What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijack this log

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi, I went on a NAVTEQ site a day ago and got re directed to a video clip site, where man dressed as a chicken was teasing an Alligator. Then loads of things started to attack my computer, as soon as Avast stopped one another one started, I tried to get off the site as quick as possible but the computer seemed to be stuck so I opened task manager and ended process. Everything seemed fine and I carried on using computer. The next day (yesterday) I booted up the computer in the morning, I was greeted by my screensaver with no icons, no start menu, no tray at all, just my screensaver and mouse arrow. I restarted my computer in safe mode, where i found Avast has been disabled and I cant turn it back on, I managed to run a a scan and it found 40 infections which it deleted. I restarted my computer as normal and only had screen saver and mouse icon as before. So i restarted in safe mode again. I ran anti malware which found nothing, and avast scan again which found over 3000 infected items, which it then deleted because the chest was full.
I restarted the computer normally and now i have my screensaver, all my icons back, i have start menu and tray. I could not access the internet at all using firefox or IE8, although while trying to setup a internet connection it said i was connected and everything was working properly, so i checked through my folders and found a previously downloaded version of safari ready to install, I installed that and i was able to get onto the internet , i then installed firefox again, OK then i noticed that my Avast was still turned off and would not turn on, also while trying to access sites i would keep getting re directed also i could not connect to microsoft sites or antivirus sites.
I managed to find a link to microsoft antivirus on a review site and downloaded it. I then removed my non working Avast and installed the microsoft antivirus, everything went smoothly but now the microsoft AV wont work propperly until upto date definitions are downloaded and it is un able to connect.
I am currently running Spybot as i type, here is my hijack this log, I hoope someone can help, Thanks Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:17:44, on 02/04/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Fluffy\My Documents\Azureus Downloads\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.msn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:6522
R3 - URLSearchHook: (no name) - {bf38d9e9-d79d-45cf-996e-f08af49dbdae} - (no file)
R3 - URLSearchHook: Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\tbVuze.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,,C:\Program Files\pkbanyfr\xqsmxcoi.exe
O2 - BHO: thechatterbox.cc - {00b8e20c-5c71-4c2f-85a5-6ad541500df0} - C:\Program Files\thechatterbox.cc\prxtbthe0.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\tbVuze.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - (no file)
O3 - Toolbar: thechatterbox.cc Toolbar - {00b8e20c-5c71-4c2f-85a5-6ad541500df0} - C:\Program Files\thechatterbox.cc\prxtbthe0.dll
O3 - Toolbar: (no name) - {bf38d9e9-d79d-45cf-996e-f08af49dbdae} - (no file)
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll
O3 - Toolbar: Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\tbVuze.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [MSSE] "C:\Program Files\Microsoft Security Essentials\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-746137067-854245398-839522115-500\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Administrator')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [ZAFFRegisterTrustChecker] "C:\WINDOWS\system32\regsvr32.exe" -s "C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustChecker.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [ZAFFRegisterTrustChecker] "C:\WINDOWS\system32\regsvr32.exe" -s "C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustChecker.dll" (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Add to VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\PROGRA~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL
O9 - Extra 'Tools' menuitem: Add to &VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\PROGRA~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1239552502515
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/pub/shoc…ash/swflash.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photo…ol/MSNPUpld.cab
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O24 - Desktop Component 1: (no name) - http://www.metcheck.com/

–
End of file - 10214 bytes
Post #2
Hello mrbland and welcome to the WTT forum.

My name is Astabi and I would be glad to help you with your computer problem. Please read the following guidelines which will help to make cleaning your machine easier:
  • Please do not install/uninstall any programs unless asked to.
  • Please do not run any scans other than those requested
  • Please follow all instructions in the order posted
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • If you don't understand something, please don't hesitate to ask for clarification before proceeding
  • The fixes are specific to your problem and should only be used for this issue on this machine.
  • Please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!
Please note that I am still in training and my replies need to be checked by an expert in order for you to receive the best possible advice. This may result in a small delay between my posts but I shall try to keep this to a minimum.

I am looking through your logs now and will reply as soon as possible.

Thanks,
Astabi
Post #3
Hello mrbland,

Having multiple AntiVirus utilities installed can create conflicts as they scan each others data base and compete for processing when scanning
Pick one AntiVirus product and uninstall all others. Pick ONE of the following Zone Alarm (If it's the Antivirus Program), a-squared Free, Microsoft Security Essentials.
I also see there is an Active Desktop Installed on your computer, it is using or pointing to the website http://www.metcheck.com. Is this something you've done on purpose? Otherwise we'll remove it.

Next,

Please disable this program and leave it disabled until we are finished.

SPYBOT TEATIMER

  • Launch Spybot S&D, go to the Mode menu and make sure "Advanced Mode" is selected.
  • On the left hand side, click on Tools, then click on the Resident Icon in the list.
  • Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
  • Click on the "System Startup" icon in the List
  • Uncheck the "TeaTimer" box and "OK" any prompts.
  • If Teatimer gives you a warning that changes were made, click the "Allow Change" box when prompted.
  • Exit Spybot S&D when done.
  • (When we are done, you can re-enable Teatimer using the same steps but this time place a check next to "Resident TeaTimer" and check the "TeaTimer" box in System Startup.]

Next,

  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
    Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

Next,

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries


In your next reply please provide:
Answer to Active Desktop, is it a website you are aware of?
OTL log
GMER log


Thanks,
Astabi
Post #4
Hi Astabi, thanks for helping me.
I have uninstalled A squared. The Zone alarm product is just a free firewall.
I have been into Spybot but the resident thing was not checked so i could not uncheck it, also in start up I could not see the word TEA Timer mentioned.
The Metcheck desk thing is not something i know about, I have been on the Metcheck web site about 10 times in the past, although not in the last 6 months. It is a weather site.
Here is the first log OTL.txtOTL logfile created on: 03/04/2011 14:25:12 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Fluffy\My Documents
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,023.00 Mb Total Physical Memory | 554.00 Mb Available Physical Memory | 54.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.04 Gb Total Space | 8.65 Gb Free Space | 5.80% Space Free | Partition Type: NTFS
Drive D: | 3.68 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: TITAN | User Name: Fluffy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Documents and Settings\Fluffy\My Documents\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Safari\Safari.exe (Apple Inc.)
PRC - C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
PRC - C:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\TUProgSt.exe (TuneUp Software)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Fluffy\My Documents\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – File not found
SRV - (vsmon) – C:\WINDOWS\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
SRV - (MsMpSvc) – C:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)
SRV - (TuneUp.ProgramStatisticsSvc) – C:\WINDOWS\system32\TUProgSt.exe (TuneUp Software)
SRV - (TuneUp.Defrag) – C:\WINDOWS\system32\TuneUpDefragService.exe (TuneUp Software)
SRV - (MSCSPTISRV) – C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe (Sony Corporation)
SRV - (PACSPTISVR) – C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe (Sony Corporation)
SRV - (SPTISRV) – C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe (Sony Corporation)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\HPZipm12.exe (HP)


========== Driver Services (SafeList) ==========

DRV - (MpKsl40c5183f) – C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3F916811-D21C-4CD6-A9CB-F48466388DDB}\MpKsl40c5183f.sys (Microsoft Corporation)
DRV - (MpKsl7a1a891e) – C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3F916811-D21C-4CD6-A9CB-F48466388DDB}\MpKsl7a1a891e.sys (Microsoft Corporation)
DRV - (MpKsl40e0e926) – C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3F916811-D21C-4CD6-A9CB-F48466388DDB}\MpKsl40e0e926.sys (Microsoft Corporation)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (vsdatant) – C:\WINDOWS\system32\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASENUM) – C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (eusk2par) – C:\WINDOWS\system32\drivers\eusk2par.sys (Aladdin Knowledge Systems Ltd.)
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (SCDEmu) – C:\WINDOWS\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (PQNTDrv) – C:\WINDOWS\System32\drivers\PQNTDRV.sys (PowerQuest Corporation)
DRV - (ms_mpu401) – C:\WINDOWS\system32\drivers\msmpu401.sys (Microsoft Corporation)
DRV - (SBKUPNT) – C:\WINDOWS\system32\drivers\SBKUPNT.SYS ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.bing.com/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {bf38d9e9-d79d-45cf-996e-f08af49dbdae} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6522

========== FireFox ==========

FF - prefs.js..browser.search.defaultthis.engineName: "Elf 1.15 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2866295&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "Elf 1.15 Customized Web Search"
FF - prefs.js..browser.startup.homepage: "http://www.google.co.uk/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.5
FF - prefs.js..extensions.enabledItems: [removed]:3.3.0.19
FF - prefs.js..extensions.enabledItems: {85E85FF9-E50C-42DE-8A3D-61485FD6C8DB}:2.0


FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/01 20:38:12 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/04/01 20:38:08 | 000,000,000 | —D | M]

[2010/11/08 00:36:15 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Fluffy\Application Data\Mozilla\Extensions
[2011/04/01 20:44:58 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Fluffy\Application Data\Mozilla\Firefox\Profiles\bfknbdjt.default\extensions
[2010/12/13 00:41:51 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Fluffy\Application Data\Mozilla\Firefox\Profiles\bfknbdjt.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/01/04 22:39:50 | 000,000,000 | —D | M] (VideoGet FireFox extension) – C:\Documents and Settings\Fluffy\Application Data\Mozilla\Firefox\Profiles\bfknbdjt.default\extensions\{85E85FF9-E50C-42DE-8A3D-61485FD6C8DB}
[2011/03/27 09:02:44 | 000,000,000 | —D | M] (Adblock Plus) – C:\Documents and Settings\Fluffy\Application Data\Mozilla\Firefox\Profiles\bfknbdjt.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2011/04/01 20:44:58 | 000,000,000 | —D | M] (Conduit Engine) – C:\Documents and Settings\Fluffy\Application Data\Mozilla\Firefox\Profiles\bfknbdjt.default\extensions\[removed]
[2010/12/30 18:16:58 | 000,000,919 | —- | M] () – C:\Documents and Settings\Fluffy\Application Data\Mozilla\Firefox\Profiles\bfknbdjt.default\searchplugins\conduit.xml
[2011/04/01 20:38:11 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) –
[2011/03/18 18:53:24 | 000,142,296 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010/01/01 09:00:00 | 000,002,252 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\bing.xml

O1 HOSTS File: ([2004/08/04 13:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (thechatterbox.cc Toolbar) - {00b8e20c-5c71-4c2f-85a5-6ad541500df0} - C:\Program Files\thechatterbox.cc\prxtbthe0.dll (Conduit Ltd.)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
O2 - BHO: (no name) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - No CLSID value found.
O3 - HKLM\..\Toolbar: (thechatterbox.cc Toolbar) - {00b8e20c-5c71-4c2f-85a5-6ad541500df0} - C:\Program Files\thechatterbox.cc\prxtbthe0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {bf38d9e9-d79d-45cf-996e-f08af49dbdae} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (thechatterbox.cc Toolbar) - {00B8E20C-5C71-4C2F-85A5-6AD541500DF0} - C:\Program Files\thechatterbox.cc\prxtbthe0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Program Files\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
O4 - HKLM..\Run: [MSSE] C:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: BackupNoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Add to VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\Program Files\Nuclear Coffee\VideoGet\Plugins\VideoGet_IE.dll (Nuclear Coffee Software)
O9 - Extra 'Tools' menuitem : Add to &VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\Program Files\Nuclear Coffee\VideoGet\Plugins\VideoGet_IE.dll (Nuclear Coffee Software)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab (System Requirements Lab Class)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1239552502515 (MUWebControl Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} http://www.pcpitstop.com/mhLbl.cab (mhLabel Class)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/pub/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx1.hotmail.com/mail/w4/pr01/photo…ol/MSNPUpld.cab (Windows Live Hotmail Photo Upload Tool)
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} http://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll (PCPitstop Exam)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\cetihpz - No CLSID value found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Program Files\pkbanyfr\xqsmxcoi.exe) - C:\Program Files\pkbanyfr\xqsmxcoi.exe File not found
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O24 - Desktop Components:1 () - http://www.metcheck.com/
O24 - Desktop WallPaper: C:\Documents and Settings\Fluffy\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Fluffy\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/04/10 22:48:35 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{0837feaa-8778-11de-9873-000c766e4975}\Shell - "" = AutoRun
O33 - MountPoints2\{0837feaa-8778-11de-9873-000c766e4975}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{0837feaa-8778-11de-9873-000c766e4975}\Shell\AutoRun\command - "" = J:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (aswBoot.exe /M:b52a09696) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/04/03 14:23:24 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Fluffy\My Documents\OTL.exe
[2011/04/02 11:22:41 | 000,222,080 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MpSigStub.exe
[2011/04/01 22:18:54 | 000,000,000 | —D | C] – C:\Documents and Settings\Fluffy\Local Settings\Application Data\PCHealth
[2011/04/01 21:11:16 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Fluffy\Recent
[2011/04/01 21:09:38 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
[2011/04/01 21:09:34 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2011/04/01 20:52:09 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Security Essentials
[2011/03/31 16:38:09 | 000,000,000 | —D | C] – C:\Program Files\pkbanyfr
[2011/03/22 12:09:01 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2011/03/22 12:07:32 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2011/03/22 12:07:04 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011/03/22 11:50:21 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\QuickTime
[2011/03/22 11:49:11 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2011/03/12 10:47:35 | 000,000,000 | —D | C] – C:\Program Files\Conduit
[2011/03/12 10:47:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Fluffy\Local Settings\Application Data\Conduit
[2011/03/12 10:47:34 | 000,000,000 | —D | C] – C:\Documents and Settings\Fluffy\Local Settings\Application Data\Vuze_Remote
[2011/03/12 10:47:32 | 000,000,000 | —D | C] – C:\Program Files\Vuze_Remote
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[12 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/04/03 14:29:36 | 000,000,374 | -H– | M] () – C:\WINDOWS\tasks\MpIdleTask.job
[2011/04/03 14:21:09 | 000,004,212 | -H– | M] () – C:\WINDOWS\System32\zllictbl.dat
[2011/04/03 14:11:51 | 000,000,408 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/04/03 14:09:04 | 000,002,187 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2011/04/03 14:09:02 | 000,002,409 | —- | M] () – C:\Documents and Settings\Fluffy\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2011/04/03 14:04:40 | 000,186,097 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2011/04/03 14:04:37 | 000,000,538 | —- | M] () – C:\WINDOWS\tasks\Automatic Maintenance.job
[2011/04/03 14:04:33 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/04/03 14:04:05 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/04/03 14:04:03 | 1073,270,784 | -HS- | M] () – C:\hiberfil.sys
[2011/04/01 21:21:57 | 000,001,891 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/04/01 21:14:49 | 000,528,268 | —- | M] () – C:\Documents and Settings\Fluffy\My Documents\cc_20110401_211438.reg
[2011/04/01 21:09:38 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/04/01 20:52:11 | 000,000,820 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Microsoft Security Essentials.lnk
[2011/04/01 20:38:15 | 000,000,742 | —- | M] () – C:\Documents and Settings\Fluffy\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/04/01 20:38:15 | 000,000,724 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/04/01 20:14:55 | 000,002,577 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2011/04/01 17:11:22 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/03/30 20:25:47 | 000,153,088 | —- | M] () – C:\Documents and Settings\Fluffy\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/03/27 09:03:00 | 000,435,568 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/03/27 09:03:00 | 000,068,272 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/03/26 21:20:38 | 008,658,658 | —- | M] () – C:\Documents and Settings\Fluffy\My Documents\M4V05130.MP4
[2011/03/22 12:09:02 | 000,001,542 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/03/22 11:50:22 | 000,001,604 | —- | M] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2011/03/22 10:43:01 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/03/19 09:08:00 | 000,182,645 | —- | M] () – C:\Documents and Settings\Fluffy\My Documents\M4V08670.MP4
[2011/03/15 23:42:48 | 000,001,525 | —- | M] () – C:\Documents and Settings\Fluffy\Desktop\c-and-g-logo.gif
[2011/03/15 23:31:59 | 000,005,225 | —- | M] () – C:\Documents and Settings\Fluffy\Desktop\thumbnail.aspx
[2011/03/12 10:48:31 | 000,001,505 | —- | M] () – C:\Documents and Settings\Fluffy\Application Data\Microsoft\Internet Explorer\Quick Launch\Vuze.lnk
[2011/03/12 10:48:31 | 000,001,505 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Vuze.lnk
[2011/03/11 20:30:23 | 408,091,282 | —- | M] () – C:\Documents and Settings\Fluffy\My Documents\M4V09613.MP4
[2011/03/06 20:01:58 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Fluffy\My Documents\OTL.exe
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[12 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/04/02 11:23:25 | 000,000,374 | -H– | C] () – C:\WINDOWS\tasks\MpIdleTask.job
[2011/04/02 11:18:12 | 1073,270,784 | -HS- | C] () – C:\hiberfil.sys
[2011/04/01 21:21:14 | 000,001,891 | —- | C] () – C:\WINDOWS\imsins.BAK
[2011/04/01 21:14:43 | 000,528,268 | —- | C] () – C:\Documents and Settings\Fluffy\My Documents\cc_20110401_211438.reg
[2011/04/01 21:09:38 | 000,000,682 | —- | C] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/04/01 20:57:42 | 000,000,408 | -H– | C] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/04/01 20:52:11 | 000,000,826 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Security Essentials.lnk
[2011/04/01 20:52:11 | 000,000,820 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Microsoft Security Essentials.lnk
[2011/04/01 20:38:15 | 000,000,730 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2011/03/26 21:19:12 | 008,658,658 | —- | C] () – C:\Documents and Settings\Fluffy\My Documents\M4V05130.MP4
[2011/03/22 12:09:02 | 000,001,542 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/03/22 11:50:22 | 000,001,604 | —- | C] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2011/03/19 09:07:56 | 000,182,645 | —- | C] () – C:\Documents and Settings\Fluffy\My Documents\M4V08670.MP4
[2011/03/15 23:42:48 | 000,001,525 | —- | C] () – C:\Documents and Settings\Fluffy\Desktop\c-and-g-logo.gif
[2011/03/15 23:31:58 | 000,005,225 | —- | C] () – C:\Documents and Settings\Fluffy\Desktop\thumbnail.aspx
[2011/03/11 20:13:18 | 408,091,282 | —- | C] () – C:\Documents and Settings\Fluffy\My Documents\M4V09613.MP4
[2010/09/03 20:12:48 | 000,000,036 | —- | C] () – C:\Documents and Settings\Fluffy\Local Settings\Application Data\housecall.guid.cache
[2010/06/08 12:13:06 | 000,000,578 | —- | C] () – C:\WINDOWS\eReg.dat
[2010/05/15 11:59:47 | 000,002,528 | —- | C] () – C:\Documents and Settings\Fluffy\Application Data\$_hpcst$.hpc
[2010/05/13 19:22:46 | 000,000,000 | —- | C] () – C:\WINDOWS\DbgOut.INI
[2010/05/01 20:27:03 | 000,000,040 | —- | C] () – C:\WINDOWS\ujf635.bin
[2010/04/11 20:28:00 | 000,027,648 | —- | C] () – C:\WINDOWS\System32\AVSredirect.dll
[2010/03/17 16:29:20 | 000,056,892 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2010/01/26 15:15:13 | 000,000,000 | —- | C] () – C:\WINDOWS\KGBkeylogg.exe
[2010/01/20 15:41:50 | 000,030,048 | —- | C] () – C:\WINDOWS\UNWISE.EXE
[2009/12/23 15:14:08 | 000,014,976 | —- | C] () – C:\WINDOWS\System32\drivers\SBKUPNT.SYS
[2009/12/23 15:14:08 | 000,013,312 | —- | C] () – C:\WINDOWS\System32\DEVLOAD.EXE
[2009/12/23 15:14:04 | 000,000,543 | —- | C] () – C:\WINDOWS\SWISV3.INI
[2009/12/23 15:13:59 | 000,000,287 | —- | C] () – C:\WINDOWS\SKNIFE.INI
[2009/12/23 15:13:47 | 000,002,799 | —- | C] () – C:\WINDOWS\SKLANG.INI
[2009/10/15 13:41:12 | 000,000,031 | -H– | C] () – C:\WINDOWS\UKCpInfo.sys
[2009/08/05 18:55:56 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\PixText.dll
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | —- | C] () – C:\WINDOWS\System32\OGAEXEC.exe
[2009/06/02 10:01:04 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2009/05/16 17:07:06 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2009/05/02 11:02:29 | 000,019,791 | —- | C] () – C:\WINDOWS\HPHins02.dat
[2009/05/02 11:02:29 | 000,004,284 | —- | C] () – C:\WINDOWS\hphmdl02.dat
[2009/05/02 11:01:58 | 000,364,544 | —- | C] () – C:\WINDOWS\System32\hphped05.exe
[2009/05/02 11:01:51 | 000,006,478 | —- | C] () – C:\WINDOWS\System32\hphmon05.dat
[2009/04/11 22:48:20 | 000,153,088 | —- | C] () – C:\Documents and Settings\Fluffy\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/04/11 19:14:42 | 000,000,008 | —- | C] () – C:\WINDOWS\System32\nvModes.dat
[2009/04/11 18:55:45 | 000,795,648 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/04/11 18:55:45 | 000,130,048 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2009/04/11 18:55:44 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2009/04/11 18:55:43 | 000,067,584 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2009/04/11 11:53:08 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2009/04/11 10:10:08 | 000,000,144 | —- | C] () – C:\WINDOWS\System32\lkfl.dat
[2009/04/11 10:10:08 | 000,000,096 | —- | C] () – C:\WINDOWS\System32\pdfl.dat
[2009/04/11 10:10:08 | 000,000,080 | —- | C] () – C:\WINDOWS\System32\ibfl.dat
[2009/04/11 10:09:46 | 000,004,212 | -H– | C] () – C:\WINDOWS\System32\zllictbl.dat
[2009/04/10 22:51:27 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2009/04/10 22:45:49 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2009/04/10 22:18:45 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2009/04/10 22:17:39 | 000,269,392 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2008/05/16 14:01:00 | 001,703,936 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2008/05/16 14:01:00 | 001,630,208 | —- | C] () – C:\WINDOWS\System32\nwiz.exe
[2008/05/16 14:01:00 | 001,486,848 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2008/05/16 14:01:00 | 001,339,392 | —- | C] () – C:\WINDOWS\System32\nvdspsch.exe
[2008/05/16 14:01:00 | 001,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2008/05/16 14:01:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2008/05/16 14:01:00 | 000,442,368 | —- | C] () – C:\WINDOWS\System32\nvappbar.exe
[2008/05/16 14:01:00 | 000,425,984 | —- | C] () – C:\WINDOWS\System32\keystone.exe
[2008/05/16 14:01:00 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2004/09/17 17:37:42 | 000,061,440 | —- | C] () – C:\WINDOWS\System32\vuins32.dll
[2004/08/04 13:00:00 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2004/08/04 13:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 13:00:00 | 000,435,568 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/04 13:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 13:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 13:00:00 | 000,068,272 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/04 13:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 13:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 13:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 13:00:00 | 000,004,463 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/04 13:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2003/02/18 18:26:28 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\cmirmdrv.dll

========== LOP Check ==========

[2010/01/02 19:48:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AGeeksToy
[2011/04/01 20:15:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2009/04/11 19:42:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Azureus
[2009/04/11 20:00:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DriverScanner
[2010/01/09 13:59:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ESET
[2009/08/14 15:12:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\id Software
[2010/05/08 23:35:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Kontiki
[2009/12/09 09:39:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCPitstop
[2009/07/19 17:11:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sony
[2010/06/17 00:03:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sophos
[2010/05/23 16:25:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2011/01/30 23:26:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2009/06/17 23:24:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2011/01/30 23:14:54 | 000,000,000 | -HSD | M] – C:\Documents and Settings\All Users\Application Data\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
[2011/03/22 12:08:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/09/07 21:14:27 | 000,000,000 | -HSD | M] – C:\Documents and Settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
[2009/12/26 09:26:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/15 19:53:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2009/11/01 00:17:47 | 000,000,000 | —D | M] – C:\Documents and Settings\Fluffy\Application Data\AVSMedia
[2011/04/01 21:12:26 | 000,000,000 | —D | M] – C:\Documents and Settings\Fluffy\Application Data\Azureus
[2010/04/30 22:40:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Fluffy\Application Data\Betting Assistant
[2010/01/09 17:43:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Fluffy\Application Data\CheckPoint
[2011/01/20 08:53:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Fluffy\Application Data\GetRightToGo
[2010/04/30 22:40:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Fluffy\Application Data\Gruss Software
[2009/12/28 18:41:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Fluffy\Application Data\HandBrake
[2009/09/14 20:49:54 | 000,000,000 | —D | M] – C:\Documents and Settings\Fluffy\Application Data\id Software
[2009/04/25 17:40:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Fluffy\Application Data\ImgBurn
[2011/04/01 16:39:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Fluffy\Application Data\OpenCandy
[2009/12/30 16:58:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Fluffy\Application Data\Red Kawa
[2011/01/14 10:20:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Fluffy\Application Data\Rovio
[2009/07/19 17:11:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Fluffy\Application Data\Sony
[2010/05/16 11:52:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Fluffy\Application Data\Spectaculator
[2010/05/13 18:40:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Fluffy\Application Data\Teleca
[2010/12/21 17:07:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Fluffy\Application Data\TriStarPro Ltd
[2011/01/30 23:15:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Fluffy\Application Data\TuneUp Software
[2009/04/11 20:00:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Fluffy\Application Data\Uniblue
[2010/01/02 10:23:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Fluffy\Application Data\uTorrent
[2009/12/28 16:45:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Fluffy\Application Data\Windows Search
[2011/04/03 14:04:37 | 000,000,538 | —- | M] () – C:\WINDOWS\Tasks\Automatic Maintenance.job
[2011/04/03 14:11:51 | 000,000,408 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2011/04/03 14:29:36 | 000,000,374 | -H– | M] () – C:\WINDOWS\Tasks\MpIdleTask.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\WINDOWS\System32\smss.exe:SummaryInformation
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CD30FA91

< End of report >
Post #5
Hi Astabi.
Here is the Extras.Txt. after this I OTL Extras logfile created on: 03/04/2011 14:25:12 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Fluffy\My Documents
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,023.00 Mb Total Physical Memory | 554.00 Mb Available Physical Memory | 54.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.04 Gb Total Space | 8.65 Gb Free Space | 5.80% Space Free | Partition Type: NTFS
Drive D: | 3.68 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: TITAN | User Name: Fluffy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
http [open] – Reg Error: Key error.
https [open] – Reg Error: Key error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Vuze\Azureus.exe" = C:\Program Files\Vuze\Azureus.exe:*:Enabled:Azureus / Vuze – (Vuze Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2A697B53-0DE3-42DA-B41D-C3F804B1C538}" = iTunes
"{2AD89908-0987-4B9E-8AB4-905899E4D754}_is1" = Next Video Converter 3.56
"{2DC94AFD-A6E2-4AB4-9132-4A3F8E07B386}" = Apple Application Support
"{3F9FB449-93DB-4C47-BB5B-7334C4D1736E}" = SD Formatter
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{7C5B4583-7CBF-4289-B195-03B553959DEA}" = VoiceOver Kit
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95120000-0122-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{99052DB7-9592-4522-A558-5417BBAD48EE}" = Microsoft ActiveSync
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A4B9E399-9E88-4AC7-8C42-C209318A98EC}" = A Geeks Toy
"{ABC86EE3-425F-43B9-9A4F-4AA765B5A4FB}_is1" = AVI&WMV 1.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C73F2967-062E-48F2-A462-D335B8950183}" = Safari
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{E62A1F01-07B7-4541-A835-EE5B0BF064C2}" = Microsoft Antimalware
"{EDE875B0-6566-4E93-B955-C63AE5F4737C}" = Sophos Computer Security Scan
"{EF98A02A-1748-4762-9B7D-5ED1600520D5}" = Microsoft Security Essentials
"8461-7759-5462-8226" = Vuze
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AudibleDownloadManager" = Audible Download Manager
"CCleaner" = CCleaner
"conduitEngine" = Conduit Engine
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Free 3GP Video Converter_is1" = Free 3GP Video Converter version 3.5
"ie8" = Windows Internet Explorer 8
"ImgBurn" = ImgBurn
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Security Essentials" = Microsoft Security Essentials
"Mozilla Firefox 4.0 (x86 en-US)" = Mozilla Firefox 4.0 (x86 en-US)
"VideoGet_is1" = Nuclear Coffee - VideoGet
"VN_VUIns_Rhine_VIA" = VIA Rhine-Family Fast Ethernet Adapter
"ZoneAlarm" = ZoneAlarm

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 02/04/2011 06:37:37 | Computer Name = TITAN | Source = MSSecurityEssentials | ID = 5000
Description =

Error - 02/04/2011 07:02:43 | Computer Name = TITAN | Source = MSSecurityEssentials | ID = 5000
Description =

Error - 02/04/2011 07:49:34 | Computer Name = TITAN | Source = MSSecurityEssentials | ID = 5000
Description =

Error - 03/04/2011 04:13:27 | Computer Name = TITAN | Source = Application Hang | ID = 1002
Description = Hanging application WINWORD.EXE, version 12.0.6545.5000, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 03/04/2011 04:13:31 | Computer Name = TITAN | Source = Application Hang | ID = 1002
Description = Hanging application WINWORD.EXE, version 12.0.6545.5000, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 03/04/2011 04:14:00 | Computer Name = TITAN | Source = Application Hang | ID = 1002
Description = Hanging application WINWORD.EXE, version 12.0.6545.5000, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 03/04/2011 04:14:01 | Computer Name = TITAN | Source = Application Hang | ID = 1002
Description = Hanging application WINWORD.EXE, version 12.0.6545.5000, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 03/04/2011 04:40:47 | Computer Name = TITAN | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 80072efd, P2 endsearch, P3 search, P4 2.1.6805.0,
P5 mpsigdwn.dll, P6 2.1.6805.0, P7 microsoft antimalware (bcf43643-a118-4432-aede-d861fcbcfcde),
P8 NIL, P9 NIL, P10 NIL.

Error - 03/04/2011 09:06:10 | Computer Name = TITAN | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 80072efd, P2 endsearch, P3 search, P4 2.1.6805.0,
P5 mpsigdwn.dll, P6 2.1.6805.0, P7 microsoft antimalware (bcf43643-a118-4432-aede-d861fcbcfcde),
P8 NIL, P9 NIL, P10 NIL.

Error - 03/04/2011 09:08:24 | Computer Name = TITAN | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 80072efd, P2 endsearch, P3 search, P4 2.1.6805.0,
P5 mpsigdwn.dll, P6 2.1.6805.0, P7 microsoft antimalware (bcf43643-a118-4432-aede-d861fcbcfcde),
P8 NIL, P9 NIL, P10 NIL.

[ DriverScanne Events ]
Error - 02/04/2011 06:37:37 | Computer Name = TITAN | Source = MSSecurityEssentials | ID = 5000
Description =

Error - 02/04/2011 07:02:43 | Computer Name = TITAN | Source = MSSecurityEssentials | ID = 5000
Description =

Error - 02/04/2011 07:49:34 | Computer Name = TITAN | Source = MSSecurityEssentials | ID = 5000
Description =

Error - 03/04/2011 04:13:27 | Computer Name = TITAN | Source = Application Hang | ID = 1002
Description =

Error - 03/04/2011 04:13:31 | Computer Name = TITAN | Source = Application Hang | ID = 1002
Description =

Error - 03/04/2011 04:14:00 | Computer Name = TITAN | Source = Application Hang | ID = 1002
Description =

Error - 03/04/2011 04:14:01 | Computer Name = TITAN | Source = Application Hang | ID = 1002
Description =

Error - 03/04/2011 04:40:47 | Computer Name = TITAN | Source = MPSampleSubmission | ID = 5000
Description =

Error - 03/04/2011 09:06:10 | Computer Name = TITAN | Source = MPSampleSubmission | ID = 5000
Description =

Error - 03/04/2011 09:08:24 | Computer Name = TITAN | Source = MPSampleSubmission | ID = 5000
Description =

[ DriverScanne Events ]
Error - 02/04/2011 06:37:37 | Computer Name = TITAN | Source = MSSecurityEssentials | ID = 5000
Description =

Error - 02/04/2011 07:02:43 | Computer Name = TITAN | Source = MSSecurityEssentials | ID = 5000
Description =

Error - 02/04/2011 07:49:34 | Computer Name = TITAN | Source = MSSecurityEssentials | ID = 5000
Description =

Error - 03/04/2011 04:13:27 | Computer Name = TITAN | Source = Application Hang | ID = 1002
Description =

Error - 03/04/2011 04:13:31 | Computer Name = TITAN | Source = Application Hang | ID = 1002
Description =

Error - 03/04/2011 04:14:00 | Computer Name = TITAN | Source = Application Hang | ID = 1002
Description =

Error - 03/04/2011 04:14:01 | Computer Name = TITAN | Source = Application Hang | ID = 1002
Description =

Error - 03/04/2011 04:40:47 | Computer Name = TITAN | Source = MPSampleSubmission | ID = 5000
Description =

Error - 03/04/2011 09:06:10 | Computer Name = TITAN | Source = MPSampleSubmission | ID = 5000
Description =

Error - 03/04/2011 09:08:24 | Computer Name = TITAN | Source = MPSampleSubmission | ID = 5000
Description =

[ OSession Events ]
Error - 03/01/2010 08:41:04 | Computer Name = TITAN | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 2, Application Name: Microsoft Office Access, Application Version:
12.0.6423.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 178
seconds with 120 seconds of active time. This session ended with a crash.

Error - 20/01/2010 17:31:20 | Computer Name = TITAN | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 685
seconds with 600 seconds of active time. This session ended with a crash.

Error - 02/02/2010 19:25:02 | Computer Name = TITAN | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 2, Application Name: Microsoft Office Access, Application Version:
12.0.6423.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1041
seconds with 1020 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 02/04/2011 06:57:26 | Computer Name = TITAN | Source = Microsoft Antimalware | ID = 1008
Description = %%861 has encountered an error when taking action on spyware or other
potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=370…atid=2147640016

User:
NT AUTHORITY\SYSTEM Name: Virus:Win32/Ramnit.gen!B ID: 2147640016 Severity: Severe

Category:
Virus Path: Action: %%810 Error Code: 0x8007007f Error description: The specified
procedure could not be found. Status: To finish removing spyware and other potentially
unwanted software, you need to run a full scan. For information about scanning
options, see Help and Support. To finish removing spyware and other potentially
unwanted software, restart the computer. Signature Version: AV: 1.101.691.0, AS:
1.101.691.0 Engine Version: 1.1.6702.0

Error - 02/04/2011 07:02:37 | Computer Name = TITAN | Source = Microsoft Antimalware | ID = 1008
Description = %%861 has encountered an error when taking action on spyware or other
potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=370…atid=2147640016

User:
TITAN\Fluffy Name: Virus:Win32/Ramnit.gen!B ID: 2147640016 Severity: Severe Category:
Virus Path: Action: %%810 Error Code: 0x8007007f Error description: The specified
procedure could not be found. Status: To finish removing spyware and other potentially
unwanted software, you need to run a full scan. For information about scanning
options, see Help and Support. To finish removing spyware and other potentially
unwanted software, restart the computer. Signature Version: AV: 1.101.691.0, AS:
1.101.691.0 Engine Version: 1.1.6702.0

Error - 02/04/2011 07:02:37 | Computer Name = TITAN | Source = Microsoft Antimalware | ID = 1008
Description = %%861 has encountered an error when taking action on spyware or other
potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=370…atid=2147640016

User:
TITAN\Fluffy Name: Virus:Win32/Ramnit.gen!B ID: 2147640016 Severity: Severe Category:
Virus Path: Action: %%810 Error Code: 0x8007007f Error description: The specified
procedure could not be found. Status: To finish removing spyware and other potentially
unwanted software, you need to run a full scan. For information about scanning
options, see Help and Support. To finish removing spyware and other potentially
unwanted software, restart the computer. Signature Version: AV: 1.101.691.0, AS:
1.101.691.0 Engine Version: 1.1.6702.0

Error - 02/04/2011 07:02:37 | Computer Name = TITAN | Source = Microsoft Antimalware | ID = 1008
Description = %%861 has encountered an error when taking action on spyware or other
potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=370…atid=2147640016

User:
TITAN\Fluffy Name: Virus:Win32/Ramnit.gen!B ID: 2147640016 Severity: Severe Category:
Virus Path: Action: %%810 Error Code: 0x8007007f Error description: The specified
procedure could not be found. Status: To finish removing spyware and other potentially
unwanted software, you need to run a full scan. For information about scanning
options, see Help and Support. To finish removing spyware and other potentially
unwanted software, restart the computer. Signature Version: AV: 1.101.691.0, AS:
1.101.691.0 Engine Version: 1.1.6702.0

Error - 02/04/2011 07:41:59 | Computer Name = TITAN | Source = Microsoft Antimalware | ID = 1008
Description = %%861 has encountered an error when taking action on spyware or other
potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=370…atid=2147640016

User:
TITAN\Fluffy Name: Virus:Win32/Ramnit.gen!B ID: 2147640016 Severity: Severe Category:
Virus Path: Action: %%810 Error Code: 0x8007007f Error description: The specified
procedure could not be found. Status: To finish removing spyware and other potentially
unwanted software, you need to run a full scan. For information about scanning
options, see Help and Support. To finish removing spyware and other potentially
unwanted software, restart the computer. Signature Version: AV: 1.101.691.0, AS:
1.101.691.0 Engine Version: 1.1.6702.0

Error - 02/04/2011 07:41:59 | Computer Name = TITAN | Source = Microsoft Antimalware | ID = 1008
Description = %%861 has encountered an error when taking action on spyware or other
potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=370…atid=2147640016

User:
TITAN\Fluffy Name: Virus:Win32/Ramnit.gen!B ID: 2147640016 Severity: Severe Category:
Virus Path: Action: %%810 Error Code: 0x8007007f Error description: The specified
procedure could not be found. Status: To finish removing spyware and other potentially
unwanted software, you need to run a full scan. For information about scanning
options, see Help and Support. To finish removing spyware and other potentially
unwanted software, restart the computer. Signature Version: AV: 1.101.691.0, AS:
1.101.691.0 Engine Version: 1.1.6702.0

Error - 03/04/2011 03:41:53 | Computer Name = TITAN | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x8007f0da: Security Update for Windows XP (KB2393802).

Error - 03/04/2011 03:42:06 | Computer Name = TITAN | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x8007f0da: Cumulative Security Update for Internet Explorer 8 for Windows
XP (KB2482017).

Error - 03/04/2011 03:43:33 | Computer Name = TITAN | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x8007f0da: Update for Windows XP (KB2524375).

Error - 03/04/2011 09:06:28 | Computer Name = TITAN | Source = Service Control Manager | ID = 7031
Description = The a-squared Free Service service terminated unexpectedly. It has
done this 1 time(s). The following corrective action will be taken in 0 milliseconds:
Restart the service.

[ TuneUp Events ]
Error - 08/02/2011 03:10:22 | Computer Name = TITAN | Source = TuneUp.UtilitiesSvc | ID = 300
Description =

Error - 08/02/2011 13:44:10 | Computer Name = TITAN | Source = TuneUp.UtilitiesSvc | ID = 300
Description =

Error - 09/02/2011 03:42:16 | Computer Name = TITAN | Source = TuneUp.UtilitiesSvc | ID = 300
Description =

Error - 09/02/2011 13:14:33 | Computer Name = TITAN | Source = TuneUp.UtilitiesSvc | ID = 300
Description =

Error - 09/02/2011 17:30:20 | Computer Name = TITAN | Source = TuneUp.UtilitiesSvc | ID = 300
Description =

Error - 10/02/2011 03:06:06 | Computer Name = TITAN | Source = TuneUp.UtilitiesSvc | ID = 300
Description =

Error - 10/02/2011 13:33:56 | Computer Name = TITAN | Source = TuneUp.UtilitiesSvc | ID = 300
Description =

Error - 11/02/2011 03:08:26 | Computer Name = TITAN | Source = TuneUp.UtilitiesSvc | ID = 300
Description =

Error - 11/02/2011 14:54:40 | Computer Name = TITAN | Source = TuneUp.UtilitiesSvc | ID = 300
Description =

Error - 12/02/2011 04:03:56 | Computer Name = TITAN | Source = TuneUp.UtilitiesSvc | ID = 300
Description =


< End of report >
carry on with your rootkit instructions thanks.
Post #7
Download Combofix from any of the links below but rename it to fluffy.exe before saving it to your desktop.

Link 1
Link 2


==================================

Double click on the renamed ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt so we can continue cleaning the system.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI