00:33:19 | 000,000,583 | —- | C] () – C:\Users\Boy\Desktop\mercs2server - Shortcut.lnk
[2010/10/27 17:55:13 | 000,120,832 | —- | C] () – C:\Windows\SysWow64\lame_enc.dll
[2010/10/14 01:36:44 | 000,179,263 | —- | C] () – C:\Windows\SysWow64\xlive.dll.cat
[2010/10/05 00:31:38 | 000,217,088 | —- | C] () – C:\Windows\NVGfxOgl.dll
[2010/08/01 18:50:05 | 000,000,026 | —- | C] () – C:\Users\Boy\AppData\Local\boot.dat
[2010/05/31 23:04:48 | 000,108,032 | —- | C] () – C:\Windows\SysWow64\ff_vfw.dll
[2010/05/06 00:06:25 | 000,056,320 | —- | C] () – C:\Windows\SysWow64\iyvu9_32.dll
[2010/03/29 16:16:07 | 000,007,168 | —- | C] () – C:\Windows\SysWow64\drivers\StarOpen.sys
[2009/12/27 03:02:38 | 000,000,298 | —- | C] () – C:\Windows\game.ini
[2009/12/05 22:18:45 | 000,000,870 | —- | C] () – C:\Users\Boy\AppData\Roaming\coreavc.ini
[2009/11/22 12:34:43 | 000,819,200 | —- | C] () – C:\Windows\SysWow64\xvidcore.dll
[2009/11/22 12:34:42 | 000,180,224 | —- | C] () – C:\Windows\SysWow64\xvidvfw.dll
[2009/07/14 00:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 22:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2005/06/16 09:15:34 | 000,327,680 | —- | C] () – C:\Windows\SysWow64\QFClient2.dll

========== LOP Check ==========

[2010/11/11 17:58:29 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\.minecraft
[2010/12/21 00:56:40 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\Bioshock2
[2010/11/12 00:13:11 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\BitTorrent
[2010/03/29 16:16:36 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\Canneverbe Limited
[2010/04/21 21:54:18 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\cepd17
[2010/12/07 17:35:59 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\Chime
[2009/12/29 14:24:33 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\Command & Conquer 3 Kane's Wrath
[2010/03/20 15:54:45 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\Command and Conquer 4
[2009/12/09 00:05:36 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\DAEMON Tools Lite
[2010/10/12 14:35:52 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\GetRightToGo
[2010/05/24 00:15:19 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\Leadertech
[2009/11/11 11:03:26 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\NewsLeecher
[2010/10/16 11:56:36 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\OnLive App
[2010/05/31 18:52:32 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\PACE Anti-Piracy
[2009/12/05 23:37:57 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\Petroglyph
[2010/03/18 14:54:13 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\Publish Providers
[2010/03/18 15:03:45 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\Sony
[2010/03/18 15:03:45 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\Sony Creative Software
[2010/07/27 19:16:00 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\SPORE
[2010/06/29 11:57:42 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\SystemRequirementsLab
[2010/04/28 17:40:10 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\Tropico 3
[2010/10/18 01:09:14 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\Tunngle
[2010/03/04 16:36:29 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\Ubisoft
[2010/08/29 17:47:13 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\Youtube Downloader HD
[2010/12/06 18:29:59 | 000,000,000 | —D | M] – C:\Users\Boy\AppData\Roaming\Zylom
[2010/11/06 23:05:39 | 000,032,620 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/10/25 21:27:34 | 000,000,084 | —- | M] () – C:\cmdlog.txt
[2010/05/06 16:11:06 | 000,000,011 | —- | M] () – C:\error.txt
[2010/12/24 12:30:47 | 3220,664,320 | -HS- | M] () – C:\hiberfil.sys
[2010/12/24 12:30:47 | 4294,221,824 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2009/07/14 06:32:31 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 06:32:31 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 06:32:31 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 06:32:31 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 21:49:50 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 05:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/11/10 23:07:15 | 000,000,221 | -HS- | M] () – C:\Users\Boy\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 1198 bytes -> C:\ProgramData\Microsoft:ara3jEVNxiYmsECDLW5d
@Alternate Data Stream - 1172 bytes -> C:\ProgramData\Microsoft:5HvAyTpmspUmrLFgXtkQhSQaDO
@Alternate Data Stream - 1160 bytes -> C:\ProgramData\Microsoft:V7mCmvw3df89o8eVFHa4lSJj
@Alternate Data Stream - 1138 bytes -> C:\Users\Boy\AppData\Local\p4J8DHD6adra:BJ6PhzpzrchLMCS2qPV

< End of report >

Extras.txt

OTL Extras logfile created on: 24/12/2010 12:38:44 - Run 1
OTL by OldTimer - Version 3.2.18.0 Folder = C:\Users\Boy\Downloads
64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 51.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 298.09 Gb Total Space | 77.77 Gb Free Space | 26.09% Space Free | Partition Type: NTFS
Drive D: | 465.76 Gb Total Space | 269.44 Gb Free Space | 57.85% Space Free | Partition Type: NTFS
Drive E: | 931.51 Gb Total Space | 99.64 Gb Free Space | 10.70% Space Free | Partition Type: NTFS
Drive G: | 6.76 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: LIBERTY_PRIME | User Name: Boy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url[@ = InternetShortcut] – C:\Windows\System32\ieframe.DLL (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.url [@ = InternetShortcut] – C:\Windows\System32\ieframe.DLL (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %* File not found
cmdfile [open] – "%1" %* File not found
comfile [open] – "%1" %* File not found
exefile [open] – "%1" %* File not found
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %* File not found
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1" File not found
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S File not found
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] – "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] – "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] – "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] – "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] – "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] – "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"\" = C:\Windows\system\dwm.exe:*:Enabled:KL – File not found
"\" = C:\Windows\system\dwm.exe:*:Enabled:KL – File not found


========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{104FB32A-7CE3-4C4B-B2AA-70C613FF9DFA}" = iTunes
"{109945A8-D8D5-48B8-B4A5-195D3F99B56D}" = Logitech GamePanel Software 3.04.143
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{26A24AE4-039D-4CA4-87B4-2F86416021FF}" = Java™ 6 Update 21 (64-bit)
"{2ACBF1FA-F5C3-4B19-A774-B22A31F231B9}_is1" = Media Player Classic - Home Cinema v. 1.3.1249.0
"{33EB1061-ABF1-4470-A540-32E97A610536}" = Apple Mobile Device Support
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{41BF0DE4-5BAE-4B88-AFD3-86A30B222186}" = Bonjour
"{5EB6F3CB-46F4-451F-A028-7F6D8D35D7D0}" = Windows Live Language Selector
"{6CC95B76-D380-46B2-9022-9353938E48BA}" = Logitech GamePanel Software 3.03.133
"{6DD41C2B-1493-4877-9CF3-1C90FB7D66AD}" = ESET NOD32 Antivirus
"{90140000-0011-0000-1000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0015-0409-1000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0016-0409-1000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0018-0409-1000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0019-0409-1000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-001A-0409-1000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001B-0409-1000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001F-0409-1000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-1000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0C0A-1000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-002C-0409-1000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-0043-0000-1000-0000000FF1CE}" = Microsoft Office Office 32-bit Components 2010
"{90140000-0043-0409-1000-0000000FF1CE}" = Microsoft Office Shared 32-bit MUI (English) 2010
"{90140000-0044-0409-1000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010
"{90140000-006E-0409-1000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-00A1-0409-1000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00BA-0409-1000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010
"{90140000-0115-0409-1000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0117-0409-1000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{D3120436-1358-4253-9EB2-257FFE8CE1D9}" = Logitech SetPoint 5.20
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"Serviio" = Serviio
"UDK-38f45571-a985-4853-932a-5d3c2fbe3796" = Dungeon Defense
"WinRAR archiver" = WinRAR archiver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{000E79B7-E725-4F01-870A-C12942B7F8E4}" = Crysis®
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
"{0314ED3D-26A7-4F62-86A2-6B23353445E8}" = Star Wars Galactic Battlegrounds: Clone Campaigns
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2™
"{064DC64E-7A2F-4FDF-B598-E3C0747BBB9C}" = Call of Duty® - World at War™ 1.6 Patch
"{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer Generals
"{086A7D8C-0A38-4C7F-819A-620275550D5C}" = Nero Burning ROM Help
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0CA38F52-F0FA-4B9F-8A36-EC8A9609FBBC}" = Halo 2 for Windows Vista
"{1632FD86-1BA4-4FC4-8B25-A8C655D63F68}" = Sid Meier's Pirates!
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 2.6.2
"{1B0FBB9A-995D-47cd-87CD-13E68B676E4F}" = Mass Effect
"{1FDA5A37-B22D-43FF-B582-B8964050DC13}" = Microsoft Games for Windows - LIVE Redistributable
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2348B586-C9AE-46CE-936C-A68E9426E214}" = Nero StartSmart Help
"{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1" = Media Player Classic - Home Cinema v. 1.3.1249.0
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java™ 6 Update 22
"{26FDF89A-FA65-4FA2-8522-37CC84DFDCEE}" = Mercenaries 2: World in Flames™
"{28526951-55EF-4901-A0CA-B9AC966D1DD1}" = Split/Second
"{2A9A40C7-6670-4D5F-8F41-D12E2E08B48B}" = Star Wars™: Knights of the Old Republic ™
"{2BF0AE92-C3BC-4112-9066-1546342B1FAE}" = Call of Duty® - World at War™ 1.2 Patch
"{3AC8457C-0385-4BEA-A959-E095F05D6D67}" = Battlefield: Bad Company™ 2
"{3D374523-CFDE-461A-827E-2A102E2AB365}" = Star Wars Battlefront II
"{3F425F12-3A1B-4511-97B2-E2BB4701B745}" = Crysis Wars®
"{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}" = NVIDIA PhysX
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{41785C66-90F2-40CE-8CB5-1C94BFC97280}" = Microsoft Chart Controls for Microsoft .NET Framework 3.5
"{4343080E-91B7-4388-AB4D-FB1000008200}" = Dead Rising 2
"{43E506CC-6633-4F2A-8D8E-4A95D2384393}" = Crysis Wars® Patch
"{45057FCE-5784-48BE-8176-D9D00AF56C3C}" = The Sims™ 3 Late Night
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A8B461A-9336-4CF9-98F4-14DD38E673F0}" = BioShock 2
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{4E79A60F-15D2-4BEC-91AD-E41EC42E61B0}" = Batman: Arkham Asylum
"{52B65911-1559-4ED5-9461-46957FDD48CD}" = Borderlands
"{54510837-BD04-4C32-9676-DB1000028201}" = Red Faction: Guerrilla
"{5454085C-840F-4070-8FAA-441000018301}" = BioShock 2
"{5454085C-840F-4070-8FAA-441000028301}" = BioShock 2
"{5454085C-840F-4070-8FAA-441000038301}" = BioShock 2
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5731C0A8-B266-451A-8D3F-8066AA21836F}" = Tom Clancy's Rainbow Six Vegas
"{593AFFA4-D08E-4272-BABB-420949D32A10}" = QUICKfind
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{6530EB5E-F2BE-45D3-906B-E4AFFF2D1588}" = Windows Live Device Manager
"{6530FDAA-5B1F-4830-95BB-650E9804D239}" = UE3Redist
"{6592FDEC-2C1A-413A-9985-25FEC2F0848D}" = Star Wars Empire at War Forces of Corruption
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{6D316D67-DA52-4659-9C98-F479963534D6}" = Audiosurf
"{6D8DDB4A-C263-40DE-BA16-AFDAD159D59A}" = Tom Clancy's Splinter Cell Conviction
"{6E36A172-06FB-4BC8-B7FC-D30D219E6776}" = Tom Clancy's H.A.W.X
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{71828142-5A24-4BD0-97E7-976DA08CE6CF}" = The Sims™ 3 High-End Loft Stuff
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7353BAE6-5E49-46C4-A9B5-8A269A313789}" = Crysis WARHEAD®
"{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}" = Mass Effect 2
"{75E607CF-7BAE-4B88-84B3-97F3DF44BA28}" = FEARCombat
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7C3D8108-8D99-427F-A1C2-D8E0D25A469C}" = Tom Clancy's EndWar
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7F7E4FA7-6F32-4DE2-917E-361E034AED7A}" = Spider-Man™ - Web of Shadows
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{83202942-84B3-4C50-8622-B8C0AA2D2885}" = Nero Express Help
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83A606F5-BF6F-42ED-9F33-B9F74297CDED}" = Need for Speed™ Hot Pursuit
"{8570BEE8-0CA3-4977-9AB1-80ED93F0513C}" = Assassin's Creed II
"{86A4C6D9-29EE-4719-AFA1-BA3341862B83}" = Microsoft Games for Windows - LIVE
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty® 4 - Modern Warfare™ 1.6 Patch
"{8DC910CD-8EE3-4ffc-A4EB-9B02701059C4}" = Battlefield Heroes
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{910F4A29-1134-49E0-AD8B-56E4A3152BD1}" = The Sims™ 3 Ambitions
"{9208F706-6528-4591-A997-F41395FBD8A7}" = Spider-Man™ - Web of Shadows 1.1 Patch
"{92482FB3-C05B-41C6-89E7-75D985602A6E}" = System Requirements Lab
"{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty® 4 - Modern Warfare™ 1.7 Patch
"{9322A850-9091-4D0E-B252-3E82EDA3D94A}" = Prototype™
"{9559F7CA-5E34-4237-A2D9-D856464AD727}" = Project64 1.6
"{974C4B12-4D02-4879-85E0-61C95CC63E9E}" = Fallout 3
"{99AE7207-8612-4DBA-A8F8-BAE5C633390D}" = Star Wars Empire at War
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B88DD94-1AAE-41C4-BD95-2D8737D5E9E2}" = Watson
"{9DF0196F-B6B8-4C3A-8790-DE42AA530101}" = SPORE™
"{9F01A67B-7D67-482F-9D4F-D5980A440FD4}" = Call of Duty® - World at War™ 1.4 Patch
"{A202BDBA-753F-41B9-B649-CFB0B45FC03E}" = Star Wars Galactic Battlegrounds
"{A357EF4C-2B6F-4980-ACA9-B1E42A74D7F3}" = Red Faction Guerrilla
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AC08BBA0-96B9-431A-A7D0-D8598E493775}" = RESIDENT EVIL 5
"{AC76BA86-7AD7-1043-7B44-A94000000001}" = Adobe Reader 9.4.1 - Nederlands
"{AEC81925-9C76-4707-84A9-40696C613ED3}" = Dragon Age: Origins
"{B0C30E93-D3D9-4F04-A2AC-54749B573275}" = Command & Conquer 3
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{BA26FFA5-6D47-47DB-BE56-34C357B5F8CC}" = The Sims™ 3 World Adventures
"{BABAEBE4-9FFB-4B5D-9453-64FF11517CA2}" = Tom Clancy's Splinter Cell Chaos Theory
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = The Sims™ 3
"{C194D333-B84A-4BB7-B35E-060732D98DC4}" = GPGNet
"{C3C9EB3D-24FA-4462-B784-0EC6AAFCD2DD}" = Fable - The Lost Chapters
"{C3DC2DF5-EFAC-4055-9010-31F7C545DD9E}" = Call of Duty® - World at War™ 1.5 Patch
"{CC2422C9-F7B5-4175-B295-5EC2283AA674}" = Command & Conquer™ 3: Kane's Wrath
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{CE4A3D0F-D1B0-47D1-BF99-3E957C548D12}" = LogMeIn Hamachi
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D80A6A73-E58A-4673-AFF5-F12D7110661F}" = Call of Duty® - World at War™
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E17141A6-211D-5854-61D9-69827A430D82}" = EA Download Manager UI
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E42E07F5-5A90-4BA9-B55A-79FCF9EAF9B5}" = STK02N 2.3
"{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty® 4 - Modern Warfare™
"{E571E8B1-9771-465D-9DE0-3BA2D1BDAE99}" = The Matrix - Path of Neo
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{ED436EA8-4145-4703-AE5D-4D09DD24AF5A}" = The Sims™ 3 Fast Lane Stuff
"{ED50ECE9-EC54-4C05-B5ED-EE4741A9F2EC}" = Battlefield 2142
"{EF7E931D-DC84-471B-8DB6-A83358095474}" = EA Download Manager
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2835483-37F2-4123-B4FE-0E77D58447F2}" = Far Cry 2
"{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1}" = Command and ConquerTM Generals Zero Hour
"{FD416706-875C-4B0B-A23A-9E740DAE029E}" = Tom Clancy's Rainbow Six Vegas 2
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FE0646A7-19D0-41B4-A2BB-2C35D644270D}" = Windows Live OneCare safety scanner
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"AC3Filter_is1" = AC3Filter 1.63b
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Audacity_is1" = Audacity 1.2.6
"AVIcodec" = AVIcodec (remove only)
"BitTorrent" = BitTorrent
"Call of Duty: Black Ops_is1" = Call of Duty: Black Ops
"CDisplay_is1" = CDisplay 1.8
"cepd17" = Cambridge English Pronouncing Dictionary - 17th Edition
"com.ea.Vault.919CACB699904AC5D41B606703500DD39747C02D.1" = EA Download Manager UI
"Coop Warfare0.7" = Coop Warfare 0.7
"Crysis WARHEAD®" = Crysis WARHEAD®
"Crysis Wars®" = Crysis Wars®
"Crysis Wars® Patch" = Crysis Wars® Patch
"divxh264_is1" = DivX H.264 decoder [removed]
"DualCoreCenter_is1" = DualCoreCenter
"EA Download Manager" = EA Download Manager
"Fallout Mod Manager_is1" = Fallout Mod Manager 0.10.2
"ffdshow_is1" = ffdshow v1.1.3529 [2010-08-11]
"Fraps" = Fraps (remove only)
"GameSpy Arcade" = GameSpy Arcade
"Generic Mod Manager_is1" = Fallout Mod Manager 0.13.21
"GFWL_{4343080E-91B7-4388-AB4D-FB1000008200}" = Dead Rising 2
"HaaliMkx" = Haali Media Splitter
"Halo" = Microsoft Halo
"Halo 2" = Halo 2 for Windows Vista
"InstallShield_{064DC64E-7A2F-4FDF-B598-E3C0747BBB9C}" = Call of Duty® - World at War™ 1.6 Patch
"InstallShield_{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer Generals
"InstallShield_{1632FD86-1BA4-4FC4-8B25-A8C655D63F68}" = Sid Meier's Pirates!
"InstallShield_{2BF0AE92-C3BC-4112-9066-1546342B1FAE}" = Call of Duty® - World at War™ 1.2 Patch
"InstallShield_{7F7E4FA7-6F32-4DE2-917E-361E034AED7A}" = Spider-Man™ - Web of Shadows
"InstallShield_{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty® 4 - Modern Warfare™ 1.6 Patch
"InstallShield_{9208F706-6528-4591-A997-F41395FBD8A7}" = Spider-Man® - Web of Shadows™ 1.1 Patch
"InstallShield_{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty® 4 - Modern Warfare™ 1.7 Patch
"InstallShield_{9322A850-9091-4D0E-B252-3E82EDA3D94A}" = Prototype™
"InstallShield_{9F01A67B-7D67-482F-9D4F-D5980A440FD4}" = Call of Duty® - World at War™ 1.4 Patch
"InstallShield_{A357EF4C-2B6F-4980-ACA9-B1E42A74D7F3}" = Red Faction Guerrilla
"InstallShield_{C3C9EB3D-24FA-4462-B784-0EC6AAFCD2DD}" = Fable - The Lost Chapters
"InstallShield_{C3DC2DF5-EFAC-4055-9010-31F7C545DD9E}" = Call of Duty® - World at War™ 1.5 Patch
"InstallShield_{D80A6A73-E58A-4673-AFF5-F12D7110661F}" = Call of Duty® - World at War™
"InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty® 4 - Modern Warfare™
"InstallShield_{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1}" = Command and ConquerTM Generals Zero Hour
"IPA/SAM Phonetic Fonts_is1" = IPA/SAM Phonetics Fonts
"Just Cause 2_is1" = Just Cause 2
"Little Fighter 2 version 2.0a" = Little Fighter 2 version 2.0a
"LogMeIn Hamachi" = LogMeIn Hamachi
"Machines" = Machines
"Mafia II_is1" = Mafia II
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mass Effect 2 Suicide Mission Survival Calculator_is1" = Mass Effect 2 Suicide Mission Survival Calculator version 1.16
"Messenger Plus! Live" = Messenger Plus! Live
"Metro 2033_is1" = Metro 2033
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"NewsLeecher_is1" = NewsLeecher v3.95 Beta 3
"OnLive" = OnLive
"Planten tegen Zombies Deluxe" = Planten tegen Zombies Deluxe
"PunkBusterSvc" = PunkBuster Services
"QuickPar" = QuickPar 0.9
"RADVideo" = RAD Video Tools
"RiseOfNations 1.0" = Microsoft Rise Of Nations
"RiseofNationsExpansion 1.0" = Rise of Nations Thrones and Patriots
"Sorian AI Mod_is1" = Sorian AI Mod 2.0.0
"StarCraft II" = StarCraft II
"Steam App 10180" = Call of Duty: Modern Warfare 2
"Steam App 10190" = Call of Duty: Modern Warfare 2 - Multiplayer
"Steam App 22380" = Fallout: New Vegas
"Steam App 31280" = Poker Night at the Inventory
"Steam App 39000" = Moonbase Alpha
"Steam App 500" = Left 4 Dead
"Steam App 550" = Left 4 Dead 2
"Steam App 62100" = Chime
"Steam App 630" = Alien Swarm
"Tropico3" = Tropico 3 1.00
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.0.3
"Winamp" = Winamp
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"WinLiveSuite" = Windows Live Essentials
"X3TerranConflict_is1" = X3 Terran Conflict v2.5
"Xvid_is1" = Xvid 1.2.2 final uninstall
"Youtube Downloader HD_is1" = Youtube Downloader HD v. 2.2

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{25A1E6A4-2DBD-4AC0-8650-8EA9A45B183D}" = Supreme Commander
"{31D95937-B237-405D-920C-A3EF4E482395}" = Supreme Commander - Forged Alliance
"InstallShield_{6530FDAA-5B1F-4830-95BB-650E9804D239}" = UE3Redist

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 15/12/2010 05:57:52 | Computer Name = Liberty_Prime | Source = Bonjour Service | ID = 100
Description = 392: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 15/12/2010 05:57:52 | Computer Name = Liberty_Prime | Source = Bonjour Service | ID = 100
Description = 476: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 17/12/2010 16:37:41 | Computer Name = Liberty_Prime | Source = Application Error | ID = 1000
Description = Faulting application name: DualCoreCenter.exe, version: 2.0.6.7, time
stamp: 0x4c29c7af Faulting module name: KERNELBASE.dll, version: 6.1.7600.16385,
time stamp: 0x4a5bdbdf Exception code: 0x80000003 Fault offset: 0x000122a1 Faulting
process id: 0xe6c Faulting application start time: 0x01cb9e0515eddf69 Faulting application
path: C:\Program Files (x86)\MSI\DualCoreCenter\DualCoreCenter.exe Faulting module
path: C:\Windows\syswow64\KERNELBASE.dll Report Id: 7e2f5992-0a1d-11e0-b470-0019db4790ed

Error - 22/12/2010 11:13:55 | Computer Name = Liberty_Prime | Source = Bonjour Service | ID = 100
Description = 472: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 22/12/2010 11:53:52 | Computer Name = Liberty_Prime | Source = Application Error | ID = 1000
Description = Faulting application name: Skype.exe, version: 5.0.0.152, time stamp:
0x4cb31516 Faulting module name: KERNELBASE.dll, version: 6.1.7600.16385, time stamp:
0x4a5bdbdf Exception code: 0xe0fafafa Fault offset: 0x0000b727 Faulting process id:
0x1190 Faulting application start time: 0x01cba1c1a7da451d Faulting application path:
C:\Program Files (x86)\Skype\Phone\Skype.exe Faulting module path: C:\Windows\syswow64\KERNELBASE.dll
Report
Id: ac018c4d-0de3-11e0-a5f6-0019db4790ed

Error - 22/12/2010 17:34:59 | Computer Name = Liberty_Prime | Source = Bonjour Service | ID = 100
Description = 264: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 22/12/2010 17:34:59 | Computer Name = Liberty_Prime | Source = Bonjour Service | ID = 100
Description = 488: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 22/12/2010 17:34:59 | Computer Name = Liberty_Prime | Source = Bonjour Service | ID = 100
Description = 468: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 22/12/2010 17:34:59 | Computer Name = Liberty_Prime | Source = Bonjour Service | ID = 100
Description = 472: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 24/12/2010 06:33:34 | Computer Name = Liberty_Prime | Source = VSS | ID = 8194
Description =

[ System Events ]
Error - 15/06/2010 19:13:07 | Computer Name = Liberty_Prime | Source = Schannel | ID = 36888
Description = The following fatal alert was generated: 10. The internal error state
is 10.

Error - 16/06/2010 13:43:49 | Computer Name = Liberty_Prime | Source = Schannel | ID = 36888
Description = The following fatal alert was generated: 10. The internal error state
is 10.

Error - 16/06/2010 19:21:38 | Computer Name = Liberty_Prime | Source = Schannel | ID = 36888
Description = The following fatal alert was generated: 10. The internal error state
is 10.

Error - 18/06/2010 18:20:24 | Computer Name = Liberty_Prime | Source = Schannel | ID = 36888
Description = The following fatal alert was generated: 10. The internal error state
is 10.

Error - 18/06/2010 18:45:51 | Computer Name = Liberty_Prime | Source = Schannel | ID = 36888
Description = The following fatal alert was generated: 10. The internal error state
is 10.

Error - 19/06/2010 05:09:42 | Computer Name = Liberty_Prime | Source = Schannel | ID = 36888
Description = The following fatal alert was generated: 10. The internal error state
is 10.

Error - 19/06/2010 09:27:37 | Computer Name = Liberty_Prime | Source = Schannel | ID = 36888
Description = The following fatal alert was generated: 10. The internal error state
is 10.

Error - 19/06/2010 13:48:35 | Computer Name = Liberty_Prime | Source = Schannel | ID = 36888
Description = The following fatal alert was generated: 10. The internal error state
is 10.

Error - 20/06/2010 14:26:22 | Computer Name = Liberty_Prime | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk4\DR4.

Error - 20/06/2010 14:26:26 | Computer Name = Liberty_Prime | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk4\DR4.


< End of report >

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.


Note: Close all browsers before running ATF Cleaner: IE, FireFox, etc.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.


It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.


Next:


Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1
Download Mirror #2

• Ensure all Firefox windows are closed.
• To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).
• When prompted to run the scan, click Yes.
• It doesn't take long to run, once it is finished move onto the next step

Next:

Note: if the Cure option is not there, please select 'Skip'.

Please read carefully and follow these steps.

• Download TDSSKiller and save it to your Desktop.
• Extract its contents to your desktop.
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If an infected file is detected, the default action will be Cure, click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Also please describe how your computer behaves at the moment.

Please run TDSSKiller again so we can be sure it's gone.

After the 50 stages part of Combofix it repeatedly stated that pev.cfxxe had stopped working but it continued anyway and finished with these results: ComboFix 10-12-23.05 - Boy 24/12/2010 16:21:49.1.2 - x64 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.4095.2317 [GMT 1:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5} SP: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . D:\install.exe . ((((((((((((((((((((((((( Files Created from 2010-11-24 to 2010-12-24 ))))))))))))))))))))))))))))))) . 2010-12-24 11:22 . 2010-12-24 11:22 ——– d—–w- c:\users\Boy\AppData\Roaming\Malwarebytes 2010-12-24 11:22 . 2010-12-20 17:09 38224 —-a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys 2010-12-24 11:22 . 2010-12-24 11:22 ——– d—–w- c:\programdata\Malwarebytes 2010-12-24 11:22 . 2010-12-24 11:22 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2010-12-24 10:21 . 2010-11-10 05:35 8199504 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D5A0C46C-5576-49CC-AEAC-341E2D1F582A}\mpengine.dll 2010-12-15 16:42 . 2010-10-27 04:32 2048 —-a-w- c:\windows\SysWow64\tzres.dll 2010-12-15 16:42 . 2010-11-02 04:40 496128 —-a-w- c:\windows\SysWow64\taskschd.dll 2010-12-15 16:42 . 2010-11-02 04:34 192000 —-a-w- c:\windows\SysWow64\taskeng.exe 2010-12-15 16:42 . 2010-11-02 04:40 305152 —-a-w- c:\windows\SysWow64\taskcomp.dll 2010-12-15 16:42 . 2010-11-02 04:34 179712 —-a-w- c:\windows\SysWow64\schtasks.exe 2010-12-12 00:07 . 2010-12-12 00:07 ——– d—–w- c:\program files (x86)\LogMeIn Hamachi 2010-12-11 10:12 . 2010-12-11 10:12 ——– d—–w- c:\program files (x86)\Common Files\Skype 2010-12-07 16:35 . 2010-12-07 16:35 ——– d—–w- c:\users\Boy\AppData\Roaming\Chime 2010-12-07 16:35 . 2010-12-07 16:35 ——– d—–w- c:\program files (x86)\Microsoft XNA 2010-12-07 14:26 . 2010-06-02 03:55 74072 —-a-w- c:\windows\SysWow64\XAPOFX1_5.dll 2010-12-07 14:26 . 2010-06-02 03:55 527192 —-a-w- c:\windows\SysWow64\XAudio2_7.dll 2010-12-07 14:26 . 2010-06-02 03:55 239960 —-a-w- c:\windows\SysWow64\xactengine3_7.dll 2010-12-07 14:26 . 2010-05-26 10:41 2106216 —-a-w- c:\windows\SysWow64\D3DCompiler_43.dll 2010-12-07 14:26 . 2010-05-26 10:41 1868128 —-a-w- c:\windows\SysWow64\d3dcsx_43.dll 2010-12-07 14:26 . 2010-05-26 10:41 470880 —-a-w- c:\windows\SysWow64\d3dx10_43.dll 2010-12-07 14:26 . 2010-05-26 10:41 248672 —-a-w- c:\windows\SysWow64\d3dx11_43.dll 2010-12-07 14:26 . 2010-05-26 10:41 1998168 —-a-w- c:\windows\SysWow64\D3DX9_43.dll 2010-12-06 23:38 . 2010-12-06 23:38 ——– d—–w- c:\program files (x86)\Microsoft Chart Controls 2010-12-06 17:30 . 2010-12-06 17:30 ——– d—–w- c:\programdata\PopCap Games 2010-12-06 17:29 . 2010-12-06 17:29 ——– d—–w- c:\users\Boy\AppData\Roaming\Zylom 2010-12-06 17:29 . 2010-12-06 17:29 ——– d—–w- c:\programdata\Zylom 2010-12-06 17:29 . 2009-03-25 10:42 114688 —-a-w- c:\program files (x86)\Mozilla Firefox\plugins\npzylomgamesplayer.dll 2010-12-04 15:27 . 2010-12-04 15:27 ——– d—–w- c:\users\Boy\AppData\Local\FOMM 2010-12-04 15:27 . 2010-12-04 15:27 ——– d—–w- c:\program files (x86)\GeMM 2010-11-25 14:26 . 2010-11-25 14:26 ——– d—–w- c:\programdata\EA Core . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-11-02 09:50 . 2010-11-02 09:51 8192 —-a-w- c:\windows\SysWow64\srvany.exe 2010-10-26 18:42 . 2010-10-26 18:42 98304 —-a-w- c:\windows\system32CmdLineExt.dll 2010-10-21 18:44 . 2009-12-27 20:32 234280 —-a-w- c:\windows\SysWow64\PnkBstrB.xtr 2010-10-21 18:44 . 2009-12-22 12:21 234280 —-a-w- c:\windows\SysWow64\PnkBstrB.exe 2010-10-14 00:36 . 2010-10-14 00:36 15451288 —-a-w- c:\windows\SysWow64\xlive.dll 2010-10-14 00:36 . 2010-10-14 00:36 13642904 —-a-w- c:\windows\SysWow64\xlivefnt.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072] "WindowsLivePhone"="c:\program files (x86)\Windows Live\Device Manager\msgrdvmn.exe" [2008-12-22 787816] "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696] [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "WindowsLivePhone"="c:\program files (x86)\Windows Live\Device Manager\msgrdvmn.exe" [2008-12-22 787816] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552] "DelReg"="c:\program files (x86)\MSI\DualCoreCenter\DelReg.exe" [2008-05-13 196608] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-09-08 421888] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-09-24 421160] "LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2010-12-06 1910152] c:\users\Boy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Sid Registration.lnk - G:\ATR1.exe [N/A] The Matrix_ Path of Neo Registration.lnk - c:\users\Boy\AppData\Local\Temp\{3E55C866-1554-4152-9734-797852C7A02A}\{E571E8B1-9771-465D-9DE0-3BA2D1BDAE99}\ATR1.exe [N/A] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ DualCoreCenter.lnk - c:\program files (x86)\MSI\DualCoreCenter\StartUpDualCoreCenter.exe [2010-10-5 192512] Serviio.lnk - c:\program files (x86)\Serviio\bin\ServiioConsole.exe [2010-6-15 116224] SetPointII.lnk - c:\program files\Logitech\SetPoint II\SetPointII.exe [2009-7-21 815104] STK02N 2.3 PNP Monitor.lnk - c:\windows\STK02N\STK02NM.exe [N/A] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 KMService;KMService;c:\windows\system32\srvany.exe [x] R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;b:\dragon age\bin_ship\DAUpdaterSvc.Service.exe [2009-07-26 25832] R3 DCamUSBSTK02N;Standard Camera;c:\windows\system32\DRIVERS\STK02NW2.sys [2007-03-12 106496] R3 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2010-12-06 2101640] R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 51456888] R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2010-04-19 50688] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-20 1255736] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-11-10 834544] S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2009-04-09 134024] S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2009-04-09 731840] S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2009-04-09 121152] S2 Serviio;Serviio;c:\program files (x86)\Serviio\bin\ServiioService.exe [2010-06-15 99840] S3 DualCoreCenter;DualCoreCenter;c:\program files (x86)\MSI\DualCoreCenter\NTGLM7X64.sys [2010-02-08 44344] S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\everest\kerneld.amd64 [2008-03-09 21120] S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [2009-11-23 22408] S3 LGPBTDD;LGPBTDD.sys Display Driver;c:\windows\system32\Drivers\LGPBTDD.sys [2009-07-01 30728] S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys [2009-11-23 16008] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-03-01 187392] S3 RushTopDevice2;RushTopDevice2;c:\program files (x86)\MSI\DualCoreCenter\RushTop64.sys [2009-03-18 76088] — Other Services/Drivers In Memory — *NewlyCreated* - EVERESTDRIVER *Deregistered* - klmd25 . ——— x86-64 ———– [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-11-10 2691496] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-20 7981088] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 130576] "Launch LgDeviceAgent"="c:\program files\Logitech\GamePanel Software\LgDevAgt.exe" [2010-02-18 415816] "Launch LCDMon"="c:\program files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2010-02-18 2093128] "Launch LGDCore"="c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2010-02-18 4271688] "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.google.nl/ mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105 Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL FF - ProfilePath - c:\users\Boy\AppData\Roaming\Mozilla\Firefox\Profiles\ttctpqjx.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.nl/ FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} FF - Ext: Battlefield Heroes Updater: [removed] - %profile%\extensions\[removed] FF - Ext: FastestFox: [removed] - %profile%\extensions\[removed] FF - Ext: ThreeShips Helper Extension: {9e1d7c80-43d1-11db-b0de-0800200c9a66} - %profile%\extensions\{9e1d7c80-43d1-11db-b0de-0800200c9a66} FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} . - - - - ORPHANS REMOVED - - - - AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc_heroes.exe AddRemove-Sorian AI Mod_is1 - c:\program files (x86)\Sorian AI Mod\unins000.exe AddRemove-Uninstall_is1 - c:\program files (x86)\Common Files\DVDVideoSoft\unins000.exe [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EverestDriver] "ImagePath"="\??\c:\everest\kerneld.amd64" . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_USERS\S-1-5-21-170070200-1436177767-1140865244-1001\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] @Allowed: (Read) (RestrictedCode) "??"=hex:35,81,37,07,f8,87,00,7e,1b,83,39,75,70,c8,91,d7,b9,e7,03,bb,91,db,0e, f4,0d,ae,1f,0b,26,4b,d9,f3,1c,dd,cf,10,a1,21,80,3c,22,09,40,6e,91,40,32,40,\ "??"=hex:04,33,d3,1d,b0,d0,53,d3,28,d8,2d,b0,8d,f8,29,f0 [HKEY_USERS\S-1-5-21-170070200-1436177767-1140865244-1001\Software\SecuROM\License information*] "datasecu"=hex:a7,5a,9f,44,f4,b2,c0,fa,56,bc,e0,93,3b,2c,fd,b2,ed,df,44,cf,96, 28,17,77,34,92,50,f9,8e,26,45,e7,3e,f8,83,34,14,98,ce,33,35,55,b2,70,25,ee,\ "rkeysecu"=hex:5b,ef,76,4d,f4,26,0d,10,50,68,85,30,9d,bd,15,13 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10c.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx" "ThreadingModel"="Apartment" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx" "ThreadingModel"="Apartment" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" [HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info] @Denied: (2) (LocalSystem) "AppDataDir"="c:\\ProgramData\\ESET\\ESET NOD32 Antivirus\\" "DataDir"="ESET\\ESET NOD32 Antivirus\\" "EditionName"=" " "InstallDir"="c:\\Program Files\\ESET\\ESET NOD32 Antivirus\\" "LanguageId"=dword:00000409 "PackageTag"=dword:6090e758 "ProductBase"=dword:00000000 "ProductCode"="{6DD41C2B-1493-4877-9CF3-1C90FB7D66AD}" "ProductName"="ESET NOD32 Antivirus" "ProductType"="eav" "ProductVersion"="4.0.424.0" "UniqueId"="00349B394AF9EF9C" "ScannerBuild"=dword:00001283 "ScannerVersionId"=dword:00000f9d "ScannerVersion"="Open window for status." "FixId"=dword:00000007 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2010-12-24 16:33:27 ComboFix-quarantined-files.txt 2010-12-24 15:33 Pre-Run: 83,030,609,920 bytes free Post-Run: 84,416,598,016 bytes free - - End Of File - - 481B84449C3721E6269B5C64EDACFD95