http://www.searchqu.com/406

OTL logfile created on: 15/06/2011 20:01:19 - Run 3
OTL by OldTimer - Version 3.2.24.0 Folder = C:\Documents and Settings\Mark\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00001809 | Country: Ireland | Language: ENI | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 1.89 Gb Available Physical Memory | 62.95% Memory free
4.84 Gb Paging File | 3.82 Gb Available in Paging File | 78.98% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 298.08 Gb Total Space | 169.70 Gb Free Space | 56.93% Space Free | Partition Type: NTFS
Drive D: | 186.31 Gb Total Space | 89.85 Gb Free Space | 48.23% Space Free | Partition Type: NTFS
Drive L: | 931.51 Gb Total Space | 805.15 Gb Free Space | 86.44% Space Free | Partition Type: NTFS

Computer Name: MARK-8AA2A066AD | User Name: Mark | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Mark\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\CCP\EVE\bin\ExeFile.exe (CCP hf.)
PRC - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
PRC - C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\WINDOWS\System32\vmnetdhcp.exe (VMware, Inc.)
PRC - C:\WINDOWS\System32\vmnat.exe (VMware, Inc.)
PRC - C:\Program Files\VMware\VMware Player\vmware-authd.exe (VMware, Inc.)
PRC - C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe (VMware, Inc.)
PRC - C:\WINDOWS\System32\FsUsbExService.Exe (Teruten)
PRC - C:\Program Files\Polar\Daemon\polard.exe ()
PRC - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone)
PRC - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone)
PRC - C:\Program Files\INTELLINET NETWORK SOLUTIONS\11n USB Wireless LAN Utility\RtWLan.exe (Realtek Semiconductor Corp.)
PRC - C:\Program Files\Common Files\GFI\ReportCenter\Framework v3.5\gfireporterservice.exe (GFI Software Ltd.)
PRC - C:\Program Files\dcmsvc\dcmsvc.exe ()
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\System32\CTXFIHLP.EXE (Creative Technology Ltd)
PRC - C:\WINDOWS\System32\CTHELPER.EXE (Creative Technology Ltd)
PRC - C:\WINDOWS\System32\CTXFISPI.EXE (Creative Technology Ltd)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Mark\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\guard32.dll (COMODO)
MOD - C:\Program Files\Alwil Software\Avast5\snxhk.dll (AVAST Software)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\CTAGENT.DLL (Creative Technology Ltd)


========== Win32 Services (SafeList) ==========

SRV - (MSDTC) – File not found
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (cmdAgent) – C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (VMnetDHCP) – C:\WINDOWS\System32\vmnetdhcp.exe (VMware, Inc.)
SRV - (VMware NAT Service) – C:\WINDOWS\System32\vmnat.exe (VMware, Inc.)
SRV - (VMAuthdService) – C:\Program Files\VMware\VMware Player\vmware-authd.exe (VMware, Inc.)
SRV - (VMUSBArbService) – C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe (VMware, Inc.)
SRV - (FsUsbExService) – C:\WINDOWS\System32\FsUsbExService.Exe (Teruten)
SRV - (ufad-ws60) – C:\Program Files\VMware\VMware Player\vmware-ufad.exe (VMware, Inc.)
SRV - (Polar Daemon) – C:\Program Files\Polar\Daemon\polard.exe ()
SRV - (VMCService) – C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone)
SRV - (SwitchBoard) – C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (GFI_ReportCenter35) – C:\Program Files\Common Files\GFI\ReportCenter\Framework v3.5\gfireporterservice.exe (GFI Software Ltd.)


========== Driver Services (SafeList) ==========

DRV - (MBAMSwissArmy) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (MBAMProtector) – C:\WINDOWS\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (Inspect) – C:\WINDOWS\System32\DRIVERS\inspect.sys (COMODO)
DRV - (cmdHlp) – C:\WINDOWS\System32\DRIVERS\cmdhlp.sys (COMODO)
DRV - (cmdGuard) – C:\WINDOWS\System32\DRIVERS\cmdguard.sys (COMODO)
DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (vmx86) – C:\WINDOWS\System32\Drivers\vmx86.sys (VMware, Inc.)
DRV - (vmci) – C:\WINDOWS\System32\Drivers\vmci.sys (VMware, Inc.)
DRV - (vmkbd) – C:\WINDOWS\System32\drivers\VMkbd.sys (VMware, Inc.)
DRV - (VMnetBridge) – C:\WINDOWS\System32\DRIVERS\vmnetbridge.sys (VMware, Inc.)
DRV - (VMnetuserif) – C:\WINDOWS\System32\drivers\vmnetuserif.sys (VMware, Inc.)
DRV - (hcmon) – C:\WINDOWS\System32\drivers\hcmon.sys (VMware, Inc.)
DRV - (VMnetAdapter) – C:\WINDOWS\System32\DRIVERS\vmnetadapter.sys (VMware, Inc.)
DRV - (PSSDK42) – C:\WINDOWS\System32\Drivers\pssdk42.sys (microOLAP Technologies LTD)
DRV - (dgderdrv) – C:\WINDOWS\System32\drivers\dgderdrv.sys (Devguru Co., Ltd)
DRV - (ssadmdm) – C:\WINDOWS\System32\DRIVERS\ssadmdm.sys (MCCI Corporation)
DRV - (ssadbus) SAMSUNG Android USB Composite Device driver (WDM) – C:\WINDOWS\System32\DRIVERS\ssadbus.sys (MCCI Corporation)
DRV - (ssadserd) SAMSUNG Android USB Diagnostic Serial Port (WDM) – C:\WINDOWS\System32\DRIVERS\ssadserd.sys (MCCI Corporation)
DRV - (ssadmdfl) SAMSUNG Android USB Modem (Filter) – C:\WINDOWS\System32\DRIVERS\ssadmdfl.sys (MCCI Corporation)
DRV - (androidusb) – C:\WINDOWS\System32\Drivers\ssadadb.sys (Google Inc)
DRV - (FsUsbExDisk) – C:\WINDOWS\System32\FsUsbExDisk.SYS ()
DRV - (vstor2-ws60) – C:\Program Files\VMware\VMware Player\vstor2-ws60.sys (VMware, Inc.)
DRV - (Tcpip6) – C:\WINDOWS\System32\DRIVERS\tcpip6.sys (Microsoft Corporation)
DRV - (RTL8192su) – C:\WINDOWS\System32\DRIVERS\RTL8192su.sys (Realtek Semiconductor Corporation )
DRV - (ewusbnet) – C:\WINDOWS\System32\DRIVERS\ewusbnet.sys (Huawei Technologies Co., Ltd.)
DRV - (hwdatacard) – C:\WINDOWS\System32\DRIVERS\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (hwusbfake) – C:\WINDOWS\System32\DRIVERS\ewusbfake.sys (Huawei Technologies Co., Ltd.)
DRV - (NPF) – C:\WINDOWS\System32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (RsFx0102) – C:\WINDOWS\System32\DRIVERS\RsFx0102.sys (Microsoft Corporation)
DRV - (NwlnkIpx) – C:\WINDOWS\System32\DRIVERS\nwlnkipx.sys (Microsoft Corporation)
DRV - (nm) – C:\WINDOWS\System32\DRIVERS\NMnt.sys (Microsoft Corporation)
DRV - (SCDEmu) – C:\WINDOWS\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (ctaud2k) Creative Audio Driver (WDM) – C:\WINDOWS\System32\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV - (ha20x2k) – C:\WINDOWS\System32\drivers\ha20x2k.sys (Creative Technology Ltd)
DRV - (emupia) – C:\WINDOWS\System32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k) – C:\WINDOWS\System32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (ctprxy2k) – C:\WINDOWS\System32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:\WINDOWS\System32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (ctac32k) – C:\WINDOWS\System32\drivers\ctac32k.sys (Creative Technology Ltd)
DRV - (nvatabus) – C:\WINDOWS\system32\DRIVERS\nvatabus.sys (NVIDIA Corporation)
DRV - (b57w2k) – C:\WINDOWS\System32\DRIVERS\b57xp32.sys (Broadcom Corporation)
DRV - (NwlnkNb) – C:\WINDOWS\System32\DRIVERS\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) – C:\WINDOWS\System32\DRIVERS\nwlnkspx.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.defaultthis.engineName: "ZoneAlarm Security Customized Web Search"
FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.startup.homepage: "http://www.google.ie"
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}:6.0.25
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..network.proxy.type: 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011/02/14 00:56:14 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011/02/14 00:56:14 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/30 21:55:55 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/04/30 21:55:55 | 000,000,000 | —D | M]

[2011/06/05 15:15:35 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Mark\Application Data\Mozilla\Extensions
[2011/06/14 19:57:16 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\9dd0e757.default\extensions
[2010/11/04 13:24:04 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\9dd0e757.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/05/13 12:39:38 | 000,000,000 | —D | M] (Greasemonkey) – C:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\9dd0e757.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011/06/15 16:17:15 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/04/29 18:30:05 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
[2011/02/14 00:56:14 | 000,000,000 | —D | M] (DivX Plus Web Player HTML5 ) – C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\HTML5VIDEO
[2011/02/14 00:56:14 | 000,000,000 | —D | M] (DivX HiQ) – C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\WPA
[2011/04/29 18:29:52 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/04/29 18:29:51 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2004/08/10 12:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4 - HKLM..\Run: [CTHelper] C:\WINDOWS\System32\CtHelper.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [CTxfiHlp] C:\WINDOWS\System32\Ctxfihlp.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [dcmsvc] C:\Program Files\dcmsvc\dcmsvc.exe ()
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [MobileConnect] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\INTELLINET NETWORK SOLUTIONS 802.11n Wireless LAN Utility.lnk = C:\Program Files\INTELLINET NETWORK SOLUTIONS\11n USB Wireless LAN Utility\RtWLan.exe (Realtek Semiconductor Corp.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme [2010/10/26 15:39:42 | 000,000,000 | —D | M]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000052 - C:\Program Files\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000053 - C:\Program Files\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O15 - HKCU\..Trusted Domains: microsoft.com ([*.update] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([*.update] https in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([update] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([update] https in Trusted sites)
O15 - HKCU\..Trusted Domains: windowsupdate.com ([download] http in Trusted sites)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1288173104563 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1288173567954 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Mark\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Mark\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/10/26 15:42:27 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2007/08/20 21:28:34 | 000,000,000 | RHSD | M] - D:\autorun.inf – [ NTFS ]
O32 - AutoRun File - [2010/09/30 17:00:30 | 000,000,047 | —- | M] () - L:\Autodesk 3ds serial.txt – [ NTFS ]
O32 - AutoRun File - [2008/12/15 10:52:18 | 000,000,080 | —- | M] () - L:\Autorun.inf – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/06/15 18:56:17 | 000,000,000 | –SD | C] – C:\ComboFix
[2011/06/15 17:46:13 | 004,127,976 | R— | C] (Swearware) – C:\Documents and Settings\Mark\Desktop\ComboFix.exe
[2011/06/15 16:46:48 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Desktop\Icons
[2011/06/15 16:06:25 | 000,000,000 | —D | C] – C:\_OTL
[2011/06/15 01:48:48 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Mark\Desktop\OTL.exe
[2011/06/14 23:58:11 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Local Settings\Application Data\Audible
[2011/06/14 23:55:36 | 000,255,352 | —- | C] (Audible, Inc.) – C:\WINDOWS\System32\awrdscdc.ax
[2011/06/14 23:55:23 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msxml3a.dll
[2011/06/14 23:54:56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\AudibleManager
[2011/06/14 23:54:23 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\My Documents\Audible
[2011/06/14 23:54:21 | 000,000,000 | —D | C] – C:\Program Files\Audible
[2011/06/14 23:54:21 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Documents\Audible
[2011/06/14 23:53:51 | 001,525,176 | —- | C] (Audible Inc.) – C:\Documents and Settings\Mark\Desktop\ActiveSetupN.exe
[2011/06/14 21:58:25 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2011/06/14 21:36:14 | 000,000,000 | —D | C] – C:\WINDOWS\SxsCaPendDel
[2011/06/14 20:02:13 | 000,105,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mup.sys
[2011/06/12 22:11:18 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/06/12 20:59:41 | 000,000,000 | RHSD | C] – C:\cmdcons
[2011/06/12 20:51:30 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/06/12 20:51:30 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/06/12 20:51:30 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/06/12 20:51:30 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/06/12 20:51:14 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2011/06/12 20:50:08 | 000,000,000 | —D | C] – C:\Qoobox
[2011/06/12 20:48:54 | 000,000,000 | R–D | C] – C:\Documents and Settings\Mark\Start Menu\Programs\Administrative Tools
[2011/06/12 18:16:57 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Application Data\Malwarebytes
[2011/06/12 18:16:52 | 000,039,984 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/06/12 18:16:52 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/06/12 18:16:52 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/06/12 18:16:48 | 000,022,712 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/06/12 18:16:48 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/06/05 19:17:21 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\PowerISO
[2011/06/05 19:17:20 | 000,000,000 | —D | C] – C:\Program Files\PowerISO
[2011/06/05 19:15:46 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\AppData
[2011/06/02 01:30:05 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Blender Foundation
[2011/06/02 01:29:51 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Application Data\Blender Foundation
[2011/06/02 01:29:44 | 000,000,000 | —D | C] – C:\Program Files\Blender Foundation
[2011/05/28 01:17:07 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Start Menu\Programs\Caligari trueSpace7.61 Beta 8 Standalone
[2011/05/28 01:15:30 | 002,682,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vcredist_x86.exe
[2011/05/28 01:14:58 | 000,000,000 | —D | C] – C:\trueSpace761Std
[2011/05/27 13:09:42 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Local Settings\Application Data\PackageAware
[2011/05/26 16:31:37 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\My Documents\MyHeritage
[2011/05/26 16:31:37 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Application Data\MyHeritage
[2011/05/26 16:31:37 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\MyHeritage
[2011/05/26 16:31:27 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Start Menu\Programs\MyHeritage.com
[2011/05/26 16:31:25 | 000,372,736 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\ijl15.dll
[2011/05/26 16:31:24 | 000,608,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\comctl32.ocx
[2011/05/26 16:31:24 | 000,137,000 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msmapi32.ocx
[2011/05/26 16:31:24 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Application Data\The Complete Genealogy Reporter - FTB
[2011/05/26 16:30:53 | 000,000,000 | —D | C] – C:\Program Files\MyHeritage
[2011/05/25 23:25:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\My Documents\GeoControl2
[2011/05/25 23:25:39 | 000,000,000 | —D | C] – C:\Program Files\GeoControl2
[2011/05/25 23:25:39 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Start Menu\Programs\GeoControl2
[2011/05/24 16:14:24 | 000,387,600 | —- | C] (MyHeritage) – C:\WINDOWS\System32\FTBSaver.scr
[2011/05/22 21:32:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\Start Menu\Programs\EVEMon
[2011/05/19 13:26:19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\World of Tanks
[2011/05/18 12:32:08 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Apple
[2011/05/17 23:03:14 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\THQ
[2011/05/17 22:36:45 | 000,000,000 | —D | C] – C:\Program Files\THQ
[2011/05/17 16:57:08 | 000,000,000 | —D | C] – C:\Documents and Settings\Mark\WINDOWS
[2006/12/12 10:47:24 | 000,034,816 | —- | C] ( ) – C:\WINDOWS\System32\a3d.dll
[2006/12/12 10:34:02 | 000,010,240 | —- | C] ( ) – C:\WINDOWS\System32\KILLAPPS.EXE

========== Files - Modified Within 30 Days ==========

[2011/06/15 19:56:23 | 000,000,420 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{23A18CCC-75BD-4F74-A52C-7624EAC70162}.job
[2011/06/15 19:22:00 | 000,000,974 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-515967899-842925246-725345543-1003UA.job
[2011/06/15 19:10:51 | 000,000,278 | —- | M] () – C:\WINDOWS\tasks\SmartDefrag_Startup.job
[2011/06/15 19:10:51 | 000,000,268 | —- | M] () – C:\WINDOWS\tasks\ASC4_PerformanceMonitor.job
[2011/06/15 19:10:38 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/06/15 18:17:43 | 000,002,277 | —- | M] () – C:\Documents and Settings\Mark\Desktop\Google Chrome.lnk
[2011/06/15 18:17:43 | 000,002,255 | —- | M] () – C:\Documents and Settings\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/06/15 17:46:38 | 004,127,976 | R— | M] (Swearware) – C:\Documents and Settings\Mark\Desktop\ComboFix.exe
[2011/06/15 17:26:10 | 000,014,120 | —- | M] () – C:\Documents and Settings\Mark\Desktop\FitList.html
[2011/06/15 17:26:10 | 000,001,598 | —- | M] () – C:\Documents and Settings\Mark\Desktop\config.ini
[2011/06/15 16:46:17 | 001,214,802 | —- | M] () – C:\Documents and Settings\Mark\Desktop\EFT2.13.4.zip
[2011/06/15 16:08:06 | 000,064,756 | —- | M] () – C:\WINDOWS\System32\DVCState-{00000004-00000000-00000005-00001102-00000005-10031102}.rfx
[2011/06/15 16:08:06 | 000,053,968 | —- | M] () – C:\WINDOWS\System32\BMXStateBkp-{00000004-00000000-00000005-00001102-00000005-10031102}.rfx
[2011/06/15 16:08:06 | 000,053,968 | —- | M] () – C:\WINDOWS\System32\BMXState-{00000004-00000000-00000005-00001102-00000005-10031102}.rfx
[2011/06/15 16:08:06 | 000,001,080 | —- | M] () – C:\WINDOWS\System32\settingsbkup.sfm
[2011/06/15 16:08:06 | 000,001,080 | —- | M] () – C:\WINDOWS\System32\settings.sfm
[2011/06/15 12:59:25 | 000,453,632 | —- | M] () – C:\Documents and Settings\Mark\Desktop\CKScanner.exe
[2011/06/15 02:00:00 | 000,000,340 | —- | M] () – C:\WINDOWS\tasks\AdobeAAMUpdater-1.0-MARK-8AA2A066AD-Mark.job
[2011/06/15 01:48:54 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Mark\Desktop\OTL.exe
[2011/06/14 23:56:36 | 000,000,307 | —- | M] () – C:\Documents and Settings\Mark\Desktop\admhelper
[2011/06/14 23:55:53 | 000,001,606 | —- | M] () – C:\Documents and Settings\Mark\Desktop\Audible Manager.lnk
[2011/06/14 23:55:36 | 000,255,352 | —- | M] (Audible, Inc.) – C:\WINDOWS\System32\awrdscdc.ax
[2011/06/14 23:54:00 | 001,525,176 | —- | M] (Audible Inc.) – C:\Documents and Settings\Mark\Desktop\ActiveSetupN.exe
[2011/06/14 23:22:00 | 000,000,922 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-515967899-842925246-725345543-1003Core.job
[2011/06/14 21:59:09 | 000,596,394 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/06/14 21:59:09 | 000,123,276 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/06/14 21:53:01 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/06/13 00:07:03 | 000,000,325 | RHS- | M] () – C:\boot.ini
[2011/06/12 18:16:52 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/12 00:43:00 | 000,001,438 | —- | M] () – C:\Documents and Settings\Mark\.recently-used.xbel
[2011/06/11 23:42:50 | 000,123,904 | —- | M] () – C:\Documents and Settings\Mark\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/06/08 12:32:00 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/06/05 19:17:21 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\PowerISO.lnk
[2011/06/02 01:30:06 | 000,001,745 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Blender.lnk
[2011/05/30 23:19:48 | 005,964,800 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mshtml.dll
[2011/05/29 11:35:36 | 000,000,209 | —- | M] () – C:\Boot.bak
[2011/05/29 09:11:30 | 000,039,984 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/29 09:11:20 | 000,022,712 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/05/28 01:17:07 | 000,001,418 | —- | M] () – C:\Documents and Settings\Mark\Desktop\trueSpace7.61 Beta 8 Standalone.lnk
[2011/05/28 01:17:07 | 000,001,303 | —- | M] () – C:\Documents and Settings\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\trueSpace7.61 Beta 8 Standalone.lnk
[2011/05/28 01:14:58 | 000,000,037 | —- | M] () – C:\WINDOWS\Caligari.ini
[2011/05/27 01:26:24 | 000,001,389 | —- | M] () – C:\Documents and Settings\Mark\Desktop\EVE.lnk
[2011/05/26 19:23:22 | 050,331,702 | —- | M] () – C:\Documents and Settings\Mark\My Documents\Shader3.bmp
[2011/05/26 19:22:55 | 050,331,702 | —- | M] () – C:\Documents and Settings\Mark\My Documents\Shader2.bmp
[2011/05/26 19:18:47 | 033,554,602 | —- | M] () – C:\Documents and Settings\Mark\My Documents\FlatPlain.tif
[2011/05/26 19:18:11 | 002,342,694 | —- | M] () – C:\Documents and Settings\Mark\My Documents\terrainFlatRiver.bmp
[2011/05/26 16:57:39 | 000,000,408 | —- | M] () – C:\WINDOWS\MyHeritage.INI
[2011/05/26 16:31:27 | 000,000,774 | —- | M] () – C:\Documents and Settings\Mark\Desktop\MyHeritage Family Tree Builder.lnk
[2011/05/26 00:48:22 | 001,233,920 | —- | M] () – C:\Documents and Settings\Mark\Desktop\EFT.exe
[2011/05/26 00:42:25 | 016,778,294 | —- | M] () – C:\Documents and Settings\Mark\My Documents\ble.bmp
[2011/05/26 00:39:22 | 033,554,602 | —- | M] () – C:\Documents and Settings\Mark\My Documents\coolAssedfkinTerrain.tif
[2011/05/25 23:26:02 | 000,000,720 | —- | M] () – C:\Documents and Settings\Mark\Desktop\GeoControl2.lnk
[2011/05/24 16:14:24 | 000,387,600 | —- | M] (MyHeritage) – C:\WINDOWS\System32\FTBSaver.scr
[2011/05/22 21:31:58 | 000,302,003 | —- | M] () – C:\Documents and Settings\Mark\My Documents\EVEMon_Settings_2761.xml.bak
[2011/05/22 13:09:35 | 000,002,557 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Vodafone Mobile Connect.lnk
[2011/05/19 13:26:52 | 000,000,681 | —- | M] () – C:\Documents and Settings\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\World of Tanks.lnk
[2011/05/19 13:26:52 | 000,000,663 | —- | M] () – C:\Documents and Settings\All Users\Desktop\World of Tanks.lnk
[2011/05/17 23:03:14 | 000,000,815 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Company of Heroes.lnk

========== Files Created - No Company Name ==========

[2011/06/15 17:26:10 | 000,014,120 | —- | C] () – C:\Documents and Settings\Mark\Desktop\FitList.html
[2011/06/15 16:46:47 | 000,002,850 | —- | C] () – C:\Documents and Settings\Mark\Desktop\FitsTmpl.html
[2011/06/15 16:46:02 | 001,214,802 | —- | C] () – C:\Documents and Settings\Mark\Desktop\EFT2.13.4.zip
[2011/06/15 12:59:25 | 000,453,632 | —- | C] () – C:\Documents and Settings\Mark\Desktop\CKScanner.exe
[2011/06/14 23:56:36 | 000,000,307 | —- | C] () – C:\Documents and Settings\Mark\Desktop\admhelper
[2011/06/14 23:55:53 | 000,001,606 | —- | C] () – C:\Documents and Settings\Mark\Desktop\Audible Manager.lnk
[2011/06/12 20:59:46 | 000,000,209 | —- | C] () – C:\Boot.bak
[2011/06/12 20:59:44 | 000,260,272 | RHS- | C] () – C:\cmldr
[2011/06/12 20:51:30 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/06/12 20:51:30 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/06/12 20:51:30 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/06/12 20:51:30 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/06/12 20:51:30 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/06/12 18:16:52 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/12 00:43:00 | 000,001,438 | —- | C] () – C:\Documents and Settings\Mark\.recently-used.xbel
[2011/06/05 19:17:21 | 000,000,682 | —- | C] () – C:\Documents and Settings\All Users\Desktop\PowerISO.lnk
[2011/06/02 01:30:06 | 000,001,745 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Blender.lnk
[2011/05/28 01:17:07 | 000,001,418 | —- | C] () – C:\Documents and Settings\Mark\Desktop\trueSpace7.61 Beta 8 Standalone.lnk
[2011/05/28 01:17:07 | 000,001,303 | —- | C] () – C:\Documents and Settings\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\trueSpace7.61 Beta 8 Standalone.lnk
[2011/05/28 01:15:30 | 000,000,819 | —- | C] () – C:\WINDOWS\System32\regpackages.bat
[2011/05/28 01:14:58 | 000,000,037 | —- | C] () – C:\WINDOWS\Caligari.ini
[2011/05/27 01:26:24 | 000,001,389 | —- | C] () – C:\Documents and Settings\Mark\Desktop\EVE.lnk
[2011/05/26 19:23:21 | 050,331,702 | —- | C] () – C:\Documents and Settings\Mark\My Documents\Shader3.bmp
[2011/05/26 19:22:53 | 050,331,702 | —- | C] () – C:\Documents and Settings\Mark\My Documents\Shader2.bmp
[2011/05/26 19:18:46 | 033,554,602 | —- | C] () – C:\Documents and Settings\Mark\My Documents\FlatPlain.tif
[2011/05/26 19:18:11 | 002,342,694 | —- | C] () – C:\Documents and Settings\Mark\My Documents\terrainFlatRiver.bmp
[2011/05/26 16:32:30 | 000,000,408 | —- | C] () – C:\WINDOWS\MyHeritage.INI
[2011/05/26 16:31:27 | 000,000,774 | —- | C] () – C:\Documents and Settings\Mark\Desktop\MyHeritage Family Tree Builder.lnk
[2011/05/26 16:31:25 | 000,454,656 | —- | C] () – C:\WINDOWS\System32\PaintX.dll
[2011/05/26 00:42:24 | 016,778,294 | —- | C] () – C:\Documents and Settings\Mark\My Documents\ble.bmp
[2011/05/26 00:39:20 | 033,554,602 | —- | C] () – C:\Documents and Settings\Mark\My Documents\coolAssedfkinTerrain.tif
[2011/05/25 23:26:02 | 000,000,720 | —- | C] () – C:\Documents and Settings\Mark\Desktop\GeoControl2.lnk
[2011/05/22 21:32:50 | 000,302,003 | —- | C] () – C:\Documents and Settings\Mark\My Documents\EVEMon_Settings_2761.xml.bak
[2011/05/19 13:26:52 | 000,000,681 | —- | C] () – C:\Documents and Settings\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\World of Tanks.lnk
[2011/05/19 13:26:52 | 000,000,663 | —- | C] () – C:\Documents and Settings\All Users\Desktop\World of Tanks.lnk
[2011/05/17 23:03:14 | 000,000,815 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Company of Heroes.lnk
[2011/05/17 00:09:39 | 000,001,608 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Conquer Online 2.0.lnk
[2011/03/22 17:32:09 | 000,004,212 | -H– | C] () – C:\WINDOWS\System32\zllictbl.dat
[2011/03/08 22:39:02 | 000,251,198 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2011/03/08 22:39:02 | 000,251,198 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-515967899-842925246-725345543-1003-0.dat
[2011/02/10 12:50:44 | 000,000,254 | —- | C] () – C:\WINDOWS\w32dasm8.ini
[2011/01/29 18:00:24 | 000,030,568 | —- | C] () – C:\WINDOWS\MusiccityDownload.exe
[2011/01/29 18:00:22 | 000,974,848 | —- | C] () – C:\WINDOWS\System32\cis-2.4.dll
[2011/01/29 18:00:22 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\issacapi_bs-2.3.dll
[2011/01/29 18:00:22 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\issacapi_pe-2.3.dll
[2011/01/29 18:00:22 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\issacapi_se-2.3.dll
[2010/12/03 16:42:03 | 000,152,520 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/12/03 13:36:59 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\FsUsbExDevice.Dll
[2010/12/03 13:36:59 | 000,036,640 | —- | C] () – C:\WINDOWS\System32\FsUsbExDisk.Sys
[2010/11/06 12:13:35 | 000,241,436 | —- | C] () – C:\WINDOWS\System32\nvdrsdb0.bin
[2010/11/06 12:13:33 | 000,241,440 | —- | C] () – C:\WINDOWS\System32\nvdrsdb1.bin
[2010/11/06 12:13:33 | 000,000,001 | —- | C] () – C:\WINDOWS\System32\nvdrssel.bin
[2010/11/05 03:15:56 | 000,451,072 | —- | C] () – C:\WINDOWS\System32\ISSRemoveSP.exe
[2010/11/02 11:39:42 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2010/10/27 23:49:30 | 000,123,904 | —- | C] () – C:\Documents and Settings\Mark\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/10/27 23:21:32 | 000,376,832 | —- | C] () – C:\WINDOWS\System32\AegisI5Installer.exe
[2010/10/27 15:03:02 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2010/10/27 12:50:06 | 000,000,600 | —- | C] () – C:\Documents and Settings\Mark\Application Data\winscp.rnd
[2010/10/27 09:50:08 | 002,293,194 | —- | C] () – C:\WINDOWS\System32\nvdata.bin
[2010/10/26 16:33:11 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2010/10/26 16:32:29 | 000,247,104 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/10/26 15:50:16 | 000,000,127 | —- | C] () – C:\Documents and Settings\Mark\Local Settings\Application Data\fusioncache.dat
[2010/10/26 15:44:02 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2010/10/26 15:40:03 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2010/03/15 20:15:34 | 000,156,430 | R— | C] () – C:\Documents and Settings\All Users\Application Data\DeviceManager.xml.rc4
[2009/10/20 19:19:30 | 000,053,299 | —- | C] () – C:\WINDOWS\System32\pthreadVC.dll
[2009/10/06 08:16:00 | 000,819,200 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2008/05/26 21:59:42 | 000,018,904 | —- | C] () – C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 21:59:40 | 000,106,605 | —- | C] () – C:\WINDOWS\System32\structuredqueryschema.bin
[2007/09/27 10:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 10:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 10:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini
[2006/12/19 07:15:20 | 000,065,154 | —- | C] () – C:\WINDOWS\System32\instwdm.ini
[2006/12/12 10:48:22 | 000,043,520 | —- | C] () – C:\WINDOWS\System32\CTBurst.dll
[2006/12/12 10:46:52 | 000,037,888 | —- | C] () – C:\WINDOWS\PSCONV.EXE
[2006/12/12 10:39:02 | 000,325,821 | —- | C] () – C:\WINDOWS\System32\ctdlang.dat
[2006/12/12 10:39:02 | 000,046,273 | —- | C] () – C:\WINDOWS\System32\ctdnlstr.dat
[2006/12/12 10:36:32 | 000,035,328 | —- | C] () – C:\WINDOWS\System32\regplib.exe
[2006/12/12 10:36:14 | 000,149,838 | —- | C] () – C:\WINDOWS\System32\CTBAS2W.DAT
[2006/12/12 10:34:30 | 000,274,587 | —- | C] () – C:\WINDOWS\System32\CTSBAS2W.DAT
[2006/12/12 10:34:22 | 000,240,568 | —- | C] () – C:\WINDOWS\System32\CTSBASW.DAT
[2006/12/12 10:34:22 | 000,114,908 | —- | C] () – C:\WINDOWS\System32\CTBASICW.DAT
[2006/12/12 10:34:06 | 000,313,207 | —- | C] () – C:\WINDOWS\System32\ctstatic.dat
[2006/12/12 10:34:06 | 000,053,932 | —- | C] () – C:\WINDOWS\System32\ctdaught.dat
[2006/12/12 10:34:04 | 000,005,120 | —- | C] () – C:\WINDOWS\System32\ENLOCSTR.EXE
[2006/11/30 08:01:26 | 000,000,054 | —- | C] () – C:\WINDOWS\System32\ctzapxx.ini
[2006/05/18 07:03:24 | 000,000,269 | —- | C] () – C:\WINDOWS\System32\KILL.INI
[2005/08/05 14:01:54 | 000,235,008 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2005/03/22 23:38:24 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2005/03/22 23:38:24 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/10 12:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/10 12:00:00 | 000,596,394 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/10 12:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/10 12:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/10 12:00:00 | 000,123,276 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/10 12:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/10 12:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/10 12:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/10 12:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2004/08/10 12:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI

========== Alternate Data Streams ==========

@Alternate Data Stream - 233 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9A870F8B

< End of report >

Got it to work in safe mode

ComboFix 11-06-15.02 - Administrator 16/06/2011 1:10.6.4 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3069.2651 [GMT 1:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: COMODO Firewall *Enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\invokesi.exe
c:\documents and settings\Mark\WINDOWS
c:\windows\system32\muzapp.exe
c:\windows\system32\system32
c:\windows\system32\system32\cis-2.4.dll
c:\windows\system32\system32\issacapi_bs-2.3.dll
c:\windows\system32\system32\issacapi_pe-2.3.dll
c:\windows\system32\system32\issacapi_se-2.3.dll
c:\windows\system32\system32\MACXMLProto.dll
c:\windows\system32\system32\MaDRM.dll
c:\windows\system32\system32\MaJGUILib.dll
c:\windows\system32\system32\MaJUtilLib.dll
c:\windows\system32\system32\MAMACExtract.dll
c:\windows\system32\system32\MASetupCaller.dll
c:\windows\system32\system32\MASetupCleaner.exe
c:\windows\system32\system32\MaXMLProto.dll
c:\windows\system32\system32\MetaStore2.dll
c:\windows\system32\system32\Microsoft.Synchronization.dll
c:\windows\system32\system32\MK_Lyric.dll
c:\windows\system32\system32\MSCLib.dll
c:\windows\system32\system32\MSFLib.dll
c:\windows\system32\system32\MSLUR71.dll
c:\windows\system32\system32\msvcp60.dll
c:\windows\system32\system32\MTTELECHIP.dll
c:\windows\system32\system32\MTXSYNCICON.dll
c:\windows\system32\system32\muzaf1.dll
c:\windows\system32\system32\muzapp.dll
c:\windows\system32\system32\muzapp.exe
c:\windows\system32\system32\muzdecode.ax
c:\windows\system32\system32\muzeffect.ax
c:\windows\system32\system32\muzmp4sp.ax
c:\windows\system32\system32\muzmpgsp.ax
c:\windows\system32\system32\muzoggsp.ax
c:\windows\system32\system32\muzwmts.dll
c:\windows\system32\system32\psapi.dll
c:\windows\system32\system32\Synchronization2.dll
c:\windows\w32dasm8.ini
L:\Autorun.inf
L:\install.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-05-16 to 2011-06-16 )))))))))))))))))))))))))))))))
.
.
2011-06-16 00:04 . 2011-06-16 00:04 ——– d—–w- c:\documents and settings\Administrator
2011-06-15 15:06 . 2011-06-15 15:06 ——– d—–w- C:\_OTL
2011-06-14 22:55 . 2011-06-14 22:55 255352 —-a-w- c:\windows\system32\awrdscdc.ax
2011-06-14 22:55 . 2001-08-17 21:43 24576 ——w- c:\windows\system32\msxml3a.dll
2011-06-14 22:54 . 2011-06-14 22:55 ——– d—–w- c:\program files\Audible
2011-06-14 20:36 . 2011-06-14 21:00 ——– d—–w- c:\windows\SxsCaPendDel
2011-06-14 19:02 . 2011-04-21 13:37 105472 -c—-w- c:\windows\system32\dllcache\mup.sys
2011-06-12 21:11 . 2011-06-12 21:11 ——– d—–w- c:\program files\ESET
2011-06-12 17:16 . 2011-06-12 17:16 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-06-12 17:16 . 2011-05-29 08:11 39984 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-12 17:16 . 2011-06-12 17:16 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-06-12 17:16 . 2011-05-29 08:11 22712 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-06-05 18:17 . 2011-06-05 18:17 ——– d—–w- c:\program files\PowerISO
2011-06-05 18:15 . 2011-06-05 18:15 ——– d—–w- c:\documents and settings\Mark\AppData
2011-06-02 00:29 . 2011-06-02 00:29 ——– d—–w- c:\program files\Blender Foundation
2011-05-28 00:15 . 2008-06-10 08:19 819 —-a-w- c:\windows\system32\regpackages.bat
2011-05-28 00:15 . 2008-06-10 08:19 2682880 —-a-w- c:\windows\system32\vcredist_x86.exe
2011-05-28 00:14 . 2011-05-28 00:15 ——– d—–w- C:\trueSpace761Std
2011-05-26 15:31 . 2011-05-26 15:43 ——– d—–w- c:\documents and settings\All Users\Application Data\MyHeritage
2011-05-26 15:31 . 2003-07-06 12:07 372736 —-a-w- c:\windows\system32\ijl15.dll
2011-05-26 15:31 . 2002-03-06 23:19 454656 —-a-w- c:\windows\system32\PaintX.dll
2011-05-26 15:31 . 2000-05-22 15:58 608448 —-a-w- c:\windows\system32\comctl32.ocx
2011-05-26 15:31 . 1998-06-23 23:00 137000 —-a-w- c:\windows\system32\msmapi32.ocx
2011-05-26 15:30 . 2011-05-26 15:43 ——– d—–w- c:\program files\MyHeritage
2011-05-25 22:25 . 2011-05-25 22:26 ——– d—–w- c:\program files\GeoControl2
2011-05-24 15:14 . 2011-05-24 15:14 387600 —-a-w- c:\windows\system32\FTBSaver.scr
2011-05-18 11:32 . 2011-05-18 11:32 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Apple
2011-05-17 21:36 . 2011-05-17 21:36 ——– d—–w- c:\program files\THQ
2011-05-17 10:30 . 2011-05-17 10:30 1103784 —-a-w- c:\program files\Common Files\Microsoft Shared\OFFICE11\RICHED20.DLL
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-14 20:57 . 2011-03-07 11:41 187328 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\VCSExpress\9.0\1033\ResourceCache.dll
2011-06-14 20:56 . 2011-03-07 11:41 416 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\MSDN\9.0\1033\ResourceCache.dll
2011-05-10 15:52 . 2010-12-29 01:42 284744 —-a-w- c:\windows\system32\guard32.dll
2011-05-10 15:52 . 2011-01-06 17:37 97504 —-a-w- c:\windows\system32\drivers\inspect.sys
2011-05-10 15:52 . 2011-01-06 17:37 29400 —-a-w- c:\windows\system32\drivers\cmdhlp.sys
2011-05-10 15:52 . 2011-01-06 17:37 17416 —-a-w- c:\windows\system32\drivers\cmderd.sys
2011-05-10 15:52 . 2011-01-06 17:37 242472 —-a-w- c:\windows\system32\drivers\cmdGuard.sys
2011-05-10 12:10 . 2010-10-27 12:03 40112 —-a-w- c:\windows\avastSS.scr
2011-05-10 12:10 . 2010-10-27 12:03 199304 —-a-w- c:\windows\system32\aswBoot.exe
2011-05-10 12:03 . 2011-03-13 15:49 441176 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2011-05-10 12:03 . 2010-10-27 12:03 307928 —-a-w- c:\windows\system32\drivers\aswSP.sys
2011-05-10 12:02 . 2010-10-27 12:03 49240 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2011-05-10 12:02 . 2010-10-27 12:03 102616 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2011-05-10 12:02 . 2010-10-27 12:03 96344 —-a-w- c:\windows\system32\drivers\aswmon.sys
2011-05-10 11:59 . 2010-10-27 12:03 25432 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2011-05-10 11:59 . 2010-10-27 12:03 30808 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2011-05-10 11:59 . 2010-10-27 12:03 19544 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-05-02 15:31 . 2010-10-26 14:40 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:29 . 2011-04-29 17:30 73728 —-a-w- c:\windows\system32\javacpl.cpl
2011-04-29 17:29 . 2011-04-29 17:30 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-04-29 16:19 . 2004-08-10 11:00 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-25 16:11 . 2006-03-04 03:33 916480 —-a-w- c:\windows\system32\wininet.dll
2011-04-25 16:11 . 2004-08-10 11:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-04-25 16:11 . 2004-08-10 11:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-04-25 12:01 . 2004-08-10 11:00 385024 —-a-w- c:\windows\system32\html.iec
2011-04-21 13:37 . 2004-08-10 11:00 105472 —-a-w- c:\windows\system32\drivers\mup.sys
2011-03-25 22:27 . 2011-03-25 22:27 854256 —-a-w- c:\windows\system32\drivers\vmx86.sys
2011-03-25 22:27 . 2011-03-25 22:27 70768 —-a-w- c:\windows\system32\drivers\vmci.sys
2011-03-25 22:27 . 2011-04-30 18:27 760432 —-a-w- c:\windows\system32\vnetlib.dll
2011-03-25 22:26 . 2011-04-30 18:27 334448 —-a-w- c:\windows\system32\vmnetdhcp.exe
2011-03-25 22:26 . 2011-04-30 18:27 404080 —-a-w- c:\windows\system32\vmnat.exe
2011-03-25 22:25 . 2011-04-30 18:26 24688 —-a-w- c:\windows\system32\drivers\VMkbd.sys
2011-03-25 22:25 . 2011-03-25 22:25 51312 —-a-w- c:\windows\system32\vmnetbridge.dll
2011-03-25 22:25 . 2011-03-25 22:25 32752 —-a-w- c:\windows\system32\drivers\vmnetbridge.sys
2011-03-25 22:24 . 2011-04-30 18:27 26352 —-a-w- c:\windows\system32\drivers\vmnetuserif.sys
2011-03-25 21:27 . 2011-03-25 21:27 32368 —-a-w- c:\windows\system32\drivers\hcmon.sys
2011-03-25 21:00 . 2011-03-25 21:00 252528 —-a-w- c:\windows\system32\vmnc.dll
2011-03-25 19:05 . 2011-03-25 19:05 59952 —-a-w- c:\windows\system32\vnetinst.dll
2011-03-25 19:05 . 2011-03-25 19:05 18736 —-a-w- c:\windows\system32\drivers\vmnet.sys
2011-03-25 19:05 . 2011-03-25 19:05 16560 —-a-w- c:\windows\system32\drivers\vmnetadapter.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-05-10 12:10 122512 —-a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"CTHelper"="CTHELPER.EXE" [2006-12-12 19456]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-12-12 20480]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-10-16 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-10-16 13851752]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-08-26 1753192]
"dcmsvc"="c:\program files\dcmsvc\dcmsvc.exe" [2009-04-07 30440]
"MobileConnect"="c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe" [2010-03-15 2499584]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-05-10 2552648]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
INTELLINET NETWORK SOLUTIONS 802.11n Wireless LAN Utility.lnk - c:\program files\INTELLINET NETWORK SOLUTIONS\11n USB Wireless LAN Utility\RtWLan.exe [2010-11-5 933888]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll
.
[HKLM\~\startupfolder\C:^Documents and Settings^Mark^Start Menu^Programs^Startup^Warner Bros.lnk]
path=c:\documents and settings\Mark\Start Menu\Programs\Startup\Warner Bros.lnk
backup=c:\windows\pss\Warner Bros.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-20 23:07 932288 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 04:47 35760 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
2010-03-06 03:44 500208 ——w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-01-10 23:25 1230704 —-a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Family Tree Builder Update]
2011-05-24 15:08 221184 —-a-w- c:\program files\MyHeritage\Bin\FTBCheckUpdates.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-09-01 06:15 136176 —-a-w- c:\documents and settings\Mark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IObit Security 360]
2010-06-11 17:14 1280344 —-a-w- c:\program files\IObit\IObit Security 360\is360tray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesHelper]
2011-01-29 23:11 888120 —-a-w- c:\program files\Samsung\Kies\KiesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent]
2011-01-29 23:11 3372856 —-a-w- c:\program files\Samsung\Kies\KiesTrayAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 17:38 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-01-07 12:12 253672 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
2010-02-19 13:37 517096 —-a-w- c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VMware hqtray]
2011-03-25 22:26 64112 —-a-w- c:\program files\VMware\VMware Player\hqtray.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\Mark\\My Documents\\Downloads\\Conquer_P2P_20100921.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\INTELLINET NETWORK SOLUTIONS\\11n USB Wireless LAN Utility\\RtWLan.exe"=
"c:\\Program Files\\CCP\\EVE\\bin\\ExeFile.exe"=
"c:\\Program Files\\INTELLINET NETWORK SOLUTIONS\\11n USB Wireless LAN Utility\\RTLDHCP.exe"=
"c:\\Program Files\\GFI\\LANguard 9\\languard.exe"=
"c:\\Program Files\\Conquer Online 2.0\\IsecPlus\\91GameCheck.exe"=
"c:\\Program Files\\VMware\\VMware Player\\vmware-authd.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1542:TCP"= 1542:TCP:Realtek WPS TCP Prot
"1542:UDP"= 1542:UDP:Realtek WPS UDP Prot
"53:UDP"= 53:UDP:Realtek AP UDP Prot
.
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [06/01/2011 18:37 29400]
R3 RTL8192su;INTELLINET NETWORK SOLUTIONS 802.11n USB Network Adapter;c:\windows\system32\drivers\RTL8192su.sys [05/11/2010 03:15 591488]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [13/03/2011 16:49 441176]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [27/10/2010 13:03 307928]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [06/01/2011 18:37 242472]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [27/10/2010 13:03 19544]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 14:16 130384]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [03/12/2010 13:36 217088]
S2 GFI_ReportCenter35;GFI ReportCenter 3.5;c:\program files\Common Files\GFI\ReportCenter\Framework v3.5\gfireporterservice.exe [16/06/2009 10:48 111912]
S2 Polar Daemon;Polar Daemon;c:\program files\Polar\Daemon\polard.exe [31/05/2010 14:28 344064]
S2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [25/03/2011 23:27 70768]
S2 VMCService;Vodafone Mobile Connect Service;c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [15/03/2010 21:11 9216]
S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files\Common Files\VMware\USB\vmware-usbarbitrator.exe [25/03/2011 22:27 539248]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\drivers\ssadadb.sys [09/03/2011 00:21 30312]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [08/03/2011 12:26 20032]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [15/01/2011 09:44 113280]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [03/12/2010 13:36 36640]
S3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\drivers\ewusbfake.sys [15/01/2011 09:51 100736]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [12/06/2011 18:16 22712]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [12/06/2011 18:16 39984]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [20/10/2009 19:19 50704]
S3 PSSDK42;PSSDK42;c:\windows\system32\drivers\pssdk42.sys [11/02/2011 02:40 38976]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\drivers\ssadbus.sys [09/03/2011 00:21 121192]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\drivers\ssadmdfl.sys [09/03/2011 00:21 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\drivers\ssadmdm.sys [09/03/2011 00:21 136680]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\drivers\ssadserd.sys [09/03/2011 00:21 114152]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19/02/2010 14:37 517096]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 14:16 753504]
S4 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [12/06/2011 18:16 366640]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [11/07/2008 01:28 47128]
S4 RsFx0102;RsFx0102 Driver;c:\windows\system32\drivers\RsFx0102.sys [10/07/2008 03:49 242712]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [11/07/2008 01:28 369688]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - PARPORT
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-15 c:\windows\Tasks\AdobeAAMUpdater-1.0-MARK-8AA2A066AD-Mark.job
- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2011-03-18 03:44]
.
2011-06-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
2011-06-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-515967899-842925246-725345543-1003Core.job
- c:\documents and settings\Mark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-10-27 06:15]
.
2011-06-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-515967899-842925246-725345543-1003UA.job
- c:\documents and settings\Mark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-10-27 06:15]
.
2011-06-16 c:\windows\Tasks\User_Feed_Synchronization-{23A18CCC-75BD-4F74-A52C-7624EAC70162}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 03:31]
.
.
——- Supplementary Scan ——-
.
LSP: c:\program files\VMware\VMware Player\vsocklib.dll
TCP: DhcpNameServer = 192.168.1.1 192.168.1.1
TCP: Interfaces\{6F100EAB-BD94-45F0-9502-ACFCA5C140D2}: NameServer = 156.154.70.22,156.154.71.22
TCP: Interfaces\{8C9111DA-1F4F-4634-8CE5-87F26E019EB5}: NameServer = 156.154.70.22,156.154.71.22
FF - ProfilePath - c:\documents and settings\Mark\Application Data\Mozilla\Firefox\Profiles\9dd0e757.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ie
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: DivX Plus Web Player HTML5 : {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\DivX\DivX Plus Web Player\firefox\html5video
FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - c:\program files\DivX\DivX Plus Web Player\firefox\wpa
FF - Ext: Java Quick Starter: [removed] - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-10 - (no file)
MSConfigStartUp-DATAMNGR - c:\progra~1\WI371A~1\Datamngr\DATAMN~1.EXE
AddRemove-EVE - c:\documents and settings\Mark\Desktop\EVE\Uninstall.exe
AddRemove-Searchqu 406 MediaBar - c:\program files\Windows iLivid Toolbar\uninstall.exe
AddRemove-{49D2008F-D878-4FC8-B1CE-36D17B6D0A8B}_is1 - c:\program files\Conquer Test\unins000.exe
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-12_Symbian_USB_Download_Driver - c:\program files\Samsung\USB Drivers\12_Symbian_USB_Download_Driver\Uninstall.exe
AddRemove-15_Symbian_Samsung_PC_DLC_Driver - c:\program files\Samsung\USB Drivers\15_Symbian_Samsung_PC_DLC_Driver\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-16 01:17
Windows 5.1.2600 Service Pack 3 NTFS
.
detected NTDLL code modification:
ZwClose, ZwOpenFile
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTHelper = CTHELPER.EXE?
CTxfiHlp = CTXFIHLP.EXE?
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2011-06-16 01:19:04
ComboFix-quarantined-files.txt 2011-06-16 00:19
.
Pre-Run: 182,119,489,536 bytes free
Post-Run: 182,050,975,744 bytes free
.
- - End Of File - - 2A704F68A6E8CFC811BE2C13FFB266A5