What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

multiple Avast warnings

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I have recently had my credit card used fraudulently and now Avast keeps giving me multiple warnings. I suspect my computer is infected. Any help would be much appreciated. (Hijack this log pasted below).

Nick.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:21:17, on 03/06/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AskBarDis\bar\bin\AskService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I091.EXE
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\Program Files\Entriq\MediaSphere\EntriqMediaTray.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Entriq\MediaSphere\3.8.2.9\EntriqMediaServer.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Nicholas\My Documents\Downloads\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: ZoneAlarm Toolbar - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZon1.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar1.dll
O2 - BHO: ZoneAlarm Toolbar - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZon1.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: FraudEliminator - {A5181F8A-0B9D-43AC-8BE5-EB61651DB685} - C:\Program Files\FraudEliminator\2.3.4\FETB.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: ZoneAlarm Spy Blocker Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar1.dll
O3 - Toolbar: ZoneAlarm Toolbar - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZon1.dll
O3 - Toolbar: ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
O4 - HKLM\..\Run: [EPSON Stylus C48 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I091.EXE /P23 "EPSON Stylus C48 Series" /O6 "USB001" /M "Stylus C48"
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [Deskup] C:\Program Files\Iomega\DriveIcons\deskup.exe /IMGSTART
O4 - HKLM\..\Run: [five Media Manager Tray] "C:\Program Files\Entriq\MediaSphere\EntriqMediaTray.exe" /CustomId:five
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ISW] "C:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {46431044-1B22-4EF3-B333-863AAF310153} (five Class) - http://download.five.tv/Download/five_3_4_0_8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1231005245375
O16 - DPF: {CE7D2BF2-D173-4CE2-9DAF-15EA153B5B43} (MediaControl Class) - http://download.five.tv/Download/Entriq_3_4_0_10_Silent.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://remote.britannia.co.uk/dana-cached/…perSetupSP1.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8FE3B2EA-AECF-4482-AA57-E8A584CFACA4}: NameServer = 212.139.132.27 212.139.132.25
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ZoneAlarm Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe

–
End of file - 10669 bytes
Post #2
Hello and Welcome to WhatTheTech Forums

My name is BlackPegasus.

  • Malware Logs can sometimes take a lot of time to research and interpret.
  • Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for
    further explanation.
  • Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to
    get your system clean.
  • Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out
    the instructions you receive, as in some instances you may have to disconnect your computer from the Internet.
  • PLEASE NOTE: If you do not reply after 3 days your thread will be closed.
  • Please be aware that I am still in training, and all of my replies to you will be checked for accuracy by one of our experts to
    ensure that I am giving you the best possible advice.
  • This may cause a delay in response time, but I will do my best to keep it as short as possible.
  • I will reply back shortly with instructions.
Post #3
Hello fixer-man_nick


Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise, this will be a team effort.
This may cause a delay, but I will do my best to keep it as short as possible. Please bear with me, I will post back to you as soon as I can.


IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

==============================
  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
    Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

==============================
NEXT
Please download aswMBR ( 511KB ) to your desktop.
  • Double click the aswMBR.exe icon to run it
  • Click the Scan button to start the scan
  • On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

===============================
Please include in your next reply:
1. Any problem executing the instructions?
2. OTL.Txt and Extras.Txt
3. aswMBR log
4. How is the computer behaving?
Post #4
Hi,

Thanks for offering to help. In response to your bullet points:

1. No problems executing the instructions they were very clear.
2. OTL logs x2 pasted below
3. aswMBR log pasted below
4. The computer is ok most of the time but sometimes freezes or refuses to shut down. My biggest concern is security of credit card and internet banking details.

Nick

OTL logfile created on: 05/06/2011 21:37:47 - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\Nicholas\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

447.23 Mb Total Physical Memory | 221.06 Mb Available Physical Memory | 49.43% Memory free
1.03 Gb Paging File | 0.68 Gb Available in Paging File | 65.72% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 114.48 Gb Total Space | 83.71 Gb Free Space | 73.12% Space Free | Partition Type: NTFS

Computer Name: PERSONAL-E765D1 | User Name: Nicholas | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Nicholas\My Documents\Downloads\OTL(1).exe (OldTimer Tools)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe (Check Point Software Technologies)
PRC - C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\Program Files\AskBarDis\bar\bin\AskService.exe ()
PRC - C:\Program Files\Entriq\MediaSphere\EntriqMediaTray.exe (Entriq, Inc.)
PRC - C:\Program Files\Entriq\MediaSphere\3.8.2.9\EntriqMediaServer.exe (Entriq, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_S4I091.EXE (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Iomega\System32\AppServices.exe (Iomega Corporation)
PRC - C:\WINDOWS\system32\VTTimer.exe (S3 Graphics, Inc.)
PRC - C:\WINDOWS\system32\VTTrayp.exe (S3 Graphics Co., Ltd.)
PRC - C:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe (THOMSON Telecom Belgium)
PRC - C:\Program Files\Iomega\AutoDisk\ADService.exe (Iomega Corporation)
PRC - C:\Program Files\Iomega\AutoDisk\ADUserMon.exe (Iomega Corporation)
PRC - C:\Program Files\Iomega\DriveIcons\Imgicon.exe (Iomega)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Nicholas\My Documents\Downloads\OTL(1).exe (OldTimer Tools)
MOD - C:\Program Files\Alwil Software\Avast5\snxhk.dll (AVAST Software)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_179798c8\msvcr80.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_179798c8\msvcp80.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (Check Point Software Technologies)
MOD - C:\Program Files\Iomega\DriveIcons\Imghook.dll (Iomega Corporation)


========== Win32 Services (SafeList) ==========

SRV - (Iomega Activity Disk2) – File not found
SRV - (HidServ) – File not found
SRV - (CarboniteService) – File not found
SRV - (AppMgmt) – File not found
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (nosGetPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper_3004.dll (NOS Microsystems Ltd.)
SRV - (vsmon) – C:\WINDOWS\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
SRV - (IswSvc) – C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe (Check Point Software Technologies)
SRV - (getPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (ASKService) – C:\Program Files\AskBarDis\bar\bin\AskService.exe ()
SRV - (KService) – C:\Program Files\Kontiki\KService.exe (Kontiki Inc.)
SRV - (CCALib8) – C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
SRV - (Iomega App Services) – C:\Program Files\Iomega\System32\AppServices.exe (Iomega Corporation)
SRV - (_IOMEGA_ACTIVE_DISK_SERVICE_) – C:\Program Files\Iomega\AutoDisk\ADService.exe (Iomega Corporation)


========== Driver Services (SafeList) ==========

DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (ISWKL) – C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys (Check Point Software Technologies)
DRV - (vsdatant) – C:\WINDOWS\system32\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (giveio) – C:\WINDOWS\system32\giveio.sys ()
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (ppa3) – C:\WINDOWS\system32\DRIVERS\ppa3.sys (Microsoft Corporation)
DRV - (AmdPPM) – C:\WINDOWS\system32\drivers\AmdPPM.sys (Advanced Micro Devices)
DRV - (Intels51) Intel® – C:\WINDOWS\system32\drivers\IntelS51.sys (Intel Corporation)
DRV - (iomdisk) – C:\WINDOWS\System32\DRIVERS\iomdisk.sys (Iomega Corporation)
DRV - (alcaudsl) – C:\WINDOWS\system32\drivers\alcaudsl.sys (THOMSON)
DRV - (alcan5wn) SpeedTouch USB ADSL PPP Networking Driver (NDISWAN) – C:\WINDOWS\system32\drivers\alcan5wn.sys (THOMSON)
DRV - (ms_mpu401) – C:\WINDOWS\system32\drivers\msmpu401.sys (Microsoft Corporation)
DRV - (irsir) – C:\WINDOWS\system32\drivers\irsir.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.google.co.uk/
IE - HKCU\..\URLSearchHook: {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZon1.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;="
FF - prefs.js..browser.search.selectedEngine: "Ask"
FF - prefs.js..browser.startup.homepage: "chrome://google-toolbar/content/new-tab.html"


FF - HKLM\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2011/02/07 12:08:22 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011/02/23 19:08:44 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/05/01 13:17:04 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/04/24 20:50:53 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011/05/07 09:31:49 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2011/04/24 20:50:53 | 000,000,000 | —D | M]

[2010/10/31 14:33:44 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Extensions
[2010/10/31 14:33:44 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011/05/22 15:15:19 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions
[2011/03/31 12:33:50 | 000,000,000 | —D | M] (Garmin Communicator) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2010/04/27 10:49:40 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/01/12 19:47:10 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2011/04/02 15:19:39 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/03/31 12:33:58 | 000,000,000 | —D | M] (ZoneAlarm Community Toolbar) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}
[2006/12/24 14:42:21 | 000,000,000 | —D | M] (fraudeliminator) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\{AEA25BF2-82A7-481c-9E0C-2639C802D17A}
[2009/02/08 22:38:59 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}
[2009/03/26 14:24:09 | 000,000,000 | —D | M] ("Ask Toolbar for Firefox") – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
[2010/12/11 21:52:30 | 000,000,000 | —D | M] (British English Dictionary) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\[removed]
[2010/08/25 23:20:52 | 000,000,000 | —D | M] (FireTorrent) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\[removed]
[2011/04/02 15:13:31 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\nostmp
[2010/06/11 18:32:42 | 000,001,745 | —- | M] () – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\searchplugins\ask.uk.xml
[2011/04/07 23:06:28 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/05/08 21:59:26 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/07/28 22:39:34 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/11/07 20:15:01 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/01/02 00:52:13 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/04/07 23:06:29 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
File not found (No name found) –
() (No name found) – C:\DOCUMENTS AND SETTINGS\NICHOLAS\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\S69WCYU0.DEFAULT\EXTENSIONS\{A7C6CF7F-112C-4500-A7EA-39801A327E5F}.XPI
[2011/02/23 19:08:44 | 000,000,000 | —D | M] (avast! WebRep) – C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST5\WEBREP\FF
[2010/05/08 21:58:59 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/05/01 13:16:56 | 000,142,296 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2005/06/01 23:26:00 | 000,077,824 | —- | M] () – C:\Program Files\Mozilla Firefox\components\FEMozMod.dll
[2011/02/02 21:40:24 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2007/12/14 19:47:20 | 000,024,673 | —- | M] (Check Point Software Technologies Ltd.) – C:\Program Files\Mozilla Firefox\plugins\NPZoneSB.dll
[2011/04/02 15:12:35 | 000,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2011/04/02 15:12:35 | 000,002,252 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2011/04/02 15:12:35 | 000,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2011/04/02 15:12:35 | 000,001,180 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2011/04/02 15:12:35 | 000,001,135 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2010/06/19 20:56:16 | 000,000,698 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar1.dll (Ask.com)
O2 - BHO: (ZoneAlarm Toolbar) - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZon1.dll (Conduit Ltd.)
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll ()
O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (ZoneAlarm Spy Blocker Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar1.dll (Ask.com)
O3 - HKLM\..\Toolbar: (ZoneAlarm Toolbar) - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZon1.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll ()
O3 - HKLM\..\Toolbar: (FraudEliminator) - {A5181F8A-0B9D-43AC-8BE5-EB61651DB685} - C:\Program Files\FraudEliminator\2.3.4\FETB.dll ()
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Spy Blocker Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar1.dll (Ask.com)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Toolbar) - {66F2E20D-0DA8-4C11-A9C8-DD8477B88ACD} - C:\Program Files\ZoneAlarm\tbZon1.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKCU\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe (Iomega Corporation)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Deskup] C:\Program Files\Iomega\DriveIcons\deskup.exe (Iomega)
O4 - HKLM..\Run: [EPSON Stylus C48 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I091.EXE (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [five Media Manager Tray] C:\Program Files\Entriq\MediaSphere\EntriqMediaTray.exe (Entriq, Inc.)
O4 - HKLM..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\Imgicon.exe (Iomega)
O4 - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [SpeedTouch USB Diagnostics] C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe (THOMSON Telecom Belgium)
O4 - HKLM..\Run: [VTTimer] C:\WINDOWS\System32\VTTimer.exe (S3 Graphics, Inc.)
O4 - HKLM..\Run: [VTTrayp] C:\WINDOWS\System32\VTTrayp.exe (S3 Graphics Co., Ltd.)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe (Kontiki Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: microsoft.com ([oas.support] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([oas.support] https in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([support] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([support] https in Trusted sites)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc2.cab (Office Update Installation Engine)
O16 - DPF: {46431044-1B22-4EF3-B333-863AAF310153} http://download.five.tv/Download/five_3_4_0_8.cab (five Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1231005245375 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CE7D2BF2-D173-4CE2-9DAF-15EA153B5B43} http://download.five.tv/Download/Entriq_3_4_0_10_Silent.cab (MediaControl Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} https://remote.britannia.co.uk/dana-cached/…perSetupSP1.cab (JuniperSetupSP1 Control)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/06/25 09:49:09 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/06/03 16:24:36 | 000,000,000 | —D | C] – C:\Documents and Settings\Nicholas\Desktop\erunt
[2011/05/18 10:13:38 | 000,404,640 | —- | C] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[1 C:\Documents and Settings\Nicholas\*.tmp files -> C:\Documents and Settings\Nicholas\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/05 21:19:26 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/06/05 21:17:05 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/06/02 22:45:08 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/05/19 21:47:32 | 000,000,049 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2011/05/18 10:13:38 | 000,404,640 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[1 C:\Documents and Settings\Nicholas\*.tmp files -> C:\Documents and Settings\Nicholas\*.tmp -> ]

========== Files Created - No Company Name ==========

[2009/12/26 21:09:18 | 000,000,050 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2009/12/26 02:19:36 | 000,048,316 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2009/04/19 20:29:42 | 000,005,248 | —- | C] () – C:\WINDOWS\System32\giveio.sys
[2008/09/06 15:22:03 | 000,126,976 | —- | C] () – C:\WINDOWS\System32\eappcfg.dll
[2008/05/26 21:59:42 | 000,018,904 | —- | C] () – C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 21:59:40 | 000,106,605 | —- | C] () – C:\WINDOWS\System32\structuredqueryschema.bin
[2007/09/27 10:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 10:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 10:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini
[2007/04/09 13:25:11 | 000,028,672 | —- | C] () – C:\Documents and Settings\Nicholas\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/06/23 19:34:13 | 000,796,584 | —- | C] () – C:\WINDOWS\System32\libeay32_0.9.6l.dll
[2006/03/04 19:51:23 | 000,000,049 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2006/02/15 13:34:49 | 000,096,249 | —- | C] () – C:\WINDOWS\System32\EPPICPrinterDB.dat
[2006/02/15 13:34:49 | 000,026,154 | —- | C] () – C:\WINDOWS\System32\EPPICPattern1.dat
[2006/02/15 13:34:49 | 000,024,903 | —- | C] () – C:\WINDOWS\System32\EPPICPattern3.dat
[2006/02/15 13:34:49 | 000,021,390 | —- | C] () – C:\WINDOWS\System32\EPPICPattern5.dat
[2006/02/15 13:34:49 | 000,020,148 | —- | C] () – C:\WINDOWS\System32\EPPICPattern2.dat
[2006/02/15 13:34:49 | 000,011,811 | —- | C] () – C:\WINDOWS\System32\EPPICPattern4.dat
[2006/02/15 13:34:49 | 000,004,943 | —- | C] () – C:\WINDOWS\System32\EPPICPattern6.dat
[2006/02/15 13:34:49 | 000,001,146 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_DU.dat
[2006/02/15 13:34:49 | 000,001,139 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_PT.dat
[2006/02/15 13:34:49 | 000,001,139 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_BP.dat
[2006/02/15 13:34:49 | 000,001,136 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_ES.dat
[2006/02/15 13:34:49 | 000,001,129 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_FR.dat
[2006/02/15 13:34:49 | 000,001,129 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_CF.dat
[2006/02/15 13:34:49 | 000,001,120 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_IT.dat
[2006/02/15 13:34:49 | 000,001,107 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_GE.dat
[2006/02/15 13:34:49 | 000,001,104 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_EN.dat
[2006/02/15 13:34:49 | 000,000,099 | —- | C] () – C:\WINDOWS\System32\PICSDK.ini
[2006/02/15 13:32:55 | 000,000,025 | —- | C] () – C:\WINDOWS\CDE C48EU.ini
[2005/12/25 16:05:21 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\Rtusd.dll
[2005/12/25 16:05:21 | 000,001,191 | —- | C] () – C:\WINDOWS\System32\RTUSD.INI
[2005/12/25 16:05:20 | 000,290,816 | —- | C] () – C:\WINDOWS\Carmctrl.dll
[2005/12/17 23:36:15 | 000,000,073 | —- | C] () – C:\WINDOWS\hdkctnts.ini
[2005/09/14 17:52:04 | 000,000,081 | —- | C] () – C:\WINDOWS\Q-PLUS.INI
[2005/07/11 14:46:35 | 000,004,212 | -H– | C] () – C:\WINDOWS\System32\zllictbl.dat
[2005/07/11 12:59:43 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2005/07/11 12:59:37 | 000,099,970 | —- | C] () – C:\WINDOWS\UninstallFirefox.exe
[2005/07/11 12:59:09 | 000,007,724 | —- | C] () – C:\WINDOWS\mozver.dat
[2005/06/25 19:24:28 | 000,000,000 | —- | C] () – C:\WINDOWS\WinInit.ini.backup
[2005/06/25 17:15:35 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2005/06/25 15:32:41 | 000,005,606 | R— | C] () – C:\WINDOWS\System32\stci.dll
[2005/06/25 10:38:50 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2005/06/25 10:37:40 | 000,263,824 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2005/06/25 10:13:38 | 000,000,356 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2005/06/25 09:57:39 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\cmirmdrv.dll
[2005/06/25 09:57:33 | 000,000,092 | —- | C] () – C:\WINDOWS\CMISETUP.INI
[2005/06/25 09:57:32 | 000,000,026 | —- | C] () – C:\WINDOWS\CMCDPLAY.INI
[2005/06/25 09:57:30 | 000,000,000 | —- | C] () – C:\WINDOWS\WinInit.ini
[2005/06/25 09:57:26 | 000,266,240 | —- | C] () – C:\WINDOWS\CMIUninstall.exe
[2005/06/25 09:57:26 | 000,225,280 | —- | C] () – C:\WINDOWS\CmiRmRedundDir.exe
[2005/06/25 09:57:26 | 000,028,672 | —- | C] () – C:\WINDOWS\CMIRmDriver.dll
[2005/06/25 09:56:47 | 000,003,541 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2005/06/25 09:56:46 | 000,005,824 | —- | C] () – C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2005/06/25 09:51:34 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2005/06/25 09:46:18 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/08/04 13:00:00 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2004/08/04 13:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 13:00:00 | 000,453,828 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/04 13:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 13:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 13:00:00 | 000,074,794 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/04 13:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 13:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 13:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 13:00:00 | 000,004,461 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/04 13:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2004/08/04 13:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat

========== LOP Check ==========

[2010/06/15 18:00:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/05/24 02:01:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2007/09/08 00:34:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Channel4
[2007/01/24 00:39:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Documents
[2008/08/03 14:48:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Entriq
[2010/06/11 18:04:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FileCure
[2010/04/03 08:56:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GARMIN
[2011/04/02 20:17:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Kontiki
[2007/09/21 21:41:47 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MailFrontier
[2006/02/15 13:36:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\UDL
[2009/03/13 00:19:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2010/04/09 01:26:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/09/10 16:03:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/10 00:56:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2010/06/05 22:42:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\Active Disk
[2010/07/02 18:34:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\CheckPoint
[2010/07/24 21:32:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2006/02/15 13:48:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\EPSON
[2010/04/03 03:15:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\GARMIN
[2010/07/04 22:32:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\Haihaisoft
[2010/07/04 22:32:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\Haihaisoft Universal Player
[2010/08/24 17:06:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\Juniper Networks
[2010/08/21 16:19:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\Opera
[2010/06/11 18:33:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\Radical Software Ltd
[2011/02/27 22:09:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\Spotify
[2010/10/31 14:33:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\Thunderbird
[2010/05/20 20:52:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\Uniblue
[2010/05/24 01:58:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\Windows Desktop Search
[2010/05/21 11:09:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\Windows Search

========== Purity Check ==========



< End of report >

OTL Extras logfile created on: 05/06/2011 21:37:47 - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\Nicholas\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

447.23 Mb Total Physical Memory | 221.06 Mb Available Physical Memory | 49.43% Memory free
1.03 Gb Paging File | 0.68 Gb Available in Paging File | 65.72% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 114.48 Gb Total Space | 83.71 Gb Free Space | 73.12% Space Free | Partition Type: NTFS

Computer Name: PERSONAL-E765D1 | User Name: Nicholas | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
https [open] – "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Kontiki\KService.exe" = C:\Program Files\Kontiki\KService.exe:*:Enabled:Delivery Manager Service – (Kontiki Inc.)
"C:\WINDOWS\system32\ZoneLabs\vsmon.exe" = C:\WINDOWS\system32\ZoneLabs\vsmon.exe:*:Enabled:vsmon – (Check Point Software Technologies LTD)
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser
"C:\Program Files\Spotify\spotify.exe" = C:\Program Files\Spotify\spotify.exe:*:Enabled:Spotify


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{06E6E30D-B498-442F-A943-07DE41D7F785}" = Microsoft Search Enhancement Pack
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200B415D-7CC6-4818-8624-9E43EDF19D9C}" = Garmin City Navigator Europe NT v9
"{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 24
"{27F650A9-6FAB-41C8-8621-92FF0118B0C4}" = EPSON Easy Photo Print
"{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}" = EPSON Scan Assistant
"{2B43252C-A1E3-4C47-927C-9F2C276D3515}" = S3GSetup
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{366FFC89-C800-4366-B903-B9C4314109A5}" = Garmin WebUpdater
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C859BBD-B524-4FD8-844D-B42D22671C00}" = Bridge Baron 15
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{779DECD7-E072-4B56-9B6B-BEB5973EEEB5}" = MobileMe Control Panel
"{7C5B4583-7CBF-4289-B195-03B553959DEA}" = VoiceOver Kit
"{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}" = EPSON Web-To-Page
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{853A4763-6643-4604-8D64-28BDD8925F4C}" = Apple Application Support
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B7443F5-E141-42A0-AB61-ED2331AAD606}" = 4oD
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90190409-6000-11D3-8CFE-0050048383C9}" = Microsoft Publisher 2002
"{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A040AC77-C1AA-4CC9-8931-9F648AF178F6}" = VC 9.0 Runtime
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A1FFCAB6-9950-48D4-9525-99295D3BAE37}" = FraudEliminator 2.3.4
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.4
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{AC76BA86-7AD7-5760-0000-900000000003}" = Japanese Fonts Support For Adobe Reader 9
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2E4B5BD-32DB-4817-A060-341AB17C3F90}" = Bonjour
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D22F5242-773E-4270-AB1F-492021BCABBE}" = Garmin City Navigator Europe NT 2010.31 Update
"{D41FAAA9-8048-4906-86B2-9AADEA1FA0B7}" = SpeedTouch USB Software
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E7C97E98-4C2D-BEAF-5D2F-CC45A2F95D90}" = Acrobat.com
"{E86BC406-944E-41F6-ADE6-2C136734C96B}" = EPSON File Manager
"{F59A9E08-A6A4-4ACF-91F2-D0344956C30B}" = iTunes
"4oD" = 4oD
"Active Disk" = Active Disk
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Applian FLV Player2.0.24" = Applian FLV Player
"Ask Toolbar_is1" = ZoneAlarm Spy Blocker Toolbar
"avast" = avast! Free Antivirus
"CAL" = Canon Camera Access Library
"CameraWindowDVC5" = Canon Camera Window DC_DV 5 for ZoomBrowser EX
"CameraWindowDVC6" = Canon Camera Window DC_DV 6 for ZoomBrowser EX
"CameraWindowMC" = Canon Camera Window MC 6 for ZoomBrowser EX
"Canon G.726 WMP-Decoder" = Canon G.726 WMP-Decoder
"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task
"Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX
"CCleaner" = CCleaner
"C-Media Audio" = C-Media 3D Audio
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Counting_at_Bridge" = Counting at Bridge
"CSCLIB" = Canon Camera Support Core Library
"Demand Five Player_is1" = Demand Five Player
"Entriq MediaSphere_is1" = Uninstall Entriq MediaSphere
"EOS Utility" = Canon Utilities EOS Utility
"EPSON Printer and Utilities" = EPSON Printer Software
"ESC48 User's Guide" = ESC48 User's Guide
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email
"Intel® 536EP Modem" = Intel® 536EP Modem
"IomegaWare" = IomegaWare 4.0.2
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"Mozilla Firefox 4.0.1 (x86 en-GB)" = Mozilla Firefox 4.0.1 (x86 en-GB)
"Mozilla Thunderbird (3.1.10)" = Mozilla Thunderbird (3.1.10)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Nero - Burning Rom!UninstallKey" = Nero OEM
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PhotoStitch" = Canon Utilities PhotoStitch
"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
"RealPlayer 6.0" = RealPlayer
"RemoteCaptureTask" = Canon RemoteCapture Task for ZoomBrowser EX
"Scan 1200c Driver" = Scan 1200c Driver
"ScoreBridge_is1" = ScoreBridge
"SSC Service Utility_is1" = SSC Service Utility v4.30
"VIA/S3G UniChrome Family Win2K/XP Display" = VIA/S3G Display Driver
"VTDisplay" = S3 S3Display
"VTGamma2" = S3 S3Gamma2
"VTInfo2" = S3 S3Info2
"VTOverlay" = S3 S3Overlay
"VTTrayPlus" = S3 S3TrayPlus
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Xerox DocuPrint C15-C11" = Xerox DocuPrint C15-C11
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Software Update" = Yahoo! Software Update
"YInstHelper" = Yahoo! Install Manager
"ZoneAlarm" = ZoneAlarm
"ZoneAlarm Toolbar" = ZoneAlarm Toolbar
"ZoneAlarmSB Uninstall" = ZoneAlarm Spy Blocker
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 19/04/2011 08:00:15 | Computer Name = PERSONAL-E765D1 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 10354765

Error - 27/04/2011 18:22:53 | Computer Name = PERSONAL-E765D1 | Source = Windows Search Service | ID = 3024
Description = The update cannot be started because the content sources cannot be
accessed. Fix the errors and try the update again. Context: Application, SystemIndex
Catalog

Error - 30/04/2011 14:17:55 | Computer Name = PERSONAL-E765D1 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 30/04/2011 14:17:55 | Computer Name = PERSONAL-E765D1 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2888875

Error - 30/04/2011 14:17:55 | Computer Name = PERSONAL-E765D1 | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 2888875

Error - 11/05/2011 18:17:10 | Computer Name = PERSONAL-E765D1 | Source = Windows Search Service | ID = 3024
Description = The update cannot be started because the content sources cannot be
accessed. Fix the errors and try the update again. Context: Application, SystemIndex
Catalog

Error - 18/05/2011 17:52:25 | Computer Name = PERSONAL-E765D1 | Source = Windows Search Service | ID = 3024
Description = The update cannot be started because the content sources cannot be
accessed. Fix the errors and try the update again. Context: Application, SystemIndex
Catalog

Error - 24/05/2011 05:27:28 | Computer Name = PERSONAL-E765D1 | Source = Windows Search Service | ID = 3024
Description = The update cannot be started because the content sources cannot be
accessed. Fix the errors and try the update again. Context: Application, SystemIndex
Catalog

Error - 31/05/2011 11:51:10 | Computer Name = PERSONAL-E765D1 | Source = Application Hang | ID = 1002
Description = Hanging application SpybotSD.exe, version 1.6.2.46, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 03/06/2011 15:26:30 | Computer Name = PERSONAL-E765D1 | Source = Application Hang | ID = 1002
Description = Hanging application stdialup.exe, version 301.0.0.12, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 05/06/2011 16:39:44 | Computer Name = PERSONAL-E765D1 | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 05/06/2011 16:39:44 | Computer Name = PERSONAL-E765D1 | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 05/06/2011 16:39:45 | Computer Name = PERSONAL-E765D1 | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 05/06/2011 16:39:48 | Computer Name = PERSONAL-E765D1 | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 05/06/2011 16:41:50 | Computer Name = PERSONAL-E765D1 | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 05/06/2011 16:41:51 | Computer Name = PERSONAL-E765D1 | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 05/06/2011 16:41:52 | Computer Name = PERSONAL-E765D1 | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 05/06/2011 16:41:54 | Computer Name = PERSONAL-E765D1 | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 05/06/2011 16:41:56 | Computer Name = PERSONAL-E765D1 | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 05/06/2011 16:41:58 | Computer Name = PERSONAL-E765D1 | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.


< End of report >

aswMBR version 0.9.5.256 Copyright© 2011 AVAST Software
Run date: 2011-06-05 21:49:36
—————————–
21:49:36.288 OS Version: Windows 5.1.2600 Service Pack 3
21:49:36.288 Number of processors: 1 586 0xC00
21:49:36.288 ComputerName: PERSONAL-E765D1 UserName: Nicholas
21:49:37.054 Initialize success
21:49:51.585 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
21:49:51.600 Disk 0 Vendor: Maxtor_6Y120L0 YAR41BW0 Size: 117246MB BusType: 3
21:49:51.616 Disk 1 \Device\Harddisk1\DR2 -> \Device\Parallel0.5
21:49:51.616 Disk 1 Vendor: IOMEGA__ D.06 Size: 117246MB BusType: 1
21:49:53.632 Disk 0 MBR read successfully
21:49:53.632 Disk 0 MBR scan
21:49:53.632 Disk 0 Windows XP default MBR code
21:49:55.632 Disk 0 scanning sectors +240091425
21:49:55.663 Disk 0 scanning C:\WINDOWS\system32\drivers
21:50:02.647 Service scanning
21:50:03.694 Disk 0 trace - called modules:
21:50:03.694 ntkrnlpa.exe CLASSPNP.SYS disk.sys iomdisk.sys hal.dll ACPI.sys atapi.sys viaide.sys PCIIDEX.SYS
21:50:03.710 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8453fab8]
21:50:03.710 3 CLASSPNP.SYS[f75f6fd7] -> nt!IofCallDriver -> [0x8453f020]
21:50:03.725 5 iomdisk.sys[f7617da4] -> nt!IofCallDriver -> \Device\00000064[0x84542f18]
21:50:03.725 7 ACPI.sys[f748d620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x84592218]
21:50:03.725 Scan finished successfully
21:50:35.210 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Nicholas\Desktop\MBR.dat"
21:50:35.225 The log file has been saved successfully to "C:\Documents and Settings\Nicholas\Desktop\aswMBR.txt"
Post #5
Hello fixer-man_nick, Thank you for the logs.

Download and Run ComboFix
  • Please download ComboFix from one of the following links.

    Link 1.

    Link 2.

    **IMPORTANT !!! Save ComboFix.exe to your Desktop**
  • Please disable any Antivirus or Firewall you have active, as shown in this topic. Please close all open application windows.
  • Double click on ComboFix.exe & follow the prompts
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console
[external image: Posted Image]
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
  • When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply
A word of warning: Neither I nor sUBs are responsible for any damage you may cause to your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper
=============================
Please include in your next reply:
1. Any problem executing the instructions?
2. ComboFix log
3. How is the computer behaving?
Post #6
Hi

Everything went fine, the ComboFix log is pasted below. The computer has worked OK today.

ComboFix 11-06-06.02 - Nicholas 07/06/2011 0:46.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.447.218 [GMT 1:00]
Running from: c:\documents and settings\[removed]\My Documents\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Firewall *Disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Nicholas\WINDOWS
.
.
((((((((((((((((((((((((( Files Created from 2011-05-07 to 2011-06-07 )))))))))))))))))))))))))))))))
.
.
2011-05-18 09:13 . 2011-05-18 09:13 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-06 15:20 . 2011-04-06 15:20 91424 —-a-w- c:\windows\system32\dnssd.dll
2011-04-06 15:20 . 2011-04-06 15:20 107808 —-a-w- c:\windows\system32\dns-sd.exe
2011-05-01 12:16 . 2011-04-02 14:12 142296 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2005-06-01 22:26 . 2005-07-12 22:38 77824 —-a-w- c:\program files\mozilla firefox\components\FEMozMod.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}"= "c:\program files\ZoneAlarm\tbZon1.dll" [2010-08-21 2734688]
.
[HKEY_CLASSES_ROOT\clsid\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-10-16 18:22 333192 —-a-w- c:\program files\AskBarDis\bar\bin\askBar1.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]
2010-08-21 12:21 2734688 —-a-w- c:\program files\ZoneAlarm\tbZon1.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar1.dll" [2008-10-16 333192]
"{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}"= "c:\program files\ZoneAlarm\tbZon1.dll" [2010-08-21 2734688]
.
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
.
[HKEY_CLASSES_ROOT\clsid\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar1.dll" [2008-10-16 333192]
"{66F2E20D-0DA8-4C11-A9C8-DD8477B88ACD}"= "c:\program files\ZoneAlarm\tbZon1.dll" [2010-08-21 2734688]
.
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
.
[HKEY_CLASSES_ROOT\clsid\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-02-23 15:04 122512 —-a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"kdx"="c:\program files\Kontiki\KHost.exe" [2007-04-23 1032640]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" [2004-10-22 53248]
"VTTrayp"="VTtrayp.exe" [2004-10-11 143360]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SpeedTouch USB Diagnostics"="c:\program files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 866816]
"ADUserMon"="c:\program files\Iomega\AutoDisk\ADUserMon.exe" [2002-09-24 147456]
"EPSON Stylus C48 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I091.EXE" [2005-05-16 99840]
"Iomega Drive Icons"="c:\program files\Iomega\DriveIcons\ImgIcon.exe" [2002-08-13 86016]
"Deskup"="c:\program files\Iomega\DriveIcons\deskup.exe" [2002-07-16 32768]
"five Media Manager Tray"="c:\program files\Entriq\MediaSphere\EntriqMediaTray.exe" [2008-05-21 368640]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2011-02-23 3451496]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2010-06-23 1043968]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2010-05-26 730600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-27 421160]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Kontiki\\KService.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [23/02/2011 19:08 371544]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [15/06/2010 18:01 301528]
R2 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [01/02/2009 15:15 464264]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [15/06/2010 18:01 19544]
R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [26/05/2010 14:35 26352]
R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [26/05/2010 14:35 493032]
S3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [04/08/2004 13:00 14336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
Trusted Zone: microsoft.com\oas.support
Trusted Zone: microsoft.com\support
TCP: Interfaces\{8FE3B2EA-AECF-4482-AA57-E8A584CFACA4}: NameServer = 212.139.132.10 212.139.132.11
DPF: {46431044-1B22-4EF3-B333-863AAF310153} - hxxp://download.five.tv/Download/five_3_4_0_8.cab
FF - ProfilePath - c:\documents and settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: browser.startup.homepage - chrome://google-toolbar/content/new-tab.html

.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-07 01:11
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: Maxtor_6Y120L0 rev.YAR41BW0 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys iomdisk.sys hal.dll ACPI.sys atapi.sys viaide.sys PCIIDEX.SYS
c:\docume~1\Nicholas\LOCALS~1\Temp\catchme.sys
c:\windows\system32\drivers\iomdisk.sys Iomega Corporation Iomega Disk Filter Driver
1 ntkrnlpa!IofCallDriver[0x804EE130] -> \Device\Harddisk0\DR0[0x8453FAB8]
3 CLASSPNP[0xF75F6FD7] -> ntkrnlpa!IofCallDriver[0x804EE130] -> [0x8453F020]
5 iomdisk[0xF7617DA4] -> ntkrnlpa!IofCallDriver[0x804EE130] -> \Device\00000064[0x84542F18]
7 ACPI[0xF748D620] -> ntkrnlpa!IofCallDriver[0x804EE130] -> \Device\Ide\IdeDeviceP0T0L0-3[0x84592218]
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
\Device\Parallel0.5 -> \??\LPTENUM#IMGVP0#5&1cf8cf45&0&LPT1.5#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
user & kernel MBR OK
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Iomega Activity Disk2]
"ImagePath"="\"\""
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(744)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
- - - - - - - > 'lsass.exe'(800)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
- - - - - - - > 'explorer.exe'(3664)
c:\windows\system32\WININET.dll
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_179798c8\MSVCR80.dll
c:\program files\Iomega\DriveIcons\IMGHOOK.DLL
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-06-07 01:19:46
ComboFix-quarantined-files.txt 2011-06-07 00:19
.
Pre-Run: 89,494,245,376 bytes free
Post-Run: 89,595,502,592 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 6B34CEC245AD84C2F9510CBD0E3599AC
Post #7
Hello fixer-man_nick,

Everything looks good so far :thumbup: Just have a few more scans for you to run.

Please download Malwarebytes from Here or Here

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Post the report please
===================
NEXT

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


Go here to run an online scannner from
ESET

(Note: You can use Internet Explorer or FireFox for this scan. If you use FireFox you will be asked to install an additional component. Please allow this.)

  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
  • Click Start
  • Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
  • Click Scan.
  • Wait for the scan to finish.
  • Re-enable your Antivirus software.
  • A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. or C:\Program Files\ESET\log.txt We will need this later.
Please post back with the ESET log.

===================
Please include in your next reply:
1. Any problem executing the instructions?
2. Malwarebytes log
3. ESET log
4. How is the computer behaving?
Post #8
Hi, Instructions fine, 2 x logs pasted below, had trouble with internet connection but a reboot solved that, otherwise OK. Malwarebytes' Anti-Malware 1.51.0.1200 www.malwarebytes.org Database version: 6796 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 07/06/2011 15:42:10 mbam-log-2011-06-07 (15-42-10).txt Scan type: Quick scan Objects scanned: 161420 Time elapsed: 5 minute(s), 54 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6427 # api_version=3.0.2 # EOSSerial=1ba6187a2024aa479ce113ec67f99f29 # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-06-08 01:09:49 # local_time=2011-06-08 02:09:49 (+0000, GMT Daylight Time) # country="United Kingdom" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=512 16777215 100 0 0 0 0 0 # compatibility_mode=768 16777215 100 0 32823223 32823223 0 0 # compatibility_mode=1024 16777215 100 0 49697965 49697965 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # compatibility_mode=9217 16777214 100 70 29392510 30193832 0 0 # scanned=77628 # found=3 # cleaned=0 # scan_time=5627 C:\Program Files\Mozilla Firefox\plugins\NPZoneSB.dll Win32/Toolbar.MyWebSearch application (unable to clean) 00000000000000000000000000000000 I C:\Program Files\ZoneAlarmSB\bar\1.bin\NPZONESB.DLL Win32/Toolbar.MyWebSearch application (unable to clean) 00000000000000000000000000000000 I C:\Program Files\ZoneAlarmSB\bar\1.bin\Z4PLUGIN.DLL a variant of Win32/Toolbar.MyWebSearch application (unable to clean) 00000000000000000000000000000000 I
Post #9
Hello fixer-man_nick,

Have you had any problems with your D:\ drive? the reason I ask is because you have a lot of errors showing (The device, \Device\Harddisk0\D, has a bad block.) Which could mean your D:\ is failing. The other errors we can try and fix with chkdsk.

Run chkdsk
  • Close any open windows.
  • Go to the Start Menu, type in cmd.exe
  • Right click on cmd.exe, and click Run as Administrator
  • In the command window that appears, type chkdsk /r, and press enter
  • Agree to any prompts - then reboot the computer.
  • chkdsk should run as you boot the machine up - this will check the harddrive for damaged sectors and attempt to repair them.
=======================
Please include in your next reply:
1. Any problem executing the instructions?
2. Please let me know how the chkdsk went.
3. How is the computer behaving?
Post #10
Hello fixer-man_nick
  • Please scan the following files


  • Please go to VirusTotal
  • On the page you'll find a "Browse" button.
  • Click on the Browse button.
  • In the Choose File to Upload window which opens, copy and paste this into the File Name box.


C:\Program Files\Mozilla Firefox\plugins\NPZoneSB.dll
C:\Program Files\ZoneAlarmSB\bar\1.bin\NPZONESB.DLL
C:\Program Files\ZoneAlarmSB\bar\1.bin\Z4PLUGIN.DLL



  • Next, click the Open button.
  • Then click the "Send File" button just below.
  • This will scan the file. Please be patient.
  • If you get a message saying File has already been analyzed: click Reanalyze file now.
  • Once scanned, copy and paste the link to the results page in your next reply.
==================
Please include in your next reply:
1. Any problem executing the instructions?
2. virustotal results
Post #11
Hi, I ran chkdsk and it was all OK. (D:\ is my DVD drive not a harddrive if that makes a difference). Results for C:\Program Files\Mozilla Firefox\plugins\NPZoneSB.dll are at: www.virustotal.com/file-scan/report.html?id=f23f1e21cc078af2b567af71e178a6efc1a784f036a41f94f5a1e335e88eeec9-1307581227 Results for C:\Program Files\ZoneAlarmSB\bar\1.bin\NPZONESB.DLL are at www.virustotal.com/file-scan/report.html?id=f23f1e21cc078af2b567af71e178a6efc1a784f036a41f94f5a1e335e88eeec9-1307581556 Results for C:\Program Files\ZoneAlarmSB\bar\1.bin\Z4PLUGIN.DLL are at www.virustotal.com/file-scan/report.html?id=4f53751b41d8f1f11dfb63a595c74288a689eab2f5140f484262d90a5dc02b83-1307581716 The computer has refused to shut down properly again but that is the only problem I am aware of. Nick.
Post #12
Hello fixer-man_nick, Almost done. :thumbup:

Zonealarm decided to include a "ZoneAlarm Spy Blocker toolbar" as well which is an optional during install.

However, this Toolbar now uses the AskJeeves/Ask.com searchengine.

[external image: Posted Image]

Ask Toolbar
Remove AskToolbar also via Add Remove Programs

  • It promotes its toolbars on sites targeted at kids.
  • It promotes its toolbars through ads that appear to be part of other companies' sites.
  • It promotes its toolbars through other companies' spyware.
  • It is Installed without any disclosure whatsoever and without any consent from the user whatsoever.
  • It solicits installations via "deceptive door openers" that do not accurately describe the offer; failing to affirmatively show a license agreement; linking to a EULA via an off-screen link.
  • It makes confusing changes to user's browsers - increasing Ask's revenues while taking users to pages they didn't intend to visit.

===============================
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Please download JavaRa to your desktop and unzip it to its own
folder
  • Run JavaRa.exe (double-click for XP/right-click and Run as Administrator for Vista), pick the language of your choice and click Select. Then
    click Remove Older Versions.
  • Accept any prompts.
  • Open JavaRa.exe (double-click for XP/right-click and Run as Administrator for Vista) again and select Search For Updates.
  • Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest
    Java Runtime Environment (JRE) version for your computer.
=============================

Update Adobe

Visit ADOBE and download the latest version of Acrobat Reader (version X)
Having the latest updates ensures there are no security vulnerabilities in your system.
=============================
Please Rerun OTL one more time and post the log in your next reply.

Please include in your next reply:
1. Any problem executing the instructions?
2. OTL log
3. How is the computer behaving?
Post #13
Hi,

I have a slight problem carrying out your last instructions. I removed the older versions of Java but was unable to install the latest version. It seems to be a problem Java is aware of at their end rather than with my computer. I will keep trying to install it. Everything else went OK.

The OTL log is below, there does not seem to be an extras log, is this correct?

The computer is running fine at the moment.

OTL logfile created on: 11/06/2011 12:41:55 - Run 2
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\Nicholas\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

447.23 Mb Total Physical Memory | 188.77 Mb Available Physical Memory | 42.21% Memory free
1.03 Gb Paging File | 0.68 Gb Available in Paging File | 66.28% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 114.48 Gb Total Space | 82.06 Gb Free Space | 71.68% Space Free | Partition Type: NTFS

Computer Name: PERSONAL-E765D1 | User Name: Nicholas | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Nicholas\My Documents\Downloads\OTL(1).exe (OldTimer Tools)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe (Check Point Software Technologies)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\Program Files\Entriq\MediaSphere\EntriqMediaTray.exe (Entriq, Inc.)
PRC - C:\Program Files\Entriq\MediaSphere\3.8.2.9\EntriqMediaServer.exe (Entriq, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_S4I091.EXE (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Iomega\System32\AppServices.exe (Iomega Corporation)
PRC - C:\WINDOWS\system32\VTTimer.exe (S3 Graphics, Inc.)
PRC - C:\WINDOWS\system32\VTTrayp.exe (S3 Graphics Co., Ltd.)
PRC - C:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe (THOMSON Telecom Belgium)
PRC - C:\Program Files\Iomega\AutoDisk\ADService.exe (Iomega Corporation)
PRC - C:\Program Files\Iomega\AutoDisk\ADUserMon.exe (Iomega Corporation)
PRC - C:\Program Files\Iomega\DriveIcons\Imgicon.exe (Iomega)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Nicholas\My Documents\Downloads\OTL(1).exe (OldTimer Tools)
MOD - C:\Program Files\Alwil Software\Avast5\snxhk.dll (AVAST Software)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_179798c8\msvcr80.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_179798c8\msvcp80.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (Check Point Software Technologies)
MOD - C:\Program Files\Iomega\DriveIcons\Imghook.dll (Iomega Corporation)


========== Win32 Services (SafeList) ==========

SRV - (Iomega Activity Disk2) – File not found
SRV - (HidServ) – File not found
SRV - (CarboniteService) – File not found
SRV - (AppMgmt) – File not found
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (nosGetPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper_3004.dll (NOS Microsystems Ltd.)
SRV - (vsmon) – C:\WINDOWS\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
SRV - (IswSvc) – C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe (Check Point Software Technologies)
SRV - (getPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (KService) – C:\Program Files\Kontiki\KService.exe (Kontiki Inc.)
SRV - (CCALib8) – C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
SRV - (Iomega App Services) – C:\Program Files\Iomega\System32\AppServices.exe (Iomega Corporation)
SRV - (_IOMEGA_ACTIVE_DISK_SERVICE_) – C:\Program Files\Iomega\AutoDisk\ADService.exe (Iomega Corporation)


========== Driver Services (SafeList) ==========

DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (ISWKL) – C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys (Check Point Software Technologies)
DRV - (vsdatant) – C:\WINDOWS\system32\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (giveio) – C:\WINDOWS\system32\giveio.sys ()
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (ppa3) – C:\WINDOWS\system32\DRIVERS\ppa3.sys (Microsoft Corporation)
DRV - (AmdPPM) – C:\WINDOWS\system32\drivers\AmdPPM.sys (Advanced Micro Devices)
DRV - (Intels51) Intel® – C:\WINDOWS\system32\drivers\IntelS51.sys (Intel Corporation)
DRV - (iomdisk) – C:\WINDOWS\System32\DRIVERS\iomdisk.sys (Iomega Corporation)
DRV - (alcaudsl) – C:\WINDOWS\system32\drivers\alcaudsl.sys (THOMSON)
DRV - (alcan5wn) SpeedTouch USB ADSL PPP Networking Driver (NDISWAN) – C:\WINDOWS\system32\drivers\alcan5wn.sys (THOMSON)
DRV - (ms_mpu401) – C:\WINDOWS\system32\drivers\msmpu401.sys (Microsoft Corporation)
DRV - (irsir) – C:\WINDOWS\system32\drivers\irsir.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.google.co.uk/
IE - HKCU\..\URLSearchHook: {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZon1.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Ask"
FF - prefs.js..browser.startup.homepage: "chrome://google-toolbar/content/new-tab.html"
FF - prefs.js..keyword.URL: "http://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q="


FF - HKLM\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2011/02/07 12:08:22 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011/02/23 19:08:44 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/05/01 13:17:04 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/06/10 01:07:21 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011/05/07 09:31:49 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2011/06/10 01:07:21 | 000,000,000 | —D | M]

[2010/10/31 14:33:44 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Extensions
[2010/10/31 14:33:44 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011/06/10 01:12:55 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions
[2011/03/31 12:33:50 | 000,000,000 | —D | M] (Garmin Communicator) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2010/04/27 10:49:40 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/01/12 19:47:10 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2011/04/02 15:19:39 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/03/31 12:33:58 | 000,000,000 | —D | M] (ZoneAlarm Community Toolbar) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}
[2006/12/24 14:42:21 | 000,000,000 | —D | M] (fraudeliminator) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\{AEA25BF2-82A7-481c-9E0C-2639C802D17A}
[2009/02/08 22:38:59 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}
[2010/12/11 21:52:30 | 000,000,000 | —D | M] (British English Dictionary) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\[removed]
[2010/08/25 23:20:52 | 000,000,000 | —D | M] (FireTorrent) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\[removed]
[2011/04/02 15:13:31 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\nostmp
[2010/06/11 18:32:42 | 000,001,745 | —- | M] () – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\searchplugins\ask.uk.xml
[2011/04/07 23:06:28 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/05/08 21:59:26 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/07/28 22:39:34 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/11/07 20:15:01 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/01/02 00:52:13 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/04/07 23:06:29 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
File not found (No name found) –
() (No name found) – C:\DOCUMENTS AND SETTINGS\NICHOLAS\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\S69WCYU0.DEFAULT\EXTENSIONS\{A7C6CF7F-112C-4500-A7EA-39801A327E5F}.XPI
[2011/02/23 19:08:44 | 000,000,000 | —D | M] (avast! WebRep) – C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST5\WEBREP\FF
[2010/05/08 21:58:59 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/05/01 13:16:56 | 000,142,296 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2005/06/01 23:26:00 | 000,077,824 | —- | M] () – C:\Program Files\Mozilla Firefox\components\FEMozMod.dll
[2011/02/02 21:40:24 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2007/12/14 19:47:20 | 000,024,673 | —- | M] (Check Point Software Technologies Ltd.) – C:\Program Files\Mozilla Firefox\plugins\NPZoneSB.dll
[2011/04/02 15:12:35 | 000,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2011/04/02 15:12:35 | 000,002,252 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2011/04/02 15:12:35 | 000,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2011/04/02 15:12:35 | 000,001,180 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2011/04/02 15:12:35 | 000,001,135 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2010/06/19 20:56:16 | 000,000,698 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (ZoneAlarm Toolbar) - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZon1.dll (Conduit Ltd.)
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll ()
O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (ZoneAlarm Toolbar) - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZon1.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll ()
O3 - HKLM\..\Toolbar: (FraudEliminator) - {A5181F8A-0B9D-43AC-8BE5-EB61651DB685} - C:\Program Files\FraudEliminator\2.3.4\FETB.dll ()
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Toolbar) - {66F2E20D-0DA8-4C11-A9C8-DD8477B88ACD} - C:\Program Files\ZoneAlarm\tbZon1.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKCU\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe (Iomega Corporation)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Deskup] C:\Program Files\Iomega\DriveIcons\deskup.exe (Iomega)
O4 - HKLM..\Run: [EPSON Stylus C48 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I091.EXE (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [five Media Manager Tray] C:\Program Files\Entriq\MediaSphere\EntriqMediaTray.exe (Entriq, Inc.)
O4 - HKLM..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\Imgicon.exe (Iomega)
O4 - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [SpeedTouch USB Diagnostics] C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe (THOMSON Telecom Belgium)
O4 - HKLM..\Run: [VTTimer] C:\WINDOWS\System32\VTTimer.exe (S3 Graphics, Inc.)
O4 - HKLM..\Run: [VTTrayp] C:\WINDOWS\System32\VTTrayp.exe (S3 Graphics Co., Ltd.)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe (Kontiki Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: microsoft.com ([oas.support] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([oas.support] https in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([support] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([support] https in Trusted sites)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc2.cab (Office Update Installation Engine)
O16 - DPF: {46431044-1B22-4EF3-B333-863AAF310153} http://download.five.tv/Download/five_3_4_0_8.cab (five Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1231005245375 (MUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos-beta/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CE7D2BF2-D173-4CE2-9DAF-15EA153B5B43} http://download.five.tv/Download/Entriq_3_4_0_10_Silent.cab (MediaControl Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} https://remote.britannia.co.uk/dana-cached/…perSetupSP1.cab (JuniperSetupSP1 Control)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/06/25 09:49:09 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/06/10 00:16:56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2011/06/08 23:34:34 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET
[2011/06/08 00:27:54 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/06/07 15:34:23 | 000,039,984 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/06/07 15:34:23 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/06/07 15:34:16 | 000,022,712 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/06/07 01:19:57 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/06/07 00:44:11 | 000,000,000 | RHSD | C] – C:\cmdcons
[2011/06/07 00:40:32 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/06/07 00:40:32 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/06/07 00:40:32 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/06/07 00:40:32 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/06/07 00:39:57 | 000,000,000 | —D | C] – C:\Qoobox
[2011/06/03 16:24:36 | 000,000,000 | —D | C] – C:\Documents and Settings\Nicholas\Desktop\erunt
[2011/05/18 10:13:38 | 000,404,640 | —- | C] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[1 C:\Documents and Settings\Nicholas\*.tmp files -> C:\Documents and Settings\Nicholas\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/11 11:52:11 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/06/11 11:50:02 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/06/10 00:16:57 | 000,001,542 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/06/09 22:45:07 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/06/09 21:02:57 | 000,493,938 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/06/09 21:02:57 | 000,083,042 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/06/09 00:55:37 | 000,404,640 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/06/07 15:34:23 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/07 00:44:19 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2011/05/29 09:11:30 | 000,039,984 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/29 09:11:20 | 000,022,712 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/05/19 21:47:32 | 000,000,049 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[1 C:\Documents and Settings\Nicholas\*.tmp files -> C:\Documents and Settings\Nicholas\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/10 01:07:22 | 000,001,804 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk
[2011/06/10 00:16:57 | 000,001,542 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/06/09 00:07:47 | 000,255,702 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2011/06/07 15:34:23 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/07 00:40:32 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/06/07 00:40:32 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/06/07 00:40:32 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/06/07 00:40:32 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/06/07 00:40:32 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2009/12/26 21:09:18 | 000,000,050 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2009/12/26 02:19:36 | 000,048,316 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2009/04/19 20:29:42 | 000,005,248 | —- | C] () – C:\WINDOWS\System32\giveio.sys
[2008/09/06 15:22:03 | 000,126,976 | —- | C] () – C:\WINDOWS\System32\eappcfg.dll
[2008/05/26 21:59:42 | 000,018,904 | —- | C] () – C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 21:59:40 | 000,106,605 | —- | C] () – C:\WINDOWS\System32\structuredqueryschema.bin
[2007/09/27 10:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 10:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 10:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini
[2007/04/09 13:25:11 | 000,028,672 | —- | C] () – C:\Documents and Settings\Nicholas\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/06/23 19:34:13 | 000,796,584 | —- | C] () – C:\WINDOWS\System32\libeay32_0.9.6l.dll
[2006/03/04 19:51:23 | 000,000,049 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2006/02/15 13:34:49 | 000,096,249 | —- | C] () – C:\WINDOWS\System32\EPPICPrinterDB.dat
[2006/02/15 13:34:49 | 000,026,154 | —- | C] () – C:\WINDOWS\System32\EPPICPattern1.dat
[2006/02/15 13:34:49 | 000,024,903 | —- | C] () – C:\WINDOWS\System32\EPPICPattern3.dat
[2006/02/15 13:34:49 | 000,021,390 | —- | C] () – C:\WINDOWS\System32\EPPICPattern5.dat
[2006/02/15 13:34:49 | 000,020,148 | —- | C] () – C:\WINDOWS\System32\EPPICPattern2.dat
[2006/02/15 13:34:49 | 000,011,811 | —- | C] () – C:\WINDOWS\System32\EPPICPattern4.dat
[2006/02/15 13:34:49 | 000,004,943 | —- | C] () – C:\WINDOWS\System32\EPPICPattern6.dat
[2006/02/15 13:34:49 | 000,001,146 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_DU.dat
[2006/02/15 13:34:49 | 000,001,139 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_PT.dat
[2006/02/15 13:34:49 | 000,001,139 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_BP.dat
[2006/02/15 13:34:49 | 000,001,136 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_ES.dat
[2006/02/15 13:34:49 | 000,001,129 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_FR.dat
[2006/02/15 13:34:49 | 000,001,129 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_CF.dat
[2006/02/15 13:34:49 | 000,001,120 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_IT.dat
[2006/02/15 13:34:49 | 000,001,107 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_GE.dat
[2006/02/15 13:34:49 | 000,001,104 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_EN.dat
[2006/02/15 13:34:49 | 000,000,099 | —- | C] () – C:\WINDOWS\System32\PICSDK.ini
[2006/02/15 13:32:55 | 000,000,025 | —- | C] () – C:\WINDOWS\CDE C48EU.ini
[2005/12/25 16:05:21 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\Rtusd.dll
[2005/12/25 16:05:21 | 000,001,191 | —- | C] () – C:\WINDOWS\System32\RTUSD.INI
[2005/12/25 16:05:20 | 000,290,816 | —- | C] () – C:\WINDOWS\Carmctrl.dll
[2005/12/17 23:36:15 | 000,000,073 | —- | C] () – C:\WINDOWS\hdkctnts.ini
[2005/09/14 17:52:04 | 000,000,081 | —- | C] () – C:\WINDOWS\Q-PLUS.INI
[2005/07/11 14:46:35 | 000,004,212 | -H– | C] () – C:\WINDOWS\System32\zllictbl.dat
[2005/07/11 12:59:43 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2005/07/11 12:59:37 | 000,099,970 | —- | C] () – C:\WINDOWS\UninstallFirefox.exe
[2005/07/11 12:59:09 | 000,007,724 | —- | C] () – C:\WINDOWS\mozver.dat
[2005/06/25 19:24:28 | 000,000,000 | —- | C] () – C:\WINDOWS\WinInit.ini.backup
[2005/06/25 17:15:35 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2005/06/25 15:32:41 | 000,005,606 | R— | C] () – C:\WINDOWS\System32\stci.dll
[2005/06/25 10:38:50 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2005/06/25 10:37:40 | 000,263,824 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2005/06/25 10:13:38 | 000,000,356 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2005/06/25 09:57:39 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\cmirmdrv.dll
[2005/06/25 09:57:33 | 000,000,092 | —- | C] () – C:\WINDOWS\CMISETUP.INI
[2005/06/25 09:57:32 | 000,000,026 | —- | C] () – C:\WINDOWS\CMCDPLAY.INI
[2005/06/25 09:57:30 | 000,000,000 | —- | C] () – C:\WINDOWS\WinInit.ini
[2005/06/25 09:57:26 | 000,266,240 | —- | C] () – C:\WINDOWS\CMIUninstall.exe
[2005/06/25 09:57:26 | 000,225,280 | —- | C] () – C:\WINDOWS\CmiRmRedundDir.exe
[2005/06/25 09:57:26 | 000,028,672 | —- | C] () – C:\WINDOWS\CMIRmDriver.dll
[2005/06/25 09:56:47 | 000,003,541 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2005/06/25 09:56:46 | 000,005,824 | —- | C] () – C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2005/06/25 09:51:34 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2005/06/25 09:46:18 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/08/04 13:00:00 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2004/08/04 13:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 13:00:00 | 000,493,938 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/04 13:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 13:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 13:00:00 | 000,083,042 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/04 13:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 13:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 13:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 13:00:00 | 000,004,461 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/04 13:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2004/08/04 13:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat

========== LOP Check ==========

[2010/06/15 18:00:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/05/24 02:01:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2007/09/08 00:34:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Channel4
[2007/01/24 00:39:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Documents
[2008/08/03 14:48:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Entriq
[2010/06/11 18:04:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FileCure
[2010/04/03 08:56:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GARMIN
[2011/04/02 20:17:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Kontiki
[2007/09/21 21:41:47 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MailFrontier
[2006/02/15 13:36:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\UDL
[2009/03/13 00:19:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2010/04/09 01:26:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/09/10 16:03:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/10 00:56:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2010/06/05 22:42:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\Active Disk
[2010/07/02 18:34:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\CheckPoint
[2010/07/24 21:32:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2006/02/15 13:48:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\EPSON
[2010/04/03 03:15:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\GARMIN
[2010/07/04 22:32:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\Haihaisoft
[2010/07/04 22:32:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\Haihaisoft Universal Player
[2010/08/24 17:06:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\Juniper Networks
[2010/08/21 16:19:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\Opera
[2010/06/11 18:33:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\Radical Software Ltd
[2011/02/27 22:09:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\Spotify
[2010/10/31 14:33:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\Thunderbird
[2010/05/20 20:52:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\Uniblue
[2010/05/24 01:58:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\Windows Desktop Search
[2010/05/21 11:09:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Nicholas\Application Data\Windows Search

========== Purity Check ==========



< End of report >
Post #14
Hello fixer-man_nick,

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :OTL
[2010/05/08 21:59:26 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/07/28 22:39:34 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/11/07 20:15:01 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/01/02 00:52:13 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2007/04/09 13:25:11 | 000,028,672 | —- | C] () – C:\Documents and Settings\Nicholas\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

:Commands
[createrestorepoint]
[purity]
[emptytemp]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
===========================
Let's try to get Java uninstalled completely and install the newest version.
  • If you are able, uninstall all previous versions of Java in add/remove programs in your control panel.
  • Next, you may download the current version of Java here: http://java.com/en/download/manual.jsp
    (I recommend that you use the offline installer version.)
  • Please download and run this automated tool to fix the Java MSI problem on all versions of windows: JavaMSIFix
  • Now you may install the version of Java that you had downloaded in the previous steps.

===========================
Please include in your next reply:
1. Any problem executing the instructions?
2. OTL log
3. Were you able to install Java
Post #15
Hi,

The instructions were fine and the OTL log is below. Once I had managed to remove all traces of the old Java using Revo uninstaller the new version installed first time.

OTL logfile created on: 12/06/2011 21:26:39 - Run 4
OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\Nicholas\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

447.23 Mb Total Physical Memory | 247.55 Mb Available Physical Memory | 55.35% Memory free
1.03 Gb Paging File | 0.69 Gb Available in Paging File | 66.92% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 114.48 Gb Total Space | 81.90 Gb Free Space | 71.54% Space Free | Partition Type: NTFS

Computer Name: PERSONAL-E765D1 | User Name: Nicholas | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Nicholas\My Documents\Downloads\OTL(1).exe (OldTimer Tools)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\Entriq\MediaSphere\EntriqMediaTray.exe (Entriq, Inc.)
PRC - C:\Program Files\Entriq\MediaSphere\3.8.2.9\EntriqMediaServer.exe (Entriq, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_S4I091.EXE (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Iomega\System32\AppServices.exe (Iomega Corporation)
PRC - C:\WINDOWS\system32\VTTimer.exe (S3 Graphics, Inc.)
PRC - C:\WINDOWS\system32\VTTrayp.exe (S3 Graphics Co., Ltd.)
PRC - C:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe (THOMSON Telecom Belgium)
PRC - C:\Program Files\Iomega\AutoDisk\ADService.exe (Iomega Corporation)
PRC - C:\Program Files\Iomega\AutoDisk\ADUserMon.exe (Iomega Corporation)
PRC - C:\Program Files\Iomega\DriveIcons\Imgicon.exe (Iomega)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Nicholas\My Documents\Downloads\OTL(1).exe (OldTimer Tools)
MOD - C:\Program Files\Alwil Software\Avast5\snxhk.dll (AVAST Software)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\Iomega\DriveIcons\Imghook.dll (Iomega Corporation)


========== Win32 Services (SafeList) ==========

SRV - (Iomega Activity Disk2) – File not found
SRV - (HidServ) – File not found
SRV - (CarboniteService) – File not found
SRV - (AppMgmt) – File not found
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (nosGetPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper_3004.dll (NOS Microsystems Ltd.)
SRV - (vsmon) – C:\WINDOWS\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
SRV - (getPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (KService) – C:\Program Files\Kontiki\KService.exe (Kontiki Inc.)
SRV - (CCALib8) – C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
SRV - (Iomega App Services) – C:\Program Files\Iomega\System32\AppServices.exe (Iomega Corporation)
SRV - (_IOMEGA_ACTIVE_DISK_SERVICE_) – C:\Program Files\Iomega\AutoDisk\ADService.exe (Iomega Corporation)


========== Driver Services (SafeList) ==========

DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (vsdatant) – C:\WINDOWS\system32\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (giveio) – C:\WINDOWS\system32\giveio.sys ()
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (ppa3) – C:\WINDOWS\system32\DRIVERS\ppa3.sys (Microsoft Corporation)
DRV - (AmdPPM) – C:\WINDOWS\system32\drivers\AmdPPM.sys (Advanced Micro Devices)
DRV - (Intels51) Intel® – C:\WINDOWS\system32\drivers\IntelS51.sys (Intel Corporation)
DRV - (iomdisk) – C:\WINDOWS\System32\DRIVERS\iomdisk.sys (Iomega Corporation)
DRV - (alcaudsl) – C:\WINDOWS\system32\drivers\alcaudsl.sys (THOMSON)
DRV - (alcan5wn) SpeedTouch USB ADSL PPP Networking Driver (NDISWAN) – C:\WINDOWS\system32\drivers\alcan5wn.sys (THOMSON)
DRV - (ms_mpu401) – C:\WINDOWS\system32\drivers\msmpu401.sys (Microsoft Corporation)
DRV - (irsir) – C:\WINDOWS\system32\drivers\irsir.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.google.co.uk/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Ask"
FF - prefs.js..browser.startup.homepage: "chrome://google-toolbar/content/new-tab.html"
FF - prefs.js..keyword.URL: "http://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q="


FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011/02/23 19:08:44 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/05/01 13:17:04 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/06/10 01:07:21 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011/05/07 09:31:49 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2011/06/10 01:07:21 | 000,000,000 | —D | M]

[2010/10/31 14:33:44 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Extensions
[2010/10/31 14:33:44 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011/06/10 01:12:55 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions
[2011/03/31 12:33:50 | 000,000,000 | —D | M] (Garmin Communicator) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2010/04/27 10:49:40 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/01/12 19:47:10 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2011/04/02 15:19:39 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/03/31 12:33:58 | 000,000,000 | —D | M] (ZoneAlarm Community Toolbar) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}
[2006/12/24 14:42:21 | 000,000,000 | —D | M] (fraudeliminator) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\{AEA25BF2-82A7-481c-9E0C-2639C802D17A}
[2009/02/08 22:38:59 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}
[2010/12/11 21:52:30 | 000,000,000 | —D | M] (British English Dictionary) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\[removed]
[2010/08/25 23:20:52 | 000,000,000 | —D | M] (FireTorrent) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\[removed]
[2011/04/02 15:13:31 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\extensions\nostmp
[2010/06/11 18:32:42 | 000,001,745 | —- | M] () – C:\Documents and Settings\Nicholas\Application Data\Mozilla\Firefox\Profiles\s69wcyu0.default\searchplugins\ask.uk.xml
[2011/06/12 21:19:10 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/04/07 23:06:29 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/06/12 21:19:13 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
File not found (No name found) –
() (No name found) – C:\DOCUMENTS AND SETTINGS\NICHOLAS\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\S69WCYU0.DEFAULT\EXTENSIONS\{A7C6CF7F-112C-4500-A7EA-39801A327E5F}.XPI
[2011/02/23 19:08:44 | 000,000,000 | —D | M] (avast! WebRep) – C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST5\WEBREP\FF
[2011/06/12 21:18:27 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/05/01 13:16:56 | 000,142,296 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2005/06/01 23:26:00 | 000,077,824 | —- | M] () – C:\Program Files\Mozilla Firefox\components\FEMozMod.dll
[2011/06/12 21:18:24 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2007/12/14 19:47:20 | 000,024,673 | —- | M] (Check Point Software Technologies Ltd.) – C:\Program Files\Mozilla Firefox\plugins\NPZoneSB.dll
[2011/04/02 15:12:35 | 000,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2011/04/02 15:12:35 | 000,002,252 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2011/04/02 15:12:35 | 000,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2011/04/02 15:12:35 | 000,001,180 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2011/04/02 15:12:35 | 000,001,135 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2010/06/19 20:56:16 | 000,000,698 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll ()
O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll ()
O3 - HKLM\..\Toolbar: (FraudEliminator) - {A5181F8A-0B9D-43AC-8BE5-EB61651DB685} - C:\Program Files\FraudEliminator\2.3.4\FETB.dll ()
O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe (Iomega Corporation)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Deskup] C:\Program Files\Iomega\DriveIcons\deskup.exe (Iomega)
O4 - HKLM..\Run: [EPSON Stylus C48 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I091.EXE (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [five Media Manager Tray] C:\Program Files\Entriq\MediaSphere\EntriqMediaTray.exe (Entriq, Inc.)
O4 - HKLM..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\Imgicon.exe (Iomega)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [SpeedTouch USB Diagnostics] C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe (THOMSON Telecom Belgium)
O4 - HKLM..\Run: [VTTimer] C:\WINDOWS\System32\VTTimer.exe (S3 Graphics, Inc.)
O4 - HKLM..\Run: [VTTrayp] C:\WINDOWS\System32\VTTrayp.exe (S3 Graphics Co., Ltd.)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe (Kontiki Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: microsoft.com ([oas.support] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([oas.support] https in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([support] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([support] https in Trusted sites)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Reg Error: Key error.)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc2.cab (Office Update Installation Engine)
O16 - DPF: {46431044-1B22-4EF3-B333-863AAF310153} http://download.five.tv/Download/five_3_4_0_8.cab (five Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1231005245375 (MUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos-beta/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CE7D2BF2-D173-4CE2-9DAF-15EA153B5B43} http://download.five.tv/Download/Entriq_3_4_0_10_Silent.cab (MediaControl Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} https://remote.britannia.co.uk/dana-cached/…perSetupSP1.cab (JuniperSetupSP1 Control)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/06/25 09:49:09 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/06/12 21:20:32 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2011/06/12 21:19:00 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2011/06/12 21:19:00 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2011/06/12 21:19:00 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2011/06/12 18:47:34 | 000,000,000 | —D | C] – C:\Documents and Settings\Nicholas\Local Settings\Application Data\Temp
[2011/06/12 18:15:51 | 000,000,000 | —D | C] – C:\Program Files\VS Revo Group
[2011/06/12 18:15:51 | 000,000,000 | —D | C] – C:\Documents and Settings\Nicholas\Start Menu\Programs\Revo Uninstaller
[2011/06/12 17:26:38 | 000,000,000 | —D | C] – C:\_OTL
[2011/06/10 00:16:56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2011/06/08 23:34:34 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET
[2011/06/07 15:34:23 | 000,039,984 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/06/07 15:34:23 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/06/07 15:34:16 | 000,022,712 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/06/07 01:19:57 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/06/07 00:44:11 | 000,000,000 | RHSD | C] – C:\cmdcons
[2011/06/07 00:40:32 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/06/07 00:40:32 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/06/07 00:40:32 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/06/07 00:40:32 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/06/07 00:39:57 | 000,000,000 | —D | C] – C:\Qoobox
[2011/06/03 16:24:36 | 000,000,000 | —D | C] – C:\Documents and Settings\Nicholas\Desktop\erunt
[2011/05/18 10:13:38 | 000,404,640 | —- | C] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[1 C:\Documents and Settings\Nicholas\*.tmp files -> C:\Documents and Settings\Nicholas\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/12 21:18:21 | 000,157,472 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2011/06/12 21:18:21 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2011/06/12 21:18:21 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2011/06/12 21:18:21 | 000,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2011/06/12 21:18:20 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2011/06/12 18:34:12 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/06/12 18:32:04 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/06/12 18:15:54 | 000,000,917 | —- | M] () – C:\Documents and Settings\Nicholas\Desktop\Revo Uninstaller.lnk
[2011/06/10 00:16:57 | 000,001,542 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/06/09 22:45:07 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/06/09 21:02:57 | 000,493,938 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/06/09 21:02:57 | 000,083,042 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/06/09 00:55:37 | 000,404,640 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/06/07 15:34:23 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/07 00:44:19 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2011/05/29 09:11:30 | 000,039,984 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/29 09:11:20 | 000,022,712 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/05/19 21:47:32 | 000,000,049 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[1 C:\Documents and Settings\Nicholas\*.tmp files -> C:\Documents and Settings\Nicholas\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/12 18:15:54 | 000,000,917 | —- | C] () – C:\Documents and Settings\Nicholas\Desktop\Revo Uninstaller.lnk
[2011/06/10 01:07:22 | 000,001,804 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk
[2011/06/10 00:16:57 | 000,001,542 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/06/09 00:07:47 | 000,255,702 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2011/06/07 15:34:23 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/07 00:40:32 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/06/07 00:40:32 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/06/07 00:40:32 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/06/07 00:40:32 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/06/07 00:40:32 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2009/12/26 21:09:18 | 000,000,050 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2009/12/26 02:19:36 | 000,048,316 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2009/04/19 20:29:42 | 000,005,248 | —- | C] () – C:\WINDOWS\System32\giveio.sys
[2008/09/06 15:22:03 | 000,126,976 | —- | C] () – C:\WINDOWS\System32\eappcfg.dll
[2008/05/26 21:59:42 | 000,018,904 | —- | C] () – C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 21:59:40 | 000,106,605 | —- | C] () – C:\WINDOWS\System32\structuredqueryschema.bin
[2007/09/27 10:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 10:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 10:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini
[2006/06/23 19:34:13 | 000,796,584 | —- | C] () – C:\WINDOWS\System32\libeay32_0.9.6l.dll
[2006/03/04 19:51:23 | 000,000,049 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2006/02/15 13:34:49 | 000,096,249 | —- | C] () – C:\WINDOWS\System32\EPPICPrinterDB.dat
[2006/02/15 13:34:49 | 000,026,154 | —- | C] () – C:\WINDOWS\System32\EPPICPattern1.dat
[2006/02/15 13:34:49 | 000,024,903 | —- | C] () – C:\WINDOWS\System32\EPPICPattern3.dat
[2006/02/15 13:34:49 | 000,021,390 | —- | C] () – C:\WINDOWS\System32\EPPICPattern5.dat
[2006/02/15 13:34:49 | 000,020,148 | —- | C] () – C:\WINDOWS\System32\EPPICPattern2.dat
[2006/02/15 13:34:49 | 000,011,811 | —- | C] () – C:\WINDOWS\System32\EPPICPattern4.dat
[2006/02/15 13:34:49 | 000,004,943 | —- | C] () – C:\WINDOWS\System32\EPPICPattern6.dat
[2006/02/15 13:34:49 | 000,001,146 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_DU.dat
[2006/02/15 13:34:49 | 000,001,139 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_PT.dat
[2006/02/15 13:34:49 | 000,001,139 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_BP.dat
[2006/02/15 13:34:49 | 000,001,136 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_ES.dat
[2006/02/15 13:34:49 | 000,001,129 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_FR.dat
[2006/02/15 13:34:49 | 000,001,129 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_CF.dat
[2006/02/15 13:34:49 | 000,001,120 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_IT.dat
[2006/02/15 13:34:49 | 000,001,107 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_GE.dat
[2006/02/15 13:34:49 | 000,001,104 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_EN.dat
[2006/02/15 13:34:49 | 000,000,099 | —- | C] () – C:\WINDOWS\System32\PICSDK.ini
[2006/02/15 13:32:55 | 000,000,025 | —- | C] () – C:\WINDOWS\CDE C48EU.ini
[2005/12/25 16:05:21 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\Rtusd.dll
[2005/12/25 16:05:21 | 000,001,191 | —- | C] () – C:\WINDOWS\System32\RTUSD.INI
[2005/12/25 16:05:20 | 000,290,816 | —- | C] () – C:\WINDOWS\Carmctrl.dll
[2005/12/17 23:36:15 | 000,000,073 | —- | C] () – C:\WINDOWS\hdkctnts.ini
[2005/09/14 17:52:04 | 000,000,081 | —- | C] () – C:\WINDOWS\Q-PLUS.INI
[2005/07/11 14:46:35 | 000,004,212 | -H– | C] () – C:\WINDOWS\System32\zllictbl.dat
[2005/07/11 12:59:43 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2005/07/11 12:59:37 | 000,099,970 | —- | C] () – C:\WINDOWS\UninstallFirefox.exe
[2005/07/11 12:59:09 | 000,007,724 | —- | C] () – C:\WINDOWS\mozver.dat
[2005/06/25 19:24:28 | 000,000,000 | —- | C] () – C:\WINDOWS\WinInit.ini.backup
[2005/06/25 17:15:35 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2005/06/25 15:32:41 | 000,005,606 | R— | C] () – C:\WINDOWS\System32\stci.dll
[2005/06/25 10:38:50 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2005/06/25 10:37:40 | 000,263,824 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2005/06/25 10:13:38 | 000,000,356 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2005/06/25 09:57:39 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\cmirmdrv.dll
[2005/06/25 09:57:33 | 000,000,092 | —- | C] () – C:\WINDOWS\CMISETUP.INI
[2005/06/25 09:57:32 | 000,000,026 | —- | C] () – C:\WINDOWS\CMCDPLAY.INI
[2005/06/25 09:57:30 | 000,000,000 | —- | C] () – C:\WINDOWS\WinInit.ini
[2005/06/25 09:57:26 | 000,266,240 | —- | C] () – C:\WINDOWS\CMIUninstall.exe
[2005/06/25 09:57:26 | 000,225,280 | —- | C] () – C:\WINDOWS\CmiRmRedundDir.exe
[2005/06/25 09:57:26 | 000,028,672 | —- | C] () – C:\WINDOWS\CMIRmDriver.dll
[2005/06/25 09:56:47 | 000,003,541 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2005/06/25 09:56:46 | 000,005,824 | —- | C] () – C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2005/06/25 09:51:34 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2005/06/25 09:46:18 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/08/04 13:00:00 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2004/08/04 13:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 13:00:00 | 000,493,938 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/04 13:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 13:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 13:00:00 | 000,083,042 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/04 13:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 13:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 13:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 13:00:00 | 000,004,461 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/04 13:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2004/08/04 13:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat

< End of report >

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI