Spyware / Malware / Virus Removal

system32 infected

11 min read

Looking for the outcome? Ask AI

Tom_q2356 Topic Starter

Post #1January 3, 2011, 9:59 AM UTC

Hi,

It has been a while since my last time here, glad to be back home.

Well, let me get to the point, my superantispyware found a trojan.Agent/Gen-Nullo[Micro] from system32 folder and with at least 3 tries of removal by superantispyware and reboot, it is still in the folder. the exact path is as follow:
C:\WINDOWS\SYSTEM32\DRIVERSTORE\FILEREPOSITORY\IALMNT5.INF_X86_NEUTRAL_00E3A135D054E3BB\SETB076.TMP
Please Help! As usual, I will check back in 3 days. Thanks!!

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:34:04, on 2011/1/2
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16700)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\reliz\akeys.exe
C:\Program Files\Kingsoft\PowerWord_Oxford\XDict.exe
C:\Program Files\ttstream\ttsAP.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Kingsoft\PowerWord_Oxford\CBAppendix.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe
C:\Users\Tom_q\Desktop\HiJackThis.exe

O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [SSDMonitor] C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Active Keys Application File] C:\Program Files\reliz\akeys.exe
O4 - HKCU\..\Run: [CursorXP] "C:\Program Files\CursorXP\CursorXP.exe" -s
O4 - HKCU\..\Run: [Kingsoft PowerWord] C:\Program Files\Kingsoft\PowerWord_Oxford\XDict.exe
O4 - HKCU\..\Run: [tts Accelerator] C:\Program Files\ttstream\ttsap.exe
O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Logoff - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComLogoff.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: 使用光影编辑和美化 - C:\Program Files\nEO iMAGING\NeoOpenNeo.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到飞信表情 - res://C:\Program Files\China Mobile\Fetion\FetionExt.dll/202
O8 - Extra context menu item: 通过飞信短信发送 - res://C:\Program Files\China Mobile\Fetion\FetionExt.dll/201
O9 - Extra button: 填写表单 - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: 填写表单 - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: 保存 - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: 保存表单 - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm工具栏 - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: 启动飞信 - {814953B0-3DE7-4171-A0DD-A7A38322B6C7} - C:\Program Files\China Mobile\Fetion\Fetion.exe
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: 显示或隐藏 HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O15 - Trusted Zone: http://*.tts.tv
O15 - Trusted Zone: http://*.ttstream.com
O15 - Trusted Zone: http://*.webscache.com
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O15 - ESC Trusted Zone: http://*.tts.tv
O15 - ESC Trusted Zone: http://*.ttstream.com
O15 - ESC Trusted Zone: http://*.webscache.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} (CInstallLPCtrl Object) - http://u3.sandisk.com/download/atts/LPInstaller.CAB
O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll
O18 - Protocol: Kool - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\Windows\System32\Kool3DownXControl.ocx
O18 - Protocol: Kool3 - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\Windows\System32\Kool3DownXControl.ocx
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe
O23 - Service: AVG 防火墙 (avgfws) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgfws.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe
O23 - Service: Defragmentation-Service (DfSdkS) - mst software GmbH, Germany - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 6\Dfsdks.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @C:\Program Files\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files\Nero\Update\NASvc.exe
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
O23 - Service: Airytec Switch Off - Task Scheduler (SwOffScheduler) - Airytec - C:\Program Files\Airytec\Switch Off\swoff.exe
O23 - Service: Airytec Switch Off - Web Interface (SwOffWeb) - Airytec - C:\Program Files\Airytec\Switch Off\swoff.exe
O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe

–
End of file - 10088 bytes

schrauber

Post #2January 4, 2011, 6:42 PM UTC

Hello, Tom_q2356
Welcome to the WhatTheTech Forums. My name is Thomas (Tom is fine), and I will be helping you fixing your problems.

Please take note of some guidelines for this fix:

Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
Please set your system to show all files.
Click Start, open My Computer, select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.

Please download OTL from one of the following mirrors:
- This is THE Mirror
Save it to your desktop.
Double click on the [external image: Posted Image] icon on your desktop.
Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%\*.exe
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemdrive%\*.sys /90 /md5
Push the Quick Scan button.
Two reports will open, copy and paste them in a reply here:
- OTL.txt <– Will be opened
- Extra.txt <– Will be minimized

Tom_q2356

Post #3January 6, 2011, 6:05 AM UTC

OTL logfile created on: 2011/1/5 19:27:05 - Run 1
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Users\Tom_q\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000804 | Country: 中华人民共和国 | Language: CHS | Date Format: yyyy/M/d

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 50.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 230.88 Gb Total Space | 203.75 Gb Free Space | 88.25% Space Free | Partition Type: NTFS

Computer Name: Tom_q-PC | User Name: Tom_q | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/01/05 19:20:06 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Tom_q\Desktop\OTL.exe
PRC - [2010/12/31 20:33:11 | 000,632,792 | —- | M] (PC Tools) – C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
PRC - [2010/12/20 18:08:58 | 000,363,344 | —- | M] (Malwarebytes Corporation) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2010/12/20 18:08:56 | 000,443,728 | —- | M] (Malwarebytes Corporation) – C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2010/12/07 00:32:02 | 002,228,008 | —- | M] (TeamViewer GmbH) – C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
PRC - [2010/12/05 16:26:40 | 000,654,176 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgrsx.exe
PRC - [2010/12/05 16:26:12 | 000,650,592 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgchsvx.exe
PRC - [2010/12/01 04:14:46 | 001,084,256 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgnsx.exe
PRC - [2010/12/01 04:14:14 | 001,052,512 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgemcx.exe
PRC - [2010/11/23 13:34:16 | 000,724,048 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
PRC - [2010/11/23 13:34:14 | 006,128,208 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
PRC - [2010/11/22 04:48:46 | 003,226,632 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgfws.exe
PRC - [2010/10/22 04:58:18 | 000,265,400 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgwdsvc.exe
PRC - [2010/10/22 04:57:54 | 002,745,696 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgtray.exe
PRC - [2010/10/22 04:56:58 | 000,845,664 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgcsrvx.exe
PRC - [2010/10/22 04:56:48 | 000,745,824 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgam.exe
PRC - [2010/05/31 01:18:16 | 000,323,976 | —- | M] (BillP Studios) – C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
PRC - [2010/05/04 12:07:22 | 000,503,080 | —- | M] (Nero AG) – C:\Program Files\Nero\Update\NASvc.exe
PRC - [2010/02/23 17:25:30 | 000,214,408 | —- | M] (ttstream Inc) – C:\Program Files\ttstream\ttsAP.exe
PRC - [2009/10/30 19:45:39 | 002,614,272 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2009/10/14 15:42:38 | 000,104,408 | —- | M] (PC Tools) – C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
PRC - [2009/08/24 19:04:08 | 001,033,480 | —- | M] (Raxco Software, Inc.) – C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
PRC - [2009/08/24 19:04:06 | 000,066,824 | —- | M] (Raxco Software, Inc.) – C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe
PRC - [2009/08/24 19:04:04 | 000,935,176 | —- | M] (Raxco Software, Inc.) – C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
PRC - [2009/07/13 15:14:42 | 000,049,152 | —- | M] (Microsoft Corporation) – C:\Windows\System32\taskhost.exe
PRC - [2009/07/13 15:14:15 | 000,271,360 | —- | M] (Microsoft Corporation) – C:\Windows\System32\conhost.exe
PRC - [2009/06/05 17:07:44 | 002,403,440 | —- | M] (Copyright © Kingsoft Corporation Limited. All rights reserved.) – C:\Program Files\Kingsoft\PowerWord_Oxford\XDict.exe
PRC - [2009/05/24 20:38:00 | 000,248,944 | —- | M] (Copyright © Kingsoft Corporation Limited. All rights reserved.) – C:\Program Files\Kingsoft\PowerWord_Oxford\CBAppendix.exe
PRC - [2008/03/18 14:31:20 | 004,742,184 | —- | M] (Yahoo! Inc.) – C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
PRC - [2003/12/17 17:43:04 | 000,118,784 | —- | M] (Softarium.com) – C:\Program Files\reliz\akeys.exe

========== Modules (SafeList) ==========

MOD - [2011/01/05 19:20:06 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Tom_q\Desktop\OTL.exe
MOD - [2010/10/28 00:03:40 | 003,235,184 | —- | M] (Sogou.com Inc.) – C:\Windows\System32\SogouPy.ime
MOD - [2010/10/26 22:08:00 | 000,596,848 | —- | M] (Sogou.com Inc.) – C:\Program Files\SogouInput\5.1.1.4845\Resource.dll
MOD - [2010/08/20 19:21:32 | 001,680,896 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll
MOD - [2009/07/13 15:16:15 | 000,099,840 | —- | M] (Microsoft Corporation) – C:\Windows\System32\sspicli.dll
MOD - [2009/07/13 15:16:13 | 000,092,160 | —- | M] (Microsoft Corporation) – C:\Windows\System32\sechost.dll
MOD - [2009/07/13 15:16:13 | 000,050,688 | —- | M] (Microsoft Corporation) – C:\Windows\System32\samcli.dll
MOD - [2009/07/13 15:16:12 | 000,031,744 | —- | M] (Microsoft Corporation) – C:\Windows\System32\profapi.dll
MOD - [2009/07/13 15:16:03 | 000,022,016 | —- | M] (Microsoft Corporation) – C:\Windows\System32\netutils.dll
MOD - [2009/07/13 15:15:35 | 000,288,256 | —- | M] (Microsoft Corporation) – C:\Windows\System32\KernelBase.dll
MOD - [2009/07/13 15:15:13 | 000,067,072 | —- | M] (Microsoft Corporation) – C:\Windows\System32\dwmapi.dll
MOD - [2009/07/13 15:15:11 | 000,064,512 | —- | M] (Microsoft Corporation) – C:\Windows\System32\devobj.dll
MOD - [2009/07/13 15:15:07 | 000,036,864 | —- | M] (Microsoft Corporation) – C:\Windows\System32\cryptbase.dll
MOD - [2009/07/13 15:15:02 | 000,145,920 | —- | M] (Microsoft Corporation) – C:\Windows\System32\cfgmgr32.dll

========== Win32 Services (SafeList) ==========

SRV - [2010/12/31 20:33:11 | 000,632,792 | —- | M] (PC Tools) [Auto | Running] – C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe – (PCToolsSSDMonitorSvc)
SRV - [2010/12/31 17:53:16 | 001,343,400 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\Wat\WatAdminSvc.exe – (WatAdminSvc)
SRV - [2010/12/20 18:08:58 | 000,363,344 | —- | M] (Malwarebytes Corporation) [Auto | Running] – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe – (MBAMService)
SRV - [2010/12/07 00:32:02 | 002,228,008 | —- | M] (TeamViewer GmbH) [Auto | Running] – C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe – (TeamViewer6)
SRV - [2010/11/25 09:49:46 | 000,517,448 | —- | M] () [On_Demand | Stopped] – C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe – (AVG Security Toolbar Service)
SRV - [2010/11/23 13:34:14 | 006,128,208 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe – (AVGIDSAgent)
SRV - [2010/11/22 04:48:46 | 003,226,632 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG10\avgfws.exe – (avgfws)
SRV - [2010/10/31 08:37:48 | 000,135,168 | —- | M] (Airytec) [Auto | Stopped] – C:\Program Files\Airytec\Switch Off\swoff.exe – (SwOffWeb)
SRV - [2010/10/31 08:37:48 | 000,135,168 | —- | M] (Airytec) [Auto | Stopped] – C:\Program Files\Airytec\Switch Off\swoff.exe – (SwOffScheduler)
SRV - [2010/10/22 04:58:18 | 000,265,400 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG10\avgwdsvc.exe – (avgwd)
SRV - [2010/05/04 12:07:22 | 000,503,080 | —- | M] (Nero AG) [Auto | Running] – C:\Program Files\Nero\Update\NASvc.exe – (NAUpdate)
SRV - [2010/03/18 13:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2009/08/24 22:16:36 | 000,406,016 | —- | M] (mst software GmbH, Germany) [On_Demand | Stopped] – C:\Program Files\Ashampoo\Ashampoo WinOptimizer 6\Dfsdks.exe – (DfSdkS)
SRV - [2009/08/24 19:04:08 | 001,033,480 | —- | M] (Raxco Software, Inc.) [On_Demand | Running] – C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe – (PDEngine)
SRV - [2009/08/24 19:04:04 | 000,935,176 | —- | M] (Raxco Software, Inc.) [Auto | Running] – C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe – (PDAgent)
SRV - [2009/07/13 15:16:21 | 000,185,856 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\wwansvc.dll – (WwanSvc)
SRV - [2009/07/13 15:16:17 | 000,151,552 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\wbiosrvc.dll – (WbioSrvc)
SRV - [2009/07/13 15:16:17 | 000,119,808 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\umpo.dll – (Power)
SRV - [2009/07/13 15:16:16 | 000,037,376 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\themeservice.dll – (Themes)
SRV - [2009/07/13 15:16:15 | 000,053,760 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\sppuinotify.dll – (sppuinotify)
SRV - [2009/07/13 15:16:13 | 000,043,520 | —- | M] (Microsoft Corporation) [Unknown | Running] – C:\Windows\System32\RpcEpMap.dll – (RpcEptMapper)
SRV - [2009/07/13 15:16:13 | 000,025,088 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\sensrsvc.dll – (SensrSvc)
SRV - [2009/07/13 15:16:12 | 001,004,544 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\PeerDistSvc.dll – (PeerDistSvc)
SRV - [2009/07/13 15:16:12 | 000,269,824 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\System32\pnrpsvc.dll – (PNRPsvc)
SRV - [2009/07/13 15:16:12 | 000,269,824 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\System32\pnrpsvc.dll – (p2pimsvc)
SRV - [2009/07/13 15:16:12 | 000,165,376 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\System32\provsvc.dll – (HomeGroupProvider)
SRV - [2009/07/13 15:16:12 | 000,020,480 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\pnrpauto.dll – (PNRPAutoReg)
SRV - [2009/07/13 15:15:41 | 000,680,960 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2009/07/13 15:15:36 | 000,194,560 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\System32\ListSvc.dll – (HomeGroupListener)
SRV - [2009/07/13 15:15:21 | 000,797,696 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\FntCache.dll – (FontCache)
SRV - [2009/07/13 15:15:11 | 000,253,440 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\dhcpcore.dll – (Dhcp)
SRV - [2009/07/13 15:15:10 | 000,218,624 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\defragsvc.dll – (defragsvc)
SRV - [2009/07/13 15:14:59 | 000,076,800 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\bdesvc.dll – (BDESVC)
SRV - [2009/07/13 15:14:58 | 000,088,064 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\AxInstSv.dll – (AxInstSV) ActiveX Installer (AxInstSV)
SRV - [2009/07/13 15:14:53 | 000,027,648 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\appidsvc.dll – (AppIDSvc)
SRV - [2009/07/13 15:14:29 | 003,179,520 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\sttsvc.exe – (sttsvc)

========== Driver Services (SafeList) ==========

DRV - [2011/01/01 10:19:15 | 000,022,016 | —- | M] (Feitian Technologies Co., Ltd.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\Rockey4.sys – (ROCKEYNT)
DRV - [2010/12/20 18:08:40 | 000,020,952 | —- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] – C:\Windows\System32\drivers\mbam.sys – (MBAMProtector)
DRV - [2010/12/08 04:12:38 | 000,251,728 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\Windows\System32\drivers\avgldx86.sys – (Avgldx86)
DRV - [2010/11/12 13:19:38 | 000,299,984 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\Windows\System32\drivers\avgtdix.sys – (Avgtdix)
DRV - [2010/09/13 15:27:54 | 000,025,680 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\AVGIDSEH.Sys – (AVGIDSEH)
DRV - [2010/09/07 03:48:56 | 000,034,384 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] – C:\Windows\System32\drivers\avgmfx86.sys – (Avgmfx86)
DRV - [2010/09/07 03:48:50 | 000,026,064 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] – C:\Windows\system32\DRIVERS\avgrkx86.sys – (Avgrkx86)
DRV - [2010/08/19 20:42:38 | 000,123,472 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\AVGIDSDriver.sys – (AVGIDSDriver)
DRV - [2010/08/19 20:42:38 | 000,030,288 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\AVGIDSFilter.sys – (AVGIDSFilter)
DRV - [2010/08/19 20:42:36 | 000,021,072 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\AVGIDSShim.sys – (AVGIDSShim)
DRV - [2010/07/12 04:34:02 | 000,054,112 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\Windows\System32\drivers\avgfwd6x.sys – (Avgfwfd)
DRV - [2010/05/10 08:41:30 | 000,067,656 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS – (SASKUTIL)
DRV - [2010/02/17 08:25:48 | 000,012,872 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys – (SASDIFSV)
DRV - [2009/12/10 21:44:02 | 000,133,720 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\Drivers\ksecpkg.sys – (KSecPkg)
DRV - [2009/08/20 11:11:30 | 000,073,232 | —- | M] (Raxco Software, Inc.) [File_System | Auto | Running] – C:\Windows\System32\drivers\DefragFs.sys – (DefragFS)
DRV - [2009/07/13 15:26:21 | 000,015,952 | —- | M] (CMD Technology, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\cmdide.sys – (cmdide)
DRV - [2009/07/13 15:26:17 | 000,297,552 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\adpahci.sys – (adpahci)
DRV - [2009/07/13 15:26:15 | 000,422,976 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\adp94xx.sys – (adp94xx)
DRV - [2009/07/13 15:26:15 | 000,159,312 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\amdsbs.sys – (amdsbs)
DRV - [2009/07/13 15:26:15 | 000,146,512 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\adpu320.sys – (adpu320)
DRV - [2009/07/13 15:26:15 | 000,086,608 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\arcsas.sys – (arcsas)
DRV - [2009/07/13 15:26:15 | 000,079,952 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\amdsata.sys – (amdsata)
DRV - [2009/07/13 15:26:15 | 000,076,368 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\arc.sys – (arc)
DRV - [2009/07/13 15:26:15 | 000,023,616 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\amdxata.sys – (amdxata)
DRV - [2009/07/13 15:26:15 | 000,014,400 | —- | M] (Acer Laboratories Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\aliide.sys – (aliide)
DRV - [2009/07/13 15:20:44 | 000,142,416 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\nvstor.sys – (nvstor)
DRV - [2009/07/13 15:20:44 | 000,117,312 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\nvraid.sys – (nvraid)
DRV - [2009/07/13 15:20:44 | 000,044,624 | —- | M] (IBM Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\nfrd960.sys – (nfrd960)
DRV - [2009/07/13 15:20:37 | 000,089,168 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\lsi_sas.sys – (LSI_SAS)
DRV - [2009/07/13 15:20:36 | 000,332,352 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\iaStorV.sys – (iaStorV)
DRV - [2009/07/13 15:20:36 | 000,235,584 | —- | M] (LSI Corporation, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\MegaSR.sys – (MegaSR)
DRV - [2009/07/13 15:20:36 | 000,096,848 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\lsi_scsi.sys – (LSI_SCSI)
DRV - [2009/07/13 15:20:36 | 000,095,824 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\lsi_fc.sys – (LSI_FC)
DRV - [2009/07/13 15:20:36 | 000,054,864 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\lsi_sas2.sys – (LSI_SAS2)
DRV - [2009/07/13 15:20:36 | 000,041,040 | —- | M] (Intel Corp./ICP vortex GmbH) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\iirsp.sys – (iirsp)
DRV - [2009/07/13 15:20:36 | 000,030,800 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\megasas.sys – (megasas)
DRV - [2009/07/13 15:20:36 | 000,013,904 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\hwpolicy.sys – (hwpolicy)
DRV - [2009/07/13 15:20:28 | 000,453,712 | —- | M] (Emulex) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\elxstor.sys – (elxstor)
DRV - [2009/07/13 15:20:28 | 000,070,720 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\djsvs.sys – (aic78xx)
DRV - [2009/07/13 15:20:28 | 000,067,152 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\HpSAMD.sys – (HpSAMD)
DRV - [2009/07/13 15:20:28 | 000,046,160 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\fsdepends.sys – (FsDepends)
DRV - [2009/07/13 15:19:11 | 000,141,904 | —- | M] (VIA Technologies Inc.,Ltd) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\vsmraid.sys – (vsmraid)
DRV - [2009/07/13 15:19:10 | 000,175,824 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\vmbus.sys – (vmbus)
DRV - [2009/07/13 15:19:10 | 000,159,824 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\vhdmp.sys – (vhdmp)
DRV - [2009/07/13 15:19:10 | 000,040,896 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\vmstorfl.sys – (storflt)
DRV - [2009/07/13 15:19:10 | 000,032,832 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\vdrvroot.sys – (vdrvroot)
DRV - [2009/07/13 15:19:10 | 000,028,224 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\storvsc.sys – (storvsc)
DRV - [2009/07/13 15:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\wimmount.sys – (WIMMount)
DRV - [2009/07/13 15:19:10 | 000,016,976 | —- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\viaide.sys – (viaide)
DRV - [2009/07/13 15:19:04 | 001,383,488 | —- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\ql2300.sys – (ql2300)
DRV - [2009/07/13 15:19:04 | 000,173,648 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\rdyboost.sys – (rdyboost)
DRV - [2009/07/13 15:19:04 | 000,106,064 | —- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\ql40xx.sys – (ql40xx)
DRV - [2009/07/13 15:19:04 | 000,077,888 | —- | M] (Silicon Integrated Systems) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\sisraid4.sys – (SiSRaid4)
DRV - [2009/07/13 15:19:04 | 000,043,088 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\pcw.sys – (pcw)
DRV - [2009/07/13 15:19:04 | 000,040,016 | —- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\SiSRaid2.sys – (SiSRaid2)
DRV - [2009/07/13 15:19:04 | 000,021,072 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\stexstor.sys – (stexstor)
DRV - [2009/07/13 15:17:54 | 000,369,568 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\Drivers\cng.sys – (CNG)
DRV - [2009/07/13 14:57:25 | 000,272,128 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\Drivers\Brserid.sys – (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2009/07/13 14:02:41 | 000,018,944 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\rdpbus.sys – (rdpbus)
DRV - [2009/07/13 14:01:41 | 000,007,168 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\RDPREFMP.sys – (RDPREFMP)
DRV - [2009/07/13 13:55:00 | 000,049,152 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\agilevpn.sys – (RasAgileVpn) WAN Miniport (IKEv2)
DRV - [2009/07/13 13:53:51 | 000,009,728 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\wfplwf.sys – (WfpLwf)
DRV - [2009/07/13 13:52:44 | 000,027,136 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\ndiscap.sys – (NdisCap)
DRV - [2009/07/13 13:52:04 | 000,048,128 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\vwififlt.sys – (vwififlt)
DRV - [2009/07/13 13:52:02 | 000,019,968 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\vwifibus.sys – (vwifibus)
DRV - [2009/07/13 13:52:00 | 000,163,328 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\1394ohci.sys – (1394ohci)
DRV - [2009/07/13 13:51:35 | 000,008,192 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\umpass.sys – (UmPass)
DRV - [2009/07/13 13:51:08 | 000,004,096 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mshidkmdf.sys – (mshidkmdf)
DRV - [2009/07/13 13:46:55 | 000,012,288 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\MTConfig.sys – (MTConfig)
DRV - [2009/07/13 13:45:26 | 000,031,232 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\CompositeBus.sys – (CompositeBus)
DRV - [2009/07/13 13:36:52 | 000,050,176 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\appid.sys – (AppID)
DRV - [2009/07/13 13:33:50 | 000,026,624 | —- | M] (Microsoft Corporation) [Kernel | Unknown | Running] – C:\Windows\System32\drivers\scfilter.sys – (scfilter)
DRV - [2009/07/13 13:28:47 | 000,005,632 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\vms3cap.sys – (s3cap)
DRV - [2009/07/13 13:28:45 | 000,017,920 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\VMBusHID.sys – (VMBusHID)
DRV - [2009/07/13 13:24:05 | 000,032,256 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\discache.sys – (discache)
DRV - [2009/07/13 13:16:36 | 000,009,728 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\acpipmi.sys – (AcpiPmi)
DRV - [2009/07/13 13:11:04 | 000,052,736 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\amdppm.sys – (AmdPPM)
DRV - [2009/07/13 12:54:14 | 000,026,624 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\hcw85cir.sys – (hcw85cir)
DRV - [2009/07/13 12:53:33 | 000,012,160 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\Drivers\BrUsbMdm.sys – (BrUsbMdm)
DRV - [2009/07/13 12:53:33 | 000,011,904 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\Drivers\BrUsbSer.sys – (BrUsbSer)
DRV - [2009/07/13 12:53:32 | 000,062,336 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\Drivers\BrSerWdm.sys – (BrSerWdm)
DRV - [2009/07/13 12:53:28 | 000,013,568 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\BrFiltLo.sys – (BrFiltLo)
DRV - [2009/07/13 12:53:28 | 000,005,248 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\BrFiltUp.sys – (BrFiltUp)
DRV - [2009/07/13 12:02:49 | 000,229,888 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\b57nd60x.sys – (b57nd60x)
DRV - [2009/07/13 12:02:48 | 003,100,160 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\evbdx.sys – (ebdrv)
DRV - [2009/07/13 12:02:48 | 000,430,080 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\bxvbdx.sys – (b06bdrv)
DRV - [2009/07/08 00:45:32 | 002,506,232 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\BCMWL6.SYS – (BCM43XX)
DRV - [2006/09/14 17:55:00 | 000,088,192 | —- | M] (Texas Instruments) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\gtipci21.sys – (GTIPCI21)
DRV - [2005/03/10 16:56:06 | 000,273,168 | —- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\STAC97.sys – (STAC97)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://cn.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = zh-cn
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 18 B5 A6 5B 72 A9 CB 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Bing"
FF - prefs.js..browser.startup.homepage: "http://www.google.com"
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:10.0.0.1178
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:[removed]
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.1
FF - prefs.js..extensions.enabledItems: [removed]:1.6.1
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100908
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {22119944-ED35-4ab1-910B-E619EA06A115}:6.9.98
FF - prefs.js..extensions.enabledItems: [removed]:4.51
FF - prefs.js..keyword.URL: "http://www.bing.com/search?pc=ZUGO&form;=ZGAADF&q;="

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG10\Firefox\ [2010/12/31 18:41:17 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files\Siber Systems\AI RoboForm\Firefox [2010/12/31 21:49:35 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/01/02 17:15:54 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/31 19:16:32 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/31 20:40:48 | 000,000,000 | —D | M]

[2010/12/31 19:16:52 | 000,000,000 | —D | M] (No name found) – C:\Users\Tom_q\AppData\Roaming\Mozilla\Extensions
[2011/01/05 19:23:26 | 000,000,000 | —D | M] (No name found) – C:\Users\Tom_q\AppData\Roaming\Mozilla\Firefox\Profiles\awad85ku.default\extensions
[2011/01/02 13:31:02 | 000,000,000 | —D | M] (NoScript) – C:\Users\Tom_q\AppData\Roaming\Mozilla\Firefox\Profiles\awad85ku.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010/12/31 19:30:48 | 000,000,000 | —D | M] (WOT) – C:\Users\Tom_q\AppData\Roaming\Mozilla\Firefox\Profiles\awad85ku.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010/12/31 19:30:49 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\Tom_q\AppData\Roaming\Mozilla\Firefox\Profiles\awad85ku.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010/12/31 19:27:31 | 000,000,000 | —D | M] (Adblock Plus) – C:\Users\Tom_q\AppData\Roaming\Mozilla\Firefox\Profiles\awad85ku.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/12/31 19:30:48 | 000,000,000 | —D | M] (Personas) – C:\Users\Tom_q\AppData\Roaming\Mozilla\Firefox\Profiles\awad85ku.default\extensions\[removed]
[2010/12/31 20:19:50 | 000,001,919 | —- | M] () – C:\Users\Tom_q\AppData\Roaming\Mozilla\Firefox\Profiles\awad85ku.default\searchplugins\bing-zugo.xml
[2010/12/31 20:19:06 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/12/31 20:19:07 | 000,000,000 | —D | M] (Skype extension) – C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/12/31 20:07:36 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2010/12/31 18:41:17 | 000,000,000 | —D | M] (AVG Safe Search) – C:\PROGRAM FILES\AVG\AVG10\FIREFOX
[2011/01/02 17:15:54 | 000,000,000 | —D | M] (HP Smart Web Printing) – C:\PROGRAM FILES\HP\DIGITAL IMAGING\SMART WEB PRINTING\MOZILLAADDON3
[2010/12/31 21:49:35 | 000,000,000 | —D | M] (AI Roboform Toolbar for Firefox) – C:\PROGRAM FILES\SIBER SYSTEMS\AI ROBOFORM\FIREFOX
File not found (No name found) – C:\USERS\钂嬩粙鐭砛APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AWAD85KU.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}
File not found (No name found) – C:\USERS\钂嬩粙鐭砛APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AWAD85KU.DEFAULT\EXTENSIONS\{A0D7CCB3-214D-498B-B4AA-0E8FDA9A7BF7}
File not found (No name found) – C:\USERS\钂嬩粙鐭砛APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AWAD85KU.DEFAULT\EXTENSIONS\{B9DB16A4-6EDC-47EC-A1F4-B86292ED211D}
File not found (No name found) – C:\USERS\钂嬩粙鐭砛APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AWAD85KU.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}
File not found (No name found) – C:\USERS\钂嬩粙鐭砛APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AWAD85KU.DEFAULT\EXTENSIONS\[removed]
[2010/12/31 20:07:26 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/12/31 20:39:54 | 000,075,208 | —- | M] (Foxit Software Company) – C:\Program Files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
[2007/03/09 13:16:44 | 000,189,496 | —- | M] (Yahoo! Inc.) – C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll

O1 HOSTS File: ([2010/12/31 20:04:06 | 000,428,463 | R— | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 123fporn.info
O1 - Hosts: 14749 more lines…
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (&RoboForm;) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm;) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SSDMonitor] C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe (PC Tools)
O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
O4 - HKCU..\Run: [Active Keys Application File] C:\Program Files\reliz\akeys.exe (Softarium.com)
O4 - HKCU..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe ( )
O4 - HKCU..\Run: [Kingsoft PowerWord] C:\Program Files\Kingsoft\PowerWord_Oxford\XDict.exe (Copyright © Kingsoft Corporation Limited. All rights reserved.)
O4 - HKCU..\Run: [tts Accelerator] C:\Program Files\ttstream\ttsAP.exe (ttstream Inc)
O4 - Startup: C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe (Yahoo! Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Customize Menu - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: Fill Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: Logoff - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComLogoff.html ()
O8 - Extra context menu item: RoboForm Toolbar - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Save Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8 - Extra context menu item: 使用光影编辑和美化 - C:\Program Files\nEO iMAGING\NeoOpenNeo.htm ()
O8 - Extra context menu item: 添加到飞信表情 - C:\Program Files\China Mobile\Fetion\FetionExt.dll (China Mobile)
O8 - Extra context menu item: 通过飞信短信发送 - C:\Program Files\China Mobile\Fetion\FetionExt.dll (China Mobile)
O9 - Extra Button: 填写表单 - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra 'Tools' menuitem : 填写表单 - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra Button: 保存 - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra 'Tools' menuitem : 保存表单 - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : RoboForm工具栏 - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra Button: 启动飞信 - {814953B0-3DE7-4171-A0DD-A7A38322B6C7} - C:\Program Files\China Mobile\Fetion\Fetion.exe (China Mobile)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: 显示或隐藏 HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: tts.tv ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: ttstream.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: webscache.com ([]http in Trusted sites)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} http://u3.sandisk.com/download/atts/LPInstaller.CAB (CInstallLPCtrl Object)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.15.1
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O18 - Protocol\Handler\Kool {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\Windows\System32\Kool3DownXControl.ocx ()
O18 - Protocol\Handler\Kool3 {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\Windows\System32\Kool3DownXControl.ocx ()
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (livessp) - C:\Windows\System32\livessp.dll (Microsoft Corp.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 11:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (PDBoot.exe) - C:\Windows\System32\PDBoot.exe (Raxco Software, Inc.)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
NetSvcs: Themes - C:\Windows\System32\themeservice.dll (Microsoft Corporation)
NetSvcs: BDESVC - C:\Windows\System32\bdesvc.dll (Microsoft Corporation)

========== Files/Folders - Created Within 30 Days ==========

[2011/01/05 19:20:02 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Tom_q\Desktop\OTL.exe
[2011/01/02 23:32:47 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\Tom_q\Desktop\HiJackThis.exe
[2011/01/02 18:41:14 | 000,000,000 | —D | C] – C:\ttsvodcache
[2011/01/02 18:05:22 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Tencent
[2011/01/02 18:05:10 | 000,000,000 | —D | C] – C:\ProgramData\Tencent
[2011/01/02 17:40:49 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Local\HP
[2011/01/02 17:17:28 | 000,000,000 | —D | C] – C:\ProgramData\WEBREG
[2011/01/02 17:17:26 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\HP
[2011/01/02 17:14:47 | 000,000,000 | —D | C] – C:\ProgramData\HP Product Assistant
[2011/01/02 17:13:27 | 000,000,000 | —D | C] – C:\Program Files\Common Files\HP
[2011/01/02 17:12:56 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
[2011/01/02 17:12:30 | 000,000,000 | —D | C] – C:\Program Files\HP
[2011/01/02 17:12:29 | 000,000,000 | -H-D | C] – C:\Config.Msi
[2011/01/02 17:12:08 | 000,000,000 | —D | C] – C:\ProgramData\Hewlett-Packard
[2011/01/02 15:44:55 | 000,000,000 | —D | C] – C:\ProgramData\HP
[2011/01/02 13:26:30 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Camfrog
[2011/01/02 13:26:19 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Camfrog Video Chat 5.5
[2011/01/02 13:26:14 | 000,000,000 | —D | C] – C:\Program Files\Camfrog
[2011/01/02 13:12:25 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\腾讯游戏
[2011/01/02 13:12:25 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\腾讯游戏
[2011/01/02 13:12:19 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\腾讯游戏
[2011/01/02 13:11:41 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\光影魔术手
[2011/01/02 13:11:40 | 000,000,000 | —D | C] – C:\Program Files\nEO iMAGING
[2011/01/02 13:11:08 | 000,000,000 | —D | C] – C:\Users\Tom_q\Documents\美图图库
[2011/01/02 13:10:49 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\美图秀秀
[2011/01/02 13:10:44 | 000,000,000 | —D | C] – C:\Program Files\Meitu
[2011/01/02 13:10:21 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\可牛影像
[2011/01/02 13:10:00 | 000,000,000 | —D | C] – C:\Users\Tom_q\Documents\可牛闪图
[2011/01/02 13:09:53 | 000,000,000 | —D | C] – C:\Program Files\Conew
[2011/01/01 17:13:16 | 000,000,000 | —D | C] – C:\Users\Tom_q\Desktop\Acupuncture
[2011/01/01 16:10:58 | 000,000,000 | -HSD | C] – C:\Windows\System32\%APPDATA%
[2011/01/01 14:13:33 | 000,000,000 | —D | C] – C:\ProgramData\Fetion
[2011/01/01 11:01:33 | 000,000,000 | —D | C] – C:\Users\Tom_q\Documents\My Widgets
[2011/01/01 11:00:20 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Local\Agenda
[2011/01/01 10:22:40 | 000,000,000 | —D | C] – C:\ProgramData\kingsoft
[2011/01/01 10:20:06 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\kingsoft
[2011/01/01 10:19:15 | 000,022,016 | —- | C] (Feitian Technologies Co., Ltd.) – C:\Windows\System32\drivers\Rockey4.sys
[2011/01/01 10:19:15 | 000,012,928 | —- | C] (Feitian Technologies Co., Ltd.) – C:\Windows\System32\drivers\Rockey4USB.sys
[2011/01/01 10:18:48 | 000,000,000 | —D | C] – C:\Program Files\SinoVoice
[2011/01/01 10:18:04 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\InstallShield
[2011/01/01 10:15:29 | 000,000,000 | —D | C] – C:\Program Files\Kingsoft
[2010/12/31 22:51:15 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Local\Stardock
[2010/12/31 22:51:09 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stardock CursorXP
[2010/12/31 22:51:07 | 000,000,000 | —D | C] – C:\Program Files\CursorXP
[2010/12/31 22:48:01 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\金山词霸2009 牛津版
[2010/12/31 22:36:22 | 000,000,000 | —D | C] – C:\Users\Tom_q\Desktop\暂时
[2010/12/31 22:36:22 | 000,000,000 | —D | C] – C:\Users\Tom_q\Desktop\每半年数目检查
[2010/12/31 22:36:22 | 000,000,000 | —D | C] – C:\Users\Tom_q\Desktop\合同
[2010/12/31 22:36:22 | 000,000,000 | —D | C] – C:\Users\Tom_q\Desktop\MateriaMedica
[2010/12/31 22:36:22 | 000,000,000 | —D | C] – C:\Users\Tom_q\Desktop\Bapaper
[2010/12/31 22:36:21 | 000,000,000 | —D | C] – C:\Users\Tom_q\Desktop\2010Semester
[2010/12/31 22:32:37 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Registry Mechanic
[2010/12/31 22:15:14 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Softarium.com
[2010/12/31 22:11:55 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Malwarebytes
[2010/12/31 22:11:50 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/12/31 22:11:50 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/12/31 22:11:46 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/12/31 22:11:46 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/12/31 22:09:26 | 000,000,000 | —D | C] – C:\ProgramData\SUPERAntiSpyware.com
[2010/12/31 22:09:25 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\SUPERAntiSpyware.com
[2010/12/31 22:09:22 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2010/12/31 22:09:20 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2010/12/31 22:00:44 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Local\Deployment
[2010/12/31 22:00:44 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Local\Atts
[2010/12/31 21:52:56 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dream Aquarium
[2010/12/31 21:52:56 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dream Aquarium
[2010/12/31 21:52:54 | 000,000,000 | —D | C] – C:\Program Files\Dream Aquarium
[2010/12/31 21:49:51 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Avant Profiles
[2010/12/31 21:49:45 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AI RoboForm
[2010/12/31 21:49:36 | 000,000,000 | —D | C] – C:\ProgramData\RoboForm
[2010/12/31 21:49:29 | 000,000,000 | —D | C] – C:\Users\Tom_q\Documents\My RoboForm Data
[2010/12/31 21:49:22 | 000,000,000 | —D | C] – C:\Program Files\Siber Systems
[2010/12/31 21:47:57 | 000,000,000 | —D | C] – C:\Program Files\Sketch Master
[2010/12/31 21:44:11 | 000,000,000 | —D | C] – C:\ProgramData\Raxco
[2010/12/31 21:43:09 | 000,000,000 | —D | C] – C:\Program Files\Raxco
[2010/12/31 21:41:42 | 000,000,000 | —D | C] – C:\Program Files\PhotoZoom Pro 3
[2010/12/31 21:32:49 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2010/12/31 21:32:17 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Silverlight
[2010/12/31 21:18:18 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Local\Windows Live
[2010/12/31 20:57:01 | 000,028,160 | —- | C] (mst software GmbH, Germany) – C:\Windows\System32\DfSdkBt.exe
[2010/12/31 20:57:01 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
[2010/12/31 20:56:51 | 000,000,000 | —D | C] – C:\Program Files\Ashampoo
[2010/12/31 20:52:59 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Nero
[2010/12/31 20:52:43 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero
[2010/12/31 20:52:40 | 000,000,000 | —D | C] – C:\Program Files\Nero
[2010/12/31 20:52:27 | 000,000,000 | —D | C] – C:\ProgramData\Nero
[2010/12/31 20:49:26 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Fetion
[2010/12/31 20:42:32 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\WinRAR
[2010/12/31 20:41:10 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader
[2010/12/31 20:41:08 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Macromedia
[2010/12/31 20:41:08 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Adobe
[2010/12/31 20:40:48 | 000,000,000 | —D | C] – C:\Program Files\Foxit Software
[2010/12/31 20:38:47 | 000,000,000 | —D | C] – C:\Program Files\MSECache
[2010/12/31 20:37:09 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2010/12/31 20:36:55 | 000,000,000 | —D | C] – C:\Program Files\Microsoft ActiveSync
[2010/12/31 20:36:48 | 000,000,000 | —D | C] – C:\Program Files\Common Files\DESIGNER
[2010/12/31 20:36:18 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Office
[2010/12/31 20:34:34 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2010/12/31 20:34:34 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2010/12/31 20:34:29 | 000,000,000 | —D | C] – C:\Program Files\WinRAR
[2010/12/31 20:31:57 | 001,101,824 | —- | C] (Woodbury Associates Limited) – C:\Windows\System32\UniBox210.ocx
[2010/12/31 20:31:57 | 000,880,640 | —- | C] (Woodbury Associates Limited) – C:\Windows\System32\UniBox10.ocx
[2010/12/31 20:31:57 | 000,212,992 | —- | C] (Woodbury Associates Limited) – C:\Windows\System32\UniBoxVB12.ocx
[2010/12/31 20:31:57 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Registry Mechanic
[2010/12/31 20:31:55 | 000,000,000 | —D | C] – C:\Program Files\Common Files\PC Tools
[2010/12/31 20:31:54 | 000,000,000 | —D | C] – C:\Program Files\Registry Mechanic
[2010/12/31 20:30:18 | 000,000,000 | —D | C] – C:\Users\Tom_q\Tracing
[2010/12/31 20:29:23 | 000,000,000 | —D | C] – C:\Users\Public\Documents\microsoft
[2010/12/31 20:28:56 | 000,000,000 | —D | C] – C:\Program Files\Windows Live
[2010/12/31 20:28:34 | 000,000,000 | —D | C] – C:\Windows\PCHEALTH
[2010/12/31 20:25:15 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Windows Live
[2010/12/31 20:25:11 | 000,000,000 | —D | C] – C:\Windows\System32\appmgmt
[2010/12/31 20:24:03 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Local\Yahoo
[2010/12/31 20:24:00 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Yahoo! Widgets
[2010/12/31 20:23:57 | 000,000,000 | —D | C] – C:\Program Files\Yahoo!
[2010/12/31 20:22:52 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Trillian
[2010/12/31 20:21:44 | 000,000,000 | —D | C] – C:\Program Files\Trillian
[2010/12/31 20:20:51 | 000,000,000 | —D | C] – C:\Program Files\TeamViewer
[2010/12/31 20:20:18 | 000,000,000 | —D | C] – C:\Program Files\Airytec
[2010/12/31 20:19:39 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SkypeLauncher
[2010/12/31 20:19:35 | 000,000,000 | —D | C] – C:\Program Files\SkypeLauncher
[2010/12/31 20:18:44 | 000,000,000 | R–D | C] – C:\Program Files\Skype
[2010/12/31 20:18:44 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2010/12/31 20:18:44 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Skype
[2010/12/31 20:18:43 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Skype
[2010/12/31 20:18:42 | 000,000,000 | —D | C] – C:\ProgramData\Skype
[2010/12/31 20:17:06 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wisdom-soft ScreenHunter 5 Free
[2010/12/31 20:17:06 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wisdom-soft ScreenHunter 5 Free
[2010/12/31 20:17:03 | 000,000,000 | —D | C] – C:\Program Files\Wisdom-soft ScreenHunter 5 Free
[2010/12/31 20:16:17 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FlashPeak SlimBrowser
[2010/12/31 20:16:16 | 000,000,000 | —D | C] – C:\Program Files\SlimBrowser
[2010/12/31 20:15:38 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ttstream
[2010/12/31 20:15:18 | 000,000,000 | —D | C] – C:\Program Files\ttstream
[2010/12/31 20:15:17 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\ttstream
[2010/12/31 20:13:29 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Opera
[2010/12/31 20:13:29 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Local\Opera
[2010/12/31 20:13:25 | 000,000,000 | —D | C] – C:\Program Files\Opera
[2010/12/31 20:12:40 | 000,000,000 | —D | C] – C:\Kool
[2010/12/31 20:12:39 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kool
[2010/12/31 20:12:37 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Kool
[2010/12/31 20:12:37 | 000,000,000 | —D | C] – C:\Program Files\Kool
[2010/12/31 20:12:21 | 000,000,000 | —D | C] – C:\Windows\System32\Macromed
[2010/12/31 20:12:02 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iDailyDiary
[2010/12/31 20:12:01 | 000,000,000 | —D | C] – C:\Program Files\iDailyDiary
[2010/12/31 20:11:44 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\中国移动飞信
[2010/12/31 20:11:10 | 000,000,000 | —D | C] – C:\Program Files\China Mobile
[2010/12/31 20:10:58 | 000,000,000 | —D | C] – C:\Program Files\ePrompter
[2010/12/31 20:10:36 | 000,000,000 | —D | C] – C:\Program Files\CRadio
[2010/12/31 20:09:22 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2010/12/31 20:08:38 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avant Browser
[2010/12/31 20:08:34 | 000,000,000 | —D | C] – C:\Program Files\Avant Browser
[2010/12/31 20:08:00 | 000,000,000 | —D | C] – C:\ProgramData\Sun
[2010/12/31 20:07:56 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/12/31 20:07:23 | 000,000,000 | —D | C] – C:\Program Files\Java
[2010/12/31 20:00:28 | 000,000,000 | —D | C] – C:\ProgramData\Spybot - Search & Destroy
[2010/12/31 20:00:28 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2010/12/31 19:58:36 | 000,000,000 | —D | C] – C:\ProgramData\TEMP
[2010/12/31 19:58:30 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
[2010/12/31 19:58:29 | 000,000,000 | —D | C] – C:\Program Files\SpywareBlaster
[2010/12/31 19:53:38 | 000,000,000 | —D | C] – C:\PerfLog
[2010/12/31 19:53:31 | 000,000,000 | —D | C] – C:\Program Files\SogouInput
[2010/12/31 19:53:31 | 000,000,000 | —D | C] – C:\Program Files\SogouExtension
[2010/12/31 19:16:36 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Mozilla
[2010/12/31 19:16:36 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Local\Mozilla
[2010/12/31 19:16:33 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox
[2010/12/31 19:16:30 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2010/12/31 19:10:20 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\WinPatrol
[2010/12/31 19:10:13 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPatrol
[2010/12/31 19:10:12 | 000,000,000 | —D | C] – C:\Program Files\BillP Studios
[2010/12/31 18:55:47 | 000,000,000 | -H-D | C] – C:\Program Files\InstallShield Installation Information
[2010/12/31 18:55:47 | 000,000,000 | —D | C] – C:\Program Files\SigmaTel
[2010/12/31 18:55:42 | 000,000,000 | —D | C] – C:\Program Files\Common Files\InstallShield
[2010/12/31 18:54:31 | 000,000,000 | —D | C] – C:\dell
[2010/12/31 18:44:59 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\AVG10
[2010/12/31 18:42:42 | 000,000,000 | -H-D | C] – C:\ProgramData\Common Files
[2010/12/31 18:42:30 | 000,000,000 | —D | C] – C:\ProgramData\AVG Security Toolbar
[2010/12/31 18:42:11 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2011
[2010/12/31 18:41:14 | 000,000,000 | —D | C] – C:\ProgramData\AVG10
[2010/12/31 18:41:14 | 000,000,000 | —D | C] – C:\Windows\System32\drivers\AVG
[2010/12/31 18:40:37 | 000,000,000 | —D | C] – C:\Program Files\AVG
[2010/12/31 18:29:47 | 000,000,000 | —D | C] – C:\ProgramData\MFAData
[2010/12/31 18:27:53 | 000,000,000 | —D | C] – C:\Program Files\reliz
[2010/12/31 17:55:39 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET
[2010/12/31 17:55:29 | 000,000,000 | -HSD | C] – C:\Windows\Installer
[2010/12/31 17:53:17 | 000,000,000 | —D | C] – C:\Windows\System32\Wat
[2010/12/31 17:52:11 | 000,000,000 | —D | C] – C:\Intel
[2010/12/31 16:41:26 | 000,000,000 | R–D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2010/12/31 16:41:26 | 000,000,000 | R–D | C] – C:\Users\Tom_q\Searches
[2010/12/31 16:41:26 | 000,000,000 | R–D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2010/12/31 16:41:25 | 000,000,000 | -H-D | C] – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
[2010/12/31 16:41:13 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Identities
[2010/12/31 16:41:11 | 000,000,000 | R–D | C] – C:\Users\Tom_q\Contacts
[2010/12/31 16:41:01 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Local\VirtualStore
[2010/12/31 16:40:58 | 000,000,000 | –SD | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft
[2010/12/31 16:40:58 | 000,000,000 | R–D | C] – C:\Users\Tom_q\Videos
[2010/12/31 16:40:58 | 000,000,000 | R–D | C] – C:\Users\Tom_q\Saved Games
[2010/12/31 16:40:58 | 000,000,000 | R–D | C] – C:\Users\Tom_q\Pictures
[2010/12/31 16:40:58 | 000,000,000 | R–D | C] – C:\Users\Tom_q\Music
[2010/12/31 16:40:58 | 000,000,000 | R–D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2010/12/31 16:40:58 | 000,000,000 | R–D | C] – C:\Users\Tom_q\Links
[2010/12/31 16:40:58 | 000,000,000 | R–D | C] – C:\Users\Tom_q\Favorites
[2010/12/31 16:40:58 | 000,000,000 | R–D | C] – C:\Users\Tom_q\Downloads
[2010/12/31 16:40:58 | 000,000,000 | R–D | C] – C:\Users\Tom_q\Documents
[2010/12/31 16:40:58 | 000,000,000 | R–D | C] – C:\Users\Tom_q\Desktop
[2010/12/31 16:40:58 | 000,000,000 | R–D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\AppData\Local\Temporary Internet Files
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\Templates
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\SendTo
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\Recent
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\PrintHood
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\NetHood
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\Documents\My Videos
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\Documents\My Pictures
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\Documents\My Music
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\My Documents
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\Local Settings
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\AppData\Local\History
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\Cookies
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\Application Data
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\AppData\Local\Application Data
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\「开始」菜单
[2010/12/31 16:40:58 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Local\Temp
[2010/12/31 16:40:58 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Local\Microsoft
[2010/12/31 16:40:58 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Media Center Programs
[2010/12/31 16:40:58 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData
[2010/12/31 16:40:42 | 000,000,000 | -HSD | C] – C:\ProgramData\桌面
[2010/12/31 16:40:42 | 000,000,000 | -HSD | C] – C:\ProgramData\收藏夹
[2010/12/31 16:40:42 | 000,000,000 | -HSD | C] – C:\Recovery
[2010/12/31 16:40:42 | 000,000,000 | -HSD | C] – C:\ProgramData\「开始」菜单
[2010/12/30 22:37:33 | 000,000,000 | —D | C] – C:\Windows\SoftwareDistribution
[2010/12/30 22:34:28 | 000,000,000 | —D | C] – C:\Windows\Prefetch
[2010/12/30 22:34:18 | 000,000,000 | -HSD | C] – C:\System Volume Information
[2010/12/30 22:33:51 | 000,000,000 | —D | C] – C:\Windows\Panther
[2010/12/30 22:33:36 | 000,000,000 | -HSD | C] – C:\Boot
[2010/12/08 04:12:38 | 000,251,728 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgldx86.sys

========== Files - Modified Within 30 Days ==========

[2011/01/05 19:20:06 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Tom_q\Desktop\OTL.exe
[2011/01/05 19:13:33 | 000,014,016 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/01/05 19:13:33 | 000,014,016 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/01/05 19:09:58 | 103,523,498 | —- | M] () – C:\Windows\System32\drivers\AVG\incavi.avm
[2011/01/05 19:09:58 | 000,641,053 | —- | M] () – C:\Windows\System32\drivers\AVG\iavifw.avm
[2011/01/05 19:05:37 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/01/05 19:05:32 | 1603,874,816 | -HS- | M] () – C:\hiberfil.sys
[2011/01/02 23:32:57 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\Tom_q\Desktop\HiJackThis.exe
[2011/01/02 17:44:12 | 000,618,896 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/01/02 17:44:12 | 000,365,396 | —- | M] () – C:\Windows\System32\prfh0804.dat
[2011/01/02 17:44:12 | 000,110,166 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/01/02 17:44:12 | 000,108,026 | —- | M] () – C:\Windows\System32\prfc0804.dat
[2011/01/02 17:38:37 | 000,282,120 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2011/01/02 17:17:19 | 000,169,761 | —- | M] () – C:\Windows\hphins27.dat
[2011/01/02 13:26:19 | 000,002,137 | —- | M] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Camfrog Video Chat 5.5.lnk
[2011/01/02 13:12:27 | 000,000,988 | —- | M] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ游戏.lnk
[2011/01/01 11:01:37 | 000,001,027 | —- | M] () – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Yahoo! Widgets.lnk
[2011/01/01 10:19:15 | 000,022,016 | —- | M] (Feitian Technologies Co., Ltd.) – C:\Windows\System32\drivers\Rockey4.sys
[2011/01/01 10:19:15 | 000,012,928 | —- | M] (Feitian Technologies Co., Ltd.) – C:\Windows\System32\drivers\Rockey4USB.sys
[2011/01/01 10:19:15 | 000,004,096 | —- | M] () – C:\Windows\System32\Ry4CoInst.dll
[2010/12/31 22:36:01 | 000,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2010/12/31 20:41:10 | 000,001,216 | —- | M] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Foxit Reader.lnk
[2010/12/31 20:38:09 | 000,000,376 | —- | M] () – C:\Windows\ODBC.INI
[2010/12/31 20:16:17 | 000,001,014 | —- | M] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\FlashPeak SlimBrowser.lnk
[2010/12/31 20:12:39 | 000,001,087 | —- | M] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Kool2010.lnk
[2010/12/31 20:08:41 | 000,001,009 | —- | M] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Avant Browser.lnk
[2010/12/31 20:04:06 | 000,428,463 | R— | M] () – C:\Windows\System32\drivers\etc\hosts
[2010/12/31 19:16:33 | 000,001,913 | —- | M] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/12/31 19:10:52 | 000,001,335 | —- | M] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/12/30 22:37:54 | 000,098,247 | —- | M] () – C:\Windows\System32\license.rtf
[2010/12/30 22:33:39 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2010/12/20 18:09:00 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/12/20 18:08:40 | 000,020,952 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/12/08 04:12:38 | 000,251,728 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgldx86.sys

========== Files Created - No Company Name ==========

[2011/01/05 19:09:58 | 103,523,498 | —- | C] () – C:\Windows\System32\drivers\AVG\incavi.avm
[2011/01/05 19:09:58 | 000,641,053 | —- | C] () – C:\Windows\System32\drivers\AVG\iavifw.avm
[2011/01/02 17:10:31 | 000,169,761 | —- | C] () – C:\Windows\hphins27.dat
[2011/01/02 17:10:31 | 000,000,349 | —- | C] () – C:\Windows\hphmdl27.dat
[2011/01/02 15:45:15 | 000,001,726 | —- | C] () – C:\ProgramData\hpzinstall.log
[2011/01/02 13:26:19 | 000,002,137 | —- | C] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Camfrog Video Chat 5.5.lnk
[2011/01/02 13:12:27 | 000,000,988 | —- | C] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ游戏.lnk
[2011/01/01 11:01:37 | 000,001,027 | —- | C] () – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Yahoo! Widgets.lnk
[2011/01/01 10:19:15 | 000,004,096 | —- | C] () – C:\Windows\System32\Ry4CoInst.dll
[2010/12/31 22:36:29 | 008,093,696 | —- | C] () – C:\Users\Tom_q\Desktop\BaiHuTang.ppt
[2010/12/31 22:36:29 | 000,054,784 | —- | C] () – C:\Users\Tom_q\Desktop\BaiHuTang.doc
[2010/12/31 22:36:29 | 000,045,056 | —- | C] () – C:\Users\Tom_q\Desktop\Tom_qPsychologyAssignments.doc
[2010/12/31 22:36:01 | 000,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2010/12/31 20:41:10 | 000,001,216 | —- | C] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Foxit Reader.lnk
[2010/12/31 20:38:09 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2010/12/31 20:16:17 | 000,001,014 | —- | C] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\FlashPeak SlimBrowser.lnk
[2010/12/31 20:12:39 | 000,001,087 | —- | C] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Kool2010.lnk
[2010/12/31 20:12:38 | 000,548,464 | —- | C] () – C:\Windows\System32\Kool3DownXControl.ocx
[2010/12/31 20:08:41 | 000,001,009 | —- | C] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Avant Browser.lnk
[2010/12/31 19:16:33 | 000,001,913 | —- | C] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/12/31 19:10:52 | 000,001,335 | —- | C] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/12/31 18:59:09 | 000,524,850 | —- | C] () – C:\Windows\System32\igxpxa32.cpa
[2010/12/31 18:59:09 | 000,058,704 | —- | C] () – C:\Windows\System32\igxpxk32.vp
[2010/12/31 18:59:09 | 000,023,296 | —- | C] () – C:\Windows\System32\igxpxs32.vp
[2010/12/31 18:59:09 | 000,000,929 | —- | C] () – C:\Windows\System32\igxpxa32.vp
[2010/12/31 18:55:48 | 000,192,512 | —- | C] () – C:\Windows\System32\Stac97co.dll
[2010/12/31 18:50:14 | 000,171,136 | RHS- | C] () – C:\grldr
[2010/12/31 16:40:58 | 000,000,290 | —- | C] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2010/12/31 16:40:58 | 000,000,272 | —- | C] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2010/12/30 22:34:18 | 1603,874,816 | -HS- | C] () – C:\hiberfil.sys
[2010/12/30 22:33:39 | 000,008,192 | RHS- | C] () – C:\BOOTSECT.BAK
[2010/12/30 22:33:37 | 000,383,562 | RHS- | C] () – C:\bootmgr
[2009/07/13 13:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 13:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2007/01/13 10:46:36 | 000,204,800 | —- | C] () – C:\Windows\System32\igfxCoIn_v4764.dll
[2003/03/03 07:16:52 | 000,004,910 | —- | C] () – C:\Windows\System32\OUTLPERF.INI

========== LOP Check ==========

[2010/12/31 18:44:59 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\AVG10
[2011/01/02 13:26:32 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\Camfrog
[2011/01/01 18:58:54 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\Fetion
[2011/01/01 10:20:06 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\kingsoft
[2010/12/31 20:12:37 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\Kool
[2011/01/01 11:00:26 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\Opera
[2011/01/02 18:40:59 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\ttstream
[2010/12/31 22:32:37 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\Registry Mechanic
[2010/12/31 22:15:14 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\Softarium.com
[2011/01/02 18:05:22 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\Tencent
[2010/12/31 20:22:52 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\Trillian
[2010/12/31 19:10:20 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\WinPatrol
[2011/01/02 13:12:19 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\腾讯游戏
[2009/07/13 18:53:46 | 000,005,758 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >

< %systemdrive%\*.sys /90 /md5 >
[2011/01/05 19:05:32 | 1603,874,816 | -HS- | M] () Unable to obtain MD5 – C:\hiberfil.sys
[2011/01/05 19:05:32 | 2138,501,120 | -HS- | M] () Unable to obtain MD5 – C:\pagefile.sys

========== Alternate Data Streams ==========

@Alternate Data Stream - 150 bytes -> C:\ProgramData\TEMP:D1B5B4F1

< End of report >

Tom_q2356

Post #4January 6, 2011, 6:08 AM UTC

OTL Extras logfile created on: 2011/1/5 19:27:05 - Run 1
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Users\Tom_q\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000804 | Country: 中华人民共和国 | Language: CHS | Date Format: yyyy/M/d

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 50.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 230.88 Gb Total Space | 203.75 Gb Free Space | 88.25% Space Free | Partition Type: NTFS

Computer Name: Tom_q-PC | User Name: Tom_q | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = Opera.HTML] – C:\Program Files\Opera\Opera.exe (Opera Software)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – Reg Error: Key error.
htmlfile [print] – rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] – "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
https [open] – "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\nEO iMAGING\LiveUpdate\ThunderLiveUD.exe" = C:\Program Files\nEO iMAGING\LiveUpdate\ThunderLiveUD.exe:*:Enabled:NeoLiveUpdate – (Thunder Networking Technologies,LTD)
"C:\Program Files\nEO iMAGING\nEOiMAGING.exe" = C:\Program Files\nEO iMAGING\nEOiMAGING.exe:*:Enabled:Neoimaging – (nEO Software)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{000F2A10-9CDF-47BF-9CF2-9AC87567B433}" = Windows Live Photo Common
"{03241D8D-2217-42F7-9FCB-6A68D141C14D}" = Windows Live 软件包
"{04E7A3BB-DB38-481C-A809-35FA60C78EDF}" = AVG 2011
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0EF5BEA9-B9D3-46d7-8958-FB69A0BAEACC}" = Status
"{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch
"{1EC71BFB-01A3-4239-B6AF-B1AE656B15C0}" = TrayApp
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{21B49B4A-BBC3-4A09-9C68-6C3CC0B1EA01}" = Windows Live Messenger
"{23181592-0ECD-4A16-81C6-F0424D2DCABF}" = Windows Live UX Platform Language Pack
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{26A24AE4-039D-4CA4-87B4-2F83216023FF}" = Java™ 6 Update 23
"{2DFBF311-4838-345F-A353-647185AA4DA1}" = Microsoft .NET Framework 4 Client Profile CHS Language Pack
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{2FF8C687-DB7D-4adc-A5DC-57983EC25046}" = DeviceDiscovery
"{382300D4-777B-4233-A98C-99EA0F6B881F}" = HP Deskjet D4300 Printer Driver Software 13.0 Rel. 3
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{476B3339-1C29-4660-85B9-15850DCCD4EE}" = D4300
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4B1FB4D5-F4F5-4897-8251-071AACED33E8}" = jTTS 5.0 Desktop
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{4E7C28C7-D5DA-4E9F-A1CA-60490B54AE35}" = UnloadSupport
"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)
"{555868C6-49FB-484F-BB43-8980651A1B00}" = Nero BurnRights 10 Help (CHM)
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{681B698F-C997-42C3-B184-B489C6CA24C9}" = HPPhotoSmartDiscLabelContent1
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6B2FFB21-AC88-45C3-9A7D-4BB3E744EC91}" = HPSSupply
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{7059BDA7-E1DB-442C-B7A1-6144596720A4}" = HP Update
"{7A5D731D-B4B3-490E-B339-75685712BAAB}" = Nero Burning ROM 10
"{7B738CD9-D107-48C7-8E65-2E6639A39C8D}" = PerfectDisk 10 Professional
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90110804-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0804-0000-0000000FF1CE}" = 2007 Office system 兼容包
"{943CFD7D-5336-47AF-9418-E02473A5A517}" = Nero BurnRights 10
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9B6B24BE-80E7-46C4-9FA5-B167D5E0F345}" = Nero BurningROM 10 Help (CHM)
"{9BBCFFFC-621F-47CB-8F81-E0E04A023A7F}}_is1" = Kool2010(正式版)
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = C-Major Audio
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{C11EABAA-7AFF-4CFA-A5BB-D5B97A6FDCBB}" = skecht_master
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D79113E7-274C-470B-BD46-01B10219DF6A}" = HPPhotosmartEssential
"{DC635845-46D3-404B-BCB1-FC4A91091AFA}" = SmartWebPrinting
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0
"{E6F30DBC-9003-497C-8ADD-39F90801932A}" = DJ_SF_03_D4300_Software_Min
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{F4C68898-EBA5-46A9-82B3-2D30426086BF}" = AVG 2011
"{FE83F463-7E61-4B18-9FA0-B94B90A0B6B9}" = Nero Burning ROM 10
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AI RoboForm" = AI RoboForm (All Users)
"Airytec Switch Off" = Airytec Switch Off
"Ashampoo WinOptimizer 6_is1" = Ashampoo WinOptimizer 6.50
"AvantBrowser" = Avant Browser (remove only)
"AVG" = AVG 2011
"Camfrog 5.5" = Camfrog Video Chat 5.5
"CCleaner" = CCleaner
"CursorXP" = CursorXP
"DreamAqua" = Dream Aquarium
"ePrompter" = ePrompter
"Fetion" = 飞信2010
"Foxit Reader" = Foxit Reader
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Photosmart Essential" = HP Photosmart Essential 3.5
"HP Smart Web Printing" = HP Smart Web Printing 4.51
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 13.0
"iDailyDiary_is1" = iDailyDiary 3.61
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile CHS Language Pack" = Microsoft .NET Framework 4 Client Profile 简体中文语言包
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"Opera 11.00.1156" = Opera 11.00
"ttstream" = tts V2.7.0.1208 正式版
"QQ游戏" = QQ游戏
"Registry Mechanic_is1" = Registry Mechanic 9.0
"Shop for HP Supplies" = Shop for HP Supplies
"SkypeLauncher" = SkypeLauncher
"SlimBrowser" = FlashPeak SlimBrowser
"Sogou Input" = 搜狗拼音输入法 5.1正式版
"SpywareBlaster_is1" = SpywareBlaster 4.4
"TeamViewer 6" = TeamViewer 6
"Trillian" = Trillian
"WinLiveSuite" = Windows Live 软件包
"WinPatrol" = WinPatrol
"WinRAR archiver" = WinRAR archiver
"Wisdom-soft Set up ScreenHunter 5.1 Free" = Wisdom-soft Set up ScreenHunter 5.1 Free
"Yahoo! Widget Engine" = Yahoo! Widgets
"YInstHelper" = Yahoo! Install Manager
"光影魔术手" = 光影魔术手 V3.1.2.103
"金山词霸2009" = 金山词霸2009 SP3 牛津特别版
"可牛影像" = 可牛影像 2.6.2 正式版
"龙卷风网络收音机_is1" = 龙卷风网络收音机 V3.0.2.1
"美图秀秀" = 美图秀秀 V2.5.8 正式版

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Agenda" = Agenda
"PhotoZoom Pro 3" = BenVista PhotoZoom Pro 3.1

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 2011/1/1 4:51:17 | Computer Name = Tom_q-PC | Source = Application Error | ID = 1000
Description = 错误应用程序名称: CurXPUtil.exe，版本: 1.0.0.1，时间戳: 0x3e60d0df 错误模块名称: unzip32.dll，版本:
1.1.0.0，时间戳: 0x38f939a1 异常代码: 0xc0000005 错误偏移量: 0x00005f6f 错误进程 ID: 0x10a8 错误应用程序启动时间:
0x01cba9910c5e8da6 错误应用程序路径: C:\Program Files\CursorXP\CurXPUtil.exe 错误模块路径: C:\Program
Files\CursorXP\unzip32.dll 报告 ID: 4b83cd0c-1584-11e0-85eb-001422b7d706

Error - 2011/1/1 4:51:25 | Computer Name = Tom_q-PC | Source = Application Error | ID = 1000
Description = 错误应用程序名称: rundll32.exe_shell32.dll，版本: 6.1.7600.16385，时间戳: 0x4a5bc637
错误模块名称:
unzip32.dll，版本: 1.1.0.0，时间戳: 0x38f939a1 异常代码: 0xc0000005 错误偏移量: 0x00005f6f 错误进程 ID:
0x788 错误应用程序启动时间: 0x01cba9910c6a7968 错误应用程序路径: C:\Windows\System32\rundll32.exe 错误模块路径:
C:\Program Files\CursorXP\unzip32.dll 报告 ID: 50677f9e-1584-11e0-85eb-001422b7d706

Error - 2011/1/1 16:18:20 | Computer Name = Tom_q-PC | Source = VSS | ID = 8194
Description =

Error - 2011/1/1 17:36:54 | Computer Name = Tom_q-PC | Source = Application Error | ID = 1000
Description = 错误应用程序名称: YahooWidgets.exe，版本: [removed]，时间戳: 0x47e05eca 错误模块名称: YahooWidgets.exe，版本:
[removed]，时间戳: 0x47e05eca 异常代码: 0xc0000005 错误偏移量: 0x001644f7 错误进程 ID: 0xc34 错误应用程序启动时间:
0x01cba9f73412b909 错误应用程序路径: C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe 错误模块路径:
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe 报告 ID: 3c3fb907-15ef-11e0-b9db-0014a431f40a

Error - 2011/1/1 19:10:48 | Computer Name = Tom_q-PC | Source = Application Error | ID = 1000
Description = 错误应用程序名称: taskmgr.exe，版本: 6.1.7600.16385，时间戳: 0x4a5bc13c 错误模块名称: unknown，版本:
0.0.0.0，时间戳: 0x00000000 异常代码: 0xc0000005 错误偏移量: 0x00000100 错误进程 ID: 0xb3c 错误应用程序启动时间:
0x01cbaa08b7f89844 错误应用程序路径: C:\Windows\system32\taskmgr.exe 错误模块路径: unknown 报告 ID:
5dedc372-15fc-11e0-b9db-0014a431f40a

Error - 2011/1/1 23:02:52 | Computer Name = Tom_q-PC | Source = Application Error | ID = 1000
Description = 错误应用程序名称: YahooWidgets.exe，版本: [removed]，时间戳: 0x47e05eca 错误模块名称: YahooWidgets.exe，版本:
[removed]，时间戳: 0x47e05eca 异常代码: 0xc0000005 错误偏移量: 0x001644f7 错误进程 ID: 0x1078 错误应用程序启动时间:
0x01cbaa276c31a3be 错误应用程序路径: C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe 错误模块路径:
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe 报告 ID: c9355f83-161c-11e0-8a86-001422b7d706

Error - 2011/1/1 23:42:31 | Computer Name = Tom_q-PC | Source = Application Error | ID = 1000
Description = 错误应用程序名称: YahooWidgets.exe，版本: [removed]，时间戳: 0x47e05eca 错误模块名称: YahooWidgets.exe，版本:
[removed]，时间戳: 0x47e05eca 异常代码: 0xc0000005 错误偏移量: 0x001644f7 错误进程 ID: 0x1260 错误应用程序启动时间:
0x01cbaa2da8ffda82 错误应用程序路径: C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe 错误模块路径:
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe 报告 ID: 53223b86-1622-11e0-9945-001422b7d706

Error - 2011/1/2 23:21:43 | Computer Name = Tom_q-PC | Source = MsiInstaller | ID = 11721
Description =

Error - 2011/1/3 4:08:50 | Computer Name = Tom_q-PC | Source = Application Error | ID = 1000
Description = 错误应用程序名称: YahooWidgets.exe，版本: [removed]，时间戳: 0x47e05eca 错误模块名称: YahooWidgets.exe，版本:
[removed]，时间戳: 0x47e05eca 异常代码: 0xc0000005 错误偏移量: 0x001644f7 错误进程 ID: 0xaf0 错误应用程序启动时间:
0x01cbab1aa3cd483e 错误应用程序路径: C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe 错误模块路径:
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe 报告 ID: b23c59de-1710-11e0-8259-001422b7d706

Error - 2011/1/3 5:51:25 | Computer Name = Tom_q-PC | Source = Application Error | ID = 1000
Description = 错误应用程序名称: YahooWidgets.exe，版本: [removed]，时间戳: 0x47e05eca 错误模块名称: YahooWidgets.exe，版本:
[removed]，时间戳: 0x47e05eca 异常代码: 0xc0000005 错误偏移量: 0x001644f7 错误进程 ID: 0x159c 错误应用程序启动时间:
0x01cbab279300bce5 错误应用程序路径: C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe 错误模块路径:
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe 报告 ID: 06df37df-171f-11e0-bdfd-0014a431f40a

[ System Events ]
Error - 2011/1/3 5:13:08 | Computer Name = Tom_q-PC | Source = DCOM | ID = 10005
Description =

Error - 2011/1/3 5:13:08 | Computer Name = Tom_q-PC | Source = Service Control Manager | ID = 7001
Description = 与 Network List Service 服务相依的 Network Location Awareness 服务因下列错误而无法启动:
%%1068

Error - 2011/1/3 5:13:08 | Computer Name = Tom_q-PC | Source = Service Control Manager | ID = 7001
Description = 与 Network List Service 服务相依的 Network Location Awareness 服务因下列错误而无法启动:
%%1068

Error - 2011/1/3 5:13:09 | Computer Name = Tom_q-PC | Source = Service Control Manager | ID = 7001
Description = 与 Network List Service 服务相依的 Network Location Awareness 服务因下列错误而无法启动:
%%1068

Error - 2011/1/3 5:13:09 | Computer Name = Tom_q-PC | Source = Service Control Manager | ID = 7001
Description = 与 Network List Service 服务相依的 Network Location Awareness 服务因下列错误而无法启动:
%%1068

Error - 2011/1/3 5:13:09 | Computer Name = Tom_q-PC | Source = Service Control Manager | ID = 7001
Description = 与 Network List Service 服务相依的 Network Location Awareness 服务因下列错误而无法启动:
%%1068

Error - 2011/1/3 5:13:09 | Computer Name = Tom_q-PC | Source = Service Control Manager | ID = 7001
Description = 与 Network List Service 服务相依的 Network Location Awareness 服务因下列错误而无法启动:
%%1068

Error - 2011/1/3 5:13:09 | Computer Name = Tom_q-PC | Source = Service Control Manager | ID = 7001
Description = 与 Network List Service 服务相依的 Network Location Awareness 服务因下列错误而无法启动:
%%1068

Error - 2011/1/3 5:13:09 | Computer Name = Tom_q-PC | Source = Service Control Manager | ID = 7001
Description = 与 Network List Service 服务相依的 Network Location Awareness 服务因下列错误而无法启动:
%%1068

Error - 2011/1/3 6:07:51 | Computer Name = Tom_q-PC | Source = Service Control Manager | ID = 7011
Description = 等待来自 avgfws 服务的事务处理响应超时(30000 毫秒)。

< End of report >

schrauber

Post #5January 6, 2011, 10:32 AM UTC

Hi,

Please make sure that you can view all hidden files. Instructions on how to do this can be found here:

How to see hidden files in Windows

Please click this link–>Jotti

When the jotti page has finished loading, click the Browse button and navigate to the following file and click Submit.

C:\WINDOWS\SYSTEM32\DRIVERSTORE\FILEREPOSITORY\IALMNT5.INF_X86_NEUTRAL_00E3A135D054E3BB\SETB076.TMP

Please post back the results of the scan in your next post.

If Jotti is busy, try the same at Virustotal: http://www.virustotal.com/

Download MBRCheck.exe to your desktop
XP users > double click on MBRCheck.exe to run it
Vista and Windows 7 users > right click on MBRCheck.exe and select Run as Administrator
It will show a black screen with some data on it
Click on the black C:\ in the upper left hand corner of the black screen
Choose Edit > Select All > Press Enter to copy the data to your clip board
Press Enter again to close MBRCheck
Now open up notepad or wordpad and paste the data in (press Control+V)

Post the results in your reply

Please download GMER from one of the following locations and save it to your desktop:

Main Mirror
This version will download a randomly named file (Recommended)
Zipped Mirror
This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

Disconnect from the Internet and close all running programs.
Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.

[external image: Posted Image]
GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system…click NO.
Now click the Scan button. If you see a rootkit warning window, click OK.
When the scan is finished, click the Save… button to save the scan results to your Desktop. Save the file as gmer.log.
Click the Copy button and paste the results into your next reply.
Exit GMER and re-enable all active protection when done.

– If you encounter any problems, try running GMER in Safe Mode.

Tom_q2356

Post #6January 6, 2011, 11:05 PM UTC

MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows 7 Ultimate Edition Windows Information: (build 7600), 32-bit Logical Drives Mask: 0x0000000c Kernel Drivers (total 158): 0x83C3A000 \SystemRoot\system32\ntoskrnl.exe 0x83C03000 \SystemRoot\system32\halmacpi.dll 0x80BD5000 \SystemRoot\system32\kdcom.dll 0x8A005000 \SystemRoot\system32\mcupdate_GenuineIntel.dll 0x8A07D000 \SystemRoot\system32\PSHED.dll 0x8A08E000 \SystemRoot\system32\BOOTVID.dll 0x8A096000 \SystemRoot\system32\CLFS.SYS 0x8A0D8000 \SystemRoot\system32\CI.dll 0x8A183000 \SystemRoot\system32\drivers\Wdf01000.sys 0x8A1F4000 \SystemRoot\system32\drivers\WDFLDR.SYS 0x8A202000 \SystemRoot\system32\DRIVERS\ACPI.sys 0x8A24A000 \SystemRoot\system32\DRIVERS\WMILIB.SYS 0x8A253000 \SystemRoot\system32\DRIVERS\msisadrv.sys 0x8A25B000 \SystemRoot\system32\DRIVERS\pci.sys 0x8A285000 \SystemRoot\system32\DRIVERS\vdrvroot.sys 0x8A290000 \SystemRoot\System32\drivers\partmgr.sys 0x8A2A1000 \SystemRoot\system32\DRIVERS\compbatt.sys 0x8A2A9000 \SystemRoot\system32\DRIVERS\BATTC.SYS 0x8A2B4000 \SystemRoot\system32\DRIVERS\volmgr.sys 0x8A2C4000 \SystemRoot\System32\drivers\volmgrx.sys 0x8A30F000 \SystemRoot\system32\DRIVERS\intelide.sys 0x8A316000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS 0x8A324000 \SystemRoot\system32\DRIVERS\pcmcia.sys 0x8A352000 \SystemRoot\System32\drivers\mountmgr.sys 0x8A368000 \SystemRoot\system32\DRIVERS\atapi.sys 0x8A371000 \SystemRoot\system32\DRIVERS\ataport.SYS 0x8A394000 \SystemRoot\system32\DRIVERS\amdxata.sys 0x8A39D000 \SystemRoot\system32\drivers\fltmgr.sys 0x8A3D1000 \SystemRoot\system32\drivers\fileinfo.sys 0x8A417000 \SystemRoot\System32\Drivers\Ntfs.sys 0x8A546000 \SystemRoot\System32\Drivers\msrpc.sys 0x8A571000 \SystemRoot\System32\Drivers\ksecdd.sys 0x8A584000 \SystemRoot\System32\Drivers\cng.sys 0x8A5E1000 \SystemRoot\System32\drivers\pcw.sys 0x8A5EF000 \SystemRoot\System32\Drivers\Fs_Rec.sys 0x8A5F8000 \SystemRoot\system32\drivers\ndis.sys 0x8A6AF000 \SystemRoot\system32\drivers\NETIO.SYS 0x8A6ED000 \SystemRoot\System32\Drivers\ksecpkg.sys 0x8A821000 \SystemRoot\System32\drivers\tcpip.sys 0x8A96A000 \SystemRoot\System32\drivers\fwpkclnt.sys 0x8A99B000 \SystemRoot\system32\DRIVERS\vmstorfl.sys 0x8A9A4000 \SystemRoot\system32\DRIVERS\volsnap.sys 0x8A9E3000 \SystemRoot\System32\Drivers\spldr.sys 0x8A9EB000 \SystemRoot\System32\drivers\rdyboost.sys 0x8AA18000 \SystemRoot\System32\Drivers\mup.sys 0x8AA28000 \SystemRoot\System32\drivers\hwpolicy.sys 0x8AA30000 \SystemRoot\System32\DRIVERS\fvevol.sys 0x8AA62000 \SystemRoot\system32\DRIVERS\disk.sys 0x8AA73000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS 0x8AA98000 \SystemRoot\system32\DRIVERS\avgrkx86.sys 0x8AA9D000 \SystemRoot\system32\DRIVERS\AVGIDSEH.Sys 0x8AAD8000 \SystemRoot\system32\DRIVERS\cdrom.sys 0x8AAF7000 \SystemRoot\system32\DRIVERS\avgmfx86.sys 0x8AB03000 \SystemRoot\System32\Drivers\Null.SYS 0x8AB0A000 \SystemRoot\System32\Drivers\Beep.SYS 0x8AB11000 \SystemRoot\System32\drivers\vga.sys 0x8AB1D000 \SystemRoot\System32\drivers\VIDEOPRT.SYS 0x8AB3E000 \SystemRoot\System32\drivers\watchdog.sys 0x8AB4B000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0x8AB53000 \SystemRoot\system32\drivers\rdpencdd.sys 0x8AB5B000 \SystemRoot\system32\drivers\rdprefmp.sys 0x8AB63000 \SystemRoot\System32\Drivers\Msfs.SYS 0x8AB6E000 \SystemRoot\System32\Drivers\Npfs.SYS 0x8AB7C000 \SystemRoot\system32\DRIVERS\avgfwd6x.sys 0x8AB8D000 \SystemRoot\system32\DRIVERS\tdx.sys 0x8ABA4000 \SystemRoot\system32\DRIVERS\TDI.SYS 0x8ABAF000 \SystemRoot\system32\DRIVERS\avgtdix.sys 0x8A712000 \SystemRoot\System32\DRIVERS\netbt.sys 0x8A744000 \SystemRoot\system32\drivers\afd.sys 0x8ABF7000 \SystemRoot\system32\DRIVERS\wfplwf.sys 0x8A800000 \SystemRoot\system32\DRIVERS\pacer.sys 0x8A79E000 \SystemRoot\system32\DRIVERS\vwififlt.sys 0x8A7AF000 \SystemRoot\system32\DRIVERS\netbios.sys 0x8A7BD000 \SystemRoot\system32\DRIVERS\wanarp.sys 0x8A7D0000 \SystemRoot\system32\DRIVERS\termdd.sys 0x92020000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS 0x92042000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS 0x92048000 \SystemRoot\system32\DRIVERS\rdbss.sys 0x92089000 \SystemRoot\system32\drivers\nsiproxy.sys 0x92093000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0x9209D000 \SystemRoot\System32\drivers\discache.sys 0x920A9000 \SystemRoot\system32\drivers\csc.sys 0x9210D000 \SystemRoot\System32\Drivers\dfsc.sys 0x92125000 \SystemRoot\system32\DRIVERS\blbdrive.sys 0x92133000 \SystemRoot\system32\DRIVERS\avgldx86.sys 0x9216F000 \SystemRoot\system32\DRIVERS\tunnel.sys 0x92190000 \SystemRoot\system32\DRIVERS\intelppm.sys 0x921A2000 \SystemRoot\system32\DRIVERS\CmBatt.sys 0x921A6000 \SystemRoot\system32\DRIVERS\b57nd60x.sys 0x921E2000 \SystemRoot\system32\DRIVERS\usbuhci.sys 0x921ED000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0x92238000 \SystemRoot\system32\DRIVERS\usbehci.sys 0x92247000 \SystemRoot\system32\DRIVERS\gtipci21.sys 0x9225D000 \SystemRoot\system32\DRIVERS\SMCLIB.SYS 0x92268000 \SystemRoot\System32\DRIVERS\scfilter.sys 0x92C1B000 \SystemRoot\system32\DRIVERS\bcmwl6.sys 0x92E82000 \SystemRoot\system32\DRIVERS\vwifibus.sys 0x92E8C000 \SystemRoot\system32\drivers\STAC97.sys 0x92ECF000 \SystemRoot\system32\drivers\portcls.sys 0x92EFE000 \SystemRoot\system32\drivers\drmk.sys 0x92F17000 \SystemRoot\system32\drivers\ks.sys 0x92F4B000 \SystemRoot\system32\DRIVERS\i8042prt.sys 0x92F63000 \SystemRoot\system32\DRIVERS\mouclass.sys 0x92F70000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0x92F7D000 \SystemRoot\system32\DRIVERS\CompositeBus.sys 0x92F8A000 \SystemRoot\system32\DRIVERS\AgileVpn.sys 0x92F9C000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0x92FB4000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0x92FBF000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0x92FE1000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0x92C00000 \SystemRoot\system32\DRIVERS\raspptp.sys 0x92274000 \SystemRoot\system32\DRIVERS\rassstp.sys 0x9228B000 \SystemRoot\system32\DRIVERS\rdpbus.sys 0x92C17000 \SystemRoot\system32\DRIVERS\swenum.sys 0x92FF9000 \SystemRoot\system32\DRIVERS\Rockey4.sys 0x92295000 \SystemRoot\system32\DRIVERS\umbus.sys 0x922A3000 \SystemRoot\system32\DRIVERS\usbhub.sys 0x922E7000 \SystemRoot\System32\Drivers\NDProxy.SYS 0x922F8000 \SystemRoot\system32\DRIVERS\hidusb.sys 0x92303000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0x92316000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0x92C19000 \SystemRoot\system32\DRIVERS\USBD.SYS 0x9231D000 \SystemRoot\system32\DRIVERS\mouhid.sys 0x92328000 \SystemRoot\System32\Drivers\crashdmp.sys 0x92335000 \SystemRoot\System32\Drivers\dump_dumpata.sys 0x92340000 \SystemRoot\System32\Drivers\dump_atapi.sys 0x92349000 \SystemRoot\System32\Drivers\dump_dumpfve.sys 0x96110000 \SystemRoot\System32\win32k.sys 0x9235A000 \SystemRoot\System32\drivers\Dxapi.sys 0x96360000 \SystemRoot\System32\drivers\dxg.sys 0x96390000 \SystemRoot\System32\TSDDD.dll 0x96010000 \SystemRoot\System32\framebuf.dll 0x92364000 \SystemRoot\system32\drivers\luafv.sys 0x9237F000 \SystemRoot\system32\drivers\WudfPf.sys 0x92399000 \SystemRoot\System32\Drivers\DefragFS.SYS 0x923AE000 \SystemRoot\system32\DRIVERS\lltdio.sys 0x8E017000 \SystemRoot\system32\DRIVERS\nwifi.sys 0x8E05D000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0x8E06D000 \SystemRoot\system32\DRIVERS\rspndr.sys 0x8E080000 \SystemRoot\system32\drivers\HTTP.sys 0x8E105000 \SystemRoot\system32\DRIVERS\bowser.sys 0x8E11E000 \SystemRoot\System32\drivers\mpsdrv.sys 0x8E130000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0x8E153000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys 0x8E18E000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys 0x8E1C1000 \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys 0x8E1CA000 \SystemRoot\system32\drivers\peauth.sys 0x8E261000 \SystemRoot\System32\Drivers\secdrv.SYS 0x8E26B000 \SystemRoot\System32\DRIVERS\srvnet.sys 0x8E28C000 \SystemRoot\System32\drivers\tcpipreg.sys 0x8E299000 \SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys 0x8E2A3000 \SystemRoot\System32\DRIVERS\srv2.sys 0x8E2F2000 \SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys 0x8E31A000 \SystemRoot\System32\DRIVERS\srv.sys 0x8E36B000 \??\C:\Windows\system32\drivers\mbam.sys 0x779D0000 \Windows\System32\ntdll.dll 0x47FB0000 \Windows\System32\smss.exe 0x77C10000 \Windows\System32\apisetschema.dll Processes (total 78): 0 System Idle Process 4 System 260 C:\Windows\System32\smss.exe 312 C:\PROGRA~1\AVG\AVG10\avgchsvx.exe 500 csrss.exe 540 C:\Windows\System32\wininit.exe 552 csrss.exe 592 C:\Windows\System32\winlogon.exe 636 C:\Windows\System32\services.exe 652 C:\Windows\System32\lsass.exe 660 C:\Windows\System32\lsm.exe 800 C:\Windows\System32\svchost.exe 872 C:\Windows\System32\svchost.exe 920 C:\Windows\System32\svchost.exe 1052 C:\Windows\System32\svchost.exe 1100 C:\Windows\System32\svchost.exe 1160 C:\Windows\System32\audiodg.exe 1316 C:\Windows\System32\svchost.exe 1372 C:\Windows\System32\svchost.exe 1504 C:\Windows\System32\spoolsv.exe 1540 C:\Windows\System32\svchost.exe 1572 C:\Windows\System32\svchost.exe 1656 C:\Program Files\AVG\AVG10\avgfws.exe 1680 C:\Program Files\AVG\AVG10\avgwdsvc.exe 1728 C:\Windows\System32\svchost.exe 1776 C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe 1808 C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe 1984 C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe 2020 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE 984 C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe 1428 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE 2192 C:\Program Files\AVG\AVG10\avgam.exe 2208 C:\Program Files\AVG\AVG10\avgnsx.exe 2224 C:\Program Files\AVG\AVG10\avgemcx.exe 2240 C:\Windows\System32\conhost.exe 2732 C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe 2916 C:\Windows\System32\svchost.exe 3296 C:\Program Files\AVG\AVG10\avgcsrvx.exe 2076 C:\Windows\System32\taskhost.exe 2672 C:\Windows\System32\dwm.exe 2764 C:\Windows\explorer.exe 3168 C:\Program Files\AVG\AVG10\avgtray.exe 2476 C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe 3216 C:\Program Files\Common Files\Java\Java Update\jusched.exe 3256 C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe 3092 C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe 3480 C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe 3488 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe 3508 C:\Program Files\Windows Sidebar\sidebar.exe 3576 C:\Program Files\reliz\akeys.exe 3588 C:\Program Files\Kingsoft\PowerWord_Oxford\XDict.exe 3692 C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe 3804 C:\Windows\System32\svchost.exe 3892 C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe 2396 C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe 3220 C:\Windows\System32\conhost.exe 1436 C:\Windows\System32\SearchIndexer.exe 1796 C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe 992 C:\Program Files\Kingsoft\PowerWord_Oxford\CBAppendix.exe 3836 C:\Program Files\Windows Media Player\wmpnetwk.exe 3404 C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe 3796 C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe 3608 C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe 2508 C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe 3008 C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe 4352 C:\Windows\System32\svchost.exe 4612 WmiPrvSE.exe 4848 C:\Program Files\Mozilla Firefox\firefox.exe 4924 dllhost.exe 5284 C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe 5412 C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe 5468 C:\Program Files\Nero\Update\NASvc.exe 1760 C:\PROGRA~1\AVG\AVG10\avgrsx.exe 2352 C:\Program Files\AVG\AVG10\avgcsrvx.exe 5904 C:\Users\ 5824 C:\Windows\System32\conhost.exe 2336 C:\Windows\System32\dllhost.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`80000000 (NTFS) PhysicalDrive0 Model Number: WDCWD2500BEVE-00WZT0, Rev: 01.01A01 Size Device Name MBR Status ——————————————– 232 GB \\.\PhysicalDrive0 Windows 7 MBR code detected SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79 Done!

Tom_q2356

Post #7January 6, 2011, 11:10 PM UTC

Hi Tom,

The following I have to type out the scan result because I could not find any button I can click on to save any file after Jotti completed its scan. Thanks very much!

Jotti's malware scan:

Filename: SETB076.TMP
Status: Scan finished. 0 out of 14 scanners reported malware.
Scan taken on: Thu 6 Jan 2011 22:33:43 (CET) Permalink

Additional info:
File size: 20 bytes
filetype: unknown
MD5: 9472bad743c5676dcb8188ade5da86ae
SHA1: edcdb54df73f337b5db41010ea08bb082d56ab35

Scanners:

(All the scanners said "Found nothing" or "No result available)

Tom_q2356

Post #8January 6, 2011, 11:24 PM UTC

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2011-01-06 12:45:05
Windows 6.1.7600 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD2500BEVE-00WZT0 rev.01.01A01
Running: c4hxbhud.exe; Driver: C:\Users\Tom_q\AppData\Local\Temp\afryqpod.sys

—- System - GMER 1.0.15 —-

SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwOpenProcess [0x8E1C3780]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateProcess [0x8E1C3830]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateThread [0x8E1C38D0]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwWriteVirtualMemory [0x8E1C3970]

—- Kernel code sections - GMER 1.0.15 —-

.text ntoskrnl.exe!ZwSaveKeyEx + 13B1 83C6F8E9 1 Byte [06]
.text ntoskrnl.exe!KiDispatchInterrupt + 5A2 83C8F3D2 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, …] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntoskrnl.exe!KeRemoveQueueEx + 165F 83C9692C 4 Bytes [80, 37, 1C, 8E]
.text ntoskrnl.exe!KeRemoveQueueEx + 192F 83C96BFC 8 Bytes [30, 38, 1C, 8E, D0, 38, 1C, …] {XOR [EAX], BH; SBB AL, 0x8e; SAR BYTE [EAX], 0x1; SBB AL, 0x8e}
.text ntoskrnl.exe!KeRemoveQueueEx + 19A3 83C96C70 4 Bytes [70, 39, 1C, 8E] {JO 0x3b; SBB AL, 0x8e}
.text peauth.sys 8E1CFC9D 28 Bytes JMP B3A92E34
.text peauth.sys 8E1CFCC1 28 Bytes JMP B3A92E58

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe[1796] kernel32.dll!SetPriorityClass + 7 75662554 1 Byte [60]
.text C:\Windows\system32\Dwm.exe[2672] USER32.dll!SetClipboardData 76784979 5 Bytes JMP 00171E10 C:\Program Files\Kingsoft\PowerWord_Oxford\CBSText.dll (Kingsoft PowerWord/Copyright © Kingsoft Corporation Limited. All rights reserved.)
.text C:\Windows\system32\Dwm.exe[2672] USER32.dll!GetClipboardData 76784B47 5 Bytes JMP 00171DF0 C:\Program Files\Kingsoft\PowerWord_Oxford\CBSText.dll (Kingsoft PowerWord/Copyright © Kingsoft Corporation Limited. All rights reserved.)
.text C:\Windows\system32\Dwm.exe[2672] USER32.dll!ChangeClipboardChain 76793425 5 Bytes JMP 00171E90 C:\Program Files\Kingsoft\PowerWord_Oxford\CBSText.dll (Kingsoft PowerWord/Copyright © Kingsoft Corporation Limited. All rights reserved.)
.text C:\Windows\system32\Dwm.exe[2672] USER32.dll!CloseClipboard 76795BA7 5 Bytes JMP 00171DE0 C:\Program Files\Kingsoft\PowerWord_Oxford\CBSText.dll (Kingsoft PowerWord/Copyright © Kingsoft Corporation Limited. All rights reserved.)
.text C:\Windows\system32\Dwm.exe[2672] USER32.dll!OpenClipboard 76795BB9 5 Bytes JMP 00171DD0 C:\Program Files\Kingsoft\PowerWord_Oxford\CBSText.dll (Kingsoft PowerWord/Copyright © Kingsoft Corporation Limited. All rights reserved.)
.text C:\Windows\Explorer.EXE[2764] kernel32.dll!SetPriorityClass + 7 75662554 1 Byte [60]
.text C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe[3256] USER32.dll!SetClipboardData 76784979 5 Bytes JMP 01351E10 C:\Program Files\Kingsoft\PowerWord_Oxford\CBSText.dll (Kingsoft PowerWord/Copyright © Kingsoft Corporation Limited. All rights reserved.)
.text C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe[3256] USER32.dll!GetClipboardData 76784B47 5 Bytes JMP 01351DF0 C:\Program Files\Kingsoft\PowerWord_Oxford\CBSText.dll (Kingsoft PowerWord/Copyright © Kingsoft Corporation Limited. All rights reserved.)
.text C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe[3256] USER32.dll!ChangeClipboardChain 76793425 5 Bytes JMP 01351E90 C:\Program Files\Kingsoft\PowerWord_Oxford\CBSText.dll (Kingsoft PowerWord/Copyright © Kingsoft Corporation Limited. All rights reserved.)
.text C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe[3256] USER32.dll!CloseClipboard 76795BA7 5 Bytes JMP 01351DE0 C:\Program Files\Kingsoft\PowerWord_Oxford\CBSText.dll (Kingsoft PowerWord/Copyright © Kingsoft Corporation Limited. All rights reserved.)
.text C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe[3256] USER32.dll!OpenClipboard 76795BB9 5 Bytes JMP 01351DD0 C:\Program Files\Kingsoft\PowerWord_Oxford\CBSText.dll (Kingsoft PowerWord/Copyright © Kingsoft Corporation Limited. All rights reserved.)
.text C:\Program Files\HP\HP Software Update\hpwuSchd2.exe[3488] USER32.dll!SetClipboardData 76784979 5 Bytes JMP 017F1E10 C:\Program Files\Kingsoft\PowerWord_Oxford\CBSText.dll (Kingsoft PowerWord/Copyright © Kingsoft Corporation Limited. All rights reserved.)
.text C:\Program Files\HP\HP Software Update\hpwuSchd2.exe[3488] USER32.dll!GetClipboardData 76784B47 5 Bytes JMP 017F1DF0 C:\Program Files\Kingsoft\PowerWord_Oxford\CBSText.dll (Kingsoft PowerWord/Copyright © Kingsoft Corporation Limited. All rights reserved.)
.text C:\Program Files\HP\HP Software Update\hpwuSchd2.exe[3488] USER32.dll!ChangeClipboardChain 76793425 5 Bytes JMP 017F1E90 C:\Program Files\Kingsoft\PowerWord_Oxford\CBSText.dll (Kingsoft PowerWord/Copyright © Kingsoft Corporation Limited. All rights reserved.)
.text C:\Program Files\HP\HP Software Update\hpwuSchd2.exe[3488] USER32.dll!CloseClipboard 76795BA7 5 Bytes JMP 017F1DE0 C:\Program Files\Kingsoft\PowerWord_Oxford\CBSText.dll (Kingsoft PowerWord/Copyright © Kingsoft Corporation Limited. All rights reserved.)
.text C:\Program Files\HP\HP Software Update\hpwuSchd2.exe[3488] USER32.dll!OpenClipboard 76795BB9 5 Bytes JMP 017F1DD0 C:\Program Files\Kingsoft\PowerWord_Oxford\CBSText.dll (Kingsoft PowerWord/Copyright © Kingsoft Corporation Limited. All rights reserved.)
.text C:\Program Files\ttstream\ttsAP.exe[3596] kernel32.dll!OpenFile 7565410F 5 Bytes JMP 05A487A8 C:\Program Files\ttstream\Vodres.dll (tts 动态链接库/ttstream Inc.)
.text C:\Program Files\ttstream\ttsAP.exe[3596] kernel32.dll!GetQueuedCompletionStatus 75656C94 5 Bytes JMP 05A48A77 C:\Program Files\ttstream\Vodres.dll (tts 动态链接库/ttstream Inc.)
.text C:\Program Files\ttstream\ttsAP.exe[3596] kernel32.dll!CreateIoCompletionPort 7565E011 5 Bytes JMP 05A48A23 C:\Program Files\ttstream\Vodres.dll (tts 动态链接库/ttstream Inc.)
.text C:\Program Files\ttstream\ttsAP.exe[3596] kernel32.dll!GetOverlappedResult 7565E0DD 5 Bytes JMP 05A489D0 C:\Program Files\ttstream\Vodres.dll (tts 动态链接库/ttstream Inc.)
.text C:\Program Files\ttstream\ttsAP.exe[3596] kernel32.dll!SetFilePointerEx 75662A2A 5 Bytes JMP 05A48850 C:\Program Files\ttstream\Vodres.dll (tts 动态链接库/ttstream Inc.)
.text C:\Program Files\ttstream\ttsAP.exe[3596] kernel32.dll!GetFileSize 75665D47 5 Bytes JMP 05A48942 C:\Program Files\ttstream\Vodres.dll (tts 动态链接库/ttstream Inc.)
.text C:\Program Files\ttstream\ttsAP.exe[3596] kernel32.dll!GetFileSizeEx 7566CA51 5 Bytes JMP 05A48989 C:\Program Files\ttstream\Vodres.dll (tts 动态链接库/ttstream Inc.)
.text C:\Program Files\ttstream\ttsAP.exe[3596] kernel32.dll!ReadFile 7566DAA9 7 Bytes JMP 05A48644 C:\Program Files\ttstream\Vodres.dll (tts 动态链接库/ttstream Inc.)
.text C:\Program Files\ttstream\ttsAP.exe[3596] kernel32.dll!CloseHandle 756705D7 5 Bytes JMP 05A48901 C:\Program Files\ttstream\Vodres.dll (tts 动态链接库/ttstream Inc.)
.text C:\Program Files\ttstream\ttsAP.exe[3596] kernel32.dll!CreateFileW 75670B7D 5 Bytes JMP 05A485DE C:\Program Files\ttstream\Vodres.dll (tts 动态链接库/ttstream Inc.)
.text C:\Program Files\ttstream\ttsAP.exe[3596] kernel32.dll!WriteFile 756711EC 5 Bytes JMP 05A486F6 C:\Program Files\ttstream\Vodres.dll (tts 动态链接库/ttstream Inc.)
.text C:\Program Files\ttstream\ttsAP.exe[3596] kernel32.dll!CreateFileA 7567291C 5 Bytes JMP 05A48578 C:\Program Files\ttstream\Vodres.dll (tts 动态链接库/ttstream Inc.)
.text C:\Program Files\ttstream\ttsAP.exe[3596] kernel32.dll!SetFilePointer 7567351F 5 Bytes JMP 05A487F6 C:\Program Files\ttstream\Vodres.dll (tts 动态链接库/ttstream Inc.)
.text C:\Program Files\ttstream\ttsAP.exe[3596] kernel32.dll!ReadFileEx 756862A5 5 Bytes JMP 05A4869D C:\Program Files\ttstream\Vodres.dll (tts 动态链接库/ttstream Inc.)
.text C:\Program Files\ttstream\ttsAP.exe[3596] kernel32.dll!WriteFileEx 756862BD 5 Bytes JMP 05A4874F C:\Program Files\ttstream\Vodres.dll (tts 动态链接库/ttstream Inc.)
.text C:\Program Files\ttstream\ttsAP.exe[3596] USER32.dll!SetClipboardData 76784979 5 Bytes JMP 05AE1E10 C:\Program Files\Kingsoft\PowerWord_Oxford\CBSText.dll (Kingsoft PowerWord/Copyright © Kingsoft Corporation Limited. All rights reserved.)
.text C:\Program Files\ttstream\ttsAP.exe[3596] USER32.dll!GetClipboardData 76784B47 5 Bytes JMP 05AE1DF0 C:\Program Files\Kingsoft\PowerWord_Oxford\CBSText.dll (Kingsoft PowerWord/Copyright © Kingsoft Corporation Limited. All rights reserved.)
.text C:\Program Files\ttstream\ttsAP.exe[3596] USER32.dll!ChangeClipboardChain 76793425 5 Bytes JMP 05AE1E90 C:\Program Files\Kingsoft\PowerWord_Oxford\CBSText.dll (Kingsoft PowerWord/Copyright © Kingsoft Corporation Limited. All rights reserved.)
.text C:\Program Files\ttstream\ttsAP.exe[3596] USER32.dll!CloseClipboard 76795BA7 5 Bytes JMP 05AE1DE0 C:\Program Files\Kingsoft\PowerWord_Oxford\CBSText.dll (Kingsoft PowerWord/Copyright © Kingsoft Corporation Limited. All rights reserved.)
.text C:\Program Files\ttstream\ttsAP.exe[3596] USER32.dll!OpenClipboard 76795BB9 5 Bytes JMP 05AE1DD0 C:\Program Files\Kingsoft\PowerWord_Oxford\CBSText.dll (Kingsoft PowerWord/Copyright © Kingsoft Corporation Limited. All rights reserved.)
.text C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe[3892] USER32.dll!SetClipboardData 76784979 5 Bytes JMP 04AD1E10 C:\Program Files\Kingsoft\PowerWord_Oxford\CBSText.dll (Kingsoft PowerWord/Copyright © Kingsoft Corporation Limited. All rights reserved.)
.text C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe[3892] USER32.dll!GetClipboardData 76784B47 5 Bytes JMP 04AD1DF0 C:\Program Files\Kingsoft\PowerWord_Oxford\CBSText.dll (Kingsoft PowerWord/Copyright © Kingsoft Corporation Limited. All rights reserved.)
.text C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe[3892] USER32.dll!ChangeClipboardChain 76793425 5 Bytes JMP 04AD1E90 C:\Program Files\Kingsoft\PowerWord_Oxford\CBSText.dll (Kingsoft PowerWord/Copyright © Kingsoft Corporation Limited. All rights reserved.)
.text C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe[3892] USER32.dll!CloseClipboard 76795BA7 5 Bytes JMP 04AD1DE0 C:\Program Files\Kingsoft\PowerWord_Oxford\CBSText.dll (Kingsoft PowerWord/Copyright © Kingsoft Corporation Limited. All rights reserved.)
.text C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe[3892] USER32.dll!OpenClipboard 76795BB9 5 Bytes JMP 04AD1DD0 C:\Program Files\Kingsoft\PowerWord_Oxford\CBSText.dll (Kingsoft PowerWord/Copyright © Kingsoft Corporation Limited. All rights reserved.)

—- User IAT/EAT - GMER 1.0.15 —-

IAT C:\Windows\Explorer.EXE[2764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [73FA2494] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf
861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [73F85624] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf
861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [73F856E2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf
861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [73FA250F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf
861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [73F98573] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf
861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [73F94D27] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf
861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [73F950CE] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf
861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [73F951A3] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf
861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromHBITMAP] [73F966D0] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf
861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [73F982CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf
861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [73F98819] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf
861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [73F9907A] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf
861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [73F9E21D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf
861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2764] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [73F94C59] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf
861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

—- Devices - GMER 1.0.15 —-

Device 旮註旮註 Ntfs.sys (NT 文件系统驱动程序/Microsoft Corporation)

AttachedDevice 旮註旮註 AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice \Driver\tdx \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

Device \Driver\ACPI_HAL \Device\0000004d halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice \Driver\tdx \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\tdx \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

—- EOF - GMER 1.0.15 —-

schrauber

Post #9January 7, 2011, 7:32 AM UTC

Hi,

How is it running?

Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan

Tick the box next to YES, I accept the Terms of Use
Click Start
When asked, allow the ActiveX control to install
Click Start
Make sure that the options Remove found threats and the option Scan unwanted applications is checked
Click Scan (This scan can take several hours, so please be patient)
Once the scan is completed, you may close the window
Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic

Tom_q2356

Post #10January 7, 2011, 11:50 AM UTC

Hi Tom,

Everything runs pretty good over all, the only time that will slow down is when I want to play an online game, watch an online movie or sometimes just listening to music. Below is the Superantispyware that my computer still has:
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 01/07/2011 at 01:41 AM

Application Version : 4.47.1000

Core Rules Database Version : 6114
Trace Rules Database Version: 3926

Scan type : Custom Scan
Total Scan Time : 00:00:03

Memory items scanned : 0
Memory threats detected : 0
Registry items scanned : 0
Registry threats detected : 0
File items scanned : 86
File threats detected : 1

Trojan.Agent/Gen-Nullo[Micro]
C:\WINDOWS\SYSTEM32\DRIVERSTORE\FILEREPOSITORY\IALMNT5.INF_X86_NEUTRAL_00E3A135D054E3BB\SETB076.TMP

I know this eset scan might take a few hours, so I will post the result later. Thanks!

Tom_q2356

Post #11January 7, 2011, 12:37 PM UTC last edited January 7, 2011, 12:39 PM UTC

ESET Online Scanner:
C:\Program Files\iDailyDiary\iDailyDiary\Utils.exe probably a variant of Win32/Delf.HLEJKUX trojan cleaned by deleting - quarantined

It is hard for me to believe that iDailyDiary would have anything to do with trojan because I have been using it to write diary for many years. However, this scan did not take care of that one trojan caught by superantispyware.

schrauber

Post #12January 7, 2011, 5:33 PM UTC

I researched this one entry from superantispyware, sounds like a false positive. Please post back with a fresh OTL logfile, I will check something in the meantime :).

Tom_q2356

Post #13January 7, 2011, 10:42 PM UTC

OTL logfile created on: 2011/1/7 11:26:42 - Run 2
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Users\Tom_q\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000804 | Country: 中华人民共和国 | Language: CHS | Date Format: yyyy/M/d

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 55.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 230.88 Gb Total Space | 203.06 Gb Free Space | 87.95% Space Free | Partition Type: NTFS

Computer Name: Tom_q-PC | User Name: Tom_q | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/01/05 19:20:06 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Tom_q\Desktop\OTL.exe
PRC - [2010/12/31 20:33:11 | 000,632,792 | —- | M] (PC Tools) – C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
PRC - [2010/12/20 18:08:58 | 000,363,344 | —- | M] (Malwarebytes Corporation) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2010/12/07 00:32:02 | 002,228,008 | —- | M] (TeamViewer GmbH) – C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
PRC - [2010/12/05 16:26:40 | 000,654,176 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgrsx.exe
PRC - [2010/12/05 16:26:12 | 000,650,592 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgchsvx.exe
PRC - [2010/12/03 09:35:08 | 000,912,344 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/12/01 04:14:46 | 001,084,256 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgnsx.exe
PRC - [2010/12/01 04:14:14 | 001,052,512 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgemcx.exe
PRC - [2010/11/26 16:01:52 | 003,989,856 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgui.exe
PRC - [2010/11/23 13:34:16 | 000,724,048 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
PRC - [2010/11/23 13:34:14 | 006,128,208 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
PRC - [2010/11/22 04:48:46 | 003,226,632 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgfws.exe
PRC - [2010/10/26 22:07:46 | 001,585,520 | —- | M] (Sogou.com Inc.) – C:\Program Files\SogouInput\5.1.1.4845\ImeUtil.exe
PRC - [2010/10/22 04:58:18 | 000,265,400 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgwdsvc.exe
PRC - [2010/10/22 04:57:54 | 002,745,696 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgtray.exe
PRC - [2010/10/22 04:57:16 | 000,566,624 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgcfgex.exe
PRC - [2010/10/22 04:56:58 | 000,845,664 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgcsrvx.exe
PRC - [2010/10/22 04:56:48 | 000,745,824 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG10\avgam.exe
PRC - [2010/05/04 12:07:22 | 000,503,080 | —- | M] (Nero AG) – C:\Program Files\Nero\Update\NASvc.exe
PRC - [2010/02/23 17:25:30 | 000,214,408 | —- | M] (ttstream Inc) – C:\Program Files\ttstream\ttsAP.exe
PRC - [2009/10/30 19:45:39 | 002,614,272 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2009/10/14 15:42:38 | 000,104,408 | —- | M] (PC Tools) – C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
PRC - [2009/08/24 19:04:08 | 001,033,480 | —- | M] (Raxco Software, Inc.) – C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
PRC - [2009/08/24 19:04:06 | 000,066,824 | —- | M] (Raxco Software, Inc.) – C:\Program Files\Raxco\PerfectDisk10\PDAgentS1.exe
PRC - [2009/08/24 19:04:04 | 000,935,176 | —- | M] (Raxco Software, Inc.) – C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
PRC - [2009/07/13 15:14:42 | 000,049,152 | —- | M] (Microsoft Corporation) – C:\Windows\System32\taskhost.exe
PRC - [2009/07/13 15:14:15 | 000,271,360 | —- | M] (Microsoft Corporation) – C:\Windows\System32\conhost.exe
PRC - [2008/03/18 14:31:20 | 004,742,184 | —- | M] (Yahoo! Inc.) – C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
PRC - [2003/12/17 17:43:04 | 000,118,784 | —- | M] (Softarium.com) – C:\Program Files\reliz\akeys.exe

========== Modules (SafeList) ==========

MOD - [2011/01/05 19:20:06 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Tom_q\Desktop\OTL.exe
MOD - [2010/10/28 00:03:40 | 003,235,184 | —- | M] (Sogou.com Inc.) – C:\Windows\System32\SogouPy.ime
MOD - [2010/10/26 22:08:00 | 000,596,848 | —- | M] (Sogou.com Inc.) – C:\Program Files\SogouInput\5.1.1.4845\Resource.dll
MOD - [2010/08/20 19:21:32 | 001,680,896 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll
MOD - [2009/07/13 15:16:15 | 000,099,840 | —- | M] (Microsoft Corporation) – C:\Windows\System32\sspicli.dll
MOD - [2009/07/13 15:16:13 | 000,092,160 | —- | M] (Microsoft Corporation) – C:\Windows\System32\sechost.dll
MOD - [2009/07/13 15:16:13 | 000,050,688 | —- | M] (Microsoft Corporation) – C:\Windows\System32\samcli.dll
MOD - [2009/07/13 15:16:12 | 000,031,744 | —- | M] (Microsoft Corporation) – C:\Windows\System32\profapi.dll
MOD - [2009/07/13 15:16:03 | 000,022,016 | —- | M] (Microsoft Corporation) – C:\Windows\System32\netutils.dll
MOD - [2009/07/13 15:15:35 | 000,288,256 | —- | M] (Microsoft Corporation) – C:\Windows\System32\KernelBase.dll
MOD - [2009/07/13 15:15:13 | 000,067,072 | —- | M] (Microsoft Corporation) – C:\Windows\System32\dwmapi.dll
MOD - [2009/07/13 15:15:11 | 000,064,512 | —- | M] (Microsoft Corporation) – C:\Windows\System32\devobj.dll
MOD - [2009/07/13 15:15:07 | 000,036,864 | —- | M] (Microsoft Corporation) – C:\Windows\System32\cryptbase.dll
MOD - [2009/07/13 15:15:02 | 000,145,920 | —- | M] (Microsoft Corporation) – C:\Windows\System32\cfgmgr32.dll

========== Win32 Services (SafeList) ==========

SRV - [2010/12/31 20:33:11 | 000,632,792 | —- | M] (PC Tools) [Auto | Running] – C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe – (PCToolsSSDMonitorSvc)
SRV - [2010/12/31 17:53:16 | 001,343,400 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\Wat\WatAdminSvc.exe – (WatAdminSvc)
SRV - [2010/12/20 18:08:58 | 000,363,344 | —- | M] (Malwarebytes Corporation) [Auto | Running] – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe – (MBAMService)
SRV - [2010/12/07 00:32:02 | 002,228,008 | —- | M] (TeamViewer GmbH) [Auto | Running] – C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe – (TeamViewer6)
SRV - [2010/11/25 09:49:46 | 000,517,448 | —- | M] () [On_Demand | Stopped] – C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe – (AVG Security Toolbar Service)
SRV - [2010/11/23 13:34:14 | 006,128,208 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe – (AVGIDSAgent)
SRV - [2010/11/22 04:48:46 | 003,226,632 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG10\avgfws.exe – (avgfws)
SRV - [2010/10/31 08:37:48 | 000,135,168 | —- | M] (Airytec) [Auto | Stopped] – C:\Program Files\Airytec\Switch Off\swoff.exe – (SwOffWeb)
SRV - [2010/10/31 08:37:48 | 000,135,168 | —- | M] (Airytec) [Auto | Stopped] – C:\Program Files\Airytec\Switch Off\swoff.exe – (SwOffScheduler)
SRV - [2010/10/22 04:58:18 | 000,265,400 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG10\avgwdsvc.exe – (avgwd)
SRV - [2010/05/04 12:07:22 | 000,503,080 | —- | M] (Nero AG) [Auto | Running] – C:\Program Files\Nero\Update\NASvc.exe – (NAUpdate)
SRV - [2010/03/18 13:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2009/08/24 22:16:36 | 000,406,016 | —- | M] (mst software GmbH, Germany) [On_Demand | Stopped] – C:\Program Files\Ashampoo\Ashampoo WinOptimizer 6\Dfsdks.exe – (DfSdkS)
SRV - [2009/08/24 19:04:08 | 001,033,480 | —- | M] (Raxco Software, Inc.) [On_Demand | Running] – C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe – (PDEngine)
SRV - [2009/08/24 19:04:04 | 000,935,176 | —- | M] (Raxco Software, Inc.) [Auto | Running] – C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe – (PDAgent)
SRV - [2009/07/13 15:16:21 | 000,185,856 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\wwansvc.dll – (WwanSvc)
SRV - [2009/07/13 15:16:17 | 000,151,552 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\wbiosrvc.dll – (WbioSrvc)
SRV - [2009/07/13 15:16:17 | 000,119,808 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\umpo.dll – (Power)
SRV - [2009/07/13 15:16:16 | 000,037,376 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\themeservice.dll – (Themes)
SRV - [2009/07/13 15:16:15 | 000,053,760 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\sppuinotify.dll – (sppuinotify)
SRV - [2009/07/13 15:16:13 | 000,043,520 | —- | M] (Microsoft Corporation) [Unknown | Running] – C:\Windows\System32\RpcEpMap.dll – (RpcEptMapper)
SRV - [2009/07/13 15:16:13 | 000,025,088 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\sensrsvc.dll – (SensrSvc)
SRV - [2009/07/13 15:16:12 | 001,004,544 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\PeerDistSvc.dll – (PeerDistSvc)
SRV - [2009/07/13 15:16:12 | 000,269,824 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\System32\pnrpsvc.dll – (PNRPsvc)
SRV - [2009/07/13 15:16:12 | 000,269,824 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\System32\pnrpsvc.dll – (p2pimsvc)
SRV - [2009/07/13 15:16:12 | 000,165,376 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\System32\provsvc.dll – (HomeGroupProvider)
SRV - [2009/07/13 15:16:12 | 000,020,480 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\pnrpauto.dll – (PNRPAutoReg)
SRV - [2009/07/13 15:15:41 | 000,680,960 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2009/07/13 15:15:36 | 000,194,560 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\System32\ListSvc.dll – (HomeGroupListener)
SRV - [2009/07/13 15:15:21 | 000,797,696 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\FntCache.dll – (FontCache)
SRV - [2009/07/13 15:15:11 | 000,253,440 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\dhcpcore.dll – (Dhcp)
SRV - [2009/07/13 15:15:10 | 000,218,624 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\defragsvc.dll – (defragsvc)
SRV - [2009/07/13 15:14:59 | 000,076,800 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\bdesvc.dll – (BDESVC)
SRV - [2009/07/13 15:14:58 | 000,088,064 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\AxInstSv.dll – (AxInstSV) ActiveX Installer (AxInstSV)
SRV - [2009/07/13 15:14:53 | 000,027,648 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\appidsvc.dll – (AppIDSvc)
SRV - [2009/07/13 15:14:29 | 003,179,520 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\sttsvc.exe – (sttsvc)

========== Driver Services (SafeList) ==========

DRV - [2011/01/01 10:19:15 | 000,022,016 | —- | M] (Feitian Technologies Co., Ltd.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\Rockey4.sys – (ROCKEYNT)
DRV - [2010/12/20 18:08:40 | 000,020,952 | —- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] – C:\Windows\System32\drivers\mbam.sys – (MBAMProtector)
DRV - [2010/12/08 04:12:38 | 000,251,728 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\Windows\System32\drivers\avgldx86.sys – (Avgldx86)
DRV - [2010/11/12 13:19:38 | 000,299,984 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\Windows\System32\drivers\avgtdix.sys – (Avgtdix)
DRV - [2010/09/13 15:27:54 | 000,025,680 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\AVGIDSEH.Sys – (AVGIDSEH)
DRV - [2010/09/07 03:48:56 | 000,034,384 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] – C:\Windows\System32\drivers\avgmfx86.sys – (Avgmfx86)
DRV - [2010/09/07 03:48:50 | 000,026,064 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] – C:\Windows\system32\DRIVERS\avgrkx86.sys – (Avgrkx86)
DRV - [2010/08/19 20:42:38 | 000,123,472 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\AVGIDSDriver.sys – (AVGIDSDriver)
DRV - [2010/08/19 20:42:38 | 000,030,288 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\AVGIDSFilter.sys – (AVGIDSFilter)
DRV - [2010/08/19 20:42:36 | 000,021,072 | —- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\AVGIDSShim.sys – (AVGIDSShim)
DRV - [2010/07/12 04:34:02 | 000,054,112 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\Windows\System32\drivers\avgfwd6x.sys – (Avgfwfd)
DRV - [2010/05/10 08:41:30 | 000,067,656 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS – (SASKUTIL)
DRV - [2010/02/17 08:25:48 | 000,012,872 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys – (SASDIFSV)
DRV - [2009/12/10 21:44:02 | 000,133,720 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\Drivers\ksecpkg.sys – (KSecPkg)
DRV - [2009/08/20 11:11:30 | 000,073,232 | —- | M] (Raxco Software, Inc.) [File_System | Auto | Running] – C:\Windows\System32\drivers\DefragFs.sys – (DefragFS)
DRV - [2009/07/13 15:26:21 | 000,015,952 | —- | M] (CMD Technology, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\cmdide.sys – (cmdide)
DRV - [2009/07/13 15:26:17 | 000,297,552 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\adpahci.sys – (adpahci)
DRV - [2009/07/13 15:26:15 | 000,422,976 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\adp94xx.sys – (adp94xx)
DRV - [2009/07/13 15:26:15 | 000,159,312 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\amdsbs.sys – (amdsbs)
DRV - [2009/07/13 15:26:15 | 000,146,512 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\adpu320.sys – (adpu320)
DRV - [2009/07/13 15:26:15 | 000,086,608 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\arcsas.sys – (arcsas)
DRV - [2009/07/13 15:26:15 | 000,079,952 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\amdsata.sys – (amdsata)
DRV - [2009/07/13 15:26:15 | 000,076,368 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\arc.sys – (arc)
DRV - [2009/07/13 15:26:15 | 000,023,616 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\amdxata.sys – (amdxata)
DRV - [2009/07/13 15:26:15 | 000,014,400 | —- | M] (Acer Laboratories Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\aliide.sys – (aliide)
DRV - [2009/07/13 15:20:44 | 000,142,416 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\nvstor.sys – (nvstor)
DRV - [2009/07/13 15:20:44 | 000,117,312 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\nvraid.sys – (nvraid)
DRV - [2009/07/13 15:20:44 | 000,044,624 | —- | M] (IBM Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\nfrd960.sys – (nfrd960)
DRV - [2009/07/13 15:20:37 | 000,089,168 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\lsi_sas.sys – (LSI_SAS)
DRV - [2009/07/13 15:20:36 | 000,332,352 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\iaStorV.sys – (iaStorV)
DRV - [2009/07/13 15:20:36 | 000,235,584 | —- | M] (LSI Corporation, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\MegaSR.sys – (MegaSR)
DRV - [2009/07/13 15:20:36 | 000,096,848 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\lsi_scsi.sys – (LSI_SCSI)
DRV - [2009/07/13 15:20:36 | 000,095,824 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\lsi_fc.sys – (LSI_FC)
DRV - [2009/07/13 15:20:36 | 000,054,864 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\lsi_sas2.sys – (LSI_SAS2)
DRV - [2009/07/13 15:20:36 | 000,041,040 | —- | M] (Intel Corp./ICP vortex GmbH) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\iirsp.sys – (iirsp)
DRV - [2009/07/13 15:20:36 | 000,030,800 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\megasas.sys – (megasas)
DRV - [2009/07/13 15:20:36 | 000,013,904 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\hwpolicy.sys – (hwpolicy)
DRV - [2009/07/13 15:20:28 | 000,453,712 | —- | M] (Emulex) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\elxstor.sys – (elxstor)
DRV - [2009/07/13 15:20:28 | 000,070,720 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\djsvs.sys – (aic78xx)
DRV - [2009/07/13 15:20:28 | 000,067,152 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\HpSAMD.sys – (HpSAMD)
DRV - [2009/07/13 15:20:28 | 000,046,160 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\fsdepends.sys – (FsDepends)
DRV - [2009/07/13 15:19:11 | 000,141,904 | —- | M] (VIA Technologies Inc.,Ltd) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\vsmraid.sys – (vsmraid)
DRV - [2009/07/13 15:19:10 | 000,175,824 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\vmbus.sys – (vmbus)
DRV - [2009/07/13 15:19:10 | 000,159,824 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\vhdmp.sys – (vhdmp)
DRV - [2009/07/13 15:19:10 | 000,040,896 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\vmstorfl.sys – (storflt)
DRV - [2009/07/13 15:19:10 | 000,032,832 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\vdrvroot.sys – (vdrvroot)
DRV - [2009/07/13 15:19:10 | 000,028,224 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\storvsc.sys – (storvsc)
DRV - [2009/07/13 15:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\wimmount.sys – (WIMMount)
DRV - [2009/07/13 15:19:10 | 000,016,976 | —- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\viaide.sys – (viaide)
DRV - [2009/07/13 15:19:04 | 001,383,488 | —- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\ql2300.sys – (ql2300)
DRV - [2009/07/13 15:19:04 | 000,173,648 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\rdyboost.sys – (rdyboost)
DRV - [2009/07/13 15:19:04 | 000,106,064 | —- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\ql40xx.sys – (ql40xx)
DRV - [2009/07/13 15:19:04 | 000,077,888 | —- | M] (Silicon Integrated Systems) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\sisraid4.sys – (SiSRaid4)
DRV - [2009/07/13 15:19:04 | 000,043,088 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\pcw.sys – (pcw)
DRV - [2009/07/13 15:19:04 | 000,040,016 | —- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\SiSRaid2.sys – (SiSRaid2)
DRV - [2009/07/13 15:19:04 | 000,021,072 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\stexstor.sys – (stexstor)
DRV - [2009/07/13 15:17:54 | 000,369,568 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\Drivers\cng.sys – (CNG)
DRV - [2009/07/13 14:57:25 | 000,272,128 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\Drivers\Brserid.sys – (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2009/07/13 14:02:41 | 000,018,944 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\rdpbus.sys – (rdpbus)
DRV - [2009/07/13 14:01:41 | 000,007,168 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\RDPREFMP.sys – (RDPREFMP)
DRV - [2009/07/13 13:55:00 | 000,049,152 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\agilevpn.sys – (RasAgileVpn) WAN Miniport (IKEv2)
DRV - [2009/07/13 13:53:51 | 000,009,728 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\wfplwf.sys – (WfpLwf)
DRV - [2009/07/13 13:52:44 | 000,027,136 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\ndiscap.sys – (NdisCap)
DRV - [2009/07/13 13:52:04 | 000,048,128 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\vwififlt.sys – (vwififlt)
DRV - [2009/07/13 13:52:02 | 000,019,968 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\vwifibus.sys – (vwifibus)
DRV - [2009/07/13 13:52:00 | 000,163,328 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\1394ohci.sys – (1394ohci)
DRV - [2009/07/13 13:51:35 | 000,008,192 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\umpass.sys – (UmPass)
DRV - [2009/07/13 13:51:08 | 000,004,096 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mshidkmdf.sys – (mshidkmdf)
DRV - [2009/07/13 13:46:55 | 000,012,288 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\MTConfig.sys – (MTConfig)
DRV - [2009/07/13 13:45:26 | 000,031,232 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\CompositeBus.sys – (CompositeBus)
DRV - [2009/07/13 13:36:52 | 000,050,176 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\appid.sys – (AppID)
DRV - [2009/07/13 13:33:50 | 000,026,624 | —- | M] (Microsoft Corporation) [Kernel | Unknown | Running] – C:\Windows\System32\drivers\scfilter.sys – (scfilter)
DRV - [2009/07/13 13:28:47 | 000,005,632 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\vms3cap.sys – (s3cap)
DRV - [2009/07/13 13:28:45 | 000,017,920 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\VMBusHID.sys – (VMBusHID)
DRV - [2009/07/13 13:24:05 | 000,032,256 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\discache.sys – (discache)
DRV - [2009/07/13 13:16:36 | 000,009,728 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\acpipmi.sys – (AcpiPmi)
DRV - [2009/07/13 13:11:04 | 000,052,736 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\amdppm.sys – (AmdPPM)
DRV - [2009/07/13 12:54:14 | 000,026,624 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\hcw85cir.sys – (hcw85cir)
DRV - [2009/07/13 12:53:33 | 000,012,160 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\Drivers\BrUsbMdm.sys – (BrUsbMdm)
DRV - [2009/07/13 12:53:33 | 000,011,904 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\Drivers\BrUsbSer.sys – (BrUsbSer)
DRV - [2009/07/13 12:53:32 | 000,062,336 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\Drivers\BrSerWdm.sys – (BrSerWdm)
DRV - [2009/07/13 12:53:28 | 000,013,568 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\BrFiltLo.sys – (BrFiltLo)
DRV - [2009/07/13 12:53:28 | 000,005,248 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\BrFiltUp.sys – (BrFiltUp)
DRV - [2009/07/13 12:02:49 | 000,229,888 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\b57nd60x.sys – (b57nd60x)
DRV - [2009/07/13 12:02:48 | 003,100,160 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\evbdx.sys – (ebdrv)
DRV - [2009/07/13 12:02:48 | 000,430,080 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\bxvbdx.sys – (b06bdrv)
DRV - [2009/07/08 00:45:32 | 002,506,232 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\BCMWL6.SYS – (BCM43XX)
DRV - [2006/09/14 17:55:00 | 000,088,192 | —- | M] (Texas Instruments) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\gtipci21.sys – (GTIPCI21)
DRV - [2005/03/10 16:56:06 | 000,273,168 | —- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\STAC97.sys – (STAC97)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://cn.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = zh-cn
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 18 B5 A6 5B 72 A9 CB 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Bing"
FF - prefs.js..browser.startup.homepage: "http://www.google.com"
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:10.0.0.1178
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:[removed]
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.1
FF - prefs.js..extensions.enabledItems: [removed]:1.6.1
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100908
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {22119944-ED35-4ab1-910B-E619EA06A115}:6.9.98
FF - prefs.js..extensions.enabledItems: [removed]:4.51
FF - prefs.js..keyword.URL: "http://www.bing.com/search?pc=ZUGO&form;=ZGAADF&q;="

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG10\Firefox\ [2010/12/31 18:41:17 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files\Siber Systems\AI RoboForm\Firefox [2010/12/31 21:49:35 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/01/02 17:15:54 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/31 19:16:32 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/31 20:40:48 | 000,000,000 | —D | M]

[2010/12/31 19:16:52 | 000,000,000 | —D | M] (No name found) – C:\Users\Tom_q\AppData\Roaming\Mozilla\Extensions
[2011/01/07 02:33:45 | 000,000,000 | —D | M] (No name found) – C:\Users\Tom_q\AppData\Roaming\Mozilla\Firefox\Profiles\awad85ku.default\extensions
[2011/01/07 02:33:29 | 000,000,000 | —D | M] (NoScript) – C:\Users\Tom_q\AppData\Roaming\Mozilla\Firefox\Profiles\awad85ku.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010/12/31 19:30:48 | 000,000,000 | —D | M] (WOT) – C:\Users\Tom_q\AppData\Roaming\Mozilla\Firefox\Profiles\awad85ku.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010/12/31 19:30:49 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\Tom_q\AppData\Roaming\Mozilla\Firefox\Profiles\awad85ku.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010/12/31 19:27:31 | 000,000,000 | —D | M] (Adblock Plus) – C:\Users\Tom_q\AppData\Roaming\Mozilla\Firefox\Profiles\awad85ku.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/12/31 19:30:48 | 000,000,000 | —D | M] (Personas) – C:\Users\Tom_q\AppData\Roaming\Mozilla\Firefox\Profiles\awad85ku.default\extensions\[removed]
[2010/12/31 20:19:50 | 000,001,919 | —- | M] () – C:\Users\Tom_q\AppData\Roaming\Mozilla\Firefox\Profiles\awad85ku.default\searchplugins\bing-zugo.xml
[2010/12/31 20:19:06 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/12/31 20:19:07 | 000,000,000 | —D | M] (Skype extension) – C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/12/31 20:07:36 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2010/12/31 18:41:17 | 000,000,000 | —D | M] (AVG Safe Search) – C:\PROGRAM FILES\AVG\AVG10\FIREFOX
[2011/01/02 17:15:54 | 000,000,000 | —D | M] (HP Smart Web Printing) – C:\PROGRAM FILES\HP\DIGITAL IMAGING\SMART WEB PRINTING\MOZILLAADDON3
[2010/12/31 21:49:35 | 000,000,000 | —D | M] (AI Roboform Toolbar for Firefox) – C:\PROGRAM FILES\SIBER SYSTEMS\AI ROBOFORM\FIREFOX
File not found (No name found) – C:\USERS\钂嬩粙鐭砛APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AWAD85KU.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}
File not found (No name found) – C:\USERS\钂嬩粙鐭砛APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AWAD85KU.DEFAULT\EXTENSIONS\{A0D7CCB3-214D-498B-B4AA-0E8FDA9A7BF7}
File not found (No name found) – C:\USERS\钂嬩粙鐭砛APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AWAD85KU.DEFAULT\EXTENSIONS\{B9DB16A4-6EDC-47EC-A1F4-B86292ED211D}
File not found (No name found) – C:\USERS\钂嬩粙鐭砛APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AWAD85KU.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}
File not found (No name found) – C:\USERS\钂嬩粙鐭砛APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AWAD85KU.DEFAULT\EXTENSIONS\[removed]
[2010/12/31 20:07:26 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/12/31 20:39:54 | 000,075,208 | —- | M] (Foxit Software Company) – C:\Program Files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
[2007/03/09 13:16:44 | 000,189,496 | —- | M] (Yahoo! Inc.) – C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll

O1 HOSTS File: ([2010/12/31 20:04:06 | 000,428,463 | R— | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 123fporn.info
O1 - Hosts: 14749 more lines…
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (&RoboForm;) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm;) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SSDMonitor] C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe (PC Tools)
O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios)
O4 - HKCU..\Run: [Active Keys Application File] C:\Program Files\reliz\akeys.exe (Softarium.com)
O4 - HKCU..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe ( )
O4 - HKCU..\Run: [Kingsoft PowerWord] C:\Program Files\Kingsoft\PowerWord_Oxford\XDict.exe (Copyright © Kingsoft Corporation Limited. All rights reserved.)
O4 - HKCU..\Run: [tts Accelerator] C:\Program Files\ttstream\ttsAP.exe (ttstream Inc)
O4 - Startup: C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe (Yahoo! Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Customize Menu - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: Fill Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: Logoff - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComLogoff.html ()
O8 - Extra context menu item: RoboForm Toolbar - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Save Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8 - Extra context menu item: 使用光影编辑和美化 - C:\Program Files\nEO iMAGING\NeoOpenNeo.htm ()
O8 - Extra context menu item: 添加到飞信表情 - C:\Program Files\China Mobile\Fetion\FetionExt.dll (China Mobile)
O8 - Extra context menu item: 通过飞信短信发送 - C:\Program Files\China Mobile\Fetion\FetionExt.dll (China Mobile)
O9 - Extra Button: 填写表单 - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra 'Tools' menuitem : 填写表单 - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra Button: 保存 - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra 'Tools' menuitem : 保存表单 - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : RoboForm工具栏 - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra Button: 启动飞信 - {814953B0-3DE7-4171-A0DD-A7A38322B6C7} - C:\Program Files\China Mobile\Fetion\Fetion.exe (China Mobile)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: 显示或隐藏 HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: tts.tv ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: ttstream.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: webscache.com ([]http in Trusted sites)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} http://u3.sandisk.com/download/atts/LPInstaller.CAB (CInstallLPCtrl Object)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.15.1
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O18 - Protocol\Handler\Kool {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\Windows\System32\Kool3DownXControl.ocx ()
O18 - Protocol\Handler\Kool3 {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\Windows\System32\Kool3DownXControl.ocx ()
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (livessp) - C:\Windows\System32\livessp.dll (Microsoft Corp.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 11:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (PDBoot.exe) - C:\Windows\System32\PDBoot.exe (Raxco Software, Inc.)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
NetSvcs: Themes - C:\Windows\System32\themeservice.dll (Microsoft Corporation)
NetSvcs: BDESVC - C:\Windows\System32\bdesvc.dll (Microsoft Corporation)

========== Files/Folders - Created Within 30 Days ==========

[2011/01/07 01:54:05 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/01/05 19:20:02 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Tom_q\Desktop\OTL.exe
[2011/01/02 23:32:47 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\Tom_q\Desktop\HiJackThis.exe
[2011/01/02 18:41:14 | 000,000,000 | —D | C] – C:\ttsvodcache
[2011/01/02 18:05:22 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Tencent
[2011/01/02 18:05:10 | 000,000,000 | —D | C] – C:\ProgramData\Tencent
[2011/01/02 17:40:49 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Local\HP
[2011/01/02 17:17:28 | 000,000,000 | —D | C] – C:\ProgramData\WEBREG
[2011/01/02 17:17:26 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\HP
[2011/01/02 17:14:47 | 000,000,000 | —D | C] – C:\ProgramData\HP Product Assistant
[2011/01/02 17:13:27 | 000,000,000 | —D | C] – C:\Program Files\Common Files\HP
[2011/01/02 17:12:56 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
[2011/01/02 17:12:30 | 000,000,000 | —D | C] – C:\Program Files\HP
[2011/01/02 17:12:29 | 000,000,000 | -H-D | C] – C:\Config.Msi
[2011/01/02 17:12:08 | 000,000,000 | —D | C] – C:\ProgramData\Hewlett-Packard
[2011/01/02 15:44:55 | 000,000,000 | —D | C] – C:\ProgramData\HP
[2011/01/02 13:26:30 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Camfrog
[2011/01/02 13:26:19 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Camfrog Video Chat 5.5
[2011/01/02 13:26:14 | 000,000,000 | —D | C] – C:\Program Files\Camfrog
[2011/01/02 13:12:25 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\腾讯游戏
[2011/01/02 13:12:25 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\腾讯游戏
[2011/01/02 13:12:19 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\腾讯游戏
[2011/01/02 13:11:41 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\光影魔术手
[2011/01/02 13:11:40 | 000,000,000 | —D | C] – C:\Program Files\nEO iMAGING
[2011/01/02 13:11:08 | 000,000,000 | —D | C] – C:\Users\Tom_q\Documents\美图图库
[2011/01/02 13:10:49 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\美图秀秀
[2011/01/02 13:10:44 | 000,000,000 | —D | C] – C:\Program Files\Meitu
[2011/01/02 13:10:21 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\可牛影像
[2011/01/02 13:10:00 | 000,000,000 | —D | C] – C:\Users\Tom_q\Documents\可牛闪图
[2011/01/02 13:09:53 | 000,000,000 | —D | C] – C:\Program Files\Conew
[2011/01/01 17:13:16 | 000,000,000 | —D | C] – C:\Users\Tom_q\Desktop\Acupuncture
[2011/01/01 16:10:58 | 000,000,000 | -HSD | C] – C:\Windows\System32\%APPDATA%
[2011/01/01 14:13:33 | 000,000,000 | —D | C] – C:\ProgramData\Fetion
[2011/01/01 11:01:33 | 000,000,000 | —D | C] – C:\Users\Tom_q\Documents\My Widgets
[2011/01/01 11:00:20 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Local\Agenda
[2011/01/01 10:22:40 | 000,000,000 | —D | C] – C:\ProgramData\kingsoft
[2011/01/01 10:20:06 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\kingsoft
[2011/01/01 10:19:15 | 000,022,016 | —- | C] (Feitian Technologies Co., Ltd.) – C:\Windows\System32\drivers\Rockey4.sys
[2011/01/01 10:19:15 | 000,012,928 | —- | C] (Feitian Technologies Co., Ltd.) – C:\Windows\System32\drivers\Rockey4USB.sys
[2011/01/01 10:18:48 | 000,000,000 | —D | C] – C:\Program Files\SinoVoice
[2011/01/01 10:18:04 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\InstallShield
[2011/01/01 10:15:29 | 000,000,000 | —D | C] – C:\Program Files\Kingsoft
[2010/12/31 22:51:15 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Local\Stardock
[2010/12/31 22:51:09 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stardock CursorXP
[2010/12/31 22:51:07 | 000,000,000 | —D | C] – C:\Program Files\CursorXP
[2010/12/31 22:48:01 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\金山词霸2009 牛津版
[2010/12/31 22:36:22 | 000,000,000 | —D | C] – C:\Users\Tom_q\Desktop\暂时
[2010/12/31 22:36:22 | 000,000,000 | —D | C] – C:\Users\Tom_q\Desktop\每半年数目检查
[2010/12/31 22:36:22 | 000,000,000 | —D | C] – C:\Users\Tom_q\Desktop\合同
[2010/12/31 22:36:22 | 000,000,000 | —D | C] – C:\Users\Tom_q\Desktop\MateriaMedica
[2010/12/31 22:36:22 | 000,000,000 | —D | C] – C:\Users\Tom_q\Desktop\Bapaper
[2010/12/31 22:36:21 | 000,000,000 | —D | C] – C:\Users\Tom_q\Desktop\2010Semester
[2010/12/31 22:32:37 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Registry Mechanic
[2010/12/31 22:15:14 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Softarium.com
[2010/12/31 22:11:55 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Malwarebytes
[2010/12/31 22:11:50 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/12/31 22:11:50 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/12/31 22:11:46 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/12/31 22:11:46 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/12/31 22:09:26 | 000,000,000 | —D | C] – C:\ProgramData\SUPERAntiSpyware.com
[2010/12/31 22:09:25 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\SUPERAntiSpyware.com
[2010/12/31 22:09:22 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2010/12/31 22:09:20 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2010/12/31 22:00:44 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Local\Deployment
[2010/12/31 22:00:44 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Local\Atts
[2010/12/31 21:52:56 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dream Aquarium
[2010/12/31 21:52:56 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dream Aquarium
[2010/12/31 21:52:54 | 000,000,000 | —D | C] – C:\Program Files\Dream Aquarium
[2010/12/31 21:49:51 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Avant Profiles
[2010/12/31 21:49:45 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AI RoboForm
[2010/12/31 21:49:36 | 000,000,000 | —D | C] – C:\ProgramData\RoboForm
[2010/12/31 21:49:29 | 000,000,000 | —D | C] – C:\Users\Tom_q\Documents\My RoboForm Data
[2010/12/31 21:49:22 | 000,000,000 | —D | C] – C:\Program Files\Siber Systems
[2010/12/31 21:47:57 | 000,000,000 | —D | C] – C:\Program Files\Sketch Master
[2010/12/31 21:44:11 | 000,000,000 | —D | C] – C:\ProgramData\Raxco
[2010/12/31 21:43:09 | 000,000,000 | —D | C] – C:\Program Files\Raxco
[2010/12/31 21:41:42 | 000,000,000 | —D | C] – C:\Program Files\PhotoZoom Pro 3
[2010/12/31 21:32:49 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2010/12/31 21:32:17 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Silverlight
[2010/12/31 21:18:18 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Local\Windows Live
[2010/12/31 20:57:01 | 000,028,160 | —- | C] (mst software GmbH, Germany) – C:\Windows\System32\DfSdkBt.exe
[2010/12/31 20:57:01 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
[2010/12/31 20:56:51 | 000,000,000 | —D | C] – C:\Program Files\Ashampoo
[2010/12/31 20:52:59 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Nero
[2010/12/31 20:52:43 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero
[2010/12/31 20:52:40 | 000,000,000 | —D | C] – C:\Program Files\Nero
[2010/12/31 20:52:27 | 000,000,000 | —D | C] – C:\ProgramData\Nero
[2010/12/31 20:49:26 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Fetion
[2010/12/31 20:42:32 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\WinRAR
[2010/12/31 20:41:10 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader
[2010/12/31 20:41:08 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Macromedia
[2010/12/31 20:41:08 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Adobe
[2010/12/31 20:40:48 | 000,000,000 | —D | C] – C:\Program Files\Foxit Software
[2010/12/31 20:38:47 | 000,000,000 | —D | C] – C:\Program Files\MSECache
[2010/12/31 20:37:09 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2010/12/31 20:36:55 | 000,000,000 | —D | C] – C:\Program Files\Microsoft ActiveSync
[2010/12/31 20:36:48 | 000,000,000 | —D | C] – C:\Program Files\Common Files\DESIGNER
[2010/12/31 20:36:18 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Office
[2010/12/31 20:34:34 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2010/12/31 20:34:34 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2010/12/31 20:34:29 | 000,000,000 | —D | C] – C:\Program Files\WinRAR
[2010/12/31 20:31:57 | 001,101,824 | —- | C] (Woodbury Associates Limited) – C:\Windows\System32\UniBox210.ocx
[2010/12/31 20:31:57 | 000,880,640 | —- | C] (Woodbury Associates Limited) – C:\Windows\System32\UniBox10.ocx
[2010/12/31 20:31:57 | 000,212,992 | —- | C] (Woodbury Associates Limited) – C:\Windows\System32\UniBoxVB12.ocx
[2010/12/31 20:31:57 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Registry Mechanic
[2010/12/31 20:31:55 | 000,000,000 | —D | C] – C:\Program Files\Common Files\PC Tools
[2010/12/31 20:31:54 | 000,000,000 | —D | C] – C:\Program Files\Registry Mechanic
[2010/12/31 20:30:18 | 000,000,000 | —D | C] – C:\Users\Tom_q\Tracing
[2010/12/31 20:29:23 | 000,000,000 | —D | C] – C:\Users\Public\Documents\microsoft
[2010/12/31 20:28:56 | 000,000,000 | —D | C] – C:\Program Files\Windows Live
[2010/12/31 20:28:34 | 000,000,000 | —D | C] – C:\Windows\PCHEALTH
[2010/12/31 20:25:15 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Windows Live
[2010/12/31 20:25:11 | 000,000,000 | —D | C] – C:\Windows\System32\appmgmt
[2010/12/31 20:24:03 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Local\Yahoo
[2010/12/31 20:24:00 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Yahoo! Widgets
[2010/12/31 20:23:57 | 000,000,000 | —D | C] – C:\Program Files\Yahoo!
[2010/12/31 20:22:52 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Trillian
[2010/12/31 20:21:44 | 000,000,000 | —D | C] – C:\Program Files\Trillian
[2010/12/31 20:20:51 | 000,000,000 | —D | C] – C:\Program Files\TeamViewer
[2010/12/31 20:20:18 | 000,000,000 | —D | C] – C:\Program Files\Airytec
[2010/12/31 20:19:39 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SkypeLauncher
[2010/12/31 20:19:35 | 000,000,000 | —D | C] – C:\Program Files\SkypeLauncher
[2010/12/31 20:18:44 | 000,000,000 | R–D | C] – C:\Program Files\Skype
[2010/12/31 20:18:44 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2010/12/31 20:18:44 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Skype
[2010/12/31 20:18:43 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Skype
[2010/12/31 20:18:42 | 000,000,000 | —D | C] – C:\ProgramData\Skype
[2010/12/31 20:17:06 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wisdom-soft ScreenHunter 5 Free
[2010/12/31 20:17:06 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wisdom-soft ScreenHunter 5 Free
[2010/12/31 20:17:03 | 000,000,000 | —D | C] – C:\Program Files\Wisdom-soft ScreenHunter 5 Free
[2010/12/31 20:16:17 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FlashPeak SlimBrowser
[2010/12/31 20:16:16 | 000,000,000 | —D | C] – C:\Program Files\SlimBrowser
[2010/12/31 20:15:38 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ttstream
[2010/12/31 20:15:18 | 000,000,000 | —D | C] – C:\Program Files\ttstream
[2010/12/31 20:15:17 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\ttstream
[2010/12/31 20:13:29 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Opera
[2010/12/31 20:13:29 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Local\Opera
[2010/12/31 20:13:25 | 000,000,000 | —D | C] – C:\Program Files\Opera
[2010/12/31 20:12:40 | 000,000,000 | —D | C] – C:\Kool
[2010/12/31 20:12:39 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kool
[2010/12/31 20:12:37 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Kool
[2010/12/31 20:12:37 | 000,000,000 | —D | C] – C:\Program Files\Kool
[2010/12/31 20:12:21 | 000,000,000 | —D | C] – C:\Windows\System32\Macromed
[2010/12/31 20:12:02 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iDailyDiary
[2010/12/31 20:12:01 | 000,000,000 | —D | C] – C:\Program Files\iDailyDiary
[2010/12/31 20:11:44 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\中国移动飞信
[2010/12/31 20:11:10 | 000,000,000 | —D | C] – C:\Program Files\China Mobile
[2010/12/31 20:10:58 | 000,000,000 | —D | C] – C:\Program Files\ePrompter
[2010/12/31 20:10:36 | 000,000,000 | —D | C] – C:\Program Files\CRadio
[2010/12/31 20:09:22 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2010/12/31 20:08:38 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avant Browser
[2010/12/31 20:08:34 | 000,000,000 | —D | C] – C:\Program Files\Avant Browser
[2010/12/31 20:08:00 | 000,000,000 | —D | C] – C:\ProgramData\Sun
[2010/12/31 20:07:56 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/12/31 20:07:23 | 000,000,000 | —D | C] – C:\Program Files\Java
[2010/12/31 20:00:28 | 000,000,000 | —D | C] – C:\ProgramData\Spybot - Search & Destroy
[2010/12/31 20:00:28 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2010/12/31 19:58:36 | 000,000,000 | —D | C] – C:\ProgramData\TEMP
[2010/12/31 19:58:30 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
[2010/12/31 19:58:29 | 000,000,000 | —D | C] – C:\Program Files\SpywareBlaster
[2010/12/31 19:53:38 | 000,000,000 | —D | C] – C:\PerfLog
[2010/12/31 19:53:31 | 000,000,000 | —D | C] – C:\Program Files\SogouInput
[2010/12/31 19:53:31 | 000,000,000 | —D | C] – C:\Program Files\SogouExtension
[2010/12/31 19:16:36 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Mozilla
[2010/12/31 19:16:36 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Local\Mozilla
[2010/12/31 19:16:33 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox
[2010/12/31 19:16:30 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2010/12/31 19:10:20 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\WinPatrol
[2010/12/31 19:10:13 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPatrol
[2010/12/31 19:10:12 | 000,000,000 | —D | C] – C:\Program Files\BillP Studios
[2010/12/31 18:55:47 | 000,000,000 | -H-D | C] – C:\Program Files\InstallShield Installation Information
[2010/12/31 18:55:47 | 000,000,000 | —D | C] – C:\Program Files\SigmaTel
[2010/12/31 18:55:42 | 000,000,000 | —D | C] – C:\Program Files\Common Files\InstallShield
[2010/12/31 18:54:31 | 000,000,000 | —D | C] – C:\dell
[2010/12/31 18:44:59 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\AVG10
[2010/12/31 18:42:42 | 000,000,000 | -H-D | C] – C:\ProgramData\Common Files
[2010/12/31 18:42:30 | 000,000,000 | —D | C] – C:\ProgramData\AVG Security Toolbar
[2010/12/31 18:42:11 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2011
[2010/12/31 18:41:14 | 000,000,000 | —D | C] – C:\ProgramData\AVG10
[2010/12/31 18:41:14 | 000,000,000 | —D | C] – C:\Windows\System32\drivers\AVG
[2010/12/31 18:40:37 | 000,000,000 | —D | C] – C:\Program Files\AVG
[2010/12/31 18:29:47 | 000,000,000 | —D | C] – C:\ProgramData\MFAData
[2010/12/31 18:27:53 | 000,000,000 | —D | C] – C:\Program Files\reliz
[2010/12/31 17:55:39 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET
[2010/12/31 17:55:29 | 000,000,000 | -HSD | C] – C:\Windows\Installer
[2010/12/31 17:53:17 | 000,000,000 | —D | C] – C:\Windows\System32\Wat
[2010/12/31 17:52:11 | 000,000,000 | —D | C] – C:\Intel
[2010/12/31 16:41:26 | 000,000,000 | R–D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2010/12/31 16:41:26 | 000,000,000 | R–D | C] – C:\Users\Tom_q\Searches
[2010/12/31 16:41:26 | 000,000,000 | R–D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2010/12/31 16:41:25 | 000,000,000 | -H-D | C] – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
[2010/12/31 16:41:13 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Identities
[2010/12/31 16:41:11 | 000,000,000 | R–D | C] – C:\Users\Tom_q\Contacts
[2010/12/31 16:41:01 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Local\VirtualStore
[2010/12/31 16:40:58 | 000,000,000 | –SD | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft
[2010/12/31 16:40:58 | 000,000,000 | R–D | C] – C:\Users\Tom_q\Videos
[2010/12/31 16:40:58 | 000,000,000 | R–D | C] – C:\Users\Tom_q\Saved Games
[2010/12/31 16:40:58 | 000,000,000 | R–D | C] – C:\Users\Tom_q\Pictures
[2010/12/31 16:40:58 | 000,000,000 | R–D | C] – C:\Users\Tom_q\Music
[2010/12/31 16:40:58 | 000,000,000 | R–D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2010/12/31 16:40:58 | 000,000,000 | R–D | C] – C:\Users\Tom_q\Links
[2010/12/31 16:40:58 | 000,000,000 | R–D | C] – C:\Users\Tom_q\Favorites
[2010/12/31 16:40:58 | 000,000,000 | R–D | C] – C:\Users\Tom_q\Downloads
[2010/12/31 16:40:58 | 000,000,000 | R–D | C] – C:\Users\Tom_q\Documents
[2010/12/31 16:40:58 | 000,000,000 | R–D | C] – C:\Users\Tom_q\Desktop
[2010/12/31 16:40:58 | 000,000,000 | R–D | C] – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\AppData\Local\Temporary Internet Files
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\Templates
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\SendTo
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\Recent
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\PrintHood
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\NetHood
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\Documents\My Videos
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\Documents\My Pictures
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\Documents\My Music
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\My Documents
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\Local Settings
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\AppData\Local\History
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\Cookies
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\Application Data
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\AppData\Local\Application Data
[2010/12/31 16:40:58 | 000,000,000 | -HSD | C] – C:\Users\Tom_q\「开始」菜单
[2010/12/31 16:40:58 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Local\Temp
[2010/12/31 16:40:58 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Local\Microsoft
[2010/12/31 16:40:58 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData\Roaming\Media Center Programs
[2010/12/31 16:40:58 | 000,000,000 | —D | C] – C:\Users\Tom_q\AppData
[2010/12/31 16:40:42 | 000,000,000 | -HSD | C] – C:\ProgramData\桌面
[2010/12/31 16:40:42 | 000,000,000 | -HSD | C] – C:\ProgramData\收藏夹
[2010/12/31 16:40:42 | 000,000,000 | -HSD | C] – C:\Recovery
[2010/12/31 16:40:42 | 000,000,000 | -HSD | C] – C:\ProgramData\「开始」菜单
[2010/12/30 22:37:33 | 000,000,000 | —D | C] – C:\Windows\SoftwareDistribution
[2010/12/30 22:34:28 | 000,000,000 | —D | C] – C:\Windows\Prefetch
[2010/12/30 22:34:18 | 000,000,000 | -HSD | C] – C:\System Volume Information
[2010/12/30 22:33:51 | 000,000,000 | —D | C] – C:\Windows\Panther
[2010/12/30 22:33:36 | 000,000,000 | -HSD | C] – C:\Boot

========== Files - Modified Within 30 Days ==========

[2011/01/07 11:24:14 | 000,014,016 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/01/07 11:24:14 | 000,014,016 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/01/07 11:18:37 | 103,672,065 | —- | M] () – C:\Windows\System32\drivers\AVG\incavi.avm
[2011/01/07 11:15:51 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/01/07 11:15:49 | 1603,874,816 | -HS- | M] () – C:\hiberfil.sys
[2011/01/06 11:48:09 | 000,296,448 | —- | M] () – C:\Users\Tom_q\Desktop\c4hxbhud.exe
[2011/01/06 11:41:05 | 000,080,384 | —- | M] () – C:\Users\Tom_q\Desktop\MBRCheck.exe
[2011/01/05 19:20:06 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Tom_q\Desktop\OTL.exe
[2011/01/05 19:09:58 | 000,641,053 | —- | M] () – C:\Windows\System32\drivers\AVG\iavifw.avm
[2011/01/02 23:32:57 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\Tom_q\Desktop\HiJackThis.exe
[2011/01/02 17:44:12 | 000,618,896 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/01/02 17:44:12 | 000,365,396 | —- | M] () – C:\Windows\System32\prfh0804.dat
[2011/01/02 17:44:12 | 000,110,166 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/01/02 17:44:12 | 000,108,026 | —- | M] () – C:\Windows\System32\prfc0804.dat
[2011/01/02 17:38:37 | 000,282,120 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2011/01/02 17:17:19 | 000,169,761 | —- | M] () – C:\Windows\hphins27.dat
[2011/01/02 13:26:19 | 000,002,137 | —- | M] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Camfrog Video Chat 5.5.lnk
[2011/01/02 13:12:27 | 000,000,988 | —- | M] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ游戏.lnk
[2011/01/01 11:01:37 | 000,001,027 | —- | M] () – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Yahoo! Widgets.lnk
[2011/01/01 10:19:15 | 000,022,016 | —- | M] (Feitian Technologies Co., Ltd.) – C:\Windows\System32\drivers\Rockey4.sys
[2011/01/01 10:19:15 | 000,012,928 | —- | M] (Feitian Technologies Co., Ltd.) – C:\Windows\System32\drivers\Rockey4USB.sys
[2011/01/01 10:19:15 | 000,004,096 | —- | M] () – C:\Windows\System32\Ry4CoInst.dll
[2010/12/31 22:36:01 | 000,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2010/12/31 20:41:10 | 000,001,216 | —- | M] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Foxit Reader.lnk
[2010/12/31 20:38:09 | 000,000,376 | —- | M] () – C:\Windows\ODBC.INI
[2010/12/31 20:16:17 | 000,001,014 | —- | M] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\FlashPeak SlimBrowser.lnk
[2010/12/31 20:12:39 | 000,001,087 | —- | M] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Kool2010.lnk
[2010/12/31 20:08:41 | 000,001,009 | —- | M] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Avant Browser.lnk
[2010/12/31 20:04:06 | 000,428,463 | R— | M] () – C:\Windows\System32\drivers\etc\hosts
[2010/12/31 19:16:33 | 000,001,913 | —- | M] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/12/31 19:10:52 | 000,001,335 | —- | M] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/12/30 22:37:54 | 000,098,247 | —- | M] () – C:\Windows\System32\license.rtf
[2010/12/30 22:33:39 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2010/12/20 18:09:00 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/12/20 18:08:40 | 000,020,952 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys

========== Files Created - No Company Name ==========

[2011/01/07 11:18:37 | 103,672,065 | —- | C] () – C:\Windows\System32\drivers\AVG\incavi.avm
[2011/01/06 11:48:07 | 000,296,448 | —- | C] () – C:\Users\Tom_q\Desktop\c4hxbhud.exe
[2011/01/06 11:41:01 | 000,080,384 | —- | C] () – C:\Users\Tom_q\Desktop\MBRCheck.exe
[2011/01/05 19:09:58 | 000,641,053 | —- | C] () – C:\Windows\System32\drivers\AVG\iavifw.avm
[2011/01/02 17:10:31 | 000,169,761 | —- | C] () – C:\Windows\hphins27.dat
[2011/01/02 17:10:31 | 000,000,349 | —- | C] () – C:\Windows\hphmdl27.dat
[2011/01/02 15:45:15 | 000,001,726 | —- | C] () – C:\ProgramData\hpzinstall.log
[2011/01/02 13:26:19 | 000,002,137 | —- | C] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Camfrog Video Chat 5.5.lnk
[2011/01/02 13:12:27 | 000,000,988 | —- | C] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ游戏.lnk
[2011/01/01 11:01:37 | 000,001,027 | —- | C] () – C:\Users\Tom_q\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Yahoo! Widgets.lnk
[2011/01/01 10:19:15 | 000,004,096 | —- | C] () – C:\Windows\System32\Ry4CoInst.dll
[2010/12/31 22:36:29 | 008,093,696 | —- | C] () – C:\Users\Tom_q\Desktop\BaiHuTang.ppt
[2010/12/31 22:36:29 | 000,054,784 | —- | C] () – C:\Users\Tom_q\Desktop\BaiHuTang.doc
[2010/12/31 22:36:29 | 000,045,056 | —- | C] () – C:\Users\Tom_q\Desktop\Tom_qPsychologyAssignments.doc
[2010/12/31 22:36:01 | 000,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2010/12/31 20:41:10 | 000,001,216 | —- | C] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Foxit Reader.lnk
[2010/12/31 20:38:09 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2010/12/31 20:16:17 | 000,001,014 | —- | C] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\FlashPeak SlimBrowser.lnk
[2010/12/31 20:12:39 | 000,001,087 | —- | C] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Kool2010.lnk
[2010/12/31 20:12:38 | 000,548,464 | —- | C] () – C:\Windows\System32\Kool3DownXControl.ocx
[2010/12/31 20:08:41 | 000,001,009 | —- | C] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Avant Browser.lnk
[2010/12/31 19:16:33 | 000,001,913 | —- | C] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/12/31 19:10:52 | 000,001,335 | —- | C] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/12/31 18:59:09 | 000,524,850 | —- | C] () – C:\Windows\System32\igxpxa32.cpa
[2010/12/31 18:59:09 | 000,058,704 | —- | C] () – C:\Windows\System32\igxpxk32.vp
[2010/12/31 18:59:09 | 000,023,296 | —- | C] () – C:\Windows\System32\igxpxs32.vp
[2010/12/31 18:59:09 | 000,000,929 | —- | C] () – C:\Windows\System32\igxpxa32.vp
[2010/12/31 18:55:48 | 000,192,512 | —- | C] () – C:\Windows\System32\Stac97co.dll
[2010/12/31 18:50:14 | 000,171,136 | RHS- | C] () – C:\grldr
[2010/12/31 16:40:58 | 000,000,290 | —- | C] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2010/12/31 16:40:58 | 000,000,272 | —- | C] () – C:\Users\Tom_q\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2010/12/30 22:34:18 | 1603,874,816 | -HS- | C] () – C:\hiberfil.sys
[2010/12/30 22:33:39 | 000,008,192 | RHS- | C] () – C:\BOOTSECT.BAK
[2010/12/30 22:33:37 | 000,383,562 | RHS- | C] () – C:\bootmgr
[2009/07/13 13:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 13:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2007/01/13 10:46:36 | 000,204,800 | —- | C] () – C:\Windows\System32\igfxCoIn_v4764.dll
[2003/03/03 07:16:52 | 000,004,910 | —- | C] () – C:\Windows\System32\OUTLPERF.INI

========== LOP Check ==========

[2010/12/31 18:44:59 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\AVG10
[2011/01/02 13:26:32 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\Camfrog
[2011/01/01 18:58:54 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\Fetion
[2011/01/01 10:20:06 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\kingsoft
[2010/12/31 20:12:37 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\Kool
[2011/01/01 11:00:26 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\Opera
[2011/01/02 18:40:59 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\ttstream
[2010/12/31 22:32:37 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\Registry Mechanic
[2010/12/31 22:15:14 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\Softarium.com
[2011/01/02 18:05:22 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\Tencent
[2010/12/31 20:22:52 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\Trillian
[2010/12/31 19:10:20 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\WinPatrol
[2011/01/02 13:12:19 | 000,000,000 | —D | M] – C:\Users\Tom_q\AppData\Roaming\腾讯游戏
[2009/07/13 18:53:46 | 000,006,654 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >

< %systemdrive%\*.sys /90 /md5 >
[2011/01/07 11:15:49 | 1603,874,816 | -HS- | M] () Unable to obtain MD5 – C:\hiberfil.sys
[2011/01/07 11:15:49 | 2138,501,120 | -HS- | M] () Unable to obtain MD5 – C:\pagefile.sys

========== Alternate Data Streams ==========

@Alternate Data Stream - 150 bytes -> C:\ProgramData\TEMP:D1B5B4F1

< End of report >

Tom_q2356

Post #14January 8, 2011, 7:33 AM UTC

Hi Tom,

Could you also give me a link to download a videocard driver for my computer? I think the one I am using is not the best one for Windows 7. Thanks very much!

schrauber

Post #15January 8, 2011, 4:35 PM UTC

Looks good to me, this one entry is a false positive. What kind of videocard do you have?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

system32 infected

✨ Ask AI

Ask AI