infected

I have been infected but can never get a complete scan .I have kasperskey but full scan never finishes so gave up ,then I used eset online scanner it found something and deleted it but never got passed 23% .yesterday it found some explot java aganet stuff .I know my machine is infected and would appreciate help cleaning it up Thanks .

here are the results of hijack this scan

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:25:15, on 11/04/2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ThreatFire\TFService.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wbsecsvc.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\slrundll.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\My Documents\Downloads\HiJackThis.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.aol.co.uk/web?isinit=true&query=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=;ftp=;https=;
O1 - Hosts: ÿþ127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Broadband Toolbar 5.0\aoltb.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AOL Broadband Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Broadband Toolbar 5.0\aoltb.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avp] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Startup: PeerGuardian.lnk = C:\Program Files\PeerGuardian2\pg2.exe
O4 - Startup: µTorrent.lnk = C:\Program Files\uTorrent\uTorrent.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol broadband toolbar 5.0\resources\en-GB\local\search.html
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: InterCasino GBP - {03588886-5C50-4645-BD5D-F105F84417DE} - http://www.intercasino.co.uk/?utm_source=download-c (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: InterCasino GBP - {03588886-5C50-4645-BD5D-F105F84417DE} - http://www.intercasino.co.uk/?utm_source=download-c (file missing) (HKCU)
O16 - DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} (Egg Money Manager Digital Safe) - https://moneymanager.egg.com/Pinsafe/accounttracking.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1247340977328
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photo…ol/MSNPUpld.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe (file missing)
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: wbsecsvc - Integrated System Solution Corp. - C:\WINDOWS\system32\wbsecsvc.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 13064 bytes

Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post





Please download TDSSKiller.zip

• Extract it to your desktop
• Double click TDSSKiller.exe
• Press Start Scan
  
  • Only if Malicious objects are found then ensure Cure is selected
    If suspicious objects are found select skip
  • Then click Continue > Reboot now
• Copy and paste the log in your next reply
  
  • A copy of the log will be saved automatically to the root of the drive (typically C:\)

• Download OTL to your desktop.
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output.
• Check the boxes beside LOP Check and Purity Check.
• Under Custom Scan paste this in
  
  netsvcs
  drivers32
  %SYSTEMDRIVE%\*.*
  %systemroot%\Fonts\*.com
  %systemroot%\Fonts\*.dll
  %systemroot%\Fonts\*.ini
  %systemroot%\Fonts\*.ini2
  %systemroot%\Fonts\*.exe
  %systemroot%\system32\spool\prtprocs\w32x86\*.*
  %systemroot%\REPAIR\*.bak1
  %systemroot%\REPAIR\*.ini
  %systemroot%\system32\*.jpg
  %systemroot%\*.jpg
  %systemroot%\*.png
  %systemroot%\*.scr
  %systemroot%\*._sy
  %APPDATA%\Adobe\Update\*.*
  %ALLUSERSPROFILE%\Favorites\*.*
  %APPDATA%\Microsoft\*.*
  %PROGRAMFILES%\*.*
  %APPDATA%\Update\*.*
  %systemroot%\*. /mp /s
  CREATERESTOREPOINT
  %systemroot%\System32\config\*.sav
  %PROGRAMFILES%\bak. /s
  %systemroot%\system32\bak. /s
  %ALLUSERSPROFILE%\Start Menu\*.lnk /x
  %systemroot%\system32\config\systemprofile\*.dat /x
  %systemroot%\*.config
  %systemroot%\system32\*.db
  %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
  %USERPROFILE%\Desktop\*.exe
  %PROGRAMFILES%\Common Files\*.*
  %systemroot%\*.src
  %systemroot%\install\*.*
  %systemroot%\system32\DLL\*.*
  %systemroot%\system32\HelpFiles\*.*
  %systemroot%\system32\rundll\*.*
  %systemroot%\winn32\*.*
  %systemroot%\Java\*.*
  %systemroot%\system32\test\*.*
  %systemroot%\system32\Rundll32\*.*
  %systemroot%\AppPatch\Custom\*.*
  %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
  %PROGRAMFILES%\PC-Doctor\Downloads\*.*
  %PROGRAMFILES%\Internet Explorer\*.tmp
  %PROGRAMFILES%\Internet Explorer\*.dat
  %USERPROFILE%\My Documents\*.exe
  %USERPROFILE%\*.exe
  %systemroot%\ADDINS\*.*
  %systemroot%\assembly\*.bak2
  %systemroot%\Config\*.*
  %systemroot%\REPAIR\*.bak2
  %systemroot%\SECURITY\Database\*.sdb /x
  %systemroot%\SYSTEM\*.bak2
  %systemroot%\Web\*.bak2
  %systemroot%\Driver Cache\*.*
  %PROGRAMFILES%\Mozilla Firefox\0*.exe
  %ProgramFiles%\Microsoft Common\*.*
  %ProgramFiles%\TinyProxy.
  %USERPROFILE%\Favorites\*.url /x
  %systemroot%\system32\*.bk
  %systemroot%\*.te
  %systemroot%\system32\system32\*.*
  %ALLUSERSPROFILE%\*.dat /x
  %systemroot%\system32\drivers\*.rmv
  dir /b "%systemroot%\system32\*.exe" | find /i " " /c
  dir /b "%systemroot%\*.exe" | find /i " " /c
  %PROGRAMFILES%\Microsoft\*.*
  %systemroot%\System32\Wbem\proquota.exe
  %PROGRAMFILES%\Mozilla Firefox\*.dat
  %USERPROFILE%\Cookies\*.txt /x
  %SystemRoot%\system32\fonts\*.*
  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
  
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
• You may need two posts to fit them both in.

Thanks for getting back to me

Please download TDSSKiller.zip
Extract it to your desktop
Double click TDSSKiller.exe
Press Start Scan
Only if Malicious objects are found then ensure Cure is selected
If suspicious objects are found select skip
Then click Continue > Reboot now
Copy and paste the log in your next reply
A copy of the log will be saved automatically to the root of the drive (typically C:\)

scan never found anything so no log file from TDS

here are the logs from otl

OTL logfile created on: 12/04/2011 16:49:08 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 66.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 88.00% Paging File free
Paging file location(s): C:\pagefile.sys 2302 3647 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.05 Gb Total Space | 6.61 Gb Free Space | 4.44% Space Free | Partition Type: NTFS

Computer Name: USER-50C5ECAA5B | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\Desktop\OTL (2).exe (OldTimer Tools)
PRC - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
PRC - C:\Program Files\ThreatFire\TFService.exe (PC Tools)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software)
PRC - C:\Program Files\PeerGuardian2\pg2.exe (Phoenix Labs)
PRC - C:\WINDOWS\system32\wbsecsvc.exe (Integrated System Solution Corp.)
PRC - C:\WINDOWS\system32\slserv.exe (Smart Link)
PRC - C:\WINDOWS\wanmpsvc.exe (America Online, Inc.)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Administrator\Desktop\OTL (2).exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\ThreatFire\TFWAH.dll (PC Tools)


========== Win32 Services (SafeList) ==========

SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – File not found
SRV - (NMIndexingService) – File not found
SRV - (HidServ) – File not found
SRV - (AVP) – C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
SRV - (ThreatFire) – C:\Program Files\ThreatFire\TFService.exe (PC Tools)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (StarWindServiceAE) – C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software)
SRV - (AOL ACS) – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)
SRV - (wbsecsvc) – C:\WINDOWS\System32\wbsecsvc.exe (Integrated System Solution Corp.)
SRV - (SLService) – C:\WINDOWS\System32\slserv.exe (Smart Link)
SRV - (WANMiniportService) WAN Miniport (ATW) – C:\WINDOWS\wanmpsvc.exe (America Online, Inc.)


========== Driver Services (SafeList) ==========

DRV - (sptd) – C:\WINDOWS\System32\Drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (Avgfwfd) – C:\WINDOWS\system32\drivers\avgfwdx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgfwdx) – C:\WINDOWS\system32\drivers\avgfwdx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Tcpip6) – C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (TfSysMon) – C:\WINDOWS\system32\drivers\TfSysMon.sys (PC Tools)
DRV - (TfNetMon) – C:\WINDOWS\system32\drivers\TfNetMon.sys (PC Tools)
DRV - (TfFsMon) – C:\WINDOWS\system32\drivers\TfFsMon.sys (PC Tools)
DRV - (SRS_SSCFilter) SRS Labs Audio Sandbox (WDM) – C:\WINDOWS\system32\drivers\SRS_SSCFilter_i386.sys ()
DRV - (KLIF) – C:\WINDOWS\system32\drivers\klif.sys (Kaspersky Lab)
DRV - (klbg) – C:\WINDOWS\system32\drivers\klbg.sys (Kaspersky Lab)
DRV - (klmouflt) – C:\WINDOWS\system32\drivers\klmouflt.sys (Kaspersky Lab)
DRV - (klim5) – C:\WINDOWS\system32\drivers\klim5.sys (Kaspersky Lab)
DRV - (kl1) – C:\WINDOWS\system32\drivers\kl1.sys (Kaspersky Lab)
DRV - (fssfltr) – C:\WINDOWS\system32\drivers\fssfltr_tdi.sys (Microsoft Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (SiSkp) – C:\WINDOWS\system32\drivers\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (SiS315) – C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (pgfilter) – C:\Program Files\PeerGuardian2\pgfilter.sys ()
DRV - (SiSGbeXP) – C:\WINDOWS\system32\drivers\SiSGbeXP.sys (Silicon Integrated Systems Corp.)
DRV - (W35UND) – C:\WINDOWS\system32\drivers\W35UND.SYS (Integrated System Solution Corp.)
DRV - (wbsecdrv) – C:\WINDOWS\system32\drivers\wbsecdrv.sys (Winbond)
DRV - (MTsensor) – C:\WINDOWS\system32\drivers\ASACPI.sys ()
DRV - (nm) – C:\WINDOWS\system32\drivers\nmnt.sys (Microsoft Corporation)
DRV - (SlNtHal) – C:\WINDOWS\system32\drivers\slnthal.sys (Smart Link)
DRV - (SlWdmSup) – C:\WINDOWS\system32\drivers\slwdmsup.sys (Smart Link)
DRV - (Slntamr) – C:\WINDOWS\system32\drivers\slntamr.sys (Smart Link)
DRV - (NtMtlFax) – C:\WINDOWS\system32\drivers\ntmtlfax.sys (Smart Link)
DRV - (Mtlmnt5) – C:\WINDOWS\system32\drivers\mtlmnt5.sys (Smart Link)
DRV - (RecAgent) – C:\WINDOWS\system32\DRIVERS\RecAgent.sys (Smart Link)
DRV - (Mtlstrm) – C:\WINDOWS\system32\drivers\mtlstrm.sys (Smart Link)
DRV - (alcan5wn) SpeedTouch USB ADSL PPP Networking Driver (NDISWAN) – C:\WINDOWS\system32\drivers\alcan5wn.sys (THOMSON)
DRV - (alcaudsl) – C:\WINDOWS\system32\drivers\alcaudsl.sys (THOMSON)
DRV - (wanusb) – C:\WINDOWS\system32\drivers\gwausb.sys (GlobespanVirata Inc.)
DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=;ftp=;https=;

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=937811"
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.co.uk/"
FF - prefs.js..extensions.enabledItems: {B042753D-F57E-4e8e-A01B-7379A6D4CEFB}:1.17
FF - prefs.js..extensions.enabledItems: [removed]:2.4.1
FF - prefs.js..extensions.enabledItems: {E0B8C461-F8FB-49b4-8373-FE32E9252800}:4.0.0.106602
FF - prefs.js..extensions.enabledItems: [removed]:1.2.2
FF - prefs.js..extensions.enabledItems: [removed]:4.1.8
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:9.0.0.736
FF - prefs.js..extensions.enabledItems: [removed]:2.1.1
FF - prefs.js..extensions.enabledItems: [removed]:2.0.0.20091223
FF - prefs.js..extensions.enabledItems: {64161300-e22b-11db-8314-0800200c9a66}:0.9.5.8
FF - prefs.js..extensions.enabledItems: {dc572301-7619-498c-a57d-39143191b318}:0.3.8.2
FF - prefs.js..extensions.enabledItems: [removed]:1.4
FF - prefs.js..extensions.enabledItems: [removed]:3.9.2
FF - prefs.js..extensions.enabledItems: [removed]:1.3.2
FF - prefs.js..extensions.enabledItems: [removed]:1.19.1
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..keyword.URL: "http://uk.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=937811&p="
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.type: 0


FF - HKLM\software\mozilla\Firefox\extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG8\Firefox
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/02/21 14:13:19 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/05 17:39:30 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\THBExt [2011/04/10 14:41:58 | 000,000,000 | —D | M]

[2009/06/27 02:55:30 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2009/06/27 02:55:30 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions\[removed]
[2011/04/06 17:38:11 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions
[2010/12/30 23:09:45 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/02/12 16:53:57 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/12/30 23:10:47 | 000,000,000 | —D | M] (Speed Dial) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}
[2009/12/29 21:25:49 | 000,000,000 | —D | M] (BitComet Video Downloader) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}
[2009/10/13 16:30:48 | 000,000,000 | —D | M] ("Tab Mix Plus") – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{dc572301-7619-498c-a57d-39143191b318}
[2010/12/30 23:10:11 | 000,000,000 | —D | M] (Evernote Web Clipper) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}
[2010/12/30 23:09:46 | 000,000,000 | —D | M] (CheckPlaces) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/12/30 23:19:11 | 000,000,000 | —D | M] (British English Dictionary) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/12/30 22:25:05 | 000,000,000 | —D | M] (Fast Youtube Downloader) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/12/30 23:12:27 | 000,000,000 | —D | M] ("Xmarks") – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/12/30 22:35:14 | 000,000,000 | —D | M] (Spell Checker) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/12/30 23:09:46 | 000,000,000 | —D | M] (Read It Later) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/12/30 22:25:10 | 000,000,000 | —D | M] (Reframe It) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/12/30 23:11:15 | 000,000,000 | —D | M] (FastestFox) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2011/04/06 16:34:42 | 000,000,000 | —D | M] (Real Hide IP) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/12/30 23:09:47 | 000,000,000 | —D | M] (The Search Sidebar) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/01/17 00:49:40 | 000,002,255 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\searchplugins\askcom.xml
[2011/04/06 16:56:54 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/07/01 20:49:55 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2011/03/13 16:07:57 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2010/01/12 21:33:20 | 000,000,000 | —D | M] (Kaspersky URL Advisor) – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2010/07/01 20:48:44 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2009/07/17 09:40:12 | 000,704,512 | —- | M] (BitComet) – C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2011/02/02 22:40:24 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/12/03 18:47:02 | 000,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/12/03 18:47:02 | 000,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/12/03 18:47:02 | 000,000,769 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/12/03 18:47:02 | 000,001,135 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2010/07/04 13:34:40 | 000,000,098 | —- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (AOL Toolbar Launcher) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Broadband Toolbar 5.0\aoltb.dll (AOL LLC)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O3 - HKLM\..\Toolbar: (AOL Broadband Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Broadband Toolbar 5.0\aoltb.dll (AOL LLC)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (AOL Broadband Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Broadband Toolbar 5.0\aoltb.dll (AOL LLC)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avp] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\PeerGuardian.lnk = C:\Program Files\PeerGuardian2\pg2.exe (Phoenix Labs)
O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\µTorrent.lnk = C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: RestrictRun = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: RestrictRun = 0
O8 - Extra context menu item: &AOL Toolbar Search - c:\Program Files\AOL\AOL Broadband Toolbar 5.0\resources\en-GB\local\search.html ()
O8 - Extra context menu item: &ieSpell Options - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Check &Spelling - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Lookup on Merriam Webster - C:\Program Files\ieSpell\Merriam Webster.HTM ()
O8 - Extra context menu item: Lookup on Wikipedia - C:\Program Files\ieSpell\wikipedia.HTM ()
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra Button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O9 - Extra Button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} https://moneymanager.egg.com/Pinsafe/accounttracking.cab (Egg Money Manager Digital Safe)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1247340977328 (WUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx1.hotmail.com/mail/w4/pr01/photo…ol/MSNPUpld.cab (Windows Live Hotmail Photo Upload Tool)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Reg Error: Value error. File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab)
O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/13 01:23:05 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.ac3acm - C:\WINDOWS\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.ac3filter - C:\WINDOWS\System32\ac3filter.acm ()
Drivers32: msacm.divxa32 - C:\WINDOWS\System32\msaud32_divx.acm (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\WINDOWS\System32\lameACM.acm (http://www.mp3dev.org/)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.tscc - C:\PROGRA~1\MpcStar\Codecs\tscc\tsccvid.dll File not found
Drivers32: vidc.vp60 - C:\WINDOWS\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.vp61 - C:\WINDOWS\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.vp62 - C:\WINDOWS\System32\vp6vfw.dll (On2.com)
Drivers32: VIDC.XVID - C:\WINDOWS\System32\xvidvfw.dll ()
Drivers32: wave - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (87552328508375040)

========== Files/Folders - Created Within 30 Days ==========

[2011/04/12 16:43:17 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL (2).exe
[2011/04/12 16:32:58 | 001,377,112 | —- | C] (Kaspersky Lab ZAO) – C:\Documents and Settings\Administrator\Desktop\TDSSKiller.exe
[2011/04/11 17:31:14 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/04/11 17:20:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\QuickScan
[2011/04/06 18:33:09 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Softplicity
[2011/04/06 18:31:59 | 000,000,000 | —D | C] – C:\Program Files\TotalCSVConverter
[2011/04/06 18:31:59 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Total CSV Converter
[2011/04/06 16:13:20 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\RealHideIP
[2011/04/06 16:13:20 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\RealHideIP
[2011/04/06 16:10:56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Real Hide IP
[2011/04/06 16:09:46 | 000,000,000 | —D | C] – C:\Program Files\RealHideIP
[2011/04/05 21:49:26 | 000,000,000 | —D | C] – C:\Program Files\Windows Live SkyDrive
[2011/04/05 21:38:39 | 001,146,696 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\Administrator\Desktop\wlsetup-custom.exe
[2011/04/02 16:30:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\PeerGuardian 2
[2011/04/02 16:30:16 | 000,000,000 | —D | C] – C:\Program Files\PeerGuardian2
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/04/12 16:58:25 | 000,000,438 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{FFFA57F7-E474-4C3A-9B66-7535F0F662CF}.job
[2011/04/12 16:56:10 | 000,001,008 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-789336058-1326574676-839522115-500UA.job
[2011/04/12 16:43:53 | 000,160,768 | —- | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/12 16:43:50 | 000,000,049 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2011/04/12 16:42:49 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL (2).exe
[2011/04/12 16:31:56 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/04/12 16:29:23 | 000,000,294 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-789336058-1326574676-839522115-500.job
[2011/04/12 16:29:17 | 000,012,598 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/04/12 16:29:15 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/04/11 18:25:15 | 000,013,066 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\hijackthis11.4.11
[2011/04/10 01:56:15 | 000,000,956 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-789336058-1326574676-839522115-500Core.job
[2011/04/06 18:45:28 | 000,011,566 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\red.jpg
[2011/04/06 18:32:02 | 000,000,702 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\CSVConverter.lnk
[2011/04/06 16:10:57 | 000,000,713 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Real Hide IP.lnk
[2011/04/05 21:38:42 | 001,146,696 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Administrator\Desktop\wlsetup-custom.exe
[2011/04/04 17:00:10 | 000,115,267 | —- | M] () – C:\WINDOWS\System32\drivers\klin.dat
[2011/04/04 17:00:10 | 000,097,859 | —- | M] () – C:\WINDOWS\System32\drivers\klick.dat
[2011/04/02 16:30:21 | 000,000,631 | —- | M] () – C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\PeerGuardian.lnk
[2011/03/31 19:53:00 | 000,134,496 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\prick-award-demint.jpg
[2011/03/29 22:02:01 | 000,000,791 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/03/27 10:31:11 | 000,444,690 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/03/27 10:31:11 | 000,072,456 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/04/11 18:25:15 | 000,013,066 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\hijackthis11.4.11
[2011/04/06 18:45:38 | 000,011,566 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\red.jpg
[2011/04/06 18:32:02 | 000,000,702 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\CSVConverter.lnk
[2011/04/06 16:10:57 | 000,000,713 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Real Hide IP.lnk
[2011/04/02 16:30:21 | 000,000,631 | —- | C] () – C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\PeerGuardian.lnk
[2011/03/31 19:53:20 | 000,134,496 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\prick-award-demint.jpg
[2011/03/29 22:02:01 | 000,000,791 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/02/21 15:03:50 | 000,016,922 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2011/02/07 19:00:08 | 001,529,856 | —- | C] () – C:\WINDOWS\System32\ff_samplerate.dll
[2011/02/07 19:00:08 | 000,925,667 | —- | C] () – C:\WINDOWS\System32\ffmpegmt.dll
[2011/02/07 19:00:08 | 000,721,798 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2011/02/07 19:00:08 | 000,336,384 | —- | C] () – C:\WINDOWS\System32\ff_libfaad2.dll
[2011/02/07 19:00:08 | 000,324,096 | —- | C] () – C:\WINDOWS\System32\TomsMoComp_ff.dll
[2011/02/07 19:00:08 | 000,216,576 | —- | C] () – C:\WINDOWS\System32\ff_libdts.dll
[2011/02/07 19:00:08 | 000,151,552 | —- | C] () – C:\WINDOWS\System32\ff_libmad.dll
[2011/02/07 19:00:08 | 000,145,408 | —- | C] () – C:\WINDOWS\System32\libmpeg2_ff.dll
[2011/02/07 19:00:08 | 000,140,800 | —- | C] () – C:\WINDOWS\System32\ff_unrar.dll
[2011/02/07 19:00:08 | 000,121,856 | —- | C] () – C:\WINDOWS\System32\ff_liba52.dll
[2011/02/07 19:00:08 | 000,100,864 | —- | C] () – C:\WINDOWS\System32\ff_wmv9.dll
[2011/02/07 19:00:08 | 000,065,024 | —- | C] () – C:\WINDOWS\System32\FLT_ffdshow.dll
[2011/02/07 18:45:52 | 000,080,896 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2011/02/07 18:39:02 | 004,166,551 | —- | C] () – C:\WINDOWS\System32\ffmpeg.dll
[2011/01/31 19:01:20 | 000,000,036 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\housecall.guid.cache
[2011/01/30 19:47:39 | 000,000,049 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2011/01/15 01:04:40 | 000,123,392 | —- | C] () – C:\WINDOWS\System32\UnCasino5.exe
[2010/08/14 09:45:18 | 000,249,856 | —- | C] () – C:\WINDOWS\System32\dxr.dll
[2010/08/14 09:45:10 | 000,358,400 | —- | C] () – C:\WINDOWS\System32\gdsmux.exe
[2010/08/14 09:43:34 | 000,141,824 | —- | C] () – C:\WINDOWS\System32\mp4.dll
[2010/08/14 09:43:22 | 000,123,392 | —- | C] () – C:\WINDOWS\System32\ogm.dll
[2010/08/14 09:42:54 | 000,113,152 | —- | C] () – C:\WINDOWS\System32\dsmux.exe
[2010/08/14 09:42:48 | 000,154,112 | —- | C] () – C:\WINDOWS\System32\ts.dll
[2010/08/14 09:42:10 | 000,097,792 | —- | C] () – C:\WINDOWS\System32\avs.dll
[2010/08/14 09:42:06 | 000,137,728 | —- | C] () – C:\WINDOWS\System32\mkv2vfr.exe
[2010/08/14 09:41:54 | 000,093,184 | —- | C] () – C:\WINDOWS\System32\avss.dll
[2010/07/03 12:50:28 | 000,268,912 | R— | C] () – C:\WINDOWS\System32\drivers\SRS_SSCFilter_i386.sys
[2010/06/27 21:40:21 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/06/27 21:40:21 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/06/20 09:57:48 | 000,137,724 | —- | C] () – C:\WINDOWS\hpoins44.dat
[2010/06/20 09:57:48 | 000,000,512 | —- | C] () – C:\WINDOWS\hpomdl44.dat
[2010/05/24 20:33:00 | 004,670,829 | —- | C] () – C:\WINDOWS\System32\libavcodec.dll
[2010/05/24 20:33:00 | 000,877,385 | —- | C] () – C:\WINDOWS\System32\ff_x264.dll
[2010/05/24 20:33:00 | 000,248,320 | —- | C] () – C:\WINDOWS\System32\ff_kernelDeint.dll
[2010/05/24 20:33:00 | 000,139,944 | —- | C] () – C:\WINDOWS\System32\libmplayer.dll
[2010/05/24 20:33:00 | 000,116,736 | —- | C] () – C:\WINDOWS\System32\ff_tremor.dll
[2010/05/19 21:59:20 | 000,150,528 | —- | C] () – C:\WINDOWS\System32\mkx.dll
[2010/05/19 21:59:10 | 000,109,568 | —- | C] () – C:\WINDOWS\System32\avi.dll
[2010/05/19 21:55:40 | 000,080,384 | —- | C] () – C:\WINDOWS\System32\mkzlib.dll
[2010/05/19 21:55:36 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\mkunicode.dll
[2010/04/09 16:40:55 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2010/03/31 17:42:23 | 000,000,715 | —- | C] () – C:\WINDOWS\aolback.exe.lnk
[2010/02/27 16:46:10 | 000,000,214 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\burnaware.ini
[2010/01/12 21:32:52 | 000,115,267 | —- | C] () – C:\WINDOWS\System32\drivers\klin.dat
[2010/01/12 21:32:52 | 000,097,859 | —- | C] () – C:\WINDOWS\System32\drivers\klick.dat
[2009/12/29 20:57:04 | 000,004,212 | -H– | C] () – C:\WINDOWS\System32\zllictbl.dat
[2009/10/24 23:52:51 | 000,005,606 | —- | C] () – C:\WINDOWS\System32\stci.dll
[2009/09/09 18:01:40 | 000,027,675 | —- | C] () – C:\WINDOWS\System32\drivers\klopp.dat
[2009/08/11 22:21:26 | 000,087,552 | —- | C] () – C:\WINDOWS\System32\ac3config.exe
[2009/07/29 01:20:14 | 000,057,252 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2009/07/13 13:17:24 | 000,160,768 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/06/20 01:38:04 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2009/06/20 00:31:19 | 000,168,448 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2009/06/20 00:31:18 | 000,000,038 | —- | C] () – C:\WINDOWS\avisplitter.ini
[2009/06/16 12:34:11 | 000,160,963 | —- | C] () – C:\WINDOWS\System32\drivers\gtipdsp.bin
[2009/06/16 12:34:11 | 000,160,951 | —- | C] () – C:\WINDOWS\System32\drivers\gtipdsp_.bin
[2009/06/16 12:34:11 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\CoInst.dll
[2009/06/16 12:34:10 | 000,016,908 | —- | C] () – C:\WINDOWS\wwdslcfg.ini
[2009/06/15 08:40:11 | 000,000,552 | —- | C] () – C:\WINDOWS\System32\d3d8caps.dat
[2009/06/15 08:38:09 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2009/06/15 07:58:23 | 000,092,985 | —- | C] () – C:\WINDOWS\VGAsetup.ini
[2009/06/15 07:57:50 | 000,208,896 | R— | C] () – C:\WINDOWS\Progress.exe
[2009/06/15 07:57:49 | 000,049,152 | R— | C] () – C:\WINDOWS\InstFunc.exe
[2009/06/15 07:57:41 | 000,065,536 | R— | C] () – C:\WINDOWS\System32\sis760.bin
[2009/06/15 07:57:41 | 000,065,536 | R— | C] () – C:\WINDOWS\System32\sis741.bin
[2009/06/15 07:57:41 | 000,049,152 | R— | C] () – C:\WINDOWS\System32\sis660.bin
[2009/06/15 07:57:32 | 000,128,191 | —- | C] () – C:\WINDOWS\System32\VGAunistlog.ini
[2009/06/15 07:53:04 | 000,049,152 | R— | C] () – C:\WINDOWS\System32\ChCfg.exe
[2009/06/15 07:51:27 | 000,016,960 | —- | C] () – C:\WINDOWS\Ascd_log.ini
[2009/06/15 07:51:05 | 000,005,810 | R— | C] () – C:\WINDOWS\System32\drivers\ASACPI.sys
[2009/06/15 07:50:55 | 000,010,288 | —- | C] () – C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2009/06/13 21:08:40 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2009/06/13 21:05:50 | 000,276,560 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2009/06/13 01:33:46 | 000,000,136 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\fusioncache.dat
[2009/06/13 01:26:41 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2009/06/13 01:18:45 | 000,034,284 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2009/06/07 17:24:04 | 000,180,224 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2009/01/10 23:15:44 | 000,159,744 | —- | C] () – C:\WINDOWS\System32\mmfinfo.dll
[2008/11/06 16:37:32 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2008/09/17 23:55:00 | 001,724,416 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2008/09/17 23:55:00 | 001,657,376 | —- | C] () – C:\WINDOWS\System32\nwiz.exe
[2008/09/17 23:55:00 | 001,503,232 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2008/09/17 23:55:00 | 001,346,080 | —- | C] () – C:\WINDOWS\System32\nvdspsch.exe
[2008/09/17 23:55:00 | 001,101,824 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2008/09/17 23:55:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2008/09/17 23:55:00 | 000,449,056 | —- | C] () – C:\WINDOWS\System32\nvappbar.exe
[2008/09/17 23:55:00 | 000,436,768 | —- | C] () – C:\WINDOWS\System32\keystone.exe
[2008/09/17 23:55:00 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2007/10/13 10:30:20 | 000,000,137 | —- | C] () – C:\WINDOWS\System32\Registration.ini
[2005/03/22 23:38:24 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2005/03/22 23:38:24 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/10 12:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/10 12:00:00 | 000,444,690 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/10 12:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/10 12:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/10 12:00:00 | 000,072,456 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/10 12:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/10 12:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/10 12:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/10 12:00:00 | 000,001,788 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2004/08/10 12:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/08/10 05:11:42 | 000,185,856 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll

========== LOP Check ==========

[2010/11/10 23:25:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\.BitTornado
[2010/04/07 22:07:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\acccore
[2009/08/23 22:26:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Camfrog
[2009/12/29 20:58:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\CheckPoint
[2010/11/10 23:56:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\deluge
[2011/02/09 18:14:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\ElevatedDiagnostics
[2011/01/28 16:38:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\FrostWire
[2010/02/28 00:38:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\GetRightToGo
[2009/12/31 20:40:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\GrabPro
[2009/07/25 22:18:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\ieSpell
[2009/12/31 20:55:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\ImgBurn
[2010/01/21 22:50:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\InfraRecorder
[2009/10/02 18:53:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\IObit
[2010/01/01 13:30:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Launchy
[2009/06/20 02:36:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\MSNInstaller
[2009/07/01 01:46:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\NotMyIp
[2009/06/18 00:47:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Opera
[2010/01/10 16:33:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Orbit
[2011/03/05 20:31:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Otto
[2011/04/11 17:20:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\QuickScan
[2011/04/06 18:33:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Softplicity
[2009/12/30 02:21:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\TigerPlayer
[2011/04/12 16:48:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\uTorrent
[2010/06/18 18:30:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2010/03/25 18:26:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Bluetooth
[2009/07/31 18:33:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Cached Installations
[2010/07/03 12:44:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DFX
[2009/10/03 23:31:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GrabJPG
[2009/12/30 17:39:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Hagel Technologies
[2010/01/13 17:23:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Innovative Solutions
[2009/07/02 00:30:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\LightScribe
[2011/03/05 20:31:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Otto
[2009/07/31 18:33:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ParetoLogic
[2010/07/03 12:55:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SRS Labs
[2010/09/12 11:47:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2011/03/05 20:02:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2011/03/03 21:41:39 | 000,000,376 | —- | M] () – C:\WINDOWS\Tasks\dr.job
[2011/04/12 16:58:25 | 000,000,438 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{FFFA57F7-E474-4C3A-9B66-7535F0F662CF}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/06/13 01:23:05 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2010/06/12 22:34:47 | 000,000,209 | -HS- | M] () – C:\Boot.bak
[2011/03/01 00:21:15 | 000,000,279 | -HS- | M] () – C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | —- | M] () – C:\cmldr
[2009/06/13 01:23:05 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2010/09/05 21:06:15 | 001,004,032 | -HS- | M] () – C:\ehthumbs.db
[2009/09/27 01:31:42 | 000,000,000 | —- | M] () – C:\FileRecovery.log
[2011/01/15 01:05:17 | 000,000,132 | —- | M] () – C:\ICSYSINF.log
[2009/06/13 01:23:05 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/07/12 20:34:24 | 000,000,345 | -H– | M] () – C:\IPH.PH
[2010/07/01 20:26:18 | 000,006,222 | —- | M] () – C:\JavaRa.log
[2009/06/13 01:23:05 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/10 12:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2009/07/25 17:18:30 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/04/12 16:29:14 | 2413,821,952 | -HS- | M] () – C:\pagefile.sys
[2009/10/11 13:09:03 | 000,000,573 | —- | M] () – C:\RHDSetup.log
[2011/04/12 16:45:36 | 000,044,102 | —- | M] () – C:\TDSSKiller.2.4.21.0_12.04.2011_16.33.25_log.txt

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2011/02/20 18:22:30 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 13:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2009/04/16 15:08:20 | 000,312,832 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpfpp70v.dll
[2008/07/06 11:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/04/17 00:04:40 | 000,306,032 | —- | M] (Microsoft Corporation) – C:\WINDOWS\WLXPGSS.SCR
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >
[2008/04/08 18:34:02 | 000,000,174 | —- | M] () – C:\Documents and Settings\All Users\Favorites\The NeoSmart Files.url

< %APPDATA%\Microsoft\*.* >
[2011/03/20 22:39:10 | 000,001,618 | -H– | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\LastFlashConfig.WFC

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2011/02/20 17:51:24 | 000,524,288 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2011/02/20 17:36:43 | 000,069,632 | —- | M] () – C:\WINDOWS\system32\config\security.sav
[2011/02/20 17:51:24 | 038,010,880 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2011/02/20 17:51:24 | 009,699,328 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2011/02/20 18:23:47 | 000,000,294 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/06/13 01:43:13 | 000,000,170 | -HS- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2009/06/13 01:43:11 | 000,000,079 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2011/04/12 16:42:49 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL (2).exe
[2011/03/10 12:27:50 | 001,377,112 | —- | M] (Kaspersky Lab ZAO) – C:\Documents and Settings\Administrator\Desktop\TDSSKiller.exe
[2011/04/05 21:38:42 | 001,146,696 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Administrator\Desktop\wlsetup-custom.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >
[2009/06/20 00:28:29 | 037,452,296 | —- | M] (Lavasoft ) – C:\Documents and Settings\Administrator\My Documents\Ad-AwareAE.exe
[2009/06/18 02:15:59 | 001,255,874 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\Aspell-0-50-3-3-Setup.exe
[2009/06/18 02:18:13 | 002,429,759 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\Aspell-en-0.50-2-3.exe
[2009/06/20 00:29:25 | 000,828,488 | —- | M] (Piriform Ltd) – C:\Documents and Settings\Administrator\My Documents\dfsetup110.exe
[2009/06/20 01:37:38 | 007,545,512 | —- | M] (Mozilla) – C:\Documents and Settings\Administrator\My Documents\Firefox Setup 3.0.11.exe
[2009/06/19 21:35:52 | 001,529,216 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Administrator\My Documents\GenuineCheck.exe
[2009/06/20 00:28:57 | 001,914,000 | —- | M] (Adobe Systems Incorporated) – C:\Documents and Settings\Administrator\My Documents\install_flash_player_10_active_x.exe
[2009/06/20 00:30:55 | 014,084,285 | —- | M] ( ) – C:\Documents and Settings\Administrator\My Documents\klcodec490f.exe
[2009/06/20 00:29:20 | 018,991,950 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\vlc-1.0.0-rc4-win32.exe
[2010/06/20 18:27:43 | 018,499,623 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\vlc-1.0.5-win32.exe
[2010/07/21 20:08:33 | 019,495,102 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\vlc-1.1.0-win32.exe
[2010/08/08 11:34:32 | 019,461,015 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\vlc-1.1.2-win32.exe
[2010/08/24 16:51:03 | 019,563,096 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\vlc-1.1.3-win32.exe
[2010/11/14 12:16:59 | 019,657,194 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\vlc-1.1.4-win32.exe
[2010/12/13 19:05:02 | 019,985,265 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\vlc-1.1.5-win32.exe
[2011/02/06 15:54:46 | 020,364,702 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\vlc-1.1.7-win32.exe
[2009/06/20 15:01:34 | 001,144,168 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Administrator\My Documents\wlsetup-custom.exe
[2009/06/19 21:14:51 | 025,740,144 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Administrator\My Documents\wmp11-windowsxp-x86-enu.exe
[2009/06/20 00:29:43 | 001,373,490 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\wrar39b3.exe

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2009/06/13 01:43:12 | 000,000,122 | -HS- | M] () – C:\Documents and Settings\Administrator\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2011/04/12 16:58:09 | 000,049,152 | -HS- | M] () – C:\Documents and Settings\Administrator\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-04-06 21:06:51

========== Files - Unicode (All) ==========
[2010/01/29 23:29:25 | 000,000,000 | —D | M](C:\Documents and Settings\Administrator\Favorites\?gsorted Bookmarks) – C:\Documents and Settings\Administrator\Favorites\錰ģsorted Bookmarks

========== Alternate Data Streams ==========

@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A2947BEA
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34

< End of report >

OTL Extras logfile created on: 12/04/2011 16:49:09 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 66.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 88.00% Paging File free
Paging file location(s): C:\pagefile.sys 2302 3647 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.05 Gb Total Space | 6.61 Gb Free Space | 4.44% Space Free | Partition Type: NTFS

Computer Name: USER-50C5ECAA5B | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
htmlfile [print] – Reg Error: Key error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
"" =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1723:TCP" = 1723:TCP:*:Enabled:@xpsp2res.dll,-22015
"1701:UDP" = 1701:UDP:*:Enabled:@xpsp2res.dll,-22016
"500:UDP" = 500:UDP:*:Enabled:@xpsp2res.dll,-22017

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"24884:TCP" = 24884:TCP:*:Enabled:BitComet 24884 TCP
"24884:UDP" = 24884:UDP:*:Enabled:BitComet 24884 UDP
"20482:TCP" = 20482:TCP:*:Enabled:BitComet 20482 TCP
"20482:UDP" = 20482:UDP:*:Enabled:BitComet 20482 UDP
"9067:TCP" = 9067:TCP:*:Enabled:BitComet 9067 TCP(ED2K)
"9067:UDP" = 9067:UDP:*:Enabled:BitComet 9067 UDP(ED2K)
"9751:TCP" = 9751:TCP:*:Enabled:BitComet 9751 TCP(ED2K)
"9751:UDP" = 9751:UDP:*:Enabled:BitComet 9751 UDP(ED2K)
"7043:TCP" = 7043:TCP:*:Enabled:BitComet 7043 TCP
"7043:UDP" = 7043:UDP:*:Enabled:BitComet 7043 UDP
"10255:TCP" = 10255:TCP:*:Enabled:BitComet 10255 TCP
"10255:UDP" = 10255:UDP:*:Enabled:BitComet 10255 UDP
"8343:TCP" = 8343:TCP:*:Enabled:BitComet 8343 TCP
"8343:UDP" = 8343:UDP:*:Enabled:BitComet 8343 UDP
"7175:TCP" = 7175:TCP:*:Enabled:BitComet 7175 TCP
"7175:UDP" = 7175:UDP:*:Enabled:BitComet 7175 UDP
"1723:TCP" = 1723:TCP:*:Enabled:@xpsp2res.dll,-22015
"1701:UDP" = 1701:UDP:*:Enabled:@xpsp2res.dll,-22016
"500:UDP" = 500:UDP:*:Enabled:@xpsp2res.dll,-22017

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe
"C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe:*:Enabled:hpqcopy2.exe
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe
"C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe" = C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe:*:Enabled:hpqphotocrm.exe
"C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe
"C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe:*:Enabled:hpqgpc01.exe
"C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe
"C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe
"C:\Program Files\HP\HP Software Update\HPWUCli.exe" = C:\Program Files\HP\HP Software Update\HPWUCli.exe:*:Enabled:hpwucli.exe
"C:\Program Files\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe" = C:\Program Files\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe
"C:\WINDOWS\system32\wmisftc.exe" = C:\WINDOWS\system32\wmisftc.exe:*:Enabled:UPnP Firewall
"C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe – (Hewlett-Packard Co.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser – (Opera Software)
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox – (Mozilla Corporation)
"C:\Program Files\VideoLAN\VLC\vlc.exe" = C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player – ()
"C:\Documents and Settings\Administrator\Desktop\Charon.exe" = C:\Documents and Settings\Administrator\Desktop\Charon.exe:*:Enabled:Charon - A proxy checking / scanning program.
"C:\Program Files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe" = C:\Program Files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe:*:Enabled:AOL TopSpeed – (AOL LLC)
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL Connectivity Service Dialler – (AOL LLC)
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL Connectivity Services – (AOL LLC)
"C:\Program Files\Common Files\AOL\1270674119\ee\aolsoftware.exe" = C:\Program Files\Common Files\AOL\1270674119\ee\aolsoftware.exe:*:Enabled:AOL Shared Components – (AOL LLC)
"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader – (America Online, Inc.)
"C:\Program Files\Common Files\AOL\1270674119\ee\AOLDesktop.exe" = C:\Program Files\Common Files\AOL\1270674119\ee\AOLDesktop.exe:*:Enabled:AOL Desktop – (AOL LLC)
"C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe – (Hewlett-Packard Co.)
"C:\Program Files\FrostWire\FrostWire.exe" = C:\Program Files\FrostWire\FrostWire.exe:*:Enabled:FrostWire
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger – (Yahoo! Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{00BA866C-F2A2-4BB9-A308-3DFA695B6F7C}" = Java DB 10.5.3.0
"{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan
"{06E6E30D-B498-442F-A943-07DE41D7F785}" = Microsoft Search Enhancement Pack
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{18E65799-76BD-46EF-9E53-972FE5A40736}" = Opera 10.62
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 2.5.7
"{1BD07DF4-FB06-41BA-B896-B2DA59000C96}" = Windows Live Toolbar
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 24
"{292F0F52-B62D-4E71-921B-89A682402201}" = Toolbox
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{32A3A4F4-B792-11D6-A78A-00B0D0160200}" = Java™ SE Development Kit 6 Update 20
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{542C6F13-6861-4010-9EBC-6F068D397AD8}" = SRS Audio Sandbox
"{5546F4E9-B0F4-4F54-B949-2AB006C9284F}" = DJ_AIO_06_F2400_SW_Min
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{60FFB3E0-6D5B-4D73-AE5B-07E58B83AF0C}" = 32 Bit HP CIO Components Installer
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{7694E0B1-2332-448B-9235-929F84B41E3F}" = Active@ ISO Burner
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{797EE0CA-8165-405C-B5CE-F11EC20F1BB0}" = Microsoft VC9 runtime libraries
"{819CA3BC-2FF8-4811-B42F-421F7BFD3559}" = HP Deskjet F2400 All-in-One Driver 14.0 Rel. 6
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9941F0AA-B903-4AF4-A055-83A9815CC011}" = Sonic Encoders
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Internet Security 2010
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.2
"{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync
"{B57EAFF2-D6EE-4C6C-9175-ED9F17BFC1BC}" = Windows Live Messenger
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC4A73BF-938E-4C19-A553-853C035C9BA1}" = LightScribe System Software 1.10.13.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D41FAAA9-8048-4906-86B2-9AADEA1FA0B7}" = SpeedTouch USB Software
"{D92FF8EB-BD77-40AE-B68B-A6BFC6F8661D}" = Windows Live Family Safety
"{DC226AC9-0314-496C-BE6A-B6A132628466}" = SiSAGP driver
"{E6158D07-2637-4ECF-B576-37C489669174}" = Windows Live Call
"{EE39FFBD-544E-49E4-A999-6819828EAE91}" = Windows Live Photo Gallery
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"3554AA4B-9B0B-451a-A269-2B5F53982209_is1" = ThreatFire
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"AOL Broadband Toolbar" = AOL Broadband Toolbar 5.0
"AOL Regclient" = AOL Registration
"AOL Uninstaller" = AOL Uninstaller (Choose which Products to Remove)
"B3EE3001-DC24-4cd1-8743-5692C716659F" = Otto
"BT Voyager 105 ADSL Modem" = BT Voyager 105 ADSL Modem
"CCleaner" = CCleaner
"ESET Online Scanner" = ESET Online Scanner v3
"GOM Player" = GOM Player
"GrabJPG" = GrabJPG
"HijackThis" = HijackThis 2.0.2
"ie8" = Windows Internet Explorer 8
"ieSpell" = ieSpell
"ImgBurn" = ImgBurn
"InstallWIX_{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Internet Security 2010
"ISSC WLAN" = ISSC WLAN
"KLiteCodecPack_is1" = K-Lite Codec Pack 4.9.0 (Full)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Media Player - Codec Pack" = Media Player Codec Pack 3.9.7
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"NVIDIA Drivers" = NVIDIA Drivers
"PeerGuardian_is1" = PeerGuardian 2.0
"Photo Gadget_is1" = Photo Gadget
"Picasa 3" = Picasa 3
"RealHideIP" = Real Hide IP
"SiS VGA Driver" = SiS VGA Utilities
"Total CSV Converter_is1" = TotalCSVConverter
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.1.7
"Windows Media Format Runtime" = Windows Media Format Runtime
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"Wisdom-soft ScreenHunter 5.1 Free" = Wisdom-soft ScreenHunter 5.1 Free
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Software Update" = Yahoo! Software Update

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 20/02/2011 13:18:38 | Computer Name = USER-50C5ECAA5B | Source = ASP.NET 1.0.3705.6018 | ID = 1031
Description =

Error - 20/02/2011 13:41:08 | Computer Name = USER-50C5ECAA5B | Source = Windows Product Activation | ID = 1012
Description = Due to hardware changes on this computer, you will need to reactivate
your Windows product.

Error - 20/02/2011 13:52:55 | Computer Name = USER-50C5ECAA5B | Source = Windows Product Activation | ID = 1002
Description = You have not successfully activated this product, or the current license
is incompatible with the existing operating system.

Error - 20/02/2011 13:53:57 | Computer Name = USER-50C5ECAA5B | Source = Windows Product Activation | ID = 1002
Description = You have not successfully activated this product, or the current license
is incompatible with the existing operating system.

Error - 20/02/2011 14:05:24 | Computer Name = USER-50C5ECAA5B | Source = Application Error | ID = 1000
Description = Faulting application chrome.exe, version 0.0.0.0, faulting module
chrome.dll, version 8.0.552.237, fault address 0x000d069a.

Error - 20/02/2011 14:09:50 | Computer Name = USER-50C5ECAA5B | Source = Application Error | ID = 1000
Description = Faulting application chrome.exe, version 0.0.0.0, faulting module
chrome.dll, version 8.0.552.237, fault address 0x000d069a.

Error - 20/02/2011 14:33:12 | Computer Name = USER-50C5ECAA5B | Source = Windows Product Activation | ID = 1002
Description = You have not successfully activated this product, or the current license
is incompatible with the existing operating system.

Error - 20/02/2011 15:33:50 | Computer Name = USER-50C5ECAA5B | Source = Application Error | ID = 1000
Description = Faulting application chrome.exe, version 0.0.0.0, faulting module
chrome.dll, version 8.0.552.237, fault address 0x000d069a.

Error - 24/02/2011 17:04:49 | Computer Name = USER-50C5ECAA5B | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.2180, faulting
module unknown, version 0.0.0.0, fault address 0x03629290.

Error - 01/03/2011 15:39:43 | Computer Name = USER-50C5ECAA5B | Source = .NET Runtime Optimization Service | ID = 1111
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Service reached limit of transient errors. Will shut down. Last error returned
from Service Manager: 0x80004004.

[ System Events ]
Error - 10/04/2011 04:08:04 | Computer Name = USER-50C5ECAA5B | Source = sptd | ID = 262148
Description = Driver detected an internal error in its data structures for .

Error - 10/04/2011 04:08:06 | Computer Name = USER-50C5ECAA5B | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
sptd

Error - 10/04/2011 09:47:27 | Computer Name = USER-50C5ECAA5B | Source = sptd | ID = 262148
Description = Driver detected an internal error in its data structures for .

Error - 10/04/2011 09:47:38 | Computer Name = USER-50C5ECAA5B | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
sptd

Error - 10/04/2011 12:49:26 | Computer Name = USER-50C5ECAA5B | Source = sptd | ID = 262148
Description = Driver detected an internal error in its data structures for .

Error - 10/04/2011 12:49:32 | Computer Name = USER-50C5ECAA5B | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
sptd

Error - 11/04/2011 11:15:58 | Computer Name = USER-50C5ECAA5B | Source = sptd | ID = 262148
Description = Driver detected an internal error in its data structures for .

Error - 11/04/2011 11:16:06 | Computer Name = USER-50C5ECAA5B | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
sptd

Error - 12/04/2011 11:29:38 | Computer Name = USER-50C5ECAA5B | Source = sptd | ID = 262148
Description = Driver detected an internal error in its data structures for .

Error - 12/04/2011 11:29:59 | Computer Name = USER-50C5ECAA5B | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
sptd


< End of report >

log file



ComboFix 11-04-12.02 - Administrator 13/04/2011 13:13:26.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1535.1054 [GMT 1:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *Disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\XSxS
.
.
((((((((((((((((((((((((( Files Created from 2011-03-13 to 2011-04-13 )))))))))))))))))))))))))))))))
.
.
2011-04-13 10:24 . 2011-04-13 10:24 ——– d—–w- C:\_OTL
2011-04-11 16:31 . 2011-04-11 16:31 ——– d—–w- c:\program files\ESET
2011-04-11 16:20 . 2011-04-11 16:20 ——– d—–w- c:\documents and settings\Administrator\Application Data\QuickScan
2011-04-06 17:33 . 2011-04-06 17:33 ——– d—–w- c:\documents and settings\Administrator\Application Data\Softplicity
2011-04-06 17:31 . 2011-04-06 17:31 ——– d—–w- c:\program files\TotalCSVConverter
2011-04-06 15:13 . 2011-04-06 15:13 ——– d—–w- c:\documents and settings\All Users\Application Data\RealHideIP
2011-04-06 15:13 . 2011-04-06 15:13 ——– d—–w- c:\documents and settings\Administrator\Application Data\RealHideIP
2011-04-06 15:09 . 2011-04-06 15:10 ——– d—–w- c:\program files\RealHideIP
2011-04-05 20:49 . 2011-04-05 20:49 ——– d—–w- c:\program files\Windows Live SkyDrive
2011-04-02 15:30 . 2011-04-13 12:23 ——– d—–w- c:\program files\PeerGuardian2
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-18 22:09 . 2009-10-14 07:30 499712 —-a-w- c:\windows\system32\msvcp71.dll
2011-02-18 22:09 . 2009-01-08 07:43 348160 —-a-w- c:\windows\system32\msvcr71.dll
2011-02-07 18:00 . 2011-02-07 18:00 925667 —-a-w- c:\windows\system32\ffmpegmt.dll
2011-02-07 18:00 . 2011-02-07 18:00 721798 —-a-w- c:\windows\system32\xvidcore.dll
2011-02-07 18:00 . 2011-02-07 18:00 65024 —-a-w- c:\windows\system32\FLT_ffdshow.dll
2011-02-07 18:00 . 2011-02-07 18:00 336384 —-a-w- c:\windows\system32\ff_libfaad2.dll
2011-02-07 18:00 . 2011-02-07 18:00 324096 —-a-w- c:\windows\system32\TomsMoComp_ff.dll
2011-02-07 18:00 . 2011-02-07 18:00 216576 —-a-w- c:\windows\system32\ff_libdts.dll
2011-02-07 18:00 . 2011-02-07 18:00 1529856 —-a-w- c:\windows\system32\ff_samplerate.dll
2011-02-07 18:00 . 2011-02-07 18:00 151552 —-a-w- c:\windows\system32\ff_libmad.dll
2011-02-07 18:00 . 2011-02-07 18:00 145408 —-a-w- c:\windows\system32\libmpeg2_ff.dll
2011-02-07 18:00 . 2011-02-07 18:00 140800 —-a-w- c:\windows\system32\ff_unrar.dll
2011-02-07 18:00 . 2011-02-07 18:00 121856 —-a-w- c:\windows\system32\ff_liba52.dll
2011-02-07 18:00 . 2011-02-07 18:00 100864 —-a-w- c:\windows\system32\ff_wmv9.dll
2011-02-07 17:45 . 2011-02-07 17:45 80896 —-a-w- c:\windows\system32\ff_vfw.dll
2011-02-07 17:39 . 2011-02-07 17:39 4166551 —-a-w- c:\windows\system32\ffmpeg.dll
2011-02-02 21:40 . 2010-07-01 19:49 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-02-02 19:19 . 2010-07-01 19:49 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-01-29 16:32 . 2009-10-24 15:55 722416 —-a-w- c:\windows\system32\drivers\sptd.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-08-20 16384512]
"avp"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2010-08-18 340520]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-10 44544]
.
c:\documents and settings\Administrator\Start Menu\Programs\Startup\
PeerGuardian.lnk - c:\program files\PeerGuardian2\pg2.exe [2011-4-2 1432064]
æTorrent.lnk - c:\program files\uTorrent\uTorrent.exe [2009-6-27 394616]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^FrostWire On Startup.lnk]
path=c:\documents and settings\Administrator\Start Menu\Programs\Startup\FrostWire On Startup.lnk
backup=c:\windows\pss\FrostWire On Startup.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\documents and settings\Administrator\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^WWU.lnk]
path=c:\documents and settings\Administrator\Start Menu\Programs\Startup\WWU.lnk
backup=c:\windows\pss\WWU.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Launchy.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Launchy.lnk
backup=c:\windows\pss\Launchy.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Utility Tray.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Utility Tray.lnk
backup=c:\windows\pss\Utility Tray.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-20 23:07 932288 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-01-31 08:44 35760 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
2009-09-18 15:34 205976 —-a-w- c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-10 11:00 15360 —-a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
2005-08-05 12:56 64512 —-a-w- c:\windows\ehome\ehtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-06-16 11:55 133104 —-atw- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2010-06-01 10:17 5252408 —-a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2007-08-03 05:22 1826816 ——r- c:\windows\SkyTel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SRS Audio Sandbox]
2010-01-07 09:43 3216664 —-a-w- c:\program files\SRS Labs\Audio Sandbox\SRSSSC.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-10-29 14:49 249064 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ThreatFire"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\1270674119\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1270674119\\ee\\AOLDesktop.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"24884:TCP"= 24884:TCP:BitComet 24884 TCP
"24884:UDP"= 24884:UDP:BitComet 24884 UDP
"20482:TCP"= 20482:TCP:BitComet 20482 TCP
"20482:UDP"= 20482:UDP:BitComet 20482 UDP
"9067:TCP"= 9067:TCP:BitComet 9067 TCP(ED2K)
"9067:UDP"= 9067:UDP:BitComet 9067 UDP(ED2K)
"9751:TCP"= 9751:TCP:BitComet 9751 TCP(ED2K)
"9751:UDP"= 9751:UDP:BitComet 9751 UDP(ED2K)
"7043:TCP"= 7043:TCP:BitComet 7043 TCP
"7043:UDP"= 7043:UDP:BitComet 7043 UDP
"10255:TCP"= 10255:TCP:BitComet 10255 TCP
"10255:UDP"= 10255:UDP:BitComet 10255 UDP
"8343:TCP"= 8343:TCP:BitComet 8343 TCP
"8343:UDP"= 8343:UDP:BitComet 8343 UDP
"7175:TCP"= 7175:TCP:BitComet 7175 TCP
"7175:UDP"= 7175:UDP:BitComet 7175 UDP
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [14/10/2009 21:18 36880]
R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [14/01/2010 23:45 51984]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [14/01/2010 23:46 59664]
R1 wbsecdrv;wbsecdrv Protocol Driver;c:\windows\system32\drivers\wbsecdrv.sys [08/04/2010 17:15 17952]
R2 ThreatFire;ThreatFire;c:\program files\ThreatFire\TFService.exe service –> c:\program files\ThreatFire\TFService.exe service [?]
R2 wbsecsvc;wbsecsvc;c:\windows\system32\wbsecsvc.exe [08/04/2010 17:15 274432]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [14/09/2009 13:42 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [02/10/2009 19:39 19472]
R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [14/01/2010 23:46 33552]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [24/10/2009 16:55 722416]
S3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [18/06/2010 18:27 30104]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [18/06/2010 18:27 30104]
S3 W35UND;IS89C35 802.11bg WLAN USB Adapter Driver;c:\windows\system32\drivers\W35UND.SYS [08/04/2010 17:15 117632]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-08-23 16:34 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-789336058-1326574676-839522115-500Core.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-16 11:55]
.
2011-04-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-789336058-1326574676-839522115-500UA.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-16 11:55]
.
2011-04-12 c:\windows\Tasks\User_Feed_Synchronization-{FFFA57F7-E474-4C3A-9B66-7535F0F662CF}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 03:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://search.aol.co.uk/web?isinit=true&query;=%s
IE: &AOL; Toolbar Search - c:\program files\aol\aol broadband toolbar 5.0\resources\en-GB\local\search.html
IE: &D;&ownload; &with; BitComet
IE: &D;&ownload; all video with BitComet
IE: &D;&ownload; all with BitComet
IE: &Download; by Orbit
IE: &Grab; video by Orbit
IE: &ieSpell; Options - c:\program files\ieSpell\iespell.dll/SPELLOPTION.HTM
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
IE: Check &Spelling; - c:\program files\ieSpell\iespell.dll/SPELLCHECK.HTM
IE: Do&wnload; selected by Orbit
IE: Down&load; all by Orbit
IE: E&xport; to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: Lookup on Merriam Webster - file://c:\program files\ieSpell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files\ieSpell\wikipedia.HTM
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/
FF - prefs.js: keyword.URL - hxxp://uk.search.yahoo.com/search?fr=greentree_ff1&ei;=utf-8&type;=937811&p;=
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Kaspersky URL Advisor: [removed] - c:\program files\Mozilla Firefox\extensions\[removed]
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Read It Later: [removed] - %profile%\extensions\[removed]
FF - Ext: Tab Mix Plus: {dc572301-7619-498c-a57d-39143191b318} - %profile%\extensions\{dc572301-7619-498c-a57d-39143191b318}
FF - Ext: CheckPlaces: [removed] - %profile%\extensions\[removed]
FF - Ext: Reframe It: [removed] - %profile%\extensions\[removed]
FF - Ext: The Search Sidebar: [removed] - %profile%\extensions\[removed]
FF - Ext: Evernote Web Clipper: {E0B8C461-F8FB-49b4-8373-FE32E9252800} - %profile%\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}
FF - Ext: Speed Dial: {64161300-e22b-11db-8314-0800200c9a66} - %profile%\extensions\{64161300-e22b-11db-8314-0800200c9a66}
FF - Ext: Fast Youtube Downloader: [removed] - %profile%\extensions\[removed]
FF - Ext: FastestFox: [removed] - %profile%\extensions\[removed]
FF - Ext: Xmarks: [removed] - %profile%\extensions\[removed]
FF - Ext: BitComet Video Downloader: {B042753D-F57E-4e8e-A01B-7379A6D4CEFB} - %profile%\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}
FF - Ext: Spell Checker: [removed] - %profile%\extensions\[removed]
FF - Ext: British English Dictionary: [removed] - %profile%\extensions\[removed]
FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF - Ext: Real Hide IP: [removed] - %profile%\extensions\[removed]
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: [removed] - c:\program files\Java\jre6\lib\deploy\jqs\ff
user_pref('capability.policy.policynames', 'localfilelinks');user_pref('capability.policy.localfilelinks.sites', 'hxxp://www.webmynd.com http://www.google.com');user_pref('…ri.enabled', 'allAccess');FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-DivXUpdate - c:\program files\DivX\DivX Update\DivXUpdate.exe
MSConfigStartUp-QuickTime Task - c:\program files\QuickTime\QTTask.exe
MSConfigStartUp-TkBellExe - c:\program files\Real\RealPlayer\update\realsched.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-13 13:23
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\ThreatFire]
"AlternateImagePath"=""
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-789336058-1326574676-839522115-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,06,f3,42,55,33,40,a7,44,82,66,09,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,06,f3,42,55,33,40,a7,44,82,66,09,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,43,8e,9a,c0,2d,a6,4c,43,85,76,45,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(1364)
c:\program files\ThreatFire\TFNI.dll
c:\program files\ThreatFire\TFMon.dll
c:\program files\ThreatFire\TFRK.dll
c:\program files\ThreatFire\TFWAH.dll
.
- - - - - - - > 'lsass.exe'(1420)
c:\program files\ThreatFire\TFWAH.dll
.
- - - - - - - > 'explorer.exe'(3120)
c:\windows\system32\WININET.dll
c:\program files\ThreatFire\TfWah.dll
c:\windows\system32\ieframe.dll
c:\program files\ThreatFire\TFNI.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\program files\ThreatFire\TFMon.dll
c:\program files\ThreatFire\TFRK.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\RTHDCPL.EXE
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\ThreatFire\TFService.exe
c:\windows\wanmpsvc.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\dllhost.exe
.
**************************************************************************
.
Completion time: 2011-04-13 13:36:38 - machine was rebooted
ComboFix-quarantined-files.txt 2011-04-13 12:36
.
Pre-Run: 10,916,159,488 bytes free
Post-Run: 10,893,000,704 bytes free
.
- - End Of File - - 8870FB22DCC8A8A92A1DA9B74282F2C8

OTL logfile created on: 14/04/2011 22:22:37 - Run 2
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 49.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 81.00% Paging File free
Paging file location(s): C:\pagefile.sys 2302 3647 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.05 Gb Total Space | 11.33 Gb Free Space | 7.60% Space Free | Partition Type: NTFS

Computer Name: USER-50C5ECAA5B | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\Desktop\OTL (2).exe (OldTimer Tools)
PRC - C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
PRC - C:\Program Files\ThreatFire\TFService.exe (PC Tools)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software)
PRC - C:\WINDOWS\system32\wbsecsvc.exe (Integrated System Solution Corp.)
PRC - C:\WINDOWS\system32\slserv.exe (Smart Link)
PRC - C:\WINDOWS\system32\slrundll.exe (Smart Link)
PRC - C:\WINDOWS\wanmpsvc.exe (America Online, Inc.)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Administrator\Desktop\OTL (2).exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – File not found
SRV - (NMIndexingService) – File not found
SRV - (HidServ) – File not found
SRV - (AVP) – C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
SRV - (ThreatFire) – C:\Program Files\ThreatFire\TFService.exe (PC Tools)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (StarWindServiceAE) – C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software)
SRV - (AOL ACS) – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)
SRV - (wbsecsvc) – C:\WINDOWS\System32\wbsecsvc.exe (Integrated System Solution Corp.)
SRV - (SLService) – C:\WINDOWS\System32\slserv.exe (Smart Link)
SRV - (WANMiniportService) WAN Miniport (ATW) – C:\WINDOWS\wanmpsvc.exe (America Online, Inc.)


========== Driver Services (SafeList) ==========

DRV - (sptd) – C:\WINDOWS\System32\Drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (Avgfwfd) – C:\WINDOWS\system32\drivers\avgfwdx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgfwdx) – C:\WINDOWS\system32\drivers\avgfwdx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Tcpip6) – C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (TfSysMon) – C:\WINDOWS\system32\drivers\TfSysMon.sys (PC Tools)
DRV - (TfNetMon) – C:\WINDOWS\system32\drivers\TfNetMon.sys (PC Tools)
DRV - (TfFsMon) – C:\WINDOWS\system32\drivers\TfFsMon.sys (PC Tools)
DRV - (SRS_SSCFilter) SRS Labs Audio Sandbox (WDM) – C:\WINDOWS\system32\drivers\SRS_SSCFilter_i386.sys ()
DRV - (KLIF) – C:\WINDOWS\system32\drivers\klif.sys (Kaspersky Lab)
DRV - (klbg) – C:\WINDOWS\system32\drivers\klbg.sys (Kaspersky Lab)
DRV - (klmouflt) – C:\WINDOWS\system32\drivers\klmouflt.sys (Kaspersky Lab)
DRV - (klim5) – C:\WINDOWS\system32\drivers\klim5.sys (Kaspersky Lab)
DRV - (kl1) – C:\WINDOWS\system32\drivers\kl1.sys (Kaspersky Lab)
DRV - (fssfltr) – C:\WINDOWS\system32\drivers\fssfltr_tdi.sys (Microsoft Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (SiSkp) – C:\WINDOWS\system32\drivers\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (SiS315) – C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (SiSGbeXP) – C:\WINDOWS\system32\drivers\SiSGbeXP.sys (Silicon Integrated Systems Corp.)
DRV - (W35UND) – C:\WINDOWS\system32\drivers\W35UND.SYS (Integrated System Solution Corp.)
DRV - (wbsecdrv) – C:\WINDOWS\system32\drivers\wbsecdrv.sys (Winbond)
DRV - (MTsensor) – C:\WINDOWS\system32\drivers\ASACPI.sys ()
DRV - (nm) – C:\WINDOWS\system32\drivers\nmnt.sys (Microsoft Corporation)
DRV - (SlNtHal) – C:\WINDOWS\system32\drivers\slnthal.sys (Smart Link)
DRV - (SlWdmSup) – C:\WINDOWS\system32\drivers\slwdmsup.sys (Smart Link)
DRV - (Slntamr) – C:\WINDOWS\system32\drivers\slntamr.sys (Smart Link)
DRV - (NtMtlFax) – C:\WINDOWS\system32\drivers\ntmtlfax.sys (Smart Link)
DRV - (Mtlmnt5) – C:\WINDOWS\system32\drivers\mtlmnt5.sys (Smart Link)
DRV - (RecAgent) – C:\WINDOWS\system32\DRIVERS\RecAgent.sys (Smart Link)
DRV - (Mtlstrm) – C:\WINDOWS\system32\drivers\mtlstrm.sys (Smart Link)
DRV - (alcan5wn) SpeedTouch USB ADSL PPP Networking Driver (NDISWAN) – C:\WINDOWS\system32\drivers\alcan5wn.sys (THOMSON)
DRV - (alcaudsl) – C:\WINDOWS\system32\drivers\alcaudsl.sys (THOMSON)
DRV - (wanusb) – C:\WINDOWS\system32\drivers\gwausb.sys (GlobespanVirata Inc.)
DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=937811"
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.co.uk/"
FF - prefs.js..extensions.enabledItems: {B042753D-F57E-4e8e-A01B-7379A6D4CEFB}:1.17
FF - prefs.js..extensions.enabledItems: [removed]:2.4.1
FF - prefs.js..extensions.enabledItems: {E0B8C461-F8FB-49b4-8373-FE32E9252800}:4.0.0.106602
FF - prefs.js..extensions.enabledItems: [removed]:1.2.2
FF - prefs.js..extensions.enabledItems: [removed]:4.1.8
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:9.0.0.736
FF - prefs.js..extensions.enabledItems: [removed]:2.1.1
FF - prefs.js..extensions.enabledItems: [removed]:2.0.0.20091223
FF - prefs.js..extensions.enabledItems: {64161300-e22b-11db-8314-0800200c9a66}:0.9.5.8
FF - prefs.js..extensions.enabledItems: {dc572301-7619-498c-a57d-39143191b318}:0.3.8.2
FF - prefs.js..extensions.enabledItems: [removed]:1.4
FF - prefs.js..extensions.enabledItems: [removed]:3.9.2
FF - prefs.js..extensions.enabledItems: [removed]:1.3.2
FF - prefs.js..extensions.enabledItems: [removed]:1.19.1
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..keyword.URL: "http://uk.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=937811&p="
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.type: 0


FF - HKLM\software\mozilla\Firefox\extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG8\Firefox
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/02/21 14:13:19 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/05 17:39:30 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\THBExt [2011/04/10 14:41:58 | 000,000,000 | —D | M]

[2009/06/27 02:55:30 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2009/06/27 02:55:30 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions\[removed]
[2011/04/06 17:38:11 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions
[2010/12/30 23:09:45 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/02/12 16:53:57 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/12/30 23:10:47 | 000,000,000 | —D | M] (Speed Dial) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}
[2009/12/29 21:25:49 | 000,000,000 | —D | M] (BitComet Video Downloader) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}
[2009/10/13 16:30:48 | 000,000,000 | —D | M] ("Tab Mix Plus") – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{dc572301-7619-498c-a57d-39143191b318}
[2010/12/30 23:10:11 | 000,000,000 | —D | M] (Evernote Web Clipper) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}
[2010/12/30 23:09:46 | 000,000,000 | —D | M] (CheckPlaces) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/12/30 23:19:11 | 000,000,000 | —D | M] (British English Dictionary) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/12/30 22:25:05 | 000,000,000 | —D | M] (Fast Youtube Downloader) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/12/30 23:12:27 | 000,000,000 | —D | M] ("Xmarks") – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/12/30 22:35:14 | 000,000,000 | —D | M] (Spell Checker) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/12/30 23:09:46 | 000,000,000 | —D | M] (Read It Later) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/12/30 22:25:10 | 000,000,000 | —D | M] (Reframe It) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/12/30 23:11:15 | 000,000,000 | —D | M] (FastestFox) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2011/04/06 16:34:42 | 000,000,000 | —D | M] (Real Hide IP) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/12/30 23:09:47 | 000,000,000 | —D | M] (The Search Sidebar) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/01/17 00:49:40 | 000,002,255 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\searchplugins\askcom.xml
[2011/04/06 16:56:54 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/07/01 20:49:55 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2011/03/13 16:07:57 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2010/01/12 21:33:20 | 000,000,000 | —D | M] (Kaspersky URL Advisor) – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2010/07/01 20:48:44 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2009/07/17 09:40:12 | 000,704,512 | —- | M] (BitComet) – C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2011/02/02 22:40:24 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/12/03 18:47:02 | 000,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/12/03 18:47:02 | 000,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/12/03 18:47:02 | 000,000,769 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/12/03 18:47:02 | 000,001,135 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2011/04/13 13:21:50 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (AOL Toolbar Launcher) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Broadband Toolbar 5.0\aoltb.dll (AOL LLC)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O3 - HKLM\..\Toolbar: (AOL Broadband Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Broadband Toolbar 5.0\aoltb.dll (AOL LLC)
O3 - HKCU\..\Toolbar\WebBrowser: (AOL Broadband Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Broadband Toolbar 5.0\aoltb.dll (AOL LLC)
O4 - HKLM..\Run: [avp] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\PeerGuardian.lnk = C:\Program Files\PeerGuardian2\pg2.exe (Phoenix Labs)
O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\µTorrent.lnk = C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &AOL Toolbar Search - c:\Program Files\AOL\AOL Broadband Toolbar 5.0\resources\en-GB\local\search.html ()
O8 - Extra context menu item: &ieSpell Options - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Check &Spelling - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Lookup on Merriam Webster - C:\Program Files\ieSpell\Merriam Webster.HTM ()
O8 - Extra context menu item: Lookup on Wikipedia - C:\Program Files\ieSpell\wikipedia.HTM ()
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra Button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O9 - Extra Button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} https://moneymanager.egg.com/Pinsafe/accounttracking.cab (Egg Money Manager Digital Safe)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1247340977328 (WUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx1.hotmail.com/mail/w4/pr01/photo…ol/MSNPUpld.cab (Windows Live Hotmail Photo Upload Tool)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\kloehk.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab)
O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/13 01:23:05 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/04/14 17:01:33 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/04/14 16:58:42 | 000,050,688 | —- | C] (Atribune.org) – C:\Documents and Settings\Administrator\Desktop\ATF-Cleaner (1).exe
[2011/04/13 13:10:51 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/04/13 13:10:51 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/04/13 13:10:51 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/04/13 13:10:51 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/04/13 13:10:12 | 000,000,000 | —D | C] – C:\Qoobox
[2011/04/13 11:24:10 | 000,000,000 | —D | C] – C:\_OTL
[2011/04/12 16:43:17 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL (2).exe
[2011/04/12 16:32:58 | 001,377,112 | —- | C] (Kaspersky Lab ZAO) – C:\Documents and Settings\Administrator\Desktop\TDSSKiller.exe
[2011/04/11 17:31:14 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/04/11 17:20:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\QuickScan
[2011/04/06 18:33:09 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Softplicity
[2011/04/06 16:13:20 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\RealHideIP
[2011/04/06 16:13:20 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\RealHideIP
[2011/04/06 16:10:56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Real Hide IP
[2011/04/06 16:09:46 | 000,000,000 | —D | C] – C:\Program Files\RealHideIP
[2011/04/05 21:49:26 | 000,000,000 | —D | C] – C:\Program Files\Windows Live SkyDrive
[2011/04/05 21:38:39 | 001,146,696 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\Administrator\Desktop\wlsetup-custom.exe
[2011/04/02 16:30:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\PeerGuardian 2
[2011/04/02 16:30:16 | 000,000,000 | —D | C] – C:\Program Files\PeerGuardian2

========== Files - Modified Within 30 Days ==========

[2011/04/14 22:30:36 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/04/14 21:56:01 | 000,001,008 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-789336058-1326574676-839522115-500UA.job
[2011/04/14 21:11:54 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/04/14 18:20:42 | 000,000,438 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{FFFA57F7-E474-4C3A-9B66-7535F0F662CF}.job
[2011/04/14 17:04:26 | 000,000,049 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2011/04/14 16:58:14 | 000,050,688 | —- | M] (Atribune.org) – C:\Documents and Settings\Administrator\Desktop\ATF-Cleaner (1).exe
[2011/04/14 16:40:46 | 000,012,598 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/04/13 16:03:18 | 000,000,811 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/04/13 13:21:50 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2011/04/13 11:46:38 | 004,320,019 | R— | M] () – C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
[2011/04/12 16:43:53 | 000,160,768 | —- | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/12 16:42:49 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL (2).exe
[2011/04/11 18:25:15 | 000,013,066 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\hijackthis11.4.11
[2011/04/10 01:56:15 | 000,000,956 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-789336058-1326574676-839522115-500Core.job
[2011/04/06 18:45:28 | 000,011,566 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\red.jpg
[2011/04/06 16:10:57 | 000,000,713 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Real Hide IP.lnk
[2011/04/05 21:38:42 | 001,146,696 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Administrator\Desktop\wlsetup-custom.exe
[2011/04/04 17:00:10 | 000,115,267 | —- | M] () – C:\WINDOWS\System32\drivers\klin.dat
[2011/04/04 17:00:10 | 000,097,859 | —- | M] () – C:\WINDOWS\System32\drivers\klick.dat
[2011/04/02 16:30:21 | 000,000,631 | —- | M] () – C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\PeerGuardian.lnk
[2011/03/31 19:53:00 | 000,134,496 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\prick-award-demint.jpg
[2011/03/29 22:02:01 | 000,000,791 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/03/27 10:31:11 | 000,444,690 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/03/27 10:31:11 | 000,072,456 | —- | M] () – C:\WINDOWS\System32\perfc009.dat

========== Files Created - No Company Name ==========

[2011/04/13 13:10:51 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/04/13 13:10:51 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/04/13 13:10:51 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/04/13 11:46:37 | 004,320,019 | R— | C] () – C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
[2011/04/11 18:25:15 | 000,013,066 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\hijackthis11.4.11
[2011/04/06 18:45:38 | 000,011,566 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\red.jpg
[2011/04/06 16:10:57 | 000,000,713 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Real Hide IP.lnk
[2011/04/02 16:30:21 | 000,000,631 | —- | C] () – C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\PeerGuardian.lnk
[2011/03/31 19:53:20 | 000,134,496 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\prick-award-demint.jpg
[2011/03/29 22:02:01 | 000,000,791 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/02/21 15:03:50 | 000,016,922 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2011/02/07 19:00:08 | 001,529,856 | —- | C] () – C:\WINDOWS\System32\ff_samplerate.dll
[2011/02/07 19:00:08 | 000,925,667 | —- | C] () – C:\WINDOWS\System32\ffmpegmt.dll
[2011/02/07 19:00:08 | 000,721,798 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2011/02/07 19:00:08 | 000,336,384 | —- | C] () – C:\WINDOWS\System32\ff_libfaad2.dll
[2011/02/07 19:00:08 | 000,324,096 | —- | C] () – C:\WINDOWS\System32\TomsMoComp_ff.dll
[2011/02/07 19:00:08 | 000,216,576 | —- | C] () – C:\WINDOWS\System32\ff_libdts.dll
[2011/02/07 19:00:08 | 000,151,552 | —- | C] () – C:\WINDOWS\System32\ff_libmad.dll
[2011/02/07 19:00:08 | 000,145,408 | —- | C] () – C:\WINDOWS\System32\libmpeg2_ff.dll
[2011/02/07 19:00:08 | 000,140,800 | —- | C] () – C:\WINDOWS\System32\ff_unrar.dll
[2011/02/07 19:00:08 | 000,121,856 | —- | C] () – C:\WINDOWS\System32\ff_liba52.dll
[2011/02/07 19:00:08 | 000,100,864 | —- | C] () – C:\WINDOWS\System32\ff_wmv9.dll
[2011/02/07 19:00:08 | 000,065,024 | —- | C] () – C:\WINDOWS\System32\FLT_ffdshow.dll
[2011/02/07 18:45:52 | 000,080,896 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2011/02/07 18:39:02 | 004,166,551 | —- | C] () – C:\WINDOWS\System32\ffmpeg.dll
[2011/01/31 19:01:20 | 000,000,036 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\housecall.guid.cache
[2011/01/30 19:47:39 | 000,000,049 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2011/01/15 01:04:40 | 000,123,392 | —- | C] () – C:\WINDOWS\System32\UnCasino5.exe
[2010/08/14 09:45:18 | 000,249,856 | —- | C] () – C:\WINDOWS\System32\dxr.dll
[2010/08/14 09:45:10 | 000,358,400 | —- | C] () – C:\WINDOWS\System32\gdsmux.exe
[2010/08/14 09:43:34 | 000,141,824 | —- | C] () – C:\WINDOWS\System32\mp4.dll
[2010/08/14 09:43:22 | 000,123,392 | —- | C] () – C:\WINDOWS\System32\ogm.dll
[2010/08/14 09:42:54 | 000,113,152 | —- | C] () – C:\WINDOWS\System32\dsmux.exe
[2010/08/14 09:42:48 | 000,154,112 | —- | C] () – C:\WINDOWS\System32\ts.dll
[2010/08/14 09:42:10 | 000,097,792 | —- | C] () – C:\WINDOWS\System32\avs.dll
[2010/08/14 09:42:06 | 000,137,728 | —- | C] () – C:\WINDOWS\System32\mkv2vfr.exe
[2010/08/14 09:41:54 | 000,093,184 | —- | C] () – C:\WINDOWS\System32\avss.dll
[2010/07/03 12:50:28 | 000,268,912 | R— | C] () – C:\WINDOWS\System32\drivers\SRS_SSCFilter_i386.sys
[2010/06/27 21:40:21 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/06/27 21:40:21 | 000,089,088 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/06/20 09:57:48 | 000,137,724 | —- | C] () – C:\WINDOWS\hpoins44.dat
[2010/06/20 09:57:48 | 000,000,512 | —- | C] () – C:\WINDOWS\hpomdl44.dat
[2010/05/24 20:33:00 | 004,670,829 | —- | C] () – C:\WINDOWS\System32\libavcodec.dll
[2010/05/24 20:33:00 | 000,877,385 | —- | C] () – C:\WINDOWS\System32\ff_x264.dll
[2010/05/24 20:33:00 | 000,248,320 | —- | C] () – C:\WINDOWS\System32\ff_kernelDeint.dll
[2010/05/24 20:33:00 | 000,139,944 | —- | C] () – C:\WINDOWS\System32\libmplayer.dll
[2010/05/24 20:33:00 | 000,116,736 | —- | C] () – C:\WINDOWS\System32\ff_tremor.dll
[2010/05/19 21:59:20 | 000,150,528 | —- | C] () – C:\WINDOWS\System32\mkx.dll
[2010/05/19 21:59:10 | 000,109,568 | —- | C] () – C:\WINDOWS\System32\avi.dll
[2010/05/19 21:55:40 | 000,080,384 | —- | C] () – C:\WINDOWS\System32\mkzlib.dll
[2010/05/19 21:55:36 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\mkunicode.dll
[2010/04/09 16:40:55 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2010/03/31 17:42:23 | 000,000,715 | —- | C] () – C:\WINDOWS\aolback.exe.lnk
[2010/02/27 16:46:10 | 000,000,214 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\burnaware.ini
[2010/01/12 21:32:52 | 000,115,267 | —- | C] () – C:\WINDOWS\System32\drivers\klin.dat
[2010/01/12 21:32:52 | 000,097,859 | —- | C] () – C:\WINDOWS\System32\drivers\klick.dat
[2009/12/29 20:57:04 | 000,004,212 | -H– | C] () – C:\WINDOWS\System32\zllictbl.dat
[2009/10/24 23:52:51 | 000,005,606 | —- | C] () – C:\WINDOWS\System32\stci.dll
[2009/09/09 18:01:40 | 000,027,675 | —- | C] () – C:\WINDOWS\System32\drivers\klopp.dat
[2009/08/11 22:21:26 | 000,087,552 | —- | C] () – C:\WINDOWS\System32\ac3config.exe
[2009/07/29 01:20:14 | 000,057,252 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2009/07/13 13:17:24 | 000,160,768 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/06/20 01:38:04 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2009/06/20 00:31:19 | 000,168,448 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2009/06/20 00:31:18 | 000,000,038 | —- | C] () – C:\WINDOWS\avisplitter.ini
[2009/06/16 12:34:11 | 000,160,963 | —- | C] () – C:\WINDOWS\System32\drivers\gtipdsp.bin
[2009/06/16 12:34:11 | 000,160,951 | —- | C] () – C:\WINDOWS\System32\drivers\gtipdsp_.bin
[2009/06/16 12:34:11 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\CoInst.dll
[2009/06/16 12:34:10 | 000,016,908 | —- | C] () – C:\WINDOWS\wwdslcfg.ini
[2009/06/15 08:40:11 | 000,000,552 | —- | C] () – C:\WINDOWS\System32\d3d8caps.dat
[2009/06/15 08:38:09 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2009/06/15 07:58:23 | 000,092,985 | —- | C] () – C:\WINDOWS\VGAsetup.ini
[2009/06/15 07:57:50 | 000,208,896 | R— | C] () – C:\WINDOWS\Progress.exe
[2009/06/15 07:57:49 | 000,049,152 | R— | C] () – C:\WINDOWS\InstFunc.exe
[2009/06/15 07:57:41 | 000,065,536 | R— | C] () – C:\WINDOWS\System32\sis760.bin
[2009/06/15 07:57:41 | 000,065,536 | R— | C] () – C:\WINDOWS\System32\sis741.bin
[2009/06/15 07:57:41 | 000,049,152 | R— | C] () – C:\WINDOWS\System32\sis660.bin
[2009/06/15 07:57:32 | 000,128,191 | —- | C] () – C:\WINDOWS\System32\VGAunistlog.ini
[2009/06/15 07:53:04 | 000,049,152 | R— | C] () – C:\WINDOWS\System32\ChCfg.exe
[2009/06/15 07:51:27 | 000,016,960 | —- | C] () – C:\WINDOWS\Ascd_log.ini
[2009/06/15 07:51:05 | 000,005,810 | R— | C] () – C:\WINDOWS\System32\drivers\ASACPI.sys
[2009/06/15 07:50:55 | 000,010,288 | —- | C] () – C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2009/06/13 21:08:40 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2009/06/13 21:05:50 | 000,276,560 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2009/06/13 01:33:46 | 000,000,136 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\fusioncache.dat
[2009/06/13 01:26:41 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2009/06/13 01:18:45 | 000,034,284 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2009/06/07 17:24:04 | 000,180,224 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2009/01/10 23:15:44 | 000,159,744 | —- | C] () – C:\WINDOWS\System32\mmfinfo.dll
[2008/11/06 16:37:32 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2008/09/17 23:55:00 | 001,724,416 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2008/09/17 23:55:00 | 001,657,376 | —- | C] () – C:\WINDOWS\System32\nwiz.exe
[2008/09/17 23:55:00 | 001,503,232 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2008/09/17 23:55:00 | 001,346,080 | —- | C] () – C:\WINDOWS\System32\nvdspsch.exe
[2008/09/17 23:55:00 | 001,101,824 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2008/09/17 23:55:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2008/09/17 23:55:00 | 000,449,056 | —- | C] () – C:\WINDOWS\System32\nvappbar.exe
[2008/09/17 23:55:00 | 000,436,768 | —- | C] () – C:\WINDOWS\System32\keystone.exe
[2008/09/17 23:55:00 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2007/10/13 10:30:20 | 000,000,137 | —- | C] () – C:\WINDOWS\System32\Registration.ini
[2005/03/22 23:38:24 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2005/03/22 23:38:24 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/10 12:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/10 12:00:00 | 000,444,690 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/10 12:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/10 12:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/10 12:00:00 | 000,072,456 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/10 12:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/10 12:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/10 12:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/10 12:00:00 | 000,001,788 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2004/08/10 12:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/08/10 05:11:42 | 000,185,856 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A2947BEA
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34

< End of report >

Here is an other scan but this time with lop and purity boxes ticked .

OTL logfile created on: 14/04/2011 22:55:20 - Run 2
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 47.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 80.00% Paging File free
Paging file location(s): C:\pagefile.sys 2302 3647 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.05 Gb Total Space | 11.33 Gb Free Space | 7.60% Space Free | Partition Type: NTFS

Computer Name: USER-50C5ECAA5B | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\Desktop\OTL (2).exe (OldTimer Tools)
PRC - C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
PRC - C:\Program Files\ThreatFire\TFService.exe (PC Tools)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software)
PRC - C:\WINDOWS\system32\wbsecsvc.exe (Integrated System Solution Corp.)
PRC - C:\WINDOWS\system32\slserv.exe (Smart Link)
PRC - C:\WINDOWS\system32\slrundll.exe (Smart Link)
PRC - C:\WINDOWS\wanmpsvc.exe (America Online, Inc.)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Administrator\Desktop\OTL (2).exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – File not found
SRV - (NMIndexingService) – File not found
SRV - (HidServ) – File not found
SRV - (AVP) – C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
SRV - (ThreatFire) – C:\Program Files\ThreatFire\TFService.exe (PC Tools)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (StarWindServiceAE) – C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (Rocket Division Software)
SRV - (AOL ACS) – C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (AOL LLC)
SRV - (wbsecsvc) – C:\WINDOWS\System32\wbsecsvc.exe (Integrated System Solution Corp.)
SRV - (SLService) – C:\WINDOWS\System32\slserv.exe (Smart Link)
SRV - (WANMiniportService) WAN Miniport (ATW) – C:\WINDOWS\wanmpsvc.exe (America Online, Inc.)


========== Driver Services (SafeList) ==========

DRV - (sptd) – C:\WINDOWS\System32\Drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (Avgfwfd) – C:\WINDOWS\system32\drivers\avgfwdx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgfwdx) – C:\WINDOWS\system32\drivers\avgfwdx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Tcpip6) – C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (TfSysMon) – C:\WINDOWS\system32\drivers\TfSysMon.sys (PC Tools)
DRV - (TfNetMon) – C:\WINDOWS\system32\drivers\TfNetMon.sys (PC Tools)
DRV - (TfFsMon) – C:\WINDOWS\system32\drivers\TfFsMon.sys (PC Tools)
DRV - (SRS_SSCFilter) SRS Labs Audio Sandbox (WDM) – C:\WINDOWS\system32\drivers\SRS_SSCFilter_i386.sys ()
DRV - (KLIF) – C:\WINDOWS\system32\drivers\klif.sys (Kaspersky Lab)
DRV - (klbg) – C:\WINDOWS\system32\drivers\klbg.sys (Kaspersky Lab)
DRV - (klmouflt) – C:\WINDOWS\system32\drivers\klmouflt.sys (Kaspersky Lab)
DRV - (klim5) – C:\WINDOWS\system32\drivers\klim5.sys (Kaspersky Lab)
DRV - (kl1) – C:\WINDOWS\system32\drivers\kl1.sys (Kaspersky Lab)
DRV - (fssfltr) – C:\WINDOWS\system32\drivers\fssfltr_tdi.sys (Microsoft Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (SiSkp) – C:\WINDOWS\system32\drivers\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (SiS315) – C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (SiSGbeXP) – C:\WINDOWS\system32\drivers\SiSGbeXP.sys (Silicon Integrated Systems Corp.)
DRV - (W35UND) – C:\WINDOWS\system32\drivers\W35UND.SYS (Integrated System Solution Corp.)
DRV - (wbsecdrv) – C:\WINDOWS\system32\drivers\wbsecdrv.sys (Winbond)
DRV - (MTsensor) – C:\WINDOWS\system32\drivers\ASACPI.sys ()
DRV - (nm) – C:\WINDOWS\system32\drivers\nmnt.sys (Microsoft Corporation)
DRV - (SlNtHal) – C:\WINDOWS\system32\drivers\slnthal.sys (Smart Link)
DRV - (SlWdmSup) – C:\WINDOWS\system32\drivers\slwdmsup.sys (Smart Link)
DRV - (Slntamr) – C:\WINDOWS\system32\drivers\slntamr.sys (Smart Link)
DRV - (NtMtlFax) – C:\WINDOWS\system32\drivers\ntmtlfax.sys (Smart Link)
DRV - (Mtlmnt5) – C:\WINDOWS\system32\drivers\mtlmnt5.sys (Smart Link)
DRV - (RecAgent) – C:\WINDOWS\system32\DRIVERS\RecAgent.sys (Smart Link)
DRV - (Mtlstrm) – C:\WINDOWS\system32\drivers\mtlstrm.sys (Smart Link)
DRV - (alcan5wn) SpeedTouch USB ADSL PPP Networking Driver (NDISWAN) – C:\WINDOWS\system32\drivers\alcan5wn.sys (THOMSON)
DRV - (alcaudsl) – C:\WINDOWS\system32\drivers\alcaudsl.sys (THOMSON)
DRV - (wanusb) – C:\WINDOWS\system32\drivers\gwausb.sys (GlobespanVirata Inc.)
DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=937811"
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.co.uk/"
FF - prefs.js..extensions.enabledItems: {B042753D-F57E-4e8e-A01B-7379A6D4CEFB}:1.17
FF - prefs.js..extensions.enabledItems: [removed]:2.4.1
FF - prefs.js..extensions.enabledItems: {E0B8C461-F8FB-49b4-8373-FE32E9252800}:4.0.0.106602
FF - prefs.js..extensions.enabledItems: [removed]:1.2.2
FF - prefs.js..extensions.enabledItems: [removed]:4.1.8
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:9.0.0.736
FF - prefs.js..extensions.enabledItems: [removed]:2.1.1
FF - prefs.js..extensions.enabledItems: [removed]:2.0.0.20091223
FF - prefs.js..extensions.enabledItems: {64161300-e22b-11db-8314-0800200c9a66}:0.9.5.8
FF - prefs.js..extensions.enabledItems: {dc572301-7619-498c-a57d-39143191b318}:0.3.8.2
FF - prefs.js..extensions.enabledItems: [removed]:1.4
FF - prefs.js..extensions.enabledItems: [removed]:3.9.2
FF - prefs.js..extensions.enabledItems: [removed]:1.3.2
FF - prefs.js..extensions.enabledItems: [removed]:1.19.1
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..keyword.URL: "http://uk.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=937811&p="
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.type: 0


FF - HKLM\software\mozilla\Firefox\extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG8\Firefox
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/02/21 14:13:19 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/05 17:39:30 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\THBExt [2011/04/10 14:41:58 | 000,000,000 | —D | M]

[2009/06/27 02:55:30 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2009/06/27 02:55:30 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions\[removed]
[2011/04/06 17:38:11 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions
[2010/12/30 23:09:45 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/02/12 16:53:57 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/12/30 23:10:47 | 000,000,000 | —D | M] (Speed Dial) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}
[2009/12/29 21:25:49 | 000,000,000 | —D | M] (BitComet Video Downloader) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}
[2009/10/13 16:30:48 | 000,000,000 | —D | M] ("Tab Mix Plus") – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{dc572301-7619-498c-a57d-39143191b318}
[2010/12/30 23:10:11 | 000,000,000 | —D | M] (Evernote Web Clipper) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}
[2010/12/30 23:09:46 | 000,000,000 | —D | M] (CheckPlaces) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/12/30 23:19:11 | 000,000,000 | —D | M] (British English Dictionary) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/12/30 22:25:05 | 000,000,000 | —D | M] (Fast Youtube Downloader) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/12/30 23:12:27 | 000,000,000 | —D | M] ("Xmarks") – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/12/30 22:35:14 | 000,000,000 | —D | M] (Spell Checker) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/12/30 23:09:46 | 000,000,000 | —D | M] (Read It Later) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/12/30 22:25:10 | 000,000,000 | —D | M] (Reframe It) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/12/30 23:11:15 | 000,000,000 | —D | M] (FastestFox) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2011/04/06 16:34:42 | 000,000,000 | —D | M] (Real Hide IP) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/12/30 23:09:47 | 000,000,000 | —D | M] (The Search Sidebar) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\extensions\[removed]
[2010/01/17 00:49:40 | 000,002,255 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0a6g1p7l.default\searchplugins\askcom.xml
[2011/04/06 16:56:54 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/07/01 20:49:55 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2011/03/13 16:07:57 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2010/01/12 21:33:20 | 000,000,000 | —D | M] (Kaspersky URL Advisor) – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2010/07/01 20:48:44 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2009/07/17 09:40:12 | 000,704,512 | —- | M] (BitComet) – C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2011/02/02 22:40:24 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/12/03 18:47:02 | 000,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/12/03 18:47:02 | 000,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/12/03 18:47:02 | 000,000,769 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/12/03 18:47:02 | 000,001,135 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2011/04/13 13:21:50 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (AOL Toolbar Launcher) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Broadband Toolbar 5.0\aoltb.dll (AOL LLC)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O3 - HKLM\..\Toolbar: (AOL Broadband Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Broadband Toolbar 5.0\aoltb.dll (AOL LLC)
O3 - HKCU\..\Toolbar\WebBrowser: (AOL Broadband Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Broadband Toolbar 5.0\aoltb.dll (AOL LLC)
O4 - HKLM..\Run: [avp] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\PeerGuardian.lnk = C:\Program Files\PeerGuardian2\pg2.exe (Phoenix Labs)
O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\µTorrent.lnk = C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &AOL Toolbar Search - c:\Program Files\AOL\AOL Broadband Toolbar 5.0\resources\en-GB\local\search.html ()
O8 - Extra context menu item: &ieSpell Options - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Check &Spelling - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Lookup on Merriam Webster - C:\Program Files\ieSpell\Merriam Webster.HTM ()
O8 - Extra context menu item: Lookup on Wikipedia - C:\Program Files\ieSpell\wikipedia.HTM ()
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra Button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O9 - Extra Button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} https://moneymanager.egg.com/Pinsafe/accounttracking.cab (Egg Money Manager Digital Safe)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1247340977328 (WUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx1.hotmail.com/mail/w4/pr01/photo…ol/MSNPUpld.cab (Windows Live Hotmail Photo Upload Tool)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\kloehk.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab)
O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/13 01:23:05 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/04/14 17:01:33 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/04/14 16:58:42 | 000,050,688 | —- | C] (Atribune.org) – C:\Documents and Settings\Administrator\Desktop\ATF-Cleaner (1).exe
[2011/04/13 13:10:51 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/04/13 13:10:51 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/04/13 13:10:51 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/04/13 13:10:51 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/04/13 13:10:12 | 000,000,000 | —D | C] – C:\Qoobox
[2011/04/13 11:24:10 | 000,000,000 | —D | C] – C:\_OTL
[2011/04/12 16:43:17 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL (2).exe
[2011/04/12 16:32:58 | 001,377,112 | —- | C] (Kaspersky Lab ZAO) – C:\Documents and Settings\Administrator\Desktop\TDSSKiller.exe
[2011/04/11 17:31:14 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/04/11 17:20:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\QuickScan
[2011/04/06 18:33:09 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Softplicity
[2011/04/06 16:13:20 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\RealHideIP
[2011/04/06 16:13:20 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\RealHideIP
[2011/04/06 16:10:56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Real Hide IP
[2011/04/06 16:09:46 | 000,000,000 | —D | C] – C:\Program Files\RealHideIP
[2011/04/05 21:49:26 | 000,000,000 | —D | C] – C:\Program Files\Windows Live SkyDrive
[2011/04/05 21:38:39 | 001,146,696 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\Administrator\Desktop\wlsetup-custom.exe
[2011/04/02 16:30:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\PeerGuardian 2
[2011/04/02 16:30:16 | 000,000,000 | —D | C] – C:\Program Files\PeerGuardian2

========== Files - Modified Within 30 Days ==========

[2011/04/14 23:56:31 | 000,001,008 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-789336058-1326574676-839522115-500UA.job
[2011/04/14 22:30:36 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/04/14 21:11:54 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/04/14 18:20:42 | 000,000,438 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{FFFA57F7-E474-4C3A-9B66-7535F0F662CF}.job
[2011/04/14 17:04:26 | 000,000,049 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2011/04/14 16:58:14 | 000,050,688 | —- | M] (Atribune.org) – C:\Documents and Settings\Administrator\Desktop\ATF-Cleaner (1).exe
[2011/04/14 16:40:46 | 000,012,598 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/04/13 16:03:18 | 000,000,811 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/04/13 13:21:50 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2011/04/13 11:46:38 | 004,320,019 | R— | M] () – C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
[2011/04/12 16:43:53 | 000,160,768 | —- | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/12 16:42:49 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL (2).exe
[2011/04/11 18:25:15 | 000,013,066 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\hijackthis11.4.11
[2011/04/10 01:56:15 | 000,000,956 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-789336058-1326574676-839522115-500Core.job
[2011/04/06 18:45:28 | 000,011,566 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\red.jpg
[2011/04/06 16:10:57 | 000,000,713 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Real Hide IP.lnk
[2011/04/05 21:38:42 | 001,146,696 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Administrator\Desktop\wlsetup-custom.exe
[2011/04/04 17:00:10 | 000,115,267 | —- | M] () – C:\WINDOWS\System32\drivers\klin.dat
[2011/04/04 17:00:10 | 000,097,859 | —- | M] () – C:\WINDOWS\System32\drivers\klick.dat
[2011/04/02 16:30:21 | 000,000,631 | —- | M] () – C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\PeerGuardian.lnk
[2011/03/31 19:53:00 | 000,134,496 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\prick-award-demint.jpg
[2011/03/29 22:02:01 | 000,000,791 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/03/27 10:31:11 | 000,444,690 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/03/27 10:31:11 | 000,072,456 | —- | M] () – C:\WINDOWS\System32\perfc009.dat

========== Files Created - No Company Name ==========

[2011/04/13 13:10:51 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/04/13 13:10:51 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/04/13 13:10:51 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/04/13 11:46:37 | 004,320,019 | R— | C] () – C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
[2011/04/11 18:25:15 | 000,013,066 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\hijackthis11.4.11
[2011/04/06 18:45:38 | 000,011,566 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\red.jpg
[2011/04/06 16:10:57 | 000,000,713 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Real Hide IP.lnk
[2011/04/02 16:30:21 | 000,000,631 | —- | C] () – C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\PeerGuardian.lnk
[2011/03/31 19:53:20 | 000,134,496 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\prick-award-demint.jpg
[2011/03/29 22:02:01 | 000,000,791 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/02/21 15:03:50 | 000,016,922 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2011/02/07 19:00:08 | 001,529,856 | —- | C] () – C:\WINDOWS\System32\ff_samplerate.dll
[2011/02/07 19:00:08 | 000,925,667 | —- | C] () – C:\WINDOWS\System32\ffmpegmt.dll
[2011/02/07 19:00:08 | 000,721,798 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2011/02/07 19:00:08 | 000,336,384 | —- | C] () – C:\WINDOWS\System32\ff_libfaad2.dll
[2011/02/07 19:00:08 | 000,324,096 | —- | C] () – C:\WINDOWS\System32\TomsMoComp_ff.dll
[2011/02/07 19:00:08 | 000,216,576 | —- | C] () – C:\WINDOWS\System32\ff_libdts.dll
[2011/02/07 19:00:08 | 000,151,552 | —- | C] () – C:\WINDOWS\System32\ff_libmad.dll
[2011/02/07 19:00:08 | 000,145,408 | —- | C] () – C:\WINDOWS\System32\libmpeg2_ff.dll
[2011/02/07 19:00:08 | 000,140,800 | —- | C] () – C:\WINDOWS\System32\ff_unrar.dll
[2011/02/07 19:00:08 | 000,121,856 | —- | C] () – C:\WINDOWS\System32\ff_liba52.dll
[2011/02/07 19:00:08 | 000,100,864 | —- | C] () – C:\WINDOWS\System32\ff_wmv9.dll
[2011/02/07 19:00:08 | 000,065,024 | —- | C] () – C:\WINDOWS\System32\FLT_ffdshow.dll
[2011/02/07 18:45:52 | 000,080,896 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2011/02/07 18:39:02 | 004,166,551 | —- | C] () – C:\WINDOWS\System32\ffmpeg.dll
[2011/01/31 19:01:20 | 000,000,036 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\housecall.guid.cache
[2011/01/30 19:47:39 | 000,000,049 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2011/01/15 01:04:40 | 000,123,392 | —- | C] () – C:\WINDOWS\System32\UnCasino5.exe
[2010/08/14 09:45:18 | 000,249,856 | —- | C] () – C:\WINDOWS\System32\dxr.dll
[2010/08/14 09:45:10 | 000,358,400 | —- | C] () – C:\WINDOWS\System32\gdsmux.exe
[2010/08/14 09:43:34 | 000,141,824 | —- | C] () – C:\WINDOWS\System32\mp4.dll
[2010/08/14 09:43:22 | 000,123,392 | —- | C] () – C:\WINDOWS\System32\ogm.dll
[2010/08/14 09:42:54 | 000,113,152 | —- | C] () – C:\WINDOWS\System32\dsmux.exe
[2010/08/14 09:42:48 | 000,154,112 | —- | C] () – C:\WINDOWS\System32\ts.dll
[2010/08/14 09:42:10 | 000,097,792 | —- | C] () – C:\WINDOWS\System32\avs.dll
[2010/08/14 09:42:06 | 000,137,728 | —- | C] () – C:\WINDOWS\System32\mkv2vfr.exe
[2010/08/14 09:41:54 | 000,093,184 | —- | C] () – C:\WINDOWS\System32\avss.dll
[2010/07/03 12:50:28 | 000,268,912 | R— | C] () – C:\WINDOWS\System32\drivers\SRS_SSCFilter_i386.sys
[2010/06/27 21:40:21 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/06/27 21:40:21 | 000,089,088 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/06/20 09:57:48 | 000,137,724 | —- | C] () – C:\WINDOWS\hpoins44.dat
[2010/06/20 09:57:48 | 000,000,512 | —- | C] () – C:\WINDOWS\hpomdl44.dat
[2010/05/24 20:33:00 | 004,670,829 | —- | C] () – C:\WINDOWS\System32\libavcodec.dll
[2010/05/24 20:33:00 | 000,877,385 | —- | C] () – C:\WINDOWS\System32\ff_x264.dll
[2010/05/24 20:33:00 | 000,248,320 | —- | C] () – C:\WINDOWS\System32\ff_kernelDeint.dll
[2010/05/24 20:33:00 | 000,139,944 | —- | C] () – C:\WINDOWS\System32\libmplayer.dll
[2010/05/24 20:33:00 | 000,116,736 | —- | C] () – C:\WINDOWS\System32\ff_tremor.dll
[2010/05/19 21:59:20 | 000,150,528 | —- | C] () – C:\WINDOWS\System32\mkx.dll
[2010/05/19 21:59:10 | 000,109,568 | —- | C] () – C:\WINDOWS\System32\avi.dll
[2010/05/19 21:55:40 | 000,080,384 | —- | C] () – C:\WINDOWS\System32\mkzlib.dll
[2010/05/19 21:55:36 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\mkunicode.dll
[2010/04/09 16:40:55 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2010/03/31 17:42:23 | 000,000,715 | —- | C] () – C:\WINDOWS\aolback.exe.lnk
[2010/02/27 16:46:10 | 000,000,214 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\burnaware.ini
[2010/01/12 21:32:52 | 000,115,267 | —- | C] () – C:\WINDOWS\System32\drivers\klin.dat
[2010/01/12 21:32:52 | 000,097,859 | —- | C] () – C:\WINDOWS\System32\drivers\klick.dat
[2009/12/29 20:57:04 | 000,004,212 | -H– | C] () – C:\WINDOWS\System32\zllictbl.dat
[2009/10/24 23:52:51 | 000,005,606 | —- | C] () – C:\WINDOWS\System32\stci.dll
[2009/09/09 18:01:40 | 000,027,675 | —- | C] () – C:\WINDOWS\System32\drivers\klopp.dat
[2009/08/11 22:21:26 | 000,087,552 | —- | C] () – C:\WINDOWS\System32\ac3config.exe
[2009/07/29 01:20:14 | 000,057,252 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2009/07/13 13:17:24 | 000,160,768 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/06/20 01:38:04 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2009/06/20 00:31:19 | 000,168,448 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2009/06/20 00:31:18 | 000,000,038 | —- | C] () – C:\WINDOWS\avisplitter.ini
[2009/06/16 12:34:11 | 000,160,963 | —- | C] () – C:\WINDOWS\System32\drivers\gtipdsp.bin
[2009/06/16 12:34:11 | 000,160,951 | —- | C] () – C:\WINDOWS\System32\drivers\gtipdsp_.bin
[2009/06/16 12:34:11 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\CoInst.dll
[2009/06/16 12:34:10 | 000,016,908 | —- | C] () – C:\WINDOWS\wwdslcfg.ini
[2009/06/15 08:40:11 | 000,000,552 | —- | C] () – C:\WINDOWS\System32\d3d8caps.dat
[2009/06/15 08:38:09 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2009/06/15 07:58:23 | 000,092,985 | —- | C] () – C:\WINDOWS\VGAsetup.ini
[2009/06/15 07:57:50 | 000,208,896 | R— | C] () – C:\WINDOWS\Progress.exe
[2009/06/15 07:57:49 | 000,049,152 | R— | C] () – C:\WINDOWS\InstFunc.exe
[2009/06/15 07:57:41 | 000,065,536 | R— | C] () – C:\WINDOWS\System32\sis760.bin
[2009/06/15 07:57:41 | 000,065,536 | R— | C] () – C:\WINDOWS\System32\sis741.bin
[2009/06/15 07:57:41 | 000,049,152 | R— | C] () – C:\WINDOWS\System32\sis660.bin
[2009/06/15 07:57:32 | 000,128,191 | —- | C] () – C:\WINDOWS\System32\VGAunistlog.ini
[2009/06/15 07:53:04 | 000,049,152 | R— | C] () – C:\WINDOWS\System32\ChCfg.exe
[2009/06/15 07:51:27 | 000,016,960 | —- | C] () – C:\WINDOWS\Ascd_log.ini
[2009/06/15 07:51:05 | 000,005,810 | R— | C] () – C:\WINDOWS\System32\drivers\ASACPI.sys
[2009/06/15 07:50:55 | 000,010,288 | —- | C] () – C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2009/06/13 21:08:40 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2009/06/13 21:05:50 | 000,276,560 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2009/06/13 01:33:46 | 000,000,136 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\fusioncache.dat
[2009/06/13 01:26:41 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2009/06/13 01:18:45 | 000,034,284 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2009/06/07 17:24:04 | 000,180,224 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2009/01/10 23:15:44 | 000,159,744 | —- | C] () – C:\WINDOWS\System32\mmfinfo.dll
[2008/11/06 16:37:32 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2008/09/17 23:55:00 | 001,724,416 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2008/09/17 23:55:00 | 001,657,376 | —- | C] () – C:\WINDOWS\System32\nwiz.exe
[2008/09/17 23:55:00 | 001,503,232 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2008/09/17 23:55:00 | 001,346,080 | —- | C] () – C:\WINDOWS\System32\nvdspsch.exe
[2008/09/17 23:55:00 | 001,101,824 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2008/09/17 23:55:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2008/09/17 23:55:00 | 000,449,056 | —- | C] () – C:\WINDOWS\System32\nvappbar.exe
[2008/09/17 23:55:00 | 000,436,768 | —- | C] () – C:\WINDOWS\System32\keystone.exe
[2008/09/17 23:55:00 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2007/10/13 10:30:20 | 000,000,137 | —- | C] () – C:\WINDOWS\System32\Registration.ini
[2005/03/22 23:38:24 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2005/03/22 23:38:24 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/10 12:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/10 12:00:00 | 000,444,690 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/10 12:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/10 12:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/10 12:00:00 | 000,072,456 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/10 12:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/10 12:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/10 12:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/10 12:00:00 | 000,001,788 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2004/08/10 12:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/08/10 05:11:42 | 000,185,856 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll

========== LOP Check ==========

[2010/11/10 23:25:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\.BitTornado
[2010/04/07 22:07:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\acccore
[2009/08/23 22:26:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Camfrog
[2009/12/29 20:58:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\CheckPoint
[2010/11/10 23:56:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\deluge
[2011/02/09 18:14:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\ElevatedDiagnostics
[2011/01/28 16:38:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\FrostWire
[2010/02/28 00:38:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\GetRightToGo
[2009/12/31 20:40:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\GrabPro
[2009/07/25 22:18:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\ieSpell
[2009/12/31 20:55:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\ImgBurn
[2010/01/21 22:50:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\InfraRecorder
[2009/10/02 18:53:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\IObit
[2010/01/01 13:30:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Launchy
[2009/06/20 02:36:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\MSNInstaller
[2009/07/01 01:46:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\NotMyIp
[2009/06/18 00:47:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Opera
[2010/01/10 16:33:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Orbit
[2011/03/05 20:31:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Otto
[2011/04/11 17:20:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\QuickScan
[2011/04/06 18:33:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Softplicity
[2009/12/30 02:21:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\TigerPlayer
[2011/04/14 21:14:47 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\uTorrent
[2010/06/18 18:30:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2010/03/25 18:26:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Bluetooth
[2009/07/31 18:33:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Cached Installations
[2010/07/03 12:44:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DFX
[2009/10/03 23:31:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GrabJPG
[2009/12/30 17:39:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Hagel Technologies
[2010/01/13 17:23:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Innovative Solutions
[2009/07/02 00:30:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\LightScribe
[2011/03/05 20:31:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Otto
[2009/07/31 18:33:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ParetoLogic
[2010/07/03 12:55:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SRS Labs
[2010/09/12 11:47:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2011/03/05 20:02:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2011/04/14 18:20:42 | 000,000,438 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{FFFA57F7-E474-4C3A-9B66-7535F0F662CF}.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A2947BEA
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34

< End of report >