Spyware / Malware / Virus Removal

Searchqu

9 min read

Looking for the outcome? Ask AI

makosa Topic Starter

Post #1May 7, 2011, 3:37 AM UTC

Hi,
I have followed similar posting, and done most of what was asked to do, my case seems a bit peculiar though as I am worried, I use my laptop for ecommerce and internet banking, this has got me in a bad situation. I know I installed a file, by name "ilivid" mistakenly and this is the beginning of my restlessness.
I hope you can help me as you have done in past.:

OTL Log:

OTL logfile created on: 7/05/2011 1:03:41 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\mohammed\Downloads
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000c09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

3.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 32.00% Memory free
6.00 Gb Paging File | 3.00 Gb Available in Paging File | 54.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 285.89 Gb Total Space | 111.00 Gb Free Space | 38.83% Space Free | Partition Type: NTFS
Drive D: | 12.20 Gb Total Space | 1.60 Gb Free Space | 13.10% Space Free | Partition Type: NTFS

Computer Name: MOHAMMED | User Name: mohammed | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/05/07 12:34:17 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\mohammed\Downloads\OTL.exe
PRC - [2011/05/01 17:59:09 | 000,140,952 | —- | M] (Google Inc.) – C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe
PRC - [2011/04/26 15:06:06 | 000,161,336 | —- | M] (Google) – C:\Users\mohammed\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
PRC - [2011/04/25 13:42:56 | 000,490,112 | —- | M] (RealNetworks, Inc.) – C:\Program Files\Real\RealPlayer\realplay.exe
PRC - [2011/04/25 13:42:52 | 000,273,544 | —- | M] (RealNetworks, Inc.) – C:\Program Files\Real\RealPlayer\Update\realsched.exe
PRC - [2011/04/15 02:25:41 | 000,924,632 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011/03/24 22:30:12 | 001,115,536 | —- | M] (Discordia, LTD) – C:\Program Files\Windows iLivid Toolbar\Datamngr\datamngrUI.exe
PRC - [2011/03/23 08:50:43 | 000,235,168 | —- | M] (Adobe Systems, Inc.) – C:\Windows\System32\Macromed\Flash\FlashUtil10o_ActiveX.exe
PRC - [2011/03/02 00:47:56 | 007,832,440 | —- | M] (TeamViewer GmbH) – C:\Program Files\TeamViewer\Version6\TeamViewer.exe
PRC - [2011/03/02 00:47:56 | 002,296,696 | —- | M] (TeamViewer GmbH) – C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
PRC - [2011/02/05 10:55:48 | 001,092,808 | —- | M] (Xmarks.com) – C:\Program Files\Xmarks\IE Extension\xmarkssync.exe
PRC - [2011/01/25 08:07:44 | 022,504,120 | —- | M] (ooVoo LLC) – C:\Program Files\ooVoo\ooVoo.exe
PRC - [2010/11/20 22:17:09 | 002,616,320 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2010/10/14 16:27:38 | 000,092,216 | —- | M] (Hewlett-Packard Company) – C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe
PRC - [2010/10/02 04:57:54 | 000,335,872 | —- | M] (Search Truth Technologies) – C:\Program Files\Quran_AR\Quran_AR.exe
PRC - [2010/08/29 01:54:52 | 002,434,568 | —- | M] (Check Point Software Technologies LTD) – C:\Windows\System32\ZoneLabs\vsmon.exe
PRC - [2010/08/29 01:53:14 | 001,039,360 | —- | M] (Check Point Software Technologies LTD) – C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2010/08/27 19:34:02 | 000,493,032 | —- | M] (Check Point Software Technologies) – C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe
PRC - [2010/06/16 08:17:52 | 000,753,664 | —- | M] (Nokia) – C:\Program Files\Nokia\Nokia PC Suite 7\PcSync2.exe
PRC - [2010/06/14 14:07:14 | 000,615,936 | —- | M] (Nokia) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
PRC - [2010/06/07 12:51:24 | 000,138,752 | —- | M] (Nokia) – C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
PRC - [2010/03/23 14:53:06 | 000,495,708 | —- | M] (IDT, Inc.) – C:\Program Files\IDT\WDM\sttray.exe
PRC - [2010/03/23 14:53:06 | 000,229,458 | —- | M] (IDT, Inc.) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\stacsv.exe
PRC - [2009/10/27 09:15:02 | 000,120,832 | —- | M] (Nokia) – C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
PRC - [2009/09/10 10:15:42 | 000,870,672 | —- | M] (SonicWALL, Inc.) – C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
PRC - [2009/03/02 18:43:08 | 000,081,920 | —- | M] (Andrea Electronics Corporation) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\AEstSrv.exe
PRC - [2009/01/08 13:00:56 | 000,915,000 | —- | M] (Hewlett-Packard) – C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
PRC - [2008/05/22 14:05:06 | 000,474,624 | —- | M] (Nokia Corporation) – C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
PRC - [2005/07/16 07:48:33 | 000,479,232 | —- | M] (Google Inc.) – C:\Program Files\Google\Gmail Notifier\gnotify.exe

========== Modules (SafeList) ==========

MOD - [2011/05/07 12:34:17 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\mohammed\Downloads\OTL.exe
MOD - [2011/04/24 16:46:23 | 000,632,656 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.5592_none_d09196c24426e2d
4\msvcr80.dll
MOD - [2011/04/24 16:46:23 | 000,554,832 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.5592_none_d09196c24426e2d
4\msvcp80.dll
MOD - [2010/11/20 21:55:09 | 001,680,896 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
MOD - [2010/08/27 19:34:08 | 000,640,488 | —- | M] (Check Point Software Technologies) – C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
MOD - [2010/08/27 19:33:58 | 000,562,664 | —- | M] (Check Point Software Technologies) – C:\Program Files\CheckPoint\ZAForceField\AK\icsak.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] – – (scan)
SRV - [2011/03/02 00:47:56 | 002,296,696 | —- | M] (TeamViewer GmbH) [Auto | Running] – C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe – (TeamViewer6)
SRV - [2011/01/26 01:11:24 | 000,654,848 | —- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe – (FLEXnet Licensing Service)
SRV - [2010/10/14 16:27:38 | 000,092,216 | —- | M] (Hewlett-Packard Company) [Auto | Running] – C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe – (HPDrvMntSvc.exe)
SRV - [2010/08/29 01:54:52 | 002,434,568 | —- | M] (Check Point Software Technologies LTD) [Auto | Running] – C:\Windows\System32\ZoneLabs\vsmon.exe – (vsmon)
SRV - [2010/08/27 19:34:02 | 000,493,032 | —- | M] (Check Point Software Technologies) [Auto | Running] – C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe – (IswSvc)
SRV - [2010/07/08 13:23:30 | 001,343,400 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\Wat\WatAdminSvc.exe – (WatAdminSvc)
SRV - [2010/06/26 03:07:20 | 000,117,264 | —- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] – C:\Program Files\WinPcap\rpcapd.exe – (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - [2010/06/14 14:07:14 | 000,615,936 | —- | M] (Nokia) [On_Demand | Running] – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe – (ServiceLayer)
SRV - [2010/03/23 14:53:06 | 000,229,458 | —- | M] (IDT, Inc.) [Auto | Running] – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\stacsv.exe – (STacSV)
SRV - [2009/07/14 11:16:13 | 000,025,088 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\sensrsvc.dll – (SensrSvc)
SRV - [2009/07/14 11:15:41 | 000,680,960 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2009/03/02 18:43:08 | 000,081,920 | —- | M] (Andrea Electronics Corporation) [Auto | Running] – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\AEstSrv.exe – (AESTFilters)

========== Driver Services (SafeList) ==========

DRV - [2011/01/07 14:56:12 | 000,044,416 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\dc3d.sys – (dc3d)
DRV - [2010/11/20 20:24:41 | 000,052,224 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV - [2010/11/20 20:06:36 | 000,117,760 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rmcast.sys – (RMCAST)
DRV - [2010/11/20 19:59:44 | 000,035,968 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\winusb.sys – (WinUsb)
DRV - [2010/08/27 19:33:54 | 000,035,568 | —- | M] (Check Point Software Technologies) [Kernel | On_Demand | Running] – C:\Program Files\CheckPoint\ZAForceField\AK\icsak.sys – (icsak)
DRV - [2010/08/27 19:33:54 | 000,026,352 | —- | M] (Check Point Software Technologies) [Kernel | Auto | Running] – C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys – (ISWKL)
DRV - [2010/07/16 15:03:36 | 000,025,656 | —- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\hpdskflt.sys – (hpdskflt)
DRV - [2010/07/16 15:03:18 | 000,035,896 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\Accelerometer.sys – (Accelerometer)
DRV - [2010/07/09 09:36:26 | 006,758,912 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\NETw5s32.sys – (NETw5s32) Intel®
DRV - [2010/06/26 03:07:14 | 000,035,088 | —- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] – C:\Windows\System32\drivers\npf.sys – (NPF)
DRV - [2010/06/09 18:16:06 | 000,465,496 | —- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] – C:\Windows\System32\drivers\vsdatant.sys – (Vsdatant)
DRV - [2010/03/23 14:53:06 | 000,423,424 | —- | M] (IDT, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\stwrt.sys – (STHDA)
DRV - [2010/02/26 13:32:58 | 000,008,192 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\usbser_lowerfltj.sys – (UsbserFilt)
DRV - [2010/02/26 13:32:46 | 000,008,192 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\usbser_lowerflt.sys – (upperdev)
DRV - [2010/02/26 13:32:44 | 000,022,528 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\ccdcmbo.sys – (nmwcdc)
DRV - [2010/02/26 13:32:44 | 000,018,176 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\ccdcmb.sys – (nmwcd)
DRV - [2009/10/12 17:15:28 | 000,305,168 | —- | M] (Kaspersky Lab) [File_System | System | Running] – C:\Windows\System32\drivers\klif.sys – (KLIF)
DRV - [2009/10/12 17:15:26 | 000,128,016 | —- | M] (Kaspersky Lab) [Kernel | System | Running] – C:\Windows\System32\drivers\kl1.sys – (kl1)
DRV - [2009/07/14 09:52:10 | 000,014,336 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\vwifimp.sys – (vwifimp)
DRV - [2009/07/14 09:45:33 | 000,083,456 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\serial.sys – (Serial)
DRV - [2009/07/14 08:02:51 | 004,231,168 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\netw5v32.sys – (netw5v32) Intel®
DRV - [2009/07/09 15:44:52 | 000,122,880 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\IntcHdmi.sys – (IntcHdmiAddService) Intel®
DRV - [2009/04/29 08:46:54 | 000,015,872 | —- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\HpqKbFiltr.sys – (HpqKbFiltr)
DRV - [2008/12/30 22:18:50 | 000,057,856 | —- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\enecir.sys – (enecir)
DRV - [2008/08/26 09:26:12 | 000,018,816 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\pccsmcfd.sys – (pccsmcfd)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.ninemsn.com.au/?ocid=OIE9HP
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.ninemsn.com.au/?ocid=OIE9HP
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ninemsn.com.au/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-au
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = F0 FA 4B D1 03 2E CB 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Web Search"
FF - prefs.js..browser.search.order.1: "Web Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.searchqu.com/406"
FF - prefs.js..keyword.URL: "http://www.searchqu.com/web?src=ffb&systemid;=406&q;="

FF - HKLM\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2011/03/15 17:37:01 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\ [2011/03/19 15:36:02 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/04/25 13:43:20 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/30 10:18:20 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/04/25 13:43:58 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/30 10:18:20 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/04/25 13:43:58 | 000,000,000 | —D | M]

[2011/05/06 12:10:06 | 000,000,000 | —D | M] (No name found) – C:\Users\mohammed\AppData\Roaming\Mozilla\Extensions
[2011/05/06 12:09:58 | 000,000,000 | —D | M] (No name found) – C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions
[2011/05/06 12:09:58 | 000,000,000 | —D | M] (Searchqu Toolbar) – C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
[2011/05/01 17:34:24 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011/05/01 14:45:32 | 000,000,000 | —D | M] ("Xmarks") – C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\[removed]
[2011/05/01 17:34:23 | 000,000,000 | —D | M] ("NetVideoHunter") – C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\[removed]
[2011/04/09 17:36:51 | 000,000,000 | —D | M] (No name found) – C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\avnvnqfb.default\extensions
[2011/04/09 17:36:46 | 000,000,000 | —D | M] (No name found) – C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\avnvnqfb.default\extensions\[removed]
[2011/05/06 12:10:06 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/07/06 18:20:31 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/09/08 14:46:26 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2011/02/24 09:40:33 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
File not found (No name found) –
[2011/04/25 13:43:20 | 000,000,000 | —D | M] (RealPlayer Browser Record Plugin) – C:\PROGRAMDATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT
() (No name found) – C:\USERS\MOHAMMED\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\82WFBVYL.DEFAULT\EXTENSIONS\{0538E3E3-7E9B-4D49-8831-A227C80A7AD3}.XPI
() (No name found) – C:\USERS\MOHAMMED\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\82WFBVYL.DEFAULT\EXTENSIONS\{4176DFF4-4698-11DE-BEEB-45DA55D89593}.XPI
() (No name found) – C:\USERS\MOHAMMED\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\82WFBVYL.DEFAULT\EXTENSIONS\{EF4E370E-D9F0-4E00-B93E-A4F274CFDD5A}.XPI
() (No name found) – C:\USERS\MOHAMMED\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\82WFBVYL.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\MOHAMMED\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\82WFBVYL.DEFAULT\EXTENSIONS\[removed]
[2011/04/15 02:26:02 | 000,142,296 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2011/02/24 09:40:08 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/03/30 21:19:50 | 000,111,960 | —- | M] ( ) – C:\Program Files\Mozilla Firefox\plugins\npww.dll
[2010/01/01 18:00:00 | 000,002,252 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2011/03/23 22:24:21 | 000,005,529 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\SearchquWebSearch.xml

O1 HOSTS File: ([2011/03/01 06:56:41 | 000,430,350 | R— | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 192.168.1.100 www.winit.local # local web at school
O1 - Hosts: 192.168.1.100 www.winit.local/welcome
O1 - Hosts: 192.168.1.100 www.winit.local/welcome/cms
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 14809 more lines…
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (ZoneAlarm Toolbar Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Windows iLivid Toolbar\ToolBar\searchqudtx.dll ()
O2 - BHO: (UrlHelper Class) - {A40DC6C5-79D0-4ca8-A185-8FF989AF1115} - C:\Program Files\Windows iLivid Toolbar\Datamngr\IEBHO.dll (Discordia, LTD)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll (Google Inc.)
O2 - BHO: (CutePDF Form Filler Helper) - {D41289F2-69C6-417B-897E-C653D677CBAF} - C:\Program Files\Acro Software\CutePDF Pro\CPFillerCo.dll (Acro Software Inc.)
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Windows iLivid Toolbar\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (ZoneAlarm Toolbar) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Toolbar) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O4 - HKLM..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe (Google Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [DATAMNGR] C:\Program Files\Windows iLivid Toolbar\Datamngr\datamngrUI.exe (Discordia, LTD)
O4 - HKLM..\Run: [Quran_AR] C:\Program Files\Quran_AR\Quran_AR.exe (Search Truth Technologies)
O4 - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (Hewlett-Packard)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [UCam_Menu] C:\Program Files\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePDIRShortCut] C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [Meebo Notifier] C:\Users\mohammed\AppData\Local\Meebo\Meebo Notifier\MeeboNotifier.exe (Meebo, Inc.)
O4 - HKCU..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 7\PcSync2.exe (Nokia)
O4 - HKCU..\Run: [ooVoo.exe] C:\Program Files\ooVoo\ooVoo.exe (ooVoo LLC)
O4 - HKCU..\Run: [Xmarks] C:\Program Files\Xmarks\IE Extension\xmarkssync.exe (Xmarks.com)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\Windows\System32\GPhotos.scr (Google Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: alipay.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: alipay.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: alisoft.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: alisoft.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: taobao.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: taobao.com ([]https in Trusted sites)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} https://picasaweb.google.com/s/v/71.37/uploader2.cab (UploadListView Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (C:\PROGRA~1\WI3C8A~1\Datamngr\datamngr.dll) - C:\Program Files\Windows iLivid Toolbar\Datamngr\datamngr.dll (Discordia, LTD)
O20 - AppInit_DLLs: (C:\PROGRA~1\WI3C8A~1\Datamngr\IEBHO.dll) - C:\Program Files\Windows iLivid Toolbar\Datamngr\IEBHO.dll (Discordia, LTD)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/11 07:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

========== Files/Folders - Created Within 30 Days ==========

[2011/05/06 12:19:41 | 000,000,000 | —D | C] – C:\Users\mohammed\AppData\Roaming\vlc
[2011/05/06 12:13:03 | 000,000,000 | —D | C] – C:\Users\mohammed\AppData\Local\Ilivid Player
[2011/05/06 12:09:22 | 000,000,000 | —D | C] – C:\Program Files\Windows iLivid Toolbar
[2011/05/06 12:08:48 | 000,000,000 | —D | C] – C:\Users\mohammed\AppData\Local\PackageAware
[2011/04/30 08:29:37 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Anonymous Browsing
[2011/04/30 08:29:36 | 000,000,000 | —D | C] – C:\Program Files\Anonymous Browsing
[2011/04/27 19:14:55 | 000,000,000 | —D | C] – C:\Users\mohammed\Desktop\Free Invoicing
[2011/04/25 13:43:24 | 000,000,000 | —D | C] – C:\Program Files\Common Files\xing shared
[2011/04/25 13:42:56 | 000,006,656 | —- | C] (RealNetworks, Inc.) – C:\Windows\System32\pndx5016.dll
[2011/04/25 13:42:56 | 000,005,632 | —- | C] (RealNetworks, Inc.) – C:\Windows\System32\pndx5032.dll
[2011/04/25 13:42:55 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Real
[2011/04/25 13:42:54 | 000,272,896 | —- | C] (Progressive Networks) – C:\Windows\System32\pncrt.dll
[2011/04/25 13:42:33 | 000,000,000 | —D | C] – C:\Program Files\Real
[2011/04/25 09:48:22 | 000,053,248 | —- | C] (Windows XP Bundled build C-Centric Single User) – C:\Windows\System32\CSVer.dll
[2011/04/22 18:13:47 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Quran_AR
[2011/04/18 16:53:08 | 000,000,000 | —D | C] – C:\Users\mohammed\AppData\Roaming\Wireshark
[2011/04/18 13:00:36 | 000,000,000 | —D | C] – C:\Program Files\Wireshark
[2011/04/18 12:19:16 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPcap
[2011/04/18 12:19:13 | 000,000,000 | —D | C] – C:\Program Files\WinPcap
[2011/04/18 07:21:09 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/04/18 07:21:08 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/04/18 07:21:07 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/04/18 07:19:23 | 001,164,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc42u.dll
[2011/04/18 07:19:23 | 001,137,664 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc42.dll
[2011/04/14 20:00:28 | 002,333,184 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2011/04/14 19:49:43 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dnscacheugc.exe
[2011/04/14 19:48:55 | 000,294,912 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\atmfd.dll
[2011/04/14 19:48:55 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\System32\atmlib.dll
[2011/04/14 19:44:46 | 000,191,488 | —- | C] (Microsoft Corporation) – C:\Windows\System32\FXSCOVER.exe
[2011/04/14 19:40:51 | 000,716,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript.dll
[2011/04/14 19:40:51 | 000,428,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vbscript.dll
[2011/04/13 15:18:56 | 000,000,000 | —D | C] – C:\Users\mohammed\Desktop\chinese
[2010/04/21 17:32:38 | 000,004,096 | —- | C] ( ) – C:\Windows\System32\IGFXDEVLib.dll
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Public\Documents\*.tmp files -> C:\Users\Public\Documents\*.tmp -> ]
[1 C:\Users\mohammed\Desktop\*.tmp files -> C:\Users\mohammed\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/05/07 13:04:08 | 000,000,890 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/05/07 11:15:12 | 000,000,036 | —- | M] () – C:\Users\mohammed\AppData\Local\housecall.guid.cache
[2011/05/07 11:08:37 | 000,000,868 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2011/05/07 10:58:13 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/05/07 10:24:17 | 000,014,832 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/05/07 10:24:17 | 000,014,832 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/05/07 10:16:43 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/05/07 10:15:09 | 2339,602,432 | -HS- | M] () – C:\hiberfil.sys
[2011/05/06 20:03:17 | 005,081,759 | —- | M] () – C:\Users\mohammed\Desktop\TvQuran.com_athkar_11.mp3
[2011/05/06 20:02:36 | 001,876,629 | —- | M] () – C:\Users\mohammed\Desktop\TvQuran.com_athkar_10.mp3
[2011/05/06 20:01:36 | 010,782,096 | —- | M] () – C:\Users\mohammed\Desktop\TvQuran.com_athkar_08.mp3
[2011/05/06 20:00:10 | 010,473,433 | —- | M] () – C:\Users\mohammed\Desktop\TvQuran.com_athkar_07.mp3
[2011/05/06 19:58:12 | 009,873,243 | —- | M] () – C:\Users\mohammed\Desktop\TvQuran.com_athkar_05.mp3
[2011/05/06 19:56:07 | 010,128,199 | —- | M] () – C:\Users\mohammed\Desktop\TvQuran.com_athkar_03.mp3
[2011/05/06 19:52:43 | 001,064,336 | —- | M] () – C:\Users\mohammed\Desktop\TvQuran.com_athkar_01.mp3
[2011/05/05 12:55:10 | 000,012,487 | —- | M] () – C:\Users\mohammed\Desktop\tranlist (5).pdf
[2011/05/05 10:18:45 | 000,146,701 | —- | M] () – C:\Users\mohammed\Desktop\royalportrait_5.jpg
[2011/05/04 17:08:59 | 000,032,471 | —- | M] () – C:\Users\mohammed\Desktop\Laguna-1-bed-Loft—Duplex_img_0_08.jpg
[2011/05/04 17:08:42 | 000,111,279 | —- | M] () – C:\Users\mohammed\Desktop\Laguna-1-bed-Loft—Duplex_img_0_03.gif
[2011/05/04 17:08:37 | 000,059,474 | —- | M] () – C:\Users\mohammed\Desktop\Laguna-1-bed-Loft—Duplex_img_0_04.gif
[2011/05/04 13:54:12 | 000,302,080 | —- | M] () – C:\Users\mohammed\Desktop\gmer.exe
[2011/05/02 12:53:49 | 000,028,160 | —- | M] () – C:\Users\mohammed\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/05/01 17:26:04 | 000,002,374 | —- | M] () – C:\Users\mohammed\Desktop\Google Chrome.lnk
[2011/04/30 14:25:43 | 000,631,364 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/04/30 14:25:43 | 000,111,456 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/04/30 10:18:26 | 000,001,096 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/04/29 07:37:47 | 000,000,868 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-552828051-1168902950-2987038348-1000Core1cc05ec841422d5.job
[2011/04/25 13:43:29 | 000,001,234 | —- | M] () – C:\Users\Public\Desktop\RealPlayer.lnk
[2011/04/25 13:42:56 | 000,006,656 | —- | M] (RealNetworks, Inc.) – C:\Windows\System32\pndx5016.dll
[2011/04/25 13:42:56 | 000,005,632 | —- | M] (RealNetworks, Inc.) – C:\Windows\System32\pndx5032.dll
[2011/04/25 13:42:54 | 000,272,896 | —- | M] (Progressive Networks) – C:\Windows\System32\pncrt.dll
[2011/04/25 09:43:18 | 000,000,000 | RHS- | M] () – C:\Windows\System32\drivers\103C_HP_cNB_Pavilion dv3 Notebook PC_Y5335KV_0U_QCND93352VJ_E514063-371_4A_I306E_SCompal_V22.40_F.15_T101129_WU3-1_L409_M2976_J320_7Intel_8676_92.00_#100705_N80864237;10EC8136_(VJ962PA#ABG)_XMO
BILE_CN10_Z_2F.15.MRK
[2011/04/25 07:41:14 | 000,000,144 | —- | M] () – C:\Windows\System32\pdfl.dat
[2011/04/22 18:13:48 | 000,001,831 | —- | M] () – C:\Users\mohammed\Desktop\Quran Auto Reciter.lnk
[2011/04/22 18:12:58 | 000,737,280 | —- | M] (Indigo Rose Corporation) – C:\Windows\iun6002.exe
[2011/04/18 16:52:56 | 081,942,060 | —- | M] () – C:\Users\mohammed\Desktop\mylog.pcap
[2011/04/18 13:00:47 | 000,001,714 | —- | M] () – C:\Users\mohammed\Application Data\Microsoft\Internet Explorer\Quick Launch\Wireshark.lnk
[2011/04/18 13:00:46 | 000,001,690 | —- | M] () – C:\Users\Public\Desktop\Wireshark.lnk
[2011/04/14 20:42:59 | 001,781,512 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Public\Documents\*.tmp files -> C:\Users\Public\Documents\*.tmp -> ]
[1 C:\Users\mohammed\Desktop\*.tmp files -> C:\Users\mohammed\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/05/07 13:05:15 | 000,302,080 | —- | C] () – C:\Users\mohammed\Desktop\gmer.exe
[2011/05/07 11:15:12 | 000,000,036 | —- | C] () – C:\Users\mohammed\AppData\Local\housecall.guid.cache
[2011/05/06 20:03:16 | 005,081,759 | —- | C] () – C:\Users\mohammed\Desktop\TvQuran.com_athkar_11.mp3
[2011/05/06 20:02:28 | 001,876,629 | —- | C] () – C:\Users\mohammed\Desktop\TvQuran.com_athkar_10.mp3
[2011/05/06 20:01:35 | 010,782,096 | —- | C] () – C:\Users\mohammed\Desktop\TvQuran.com_athkar_08.mp3
[2011/05/06 20:00:09 | 010,473,433 | —- | C] () – C:\Users\mohammed\Desktop\TvQuran.com_athkar_07.mp3
[2011/05/06 19:58:11 | 009,873,243 | —- | C] () – C:\Users\mohammed\Desktop\TvQuran.com_athkar_05.mp3
[2011/05/06 19:56:04 | 010,128,199 | —- | C] () – C:\Users\mohammed\Desktop\TvQuran.com_athkar_03.mp3
[2011/05/06 19:52:41 | 001,064,336 | —- | C] () – C:\Users\mohammed\Desktop\TvQuran.com_athkar_01.mp3
[2011/05/05 12:55:10 | 000,012,487 | —- | C] () – C:\Users\mohammed\Desktop\tranlist (5).pdf
[2011/05/05 10:20:31 | 000,146,701 | —- | C] () – C:\Users\mohammed\Desktop\royalportrait_5.jpg
[2011/05/04 17:09:03 | 000,032,471 | —- | C] () – C:\Users\mohammed\Desktop\Laguna-1-bed-Loft—Duplex_img_0_08.jpg
[2011/05/04 17:08:41 | 000,059,474 | —- | C] () – C:\Users\mohammed\Desktop\Laguna-1-bed-Loft—Duplex_img_0_04.gif
[2011/05/04 17:08:32 | 000,111,279 | —- | C] () – C:\Users\mohammed\Desktop\Laguna-1-bed-Loft—Duplex_img_0_03.gif
[2011/04/30 10:18:26 | 000,001,108 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011/04/30 10:18:26 | 000,001,096 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/04/29 07:37:47 | 000,000,868 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-552828051-1168902950-2987038348-1000Core1cc05ec841422d5.job
[2011/04/25 13:43:29 | 000,001,234 | —- | C] () – C:\Users\Public\Desktop\RealPlayer.lnk
[2011/04/25 09:41:32 | 000,000,000 | RHS- | C] () – C:\Windows\System32\drivers\103C_HP_cNB_Pavilion dv3 Notebook PC_Y5335KV_0U_QCND93352VJ_E514063-371_4A_I306E_SCompal_V22.40_F.15_T101129_WU3-1_L409_M2976_J320_7Intel_8676_92.00_#100705_N80864237;10EC8136_(VJ962PA#ABG)_XMO
BILE_CN10_Z_2F.15.MRK
[2011/04/18 16:52:46 | 081,942,060 | —- | C] () – C:\Users\mohammed\Desktop\mylog.pcap
[2011/04/18 13:00:47 | 000,001,714 | —- | C] () – C:\Users\mohammed\Application Data\Microsoft\Internet Explorer\Quick Launch\Wireshark.lnk
[2011/04/18 13:00:46 | 000,001,702 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark.lnk
[2011/04/18 13:00:46 | 000,001,690 | —- | C] () – C:\Users\Public\Desktop\Wireshark.lnk
[2011/04/01 10:49:28 | 000,001,849 | —- | C] () – C:\Users\mohammed\AppData\Roaming\GhostObjGAFix.xml
[2011/03/23 14:04:55 | 000,014,632 | —- | C] () – C:\Windows\System32\WHIDCoinst.dll
[2011/03/15 15:10:33 | 000,004,432 | —- | C] () – C:\ProgramData\precheck_output.xml
[2010/11/15 06:30:33 | 000,000,050 | —- | C] () – C:\Windows\cdplayer.ini
[2010/09/28 02:26:01 | 000,028,160 | —- | C] () – C:\Users\mohammed\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/14 18:23:33 | 000,007,669 | —- | C] () – C:\Users\mohammed\AppData\Local\Resmon.ResmonCfg
[2010/08/28 12:13:17 | 000,000,000 | —- | C] () – C:\Windows\nsreg.dat
[2010/08/08 20:50:29 | 000,000,144 | —- | C] () – C:\Windows\System32\pdfl.dat
[2010/08/08 20:50:29 | 000,000,144 | —- | C] () – C:\Windows\System32\lkfl.dat
[2010/08/08 20:50:29 | 000,000,080 | —- | C] () – C:\Windows\System32\ibfl.dat
[2010/07/07 09:47:02 | 000,000,056 | -H– | C] () – C:\Windows\System32\ezsidmv.dat
[2010/07/06 13:56:39 | 000,000,000 | —- | C] () – C:\Windows\HPMProp.INI
[2010/07/05 17:18:17 | 000,087,552 | —- | C] () – C:\Windows\System32\cpwmon2k.dll
[2010/06/26 03:03:12 | 000,053,299 | —- | C] () – C:\Windows\System32\pthreadVC.dll
[2010/04/21 17:29:46 | 000,000,151 | —- | C] () – C:\Windows\System32\GfxUI.exe.config
[2010/04/21 17:22:50 | 000,208,896 | —- | C] () – C:\Windows\System32\iglhsip32.dll
[2010/04/21 17:22:50 | 000,143,360 | —- | C] () – C:\Windows\System32\iglhcp32.dll
[2009/08/26 16:57:38 | 000,982,220 | —- | C] () – C:\Windows\System32\igkrng500.bin
[2009/08/26 16:57:38 | 000,439,300 | —- | C] () – C:\Windows\System32\igcompkrng500.bin
[2009/08/26 16:57:38 | 000,134,592 | —- | C] () – C:\Windows\System32\igfcg500.bin
[2009/08/26 16:57:38 | 000,092,216 | —- | C] () – C:\Windows\System32\igfcg500m.bin
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2009/07/14 14:57:37 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/14 14:33:53 | 001,781,512 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2009/07/14 12:05:48 | 000,631,364 | —- | C] () – C:\Windows\System32\perfh009.dat
[2009/07/14 12:05:48 | 000,291,294 | —- | C] () – C:\Windows\System32\perfi009.dat
[2009/07/14 12:05:48 | 000,111,456 | —- | C] () – C:\Windows\System32\perfc009.dat
[2009/07/14 12:05:48 | 000,031,548 | —- | C] () – C:\Windows\System32\perfd009.dat
[2009/07/14 12:05:05 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2009/07/14 12:04:11 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2009/07/14 09:55:01 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/14 09:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/14 09:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/07/09 15:44:40 | 000,004,608 | —- | C] () – C:\Windows\System32\HdmiCoin.dll
[2009/06/11 07:26:10 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2008/05/08 19:16:12 | 000,043,566 | —- | C] () – C:\Windows\php_old.ini

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/06/11 07:42:20 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2010/11/20 22:40:07 | 000,383,786 | RHS- | M] () – C:\bootmgr
[2010/07/06 09:48:35 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2009/06/11 07:42:20 | 000,000,010 | —- | M] () – C:\config.sys
[2011/05/07 10:15:09 | 2339,602,432 | -HS- | M] () – C:\hiberfil.sys
[2010/07/05 16:11:50 | 000,000,185 | —- | M] () – C:\hpqlb.log
[2010/09/14 18:41:44 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/09/14 18:41:44 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2011/05/07 10:15:13 | 3119,472,640 | -HS- | M] () – C:\pagefile.sys
[2011/05/07 12:01:17 | 000,000,497 | —- | M] () – C:\rkill.log

< %systemroot%\Fonts\*.com >
[2009/07/14 14:52:25 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 14:52:25 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 14:52:25 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 14:52:25 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/11 07:31:19 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2010/06/18 09:35:00 | 000,302,080 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\hpcpp104.dll
[2009/06/22 18:58:20 | 000,089,600 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\HPZPPLHN.DLL
[2009/07/14 11:15:26 | 000,090,624 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\HPZPPWN7.DLL
[2009/07/14 11:15:35 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 19:58:12 | 000,030,512 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\mdippr.dll
[2006/10/26 19:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll
[2010/11/20 22:21:36 | 000,030,208 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2011/04/17 14:02:05 | 000,001,718 | -HS- | M] () – C:\Users\mohammed\AppData\Roaming\Microsoft\LastFlashConfig.wfc

< %PROGRAMFILES%\*.* >
[2009/07/14 14:41:57 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/03/29 17:07:19 | 000,000,312 | -HS- | M] () – C:\Users\mohammed\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[1980/01/04 17:46:02 | 021,822,168 | —- | M] ( ) – C:\Users\mohammed\Desktop\AdbeRdr80_en_US.exe
[2010/07/06 16:17:20 | 000,373,248 | —- | M] (eyeos-Team) – C:\Users\mohammed\Desktop\eyeSync.exe
[2011/05/04 13:54:12 | 000,302,080 | —- | M] () – C:\Users\mohammed\Desktop\gmer.exe
[2011/03/14 07:50:34 | 001,253,088 | —- | M] () – C:\Users\mohammed\Desktop\Google Updater.exe
[2002/01/15 04:57:58 | 000,331,776 | —- | M] () – C:\Users\mohammed\Desktop\putty.exe
[1 C:\Users\mohammed\Desktop\*.tmp files -> C:\Users\mohammed\Desktop\*.tmp -> ]

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-04-24 06:47:31

========== Alternate Data Streams ==========

@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:DFC5A2B2

< End of report >

EXTRAS:

OTL Extras logfile created on: 7/05/2011 1:03:41 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\mohammed\Downloads
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000c09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

3.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 32.00% Memory free
6.00 Gb Paging File | 3.00 Gb Available in Paging File | 54.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 285.89 Gb Total Space | 111.00 Gb Free Space | 38.83% Space Free | Partition Type: NTFS
Drive D: | 12.20 Gb Total Space | 1.60 Gb Free Space | 13.10% Space Free | Partition Type: NTFS

Computer Name: MOHAMMED | User Name: mohammed | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = HP MediaSmart Webcam
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}" = Google Gmail Notifier
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements
"{089DD780-DB3F-4CDB-A0C2-111360247298}" = PC Connectivity Solution
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}" = LightScribe System Software 1.14.17.1
"{1805BD6D-C441-4A1C-802D-AFF0232DAACD}" = A-Men Technologies USB-to-Serial
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{1B9B5B3B-28E7-4E59-A80D-D670AA984514}" = Nokia Connectivity Cable Driver
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}" = Nokia PC Suite
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java™ 6 Update 24
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{32A3A4F4-B792-11D6-A78A-00B0D0160240}" = Java™ SE Development Kit 6 Update 24
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons
"{3877C901-7B90-4727-A639-B6ED2DD59D43}" = ESU for Microsoft Windows 7
"{39FAD929-4B55-403A-9430-3DF01BF47FBF}" = HP MediaSmart SmartMenu
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D7E3EC9-46CF-4359-9289-39CE01DFB82F}" = Adobe Photoshop CS3
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{484B100E-6FBE-4631-BC55-5F872FD8E020}" = HP Wireless Assistant
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73EC658D-A1C6-40CA-8E86-E05821BAACE7}" = Java DB 10.6.2.1
"{74E2CD0C-D4A2-11D3-95A6-0000E86CFDE5}" = SSH Secure Shell
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{85A42FF0-F0D0-44A3-B226-C124D6E8B1D5}" = HP 3D DriveGuard
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95655ED4-7CA5-46DF-907F-7144877A32E5}" = Adobe Color NA Recommended Settings
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1033-7B44-AA0000000001}" = Adobe Reader X (10.0.1)
"{AC76BA86-7AD7-2447-0000-900000000003}" = Chinese Simplified Fonts Support For Adobe Reader 9
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{B097E0C4-3863-4AEB-ACA3-79EBF5176F95}" = Quran With Tafseer Software
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B57EAFF2-D6EE-4C6C-9175-ED9F17BFC1BC}" = Windows Live Messenger
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C3379132-291E-4B3D-B1FE-BCFAD8157B46}" = Xmarks for IE
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{C861921A-E002-498F-9800-153CCBABB9C9}" = 32 Bit HP CIO Components Installer
"{C8E95BF5-C07F-4D98-BB42-F58FC98BC03E}" = Google Apps
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CD232781-26CA-4E18-BC70-4343A2F0D583}" = Microsoft IntelliPoint 8.0
"{CF0EDB56-BBF6-3C9F-9C50-2E3B3D444641}" = Google Talk Plugin
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D88C3E7C-1DA6-4AD7-97FC-75BC8705B266}" = runtime
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E6158D07-2637-4ECF-B576-37C489669174}" = Windows Live Call
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{E8020EC7-5DD8-80C9-7237-7B2E9BDA8CC6}" = muvee Reveal
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F10D1D8F-C20C-4F0D-B243-688C0C6873F6}" = CutePDF Professional 3.6
"{F1D7AC58-554A-4A58-B784-B61558B1449A}" = QLBCASL
"{FAA7F8FF-3C05-4A61-8F14-D8A6E9ED6623}" = ooVoo
"{FF11004C-F42A-4A31-9BCF-7F5C8FDBE53C}" = Adobe Setup
"2F91FC44350477C3D31ADE03728FF7F1B1B9E493" = ENE CIR Receiver Driver (12/30/2008 2.7.2.0)
"34EA302E7F4CBD17A19E33BBCB72363234956D7E" = Windows Driver Package - Nokia Modem (06/09/2010 4.5)
"504244733D18C8F63FF584AEB290E3904E791693" = Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe_719d6f144d0c086a0dfa7ff76bb9ac1" = Adobe Photoshop CS3
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.12 (Unicode)
"burnatonce_is1" = burnatonce
"CutePDF Writer Installation" = CutePDF Writer 2.8
"EEEE705096F837B7907659F100C9FE6DA001970F" = Windows Driver Package - Nokia Modem (06/09/2010 7.01.0.7)
"ENTERPRISE" = Microsoft Office Enterprise 2007
"eyeDesigner 1.0.0.11" = eyeDesigner 1.0.0.11
"Google Updater" = Google Updater
"HDMI" = Intel® Graphics Media Accelerator Driver
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = HP MediaSmart Webcam
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 4.0.1 (x86 en-US)" = Mozilla Firefox 4.0.1 (x86 en-US)
"Nokia PC Suite" = Nokia PC Suite
"Notepad++" = Notepad++
"Paint Shop Pro 5.01" = Paint Shop Pro 5.01
"Picasa 3" = Picasa 3
"Quran_AR" = Quran Auto Reciter 2.8
"RealPlayer 12.0" = RealPlayer
"Searchqu 406 MediaBar" = Windows iLivid Toolbar
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TeamViewer 6" = TeamViewer 6
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinPcapInst" = WinPcap 4.1.2
"WinRAR archiver" = WinRAR archiver
"Wireshark" = Wireshark 1.4.5
"Yahoo! Messenger" = Yahoo! Messenger
"ZoneAlarm Extreme Security" = ZoneAlarm Extreme Security

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"Meebo Notifier" = Meebo Notifier

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 2/05/2011 8:00:35 PM | Computer Name = mohammed | Source = Application Error | ID = 1000
Description = Faulting application name: PcSync2.exe, version: 2.0.0.733, time stamp:
0x4c186c8c Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception
code: 0xc0000005 Fault offset: 0x00000000 Faulting process id: 0x1408 Faulting application
start time: 0x01cc09251690e695 Faulting application path: C:\Program Files\Nokia\Nokia
PC Suite 7\PcSync2.exe Faulting module path: unknown Report Id: 5e70b702-7518-11e0-ac8c-00235abeddc1

Error - 3/05/2011 12:27:00 AM | Computer Name = mohammed | Source = Application Error | ID = 1000
Description = Faulting application name: jaucheck.exe, version: 2.0.3.1, time stamp:
0x4ccb415f Faulting module name: jaucheck.exe, version: 2.0.3.1, time stamp: 0x4ccb415f
Exception
code: 0xc0000005 Fault offset: 0x0000c940 Faulting process id: 0x158c Faulting application
start time: 0x01cc094a506233dd Faulting application path: C:\Program Files\Common
Files\Java\Java Update\jaucheck.exe Faulting module path: C:\Program Files\Common
Files\Java\Java Update\jaucheck.exe Report Id: 9643c1aa-753d-11e0-ac8c-00235abeddc1

Error - 3/05/2011 5:54:44 PM | Computer Name = mohammed | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\Nokia\Nokia
PC Suite 7\TIS_Windows7PIM.dll". Dependent Assembly Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 5/05/2011 9:17:58 PM | Computer Name = mohammed | Source = Application Error | ID = 1000
Description = Faulting application name: Explorer.EXE, version: 6.1.7601.17514,
time stamp: 0x4ce796f3 Faulting module name: hxmedpltfm.dll, version: 12.0.1.633,
time stamp: 0x4d3dfc82 Exception code: 0xc0000005 Fault offset: 0x0001c15b Faulting
process id: 0x714 Faulting application start time: 0x01cc0b768084566c Faulting application
path: C:\Windows\Explorer.EXE Faulting module path: C:\Program Files\Real\RealPlayer\common\hxmedpltfm.dll
Report
Id: ad099bcc-777e-11e0-ad67-00235abeddc1

Error - 5/05/2011 10:39:08 PM | Computer Name = mohammed | Source = Application Error | ID = 1000
Description = Faulting application name: chrome.exe, version: 0.0.0.0, time stamp:
0x4db90fe3 Faulting module name: cooliris.dll, version: 1.11.0.0, time stamp: 0x4d9d1518
Exception
code: 0xc0000005 Fault offset: 0x0011f6c7 Faulting process id: 0x1858 Faulting application
start time: 0x01cc0b96c20fd50f Faulting application path: C:\Users\mohammed\AppData\Local\Google\Chrome\Application\chrome.exe
Faulting
module path: C:\Users\mohammed\AppData\Local\Google\Chrome\User Data\Default\Extensions\noocneohefmdhonidldnlhaainpiomkp\1.12.2.44674_0\lib\cooliris.dll
Report
Id: 04188710-778a-11e0-ad67-00235abeddc1

Error - 6/05/2011 3:18:34 AM | Computer Name = mohammed | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\$Recycle.Bin\S-1-5-21-552828051-1168902950-2987038348-1000\$R3MOH25.exe".
Dependent
Assembly CinemasterAudio.4.3,language="*",type="win32",version="4.3.0.0" could
not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 6/05/2011 3:19:19 AM | Computer Name = mohammed | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\$Recycle.Bin\S-1-5-21-552828051-1168902950-2987038348-1000\$RGKWWS2.exe".
Dependent
Assembly CinemasterAudio.4.3,language="*",type="win32",version="4.3.0.0" could
not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 6/05/2011 3:19:20 AM | Computer Name = mohammed | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\$Recycle.Bin\S-1-5-21-552828051-1168902950-2987038348-1000\$RYE48ID.exe".
Dependent
Assembly CinemasterAudio.4.3,language="*",type="win32",version="4.3.0.0" could
not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 6/05/2011 3:47:35 AM | Computer Name = mohammed | Source = Application Hang | ID = 1002
Description = The program firefox.exe version 2.0.1.4120 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 182c Start
Time: 01cc0bc1a674b0b1 Termination Time: 26 Application Path: C:\Program Files\Mozilla
Firefox\firefox.exe Report Id: 18712c51-77b5-11e0-ad67-00235abeddc1

Error - 6/05/2011 8:44:18 PM | Computer Name = mohammed | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\Nokia\Nokia
PC Suite 7\TIS_Windows7PIM.dll". Dependent Assembly Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

[ Hewlett-Packard Events ]
Error - 19/07/2010 10:34:56 PM | Computer Name = mohammed-PC | Source = Hewlett-Packard | ID = 0
Description = en-AU Could not find file 'C:\Program Files\Hewlett-Packard\HP Support
Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32
errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode
mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32
bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath,
Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode,
FileAccess access, FileShare share, Int32 bufferSize, FileOptions options) at
System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,
Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding)

at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a()

Error - 9/08/2010 10:19:37 PM | Computer Name = mohammed-PC | Source = Hewlett-Packard | ID = 0
Description = en-AU Could not find file 'C:\Program Files\Hewlett-Packard\HP Support
Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32
errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode
mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32
bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath,
Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode,
FileAccess access, FileShare share, Int32 bufferSize, FileOptions options) at
System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,
Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding)

at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a()

Error - 5/09/2010 7:10:41 AM | Computer Name = mohammed-PC | Source = Hewlett-Packard | ID = 0
Description = en-AU Could not find file 'C:\Program Files\Hewlett-Packard\HP Support
Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32
errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode
mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32
bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath,
Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode,
FileAccess access, FileShare share, Int32 bufferSize, FileOptions options) at
System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,
Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding)

at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a()

Error - 21/09/2010 3:24:22 PM | Computer Name = mohammed | Source = Hewlett-Packard | ID = 0
Description = en-AU Could not find file 'C:\Program Files\Hewlett-Packard\HP Support
Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32
errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode
mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32
bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath,
Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode,
FileAccess access, FileShare share, Int32 bufferSize, FileOptions options) at
System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,
Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding)

at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a()

Error - 31/03/2011 8:49:22 PM | Computer Name = mohammed | Source = Hewlett-Packard | ID = 0
Description = AAProcessExited() C:\ProgramData\Hewlett-Packard\HP Support Framework\Telemetry\041101114914.xml
File not created by asset agent

Error - 5/04/2011 4:36:34 AM | Computer Name = mohammed | Source = Hewlett-Packard | ID = 0
Description = AAProcessExited() C:\ProgramData\Hewlett-Packard\HP Support Framework\Telemetry\041105063630.xml
File not created by asset agent

[ OSession Events ]
Error - 18/08/2010 6:46:39 AM | Computer Name = mohammed-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6535.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 22820
seconds with 1080 seconds of active time. This session ended with a crash.

Error - 13/09/2010 2:47:04 AM | Computer Name = mohammed-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6535.5005, Microsoft Office Version: 12.0.6425.1000. This session lasted 12116
seconds with 240 seconds of active time. This session ended with a crash.

Error - 2/05/2011 6:37:47 AM | Computer Name = mohammed | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 37334
seconds with 0 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 11/02/2011 7:25:36 PM | Computer Name = mohammed | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the Wlansvc service.

Error - 19/02/2011 3:27:18 AM | Computer Name = mohammed | Source = Ntfs | ID = 262199
Description = The file system structure on the disk is corrupt and unusable. Please
run the chkdsk utility on the volume \Device\HarddiskVolume1.

Error - 20/02/2011 11:34:08 PM | Computer Name = mohammed | Source = EventLog | ID = 6008
Description = The previous system shutdown at 9:04:20 AM on ?20/?02/?2011 was unexpected.

Error - 20/02/2011 11:34:16 PM | Computer Name = mohammed | Source = Microsoft-Windows-TaskScheduler | ID = 413
Description = Task Scheduler service failed to load tasks at service startup. Additional
Data: Error Value: 2147549183.

Error - 20/02/2011 11:34:16 PM | Computer Name = mohammed | Source = Microsoft-Windows-TaskScheduler | ID = 413
Description = Task Scheduler service failed to load tasks at service startup. Additional
Data: Error Value: 2147549183.

Error - 21/02/2011 9:40:36 PM | Computer Name = mohammed | Source = Microsoft-Windows-TaskScheduler | ID = 413
Description = Task Scheduler service failed to load tasks at service startup. Additional
Data: Error Value: 2147549183.

Error - 21/02/2011 9:40:36 PM | Computer Name = mohammed | Source = Microsoft-Windows-TaskScheduler | ID = 413
Description = Task Scheduler service failed to load tasks at service startup. Additional
Data: Error Value: 2147549183.

Error - 21/02/2011 10:26:37 PM | Computer Name = mohammed | Source = Microsoft-Windows-TaskScheduler | ID = 413
Description = Task Scheduler service failed to load tasks at service startup. Additional
Data: Error Value: 2147549183.

Error - 21/02/2011 10:26:37 PM | Computer Name = mohammed | Source = Microsoft-Windows-TaskScheduler | ID = 413
Description = Task Scheduler service failed to load tasks at service startup. Additional
Data: Error Value: 2147549183.

Error - 21/02/2011 10:27:19 PM | Computer Name = mohammed | Source = Service Control Manager | ID = 7023
Description = The Windows Modules Installer service terminated with the following
error: %%16405

< End of report >

CatByte

Post #2May 7, 2011, 6:47 AM UTC

Hi,

Please do the following:

Please download aswMBR ( 511KB ) to your desktop.

Double click the aswMBR.exe icon to run it
Click the Scan button to start the scan
On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

makosa

Post #3May 7, 2011, 7:58 AM UTC

This is what I got after running the scan: aswMBR version 0.9.5.256 Copyright© 2011 AVAST Software Run date: 2011-05-07 17:53:52 —————————– 17:53:52.588 OS Version: Windows 6.1.7601 Service Pack 1 17:53:52.588 Number of processors: 2 586 0x1706 17:53:52.602 ComputerName: MOHAMMED UserName: mohammed 17:53:58.567 Initialize success 17:54:07.858 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 17:54:07.861 Disk 0 Vendor: SAMSUNG_HM320II 2AC101C4 Size: 305245MB BusType: 11 17:54:10.014 Disk 0 MBR read successfully 17:54:10.021 Disk 0 MBR scan 17:54:10.028 Disk 0 unknown MBR code 17:54:12.084 Disk 0 scanning sectors +625135616 17:54:12.301 Disk 0 scanning C:\Windows\system32\drivers 17:55:23.597 Service scanning 17:55:24.654 Disk 0 trace - called modules: 17:55:24.747 ntkrnlpa.exe CLASSPNP.SYS disk.sys hpdskflt.sys halmacpi.dll ACPI.sys ataport.SYS PCIIDEX.SYS msahci.sys 17:55:24.751 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86314ac8] 17:55:24.756 3 CLASSPNP.SYS[8b5b859e] -> nt!IofCallDriver -> [0x86313090] 17:55:24.761 5 hpdskflt.sys[8b56a0be] -> nt!IofCallDriver -> [0x861e6918] 17:55:24.766 7 ACPI.sys[8b0b23d4] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x861f7030] 17:55:24.773 Scan finished successfully 17:55:42.554 Disk 0 MBR has been saved successfully to "C:\Users\mohammed\Desktop\MBR.dat" 17:55:42.587 The log file has been saved successfully to "C:\Users\mohammed\Desktop\aswMBR.txt"

CatByte

Post #4May 7, 2011, 2:45 PM UTC

Hi

Please do the following:

Hold down the Windows key and press R to open a run box
type the following text into the run box

appwiz.cpl
This will open your Programs And Features
A list of installed programs will populate
Remove the following programs:

"Searchqu 406 MediaBar"

NEXT

Refer to the ComboFix User's Guide

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Place ComboFix.exe on your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.

You can get help on disabling your protection programs here
Double click on ComboFix.exe & follow the prompts.
Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

———————————————————————————————
Ensure your AntiVirus and AntiSpyware applications are re-enabled.

———————————————————————————————

makosa

Post #5May 8, 2011, 12:19 AM UTC

Hi, I have run the combo fix and got the following log. I had earlier removed the searchqu from the ilivid tool bar. – ComboFix 11-05-07.01 - mohammed 08/05/2011 9:42.1.2 - x86 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.61.1033.18.2975.1486 [GMT 10:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe FW: ZoneAlarm Extreme Security Firewall *Disabled* {D17DF357-CFF5-F001-D1C1-FCD21DFE3D5E} SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: ZoneAlarm Extreme Security Anti-Spyware *Disabled/Updated* {52279396-A3A0-FED7-C02E-6E9598AA3098} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files\Mozilla Firefox\searchplugins\SearchquWebSearch.xml c:\speedcrunchportable\SpeedCrunchPortable.exe . . ((((((((((((((((((((((((( Files Created from 2011-04-08 to 2011-05-08 ))))))))))))))))))))))))))))))) . . 2011-05-07 23:57 . 2011-05-07 23:57 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-05-07 23:57 . 2011-05-07 23:57 ——– d—–w- c:\users\Administrator\AppData\Local\temp 2011-05-06 02:19 . 2011-05-06 02:24 ——– d—–w- c:\users\mohammed\AppData\Roaming\vlc 2011-05-06 02:13 . 2011-05-06 02:13 ——– d—–w- c:\users\mohammed\AppData\Local\Ilivid Player 2011-05-06 02:08 . 2011-05-06 02:08 ——– d—–w- c:\users\mohammed\AppData\Local\PackageAware 2011-04-29 22:29 . 2011-04-29 23:26 ——– d—–w- c:\program files\Anonymous Browsing 2011-04-25 03:43 . 2011-04-25 03:43 11776 —-a-w- c:\program files\Mozilla Firefox\plugins\nprjplug.dll 2011-04-25 03:43 . 2011-04-25 03:43 ——– d—–w- c:\program files\Common Files\xing shared 2011-04-25 03:43 . 2011-04-25 03:43 150712 —-a-w- c:\program files\Mozilla Firefox\plugins\nppl3260.dll 2011-04-25 03:42 . 2011-04-25 03:42 100864 —-a-w- c:\program files\Mozilla Firefox\plugins\nprpjplug.dll 2011-04-25 03:42 . 2011-04-25 03:43 ——– d—–w- c:\program files\Real 2011-04-24 23:48 . 2009-07-08 07:34 53248 —-a-w- c:\windows\system32\CSVer.dll 2011-04-24 08:02 . 2011-04-24 08:02 499712 —-a-w- c:\windows\system32\msvcp71.dll 2011-04-24 06:45 . 2011-04-11 07:04 7071056 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{FA08C647-C482-4088-80C1-D54DF6951A6E}\mpengine.dll 2011-04-18 06:53 . 2011-04-18 06:53 ——– d—–w- c:\users\mohammed\AppData\Roaming\Wireshark 2011-04-18 03:00 . 2011-04-18 03:01 ——– d—–w- c:\program files\Wireshark 2011-04-18 02:19 . 2011-04-18 02:19 ——– d—–w- c:\program files\WinPcap 2011-04-17 21:21 . 2011-03-07 05:33 981504 —-a-w- c:\windows\system32\wininet.dll 2011-04-17 21:21 . 2011-03-07 05:31 163328 —-a-w- c:\program files\Internet Explorer\ieproxy.dll 2011-04-17 21:21 . 2011-03-07 03:52 1638912 —-a-w- c:\windows\system32\mshtml.tlb 2011-04-17 21:19 . 2011-03-11 05:33 1164288 —-a-w- c:\windows\system32\mfc42u.dll 2011-04-17 21:19 . 2011-03-11 05:33 1137664 —-a-w- c:\windows\system32\mfc42.dll 2011-04-14 10:50 . 2011-02-23 04:48 311808 —-a-w- c:\windows\system32\drivers\srv.sys 2011-04-14 10:50 . 2011-02-23 04:48 310272 —-a-w- c:\windows\system32\drivers\srv2.sys 2011-04-14 10:50 . 2011-02-23 04:47 114176 —-a-w- c:\windows\system32\drivers\srvnet.sys 2011-04-14 10:00 . 2011-03-03 03:42 2333184 —-a-w- c:\windows\system32\win32k.sys 2011-04-14 09:49 . 2011-03-03 05:38 132608 —-a-w- c:\windows\system32\dnsrslvr.dll 2011-04-14 09:49 . 2011-03-03 05:36 28672 —-a-w- c:\windows\system32\dnscacheugc.exe 2011-04-14 09:49 . 2011-02-23 04:47 223232 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys 2011-04-14 09:49 . 2011-02-23 04:47 96768 —-a-w- c:\windows\system32\drivers\mrxsmb20.sys 2011-04-14 09:49 . 2011-02-23 04:47 123904 —-a-w- c:\windows\system32\drivers\mrxsmb.sys 2011-04-14 09:49 . 2011-02-23 04:47 69632 —-a-w- c:\windows\system32\drivers\bowser.sys 2011-04-14 09:48 . 2011-02-19 06:30 34304 —-a-w- c:\windows\system32\atmlib.dll 2011-04-14 09:48 . 2011-02-19 04:34 294912 —-a-w- c:\windows\system32\atmfd.dll 2011-04-14 09:44 . 2011-02-12 05:35 191488 —-a-w- c:\windows\system32\FXSCOVER.exe 2011-04-14 09:40 . 2011-02-18 05:43 428032 —-a-w- c:\windows\system32\vbscript.dll 2011-04-14 09:39 . 2011-03-08 05:28 741376 —-a-w- c:\windows\system32\inetcomm.dll 2011-04-10 04:28 . 2011-04-24 08:02 348160 —-a-w- c:\windows\system32\msvcr71.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-04-22 08:12 . 2010-08-18 07:28 737280 —-a-w- c:\windows\iun6002.exe 2011-03-25 23:48 . 2011-03-25 23:48 4284416 —-a-w- c:\windows\system32\GPhotos.scr 2011-03-22 22:13 . 2011-03-22 22:02 1053232 —-a-w- c:\windows\system32\MFC71u.dll 2011-03-22 22:13 . 2011-03-22 22:02 1066544 —-a-w- c:\windows\system32\MFC71.dll 2011-03-19 03:37 . 2009-07-14 02:05 152576 —-a-w- c:\windows\system32\msclmd.dll 2011-02-23 23:40 . 2010-07-06 08:20 472808 —-a-w- c:\windows\system32\deployJava1.dll 2011-02-19 06:30 . 2011-04-02 02:27 805376 —-a-w- c:\windows\system32\FntCache.dll 2011-02-19 06:30 . 2011-04-02 02:27 1076736 —-a-w- c:\windows\system32\DWrite.dll 2011-02-19 06:30 . 2011-04-02 02:27 739840 —-a-w- c:\windows\system32\d2d1.dll 2011-04-14 16:26 . 2011-04-30 00:18 142296 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080] "Meebo Notifier"="c:\users\mohammed\AppData\Local\Meebo\Meebo Notifier\MeeboNotifier.exe" [2010-07-14 818888] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-01-26 15026056] "ooVoo.exe"="c:\program files\ooVoo\ooVoo.exe" [2011-01-24 22504120] "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-08 2363392] "Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 7\PcSync2.exe" [2010-06-15 753664] "Xmarks"="c:\program files\Xmarks\IE Extension\xmarkssync.exe" [2011-02-05 1092808] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-06-24 320056] "WirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-05-11 513080] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-05-27 1721640] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-09 141848] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-09 174104] "Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-09 151064] "Quran_AR"="c:\program files\Quran_AR\Quran_AR.exe" [2010-10-01 335872] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064] "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2010-08-28 1039360] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888] "UCam_Menu"="c:\program files\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" [2008-11-14 218408] "UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-06-13 210216] "UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408] "UpdatePDIRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408] "UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2009-01-12 210216] "SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2009-01-08 915000] "SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2010-03-23 495708] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-01-07 1797488] "TkBellExe"="c:\program files\Real\RealPlayer\Update\realsched.exe" [2011-04-25 273544] . c:\users\mohammed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-08-10 136176] R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [x] R3 connctfy;Connectify Service;c:\windows\system32\DRIVERS\connctfy.sys [x] R3 connctfyMP;connctfyMP;c:\windows\system32\DRIVERS\connctfy.sys [x] R3 dc3d;MS Hardware Device Detection Driver;c:\windows\system32\DRIVERS\dc3d.sys [2011-01-07 44416] R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-08-10 136176] R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224] R3 WacomVTHid;Virtual Touch Driver;c:\windows\system32\DRIVERS\WacomVTHid.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-07-08 1343400] S1 VWiFiFlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128] S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\aestsrv.exe [2009-03-02 81920] S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2010-10-14 92216] S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2010-07-16 26168] S2 ISWKL;ZoneAlarm ForceField ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [2010-08-27 26352] S2 IswSvc;ZoneAlarm ForceField IswSvc;c:\program files\CheckPoint\ZAForceField\IswSvc.exe [2010-08-27 493032] S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-06-25 35088] S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [2011-03-01 2296696] S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [2008-12-30 57856] S3 icsak;icsak;c:\program files\CheckPoint\ZAForceField\AK\icsak.sys [2010-08-27 35568] S3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-07-09 122880] S3 NETw5s32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [2010-07-08 6758912] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-03-01 139776] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 bdx REG_MULTI_SZ scan sysagent . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2008-06-08 23:14 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe . Contents of the 'Scheduled Tasks' folder . 2011-05-07 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2011-02-22 21:51] . 2011-05-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-08-10 08:49] . 2011-05-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-08-10 08:49] . 2011-04-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-552828051-1168902950-2987038348-1000Core1cc05ec841422d5.job - c:\users\mohammed\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-05 06:27] . 2010-10-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-552828051-1168902950-2987038348-1000UA.job - c:\users\mohammed\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-05 06:27] . . ——- Supplementary Scan ——- . uStart Page = hxxp://www.ninemsn.com.au/?ocid=OIE9HP uDefault_Search_URL = hxxp://www.google.com/ie uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html Trusted Zone: alipay.com Trusted Zone: alisoft.com Trusted Zone: taobao.com FF - ProfilePath - c:\users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.ghanaweb.com|http://myjoyonline.com|http://peacefmonline.com|https://mail.google.com FF - prefs.js: keyword.URL - hxxp://www.google.com/search?hl=en&q= . - - - - ORPHANS REMOVED - - - - . Toolbar-10 - (no file) HKLM-Run-DATAMNGR - c:\progra~1\WI3C8A~1\Datamngr\DATAMN~1.EXE . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\S-1-5-21-552828051-1168902950-2987038348-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*o*b*i*l*e* *b*o*o*k*m*a*r*k*s* \Application Downloads] "Order"=hex:08,00,00,00,02,00,00,00,7e,00,00,00,01,00,00,00,01,00,00,00,72,00, 00,00,00,00,00,00,64,00,32,00,84,00,00,00,00,d6,59,df,20,00,4e,4f,4b,49,41,\ . [HKEY_USERS\S-1-5-21-552828051-1168902950-2987038348-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*o*b*i*l*e* *b*o*o*k*m*a*r*k*s* \Graphics Downloads] "Order"=hex:08,00,00,00,02,00,00,00,7e,00,00,00,01,00,00,00,01,00,00,00,72,00, 00,00,00,00,00,00,64,00,32,00,84,00,00,00,00,7e,e6,bc,20,00,4e,4f,4b,49,41,\ . [HKEY_USERS\S-1-5-21-552828051-1168902950-2987038348-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*o*b*i*l*e* *b*o*o*k*m*a*r*k*s* \Mobile feeds] "Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00 . [HKEY_USERS\S-1-5-21-552828051-1168902950-2987038348-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*o*b*i*l*e* *b*o*o*k*m*a*r*k*s* \Music Downloads] "Order"=hex:08,00,00,00,02,00,00,00,7e,00,00,00,01,00,00,00,01,00,00,00,72,00, 00,00,00,00,00,00,64,00,32,00,84,00,00,00,00,01,64,ce,20,00,4e,4f,4b,49,41,\ . [HKEY_USERS\S-1-5-21-552828051-1168902950-2987038348-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*o*b*i*l*e* *b*o*o*k*m*a*r*k*s* \Themes Downloads] "Order"=hex:08,00,00,00,02,00,00,00,7e,00,00,00,01,00,00,00,01,00,00,00,72,00, 00,00,00,00,00,00,64,00,32,00,84,00,00,00,00,cb,76,04,20,00,4e,4f,4b,49,41,\ . [HKEY_USERS\S-1-5-21-552828051-1168902950-2987038348-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*o*b*i*l*e* *b*o*o*k*m*a*r*k*s* \Tones Downloads] "Order"=hex:08,00,00,00,02,00,00,00,7e,00,00,00,01,00,00,00,01,00,00,00,72,00, 00,00,00,00,00,00,64,00,32,00,84,00,00,00,00,90,e8,a1,20,00,4e,4f,4b,49,41,\ . [HKEY_USERS\S-1-5-21-552828051-1168902950-2987038348-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\M*o*b*i*l*e* *b*o*o*k*m*a*r*k*s* \Video Downloads] "Order"=hex:08,00,00,00,02,00,00,00,7e,00,00,00,01,00,00,00,01,00,00,00,72,00, 00,00,00,00,00,00,64,00,32,00,84,00,00,00,00,03,01,a2,20,00,4e,4f,4b,49,41,\ . [HKEY_USERS\S-1-5-21-552828051-1168902950-2987038348-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\N*e*w* *F*o*l*d*e*r* \ANDRIOD] "Order"=hex:08,00,00,00,02,00,00,00,c8,03,00,00,01,00,00,00,05,00,00,00,bc,00, 00,00,00,00,00,00,ae,00,32,00,84,00,00,00,00,1a,47,14,20,00,41,4e,44,52,4f,\ . [HKEY_USERS\S-1-5-21-552828051-1168902950-2987038348-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\w*e*b* *h*o*s*t* \New Folder] "Order"=hex:08,00,00,00,02,00,00,00,0c,00,00,00,01,00,00,00,00,00,00,00 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ——————— DLLs Loaded Under Running Processes ——————— . - - - - - - - > 'lsass.exe'(532) c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll c:\program files\CheckPoint\ZAForceField\AK\icsak.dll . - - - - - - - > 'csrss.exe'(384) c:\program files\CheckPoint\ZAForceField\AK\akconsole.dll . Completion time: 2011-05-08 10:13:23 ComboFix-quarantined-files.txt 2011-05-08 00:13 . Pre-Run: 122,027,520,000 bytes free Post-Run: 126,307,528,704 bytes free . - - End Of File - - 038800011C87C46356926D5562525B90

CatByte

Post #6May 8, 2011, 12:36 AM UTC

Hi

Please do the following:

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

Go here to run an online scanner from ESET.

Note: You will need to use Internet explorer for this scan
Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activeX control to install
Click Start
Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
Wait for the scan to finish
When the scan completes, press the LIST OF THREATS FOUND button
Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
Include the contents of this report in your next reply.
Press the BACK button.
Press Finish

makosa

Post #7May 8, 2011, 7:50 AM UTC

Hi, I have been able to do the mban and attached, but the eset, did not give me an option to save, so was only able to capture screen and attached. Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 6529 Windows 6.1.7601 Service Pack 1 Internet Explorer 8.0.7601.17514 8/05/2011 10:49:39 AM mbam-log-2011-05-08 (10-49-39).txt Scan type: Quick scan Objects scanned: 173635 Time elapsed: 5 minute(s), 13 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

Attachments:

CatByte

Post #8May 8, 2011, 11:15 AM UTC

Did you press the button that says "list of found threats"? Do you recall what the found threat was? how is the computer running now? Are there any outstanding issues? Please run OTL and post a fresh log

makosa

Post #9May 9, 2011, 3:32 AM UTC

Hello, I have rerun the eset online, and had the following : C:\Users\mohammed\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57\4661f1f9-6d3fb3d6 probably a variant of Win32/Agent.RPSVWU trojan

Attachments:

📎eset.txt

CatByte

Post #10May 9, 2011, 9:52 PM UTC

Hi

Please do the following:

Click Start > Control Panel.
Double-click the Java icon in the control panel.
The Java Control Panel appears.
Click Settings under Temporary Internet Files.
The Temporary Files Settings dialog box appears.

There are three options on this window to clear the cache.

Delete Files
View Applications
View Applets

Click OK on Delete Temporary Files window.
Note: This deletes all the Downloaded Applications and Applets from the cache.
Click OK on Temporary Files Settings window.

NEXT

Please post a fresh OTL log and advise how your computer is running now and if there are any outstanding issues

makosa

Post #11May 9, 2011, 10:43 PM UTC

I have deleted as shown earlier and run otl, below is the log:

OTL:

OTL logfile created on: 10/05/2011 8:32:44 AM - Run 2
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\mohammed\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000c09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

3.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 33.00% Memory free
6.00 Gb Paging File | 4.00 Gb Available in Paging File | 61.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 285.89 Gb Total Space | 123.54 Gb Free Space | 43.21% Space Free | Partition Type: NTFS
Drive D: | 12.20 Gb Total Space | 1.60 Gb Free Space | 13.14% Space Free | Partition Type: NTFS

Computer Name: MOHAMMED | User Name: mohammed | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/05/07 12:34:17 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\mohammed\Desktop\OTL.exe
PRC - [2011/05/01 17:59:09 | 000,140,952 | —- | M] (Google Inc.) – C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe
PRC - [2011/04/26 15:06:06 | 000,161,336 | —- | M] (Google) – C:\Users\mohammed\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
PRC - [2011/04/25 13:42:52 | 000,273,544 | —- | M] (RealNetworks, Inc.) – C:\Program Files\Real\RealPlayer\Update\realsched.exe
PRC - [2011/04/15 02:25:41 | 000,924,632 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011/03/02 00:47:56 | 007,832,440 | —- | M] (TeamViewer GmbH) – C:\Program Files\TeamViewer\Version6\TeamViewer.exe
PRC - [2011/03/02 00:47:56 | 002,296,696 | —- | M] (TeamViewer GmbH) – C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
PRC - [2011/02/05 10:55:48 | 001,092,808 | —- | M] (Xmarks.com) – C:\Program Files\Xmarks\IE Extension\xmarkssync.exe
PRC - [2011/01/25 08:07:44 | 022,504,120 | —- | M] (ooVoo LLC) – C:\Program Files\ooVoo\ooVoo.exe
PRC - [2010/11/20 22:17:09 | 002,616,320 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2010/10/14 16:27:38 | 000,092,216 | —- | M] (Hewlett-Packard Company) – C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe
PRC - [2010/10/02 04:57:54 | 000,335,872 | —- | M] (Search Truth Technologies) – C:\Program Files\Quran_AR\Quran_AR.exe
PRC - [2010/08/29 01:54:52 | 002,434,568 | —- | M] (Check Point Software Technologies LTD) – C:\Windows\System32\ZoneLabs\vsmon.exe
PRC - [2010/08/29 01:53:14 | 001,039,360 | —- | M] (Check Point Software Technologies LTD) – C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2010/08/27 19:34:02 | 000,493,032 | —- | M] (Check Point Software Technologies) – C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe
PRC - [2010/07/15 04:23:52 | 000,818,888 | —- | M] (Meebo, Inc.) – C:\Users\mohammed\AppData\Local\Meebo\Meebo Notifier\MeeboNotifier.exe
PRC - [2010/06/16 08:17:52 | 000,753,664 | —- | M] (Nokia) – C:\Program Files\Nokia\Nokia PC Suite 7\PcSync2.exe
PRC - [2010/06/14 14:07:14 | 000,615,936 | —- | M] (Nokia) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
PRC - [2010/06/07 12:51:24 | 000,138,752 | —- | M] (Nokia) – C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
PRC - [2010/03/23 14:53:06 | 000,495,708 | —- | M] (IDT, Inc.) – C:\Program Files\IDT\WDM\sttray.exe
PRC - [2010/03/23 14:53:06 | 000,229,458 | —- | M] (IDT, Inc.) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\stacsv.exe
PRC - [2009/10/27 09:15:02 | 000,120,832 | —- | M] (Nokia) – C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
PRC - [2009/09/10 10:15:42 | 000,870,672 | —- | M] (SonicWALL, Inc.) – C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
PRC - [2009/03/02 18:43:08 | 000,081,920 | —- | M] (Andrea Electronics Corporation) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\AEstSrv.exe
PRC - [2009/01/08 13:00:56 | 000,915,000 | —- | M] (Hewlett-Packard) – C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
PRC - [2008/05/22 14:05:06 | 000,474,624 | —- | M] (Nokia Corporation) – C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
PRC - [2005/07/16 07:48:33 | 000,479,232 | —- | M] (Google Inc.) – C:\Program Files\Google\Gmail Notifier\gnotify.exe

========== Modules (SafeList) ==========

MOD - [2011/05/07 12:34:17 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\mohammed\Desktop\OTL.exe
MOD - [2011/04/24 16:46:23 | 000,632,656 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.5592_none_d09196c24426e2d
4\msvcr80.dll
MOD - [2011/04/24 16:46:23 | 000,554,832 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.5592_none_d09196c24426e2d
4\msvcp80.dll
MOD - [2010/11/20 21:55:09 | 001,680,896 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
MOD - [2010/08/27 19:34:08 | 000,640,488 | —- | M] (Check Point Software Technologies) – C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
MOD - [2010/08/27 19:33:58 | 000,562,664 | —- | M] (Check Point Software Technologies) – C:\Program Files\CheckPoint\ZAForceField\AK\icsak.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] – – (scan)
SRV - [2011/03/02 00:47:56 | 002,296,696 | —- | M] (TeamViewer GmbH) [Auto | Running] – C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe – (TeamViewer6)
SRV - [2011/01/26 01:11:24 | 000,654,848 | —- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe – (FLEXnet Licensing Service)
SRV - [2010/10/14 16:27:38 | 000,092,216 | —- | M] (Hewlett-Packard Company) [Auto | Running] – C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe – (HPDrvMntSvc.exe)
SRV - [2010/08/29 01:54:52 | 002,434,568 | —- | M] (Check Point Software Technologies LTD) [Auto | Running] – C:\Windows\System32\ZoneLabs\vsmon.exe – (vsmon)
SRV - [2010/08/27 19:34:02 | 000,493,032 | —- | M] (Check Point Software Technologies) [Auto | Running] – C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe – (IswSvc)
SRV - [2010/07/08 13:23:30 | 001,343,400 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\Wat\WatAdminSvc.exe – (WatAdminSvc)
SRV - [2010/06/26 03:07:20 | 000,117,264 | —- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] – C:\Program Files\WinPcap\rpcapd.exe – (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - [2010/06/14 14:07:14 | 000,615,936 | —- | M] (Nokia) [On_Demand | Running] – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe – (ServiceLayer)
SRV - [2010/03/23 14:53:06 | 000,229,458 | —- | M] (IDT, Inc.) [Auto | Running] – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\stacsv.exe – (STacSV)
SRV - [2009/07/14 11:16:13 | 000,025,088 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\sensrsvc.dll – (SensrSvc)
SRV - [2009/07/14 11:15:41 | 000,680,960 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2009/03/02 18:43:08 | 000,081,920 | —- | M] (Andrea Electronics Corporation) [Auto | Running] – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\AEstSrv.exe – (AESTFilters)

========== Driver Services (SafeList) ==========

DRV - [2011/01/07 14:56:12 | 000,044,416 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\dc3d.sys – (dc3d)
DRV - [2010/11/20 20:24:41 | 000,052,224 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV - [2010/11/20 20:06:36 | 000,117,760 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rmcast.sys – (RMCAST)
DRV - [2010/11/20 19:59:44 | 000,035,968 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\winusb.sys – (WinUsb)
DRV - [2010/08/27 19:33:54 | 000,035,568 | —- | M] (Check Point Software Technologies) [Kernel | On_Demand | Running] – C:\Program Files\CheckPoint\ZAForceField\AK\icsak.sys – (icsak)
DRV - [2010/08/27 19:33:54 | 000,026,352 | —- | M] (Check Point Software Technologies) [Kernel | Auto | Running] – C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys – (ISWKL)
DRV - [2010/07/16 15:03:36 | 000,025,656 | —- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\hpdskflt.sys – (hpdskflt)
DRV - [2010/07/16 15:03:18 | 000,035,896 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\Accelerometer.sys – (Accelerometer)
DRV - [2010/07/09 09:36:26 | 006,758,912 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\NETw5s32.sys – (NETw5s32) Intel®
DRV - [2010/06/26 03:07:14 | 000,035,088 | —- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] – C:\Windows\System32\drivers\npf.sys – (NPF)
DRV - [2010/06/09 18:16:06 | 000,465,496 | —- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] – C:\Windows\System32\drivers\vsdatant.sys – (Vsdatant)
DRV - [2010/03/23 14:53:06 | 000,423,424 | —- | M] (IDT, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\stwrt.sys – (STHDA)
DRV - [2010/02/26 13:32:58 | 000,008,192 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\usbser_lowerfltj.sys – (UsbserFilt)
DRV - [2010/02/26 13:32:46 | 000,008,192 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\usbser_lowerflt.sys – (upperdev)
DRV - [2010/02/26 13:32:44 | 000,022,528 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\ccdcmbo.sys – (nmwcdc)
DRV - [2010/02/26 13:32:44 | 000,018,176 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\ccdcmb.sys – (nmwcd)
DRV - [2009/10/12 17:15:28 | 000,305,168 | —- | M] (Kaspersky Lab) [File_System | System | Running] – C:\Windows\System32\drivers\klif.sys – (KLIF)
DRV - [2009/10/12 17:15:26 | 000,128,016 | —- | M] (Kaspersky Lab) [Kernel | System | Running] – C:\Windows\System32\drivers\kl1.sys – (kl1)
DRV - [2009/07/14 09:52:10 | 000,014,336 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\vwifimp.sys – (vwifimp)
DRV - [2009/07/14 09:45:33 | 000,083,456 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\serial.sys – (Serial)
DRV - [2009/07/14 08:02:51 | 004,231,168 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\netw5v32.sys – (netw5v32) Intel®
DRV - [2009/07/09 15:44:52 | 000,122,880 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\IntcHdmi.sys – (IntcHdmiAddService) Intel®
DRV - [2009/04/29 08:46:54 | 000,015,872 | —- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\HpqKbFiltr.sys – (HpqKbFiltr)
DRV - [2008/12/30 22:18:50 | 000,057,856 | —- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\enecir.sys – (enecir)
DRV - [2008/08/26 09:26:12 | 000,018,816 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\pccsmcfd.sys – (pccsmcfd)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.ninemsn.com.au/?ocid=OIE9HP
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-au
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = F0 FA 4B D1 03 2E CB 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.order.1: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.ghanaweb.com|http://myjoyonline.com|http://peacefmonline.com|https://mail.google.com"
FF - prefs.js..keyword.URL: "http://www.google.com/search?hl=en&q;="

FF - HKLM\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2011/03/15 17:37:01 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\ [2011/03/19 15:36:02 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/04/25 13:43:20 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/30 10:18:20 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/04/25 13:43:58 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/30 10:18:20 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/04/25 13:43:58 | 000,000,000 | —D | M]

[2011/05/07 16:07:17 | 000,000,000 | —D | M] (No name found) – C:\Users\mohammed\AppData\Roaming\Mozilla\Extensions
[2011/05/06 12:09:58 | 000,000,000 | —D | M] (No name found) – C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions
[2011/05/06 12:09:58 | 000,000,000 | —D | M] (Searchqu Toolbar) – C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
[2011/05/01 17:34:24 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011/05/01 14:45:32 | 000,000,000 | —D | M] ("Xmarks") – C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\[removed]
[2011/05/01 17:34:23 | 000,000,000 | —D | M] ("NetVideoHunter") – C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\[removed]
[2011/04/09 17:36:51 | 000,000,000 | —D | M] (No name found) – C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\avnvnqfb.default\extensions
[2011/04/09 17:36:46 | 000,000,000 | —D | M] (No name found) – C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\avnvnqfb.default\extensions\[removed]
[2011/05/07 16:07:17 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/07/06 18:20:31 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/09/08 14:46:26 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2011/02/24 09:40:33 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
File not found (No name found) –
[2011/04/25 13:43:20 | 000,000,000 | —D | M] (RealPlayer Browser Record Plugin) – C:\PROGRAMDATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT
() (No name found) – C:\USERS\MOHAMMED\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\82WFBVYL.DEFAULT\EXTENSIONS\{0538E3E3-7E9B-4D49-8831-A227C80A7AD3}.XPI
() (No name found) – C:\USERS\MOHAMMED\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\82WFBVYL.DEFAULT\EXTENSIONS\{4176DFF4-4698-11DE-BEEB-45DA55D89593}.XPI
() (No name found) – C:\USERS\MOHAMMED\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\82WFBVYL.DEFAULT\EXTENSIONS\{EF4E370E-D9F0-4E00-B93E-A4F274CFDD5A}.XPI
() (No name found) – C:\USERS\MOHAMMED\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\82WFBVYL.DEFAULT\EXTENSIONS\[removed]
() (No name found) – C:\USERS\MOHAMMED\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\82WFBVYL.DEFAULT\EXTENSIONS\[removed]
[2011/04/15 02:26:02 | 000,142,296 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2011/02/24 09:40:08 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/03/30 21:19:50 | 000,111,960 | —- | M] ( ) – C:\Program Files\Mozilla Firefox\plugins\npww.dll
[2010/01/01 18:00:00 | 000,002,252 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\bing.xml

O1 HOSTS File: ([2011/05/08 10:00:44 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (ZoneAlarm Toolbar Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll (Google Inc.)
O2 - BHO: (CutePDF Form Filler Helper) - {D41289F2-69C6-417B-897E-C653D677CBAF} - C:\Program Files\Acro Software\CutePDF Pro\CPFillerCo.dll (Acro Software Inc.)
O3 - HKLM\..\Toolbar: (ZoneAlarm Toolbar) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Toolbar) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O4 - HKLM..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe (Google Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Quran_AR] C:\Program Files\Quran_AR\Quran_AR.exe (Search Truth Technologies)
O4 - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (Hewlett-Packard)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [UCam_Menu] C:\Program Files\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePDIRShortCut] C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [Meebo Notifier] C:\Users\mohammed\AppData\Local\Meebo\Meebo Notifier\MeeboNotifier.exe (Meebo, Inc.)
O4 - HKCU..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 7\PcSync2.exe (Nokia)
O4 - HKCU..\Run: [ooVoo.exe] C:\Program Files\ooVoo\ooVoo.exe (ooVoo LLC)
O4 - HKCU..\Run: [Xmarks] C:\Program Files\Xmarks\IE Extension\xmarkssync.exe (Xmarks.com)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\Windows\System32\GPhotos.scr (Google Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O15 - HKCU\..Trusted Domains: alipay.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: alipay.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: alisoft.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: alisoft.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: taobao.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: taobao.com ([]https in Trusted sites)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} https://picasaweb.google.com/s/v/71.37/uploader2.cab (UploadListView Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos-beta/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/11 07:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/05/10 08:32:24 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Users\mohammed\Desktop\OTL.exe
[2011/05/09 07:53:33 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/05/08 10:43:14 | 000,000,000 | —D | C] – C:\Users\mohammed\AppData\Roaming\Malwarebytes
[2011/05/08 10:43:03 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/05/08 10:43:03 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/05/08 10:43:02 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011/05/08 10:42:58 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2011/05/08 10:42:58 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/05/08 10:41:20 | 007,734,208 | —- | C] (Malwarebytes Corporation ) – C:\Users\mohammed\Desktop\mbam-setup.exe
[2011/05/08 10:13:48 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2011/05/08 09:36:37 | 000,161,792 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2011/05/08 09:36:37 | 000,136,704 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2011/05/08 09:36:37 | 000,031,232 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2011/05/08 09:36:19 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2011/05/08 09:35:53 | 000,000,000 | —D | C] – C:\Qoobox
[2011/05/08 09:35:31 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2011/05/06 12:19:41 | 000,000,000 | —D | C] – C:\Users\mohammed\AppData\Roaming\vlc
[2011/05/06 12:13:03 | 000,000,000 | —D | C] – C:\Users\mohammed\AppData\Local\Ilivid Player
[2011/05/06 12:08:48 | 000,000,000 | —D | C] – C:\Users\mohammed\AppData\Local\PackageAware
[2011/04/30 08:29:37 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Anonymous Browsing
[2011/04/30 08:29:36 | 000,000,000 | —D | C] – C:\Program Files\Anonymous Browsing
[2011/04/27 19:14:55 | 000,000,000 | —D | C] – C:\Users\mohammed\Desktop\Free Invoicing
[2011/04/25 13:43:24 | 000,000,000 | —D | C] – C:\Program Files\Common Files\xing shared
[2011/04/25 13:42:56 | 000,006,656 | —- | C] (RealNetworks, Inc.) – C:\Windows\System32\pndx5016.dll
[2011/04/25 13:42:56 | 000,005,632 | —- | C] (RealNetworks, Inc.) – C:\Windows\System32\pndx5032.dll
[2011/04/25 13:42:55 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Real
[2011/04/25 13:42:54 | 000,272,896 | —- | C] (Progressive Networks) – C:\Windows\System32\pncrt.dll
[2011/04/25 13:42:33 | 000,000,000 | —D | C] – C:\Program Files\Real
[2011/04/25 09:48:22 | 000,053,248 | —- | C] (Windows XP Bundled build C-Centric Single User) – C:\Windows\System32\CSVer.dll
[2011/04/22 18:13:47 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Quran_AR
[2011/04/18 16:53:08 | 000,000,000 | —D | C] – C:\Users\mohammed\AppData\Roaming\Wireshark
[2011/04/18 13:00:36 | 000,000,000 | —D | C] – C:\Program Files\Wireshark
[2011/04/18 12:19:16 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPcap
[2011/04/18 12:19:13 | 000,000,000 | —D | C] – C:\Program Files\WinPcap
[2011/04/18 07:21:09 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/04/18 07:21:08 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/04/18 07:21:07 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/04/18 07:19:23 | 001,164,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc42u.dll
[2011/04/18 07:19:23 | 001,137,664 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc42.dll
[2011/04/14 20:00:28 | 002,333,184 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2011/04/14 19:49:43 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dnscacheugc.exe
[2011/04/14 19:48:55 | 000,294,912 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\atmfd.dll
[2011/04/14 19:48:55 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\System32\atmlib.dll
[2011/04/14 19:44:46 | 000,191,488 | —- | C] (Microsoft Corporation) – C:\Windows\System32\FXSCOVER.exe
[2011/04/14 19:40:51 | 000,716,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript.dll
[2011/04/14 19:40:51 | 000,428,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vbscript.dll
[2011/04/13 15:18:56 | 000,000,000 | —D | C] – C:\Users\mohammed\Desktop\chinese
[2010/04/21 17:32:38 | 000,004,096 | —- | C] ( ) – C:\Windows\System32\IGFXDEVLib.dll
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Public\Documents\*.tmp files -> C:\Users\Public\Documents\*.tmp -> ]
[1 C:\Users\mohammed\Desktop\*.tmp files -> C:\Users\mohammed\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/05/10 08:22:49 | 000,014,832 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/05/10 08:22:49 | 000,014,832 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/05/10 08:15:45 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/05/10 08:14:44 | 000,000,868 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2011/05/10 08:12:07 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/05/10 08:12:02 | 2339,602,432 | -HS- | M] () – C:\hiberfil.sys
[2011/05/09 21:04:00 | 000,000,890 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/05/08 19:44:50 | 000,039,629 | —- | M] () – C:\Users\mohammed\Desktop\167372_195926047090522_100000193840033_818190_7847735_n.jpg
[2011/05/08 17:48:41 | 000,056,205 | —- | M] () – C:\Users\mohammed\Desktop\eset.jpg
[2011/05/08 10:43:03 | 000,001,067 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/08 10:41:56 | 007,734,208 | —- | M] (Malwarebytes Corporation ) – C:\Users\mohammed\Desktop\mbam-setup.exe
[2011/05/08 10:00:44 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2011/05/08 09:28:57 | 004,343,224 | R— | M] () – C:\Users\mohammed\Desktop\ComboFix.exe
[2011/05/07 18:13:55 | 028,746,182 | —- | M] () – C:\Users\mohammed\Desktop\07052011.pcap
[2011/05/07 17:55:42 | 000,000,512 | —- | M] () – C:\Users\mohammed\Desktop\MBR.dat
[2011/05/07 12:34:17 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\mohammed\Desktop\OTL.exe
[2011/05/07 11:15:12 | 000,000,036 | —- | M] () – C:\Users\mohammed\AppData\Local\housecall.guid.cache
[2011/05/04 13:54:12 | 000,302,080 | —- | M] () – C:\Users\mohammed\Desktop\gmer.exe
[2011/05/02 12:53:49 | 000,028,160 | —- | M] () – C:\Users\mohammed\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/05/01 17:26:04 | 000,002,374 | —- | M] () – C:\Users\mohammed\Desktop\Google Chrome.lnk
[2011/04/30 14:25:43 | 000,631,364 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/04/30 14:25:43 | 000,111,456 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/04/30 10:18:26 | 000,001,096 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/04/29 07:37:47 | 000,000,868 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-552828051-1168902950-2987038348-1000Core1cc05ec841422d5.job
[2011/04/25 13:43:29 | 000,001,234 | —- | M] () – C:\Users\Public\Desktop\RealPlayer.lnk
[2011/04/25 13:42:56 | 000,006,656 | —- | M] (RealNetworks, Inc.) – C:\Windows\System32\pndx5016.dll
[2011/04/25 13:42:56 | 000,005,632 | —- | M] (RealNetworks, Inc.) – C:\Windows\System32\pndx5032.dll
[2011/04/25 13:42:54 | 000,272,896 | —- | M] (Progressive Networks) – C:\Windows\System32\pncrt.dll
[2011/04/25 09:43:18 | 000,000,000 | RHS- | M] () – C:\Windows\System32\drivers\103C_HP_cNB_Pavilion dv3 Notebook PC_Y5335KV_0U_QCND93352VJ_E514063-371_4A_I306E_SCompal_V22.40_F.15_T101129_WU3-1_L409_M2976_J320_7Intel_8676_92.00_#100705_N80864237;10EC8136_(VJ962PA#ABG)_XMO
BILE_CN10_Z_2F.15.MRK
[2011/04/25 07:41:14 | 000,000,144 | —- | M] () – C:\Windows\System32\pdfl.dat
[2011/04/22 18:13:48 | 000,001,831 | —- | M] () – C:\Users\mohammed\Desktop\Quran Auto Reciter.lnk
[2011/04/22 18:12:58 | 000,737,280 | —- | M] (Indigo Rose Corporation) – C:\Windows\iun6002.exe
[2011/04/18 13:00:47 | 000,001,714 | —- | M] () – C:\Users\mohammed\Application Data\Microsoft\Internet Explorer\Quick Launch\Wireshark.lnk
[2011/04/18 13:00:46 | 000,001,690 | —- | M] () – C:\Users\Public\Desktop\Wireshark.lnk
[2011/04/14 20:42:59 | 001,781,512 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Public\Documents\*.tmp files -> C:\Users\Public\Documents\*.tmp -> ]
[1 C:\Users\mohammed\Desktop\*.tmp files -> C:\Users\mohammed\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/05/08 19:44:48 | 000,039,629 | —- | C] () – C:\Users\mohammed\Desktop\167372_195926047090522_100000193840033_818190_7847735_n.jpg
[2011/05/08 17:48:41 | 000,056,205 | —- | C] () – C:\Users\mohammed\Desktop\eset.jpg
[2011/05/08 10:43:03 | 000,001,067 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/08 09:36:37 | 000,256,512 | —- | C] () – C:\Windows\PEV.exe
[2011/05/08 09:36:37 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2011/05/08 09:36:37 | 000,089,088 | —- | C] () – C:\Windows\MBR.exe
[2011/05/08 09:36:37 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2011/05/08 09:36:37 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2011/05/08 09:26:32 | 004,343,224 | R— | C] () – C:\Users\mohammed\Desktop\ComboFix.exe
[2011/05/07 18:13:54 | 028,746,182 | —- | C] () – C:\Users\mohammed\Desktop\07052011.pcap
[2011/05/07 17:55:42 | 000,000,512 | —- | C] () – C:\Users\mohammed\Desktop\MBR.dat
[2011/05/07 13:05:15 | 000,302,080 | —- | C] () – C:\Users\mohammed\Desktop\gmer.exe
[2011/05/07 11:15:12 | 000,000,036 | —- | C] () – C:\Users\mohammed\AppData\Local\housecall.guid.cache
[2011/04/30 10:18:26 | 000,001,108 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011/04/30 10:18:26 | 000,001,096 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/04/29 07:37:47 | 000,000,868 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-552828051-1168902950-2987038348-1000Core1cc05ec841422d5.job
[2011/04/25 13:43:29 | 000,001,234 | —- | C] () – C:\Users\Public\Desktop\RealPlayer.lnk
[2011/04/25 09:41:32 | 000,000,000 | RHS- | C] () – C:\Windows\System32\drivers\103C_HP_cNB_Pavilion dv3 Notebook PC_Y5335KV_0U_QCND93352VJ_E514063-371_4A_I306E_SCompal_V22.40_F.15_T101129_WU3-1_L409_M2976_J320_7Intel_8676_92.00_#100705_N80864237;10EC8136_(VJ962PA#ABG)_XMO
BILE_CN10_Z_2F.15.MRK
[2011/04/18 13:00:47 | 000,001,714 | —- | C] () – C:\Users\mohammed\Application Data\Microsoft\Internet Explorer\Quick Launch\Wireshark.lnk
[2011/04/18 13:00:46 | 000,001,702 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark.lnk
[2011/04/18 13:00:46 | 000,001,690 | —- | C] () – C:\Users\Public\Desktop\Wireshark.lnk
[2011/04/01 10:49:28 | 000,001,849 | —- | C] () – C:\Users\mohammed\AppData\Roaming\GhostObjGAFix.xml
[2011/03/23 14:04:55 | 000,014,632 | —- | C] () – C:\Windows\System32\WHIDCoinst.dll
[2011/03/15 15:10:33 | 000,004,432 | —- | C] () – C:\ProgramData\precheck_output.xml
[2010/11/15 06:30:33 | 000,000,050 | —- | C] () – C:\Windows\cdplayer.ini
[2010/09/28 02:26:01 | 000,028,160 | —- | C] () – C:\Users\mohammed\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/14 18:23:33 | 000,007,669 | —- | C] () – C:\Users\mohammed\AppData\Local\Resmon.ResmonCfg
[2010/08/28 12:13:17 | 000,000,000 | —- | C] () – C:\Windows\nsreg.dat
[2010/08/08 20:50:29 | 000,000,144 | —- | C] () – C:\Windows\System32\pdfl.dat
[2010/08/08 20:50:29 | 000,000,144 | —- | C] () – C:\Windows\System32\lkfl.dat
[2010/08/08 20:50:29 | 000,000,080 | —- | C] () – C:\Windows\System32\ibfl.dat
[2010/07/07 09:47:02 | 000,000,056 | -H– | C] () – C:\Windows\System32\ezsidmv.dat
[2010/07/06 13:56:39 | 000,000,000 | —- | C] () – C:\Windows\HPMProp.INI
[2010/07/05 17:18:17 | 000,087,552 | —- | C] () – C:\Windows\System32\cpwmon2k.dll
[2010/06/26 03:03:12 | 000,053,299 | —- | C] () – C:\Windows\System32\pthreadVC.dll
[2010/04/21 17:29:46 | 000,000,151 | —- | C] () – C:\Windows\System32\GfxUI.exe.config
[2010/04/21 17:22:50 | 000,208,896 | —- | C] () – C:\Windows\System32\iglhsip32.dll
[2010/04/21 17:22:50 | 000,143,360 | —- | C] () – C:\Windows\System32\iglhcp32.dll
[2009/08/26 16:57:38 | 000,982,220 | —- | C] () – C:\Windows\System32\igkrng500.bin
[2009/08/26 16:57:38 | 000,439,300 | —- | C] () – C:\Windows\System32\igcompkrng500.bin
[2009/08/26 16:57:38 | 000,134,592 | —- | C] () – C:\Windows\System32\igfcg500.bin
[2009/08/26 16:57:38 | 000,092,216 | —- | C] () – C:\Windows\System32\igfcg500m.bin
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2009/07/14 14:57:37 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/14 14:33:53 | 001,781,512 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2009/07/14 12:05:48 | 000,631,364 | —- | C] () – C:\Windows\System32\perfh009.dat
[2009/07/14 12:05:48 | 000,291,294 | —- | C] () – C:\Windows\System32\perfi009.dat
[2009/07/14 12:05:48 | 000,111,456 | —- | C] () – C:\Windows\System32\perfc009.dat
[2009/07/14 12:05:48 | 000,031,548 | —- | C] () – C:\Windows\System32\perfd009.dat
[2009/07/14 12:05:05 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2009/07/14 12:04:11 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2009/07/14 09:55:01 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/14 09:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/14 09:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/07/09 15:44:40 | 000,004,608 | —- | C] () – C:\Windows\System32\HdmiCoin.dll
[2009/06/11 07:26:10 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2008/05/08 19:16:12 | 000,043,566 | —- | C] () – C:\Windows\php_old.ini

========== Alternate Data Streams ==========

@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:DFC5A2B2

< End of report >

CatByte

Post #12May 10, 2011, 12:26 AM UTC

Hi,

Please do the following:

have a look in the FireFox Add-ons manager

Tools -> Add-ons -> Extensions > see if the searchq toolbar is listed there > select it and click the 'Uninstall' button, then restart Firefox.
If the 'Uninstall' option is not working, restart Firefox in Safe Mode (firefox safemode) and try again. If you still can't uninstall the toolbar, use the 'Disable" option as a workaround and I'll try uninstalling it with OTL

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
[2011/05/06 12:09:58 | 000,000,000 | —D | M] (Searchqu Toolbar) – C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
IE - HKCU\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - Reg Error: Key error. File not found
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O15 - HKCU\..Trusted Domains: alipay.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: alipay.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: alisoft.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: alisoft.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: taobao.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: taobao.com ([]https in Trusted sites)

:Files
ipconfig /flushdns /c

:Commands
[resethosts]
[emptyflash]
[purity]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post the OTL log

NEXT

Please advise how the computer is running and if there are any outstanding issues

makosa

Post #13May 10, 2011, 1:06 AM UTC

This is the new OTL log:

Computer is running okay, searchqu doesnt show up.

All processes killed
========== OTL ==========
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\components folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\searchbar folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\options folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\weatherbutton\panels\images folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\weatherbutton\panels folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\weatherbutton\icons folder moved successfully.
Folder move failed. C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\weatherbutton scheduled to be moved on reboot.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\uwa folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\radio\images folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\radio\css folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\radio folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\panels\images folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\panels\default\scripts folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\panels\default\images folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\panels\default\css folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\panels\default folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\panels\css folder moved successfully.
Folder move failed. C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\panels scheduled to be moved on reboot.
Folder move failed. C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib scheduled to be moved on reboot.
Folder move failed. C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin scheduled to be moved on reboot.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.YouTube_v2\skin\scripts folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.YouTube_v2\skin\images folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.YouTube_v2\skin\css folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.YouTube_v2\skin folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.YouTube_v2\js folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.YouTube_v2\images folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.YouTube_v2\css folder moved successfully.
Folder move failed. C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.YouTube_v2 scheduled to be moved on reboot.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.Twitter\skin\scripts folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.Twitter\skin\images folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.Twitter\skin\css folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.Twitter\skin folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.Twitter\js folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.Twitter\images folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.Twitter\css folder moved successfully.
Folder move failed. C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.Twitter scheduled to be moved on reboot.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.PPCBully folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\scripts folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\images folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\css folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.MyStartFacebook\js folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.MyStartFacebook\images folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.MyStartFacebook\css folder moved successfully.
Folder move failed. C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.MyStartFacebook scheduled to be moved on reboot.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\scripts folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\images folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\css folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.Coupons_v2\skin folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.Coupons_v2\js folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.Coupons_v2\images folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.Coupons_v2\css folder moved successfully.
Folder move failed. C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.Coupons_v2 scheduled to be moved on reboot.
Folder move failed. C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets scheduled to be moved on reboot.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\modules folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\lib folder moved successfully.
Folder move failed. C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\data\search scheduled to be moved on reboot.
Folder move failed. C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\data scheduled to be moved on reboot.
Folder move failed. C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content scheduled to be moved on reboot.
Folder move failed. C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome scheduled to be moved on reboot.
Folder move failed. C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7} scheduled to be moved on reboot.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{472734EA-242A-422b-ADF8-83D1E48CC825} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{472734EA-242A-422b-ADF8-83D1E48CC825}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\alipay.com\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\alipay.com\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\alisoft.com\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\alisoft.com\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\taobao.com\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\taobao.com\ not found.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\mohammed\Desktop\cmd.bat deleted successfully.
C:\Users\mohammed\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYFLASH]

User: Administrator

User: All Users

User: Default

User: Default User

User: mohammed
->Flash cache emptied: 69100 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->FireFox cache emptied: 2280761 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: mohammed
->Temp folder emptied: 14289896 bytes
->Temporary Internet Files folder emptied: 188051733 bytes
->Java cache emptied: 330715 bytes
->FireFox cache emptied: 59926092 bytes
->Google Chrome cache emptied: 166863072 bytes
->Flash cache emptied: 456 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 619520 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2529953 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 415.00 mb

OTL by OldTimer - Version 3.2.22.3 log created on 05102011_104607

Files\Folders moved on Reboot…
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\weatherbutton folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib\panels folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin\lib folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\skin folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.YouTube_v2 folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.Twitter folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.MyStartFacebook folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets\net.vmn.www.Coupons_v2 folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\widgets folder moved successfully.
File\Folder C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\data\search not found!
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content\data folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome\content folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}\chrome folder moved successfully.
C:\Users\mohammed\AppData\Roaming\Mozilla\Firefox\Profiles\82wfbvyl.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7} folder moved successfully.
C:\Users\mohammed\AppData\Local\Temp\Low\debug.log moved successfully.
File\Folder C:\Users\mohammed\AppData\Local\Temp\~DF1656AEACD22153FB.TMP not found!
File\Folder C:\Users\mohammed\AppData\Local\Temp\~DF276F954D17DA2217.TMP not found!
File\Folder C:\Users\mohammed\AppData\Local\Temp\~DF3385EF80E87446AD.TMP not found!
File\Folder C:\Users\mohammed\AppData\Local\Temp\~DF42CEB0E3510F91E6.TMP not found!
C:\Users\mohammed\AppData\Local\Temp\~DF4B9442303D963A7B.TMP moved successfully.
File\Folder C:\Users\mohammed\AppData\Local\Temp\~DF5B0B4EF11600799E.TMP not found!
File\Folder C:\Users\mohammed\AppData\Local\Temp\~DF70B4D07AF7E7768D.TMP not found!
File\Folder C:\Users\mohammed\AppData\Local\Temp\~DF906F02459D82DB3E.TMP not found!
File\Folder C:\Users\mohammed\AppData\Local\Temp\~DF927A3AC807FF0A57.TMP not found!
File\Folder C:\Users\mohammed\AppData\Local\Temp\~DFD75353AB315433F7.TMP not found!
File\Folder C:\Users\mohammed\AppData\Local\Temp\~DFDA186A6C2BDD7A24.TMP not found!
File\Folder C:\Users\mohammed\AppData\Local\Temp\~DFE7F45BB646544D09.TMP not found!
File\Folder C:\Users\mohammed\AppData\Local\Temp\~DFF359E199F8304050.TMP not found!
C:\Users\mohammed\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C\Users\mohammed\AppData\Local\Google\Google Talk Plugin\gtbplugin.log moved successfully.
C:\Users\mohammed\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WPSGTT0S\01[1].htm moved successfully.
C:\Users\mohammed\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WPSGTT0S\01[2].htm moved successfully.
C:\Users\mohammed\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WPSGTT0S\likebox[1].htm moved successfully.
C:\Users\mohammed\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WPSGTT0S\mail[2].htm moved successfully.
C:\Users\mohammed\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\O6YH43IS\article[1].htm moved successfully.
C:\Users\mohammed\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\L0I69YNP\like[1].htm moved successfully.
C:\Users\mohammed\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\IV0IBR2Z\01[1].htm moved successfully.
C:\Users\mohammed\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\IV0IBR2Z\B5109969[3].htm moved successfully.
C:\Users\mohammed\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\IV0IBR2Z\mail[1].htm moved successfully.
C:\Users\mohammed\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\IV0IBR2Z\mail[2].htm moved successfully.
C:\Users\mohammed\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\I1P2UZ0J\like[1].htm moved successfully.
C:\Users\mohammed\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5T2CLGNB\B4950125[2].htm moved successfully.
C:\Users\mohammed\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5T2CLGNB\recommendations[1].htm moved successfully.
File\Folder C:\Users\mohammed\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\628YDAJ4\01[2].htm not found!
File\Folder C:\Users\mohammed\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\628YDAJ4\ADSAdClient31[1].txt not found!
C:\Windows\temp\av8260.tmp moved successfully.
C:\Windows\temp\iswift.dat moved successfully.
C:\Windows\temp\sfdb.dat moved successfully.
C:\Windows\temp\ZLT00651.TMP moved successfully.

Registry entries deleted on Reboot…

CatByte

Post #14May 10, 2011, 1:10 AM UTC

Hi

Just some housekeeping to do now,

Please do the following:

You can delete the aswMBR logs and program from your desktop.

NEXT

Follow these steps to uninstall Combofix

Make sure your security programs are totally disabled.
Click START then RUN
Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]

NEXT

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

If there are any logs/tools remaining on your desktop > right click and delete them.

NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them Then consider a password keeper, to keep all your passwords safe. KeePass is a small utility that allows you to manage all your passwords.
Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
Make Internet Explorer more secure
- Click Start > Run
- Type Inetcpl.cpl & click OK
- Click on the Security tab
- Click Reset all zones to default level
- Make sure the Internet Zone is selected & Click Custom level
- In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
- Next Click OK, then Apply button and then OK to exit the Internet Properties page.
Download TFC to your desktop
- Close any open windows.
- Double click the TFC icon to run the program
- TFC will close all open programs itself in order to run,
- Click the Start button to begin the process.
- Allow TFC to run uninterrupted.
- The program should not take long to finish it's job
- Once its finished it should automatically reboot your machine,
- if it doesn't, manually reboot to ensure a complete clean
It's normal after running TFC cleaner that the PC will be slower to boot the first time.
WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
- Green to go
- Yellow for caution
- Red to stop
WOT has an addon available for both Firefox and IE
Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at this well written article:
PC Safety and Security–What Do I Need?.

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

makosa

Post #15May 10, 2011, 2:14 AM UTC

Hello, I have done the last stages as recommended. I have also changed my online passwords to suit my current situation. I will say with this, this ticket will be considered closed. Thanks for the yeoman's job of support, will also send in my contribution soon. Regards. HM

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Searchqu

✨ Ask AI

Ask AI