search results redirecting and constant script error popups

My son's computer had the Windows Recovery virus. I managed to get rid of that, or so I thought, but now his computer is still getting redirected to "buy anti-spyware" sites and script error popups even though I have that option disabled. Here's the hijackthis log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:24:11 AM, on 5/15/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?ilc=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

–
End of file - 7150 bytes

Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post

• Download aswMBR.exe ( 511KB ) to your desktop.
• Double click the aswMBR.exe to run it
• Click the Scan button to start scan
• On completion of the scan click Save Log, save it to your Desktop and post in your next reply

• Download OTL to your desktop.
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output.
• Check the boxes beside LOP Check and Purity Check.
• Under Custom Scan paste this in
  
  netsvcs
  drivers32
  %SYSTEMDRIVE%\*.*
  %systemroot%\Fonts\*.com
  %systemroot%\Fonts\*.dll
  %systemroot%\Fonts\*.ini
  %systemroot%\Fonts\*.ini2
  %systemroot%\Fonts\*.exe
  %systemroot%\system32\spool\prtprocs\w32x86\*.*
  %systemroot%\REPAIR\*.bak1
  %systemroot%\REPAIR\*.ini
  %systemroot%\system32\*.jpg
  %systemroot%\*.jpg
  %systemroot%\*.png
  %systemroot%\*.scr
  %systemroot%\*._sy
  %APPDATA%\Adobe\Update\*.*
  %ALLUSERSPROFILE%\Favorites\*.*
  %APPDATA%\Microsoft\*.*
  %PROGRAMFILES%\*.*
  %APPDATA%\Update\*.*
  %systemroot%\*. /mp /s
  CREATERESTOREPOINT
  %systemroot%\System32\config\*.sav
  %PROGRAMFILES%\bak. /s
  %systemroot%\system32\bak. /s
  %ALLUSERSPROFILE%\Start Menu\*.lnk /x
  %systemroot%\system32\config\systemprofile\*.dat /x
  %systemroot%\*.config
  %systemroot%\system32\*.db
  %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
  %USERPROFILE%\Desktop\*.exe
  %PROGRAMFILES%\Common Files\*.*
  %systemroot%\*.src
  %systemroot%\install\*.*
  %systemroot%\system32\DLL\*.*
  %systemroot%\system32\HelpFiles\*.*
  %systemroot%\system32\rundll\*.*
  %systemroot%\winn32\*.*
  %systemroot%\Java\*.*
  %systemroot%\system32\test\*.*
  %systemroot%\system32\Rundll32\*.*
  %systemroot%\AppPatch\Custom\*.*
  %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
  %PROGRAMFILES%\PC-Doctor\Downloads\*.*
  %PROGRAMFILES%\Internet Explorer\*.tmp
  %PROGRAMFILES%\Internet Explorer\*.dat
  %USERPROFILE%\My Documents\*.exe
  %USERPROFILE%\*.exe
  %systemroot%\ADDINS\*.*
  %systemroot%\assembly\*.bak2
  %systemroot%\Config\*.*
  %systemroot%\REPAIR\*.bak2
  %systemroot%\SECURITY\Database\*.sdb /x
  %systemroot%\SYSTEM\*.bak2
  %systemroot%\Web\*.bak2
  %systemroot%\Driver Cache\*.*
  %PROGRAMFILES%\Mozilla Firefox\0*.exe
  %ProgramFiles%\Microsoft Common\*.*
  %ProgramFiles%\TinyProxy.
  %USERPROFILE%\Favorites\*.url /x
  %systemroot%\system32\*.bk
  %systemroot%\*.te
  %systemroot%\system32\system32\*.*
  %ALLUSERSPROFILE%\*.dat /x
  %systemroot%\system32\drivers\*.rmv
  dir /b "%systemroot%\system32\*.exe" | find /i " " /c
  dir /b "%systemroot%\*.exe" | find /i " " /c
  %PROGRAMFILES%\Microsoft\*.*
  %systemroot%\System32\Wbem\proquota.exe
  %PROGRAMFILES%\Mozilla Firefox\*.dat
  %USERPROFILE%\Cookies\*.txt /x
  %SystemRoot%\system32\fonts\*.*
  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
  
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
• You may need two posts to fit them both in.

aswMBR version 0.9.5.256 Copyright© 2011 AVAST Software
Run date: 2011-05-17 18:20:28
—————————–
18:20:28.790 OS Version: Windows 5.1.2600 Service Pack 3
18:20:28.790 Number of processors: 1 586 0x2C02
18:20:28.790 ComputerName: YOUR-E752847052 UserName: Owner
18:20:31.064 Initialize success
18:20:35.951 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
18:20:35.981 Disk 0 Vendor: ST380021A 3.75 Size: 76319MB BusType: 3
18:20:38.014 Disk 0 MBR read successfully
18:20:38.014 Disk 0 MBR scan
18:20:38.014 Disk 0 unknown MBR code
18:20:40.017 Disk 0 scanning sectors +156280320
18:20:40.037 Disk 0 scanning C:\WINDOWS\system32\drivers
18:21:12.523 Service scanning
18:21:13.695 Disk 0 trace - called modules:
18:21:13.715 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x85e901ed]<<
18:21:13.715 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85eb1ab8]
18:21:13.715 3 CLASSPNP.SYS[f75b4fd7] -> nt!IofCallDriver -> \Device\00000088[0x85f84f18]
18:21:13.715 5 ACPI.sys[f73cb620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x85f004e0]
18:21:13.715 \Driver\atapi[0x85f00c28] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0x85e901ed
18:21:13.725 Scan finished successfully
18:24:25.851 Disk 0 MBR has been saved successfully to "I:\MBR.dat"
18:24:25.871 The log file has been saved successfully to "I:\aswMBR.txt"




OTL logfile created on: 5/17/2011 6:27:49 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

494.00 Mb Total Physical Memory | 153.00 Mb Available Physical Memory | 31.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 63.00% Paging File free
Paging file location(s): C:\pagefile.sys 744 1488 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 60.11 Gb Free Space | 80.66% Space Free | Partition Type: NTFS
Drive D: | 7.72 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive I: | 955.72 Mb Total Space | 780.03 Mb Free Space | 81.62% Space Free | Partition Type: FAT

Computer Name: YOUR-E752847052 | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe ()
PRC - C:\Program Files\AVG\AVG10\avgsrmax.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Windows NT\Accessories\wordpad.exe (Microsoft Corporation)
PRC - C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – File not found
SRV - (AppMgmt) – File not found
SRV - (AVG Security Toolbar Service) – C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe ()
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (NMSAccessU) – C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
SRV - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (AVGIDSDriver) – C:\WINDOWS\system32\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgtdix) – C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) – C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) – C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSEH) – C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSShim) – C:\WINDOWS\system32\drivers\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSFilter) – C:\WINDOWS\system32\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgldx86) – C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (MBAMSwissArmy) – C:\WINDOWS\system32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (PnkBstrK) – C:\WINDOWS\system32\drivers\PnkBstrK.sys ()
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\alcxwdm.sys (Realtek Semiconductor Corp.)
DRV - (nvnetbus) – C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
DRV - (AmdPPM) – C:\WINDOWS\system32\drivers\AmdPPM.sys (Advanced Micro Devices)
DRV - (nvata) – C:\WINDOWS\system32\DRIVERS\nvata.sys (NVIDIA Corporation)
DRV - (HSF_DPV) – C:\WINDOWS\system32\drivers\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (HSFHWBS2) – C:\WINDOWS\system32\drivers\HSFHWBS2.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (mxnic) – C:\WINDOWS\system32\drivers\mxnic.sys (Macronix International Co., Ltd. )


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{DCB16B06-6FEA-42D8-8B9B-82B2C261A01C}: C:\Documents and Settings\Owner\Local Settings\Application Data\{DCB16B06-6FEA-42D8-8B9B-82B2C261A01C} [2011/05/09 17:41:33 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/05/10 22:17:38 | 000,000,000 | —D | M]

[2011/03/10 22:55:23 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions

O1 HOSTS File: ([2009/09/28 12:18:46 | 000,335,225 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 11488 more lines…
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [UserFaultCheck] File not found
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &ieSpell Options - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Check &Spelling - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Lookup on Merriam Webster - C:\Program Files\ieSpell\Merriam Webster.HTM ()
O8 - Extra context menu item: Lookup on Wikipedia - C:\Program Files\ieSpell\wikipedia.HTM ()
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/26 14:04:39 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2010/09/09 22:14:07 | 000,000,047 | RH– | M] () - D:\autorun.inf – [ UDF ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.ac3acm - C:\WINDOWS\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\WINDOWS\System32\lameACM.acm (http://www.mp3dev.org/)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
Drivers32: VIDC.HFYU - C:\WINDOWS\System32\huffyuv.dll (Disappearing Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.VP70 - C:\WINDOWS\System32\vp7vfw.dll (On2.com)
Drivers32: VIDC.XVID - C:\WINDOWS\System32\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\WINDOWS\System32\yv12vfw.dll (www.helixcommunity.org)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2011/05/17 18:24:50 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/05/17 18:20:15 | 000,589,632 | —- | C] (AVAST Software) – C:\Documents and Settings\Owner\Desktop\aswMBR.exe
[2011/05/15 16:27:54 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Start Menu\Programs\World of Warcraft
[2011/05/15 16:27:07 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Start Menu\Programs\Turbine
[2011/05/15 16:26:15 | 001,974,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_42.dll
[2011/05/15 16:26:06 | 000,235,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx11_42.dll
[2011/05/15 16:25:48 | 000,453,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_42.dll
[2011/05/15 13:57:11 | 000,953,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc40u.dll
[2011/05/15 13:57:10 | 000,978,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc42.dll
[2011/05/15 13:56:42 | 000,617,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comctl32.dll
[2011/05/15 13:56:09 | 000,744,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\helpsvc.exe
[2011/05/15 13:55:51 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ndproxy.sys
[2011/05/15 13:43:55 | 000,471,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\aclayers.dll
[2011/05/15 13:41:29 | 003,558,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\moviemk.exe
[2011/05/15 13:39:41 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wab.exe
[2011/05/15 13:09:09 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Owner\IECompatCache
[2011/05/15 10:23:28 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2011/05/15 10:23:28 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Start Menu\Programs\HiJackThis
[2011/05/15 09:58:58 | 000,222,080 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MpSigStub.exe
[2011/05/15 09:56:03 | 000,000,000 | —D | C] – C:\Program Files\Windows Defender
[2011/05/15 09:47:04 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2011/05/11 21:02:08 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\TEMP
[2011/05/11 21:00:06 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\PC Tools
[2011/05/11 20:26:40 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2011/05/11 19:20:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\RegCure
[2011/05/11 19:18:49 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\WinZip
[2011/05/11 19:18:30 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\WinZip
[2011/05/11 19:17:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\WinZip
[2011/05/11 19:17:41 | 000,000,000 | —D | C] – C:\Program Files\WinZip
[2011/05/11 15:16:58 | 016,409,960 | —- | C] (Safer Networking Limited ) – C:\Documents and Settings\Owner\My Documents\spybotsd162.exe
[2011/05/11 01:45:06 | 000,016,736 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll.mui
[2011/05/11 01:45:05 | 000,274,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll
[2011/05/10 22:22:08 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\AVG10
[2011/05/10 22:17:52 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\AVG 2011
[2011/05/10 22:15:32 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVG10
[2011/05/10 22:15:32 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\AVG
[2011/05/10 22:10:22 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\Malwarebytes
[2011/05/10 21:36:58 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/10 21:36:58 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/05/10 21:36:57 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/05/10 21:36:54 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/05/10 21:28:22 | 000,000,000 | R–D | C] – C:\Documents and Settings\Owner\Recent
[2011/05/10 21:27:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/05/10 21:26:50 | 000,000,000 | —D | C] – C:\$AVG
[2011/05/10 21:05:14 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/05/09 17:41:33 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\{DCB16B06-6FEA-42D8-8B9B-82B2C261A01C}
[2011/05/09 17:37:45 | 000,000,000 | —D | C] – C:\WINDOWS\Sun
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/05/17 18:18:51 | 000,192,954 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2011/05/17 18:18:10 | 000,012,598 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/05/17 18:17:51 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/05/17 18:15:24 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/05/17 18:14:46 | 000,589,632 | —- | M] (AVAST Software) – C:\Documents and Settings\Owner\Desktop\aswMBR.exe
[2011/05/15 16:22:36 | 000,441,652 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/05/15 16:22:36 | 000,071,526 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/05/15 16:17:50 | 000,112,584 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/05/15 15:16:30 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/05/15 10:23:43 | 000,002,447 | —- | M] () – C:\Documents and Settings\Owner\Desktop\HiJackThis.lnk
[2011/05/15 09:52:35 | 115,063,255 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/05/11 21:03:29 | 000,596,970 | —- | M] () – C:\WINDOWS\System32\drivers\Cat.DB
[2011/05/11 20:59:59 | 000,512,992 | —- | M] () – C:\Documents and Settings\Owner\My Documents\sdsetup_aff[1].exe
[2011/05/11 19:22:18 | 000,000,910 | —- | M] () – C:\Documents and Settings\Owner\Desktop\The Lord of the Rings Online.lnk
[2011/05/11 19:22:18 | 000,000,627 | —- | M] () – C:\Documents and Settings\Owner\Desktop\World Of Warcraft Cataclysm.lnk
[2011/05/11 19:22:18 | 000,000,606 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Shortcut to Dark Crusade.lnk
[2011/05/11 19:18:30 | 000,001,732 | —- | M] () – C:\Documents and Settings\Owner\My Documents\WinZip.lnk
[2011/05/11 17:36:05 | 000,000,100 | —- | M] () – C:\WINDOWS\wininit.ini
[2011/05/11 15:18:09 | 000,000,933 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Spybot - Search & Destroy.lnk
[2011/05/11 15:14:20 | 016,409,960 | —- | M] (Safer Networking Limited ) – C:\Documents and Settings\Owner\My Documents\spybotsd162.exe
[2011/05/11 13:16:52 | 000,000,667 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Shortcut to iexplore.lnk
[2011/05/11 13:15:54 | 000,000,500 | —- | M] () – C:\WINDOWS\tasks\One-Click Tweak.job
[2011/05/10 22:17:55 | 000,000,690 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk
[2011/05/10 21:36:58 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/10 21:32:38 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/05/10 21:22:32 | 001,006,778 | —- | M] () – C:\Documents and Settings\Owner\Desktop\rkill.com
[2011/05/10 20:00:04 | 000,000,000 | —- | M] () – C:\WINDOWS\Jkegomu.bin
[2011/05/09 17:56:04 | 000,000,152 | —- | M] () – C:\Documents and Settings\All Users\Application Data\~17555236
[2011/05/09 17:55:58 | 000,000,160 | —- | M] () – C:\Documents and Settings\All Users\Application Data\~17555236r
[2011/05/09 17:49:26 | 000,000,336 | —- | M] () – C:\Documents and Settings\All Users\Application Data\17555236
[2011/05/09 17:41:35 | 000,000,120 | —- | M] () – C:\WINDOWS\Hhiwuyubozidi.dat
[2011/05/09 17:39:30 | 000,000,000 | —- | M] () – C:\Documents and Settings\Owner\2gweorjqjutp92vjy9gake
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/05/15 10:23:28 | 000,002,447 | —- | C] () – C:\Documents and Settings\Owner\Desktop\HiJackThis.lnk
[2011/05/15 09:56:13 | 000,000,955 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Windows Defender.lnk
[2011/05/15 09:52:35 | 115,063,255 | —- | C] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/05/11 21:03:19 | 000,596,970 | —- | C] () – C:\WINDOWS\System32\drivers\Cat.DB
[2011/05/11 21:00:06 | 000,512,992 | —- | C] () – C:\Documents and Settings\Owner\My Documents\sdsetup_aff[1].exe
[2011/05/11 19:18:30 | 000,001,732 | —- | C] () – C:\Documents and Settings\Owner\My Documents\WinZip.lnk
[2011/05/11 17:36:05 | 000,000,100 | —- | C] () – C:\WINDOWS\wininit.ini
[2011/05/11 15:18:09 | 000,000,933 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Spybot - Search & Destroy.lnk
[2011/05/11 15:17:09 | 001,006,778 | —- | C] () – C:\Documents and Settings\Owner\Desktop\rkill.com
[2011/05/11 13:16:52 | 000,000,667 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Shortcut to iexplore.lnk
[2011/05/11 11:46:23 | 000,000,500 | —- | C] () – C:\WINDOWS\tasks\One-Click Tweak.job
[2011/05/10 22:17:55 | 000,000,690 | —- | C] () – C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk
[2011/05/10 21:36:58 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/10 20:19:01 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/05/09 17:55:58 | 000,000,160 | —- | C] () – C:\Documents and Settings\All Users\Application Data\~17555236r
[2011/05/09 17:55:57 | 000,000,152 | —- | C] () – C:\Documents and Settings\All Users\Application Data\~17555236
[2011/05/09 17:49:26 | 000,000,336 | —- | C] () – C:\Documents and Settings\All Users\Application Data\17555236
[2011/05/09 17:41:35 | 000,000,120 | —- | C] () – C:\WINDOWS\Hhiwuyubozidi.dat
[2011/05/09 17:41:35 | 000,000,000 | —- | C] () – C:\WINDOWS\Jkegomu.bin
[2011/05/09 17:39:30 | 000,000,000 | —- | C] () – C:\Documents and Settings\Owner\2gweorjqjutp92vjy9gake
[2011/01/09 16:07:46 | 000,000,000 | —- | C] () – C:\WINDOWS\iPlayer.INI
[2010/03/21 12:56:13 | 000,003,584 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/26 07:17:10 | 000,006,518 | —- | C] () – C:\WINDOWS\System32\18329szambot17c5.exe
[2009/12/25 11:08:24 | 000,008,292 | —- | C] () – C:\WINDOWS\19895irz188.exe
[2009/12/25 05:56:32 | 000,009,566 | —- | C] () – C:\WINDOWS\1a30vz92655.dll
[2009/12/22 17:46:26 | 000,008,161 | —- | C] () – C:\WINDOWS\System32\1159viruz15e.dll
[2009/12/22 03:02:51 | 000,009,214 | —- | C] () – C:\WINDOWS\System32\2995threat16z37.dll
[2009/12/21 01:53:56 | 000,018,134 | —- | C] () – C:\WINDOWS\System32\35019zorm515.exe
[2009/12/19 21:30:34 | 000,015,838 | —- | C] () – C:\WINDOWS\30956tzoj579.exe
[2009/12/19 15:59:06 | 000,017,690 | —- | C] () – C:\WINDOWS\System32\5563zhief9530.exe
[2009/12/19 04:11:46 | 000,002,625 | —- | C] () – C:\WINDOWS\System32\1zb7vir3593.bin
[2009/12/13 15:30:41 | 000,008,664 | —- | C] () – C:\WINDOWS\System32\6a5ethi9z674.exe
[2009/12/13 15:30:40 | 000,002,801 | —- | C] () – C:\WINDOWS\System32\z07595ro9192.dll
[2009/12/13 15:30:39 | 000,008,415 | —- | C] () – C:\WINDOWS\System32\59z559y4cd.bin
[2009/12/13 15:30:29 | 000,011,005 | —- | C] () – C:\WINDOWS\25696spyze2.dll
[2009/12/13 15:30:29 | 000,005,204 | —- | C] () – C:\WINDOWS\System32\31694h5cktool4bfz.dll
[2009/12/13 15:30:28 | 000,008,413 | —- | C] () – C:\WINDOWS\System32\7f39vz9785.exe
[2009/12/13 15:30:27 | 000,017,256 | —- | C] () – C:\WINDOWS\System32\5088addw9rz345.dll
[2009/12/13 15:30:27 | 000,016,509 | —- | C] () – C:\WINDOWS\System32\32615zir9s565.exe
[2009/12/13 15:30:27 | 000,007,337 | —- | C] () – C:\WINDOWS\System32\5cb5thrzat9195.exe
[2009/12/13 15:30:25 | 000,015,285 | —- | C] () – C:\WINDOWS\System32\28ddbz5kdoor3159.dll
[2009/12/13 15:30:16 | 000,003,771 | —- | C] () – C:\WINDOWS\System32\23738zp59ec.dll
[2009/12/13 15:30:09 | 000,014,293 | —- | C] () – C:\WINDOWS\78cfste5l9z9.exe
[2009/12/13 15:30:03 | 000,009,846 | —- | C] () – C:\WINDOWS\1zf79ddwa5e2109.bin
[2009/12/13 15:29:58 | 000,007,953 | —- | C] () – C:\WINDOWS\System32\3z7fs9ea5808.dll
[2009/12/13 15:29:53 | 000,017,399 | —- | C] () – C:\WINDOWS\61859hiez3199.exe
[2009/12/13 15:29:51 | 000,011,754 | —- | C] () – C:\WINDOWS\System32\57z3vir9s59c.exe
[2009/12/13 15:29:51 | 000,006,456 | —- | C] () – C:\WINDOWS\25z05wo9m350.bin
[2009/12/13 15:29:48 | 000,012,394 | —- | C] () – C:\WINDOWS\27051tr5j49z9.dll
[2009/12/13 15:29:47 | 000,005,885 | —- | C] () – C:\WINDOWS\System32\131z09pambo5b6.exe
[2009/12/13 15:29:46 | 000,004,630 | —- | C] () – C:\WINDOWS\4773t5zea917402.bin
[2009/12/13 15:29:42 | 000,002,971 | —- | C] () – C:\WINDOWS\29759zac5tool752.bin
[2009/12/13 15:29:35 | 000,015,689 | —- | C] () – C:\WINDOWS\2759s9ambzt763.dll
[2009/12/13 15:29:34 | 000,007,711 | —- | C] () – C:\WINDOWS\5590addwzre16159.exe
[2009/12/13 15:29:33 | 000,004,764 | —- | C] () – C:\WINDOWS\System32\964zdownl5ader953.dll
[2009/12/13 15:29:30 | 000,017,470 | —- | C] () – C:\WINDOWS\55zdownloade9452.dll
[2009/12/13 15:29:29 | 000,013,741 | —- | C] () – C:\WINDOWS\System32\25z05tr9j51.dll
[2009/12/13 15:29:27 | 000,015,423 | —- | C] () – C:\WINDOWS\8573zo5m495.bin
[2009/12/13 15:29:26 | 000,017,527 | —- | C] () – C:\WINDOWS\System32\31794zo597a5.dll
[2009/12/13 15:29:23 | 000,005,904 | —- | C] () – C:\WINDOWS\System32\200209i5us1a7z.dll
[2009/12/13 15:29:10 | 000,015,245 | —- | C] () – C:\WINDOWS\System32\3d889hzef1259.dll
[2009/12/13 15:29:08 | 000,017,279 | —- | C] () – C:\WINDOWS\System32\5z20thi95889.bin
[2009/12/13 15:29:05 | 000,006,406 | —- | C] () – C:\WINDOWS\2zb5add5are869.bin
[2009/12/13 15:29:04 | 000,003,587 | —- | C] () – C:\WINDOWS\2ce3spyzare5579.bin
[2009/12/13 15:28:59 | 000,011,217 | —- | C] () – C:\WINDOWS\System32\z6315viru91a9.bin
[2009/12/13 15:28:58 | 000,016,398 | —- | C] () – C:\WINDOWS\51939zorm3c3.dll
[2009/12/13 15:28:58 | 000,006,356 | —- | C] () – C:\WINDOWS\System32\758bdo9nloadez3024.dll
[2009/12/13 15:28:56 | 000,008,260 | —- | C] () – C:\WINDOWS\System32\5a59z5ars9386.exe
[2009/12/13 15:28:56 | 000,004,853 | —- | C] () – C:\WINDOWS\24a0bazkdoor29359.bin
[2009/12/13 15:28:52 | 000,016,235 | —- | C] () – C:\WINDOWS\System32\ba4b5c9zoor307.bin
[2009/12/13 15:28:52 | 000,006,378 | —- | C] () – C:\WINDOWS\323955ozm359.exe
[2009/12/13 15:28:51 | 000,011,667 | —- | C] () – C:\WINDOWS\System32\9ezav5r1578.exe
[2009/12/13 15:28:48 | 000,016,855 | —- | C] () – C:\WINDOWS\9aafzhrea516377.bin
[2009/12/13 15:28:43 | 000,016,999 | —- | C] () – C:\WINDOWS\165th5zf23919.dll
[2009/12/13 15:28:42 | 000,010,088 | —- | C] () – C:\WINDOWS\System32\29847not-a-zirus9e5.bin
[2009/12/13 15:28:40 | 000,008,919 | —- | C] () – C:\WINDOWS\15265no9-a-virusz1.dll
[2009/12/13 15:28:37 | 000,006,453 | —- | C] () – C:\WINDOWS\System32\2z94v5r25219.exe
[2009/12/13 15:28:36 | 000,017,063 | —- | C] () – C:\WINDOWS\System32\58b9zh5eat12194.dll
[2009/12/13 15:28:29 | 000,008,853 | —- | C] () – C:\WINDOWS\59092hacktooz454.exe
[2009/12/13 15:28:29 | 000,003,362 | —- | C] () – C:\WINDOWS\495d9ackdoorz5775.exe
[2009/12/13 15:28:28 | 000,012,901 | —- | C] () – C:\WINDOWS\21574s9zmbot2c5.dll
[2009/12/13 15:28:27 | 000,010,627 | —- | C] () – C:\WINDOWS\System32\50139zirus6d4.bin
[2009/12/13 15:28:25 | 000,005,338 | —- | C] () – C:\WINDOWS\System32\39ffsze9l5075.bin
[2009/12/13 15:28:19 | 000,009,165 | —- | C] () – C:\WINDOWS\System32\z301s9y755.exe
[2009/12/13 15:28:11 | 000,010,766 | —- | C] () – C:\WINDOWS\3821down9oader27z95.bin
[2009/12/13 15:28:11 | 000,009,645 | —- | C] () – C:\WINDOWS\52014hazkt9ol12d.bin
[2009/12/13 15:28:08 | 000,005,704 | —- | C] () – C:\WINDOWS\System32\3abdz9yware858.dll
[2009/12/13 15:28:07 | 000,012,599 | —- | C] () – C:\WINDOWS\4505z9ambot557.dll
[2009/12/13 15:28:07 | 000,011,001 | —- | C] () – C:\WINDOWS\2z0745irus9c0.dll
[2009/12/13 15:28:07 | 000,010,442 | —- | C] () – C:\WINDOWS\System32\6db9stezl955.dll
[2009/12/13 15:28:06 | 000,006,062 | —- | C] () – C:\WINDOWS\System32\1110559oj2z9.dll
[2009/12/13 15:28:05 | 000,017,425 | —- | C] () – C:\WINDOWS\System32\14712worm45z9.exe
[2009/12/13 15:28:05 | 000,010,760 | —- | C] () – C:\WINDOWS\z5871troj7a99.exe
[2009/12/13 15:28:04 | 000,008,481 | —- | C] () – C:\WINDOWS\40f2stz9l14545.exe
[2009/12/13 15:27:59 | 000,014,246 | —- | C] () – C:\WINDOWS\System32\3569ad9warez242.bin
[2009/12/13 15:27:57 | 000,008,557 | —- | C] () – C:\WINDOWS\System32\5509thre5t1179z.exe
[2009/12/13 15:27:56 | 000,010,091 | —- | C] () – C:\WINDOWS\61589orz25.exe
[2009/12/13 15:27:52 | 000,013,083 | —- | C] () – C:\WINDOWS\25e7backd95r7z3.exe
[2009/12/13 15:27:47 | 000,016,690 | —- | C] () – C:\WINDOWS\2f50spar9ez7.bin
[2009/12/13 15:27:41 | 000,003,584 | —- | C] () – C:\WINDOWS\System32\7c8zsteal599.exe
[2009/12/11 10:42:06 | 000,013,166 | —- | C] () – C:\WINDOWS\System32\1b6f9pzware5938.bin
[2009/12/07 13:01:02 | 000,002,774 | —- | C] () – C:\WINDOWS\31842not-59zirus578.dll
[2009/12/07 03:22:25 | 000,002,813 | —- | C] () – C:\WINDOWS\System32\1z425troj9435.dll
[2009/12/06 06:57:39 | 000,004,308 | —- | C] () – C:\WINDOWS\System32\5435t5oj192z.dll
[2009/12/05 15:08:47 | 000,003,858 | —- | C] () – C:\WINDOWS\9ca5sp5rse1z69.dll
[2009/12/03 13:47:32 | 000,010,762 | —- | C] () – C:\WINDOWS\29469hacz5o9l.exe
[2009/12/02 15:44:55 | 000,012,839 | —- | C] () – C:\WINDOWS\System32\5516spyzb9.bin
[2009/12/01 19:44:08 | 000,003,286 | —- | C] () – C:\WINDOWS\1689vir115z.dll
[2009/11/23 07:14:40 | 000,003,098 | —- | C] () – C:\WINDOWS\System32\3954szarse1494.dll
[2009/11/22 20:01:39 | 000,004,628 | —- | C] () – C:\WINDOWS\System32\3553zpyware5709.dll
[2009/11/22 14:24:42 | 000,003,135 | —- | C] () – C:\WINDOWS\System32\9z55thief551.bin
[2009/11/21 13:43:57 | 000,012,010 | —- | C] () – C:\WINDOWS\System32\53fabackd9or1z13.bin
[2009/11/18 17:48:33 | 000,015,743 | —- | C] () – C:\WINDOWS\System32\17093not-a-vzrus695.exe
[2009/11/16 06:09:29 | 000,009,162 | —- | C] () – C:\WINDOWS\19634zorm9025.bin
[2009/11/12 04:17:43 | 000,017,432 | —- | C] () – C:\WINDOWS\System32\18087n5t-a9virus683z.bin
[2009/11/10 08:59:39 | 000,004,698 | —- | C] () – C:\WINDOWS\System32\1z9419p518.dll
[2009/11/04 18:51:13 | 000,000,128 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\fusioncache.dat
[2009/10/31 22:54:53 | 000,003,677 | —- | C] () – C:\WINDOWS\5f5ezpa9se139.dll
[2009/10/27 17:25:51 | 000,015,354 | —- | C] () – C:\WINDOWS\System32\173z85ro987.exe
[2009/10/27 12:04:33 | 000,139,456 | —- | C] () – C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2009/10/27 12:04:32 | 000,138,056 | —- | C] () – C:\Documents and Settings\Owner\Application Data\PnkBstrK.sys
[2009/10/27 12:04:06 | 000,190,160 | —- | C] () – C:\WINDOWS\System32\PnkBstrB.exe
[2009/10/27 12:03:58 | 002,395,944 | —- | C] () – C:\WINDOWS\System32\pbsvc_heroes.exe
[2009/10/27 12:03:58 | 000,075,064 | —- | C] () – C:\WINDOWS\System32\PnkBstrA.exe
[2009/10/24 08:25:42 | 000,010,123 | —- | C] () – C:\WINDOWS\99658troj542z.exe
[2009/10/23 05:44:18 | 000,004,451 | —- | C] () – C:\WINDOWS\34z5spamb9t655.bin
[2009/10/21 16:10:11 | 000,009,599 | —- | C] () – C:\WINDOWS\6589zhre5t6943.dll
[2009/10/20 16:06:13 | 000,006,405 | —- | C] () – C:\WINDOWS\System32\94zfaddware45.dll
[2009/10/20 04:18:13 | 000,017,997 | —- | C] () – C:\WINDOWS\System32\94dcb5czdoor1784.bin
[2009/10/15 16:01:33 | 000,005,865 | —- | C] () – C:\WINDOWS\System32\6c1at95ef11z9.bin
[2009/10/14 16:22:12 | 000,003,650 | —- | C] () – C:\WINDOWS\z498vir7265.dll
[2009/10/12 02:51:14 | 000,006,892 | —- | C] () – C:\WINDOWS\7z52addwar91516.exe
[2009/10/10 15:15:17 | 000,012,135 | —- | C] () – C:\WINDOWS\5b2azd9ware1556.exe
[2009/10/08 22:07:52 | 000,006,739 | —- | C] () – C:\WINDOWS\System32\95765zorm591.exe
[2009/10/08 10:17:18 | 000,016,828 | —- | C] () – C:\WINDOWS\4d57ad5wzre8259.bin
[2009/10/06 06:55:21 | 000,009,135 | —- | C] () – C:\WINDOWS\2b5f9pywaze1638.exe
[2009/10/03 19:14:03 | 000,007,010 | —- | C] () – C:\WINDOWS\System32\1bcdow9lzader2513.bin
[2009/10/01 09:54:29 | 000,003,056 | —- | C] () – C:\WINDOWS\555czpywa9e1971.exe
[2009/09/28 12:24:32 | 000,178,176 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2009/09/28 12:24:32 | 000,000,038 | —- | C] () – C:\WINDOWS\avisplitter.ini
[2009/09/28 12:24:30 | 000,881,664 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/09/28 12:24:30 | 000,205,824 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2009/09/28 12:24:29 | 000,085,504 | —- | C] () – C:\WINDOWS\System32\ff_vfw.dll
[2009/09/28 12:19:36 | 000,176,235 | —- | C] () – C:\WINDOWS\System32\Primomonnt.dll
[2009/09/27 14:41:42 | 000,015,807 | —- | C] () – C:\WINDOWS\26886tzoj539.exe
[2009/09/27 01:17:01 | 000,004,074 | —- | C] () – C:\WINDOWS\155649irus219z.bin
[2009/09/26 17:57:04 | 000,000,060 | —- | C] () – C:\WINDOWS\System32\SYSDRV.DAT
[2009/09/26 17:51:01 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2009/09/26 17:50:48 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2009/09/26 17:50:47 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2009/09/26 17:50:44 | 000,005,151 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2009/09/26 17:50:39 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2009/09/26 17:50:33 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2009/09/26 17:50:05 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2009/09/26 17:50:04 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2009/09/26 17:48:57 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2009/09/26 17:48:28 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2009/09/26 16:10:55 | 000,004,984 | —- | C] () – C:\WINDOWS\System32\drivers\nvphy.bin
[2009/09/26 15:33:50 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\ChCfg.exe
[2009/09/26 15:33:12 | 000,147,456 | —- | C] () – C:\WINDOWS\System32\RtlCPAPI.dll
[2009/09/25 16:45:22 | 000,003,659 | —- | C] () – C:\WINDOWS\System32\1395thzea53411.dll
[2009/09/25 10:18:28 | 000,013,931 | —- | C] () – C:\WINDOWS\17505troj559z.dll
[2009/09/24 18:20:58 | 000,016,209 | —- | C] () – C:\WINDOWS\b959hief57z5.dll
[2009/09/24 13:14:00 | 000,018,400 | —- | C] () – C:\WINDOWS\System32\5858downlozd9r1535.exe
[2009/09/22 07:25:31 | 000,014,491 | —- | C] () – C:\WINDOWS\5dc39teal3157z.dll
[2009/09/19 21:38:05 | 000,011,901 | —- | C] () – C:\WINDOWS\System32\19095tzo935c.dll
[2009/09/18 21:17:20 | 000,017,073 | —- | C] () – C:\WINDOWS\System32\2257zhackto5lc9.exe
[2009/09/18 15:42:08 | 000,008,278 | —- | C] () – C:\WINDOWS\345aspywzre12919.exe
[2009/09/17 20:00:28 | 000,008,717 | —- | C] () – C:\WINDOWS\System32\44325tezl919.exe
[2009/09/15 12:23:10 | 000,012,599 | —- | C] () – C:\WINDOWS\System32\18699spamzot589.exe
[2009/09/13 15:53:05 | 000,007,780 | —- | C] () – C:\WINDOWS\7689spy5zre9346.exe
[2009/09/13 11:49:43 | 000,009,708 | —- | C] () – C:\WINDOWS\z13not5a-virus3c29.exe
[2009/09/08 15:52:48 | 000,017,173 | —- | C] () – C:\WINDOWS\System32\4d65s9eal232z.exe
[2009/09/05 18:58:26 | 000,016,774 | —- | C] () – C:\WINDOWS\549d5zarse2851.dll
[2009/09/05 15:43:37 | 000,017,998 | —- | C] () – C:\WINDOWS\System32\zcebspyware2952.exe
[2009/09/04 11:19:21 | 000,016,133 | —- | C] () – C:\WINDOWS\5c69thrzat123165.exe
[2009/09/01 02:03:22 | 000,006,866 | —- | C] () – C:\WINDOWS\System32\29197s5a9bzt745.bin
[2009/08/26 20:57:41 | 000,006,135 | —- | C] () – C:\WINDOWS\System32\5f69th5eaz8493.exe
[2009/08/26 04:20:50 | 000,009,736 | —- | C] () – C:\WINDOWS\18856virus7z9.exe
[2009/08/24 10:12:03 | 000,004,449 | —- | C] () – C:\WINDOWS\515ethiefz986.bin
[2009/08/17 08:58:53 | 000,014,843 | —- | C] () – C:\WINDOWS\29989spam5ot5zd.exe
[2009/08/12 17:21:00 | 000,013,686 | —- | C] () – C:\WINDOWS\System32\9f5zsteal1518.exe
[2009/08/11 03:31:22 | 000,017,670 | —- | C] () – C:\WINDOWS\51f4doz9loade52732.exe
[2009/08/10 06:20:05 | 000,010,528 | —- | C] () – C:\WINDOWS\3910do5zloader2808.bin
[2009/08/08 09:27:48 | 000,016,382 | —- | C] () – C:\WINDOWS\System32\95z8vir150.bin
[2009/08/07 04:39:36 | 000,004,503 | —- | C] () – C:\WINDOWS\10865not-az5irus19c.exe
[2009/08/05 02:52:52 | 000,006,527 | —- | C] () – C:\WINDOWS\System32\15955hief779z.exe
[2009/08/02 15:49:32 | 000,006,789 | —- | C] () – C:\WINDOWS\System32\z659sp52d0.exe
[2009/08/01 20:25:59 | 000,011,324 | —- | C] () – C:\WINDOWS\System32\229ab5ckd9oz133.bin
[2009/07/28 08:29:31 | 000,009,714 | —- | C] () – C:\WINDOWS\z7ev9r2995.bin
[2009/07/20 13:59:21 | 000,004,062 | —- | C] () – C:\WINDOWS\System32\7c96th9eatz4915.exe
[2009/07/20 01:12:05 | 000,014,910 | —- | C] () – C:\WINDOWS\System32\4z2caddwa9e5922.dll
[2009/07/15 00:59:49 | 000,007,971 | —- | C] () – C:\WINDOWS\69e5sparse2789z.exe
[2009/07/11 03:59:10 | 000,010,272 | —- | C] () – C:\WINDOWS\System32\5dd5down9oader952z.bin
[2009/07/10 08:47:36 | 000,005,915 | —- | C] () – C:\WINDOWS\System32\ff5addware192z.exe
[2009/07/10 07:53:12 | 000,018,241 | —- | C] () – C:\WINDOWS\System32\1e6zhief2695.bin
[2009/07/09 15:56:57 | 000,011,721 | —- | C] () – C:\WINDOWS\9568dowzl5ader2971.exe
[2009/07/07 14:55:24 | 000,003,421 | —- | C] () – C:\WINDOWS\zffbsp5ware1369.bin
[2009/07/07 13:41:22 | 000,013,568 | —- | C] () – C:\WINDOWS\System32\5ed9zir6509.bin
[2009/07/07 02:48:03 | 000,003,455 | —- | C] () – C:\WINDOWS\System32\925ztroj318.exe
[2009/07/07 01:06:32 | 000,016,400 | —- | C] () – C:\WINDOWS\79dezhief12575.bin
[2009/07/05 13:03:53 | 000,017,681 | —- | C] () – C:\WINDOWS\5250not-a-vzrus59c.dll
[2009/07/04 07:56:02 | 000,017,948 | —- | C] () – C:\WINDOWS\System32\3759wozm26a.exe
[2009/07/01 14:47:14 | 000,017,978 | —- | C] () – C:\WINDOWS\System32\32437spambot55z9.dll
[2009/07/01 13:01:47 | 000,002,883 | —- | C] () – C:\WINDOWS\779e5ackzoor2911.dll
[2009/06/24 00:34:42 | 000,011,545 | —- | C] () – C:\WINDOWS\System32\7cfathre5t299z4.dll
[2009/06/10 03:18:07 | 000,008,587 | —- | C] () – C:\WINDOWS\System32\15934t5oz95.dll
[2009/06/07 16:01:00 | 000,006,091 | —- | C] () – C:\WINDOWS\System32\1z60659y99.bin
[2009/06/07 06:02:24 | 000,015,998 | —- | C] () – C:\WINDOWS\3659addwa9e1z69.exe
[2009/06/02 08:21:45 | 000,018,403 | —- | C] () – C:\WINDOWS\System32\15718wozm199.dll
[2009/05/28 08:16:49 | 000,011,804 | —- | C] () – C:\WINDOWS\System32\1f8zt9i5f1100.dll
[2009/05/28 04:33:11 | 000,009,875 | —- | C] () – C:\WINDOWS\58e7spy9are23z.bin
[2009/05/27 18:42:56 | 000,016,751 | —- | C] () – C:\WINDOWS\System32\44zasp95are900.bin
[2009/05/24 19:48:23 | 000,014,036 | —- | C] () – C:\WINDOWS\29092zirus9a5.bin
[2009/05/24 08:13:56 | 000,007,293 | —- | C] () – C:\WINDOWS\System32\4z689ack5ool441.dll
[2009/05/24 01:32:48 | 000,014,328 | —- | C] () – C:\WINDOWS\System32\z0cdba9kd5or2148.dll
[2009/05/21 03:02:52 | 000,009,651 | —- | C] () – C:\WINDOWS\System32\1bzes9arse5433.bin
[2009/05/20 08:13:42 | 000,009,005 | —- | C] () – C:\WINDOWS\20975hacktooz215.bin
[2009/05/14 22:08:18 | 000,006,301 | —- | C] () – C:\WINDOWS\5929backdoorz231.exe
[2009/05/12 23:29:24 | 000,011,533 | —- | C] () – C:\WINDOWS\System32\97455tzoj1aa.bin
[2009/05/11 10:37:58 | 000,018,282 | —- | C] () – C:\WINDOWS\5593spzware702.bin
[2009/05/10 00:37:36 | 000,004,764 | —- | C] () – C:\WINDOWS\System32\5zcb9ddware1761.bin
[2009/05/06 17:25:20 | 000,017,594 | —- | C] () – C:\WINDOWS\7d66v5rz0849.dll
[2009/05/06 16:06:50 | 000,003,396 | —- | C] () – C:\WINDOWS\3ebcaddwz592271.bin
[2009/05/06 00:28:05 | 000,015,339 | —- | C] () – C:\WINDOWS\448c9tzal30035.dll
[2009/05/04 23:01:55 | 000,005,369 | —- | C] () – C:\WINDOWS\134z9worm445.dll
[2009/05/03 22:11:34 | 000,017,637 | —- | C] () – C:\WINDOWS\System32\3d755ow9lozder3146.bin
[2009/05/03 05:13:25 | 000,006,229 | —- | C] () – C:\WINDOWS\System32\9b97spazse259.exe
[2009/05/02 15:49:26 | 000,002,749 | —- | C] () – C:\WINDOWS\System32\7b9avir2775z.dll
[2009/04/27 01:56:41 | 000,002,855 | —- | C] () – C:\WINDOWS\9f5vir3z97.exe
[2009/04/27 00:13:36 | 000,000,314 | —- | C] () – C:\WINDOWS\primopdf.ini
[2009/04/25 03:43:23 | 000,016,646 | —- | C] () – C:\WINDOWS\System32\2f4evi950z1.bin
[2009/04/24 00:53:53 | 000,017,153 | —- | C] () – C:\WINDOWS\System32\z065vir9s43c.bin
[2009/04/22 22:45:47 | 000,011,321 | —- | C] () – C:\WINDOWS\System32\1529sparze5186.bin
[2009/04/21 20:46:26 | 000,014,809 | —- | C] () – C:\WINDOWS\System32\50fcste95699z.dll
[2009/04/20 18:16:35 | 000,013,424 | —- | C] () – C:\WINDOWS\System32\7952down9oa5er32z0.dll
[2009/04/13 09:44:10 | 000,003,212 | —- | C] () – C:\WINDOWS\System32\26875not5a-vir9s2d4z.exe
[2009/04/12 14:36:13 | 000,017,577 | —- | C] () – C:\WINDOWS\5149troz445.exe
[2009/04/11 01:55:03 | 000,014,694 | —- | C] () – C:\WINDOWS\681b9ckdoor15z.dll
[2009/04/10 16:55:12 | 000,018,010 | —- | C] () – C:\WINDOWS\System32\79d9addwarez6585.dll
[2009/04/10 07:04:14 | 000,012,736 | —- | C] () – C:\WINDOWS\4z1csp5wa9e1915.dll
[2009/04/10 03:28:55 | 000,002,771 | —- | C] () – C:\WINDOWS\5542sp9rse6z1.dll
[2009/04/09 18:00:01 | 000,005,851 | —- | C] () – C:\WINDOWS\System32\569cadzware1145.dll
[2009/04/05 15:10:16 | 000,015,282 | —- | C] () – C:\WINDOWS\System32\9882addwarz29495.exe
[2009/04/05 12:13:43 | 000,016,418 | —- | C] () – C:\WINDOWS\System32\26961noz-a-v5rus7d.bin
[2009/04/02 06:00:24 | 000,017,340 | —- | C] () – C:\WINDOWS\System32\2138a5dwzre914.exe
[2009/04/01 10:31:04 | 000,009,716 | —- | C] () – C:\WINDOWS\System32\312995ro9707z.dll
[2009/03/28 10:40:03 | 000,012,215 | —- | C] () – C:\WINDOWS\System32\955z5ckd9or227.bin
[2009/03/28 04:31:04 | 000,005,071 | —- | C] () – C:\WINDOWS\System32\9z034t5oj2f3.exe
[2009/03/27 04:24:57 | 000,016,557 | —- | C] () – C:\WINDOWS\58z99spy7c.bin
[2009/03/26 12:01:21 | 000,007,552 | —- | C] () – C:\WINDOWS\6ac7download9r15z65.bin
[2009/03/25 03:45:30 | 000,017,680 | —- | C] () – C:\WINDOWS\System32\774a5zware692.bin
[2009/03/23 16:25:45 | 000,015,117 | —- | C] () – C:\WINDOWS\z6025wor92875.exe
[2009/03/18 22:09:33 | 000,013,511 | —- | C] () – C:\WINDOWS\6za1t95ef1508.dll
[2009/03/16 09:53:47 | 000,010,789 | —- | C] () – C:\WINDOWS\System32\5123sz5r9e1197.dll
[2009/03/16 08:29:06 | 000,004,509 | —- | C] () – C:\WINDOWS\15aaspywa9e649z.exe
[2009/03/15 22:21:53 | 000,014,339 | —- | C] () – C:\WINDOWS\System32\905spywarz1979.bin
[2009/03/13 11:15:06 | 000,006,950 | —- | C] () – C:\WINDOWS\5819addwarez732.exe
[2009/03/12 09:29:32 | 000,006,475 | —- | C] () – C:\WINDOWS\z57s9ambot1c3.dll
[2009/03/10 11:36:37 | 000,016,857 | —- | C] () – C:\WINDOWS\72b5spywaze987.bin
[2009/03/09 06:41:27 | 000,012,315 | —- | C] () – C:\WINDOWS\System32\630bthzea918153.dll
[2009/03/08 09:34:44 | 000,012,624 | —- | C] () – C:\WINDOWS\253es9yw5re1z53.dll
[2009/03/06 04:55:17 | 000,003,462 | —- | C] () – C:\WINDOWS\30957spzmb9t7c85.dll
[2009/03/04 12:26:12 | 000,010,650 | —- | C] () – C:\WINDOWS\System32\859spywa5ez4.bin
[2009/03/03 10:20:39 | 000,004,461 | —- | C] () – C:\WINDOWS\65945oznloader350.exe
[2009/03/01 19:59:23 | 000,002,767 | —- | C] () – C:\WINDOWS\System32\z959roj6295.dll
[2009/03/01 19:33:39 | 000,003,796 | —- | C] () – C:\WINDOWS\5639spazse3567.exe
[2009/03/01 04:37:29 | 000,003,372 | —- | C] () – C:\WINDOWS\System32\1c77baczdo9r951.bin
[2009/02/28 13:06:57 | 000,011,207 | —- | C] () – C:\WINDOWS\System32\5644tz9j5f1.dll
[2009/02/28 03:36:29 | 000,009,356 | —- | C] () – C:\WINDOWS\System32\7318downzo9d5r1319.dll
[2009/02/27 13:03:58 | 000,009,371 | —- | C] () – C:\WINDOWS\3e9sp9r5e7z4.exe
[2009/02/26 21:53:51 | 000,012,222 | —- | C] () – C:\WINDOWS\40a8t5r9at173z9.bin
[2009/02/26 00:38:56 | 000,015,990 | —- | C] () – C:\WINDOWS\2b9zsteal5065.exe
[2009/02/23 22:42:20 | 000,012,479 | —- | C] () – C:\WINDOWS\System32\4d2zback9oor550.bin
[2009/02/17 11:27:38 | 000,017,782 | —- | C] () – C:\WINDOWS\System32\8139hack9oo5508z.exe
[2009/02/17 10:33:07 | 000,005,786 | —- | C] () – C:\WINDOWS\598spyware30z5.exe
[2009/02/16 08:05:22 | 000,003,544 | —- | C] () – C:\WINDOWS\41fdd9wn5ozder1366.exe
[2009/02/09 10:32:05 | 000,012,579 | —- | C] () – C:\WINDOWS\5e55backzoo9555.dll
[2009/02/09 03:10:46 | 000,007,555 | —- | C] () – C:\WINDOWS\System32\5f5abackdoor9055z.bin
[2009/02/08 14:27:36 | 000,006,009 | —- | C] () – C:\WINDOWS\27326ha5ktoolz49.exe
[2009/02/08 02:50:03 | 000,015,013 | —- | C] () – C:\WINDOWS\950465rojz1b.bin
[2009/02/07 23:10:52 | 000,003,437 | —- | C] () – C:\WINDOWS\5e5vir959z.bin
[2009/02/05 23:02:42 | 000,012,490 | —- | C] () – C:\WINDOWS\97597wzrm7f5.bin
[2009/02/04 12:15:52 | 000,005,812 | —- | C] () – C:\WINDOWS\System32\7597bac5zoor2743.exe
[2009/02/03 13:16:46 | 000,006,444 | —- | C] () – C:\WINDOWS\System32\19724not59-viruszdc.bin
[2009/02/01 03:04:03 | 000,012,579 | —- | C] () – C:\WINDOWS\20549tr5j65z.exe
[2009/01/28 19:42:23 | 000,012,179 | —- | C] () – C:\WINDOWS\58a9azdware2059.exe
[2009/01/28 05:34:20 | 000,017,820 | —- | C] () – C:\WINDOWS\System32\3z338virus259.bin
[2009/01/28 00:03:15 | 000,013,135 | —- | C] () – C:\WINDOWS\System32\4dbavi9z7245.dll
[2009/01/27 09:04:44 | 000,013,012 | —- | C] () – C:\WINDOWS\System32\9118not5a-v9rus5z3.dll
[2009/01/27 03:35:39 | 000,012,342 | —- | C] () – C:\WINDOWS\System32\z5466spam9ot5eb.exe
[2009/01/26 06:54:51 | 000,006,835 | —- | C] () – C:\WINDOWS\1855z9i5us12.dll
[2009/01/24 18:13:27 | 000,013,067 | —- | C] () – C:\WINDOWS\System32\39z0spy9are5263.bin
[2009/01/22 10:03:21 | 000,016,617 | —- | C] () – C:\WINDOWS\10z90virus5a8.bin
[2009/01/19 13:10:37 | 000,003,016 | —- | C] () – C:\WINDOWS\304z9virus1bf5.dll
[2009/01/17 04:03:47 | 000,012,711 | —- | C] () – C:\WINDOWS\System32\395edo5nloader1z39.bin
[2009/01/17 03:45:17 | 000,014,323 | —- | C] () – C:\WINDOWS\System32\1f4c5z9nloader812.exe
[2009/01/14 13:11:33 | 000,009,311 | —- | C] () – C:\WINDOWS\System32\396eszars51978.dll
[2009/01/09 03:15:34 | 000,006,484 | —- | C] () – C:\WINDOWS\2z149ownloader115.exe
[2009/01/08 21:39:43 | 000,016,619 | —- | C] () – C:\WINDOWS\System32\z3f8backd9or145.dll
[2009/01/08 12:07:49 | 000,003,264 | —- | C] () – C:\WINDOWS\655dow9loadez3115.dll
[2009/01/05 09:00:35 | 000,008,268 | —- | C] () – C:\WINDOWS\94709spambot2z95.exe
[2009/01/05 00:27:17 | 000,016,745 | —- | C] () – C:\WINDOWS\System32\6f3caddwzre21945.bin
[2009/01/03 20:24:38 | 000,018,432 | —- | C] () – C:\WINDOWS\16835zirus69a.exe
[2009/01/03 15:51:32 | 000,013,511 | —- | C] () – C:\WINDOWS\System32\59774viruz2ac.bin
[2009/01/01 20:15:33 | 000,017,605 | —- | C] () – C:\WINDOWS\System32\z3855sp93615.bin
[2008/12/27 23:43:05 | 000,010,569 | —- | C] () – C:\WINDOWS\19z27wor5502.dll
[2008/12/27 00:05:14 | 000,002,763 | —- | C] () – C:\WINDOWS\System32\19899zackto5l57b.exe
[2008/12/25 21:22:40 | 000,013,957 | —- | C] () – C:\WINDOWS\System32\860z9pambot559.exe
[2008/12/25 09:48:07 | 000,007,215 | —- | C] () – C:\WINDOWS\System32\27679sp5707z.dll
[2008/12/25 03:42:45 | 000,005,079 | —- | C] () – C:\WINDOWS\System32\648aste5z1095.bin
[2008/12/25 03:04:36 | 000,007,624 | —- | C] () – C:\WINDOWS\System32\22918zac5tool3f.dll
[2008/12/24 13:55:10 | 000,004,420 | —- | C] () – C:\WINDOWS\z0979spam5otd.dll
[2008/12/24 03:02:45 | 000,008,828 | —- | C] () – C:\WINDOWS\4d05z9reat10125.bin
[2008/12/23 17:27:42 | 000,014,752 | —- | C] () – C:\WINDOWS\9133n5t-a-vzrus634.exe
[2008/12/21 23:16:45 | 000,012,201 | —- | C] () – C:\WINDOWS\System32\21059ackt5ol5edz.bin
[2008/12/17 14:04:09 | 000,015,995 | —- | C] () – C:\WINDOWS\58e3thzea912639.bin
[2008/12/10 13:27:01 | 000,010,068 | —- | C] () – C:\WINDOWS\System32\z57155py92a.dll
[2008/12/09 02:09:11 | 000,017,700 | —- | C] () – C:\WINDOWS\System32\12842hack5ooz297.bin
[2008/12/08 14:20:44 | 000,009,914 | —- | C] () – C:\WINDOWS\System32\5z50spar5e1569.dll
[2008/12/07 15:25:21 | 000,010,122 | —- | C] () – C:\WINDOWS\59096zpambot2e6.exe
[2008/12/02 03:23:30 | 000,014,575 | —- | C] () – C:\WINDOWS\2cdcthrea9272z85.bin
[2008/12/01 03:31:15 | 000,006,117 | —- | C] () – C:\WINDOWS\System32\8797viruz4b95.bin
[2008/11/30 23:11:36 | 000,004,206 | —- | C] () – C:\WINDOWS\3afe9zar5e1554.exe
[2008/11/28 17:34:35 | 000,013,184 | —- | C] () – C:\WINDOWS\2e05s9yware309z.dll
[2008/11/27 11:04:14 | 000,017,886 | —- | C] () – C:\WINDOWS\System32\9d6zdow5loader974.exe
[2008/11/26 15:56:05 | 000,013,503 | —- | C] () – C:\WINDOWS\2848not-z-virus955.dll
[2008/11/22 06:54:50 | 000,012,106 | —- | C] () – C:\WINDOWS\6a2cthrzat59810.dll
[2008/11/19 23:17:24 | 000,002,781 | —- | C] () – C:\WINDOWS\System32\29967vizus55a.exe
[2008/11/19 11:02:27 | 000,018,432 | —- | C] () – C:\WINDOWS\62e69h5eat8724z.bin
[2008/11/18 10:44:29 | 000,010,151 | —- | C] () – C:\WINDOWS\2z195no5-a-vi9us389.bin
[2008/11/17 09:37:38 | 000,011,154 | —- | C] () – C:\WINDOWS\System32\25497vizus213.bin
[2008/11/12 23:11:06 | 000,008,657 | —- | C] () – C:\WINDOWS\System32\95527noz-a5virus55e.bin
[2008/11/11 13:06:30 | 000,015,057 | —- | C] () – C:\WINDOWS\19b4spywa95z670.dll
[2008/11/11 06:20:44 | 000,004,823 | —- | C] () – C:\WINDOWS\26828spam95t3z9.exe
[2008/11/08 12:25:25 | 000,007,049 | —- | C] () – C:\WINDOWS\17452t9oj13z.bin
[2008/11/05 16:23:59 | 000,017,031 | —- | C] () – C:\WINDOWS\System32\2592addware93z0.bin
[2008/11/04 04:18:47 | 000,012,886 | —- | C] () – C:\WINDOWS\System32\5494spy3b7z.exe
[2008/11/04 01:52:41 | 000,014,961 | —- | C] () – C:\WINDOWS\System32\397fad9ware2759z.dll
[2008/11/03 15:28:11 | 000,015,556 | —- | C] () – C:\WINDOWS\275zvir1994.bin
[2008/11/01 00:29:24 | 000,005,117 | —- | C] () – C:\WINDOWS\System32\685bspywzre27799.bin
[2008/10/28 07:10:10 | 000,005,053 | —- | C] () – C:\WINDOWS\System32\39fdthreat766z5.exe
[2008/10/27 12:48:51 | 000,002,648 | —- | C] () – C:\WINDOWS\System32\1819t9ie52995z.exe
[2008/10/26 22:57:47 | 000,008,149 | —- | C] () – C:\WINDOWS\19c2addwarz351.exe
[2008/10/26 01:21:12 | 000,002,984 | —- | C] () – C:\WINDOWS\System32\1z319vir5s24c.bin
[2008/10/16 01:09:17 | 000,010,164 | —- | C] () – C:\WINDOWS\73z5or9480.exe
[2008/10/11 20:30:19 | 000,017,863 | —- | C] () – C:\WINDOWS\4999t5zef2938.bin
[2008/10/07 19:09:41 | 000,016,628 | —- | C] () – C:\WINDOWS\93d4szarse14305.exe
[2008/09/27 06:36:01 | 000,006,826 | —- | C] () – C:\WINDOWS\System32\87205iruz59.exe
[2008/09/26 07:57:02 | 000,016,002 | —- | C] () – C:\WINDOWS\System32\9310spambo51z5.bin
[2008/09/26 02:06:34 | 000,008,838 | —- | C] () – C:\WINDOWS\System32\195z9not-5-virus6849.exe
[2008/09/23 06:43:04 | 000,010,784 | —- | C] () – C:\WINDOWS\System32\289749pyz205.bin
[2008/09/22 10:29:24 | 000,012,415 | —- | C] () – C:\WINDOWS\7zf1t5reat26926.bin
[2008/09/18 07:49:25 | 000,005,519 | —- | C] () – C:\WINDOWS\3546spzwa952236.exe
[2008/09/11 23:44:12 | 000,003,141 | —- | C] () – C:\WINDOWS\947065py6az.exe
[2008/09/08 01:10:11 | 000,009,404 | —- | C] () – C:\WINDOWS\System32\24569zormbc.exe
[2008/09/07 03:26:01 | 000,012,780 | —- | C] () – C:\WINDOWS\System32\2689wz95588.bin
[2008/09/06 09:48:10 | 000,007,796 | —- | C] () – C:\WINDOWS\z9516hac5tool176.bin
[2008/08/28 06:26:20 | 000,018,308 | —- | C] () – C:\WINDOWS\System32\2z159s5ambot54a.dll
[2008/08/27 00:24:12 | 000,006,173 | —- | C] () – C:\WINDOWS\28584worm95z.exe
[2008/08/26 07:18:31 | 000,006,605 | —- | C] () – C:\WINDOWS\671cs5y9are2z52.exe
[2008/08/24 20:17:50 | 000,016,262 | —- | C] () – C:\WINDOWS\17917z5o9e4.bin
[2008/08/21 05:14:34 | 000,010,081 | —- | C] () – C:\WINDOWS\6z50dow5lo9der584.dll
[2008/08/20 06:32:18 | 000,010,928 | —- | C] () – C:\WINDOWS\15639vi5uz1ff.exe
[2008/08/16 11:24:19 | 000,018,167 | —- | C] () – C:\WINDOWS\System32\272zspyware52699.dll
[2008/08/16 06:07:01 | 000,005,837 | —- | C] () – C:\WINDOWS\System32\5c50thiefz3709.dll
[2008/08/14 10:04:19 | 000,002,852 | —- | C] () – C:\WINDOWS\System32\28142sp9zbot385.exe
[2008/08/11 19:29:34 | 000,005,605 | —- | C] () – C:\WINDOWS\559zthi5f2907.exe
[2008/08/11 09:30:08 | 000,018,121 | —- | C] () – C:\WINDOWS\System32\1510zwo9m766.exe
[2008/08/10 19:42:22 | 000,010,367 | —- | C] () – C:\WINDOWS\System32\245889zoj3d3.bin
[2008/08/08 05:38:30 | 000,009,520 | —- | C] () – C:\WINDOWS\5d80thrzat927595.exe
[2008/08/05 07:31:22 | 000,014,923 | —- | C] () – C:\WINDOWS\System32\452zspyware1980.exe
[2008/08/04 03:28:13 | 000,006,290 | —- | C] () – C:\WINDOWS\2157ztea59778.dll
[2008/08/02 15:42:56 | 000,003,107 | —- | C] () – C:\WINDOWS\6e91tzief5683.bin
[2008/08/01 06:50:15 | 000,007,246 | —- | C] () – C:\WINDOWS\3591dow9lozd5r1747.bin
[2008/07/28 06:30:25 | 000,015,859 | —- | C] () – C:\WINDOWS\System32\27326szambot905.bin
[2008/07/27 22:06:01 | 000,008,065 | —- | C] () – C:\WINDOWS\4b92vir5z13.exe
[2008/07/25 17:55:18 | 000,009,592 | —- | C] () – C:\WINDOWS\System32\4e2eb9ck5oor19z4.bin
[2008/07/24 23:11:55 | 000,008,766 | —- | C] () – C:\WINDOWS\System32\1759zormc5.dll
[2008/07/24 11:48:30 | 000,015,525 | —- | C] () – C:\WINDOWS\System32\594bbackdo5r2891z.exe
[2008/07/23 13:20:37 | 000,012,354 | —- | C] () – C:\WINDOWS\System32\5946threat25z0.bin
[2008/07/19 22:40:03 | 000,012,406 | —- | C] () – C:\WINDOWS\System32\294vi59009z.bin
[2008/07/19 19:36:32 | 000,012,646 | —- | C] () – C:\WINDOWS\System32\21657tr5j398z.dll
[2008/07/17 12:23:58 | 000,016,126 | —- | C] () – C:\WINDOWS\System32\177z9w59m75.bin
[2008/07/14 10:00:05 | 000,013,272 | —- | C] () – C:\WINDOWS\System32\5df4zown59ader2508.bin
[2008/07/10 17:14:47 | 000,011,491 | —- | C] () – C:\WINDOWS\System32\2399zw5rm4a7.bin
[2008/07/04 06:11:12 | 000,014,383 | —- | C] () – C:\WINDOWS\System32\1z962not-a-v5rus39b.dll
[2008/07/03 11:53:26 | 000,004,362 | —- | C] () – C:\WINDOWS\2d4fazdw9re3558.exe
[2008/07/03 07:58:01 | 000,010,097 | —- | C] () – C:\WINDOWS\50d7backz9or2532.dll
[2008/07/01 00:42:36 | 000,014,961 | —- | C] () – C:\WINDOWS\System32\1za65ir9150.exe
[2008/06/24 00:08:06 | 000,013,911 | —- | C] () – C:\WINDOWS\System32\136cbackdozr4759.bin
[2008/06/22 15:22:51 | 000,010,187 | —- | C] () – C:\WINDOWS\15vi9us5z25.exe
[2008/06/22 01:35:58 | 000,003,684 | —- | C] () – C:\WINDOWS\18324s59z31.bin
[2008/06/17 23:14:14 | 000,003,402 | —- | C] () – C:\WINDOWS\System32\91245orm5z7.dll
[2008/06/17 03:00:27 | 000,009,057 | —- | C] () – C:\WINDOWS\System32\5740viz9s318.bin
[2008/06/14 10:27:20 | 000,005,601 | —- | C] () – C:\WINDOWS\System32\39z54viru5163.exe
[2008/06/11 16:09:18 | 000,016,505 | —- | C] () – C:\WINDOWS\6095threat245z5.exe
[2008/06/10 18:33:21 | 000,007,677 | —- | C] () – C:\WINDOWS\7a86st9az2537.bin
[2008/06/06 12:05:42 | 000,008,375 | —- | C] () – C:\WINDOWS\99895not-a-vir5sz3c.bin
[2008/06/02 01:12:41 | 000,014,646 | —- | C] () – C:\WINDOWS\System32\2cc4download9z5431.dll
[2008/06/01 13:25:08 | 000,004,103 | —- | C] () – C:\WINDOWS\System32\z60089or52eb.bin
[2008/05/25 20:49:00 | 000,011,124 | —- | C] () – C:\WINDOWS\4887z59ef580.dll
[2008/05/23 13:58:13 | 000,018,123 | —- | C] () – C:\WINDOWS\System32\6263virus95z.bin
[2008/05/20 03:22:51 | 000,002,812 | —- | C] () – C:\WINDOWS\System32\118z3v9r5s18b.bin
[2008/05/18 17:39:59 | 000,018,402 | —- | C] () – C:\WINDOWS\System32\2759viz283.dll
[2008/05/17 03:44:21 | 000,015,444 | —- | C] () – C:\WINDOWS\System32\6343z9r20485.bin
[2008/05/16 15:03:16 | 000,013,444 | —- | C] () – C:\WINDOWS\12857spa9bot55z.dll
[2008/05/15 09:58:57 | 000,017,324 | —- | C] () – C:\WINDOWS\System32\59425ddwar9z27.dll
[2008/05/13 21:41:34 | 000,002,692 | —- | C] () – C:\WINDOWS\2c509ir846z.bin
[2008/05/13 01:44:22 | 000,012,456 | —- | C] () – C:\WINDOWS\System32\194985pazbot79f.bin
[2008/05/11 09:29:00 | 000,012,446 | —- | C] () – C:\WINDOWS\49e8thie52068z.exe
[2008/05/08 06:32:03 | 000,014,087 | —- | C] () – C:\WINDOWS\14z54not-a-virus495.dll
[2008/05/07 14:54:55 | 000,012,309 | —- | C] () – C:\WINDOWS\29355wor96zb5.dll
[2008/05/05 22:20:23 | 000,003,229 | —- | C] () – C:\WINDOWS\System32\24392sp5zff.bin
[2008/05/05 14:43:24 | 000,008,090 | —- | C] () – C:\WINDOWS\System32\4098not-a-virus5z9.dll
[2008/05/04 17:17:04 | 000,007,213 | —- | C] () – C:\WINDOWS\355zs9yware2569.dll
[2008/05/01 06:25:57 | 000,011,791 | —- | C] () – C:\WINDOWS\System32\2943z95rse1155.bin
[2008/04/27 17:41:23 | 000,003,052 | —- | C] () – C:\WINDOWS\5b2spy95re13z9.bin
[2008/04/27 03:37:58 | 000,015,491 | —- | C] () – C:\WINDOWS\System32\6997down9oad5r142z.exe
[2008/04/26 17:32:22 | 000,003,177 | —- | C] () – C:\WINDOWS\System32\9933spy75z.exe
[2008/04/24 08:48:53 | 000,017,083 | —- | C] () – C:\WINDOWS\29953worm551z.exe
[2008/04/22 19:58:59 | 000,014,173 | —- | C] () – C:\WINDOWS\System32\c97add9a5e3z0.exe
[2008/04/22 00:54:32 | 000,016,609 | —- | C] () – C:\WINDOWS\System32\1952worm501z.dll
[2008/04/21 14:11:05 | 000,011,466 | —- | C] () – C:\WINDOWS\6z2bsp5wa9e1857.exe
[2008/04/21 12:22:09 | 000,013,768 | —- | C] () – C:\WINDOWS\System32\52969troj555z.dll
[2008/04/20 15:46:45 | 000,014,616 | —- | C] () – C:\WINDOWS\System32\25779zot-a-vir9s165.bin
[2008/04/17 08:22:08 | 000,006,256 | —- | C] () – C:\WINDOWS\System32\28dddown5oz9er212.exe
[2008/04/15 20:57:04 | 000,017,649 | —- | C] () – C:\WINDOWS\System32\951backd9orz61.bin
[2008/04/15 09:27:30 | 000,002,568 | —- | C] () – C:\WINDOWS\4058dowzload9r2574.bin
[2008/04/13 11:04:55 | 000,017,068 | —- | C] () – C:\WINDOWS\5493adzware1280.exe
[2008/04/08 01:35:44 | 000,004,285 | —- | C] () – C:\WINDOWS\System32\25558tr9j4z5.dll
[2008/04/07 18:58:04 | 000,011,770 | —- | C] () – C:\WINDOWS\System32\476bsparze5799.bin
[2008/04/06 09:59:07 | 000,013,113 | —- | C] () – C:\WINDOWS\System32\9fe0v5r764z.bin
[2008/04/04 11:26:17 | 000,010,333 | —- | C] () – C:\WINDOWS\2f10sp9rsz5831.dll
[2008/04/04 10:35:57 | 000,009,377 | —- | C] () – C:\WINDOWS\System32\37bdown9z5der1037.exe
[2008/04/01 21:09:45 | 000,010,402 | —- | C] () – C:\WINDOWS\19848sp9mbzt1b65.bin
[2008/03/31 22:52:02 | 000,009,169 | —- | C] () – C:\WINDOWS\1c4bthi9f35z2.exe
[2008/03/24 23:28:30 | 000,003,944 | —- | C] () – C:\WINDOWS\3596trojez.exe
[2008/03/24 10:29:11 | 000,007,478 | —- | C] () – C:\WINDOWS\System32\7dzfa95ware213.dll
[2008/03/23 07:26:15 | 000,009,234 | —- | C] () – C:\WINDOWS\799sp5rze793.exe
[2008/03/21 20:31:36 | 000,005,607 | —- | C] () – C:\WINDOWS\354zspywa9e2355.dll
[2008/03/21 16:23:47 | 000,015,671 | —- | C] () – C:\WINDOWS\System32\7zfeth5ef2975.bin
[2008/03/18 14:24:04 | 000,015,878 | —- | C] () – C:\WINDOWS\5ccfdownlozder950.exe
[2008/03/17 01:30:20 | 000,013,828 | —- | C] () – C:\WINDOWS\2959tzreat17937.dll
[2008/03/15 18:48:50 | 000,005,907 | —- | C] () – C:\WINDOWS\25738no9-a-virz564c.dll
[2008/03/08 02:20:47 | 000,009,947 | —- | C] () – C:\WINDOWS\System32\z2a5vir9349.dll
[2008/03/06 20:35:40 | 000,003,516 | —- | C] () – C:\WINDOWS\System32\5924zhacktool4b.dll
[2008/03/05 09:02:30 | 000,017,449 | —- | C] () – C:\WINDOWS\2zcc5parse999.exe
[2008/03/02 17:09:02 | 000,006,445 | —- | C] () – C:\WINDOWS\System32\173z6spamb9t5e8.dll
[2008/03/01 04:38:01 | 000,005,951 | —- | C] () – C:\WINDOWS\2906zpyware4555.dll
[2008/02/28 19:13:31 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\4b97d5wnloadzr1899.dll
[2008/02/27 03:07:21 | 000,010,478 | —- | C] () – C:\WINDOWS\System32\9569backd5oz2997.dll
[2008/02/25 05:26:49 | 000,003,097 | —- | C] () – C:\WINDOWS\7ab4download9z546.dll
[2008/02/23 04:30:30 | 000,010,820 | —- | C] () – C:\WINDOWS\z8ba5p9rse1156.exe
[2008/02/20 21:28:08 | 000,003,355 | —- | C] () – C:\WINDOWS\System32\35d5backd9oz2757.dll
[2008/02/16 23:55:17 | 000,018,086 | —- | C] () – C:\WINDOWS\58794vi9usz33.bin
[2008/02/15 11:13:38 | 000,017,654 | —- | C] () – C:\WINDOWS\System32\32287tro9155z.bin
[2008/02/14 21:41:49 | 000,011,471 | —- | C] () – C:\WINDOWS\System32\55c6zddware5909.dll
[2008/02/14 17:19:38 | 000,017,458 | —- | C] () – C:\WINDOWS\24873hacktoz59ac.dll
[2008/02/14 09:35:22 | 000,009,101 | —- | C] () – C:\WINDOWS\System32\6b3d5ackdo9r292z.dll
[2008/02/14 04:36:17 | 000,009,056 | —- | C] () – C:\WINDOWS\System32\29532zroj4fb.dll
[2008/02/10 18:07:02 | 000,017,611 | —- | C] () – C:\WINDOWS\4257zp5r9e2148.dll
[2008/02/07 00:37:38 | 000,012,336 | —- | C] () – C:\WINDOWS\System32\7d865pars9178z.dll
[2008/02/01 10:27:41 | 000,008,800 | —- | C] () – C:\WINDOWS\System32\3313spambo9z65.bin
[2008/02/01 06:27:30 | 000,006,286 | —- | C] () – C:\WINDOWS\z97bd5wnloader379.dll
[2008/01/27 23:19:01 | 000,016,945 | —- | C] () – C:\WINDOWS\5539hzef1529.bin
[2008/01/27 20:22:52 | 000,017,211 | —- | C] () – C:\WINDOWS\3885zpambo59c5.dll
[2008/01/22 17:26:06 | 000,004,682 | —- | C] () – C:\WINDOWS\120z59roj60e5.dll
[2008/01/21 15:55:41 | 000,015,320 | —- | C] () – C:\WINDOWS\System32\z958t9ief626.bin
[2008/01/16 16:00:33 | 000,003,290 | —- | C] () – C:\WINDOWS\System32\4244zor5319.exe
[2008/01/14 14:04:52 | 000,006,196 | —- | C] () – C:\WINDOWS\System32\21230hack9oolz5d.exe
[2008/01/14 12:29:42 | 000,004,411 | —- | C] () – C:\WINDOWS\4f579ddzare2715.bin
[2008/01/14 11:38:12 | 000,008,875 | —- | C] () – C:\WINDOWS\765zv59956.exe
[2008/01/12 17:16:28 | 000,012,145 | —- | C] () – C:\WINDOWS\System32\5zb95hief702.exe
[2008/01/06 20:26:52 | 000,003,141 | —- | C] () – C:\WINDOWS\765back9oor9z7.bin
[2008/01/05 01:05:11 | 000,007,229 | —- | C] () – C:\WINDOWS\1528addwarez2589.dll
[2008/01/02 18:31:12 | 000,012,545 | —- | C] () – C:\WINDOWS\System32\294785pambot5bz.dll
[2008/01/01 19:03:58 | 000,008,844 | —- | C] () – C:\WINDOWS\System32\95559irzs2e5.dll
[2008/01/01 16:50:38 | 000,004,238 | —- | C] () – C:\WINDOWS\System32\93414wormzef5.exe
[2005/09/18 08:32:00 | 001,724,416 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2005/09/18 08:32:00 | 001,657,376 | —- | C] () – C:\WINDOWS\System32\nwiz.exe
[2005/09/18 08:32:00 | 001,503,232 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2005/09/18 08:32:00 | 001,346,080 | —- | C] () – C:\WINDOWS\System32\nvdspsch.exe
[2005/09/18 08:32:00 | 001,101,824 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2005/09/18 08:32:00 | 000,573,440 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[2005/09/18 08:32:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2005/09/18 08:32:00 | 000,449,056 | —- | C] () – C:\WINDOWS\System32\nvappbar.exe
[2005/09/18 08:32:00 | 000,436,768 | —- | C] () – C:\WINDOWS\System32\keystone.exe
[2005/09/18 08:32:00 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2004/08/27 06:50:59 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/08/27 05:54:47 | 000,516,096 | —- | C] () – C:\WINDOWS\System32\HotlineClient.exe
[2004/08/26 14:07:50 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2004/08/26 14:01:37 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/08/26 12:12:43 | 000,000,465 | —- | C] () – C:\WINDOWS\System32\emver.ini
[2004/08/26 12:12:43 | 000,000,416 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2004/08/26 12:12:10 | 000,441,652 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/26 12:12:10 | 000,071,526 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/26 06:54:56 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/08/26 06:54:01 | 000,112,584 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT

========== LOP Check ==========

[2011/05/15 09:49:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2011/05/15 16:39:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG10
[2009/10/04 07:08:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Canneverbe Limited
[2011/05/10 21:27:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/05/10 22:22:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/05/11 19:25:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\RegCure
[2011/05/11 21:29:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2011/05/11 19:18:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2011/05/10 22:22:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\AVG10
[2009/10/04 07:08:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Canneverbe_Limited
[2009/09/28 12:26:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\OpenOffice.org
[2010/07/27 12:19:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\TS3Client
[2009/11/04 18:51:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Turbine
[2010/02/05 10:14:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Unity
[2011/05/11 13:15:54 | 000,000,500 | —- | M] () – C:\WINDOWS\Tasks\One-Click Tweak.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2004/08/26 14:04:39 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2009/09/28 12:34:01 | 000,000,199 | -HS- | M] () – C:\boot.ini
[2004/08/26 14:04:39 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2011/03/19 20:36:22 | 000,000,076 | —- | M] () – C:\DVDPATH.TXT
[2004/08/26 14:04:39 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2004/08/26 14:04:39 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/04 15:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2009/09/28 08:58:50 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/05/17 18:17:26 | 780,140,544 | -HS- | M] () – C:\pagefile.sys
[2011/05/11 19:08:19 | 000,000,359 | —- | M] () – C:\rkill.log
[2009/09/28 12:22:51 | 000,000,268 | —- | M] () – C:\sqmdata00.sqm
[2009/12/13 01:11:23 | 000,000,232 | —- | M] () – C:\sqmdata01.sqm
[2009/12/13 01:11:23 | 000,000,172 | —- | M] () – C:\sqmdata02.sqm
[2009/09/28 12:22:51 | 000,000,244 | —- | M] () – C:\sqmnoopt00.sqm
[2009/12/13 01:11:23 | 000,000,244 | —- | M] () – C:\sqmnoopt01.sqm
[2009/12/13 01:11:23 | 000,000,172 | —- | M] () – C:\sqmnoopt02.sqm

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/08/04 15:00:00 | 000,000,067 | —- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 08:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/07/06 06:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2004/08/26 06:53:19 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2004/08/26 06:53:18 | 000,634,880 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2004/08/26 06:53:18 | 000,864,256 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >

< %USERPROFILE%\Desktop\*.exe >
[2011/05/17 18:14:46 | 000,589,632 | —- | M] (AVAST Software) – C:\Documents and Settings\Owner\Desktop\aswMBR.exe
[2006/10/04 03:18:50 | 004,272,128 | —- | M] (LucasArts LLC) – C:\Documents and Settings\Owner\Desktop\EAWXLaunch to Starwars Empire at war 2.exe
[2006/01/07 22:30:02 | 000,557,056 | R— | M] () – C:\Documents and Settings\Owner\Desktop\LaunchEAW to Starwars Empire at war 1.exe
[2011/05/17 18:15:24 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2009/06/12 15:28:13 | 001,815,552 | —- | M] (TODO: ) – C:\Documents and Settings\Owner\Desktop\Project Torque Raceing Cars Game.exe
[2011/02/11 21:05:13 | 006,275,960 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Owner\Desktop\Silverlight.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >
[2011/05/11 20:59:59 | 000,512,992 | —- | M] () – C:\Documents and Settings\Owner\My Documents\sdsetup_aff[1].exe
[2011/05/11 15:14:20 | 016,409,960 | —- | M] (Safer Networking Limited ) – C:\Documents and Settings\Owner\My Documents\spybotsd162.exe

< %USERPROFILE%\*.exe >
[2009/10/04 11:00:30 | 001,815,552 | —- | M] (TODO: ) – C:\Documents and Settings\Owner\project torque.exe

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2009/09/28 09:21:02 | 000,000,122 | -HS- | M] () – C:\Documents and Settings\Owner\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2009/12/13 01:53:09 | 000,000,067 | -HS- | M] () – C:\Documents and Settings\Owner\Cookies\desktop.ini
[2011/05/17 18:27:05 | 000,245,760 | —- | M] () – C:\Documents and Settings\Owner\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-05-16 04:16:06

========== Alternate Data Streams ==========

@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:430C6D84
@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

< End of report >

OTL Extras logfile created on: 5/17/2011 6:27:49 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

494.00 Mb Total Physical Memory | 153.00 Mb Available Physical Memory | 31.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 63.00% Paging File free
Paging file location(s): C:\pagefile.sys 744 1488 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 60.11 Gb Free Space | 80.66% Space Free | Partition Type: NTFS
Drive D: | 7.72 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive I: | 955.72 Mb Total Space | 780.03 Mb Free Space | 81.62% Space Free | Partition Type: FAT

Computer Name: YOUR-E752847052 | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"3724:TCP" = 3724:TCP:*:Enabled:Blizzard Downloader: 3724

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger – (Yahoo! Inc.)
"I:\Program Files\World of Warcraft\WoW-3.2.0.10314-to-3.2.2.10482-enUS-downloader.exe" = I:\Program Files\World of Warcraft\WoW-3.2.0.10314-to-3.2.2.10482-enUS-downloader.exe:*:Enabled:Blizzard Downloader
"I:\Program Files\World of Warcraft\Launcher.exe" = I:\Program Files\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher
"I:\Program Files\World of Warcraft\WoW-3.2.2.10482-to-3.2.2.10505-enUS-downloader.exe" = I:\Program Files\World of Warcraft\WoW-3.2.2.10482-to-3.2.2.10505-enUS-downloader.exe:*:Enabled:Blizzard Downloader
"I:\Program Files\DarkCrusade\DarkCrusade.exe" = I:\Program Files\DarkCrusade\DarkCrusade.exe:*:Enabled:DarkCrusade
"I:\Program Files\Turbine\The Lord of the Rings Online\lotroclient.exe" = I:\Program Files\Turbine\The Lord of the Rings Online\lotroclient.exe:*:Enabled:lotroclient
"I:\Program Files\World of Warcraft\BackgroundDownloader.exe" = I:\Program Files\World of Warcraft\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader
"I:\Program Files\World of Warcraft\Launcher.patch.exe" = I:\Program Files\World of Warcraft\Launcher.patch.exe:*:Enabled:Blizzard Launcher
"I:\Program Files\World of Warcraft\Blizzard Downloader.exe" = I:\Program Files\World of Warcraft\Blizzard Downloader.exe:*:Enabled:Blizzard Downloader
"C:\Program Files\AVG\AVG10\avgdiagex.exe" = C:\Program Files\AVG\AVG10\avgdiagex.exe:*:Enabled:AVG Diagnostics 2011 – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG10\avgnsx.exe" = C:\Program Files\AVG\AVG10\avgnsx.exe:*:Enabled:Online Shield – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG10\avgmfapx.exe" = C:\Program Files\AVG\AVG10\avgmfapx.exe:*:Enabled:AVG Installer – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG10\avgemcx.exe" = C:\Program Files\AVG\AVG10\avgemcx.exe:*:Enabled:Personal E-mail Scanner – (AVG Technologies CZ, s.r.o.)
"J:\Program Files\World of Warcraft\Launcher.exe" = J:\Program Files\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher
"J:\Program Files\World of Warcraft\Launcher.patch.exe" = J:\Program Files\World of Warcraft\Launcher.patch.exe:*:Enabled:Blizzard Launcher
"J:\Program Files\DarkCrusade\DarkCrusade.exe" = J:\Program Files\DarkCrusade\DarkCrusade.exe:*:Enabled:DarkCrusade


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0F6648B7-D891-41E8-9734-345BDF32603F}" = Garfield G2 Reading vol1
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{230E8DDC-FB78-4F9F-8461-22ED20DBC3BA}" = AVG 2011
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java™ 6 Update 16
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{55CED035-7710-41EE-9A6D-7B1A640D6226}" = Garfield Math Readiness vol1.
"{571700F0-DB9D-4B3A-B03D-35A14BB5939F}" = Windows Live Messenger
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76EFFC7C-17A6-479D-9E47-8E658C1695AE}" = Windows Backup Utility
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DC910CD-8EE3-4ffc-A4EB-9B02701059C4}" = Battlefield Heroes
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.6
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240C2}" = WinZip 15.5
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D4E53304-1F6C-4111-9872-1BCD2CF5B642}" = AVG 2011
"{E6B87DC4-2B3D-4483-ADFF-E483BF718991}" = OpenOffice.org 3.1
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"AVG" = AVG 2011
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200014F1" = Soft Data Fax Modem with SmartCP
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"ieSpell" = ieSpell
"InterActual Player" = InterActual Player
"KLiteCodecPack_is1" = K-Lite Codec Pack 5.1.4 (Full)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"PrimoPDF" = PrimoPDF – brought to you by Nitro PDF Software
"PunkBusterSvc" = PunkBuster Services
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"WIC" = Windows Imaging Component
"Windows XP Service Pack" = Windows XP Service Pack 3
"World of Warcraft" = World of Warcraft
"Yahoo! Messenger" = Yahoo! Messenger

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"UnityWebPlayer" = Unity Web Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 5/10/2011 9:35:14 PM | Computer Name = YOUR-E752847052 | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 0.0.0.0, faulting module
iexplore.exe, version 0.0.0.0, fault address 0x0008cb40.

Error - 5/11/2011 8:28:02 PM | Computer Name = YOUR-E752847052 | Source = MsiInstaller | ID = 11923
Description = Product: Ad-Aware – Error 1923. Service 'Lavasoft Ad-Aware Service'
(Lavasoft Ad-Aware Service) could not be installed. Verify that you have sufficient
privileges to install system services.

Error - 5/11/2011 8:28:04 PM | Computer Name = YOUR-E752847052 | Source = MsiInstaller | ID = 11923
Description = Product: Ad-Aware – Error 1923. Service 'Lavasoft Ad-Aware Service'
(Lavasoft Ad-Aware Service) could not be installed. Verify that you have sufficient
privileges to install system services.

Error - 5/11/2011 8:32:42 PM | Computer Name = YOUR-E752847052 | Source = MsiInstaller | ID = 11923
Description = Product: Ad-Aware – Error 1923. Service 'Lavasoft Ad-Aware Service'
(Lavasoft Ad-Aware Service) could not be installed. Verify that you have sufficient
privileges to install system services.

Error - 5/11/2011 9:23:58 PM | Computer Name = YOUR-E752847052 | Source = Application Error | ID = 1000
Description = Faulting application , version 0.0.0.0, faulting module unknown, version
0.0.0.0, fault address 0x00000000.

Error - 5/11/2011 9:26:59 PM | Computer Name = YOUR-E752847052 | Source = pctsSvc.exe | ID = 0
Description =

Error - 5/15/2011 1:25:04 PM | Computer Name = YOUR-E752847052 | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x0f8bc053.

Error - 5/15/2011 1:46:43 PM | Computer Name = YOUR-E752847052 | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 5/15/2011 1:46:43 PM | Computer Name = YOUR-E752847052 | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 5/15/2011 5:09:26 PM | Computer Name = YOUR-E752847052 | Source = MsiInstaller | ID = 11923
Description = Product: Ad-Aware – Error 1923. Service 'Lavasoft Ad-Aware Service'
(Lavasoft Ad-Aware Service) could not be installed. Verify that you have sufficient
privileges to install system services.

[ Application Events ]
Error - 5/10/2011 9:35:14 PM | Computer Name = YOUR-E752847052 | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 0.0.0.0, faulting module
iexplore.exe, version 0.0.0.0, fault address 0x0008cb40.

Error - 5/11/2011 8:28:02 PM | Computer Name = YOUR-E752847052 | Source = MsiInstaller | ID = 11923
Description = Product: Ad-Aware – Error 1923. Service 'Lavasoft Ad-Aware Service'
(Lavasoft Ad-Aware Service) could not be installed. Verify that you have sufficient
privileges to install system services.

Error - 5/11/2011 8:28:04 PM | Computer Name = YOUR-E752847052 | Source = MsiInstaller | ID = 11923
Description = Product: Ad-Aware – Error 1923. Service 'Lavasoft Ad-Aware Service'
(Lavasoft Ad-Aware Service) could not be installed. Verify that you have sufficient
privileges to install system services.

Error - 5/11/2011 8:32:42 PM | Computer Name = YOUR-E752847052 | Source = MsiInstaller | ID = 11923
Description = Product: Ad-Aware – Error 1923. Service 'Lavasoft Ad-Aware Service'
(Lavasoft Ad-Aware Service) could not be installed. Verify that you have sufficient
privileges to install system services.

Error - 5/11/2011 9:23:58 PM | Computer Name = YOUR-E752847052 | Source = Application Error | ID = 1000
Description = Faulting application , version 0.0.0.0, faulting module unknown, version
0.0.0.0, fault address 0x00000000.

Error - 5/11/2011 9:26:59 PM | Computer Name = YOUR-E752847052 | Source = pctsSvc.exe | ID = 0
Description =

Error - 5/15/2011 1:25:04 PM | Computer Name = YOUR-E752847052 | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module unknown, version 0.0.0.0, fault address 0x0f8bc053.

Error - 5/15/2011 1:46:43 PM | Computer Name = YOUR-E752847052 | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 5/15/2011 1:46:43 PM | Computer Name = YOUR-E752847052 | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 5/15/2011 5:09:26 PM | Computer Name = YOUR-E752847052 | Source = MsiInstaller | ID = 11923
Description = Product: Ad-Aware – Error 1923. Service 'Lavasoft Ad-Aware Service'
(Lavasoft Ad-Aware Service) could not be installed. Verify that you have sufficient
privileges to install system services.

[ System Events ]
Error - 5/15/2011 7:59:05 PM | Computer Name = YOUR-E752847052 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 5/15/2011 7:59:05 PM | Computer Name = YOUR-E752847052 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 5/15/2011 7:59:05 PM | Computer Name = YOUR-E752847052 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 5/15/2011 7:59:05 PM | Computer Name = YOUR-E752847052 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 5/15/2011 7:59:05 PM | Computer Name = YOUR-E752847052 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 5/15/2011 7:59:05 PM | Computer Name = YOUR-E752847052 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 5/15/2011 7:59:05 PM | Computer Name = YOUR-E752847052 | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 5/15/2011 9:53:06 PM | Computer Name = YOUR-E752847052 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
abp480n5 adpu160m agp440 agpCPQ Aha154x aic78u2 aic78xx AliIde alim1541 amdagp amsint asc asc3350p
asc3550
cbidf
cd20xrnt
CmdIde
Cpqarray
dac2w2k
dac960nt
dpti2o
hpn
i2omp
ini910u
IntelIde
mraid35x
perc2
perc2hib
ql1080
Ql10wnt
ql12160
ql1240
ql1280
sisagp
Sparrow
symc810
symc8xx
sym_hi
sym_u3
TosIde
ultra
viaagp
ViaIde

Error - 5/16/2011 12:16:05 AM | Computer Name = YOUR-E752847052 | Source = NtServicePack | ID = 921877
Description = Windows XP KB2393802 installation failed. An internal error occurred.


Error - 5/16/2011 12:16:06 AM | Computer Name = YOUR-E752847052 | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x8007054f: Security Update for Windows XP (KB2393802).


< End of report >

ComboFix 11-05-17.01 - Owner 05/17/2011 20:14:59.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.494.215 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Owner\2gweorjqjutp92vjy9gake
c:\documents and settings\Owner\Application Data\Adobe\plugs
c:\documents and settings\Owner\Application Data\Adobe\plugs\mmc2.exe
c:\documents and settings\Owner\Application Data\Adobe\plugs\mmc2224618.txt
c:\documents and settings\Owner\Application Data\Adobe\shed
c:\documents and settings\Owner\Application Data\Adobe\shed\thr1.chm
c:\documents and settings\Owner\Local Settings\Application Data\{DCB16B06-6FEA-42D8-8B9B-82B2C261A01C}
c:\documents and settings\Owner\Local Settings\Application Data\{DCB16B06-6FEA-42D8-8B9B-82B2C261A01C}\chrome.manifest
c:\documents and settings\Owner\Local Settings\Application Data\{DCB16B06-6FEA-42D8-8B9B-82B2C261A01C}\chrome\content\_cfg.js
c:\documents and settings\Owner\Local Settings\Application Data\{DCB16B06-6FEA-42D8-8B9B-82B2C261A01C}\chrome\content\overlay.xul
c:\documents and settings\Owner\Local Settings\Application Data\{DCB16B06-6FEA-42D8-8B9B-82B2C261A01C}\install.rdf
c:\documents and settings\Owner\SpeedTreeRT.dll
c:\documents and settings\Owner\WINDOWS
c:\windows\103239pambotz55.cpl
c:\windows\1085z9yce.cpl
c:\windows\10865not-az5irus19c.exe
c:\windows\1096troj4z5.ocx
c:\windows\1099downl5ader1177z.cpl
c:\windows\10z51worm4b9.ocx
c:\windows\10z90virus5a8.bin
c:\windows\11509not-59vzrus636.cpl
c:\windows\11914w59ze4.cpl
c:\windows\120z59roj60e5.dll
c:\windows\1249zo5m4b5.ocx
c:\windows\1273ztea9935.ocx
c:\windows\12857spa9bot55z.dll
c:\windows\12e9spzw5re1575.cpl
c:\windows\1322595ambot6bz.cpl
c:\windows\134z9worm445.dll
c:\windows\14765spyz95.ocx
c:\windows\14z54not-a-virus495.dll
c:\windows\150b9za5se2891.ocx
c:\windows\151525zt-a-viru99e.ocx
c:\windows\15265no9-a-virusz1.dll
c:\windows\1528addwarez2589.dll
c:\windows\155649irus219z.bin
c:\windows\15639vi5uz1ff.exe
c:\windows\15952vizu57479.cpl
c:\windows\159c5h9efz730.cpl
c:\windows\159z0wor96c45.cpl
c:\windows\15aaspywa9e649z.exe
c:\windows\15vi9us5z25.exe
c:\windows\165th5zf23919.dll
c:\windows\16835zirus69a.exe
c:\windows\1689vir115z.dll
c:\windows\17452t9oj13z.bin
c:\windows\17494wor57z8.cpl
c:\windows\17505troj559z.dll
c:\windows\17505tzo5985.ocx
c:\windows\17917z5o9e4.bin
c:\windows\17e5b9ckdoorz023.ocx
c:\windows\18045hackt9oz335.ocx
c:\windows\18324s59z31.bin
c:\windows\1855z9i5us12.dll
c:\windows\185z9sp5664.cpl
c:\windows\18856virus7z9.exe
c:\windows\1899zspy6fe5.cpl
c:\windows\193z8w5rm9e5.cpl
c:\windows\19527tro93az5.ocx
c:\windows\19634zorm9025.bin
c:\windows\19848sp9mbzt1b65.bin
c:\windows\19895irz188.exe
c:\windows\19b4spywa95z670.dll
c:\windows\19c2addwarz351.exe
c:\windows\19z27wor5502.dll
c:\windows\19z5t5o959f.ocx
c:\windows\1a30vz92655.dll
c:\windows\1c4bthi9f35z2.exe
c:\windows\1e79threaz252845.ocx
c:\windows\1ezth5eat48489.cpl
c:\windows\1zf79ddwa5e2109.bin
c:\windows\20549tr5j65z.exe
c:\windows\2057ste9l2686z.cpl
c:\windows\20975hacktooz215.bin
c:\windows\20z259ambot7cd.ocx
c:\windows\21574s9zmbot2c5.dll
c:\windows\2157ztea59778.dll
c:\windows\22040not-azvir9s577.cpl
c:\windows\22804v5zus5359.ocx
c:\windows\23z65wor919c.ocx
c:\windows\24731virusz955.cpl
c:\windows\24873hacktoz59ac.dll
c:\windows\24904h9ckto5l6zb.cpl
c:\windows\24a0bazkdoor29359.bin
c:\windows\25391no9-a-zirus5d5.ocx
c:\windows\253es9yw5re1z53.dll
c:\windows\25519trzj7b8.ocx
c:\windows\255bspyzar91425.ocx
c:\windows\25696spyze2.dll
c:\windows\25738no9-a-virz564c.dll
c:\windows\25945hac5tool1zf.cpl
c:\windows\25956spzmbo5389.cpl
c:\windows\25e7backd95r7z3.exe
c:\windows\25eespywaz9837.ocx
c:\windows\25not-a-vizu910c.ocx
c:\windows\25z05wo9m350.bin
c:\windows\265zthreat217229.cpl
c:\windows\26828spam95t3z9.exe
c:\windows\26886tzoj539.exe
c:\windows\27051tr5j49z9.dll
c:\windows\27326ha5ktoolz49.exe
c:\windows\2759s9ambzt763.dll
c:\windows\275zvir1994.bin
c:\windows\27755spzmbot35d9.cpl
c:\windows\28139vi95s453z.cpl
c:\windows\2848not-z-virus955.dll
c:\windows\28584worm95z.exe
c:\windows\2869zpywar92351.cpl
c:\windows\2906zpyware4555.dll
c:\windows\29072tzoj555.cpl
c:\windows\29092zirus9a5.bin
c:\windows\29355wor96zb5.dll
c:\windows\29469hacz5o9l.exe
c:\windows\2959tzreat17937.dll
c:\windows\295bs9yzare619.cpl
c:\windows\29759zac5tool752.bin
c:\windows\29953worm551z.exe
c:\windows\29989spam5ot5zd.exe
c:\windows\2a91backdoor592z.ocx
c:\windows\2b5f9pywaze1638.exe
c:\windows\2b9zsteal5065.exe
c:\windows\2c509ir846z.bin
c:\windows\2cdcthrea9272z85.bin
c:\windows\2ce2s5ywz9e15.cpl
c:\windows\2ce3spyzare5579.bin
c:\windows\2d4fazdw9re3558.exe
c:\windows\2e05s9yware309z.dll
c:\windows\2e5estea9325z.ocx
c:\windows\2f10sp9rsz5831.dll
c:\windows\2f3abackdooz19559.ocx
c:\windows\2f50spar9ez7.bin
c:\windows\2z055not-9-virus71d.cpl
c:\windows\2z0745irus9c0.dll
c:\windows\2z149ownloader115.exe
c:\windows\2z152s9y6bf.ocx
c:\windows\2z195no5-a-vi9us389.bin
c:\windows\2zb5add5are869.bin
c:\windows\2zcc5parse999.exe
c:\windows\304z9virus1bf5.dll
c:\windows\30956tzoj579.exe
c:\windows\30957spzmb9t7c85.dll
c:\windows\31397not-a-virus1z5.ocx
c:\windows\31842not-59zirus578.dll
c:\windows\323555ot-azvirus2d9.cpl
c:\windows\323955ozm359.exe
c:\windows\3303hacktzol559.ocx
c:\windows\33azaddware5199.cpl
c:\windows\34525ownl9adez295.cpl
c:\windows\3456backdoorz909.ocx
c:\windows\345aspywzre12919.exe
c:\windows\34995tezl900.ocx
c:\windows\34z5spamb9t655.bin
c:\windows\3503threa931z18.cpl
c:\windows\3546spzwa952236.exe
c:\windows\354zspywa9e2355.dll
c:\windows\355zs9yware2569.dll
c:\windows\3591dow9lozd5r1747.bin
c:\windows\3596trojez.exe
c:\windows\3659addwa9e1z69.exe
c:\windows\36czstea53964.ocx
c:\windows\3821down9oader27z95.bin
c:\windows\3885zpambo59c5.dll
c:\windows\3910do5zloader2808.bin
c:\windows\395205acktool7b4z.ocx
c:\windows\39bdzackdo9r2159.cpl
c:\windows\39zct5i9f1828.ocx
c:\windows\3afe9zar5e1554.exe
c:\windows\3azc59arse687.ocx
c:\windows\3b5zdownlo9der663.ocx
c:\windows\3e45sp9rse2z50.cpl
c:\windows\3e9sp9r5e7z4.exe
c:\windows\3ebcaddwz592271.bin
c:\windows\3z2759ormeb.cpl
c:\windows\3za8addwa95108.cpl
c:\windows\4058dowzload9r2574.bin
c:\windows\40a8t5r9at173z9.bin
c:\windows\40f2stz9l14545.exe
c:\windows\41fdd9wn5ozder1366.exe
c:\windows\4257zp5r9e2148.dll
c:\windows\4483hzck5ool5e9.ocx
c:\windows\448c9tzal30035.dll
c:\windows\4505z9ambot557.dll
c:\windows\45a9tzreat17519.cpl
c:\windows\46c5thiez2999.ocx
c:\windows\4773t5zea917402.bin
c:\windows\4887z59ef580.dll
c:\windows\4908backzoor1615.cpl
c:\windows\4955vzr1296.ocx
c:\windows\495d9ackdoorz5775.exe
c:\windows\4999t5zef2938.bin
c:\windows\49e8thie52068z.exe
c:\windows\4a45stz9l2320.ocx
c:\windows\4b5z59wnloader571.cpl
c:\windows\4b92vir5z13.exe
c:\windows\4d05z9reat10125.bin
c:\windows\4d57ad5wzre8259.bin
c:\windows\4e8c9teal599z.cpl
c:\windows\4f579ddzare2715.bin
c:\windows\4z1csp5wa9e1915.dll
c:\windows\4z90vir5364.cpl
c:\windows\50b6z9wnloader3250.cpl
c:\windows\50d7backz9or2532.dll
c:\windows\5149troz445.exe
c:\windows\515ethiefz986.bin
c:\windows\51939zorm3c3.dll
c:\windows\51azspyware398.ocx
c:\windows\51f4doz9loade52732.exe
c:\windows\52014hazkt9ol12d.bin
c:\windows\522199py3fz.cpl
c:\windows\5250not-a-vzrus59c.dll
c:\windows\52a4zhre9t21052.ocx
c:\windows\53189py5dz.ocx
c:\windows\53579trzj3eb.ocx
c:\windows\53b9thrz9t2333.cpl
c:\windows\5493adzware1280.exe
c:\windows\5498no5-a-virzs655.cpl
c:\windows\549d5zarse2851.dll
c:\windows\5539hzef1529.bin
c:\windows\5542sp9rse6z1.dll
c:\windows\555czpywa9e1971.exe
c:\windows\5569zorm39a.cpl
c:\windows\5590addwzre16159.exe
c:\windows\5593spzware702.bin
c:\windows\5599hac5tool6ze.cpl
c:\windows\559zthi5f2907.exe
c:\windows\55cdzddware30219.ocx
c:\windows\55zdownloade9452.dll
c:\windows\5639spazse3567.exe
c:\windows\56z4vir9595.cpl
c:\windows\57b89ownlz5der2321.cpl
c:\windows\57dd5pywzre1497.cpl
c:\windows\57ffs9yz5re1912.cpl
c:\windows\5819addwarez732.exe
c:\windows\58794vi9usz33.bin
c:\windows\5892woz9351.cpl
c:\windows\58a9azdware2059.exe
c:\windows\58e3thzea912639.bin
c:\windows\58e7spy9are23z.bin
c:\windows\58z99spy7c.bin
c:\windows\59092hacktooz454.exe
c:\windows\59093z9rus20.ocx
c:\windows\59096zpambot2e6.exe
c:\windows\5929backdoorz231.exe
c:\windows\5984backd5or127z.ocx
c:\windows\598spyware30z5.exe
c:\windows\59a9zackdoor1953.ocx
c:\windows\59z5troj725.cpl
c:\windows\5a98st5a9225z.ocx
c:\windows\5ac2tzre9515227.cpl
c:\windows\5b2azd9ware1556.exe
c:\windows\5b2spy95re13z9.bin
c:\windows\5c35spywar92z94.ocx
c:\windows\5c69thrzat123165.exe
c:\windows\5ccfdownlozder950.exe
c:\windows\5d75virz9595.cpl
c:\windows\5d80thrzat927595.exe
c:\windows\5dc39teal3157z.dll
c:\windows\5e55backzoo9555.dll
c:\windows\5e5vir959z.bin
c:\windows\5e75b9ckdoor1847z.ocx
c:\windows\5f4aaddzare2296.cpl
c:\windows\5f5ezpa9se139.dll
c:\windows\5z20spywa5e9634.ocx
c:\windows\5z35spamb9t120.ocx
c:\windows\5z59spa9se2529.cpl
c:\windows\5z835spy9f9.ocx
c:\windows\6095threat245z5.exe
c:\windows\61589orz25.exe
c:\windows\61859hiez3199.exe
c:\windows\61b5add9are948z.cpl
c:\windows\62e69h5eat8724z.bin
c:\windows\652fviz1956.cpl
c:\windows\655dow9loadez3115.dll
c:\windows\6589zhre5t6943.dll
c:\windows\65945oznloader350.exe
c:\windows\65e3d59nlozder2495.cpl
c:\windows\671cs5y9are2z52.exe
c:\windows\67zedownl5ad9r113.ocx
c:\windows\681b9ckdoor15z.dll
c:\windows\6843do9nz5ader2358.cpl
c:\windows\69209ownloader54z1.cpl
c:\windows\6920sparsez954.ocx
c:\windows\69bfspywarez255.cpl
c:\windows\69e5sparse2789z.exe
c:\windows\69zcdownloade59041.ocx
c:\windows\6a2cthrzat59810.dll
c:\windows\6ac7download9r15z65.bin
c:\windows\6e91tzief5683.bin
c:\windows\6z26th9eat57818.cpl
c:\windows\6z2bsp5wa9e1857.exe
c:\windows\6z50dow5lo9der584.dll
c:\windows\6za1t95ef1508.dll
c:\windows\72b5spywaze987.bin
c:\windows\730z5ddware59.cpl
c:\windows\73z5or9480.exe
c:\windows\758es5ar9e1z43.ocx
c:\windows\7629addzare5379.ocx
c:\windows\765back9oor9z7.bin
c:\windows\765zv59956.exe
c:\windows\7689spy5zre9346.exe
c:\windows\779e5ackzoor2911.dll
c:\windows\779threat15072z.cpl
c:\windows\77z0thi592012.ocx
c:\windows\78cfste5l9z9.exe
c:\windows\799sp5rze793.exe
c:\windows\79dezhief12575.bin
c:\windows\79dz5hie9797.ocx
c:\windows\7a86st9az2537.bin
c:\windows\7ab4download9z546.dll
c:\windows\7d66v5rz0849.dll
c:\windows\7eb5backdoorz9289.cpl
c:\windows\7eb9a5dwzre2586.ocx
c:\windows\7f8zadd9ar5431.ocx
c:\windows\7z52addwar91516.exe
c:\windows\7zf1t5reat26926.bin
c:\windows\8042wzr55789.ocx
c:\windows\8573zo5m495.bin
c:\windows\89fzpy5are457.cpl
c:\windows\903zwo5m29e.cpl
c:\windows\90z8hackto9l1695.ocx
c:\windows\9133n5t-a-vzrus634.exe
c:\windows\91z68worm215.cpl
c:\windows\9378zparse27085.ocx
c:\windows\93d4szarse14305.exe
c:\windows\947065py6az.exe
c:\windows\94709spambot2z95.exe
c:\windows\94c3zhreat14955.cpl
c:\windows\950465rojz1b.bin
c:\windows\953bzpyware718.ocx
c:\windows\9568dowzl5ader2971.exe
c:\windows\95aaszarse751.cpl
c:\windows\9747v5ruz913.ocx
c:\windows\97597wzrm7f5.bin
c:\windows\97900hazkto5l283.cpl
c:\windows\99504n5t-a-viruszbb.ocx
c:\windows\99658troj542z.exe
c:\windows\99895not-a-vir5sz3c.bin
c:\windows\9aafzhrea516377.bin
c:\windows\9ca5sp5rse1z69.dll
c:\windows\9dcfback5oor1935z.cpl
c:\windows\9f5vir3z97.exe
c:\windows\9z023s5yf3.cpl
c:\windows\9z955ot-a-virus644.ocx
c:\windows\9zf8s5arse1023.cpl
c:\windows\ab5sparz9474.cpl
c:\windows\b959hief57z5.dll
c:\windows\beza5dware3092.ocx
c:\windows\czd5ddware3109.cpl
c:\windows\ez95pyware646.cpl
c:\windows\system32\10095v5rus6fcz.cpl
c:\windows\system32\1029szyware2195.cpl
c:\windows\system32\10510zirus7519.cpl
c:\windows\system32\105z99py550.cpl
c:\windows\system32\10895hacktozl75b.ocx
c:\windows\system32\1110559oj2z9.dll
c:\windows\system32\11189hzckto5l634.cpl
c:\windows\system32\1159viruz15e.dll
c:\windows\system32\118z3v9r5s18b.bin
c:\windows\system32\11951t5oz62d.cpl
c:\windows\system32\1249szamb5tf9.ocx
c:\windows\system32\12606hackt9o57zd.ocx
c:\windows\system32\12842hack5ooz297.bin
c:\windows\system32\12z79s5y695.cpl
c:\windows\system32\131z09pambo5b6.exe
c:\windows\system32\1352zt9oj4e2.ocx
c:\windows\system32\13595troj19z.cpl
c:\windows\system32\13645zpy6839.ocx
c:\windows\system32\136cbackdozr4759.bin
c:\windows\system32\1395thzea53411.dll
c:\windows\system32\14712worm45z9.exe
c:\windows\system32\14e9downloader237z5.cpl
c:\windows\system32\1510zwo9m766.exe
c:\windows\system32\1529sparze5186.bin
c:\windows\system32\15668spambotz9.cpl
c:\windows\system32\156z3s9ambot4925.cpl
c:\windows\system32\15718wozm199.dll
c:\windows\system32\158515or923z.ocx
c:\windows\system32\15934t5oz95.dll
c:\windows\system32\15955hief779z.exe
c:\windows\system32\15955worm4cez.cpl
c:\windows\system32\1697zack5ool134.cpl
c:\windows\system32\17093not-a-vzrus695.exe
c:\windows\system32\173z6spamb9t5e8.dll
c:\windows\system32\173z85ro987.exe
c:\windows\system32\1759zormc5.dll
c:\windows\system32\1774695ambot27z.ocx
c:\windows\system32\177z9w59m75.bin
c:\windows\system32\17z85hacktool52a9.ocx
c:\windows\system32\18087n5t-a9virus683z.bin
c:\windows\system32\1819t9ie52995z.exe
c:\windows\system32\18329szambot17c5.exe
c:\windows\system32\18699spamzot589.exe
c:\windows\system32\189cstealz506.cpl
c:\windows\system32\19095tzo935c.dll
c:\windows\system32\19331ha9k5oolz14.cpl
c:\windows\system32\194985pazbot79f.bin
c:\windows\system32\19508zroj7509.cpl
c:\windows\system32\1952worm501z.dll
c:\windows\system32\195z9not-5-virus6849.exe
c:\windows\system32\19724not59-viruszdc.bin
c:\windows\system32\19899zackto5l57b.exe
c:\windows\system32\1a9zvi5389.cpl
c:\windows\system32\1b6f9pzware5938.bin
c:\windows\system32\1bcdow9lzader2513.bin
c:\windows\system32\1bzes9arse5433.bin
c:\windows\system32\1c42downl9ade51z28.cpl
c:\windows\system32\1c77baczdo9r951.bin
c:\windows\system32\1e69st5zl743.ocx
c:\windows\system32\1e6zhief2695.bin
c:\windows\system32\1f4c5z9nloader812.exe
c:\windows\system32\1f5dv9r858z.ocx
c:\windows\system32\1f8zt9i5f1100.dll
c:\windows\system32\1z319vir5s24c.bin
c:\windows\system32\1z425troj9435.dll
c:\windows\system32\1z60659y99.bin
c:\windows\system32\1z866v59us4f4.ocx
c:\windows\system32\1z9419p518.dll
c:\windows\system32\1z962not-a-v5rus39b.dll
c:\windows\system32\1za65ir9150.exe
c:\windows\system32\1zb1spar5e9145.ocx
c:\windows\system32\1zb7vir3593.bin
c:\windows\system32\200209i5us1a7z.dll
c:\windows\system32\20859hazktool38b.cpl
c:\windows\system32\21019zr5j6a1.cpl
c:\windows\system32\21059ackt5ol5edz.bin
c:\windows\system32\21066s5am9ot2dz.ocx
c:\windows\system32\21230hack9oolz5d.exe
c:\windows\system32\2138a5dwzre914.exe
c:\windows\system32\21529pam5ot6a5z.cpl
c:\windows\system32\21657tr5j398z.dll
c:\windows\system32\2257zhackto5lc9.exe
c:\windows\system32\22918zac5tool3f.dll
c:\windows\system32\229ab5ckd9oz133.bin
c:\windows\system32\23738zp59ec.dll
c:\windows\system32\2399zw5rm4a7.bin
c:\windows\system32\239z95roj5c4.ocx
c:\windows\system32\24392sp5zff.bin
c:\windows\system32\24569zormbc.exe
c:\windows\system32\245889zoj3d3.bin
c:\windows\system32\2502backdoor1z69.cpl
c:\windows\system32\25497vizus213.bin
c:\windows\system32\255549pyzc6.ocx
c:\windows\system32\25558tr9j4z5.dll
c:\windows\system32\25779zot-a-vir9s165.bin
c:\windows\system32\2592addware93z0.bin
c:\windows\system32\25953v9rus5ez.cpl
c:\windows\system32\25z05tr9j51.dll
c:\windows\system32\26150h5zkto9l7a8.ocx
c:\windows\system32\26593sp9mbo51cfz.cpl
c:\windows\system32\26875not5a-vir9s2d4z.exe
c:\windows\system32\2689wz95588.bin
c:\windows\system32\26961noz-a-v5rus7d.bin
c:\windows\system32\269z85py2f3.cpl
c:\windows\system32\27135spamzot5019.cpl
c:\windows\system32\2724hack5ool9zb.ocx
c:\windows\system32\272zspyware52699.dll
c:\windows\system32\27326szambot905.bin
c:\windows\system32\2759viz283.dll
c:\windows\system32\275z5tro928f.ocx
c:\windows\system32\27679sp5707z.dll
c:\windows\system32\28142sp9zbot385.exe
c:\windows\system32\289749pyz205.bin
c:\windows\system32\28ddbz5kdoor3159.dll
c:\windows\system32\28dddown5oz9er212.exe
c:\windows\system32\29096zro53f5.ocx
c:\windows\system32\29197s5a9bzt745.bin
c:\windows\system32\293z25acktool5f7.ocx
c:\windows\system32\2943z95rse1155.bin
c:\windows\system32\294785pambot5bz.dll
c:\windows\system32\294vi59009z.bin
c:\windows\system32\29532zroj4fb.dll
c:\windows\system32\2970bzck5oo9379.ocx
c:\windows\system32\2982zhacktool4855.ocx
c:\windows\system32\29847not-a-zirus9e5.bin
c:\windows\system32\2986down9ozder205.ocx
c:\windows\system32\2992ba5kdoor3z00.ocx
c:\windows\system32\2995threat16z37.dll
c:\windows\system32\29967vizus55a.exe
c:\windows\system32\29c0zddw5r92973.ocx
c:\windows\system32\29z71vir5s137.cpl
c:\windows\system32\29z80hacktool59f.ocx
c:\windows\system32\2cc4download9z5431.dll
c:\windows\system32\2cd9ownloader585z.ocx
c:\windows\system32\2f4evi950z1.bin
c:\windows\system32\2f53threat10963z.cpl
c:\windows\system32\2z159s5ambot54a.dll
c:\windows\system32\2z8dvir14059.cpl
c:\windows\system32\2z94v5r25219.exe
c:\windows\system32\2ze6spyw9re30725.cpl
c:\windows\system32\312995ro9707z.dll
c:\windows\system32\31694h5cktool4bfz.dll
c:\windows\system32\31794zo597a5.dll
c:\windows\system32\3192zhac9t5ol5b1.cpl
c:\windows\system32\32287tro9155z.bin
c:\windows\system32\32437spambot55z9.dll
c:\windows\system32\3250downloa9er245z.cpl
c:\windows\system32\32615zir9s565.exe
c:\windows\system32\32671ziru9250.cpl
c:\windows\system32\3313spambo9z65.bin
c:\windows\system32\33z9troj5945.cpl
c:\windows\system32\343z9pyware1359.cpl
c:\windows\system32\35019zorm515.exe
c:\windows\system32\3553zpyware5709.dll
c:\windows\system32\3569ad9warez242.bin
c:\windows\system32\3595addwarez351.cpl
c:\windows\system32\35d5backd9oz2757.dll
c:\windows\system32\35z9threat27924.cpl
c:\windows\system32\3724bacz9oor895.cpl
c:\windows\system32\3759wozm26a.exe
c:\windows\system32\37bdown9z5der1037.exe
c:\windows\system32\384ez5ief8829.ocx
c:\windows\system32\389thr5at225z8.ocx
c:\windows\system32\392astea53z41.ocx
c:\windows\system32\3954szarse1494.dll
c:\windows\system32\395edo5nloader1z39.bin
c:\windows\system32\3963zac5door3024.cpl
c:\windows\system32\396eszars51978.dll
c:\windows\system32\397fad9ware2759z.dll
c:\windows\system32\39fdthreat766z5.exe
c:\windows\system32\39ffsze9l5075.bin
c:\windows\system32\39z0spy9are5263.bin
c:\windows\system32\39z54viru5163.exe
c:\windows\system32\3ab9th5ef30z8.cpl
c:\windows\system32\3abdz9yware858.dll
c:\windows\system32\3d755ow9lozder3146.bin
c:\windows\system32\3d889hzef1259.dll
c:\windows\system32\3e35ste9lz23.cpl
c:\windows\system32\3e5a5ownl9ader3z95.ocx
c:\windows\system32\3ebethr5at97709z.cpl
c:\windows\system32\3z338virus259.bin
c:\windows\system32\3z50do9nloader155.ocx
c:\windows\system32\3z7fs9ea5808.dll
c:\windows\system32\402e9h5eatz033.cpl
c:\windows\system32\4098not-a-virus5z9.dll
c:\windows\system32\409dthreatz5593.ocx
c:\windows\system32\409zt5oj1ad.cpl
c:\windows\system32\40d6thzef9529.cpl
c:\windows\system32\41539pz211.cpl
c:\windows\system32\4244zor5319.exe
c:\windows\system32\4294backdzor805.ocx
c:\windows\system32\4395steal2z57.ocx
c:\windows\system32\44325tezl919.exe
c:\windows\system32\44zasp95are900.bin
c:\windows\system32\452zspyware1980.exe
c:\windows\system32\4657not-a-vzru93f.ocx
c:\windows\system32\4759b9ckdooz1315.ocx
c:\windows\system32\476bsparze5799.bin
c:\windows\system32\485a5zeal2992.cpl
c:\windows\system32\48b9steal82z5.ocx
c:\windows\system32\4958thiefz0205.cpl
c:\windows\system32\498zpyw9re965.cpl
c:\windows\system32\4b97d5wnloadzr1899.dll
c:\windows\system32\4d2zback9oor550.bin
c:\windows\system32\4d65s9eal232z.exe
c:\windows\system32\4dbavi9z7245.dll
c:\windows\system32\4e2eb9ck5oor19z4.bin
c:\windows\system32\4z2caddwa9e5922.dll
c:\windows\system32\4z689ack5ool441.dll
c:\windows\system32\50139zirus6d4.bin
c:\windows\system32\5088addw9rz345.dll
c:\windows\system32\50fcste95699z.dll
c:\windows\system32\5123sz5r9e1197.dll
c:\windows\system32\52297szy2dc.ocx
c:\windows\system32\5249down5zader2930.cpl
c:\windows\system32\52969troj555z.dll
c:\windows\system32\53925teal3013z.ocx
c:\windows\system32\53fabackd9or1z13.bin
c:\windows\system32\5435t5oj192z.dll
c:\windows\system32\5494spy3b7z.exe
c:\windows\system32\54z8ha9ktool651.ocx
c:\windows\system32\5509thre5t1179z.exe
c:\windows\system32\5516spyzb9.bin
c:\windows\system32\55221spambot9za.cpl
c:\windows\system32\5563zhief9530.exe
c:\windows\system32\5590downloadez2211.cpl
c:\windows\system32\55c6zddware5909.dll
c:\windows\system32\55dcspywa9e63z.ocx
c:\windows\system32\5623zirus7095.ocx
c:\windows\system32\5644tz9j5f1.dll
c:\windows\system32\5692wzrm709.ocx
c:\windows\system32\569cadzware1145.dll
c:\windows\system32\5740viz9s318.bin
c:\windows\system32\57459o5z2d3.cpl
c:\windows\system32\57z3vir9s59c.exe
c:\windows\system32\5819tz5eat28196.cpl
c:\windows\system32\5858downlozd9r1535.exe
c:\windows\system32\58b9zh5eat12194.dll
c:\windows\system32\5924zhacktool4b.dll
c:\windows\system32\59425ddwar9z27.dll
c:\windows\system32\5946threat25z0.bin
c:\windows\system32\594bbackdo5r2891z.exe
c:\windows\system32\5957downlozder1551.cpl
c:\windows\system32\5962zddware1026.ocx
c:\windows\system32\59774viruz2ac.bin
c:\windows\system32\59adzir5175.cpl
c:\windows\system32\59bfb5ckdoo91z97.cpl
c:\windows\system32\59z559y4cd.bin
c:\windows\system32\5a57thizf1519.cpl
c:\windows\system32\5a59z5ars9386.exe
c:\windows\system32\5b4ethreatz6937.cpl
c:\windows\system32\5c50thiefz3709.dll
c:\windows\system32\5c6a95ief71z.ocx
c:\windows\system32\5cb5thrzat9195.exe
c:\windows\system32\5d46th9e5t11z94.ocx
c:\windows\system32\5dd5down9oader952z.bin
c:\windows\system32\5df4zown59ader2508.bin
c:\windows\system32\5ed9zir6509.bin
c:\windows\system32\5f5abackdoor9055z.bin
c:\windows\system32\5f69th5eaz8493.exe
c:\windows\system32\5z19spyware2503.cpl
c:\windows\system32\5z20thi95889.bin
c:\windows\system32\5z50spar5e1569.dll
c:\windows\system32\5zb95hief702.exe
c:\windows\system32\5zcb9ddware1761.bin
c:\windows\system32\61e5downl9zder3855.ocx
c:\windows\system32\6237spzr5e2339.cpl
c:\windows\system32\6263virus95z.bin
c:\windows\system32\630bthzea918153.dll
c:\windows\system32\6343z9r20485.bin
c:\windows\system32\648aste5z1095.bin
c:\windows\system32\65f2v9z978.cpl
c:\windows\system32\685bspywzre27799.bin
c:\windows\system32\6952worm2b5z.cpl
c:\windows\system32\695za9dwar545.ocx
c:\windows\system32\6997down9oad5r142z.exe
c:\windows\system32\6a5ethi9z674.exe
c:\windows\system32\6b3d5ackdo9r292z.dll
c:\windows\system32\6bz2vi927515.ocx
c:\windows\system32\6c1at95ef11z9.bin
c:\windows\system32\6cfsteal9578z.ocx
c:\windows\system32\6db9stezl955.dll
c:\windows\system32\6f3caddwzre21945.bin
c:\windows\system32\7292not-azvi5usa0.cpl
c:\windows\system32\729a5dwaze2929.ocx
c:\windows\system32\7318downzo9d5r1319.dll
c:\windows\system32\7456virusz96.cpl
c:\windows\system32\7489virus5daz.cpl
c:\windows\system32\74c2addwar592z9.ocx
c:\windows\system32\752caddw9re1z69.cpl
c:\windows\system32\758bdo9nloadez3024.dll
c:\windows\system32\7597bac5zoor2743.exe
c:\windows\system32\774a5zware692.bin
c:\windows\system32\7791sp5mb9tz5f.cpl
c:\windows\system32\7952down9oa5er32z0.dll
c:\windows\system32\79d9addwarez6585.dll
c:\windows\system32\7b85virz319.cpl
c:\windows\system32\7b9avir2775z.dll
c:\windows\system32\7c8zsteal599.exe
c:\windows\system32\7c96th9eatz4915.exe
c:\windows\system32\7cfathre5t299z4.dll
c:\windows\system32\7d865pars9178z.dll
c:\windows\system32\7dzfa95ware213.dll
c:\windows\system32\7e9ethief50z.ocx
c:\windows\system32\7f39vz9785.exe
c:\windows\system32\7f469ackdooz1150.cpl
c:\windows\system32\7ffdow5l9ader14z0.cpl
c:\windows\system32\7z95troj456.cpl
c:\windows\system32\7zfeth5ef2975.bin
c:\windows\system32\8139hack9oo5508z.exe
c:\windows\system32\8514wo9m54z.cpl
c:\windows\system32\859spywa5ez4.bin
c:\windows\system32\860z9pambot559.exe
c:\windows\system32\87205iruz59.exe
c:\windows\system32\8797viruz4b95.bin
c:\windows\system32\90535vizus2f5.cpl
c:\windows\system32\905spywarz1979.bin
c:\windows\system32\9118not5a-v9rus5z3.dll
c:\windows\system32\91245orm5z7.dll
c:\windows\system32\91304hac5tzol678.cpl
c:\windows\system32\925ztroj318.exe
c:\windows\system32\926zorm1935.cpl
c:\windows\system32\92f9downloader3z85.cpl
c:\windows\system32\9310spambo51z5.bin
c:\windows\system32\93414wormzef5.exe
c:\windows\system32\9426zac5tool91a.ocx
c:\windows\system32\949z5t-a-virus2a1.ocx
c:\windows\system32\94dcb5czdoor1784.bin
c:\windows\system32\94zfaddware45.dll
c:\windows\system32\951backd9orz61.bin
c:\windows\system32\95527noz-a5virus55e.bin
c:\windows\system32\95559irzs2e5.dll
c:\windows\system32\955bthiefz189.cpl
c:\windows\system32\955z5ckd9or227.bin
c:\windows\system32\9569backd5oz2997.dll
c:\windows\system32\95763zi5us21c.cpl
c:\windows\system32\95765zorm591.exe
c:\windows\system32\95z8vir150.bin
c:\windows\system32\964zdownl5ader953.dll
c:\windows\system32\97455tzoj1aa.bin
c:\windows\system32\97c7t5rezt1628.cpl
c:\windows\system32\9882addwarz29495.exe
c:\windows\system32\9933spy75z.exe
c:\windows\system32\9a7b5hizf1501.cpl
c:\windows\system32\9azespar5e1610.cpl
c:\windows\system32\9b97spazse259.exe
c:\windows\system32\9d6zdow5loader974.exe
c:\windows\system32\9ezav5r1578.exe
c:\windows\system32\9f5zsteal1518.exe
c:\windows\system32\9fe0v5r764z.bin
c:\windows\system32\9z034t5oj2f3.exe
c:\windows\system32\9z55thief551.bin
c:\windows\system32\9z988s5y309.ocx
c:\windows\system32\b54backdozr9212.ocx
c:\windows\system32\ba4b5c9zoor307.bin
c:\windows\system32\c97add9a5e3z0.exe
c:\windows\system32\d6bspy9zre3105.cpl
c:\windows\system32\ff5addware192z.exe
c:\windows\system32\z0183wor542a9.ocx
c:\windows\system32\z065vir9s43c.bin
c:\windows\system32\z07595ro9192.dll
c:\windows\system32\z0cdba9kd5or2148.dll
c:\windows\system32\z25d9ir2751.cpl
c:\windows\system32\z2a5vir9349.dll
c:\windows\system32\z301s9y755.exe
c:\windows\system32\z3855sp93615.bin
c:\windows\system32\z3f5stea92639.ocx
c:\windows\system32\z3f8backd9or145.dll
c:\windows\system32\z5466spam9ot5eb.exe
c:\windows\system32\z57155py92a.dll
c:\windows\system32\z60089or52eb.bin
c:\windows\system32\z6315viru91a9.bin
c:\windows\system32\z659sp52d0.exe
c:\windows\system32\z68cs5ars92948.cpl
c:\windows\system32\z9255hief1724.cpl
c:\windows\system32\z958t9ief626.bin
c:\windows\system32\z959roj6295.dll
c:\windows\system32\z965worm3e4.ocx
c:\windows\system32\z9965worm414.cpl
c:\windows\system32\zb7as95al984.ocx
c:\windows\system32\zcebspyware2952.exe
c:\windows\system32\zd2a59ware2942.cpl
c:\windows\z0479troj598.cpl
c:\windows\z0979spam5otd.dll
c:\windows\z13not5a-virus3c29.exe
c:\windows\z498vir7265.dll
c:\windows\z54threat55989.cpl
c:\windows\z57s9ambot1c3.dll
c:\windows\z5871troj7a99.exe
c:\windows\z6025wor92875.exe
c:\windows\z799threat27590.cpl
c:\windows\z7ev9r2995.bin
c:\windows\z8ba5p9rse1156.exe
c:\windows\z90ethr9at19544.cpl
c:\windows\z9516hac5tool176.bin
c:\windows\z97bd5wnloader379.dll
c:\windows\zdcaadd9a5e2523.ocx
c:\windows\ze6steal9445.cpl
c:\windows\zffbsp5ware1369.bin
.
Infected copy of c:\windows\system32\drivers\volsnap.sys was found and disinfected
Restored copy from - Kitty had a snack
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Service_usnjsvc
.
.
((((((((((((((((((((((((( Files Created from 2011-04-18 to 2011-05-18 )))))))))))))))))))))))))))))))
.
.
2011-05-15 20:26 . 2009-09-04 21:29 1974616 —-a-w- c:\windows\system32\D3DCompiler_42.dll
2011-05-15 20:26 . 2009-09-04 21:29 235344 —-a-w- c:\windows\system32\d3dx11_42.dll
2011-05-15 20:25 . 2009-09-04 21:29 453456 —-a-w- c:\windows\system32\d3dx10_42.dll
2011-05-15 17:57 . 2010-09-18 06:53 953856 -c—-w- c:\windows\system32\dllcache\mfc40u.dll
2011-05-15 17:57 . 2011-02-08 13:33 978944 -c—-w- c:\windows\system32\dllcache\mfc42.dll
2011-05-15 17:56 . 2010-08-23 16:12 617472 -c—-w- c:\windows\system32\dllcache\comctl32.dll
2011-05-15 17:56 . 2010-06-14 14:31 744448 -c—-w- c:\windows\system32\dllcache\helpsvc.exe
2011-05-15 17:55 . 2010-11-02 15:17 40960 -c—-w- c:\windows\system32\dllcache\ndproxy.sys
2011-05-15 17:43 . 2009-11-21 15:51 471552 -c—-w- c:\windows\system32\dllcache\aclayers.dll
2011-05-15 17:41 . 2010-06-18 13:36 3558912 -c—-w- c:\windows\system32\dllcache\moviemk.exe
2011-05-15 17:39 . 2010-10-11 14:59 45568 -c—-w- c:\windows\system32\dllcache\wab.exe
2011-05-15 17:09 . 2011-05-15 17:09 ——– d-sh–w- c:\documents and settings\Owner\IECompatCache
2011-05-15 14:23 . 2011-05-15 14:23 388096 —-a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-05-15 14:23 . 2011-05-15 14:23 ——– d—–w- c:\program files\Trend Micro
2011-05-15 13:59 . 2007-03-09 15:25 2321288 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2011-05-15 13:59 . 2011-04-18 13:15 7071056 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{3BEF478E-3278-467C-B74D-359D14456C8B}\mpengine.dll
2011-05-15 13:58 . 2011-02-02 22:11 222080 ——w- c:\windows\system32\MpSigStub.exe
2011-05-15 13:56 . 2011-05-15 13:56 ——– d—–w- c:\program files\Windows Defender
2011-05-12 01:10 . 2011-05-12 01:10 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2011-05-12 01:02 . 2011-05-12 01:29 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2011-05-12 01:00 . 2011-05-12 01:27 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools
2011-05-11 23:20 . 2011-05-11 23:25 ——– d—–w- c:\documents and settings\All Users\Application Data\RegCure
2011-05-11 23:18 . 2011-05-11 23:18 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\WinZip
2011-05-11 23:17 . 2011-05-11 23:18 ——– d—–w- c:\documents and settings\All Users\Application Data\WinZip
2011-05-11 05:45 . 2009-08-06 23:23 215920 —-a-w- c:\windows\system32\muweb.dll
2011-05-11 05:45 . 2009-08-06 23:23 274288 —-a-w- c:\windows\system32\mucltui.dll
2011-05-11 02:22 . 2011-05-11 02:22 ——– d—–w- c:\documents and settings\Owner\Application Data\AVG10
2011-05-11 02:15 . 2011-05-18 00:04 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG10
2011-05-11 02:10 . 2011-05-11 02:10 ——– d—–w- c:\documents and settings\Owner\Application Data\Malwarebytes
2011-05-11 01:36 . 2010-12-20 22:09 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-11 01:36 . 2011-05-11 01:36 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-05-11 01:36 . 2011-05-11 01:36 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-05-11 01:27 . 2011-05-11 01:27 ——– d—–w- c:\documents and settings\All Users\Application Data\Common Files
2011-05-11 01:05 . 2011-05-18 00:02 ——– d—–w- c:\documents and settings\All Users\Application Data\MFAData
2011-05-11 00:14 . 2011-05-11 00:25 ——– d—–w- c:\documents and settings\Administrator
2011-05-09 21:41 . 2011-05-11 00:00 0 —-a-w- c:\windows\Jkegomu.bin
2011-05-09 21:37 . 2011-05-09 21:37 ——– d—–w- c:\windows\Sun
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-07 05:33 . 2009-09-26 21:49 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:37 . 2009-09-26 21:51 420864 —-a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:21 . 2009-09-26 21:51 1857920 —-a-w- c:\windows\system32\win32k.sys
2011-02-22 23:06 . 2009-09-26 21:51 916480 —-a-w- c:\windows\system32\wininet.dll
2011-02-22 23:06 . 2009-09-26 21:49 43520 ——w- c:\windows\system32\licmgr10.dll
2011-02-22 23:06 . 2009-09-26 21:49 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-02-22 11:41 . 2009-09-26 21:49 385024 ——w- c:\windows\system32\html.iec
2011-02-17 13:18 . 2009-09-26 21:50 455936 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-02-17 13:18 . 2009-09-26 21:51 357888 —-a-w- c:\windows\system32\drivers\srv.sys
2011-02-17 12:32 . 2009-09-26 19:43 5120 —-a-w- c:\windows\system32\xpsp4res.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-18 13574144]
"nwiz"="nwiz.exe" [2008-09-18 1657376]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-18 86016]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 05:04 39792 —-a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2009-05-27 01:06 4351216 —-a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-09-28 15:56 149280 —-a-w- c:\program files\Java\jre6\bin\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"usnjsvc"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"idsvc"=3 (0x3)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
.
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [5/10/2011 9:36 PM 38224]
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-18 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 23:20]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
IE: &ieSpell; Options - c:\program files\ieSpell\iespell.dll/SPELLOPTION.HTM
IE: Check &Spelling; - c:\program files\ieSpell\iespell.dll/SPELLCHECK.HTM
IE: Lookup on Merriam Webster - file://c:\program files\ieSpell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files\ieSpell\wikipedia.HTM
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-17 20:24
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(3576)
c:\windows\system32\WININET.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
.
———————— Other Running Processes ————————
.
c:\windows\SOUNDMAN.EXE
c:\windows\system32\RUNDLL32.EXE
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2011-05-17 20:28:58 - machine was rebooted
ComboFix-quarantined-files.txt 2011-05-18 00:28
.
Pre-Run: 64,828,297,216 bytes free
Post-Run: 64,962,322,432 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 184F1921FA9F2FA228224B5A542BD923