Spyware / Malware / Virus Removal

please check my log

23 min read

Looking for the outcome? Ask AI

farmgirl806 Topic Starter

Post #1June 21, 2011, 2:46 PM UTC

Hello, I am working on a friends computer. It was infected with malware remover tool 2011. I ran malwarebytes and found 2500 infected files. Then I ran spybot and found a few more. She did not have a virus program so I have installed avast free. I also scanned with that. She has a very large amount of games on this computer. I did uninstall free ride games but I am unable to uninstall the freeride toolbar. I will unistall any game that you think can pose a threat. The computer seems to be working now and I am able to get on the internet. (I was unable to get anywhere before). The one problem I do have with the computer is that it continues to wake itself up from sleep about 5 minutes after it goes to standby. Please check my log and let me know what else to work on. Thank you so much.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:34:44 AM, on 6/21/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\hp\support\hpsysdrv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Yahoo!\Common\YMailAdvisor.exe
C:\Program Files\iBryte\playbryte\iBryteDesktop.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10t_ActiveX.exe
C:\Users\Tanja-PC\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=566…ome.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Freecause Shopping BHO - {1F44B5B5-7976-4378-9A7F-FE6435E9660F} - C:\Program Files\Shop to Win 12\Shop to Win 12.dll
O2 - BHO: FCTBPos00Pos - {399C60D2-38B1-4E25-B9E7-6498C1BC2DCD} - (no file)
O2 - BHO: PlayBryte BHO - {61e0ef7a-9bc0-45ea-9b2f-f3e9f02692bd} - mscoree.dll (file missing)
O2 - BHO: Playfin Games Toolbar - {6905e4b1-afef-4444-85a9-ecb16c048784} - C:\Program Files\playfingamestoolbar\vmntemplateX.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Arcadeweb - {78919608-B066-4B5A-B248-38E12A783E05} - C:\Program Files\ArcadeWeb\arcadeweb32.dll
O2 - BHO: (no name) - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - (no file)
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O2 - BHO: Free Ride Games Toolbar - {f92a9fe4-2850-4198-b9d5-279880e49b16} - C:\Program Files\Free_Ride_Games\tbFree.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll
O3 - Toolbar: (no name) - {C53FE659-316A-4F56-A194-A5BE491BE866} - (no file)
O3 - Toolbar: Free Ride Games Toolbar - {f92a9fe4-2850-4198-b9d5-279880e49b16} - C:\Program Files\Free_Ride_Games\tbFree.dll
O3 - Toolbar: Playfin Games Toolbar - {6905e4b1-afef-4444-85a9-ecb16c048784} - C:\Program Files\playfingamestoolbar\vmntemplateX.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: PlayBryte Toolbar - {b278d9f8-0fa9-465e-9938-0c392605d8e3} - mscoree.dll (file missing)
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [YMailAdvisor] "C:\Program Files\Yahoo!\Common\YMailAdvisor.exe"
O4 - HKLM\..\Run: [iBryte playbryte Desktop] C:\Program Files\iBryte\playbryte\ibrytedesktop.exe
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\System32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100458 -Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0; FunWebProducts; SIMBAR={6C878615-E832-4D4E-8D3C-825AC6F7A845}; GTB6; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.21022; .NET CLR 3.5.30729; .NET CLR 3.0.30618)
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
O9 - Extra button: Go to PlaySushi web site - {EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - (no file)
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Exorcist/Images/stg_drm.ocx
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Emsisoft Anti-Malware 5.1 - Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\Emsisoft Anti-Malware\a2service.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: GamesAppService - WildTangent, Inc. - C:\Program Files\WildTangent Games\App\GamesAppService.exe
O23 - Service: Google Update Service (gupdate1ca1ce843938c30) (gupdate1ca1ce843938c30) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 9110 bytes

patndoris

Post #2June 23, 2011, 3:01 PM UTC

Hello and

My name is patndoris. I will be glad to take a look at your log and help you with solving any malware problems. It will be very helpful if you follow these guidelines:

Malware logs are often lengthy and can take a lot of time to research and interpret. Please be patient while I review your logs.
Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
Please follow my instructions carefully and in the order they are posted. You may also find it helpful to print out the instructions you receive.
Please do not run any scans or install/uninstall any applications or delete anything without being directed to do so.
Remember, absence of symptoms does not mean the infection is all gone. Please stick with me till you're given the "all clear".
Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
Please reply within 3 days. If I do not hear back from you in that time frame, I will post a reminder for you. Topics with no reply in 4 days are closed!

HijackThis has largely been replaced by other tools. Since being acquired by TrendMicro, HijackThis has not been regularly updated. Many infections are now able to hide partly, or completely from a HijackThis scan. DDS includes all the scan locations of HijackThis and more.

Download and Run DDS by sUBs

Please download DDS and save it to your desktop.

Disable any script blocking protection
Double click dds.scr to run the tool.
When done, DDS.txt will open.
Save both reports to your desktop.

—————————————————

Please Please copy / paste the scan reults.

DDS.txt

Please attach the second file; Attach.txt.

Download and Run GMER

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Right-click and choose Run as Administrator on GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that may have been checked. Uncheck the following …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one - make sure it is UNCHECKED)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

farmgirl806

Post #3June 23, 2011, 10:27 PM UTC

Thank you so much for helping me. Below is the copy of the DDS file . DDS (Ver_2011-06-12.02) - NTFSx86 Internet Explorer: 9.0.8112.16421 Run by [removed] at 10:23:38 on 2011-06-23 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2039.993 [GMT -5:00] . AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\hp\support\hpsysdrv.exe svchost.exe C:\Windows\system32\taskeng.exe C:\Windows\RtHDVCpl.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Yahoo!\Common\YMailAdvisor.exe C:\Program Files\iBryte\playbryte\iBryteDesktop.exe C:\Program Files\AVAST Software\Avast\AvastUI.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE C:\Windows\ehome\ehtray.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe svchost.exe svchost.exe svchost.exe svchost.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\Macromed\Flash\FlashUtil10t_ActiveX.exe C:\Program Files\Internet Explorer\IELowutil.exe . ============== Pseudo HJT Report =============== . uSearch Page = uStart Page = hxxp://www.yahoo.com/ uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Presario&pf=desktop uSearch Bar = mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Presario&pf=desktop mDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com mSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com mSearchAssistant = mURLSearchHooks: Free Ride Games Toolbar: {f92a9fe4-2850-4198-b9d5-279880e49b16} - c:\program files\free_ride_games\tbFree.dll mURLSearchHooks: H - No File BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: Shop to Win 12: {1f44b5b5-7976-4378-9a7f-fe6435e9660f} - c:\program files\shop to win 12\Shop to Win 12.dll BHO: {399C60D2-38B1-4E25-B9E7-6498C1BC2DCD} - No File BHO: PlayBryte BHO: {61e0ef7a-9bc0-45ea-9b2f-f3e9f02692bd} - mscoree.dll BHO: Playfin Games Toolbar: {6905e4b1-afef-4444-85a9-ecb16c048784} - c:\program files\playfingamestoolbar\vmntemplateX.dll BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll BHO: ArcadeWeb Class: {78919608-b066-4b5a-b248-38e12a783e05} - c:\program files\arcadeweb\arcadeweb32.dll BHO: {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - No File BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.6406.1642\swg.dll BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File BHO: Free Ride Games Toolbar: {f92a9fe4-2850-4198-b9d5-279880e49b16} - c:\program files\free_ride_games\tbFree.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll TB: {C53FE659-316A-4F56-A194-A5BE491BE866} - No File TB: Free Ride Games Toolbar: {f92a9fe4-2850-4198-b9d5-279880e49b16} - c:\program files\free_ride_games\tbFree.dll TB: Playfin Games Toolbar: {6905e4b1-afef-4444-85a9-ecb16c048784} - c:\program files\playfingamestoolbar\vmntemplateX.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: PlayBryte Toolbar: {b278d9f8-0fa9-465e-9938-0c392605d8e3} - mscoree.dll TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File TB: {D0523BB4-21E7-11DD-9AB7-415B56D89593} - No File TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File {555d4d79-4bd2-4094-a395-cfc534424a05} uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockw~1\SWHELP~1.EXE -Update -1100458 -Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0; FunWebProducts; SIMBAR={6C878615-E832-4D4E-8D3C-825AC6F7A845}; GTB6; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.21022; .NET CLR 3.5.30729; .NET CLR 3.0.30618) mRun: [hpsysdrv] c:\hp\support\hpsysdrv.exe mRun: [RtHDVCpl] RtHDVCpl.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [YMailAdvisor] "c:\program files\yahoo!\common\YMailAdvisor.exe" mRun: [iBryte playbryte Desktop] c:\program files\ibryte\playbryte\ibrytedesktop.exe mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: &Search IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html IE: {EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - {EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} - file:///C:/Program%20Files/Exorcist/Images/stg_drm.ocx DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: DhcpNameServer = [removed] [removed] TCP: Interfaces\{BDDD3D66-7653-42F8-9B2B-430B8FFBC5E8} : DhcpNameServer = [removed] [removed] Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL Notify: igfxcui - igfxdev.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL . ============= SERVICES / DRIVERS =============== . R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-6-7 441176] R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-6-7 307928] R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2008-5-28 12872] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2008-5-28 67656] R2 a2AntiMalware;Emsisoft Anti-Malware 5.1 - Service;c:\program files\emsisoft anti-malware\a2service.exe [2011-6-9 2978720] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-6-7 19544] R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-6-7 53592] R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2011-6-7 42184] R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-7-27 21504] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 gupdate1ca1ce843938c30;Google Update Service (gupdate1ca1ce843938c30);c:\program files\google\update\GoogleUpdate.exe [2009-8-14 133104] S3 a2acc;a2acc;c:\program files\emsisoft anti-malware\a2accx86.sys [2011-6-9 73728] S3 GamesAppService;GamesAppService;c:\program files\wildtangent games\app\GamesAppService.exe [2010-10-12 206072] S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2009-8-14 133104] S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-6-6 39984] S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [2011-6-8 27192] S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2008-5-28 12872] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] . =============== Created Last 30 ================ . 2011-06-21 09:27:46 7074640 —-a-w- c:\programdata\microsoft\windows defender\definition updates\{fb16e7dc-501e-4c20-a97e-edeb91b36d81}\mpengine.dll 2011-06-16 08:01:42 2382848 —-a-w- c:\windows\system32\mshtml.tlb 2011-06-16 08:01:41 141104 —-a-w- c:\program files\internet explorer\sqmapi.dll 2011-06-16 08:01:40 1797632 —-a-w- c:\windows\system32\jscript9.dll 2011-06-15 20:15:38 75264 —-a-w- c:\windows\system32\drivers\dfsc.sys 2011-06-15 20:15:36 273408 —-a-w- c:\windows\system32\drivers\afd.sys 2011-06-15 20:15:34 146432 —-a-w- c:\windows\system32\drivers\srv2.sys 2011-06-15 20:15:34 102400 —-a-w- c:\windows\system32\drivers\srvnet.sys 2011-06-15 20:15:10 563712 —-a-w- c:\windows\system32\oleaut32.dll 2011-06-15 20:15:08 739328 —-a-w- c:\windows\system32\inetcomm.dll 2011-06-15 20:15:06 214016 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys 2011-06-15 20:15:05 79872 —-a-w- c:\windows\system32\drivers\mrxsmb20.sys 2011-06-15 20:15:05 106496 —-a-w- c:\windows\system32\drivers\mrxsmb.sys 2011-06-15 20:15:02 2409784 —-a-w- c:\program files\windows mail\OESpamFilter.dat 2011-06-12 20:27:29 ——– d—–w- c:\program files\Sophos 2011-06-12 20:25:57 ——– d—–w- c:\programdata\Spybot - Search & Destroy 2011-06-12 20:25:57 ——– d—–w- c:\program files\Spybot - Search & Destroy 2011-06-11 01:53:07 3584 —-a-r- c:\users\tanja-pc\appdata\roaming\microsoft\installer\{121634b0-2f4b-11d3-ada3-00c04f52dd52}\Icon386ED4E3.exe 2011-06-11 01:53:07 ——– d—–w- c:\program files\Windows Installer Clean Up 2011-06-11 01:52:23 ——– d—–w- c:\program files\MSECACHE 2011-06-09 16:49:14 ——– d—–w- c:\program files\Emsisoft Anti-Malware 2011-06-08 20:57:13 ——– d—–w- c:\windows\pss 2011-06-08 18:50:13 ——– d—–w- c:\users\tanja-pc\appdata\local\VS Revo Group 2011-06-08 18:50:07 27192 —-a-w- c:\windows\system32\drivers\revoflt.sys 2011-06-08 18:50:05 ——– d—–w- c:\program files\VS Revo Group 2011-06-08 03:28:58 441176 —-a-w- c:\windows\system32\drivers\aswSnx.sys 2011-06-08 03:28:56 53592 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys 2011-06-08 03:28:28 40112 —-a-w- c:\windows\avastSS.scr 2011-06-08 03:27:53 ——– d—–w- c:\programdata\AVAST Software 2011-06-08 03:27:53 ——– d—–w- c:\program files\AVAST Software 2011-06-07 02:48:29 ——– d—–w- c:\program files\CCleaner 2011-06-07 02:40:13 189520 —-a-w- c:\windows\system32\drivers\tmcomm.sys 2011-06-06 18:48:45 ——– d—–w- c:\users\tanja-pc\appdata\roaming\Malwarebytes 2011-06-06 18:48:40 39984 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-06-06 18:48:39 ——– d—–w- c:\programdata\Malwarebytes 2011-06-06 18:48:36 22712 —-a-w- c:\windows\system32\drivers\mbam.sys 2011-06-06 18:48:36 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2011-05-26 03:45:56 ——– d—–w- c:\users\tanja-pc\appdata\roaming\GuardiansOfMagic 2011-05-25 10:19:22 ——– d—–w- c:\users\tanja-pc\appdata\local\Wild Tangent . ==================== Find3M ==================== . 2011-06-18 16:58:03 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-05-25 00:14:10 222080 ——w- c:\windows\system32\MpSigStub.exe 2008-11-12 14:59:16 774144 —-a-w- c:\program files\RngInterstitial.dll 2002-07-26 22:02:06 153088 ——w- c:\program files\UNWISE.EXE . ============= FINISH: 10:26:09.48 =============== I am not sure I did the attachment correctly. If not let me know . 📎New_Text_Document.txt I am still running the gmar scan. It is stuck in HP games and has been scanning all day. I started this at 10:30 this morning. I wondered if I should restart it? Or just wait.

patndoris

Post #4June 23, 2011, 10:43 PM UTC

Let's stop the GMER log and try a different scan. Scan time can vary based on the machine, but it shouldn't take that long.

Scan With RootKitUnHooker

Please choose one link and download Rootkit Unhooker and save it to your desktop.

Link 1
Link 2
Link 3
Now double-click on RKUnhookerLE.exe to run it.
Click the Report tab, then click Scan.
Check (Tick) Drivers and Stealth
Uncheck the rest. then click OK
When prompted to Select Disks for Scan, make sure C:/ is checked and click OK
Wait till the scanner has finished and then click File > Save Report.
Save the report somewhere where you can find it. Click Close.
Copy the entire contents of the report and paste it in your next reply.

Note** you may get the following warning, just click OK and continue.

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

farmgirl806

Post #5June 23, 2011, 11:07 PM UTC

here is the report. RkU Version: 3.8.389.593, Type LE (SR2) ============================================== OS Name: Windows Vista Version 6.0.6002 (Service Pack 2) Number of processors #2 ============================================== >Drivers ============================================== 0x8C208000 C:\Windows\system32\DRIVERS\igdkmd32.sys 7065600 bytes (Intel Corporation, Intel Graphics Kernel Mode Driver) 0x82000000 C:\Windows\system32\ntkrnlpa.exe 3907584 bytes (Microsoft Corporation, NT Kernel & System) 0x82000000 PnpManager 3907584 bytes 0x82000000 RAW 3907584 bytes 0x82000000 WMIxWDM 3907584 bytes 0x8D204000 C:\Windows\system32\drivers\RTKVHDA.sys 2322432 bytes (Realtek Semiconductor Corp., Realtek® High Definition Audio Function Driver) 0x94A40000 Win32k 2113536 bytes 0x94A40000 C:\Windows\System32\win32k.sys 2113536 bytes (Microsoft Corporation, Multi-User Win32 Driver) 0x87E0E000 C:\Windows\System32\Drivers\Ntfs.sys 1114112 bytes (Microsoft Corporation, NT File System Driver) 0x82671000 C:\Windows\system32\drivers\ndis.sys 1093632 bytes (Microsoft Corporation, NDIS 6.0 wrapper driver) 0x8CC03000 C:\Windows\system32\DRIVERS\HSX_DP.sys 1056768 bytes (Conexant Systems, Inc., HSF_DP driver) 0x87C03000 C:\Windows\System32\drivers\tcpip.sys 958464 bytes (Microsoft Corporation, TCP/IP Driver) 0x804D4000 C:\Windows\system32\CI.dll 917504 bytes (Microsoft Corporation, Code Integrity Module) 0xB0881000 C:\Windows\system32\drivers\peauth.sys 909312 bytes (Microsoft Corporation, Protected Environment Authentication and Authorization Export Driver) 0x8CD05000 C:\Windows\system32\DRIVERS\HSX_CNXT.sys 741376 bytes (Conexant Systems, Inc., HSF_CNXT driver) 0xAA20F000 C:\Windows\system32\drivers\spsys.sys 720896 bytes (Microsoft Corporation, security processor) 0x8C8C5000 C:\Windows\System32\drivers\dxgkrnl.sys 655360 bytes (Microsoft Corporation, DirectX Graphics Kernel) 0x8C971000 C:\Windows\system32\DRIVERS\HDAudBus.sys 577536 bytes (Microsoft Corporation, High Definition Audio Bus Driver) 0x8060A000 C:\Windows\system32\drivers\Wdf01000.sys 507904 bytes (Microsoft Corporation, WDF Dynamic) 0x82600000 C:\Windows\System32\Drivers\ksecdd.sys 462848 bytes (Microsoft Corporation, Kernel Security Support Provider Interface) 0x8D48D000 C:\Windows\System32\Drivers\aswSnx.SYS 458752 bytes (AVAST Software, avast! Virtualization Driver) 0x8040A000 C:\Windows\system32\mcupdate_GenuineIntel.dll 458752 bytes (Microsoft Corporation, Intel Microcode Update Library) 0xAA2E2000 C:\Windows\system32\drivers\HTTP.sys 446464 bytes (Microsoft Corporation, HTTP Protocol Stack) 0xB082E000 C:\Windows\System32\DRIVERS\srv.sys 323584 bytes (Microsoft Corporation, Server driver) 0x87D89000 C:\Windows\system32\DRIVERS\HSXHWBS2.sys 311296 bytes (Conexant Systems, Inc., HSF_HWB2 WDM driver) 0x8DA6A000 C:\Windows\System32\Drivers\aswSP.SYS 303104 bytes (AVAST Software, avast! self protection module) 0x8072F000 C:\Windows\System32\drivers\volmgrx.sys 303104 bytes (Microsoft Corporation, Volume Manager Extension Driver) 0x8CF4E000 C:\Windows\system32\drivers\afd.sys 294912 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock) 0x80693000 C:\Windows\system32\drivers\acpi.sys 286720 bytes (Microsoft Corporation, ACPI Driver for NT) 0x80493000 C:\Windows\system32\CLFS.SYS 266240 bytes (Microsoft Corporation, Common Log File System Driver) 0x8CE0B000 C:\Windows\system32\DRIVERS\storport.sys 266240 bytes (Microsoft Corporation, Microsoft Storage Port Driver) 0x87D3C000 C:\Windows\system32\DRIVERS\USBPORT.SYS 253952 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver) 0x8DA0D000 C:\Windows\system32\DRIVERS\rdbss.sys 245760 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver) 0x827A7000 C:\Windows\system32\drivers\NETIO.SYS 241664 bytes (Microsoft Corporation, Network I/O Subsystem) 0x8DAF3000 C:\Windows\system32\DRIVERS\udfs.sys 241664 bytes (Microsoft Corporation, UDF File System Driver) 0x8DBC5000 C:\Windows\system32\DRIVERS\mrxsmb10.sys 233472 bytes (Microsoft Corporation, Longhorn SMB Downlevel SubRdr) 0x87F1E000 C:\Windows\system32\drivers\volsnap.sys 233472 bytes (Microsoft Corporation, Volume Shadow Copy Driver) 0x8DB82000 C:\Windows\system32\drivers\aswMonFlt.sys 229376 bytes (AVAST Software, avast! File System Minifilter for Windows 2003/Vista) 0x8CF08000 C:\Windows\system32\DRIVERS\usbhub.sys 217088 bytes (Microsoft Corporation, Default Hub Driver for USB) 0x823BA000 ACPI_HAL 208896 bytes 0x823BA000 C:\Windows\system32\hal.dll 208896 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL) 0x807C4000 C:\Windows\system32\drivers\fltmgr.sys 204800 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager) 0x8D593000 C:\Windows\System32\DRIVERS\netbt.sys 204800 bytes (Microsoft Corporation, MBT Transport driver) 0x805C4000 C:\Windows\system32\DRIVERS\msiscsi.sys 192512 bytes (Microsoft Corporation, Microsoft iSCSI Initiator Driver) 0x8D43B000 C:\Windows\system32\drivers\portcls.sys 184320 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices)) 0x8277C000 C:\Windows\system32\drivers\msrpc.sys 176128 bytes (Microsoft Corporation, Kernel Remote Procedure Call Provider) 0x87DD5000 C:\Windows\system32\DRIVERS\ks.sys 172032 bytes (Microsoft Corporation, Kernel CSA Library) 0xB0806000 C:\Windows\System32\DRIVERS\srv2.sys 163840 bytes (Microsoft Corporation, Smb 2.0 Server driver) 0x87F6E000 C:\Windows\System32\drivers\ecache.sys 159744 bytes (Microsoft Corporation, Special Memory Device Cache) 0x806EA000 C:\Windows\system32\drivers\pci.sys 159744 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator) 0x8D468000 C:\Windows\system32\drivers\drmk.sys 151552 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter) 0x8CE79000 C:\Windows\system32\DRIVERS\ndiswan.sys 143360 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption)) 0x8CFB7000 C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys 139264 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASKUTIL.SYS) 0x87FA6000 C:\Windows\system32\drivers\CLASSPNP.SYS 135168 bytes (Microsoft Corporation, SCSI Class System Dll) 0xAA39A000 C:\Windows\system32\drivers\mrxdav.sys 135168 bytes (Microsoft Corporation, Windows NT WebDav Minirdr) 0x8D520000 C:\Windows\System32\drivers\VIDEOPRT.SYS 135168 bytes (Microsoft Corporation, Video Port Driver) 0xAA3BB000 C:\Windows\system32\DRIVERS\mrxsmb.sys 126976 bytes (Microsoft Corporation, Windows NT SMB Minirdr) 0x807A6000 C:\Windows\system32\drivers\ataport.SYS 122880 bytes (Microsoft Corporation, ATAPI Driver Extension) 0xAA34F000 C:\Windows\System32\DRIVERS\srvnet.sys 118784 bytes (Microsoft Corporation, Server Network driver) 0x87CED000 C:\Windows\System32\drivers\fwpkclnt.sys 110592 bytes (Microsoft Corporation, FWP/IPsec Kernel-Mode API) 0x8DB67000 C:\Windows\system32\drivers\luafv.sys 110592 bytes (Microsoft Corporation, LUA File Virtualization Filter Driver) 0x87D17000 C:\Windows\system32\DRIVERS\Rtlh86.sys 106496 bytes (Realtek Corporation , Realtek 8101E/8168/8169 NDIS6 32-bit Driver ) 0xAA36C000 C:\Windows\system32\DRIVERS\bowser.sys 102400 bytes (Microsoft Corporation, NT Lan Manager Datagram Receiver Driver) 0xB09A4000 C:\Users\Tanja-PC\AppData\Local\Temp\kwlorkow.sys 102400 bytes 0x8CDE5000 C:\Windows\system32\DRIVERS\cdrom.sys 98304 bytes (Microsoft Corporation, SCSI CD-ROM Driver) 0xAA3DA000 C:\Windows\system32\DRIVERS\mrxsmb20.sys 98304 bytes (Microsoft Corporation, Longhorn SMB 2.0 Redirector) 0x8DA53000 C:\Windows\System32\Drivers\dfsc.sys 94208 bytes (Microsoft Corporation, DFS Namespace Client Driver) 0x8CE57000 C:\Windows\system32\DRIVERS\rasl2tp.sys 94208 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver) 0x8D5DE000 C:\Windows\system32\DRIVERS\pacer.sys 90112 bytes (Microsoft Corporation, QoS Packet Scheduler) 0x8D573000 C:\Windows\system32\DRIVERS\tdx.sys 90112 bytes (Microsoft Corporation, TDI Translation Driver) 0xAA385000 C:\Windows\System32\drivers\mpsdrv.sys 86016 bytes (Microsoft Corporation, Microsoft Protection Service Driver) 0x8CEBF000 C:\Windows\system32\DRIVERS\rassstp.sys 86016 bytes (Microsoft Corporation, RAS SSTP Miniport Call Manager) 0x8DADE000 C:\Windows\system32\DRIVERS\USBSTOR.SYS 86016 bytes (Microsoft Corporation, USB Mass Storage Class Driver) 0xB0975000 C:\Windows\system32\DRIVERS\WUDFRd.sys 86016 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Reflector) 0x8CEAB000 C:\Windows\system32\DRIVERS\raspptp.sys 81920 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol) 0x8D5C5000 C:\Windows\system32\DRIVERS\smb.sys 81920 bytes (Microsoft Corporation, SMB Transport driver) 0x8CDC7000 C:\Windows\system32\DRIVERS\i8042prt.sys 77824 bytes (Microsoft Corporation, i8042 Port Driver) 0xAA2CF000 C:\Windows\system32\DRIVERS\rspndr.sys 77824 bytes (Microsoft Corporation, Link-Layer Topology Responder Driver for NDIS 6) 0x8CFA4000 C:\Windows\system32\DRIVERS\wanarp.sys 77824 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver) 0xB098A000 C:\Windows\system32\DRIVERS\WUDFPf.sys 73728 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver) 0x87F95000 C:\Windows\system32\drivers\disk.sys 69632 bytes (Microsoft Corporation, PnP Disk Driver) 0x8CF3D000 C:\Windows\System32\Drivers\NDProxy.SYS 69632 bytes (Microsoft Corporation, NDIS Proxy) 0x8047A000 C:\Windows\system32\PSHED.dll 69632 bytes (Microsoft Corporation, Platform Specific Hardware Error Driver) 0x805B4000 C:\Windows\system32\drivers\fileinfo.sys 65536 bytes (Microsoft Corporation, FileInfo Filter Driver) 0x8DABD000 C:\Windows\system32\DRIVERS\HIDCLASS.SYS 65536 bytes (Microsoft Corporation, Hid Class Library) 0xAA2BF000 C:\Windows\system32\DRIVERS\lltdio.sys 65536 bytes (Microsoft Corporation, Link-Layer Topology Mapper I/O Driver) 0x8078E000 C:\Windows\System32\drivers\mountmgr.sys 65536 bytes (Microsoft Corporation, Mount Point Manager) 0x8CED4000 C:\Windows\system32\DRIVERS\termdd.sys 65536 bytes (Microsoft Corporation, Terminal Server Driver) 0x87D08000 C:\Windows\system32\DRIVERS\intelppm.sys 61440 bytes (Microsoft Corporation, Processor Device Driver) 0x8DB58000 C:\Windows\system32\DRIVERS\monitor.sys 61440 bytes (Microsoft Corporation, Monitor Driver) 0x87F5F000 C:\Windows\System32\Drivers\mup.sys 61440 bytes (Microsoft Corporation, Multiple UNC Provider driver) 0x80711000 C:\Windows\System32\drivers\partmgr.sys 61440 bytes (Microsoft Corporation, Partition Management Driver) 0x8CE9C000 C:\Windows\system32\DRIVERS\raspppoe.sys 61440 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver) 0x87D7A000 C:\Windows\system32\DRIVERS\usbehci.sys 61440 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver) 0x80720000 C:\Windows\system32\drivers\volmgr.sys 61440 bytes (Microsoft Corporation, Volume Manager Driver) 0x94C80000 C:\Windows\System32\cdd.dll 57344 bytes (Microsoft Corporation, Canonical Display Driver) 0x8CF96000 C:\Windows\system32\DRIVERS\netbios.sys 57344 bytes (Microsoft Corporation, NetBIOS interface driver) 0x8D55C000 C:\Windows\System32\Drivers\Npfs.SYS 57344 bytes (Microsoft Corporation, NPFS Driver) 0x80780000 C:\Windows\system32\drivers\PCIIDEX.SYS 57344 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension) 0x8DB2E000 C:\Windows\System32\Drivers\crashdmp.sys 53248 bytes (Microsoft Corporation, Crash Dump Driver) 0x8CDBA000 C:\Windows\system32\drivers\modem.sys 53248 bytes (Microsoft Corporation, Modem Device Driver) 0x8CEFB000 C:\Windows\system32\DRIVERS\umbus.sys 53248 bytes (Microsoft Corporation, User-Mode Bus Enumerator) 0x80686000 C:\Windows\system32\drivers\WDFLDR.SYS 53248 bytes (Microsoft Corporation, WDFLDR) 0xB0969000 C:\Windows\System32\drivers\tcpipreg.sys 49152 bytes (Microsoft Corporation, TCP/IP Registry Compatibility Driver) 0x8D514000 C:\Windows\System32\drivers\vga.sys 49152 bytes (Microsoft Corporation, VGA/Super VGA Video Driver) 0x8C965000 C:\Windows\System32\drivers\watchdog.sys 49152 bytes (Microsoft Corporation, Watchdog Driver) 0x8DB3B000 C:\Windows\System32\Drivers\dump_dumpata.sys 45056 bytes 0x8CDDA000 C:\Windows\system32\DRIVERS\kbdclass.sys 45056 bytes (Microsoft Corporation, Keyboard Class Driver) 0x8CEE4000 C:\Windows\system32\DRIVERS\mouclass.sys 45056 bytes (Microsoft Corporation, Mouse Class Driver) 0x8D551000 C:\Windows\System32\Drivers\Msfs.SYS 45056 bytes (Microsoft Corporation, Mailslot driver) 0x8CE6E000 C:\Windows\system32\DRIVERS\ndistapi.sys 45056 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver) 0x8CE4C000 C:\Windows\system32\DRIVERS\TDI.SYS 45056 bytes (Microsoft Corporation, TDI Wrapper) 0x87FF0000 C:\Windows\system32\DRIVERS\tunnel.sys 45056 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver) 0x87D31000 C:\Windows\system32\DRIVERS\usbuhci.sys 45056 bytes (Microsoft Corporation, UHCI USB Miniport Driver) 0x8D589000 C:\Windows\System32\Drivers\aswTdi.SYS 40960 bytes (AVAST Software, avast! TDI Filter Driver) 0x8DB4E000 C:\Windows\System32\drivers\Dxapi.sys 40960 bytes (Microsoft Corporation, DirectX API Driver) 0x8CEF1000 C:\Windows\system32\DRIVERS\mssmbios.sys 40960 bytes (Microsoft Corporation, System Management BIOS Driver) 0x8DA49000 C:\Windows\system32\drivers\nsiproxy.sys 40960 bytes (Microsoft Corporation, NSI Proxy) 0xB095F000 C:\Windows\System32\Drivers\secdrv.SYS 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver) 0xB09BD000 C:\Windows\System32\Drivers\BlackBox.SYS 36864 bytes (RKU Driver) 0x87FC7000 C:\Windows\system32\drivers\crcdisk.sys 36864 bytes (Microsoft Corporation, Disk Block Verification Filter Driver) 0x8D4FD000 C:\Windows\System32\Drivers\Fs_Rec.SYS 36864 bytes (Microsoft Corporation, File System Recognizer Driver) 0x8DAB4000 C:\Windows\system32\DRIVERS\hidusb.sys 36864 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices) 0x8D56A000 C:\Windows\System32\DRIVERS\rasacd.sys 36864 bytes (Microsoft Corporation, RAS Automatic Connection Driver) 0x94C60000 C:\Windows\System32\TSDDD.dll 36864 bytes (Microsoft Corporation, Framebuffer Display Driver) 0x87E00000 C:\Windows\system32\DRIVERS\tunmp.sys 36864 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver) 0x806D9000 C:\Windows\system32\drivers\WMILIB.SYS 36864 bytes (Microsoft Corporation, WMILIB WMI support library Dll) 0x8079E000 C:\Windows\system32\drivers\atapi.sys 32768 bytes (Microsoft Corporation, ATAPI IDE Miniport Driver) 0x8048B000 C:\Windows\system32\BOOTVID.dll 32768 bytes (Microsoft Corporation, VGA Boot Driver) 0x8DB46000 C:\Windows\System32\Drivers\dump_atapi.sys 32768 bytes 0x8DAD6000 C:\Windows\system32\DRIVERS\mouhid.sys 32768 bytes (Microsoft Corporation, HID Mouse Filter Driver) 0x806E2000 C:\Windows\system32\drivers\msisadrv.sys 32768 bytes (Microsoft Corporation, ISA Driver) 0x8D541000 C:\Windows\System32\DRIVERS\RDPCDD.sys 32768 bytes (Microsoft Corporation, RDP Miniport) 0x8D549000 C:\Windows\system32\drivers\rdpencdd.sys 32768 bytes (Microsoft Corporation, RDP Miniport) 0x87F57000 C:\Windows\System32\Drivers\spldr.sys 32768 bytes (Microsoft Corporation, loader for security processor) 0xB099C000 C:\Windows\system32\DRIVERS\xaudio.sys 32768 bytes (Conexant Systems, Inc., Modem Audio Device Driver) 0x8D50D000 C:\Windows\System32\Drivers\Beep.SYS 28672 bytes (Microsoft Corporation, BEEP Driver) 0x8DACD000 C:\Windows\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library) 0x80779000 C:\Windows\system32\drivers\intelide.sys 28672 bytes (Microsoft Corporation, Intel PCI IDE Driver) 0x80403000 C:\Windows\system32\kdcom.dll 28672 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL) 0x8D506000 C:\Windows\System32\Drivers\Null.SYS 28672 bytes (Microsoft Corporation, NULL Driver) 0x8D5F4000 C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS 24576 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASDIFSV.SYS) 0x8D5D9000 C:\Windows\System32\Drivers\aswRdr.SYS 20480 bytes (AVAST Software, avast! TDI RDR Driver) 0xB087D000 C:\Windows\system32\DRIVERS\mdmxsdk.sys 16384 bytes (Conexant, Diagnostic Interface x86 Driver) 0x8DBBA000 C:\Windows\System32\Drivers\aswFsBlk.SYS 12288 bytes (AVAST Software, avast! File System Access Blocking Driver) 0x8CEEF000 C:\Windows\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator) 0x8DAD4000 C:\Windows\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver) ============================================== >Stealth ==============================================

patndoris

Post #6June 23, 2011, 11:24 PM UTC

You've done a good job clearing malware from the machine

We do have a few more tasks to clean a few items (including that toolbar you mentioned you want to remove) and to double check nothing is hiding in any other places.

Download OTL to your desktop.

Run OTL.exe by right-clicking and choosing Run as Administrator on the icon.

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services
:OTL
O2 - BHO: Playfin Games Toolbar - {6905e4b1-afef-4444-85a9-ecb16c048784} - C:\Program Files\playfingamestoolbar\vmntemplateX.dll
O2 - BHO: (no name) - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - (no file)
O3 - Toolbar: Playfin Games Toolbar - {6905e4b1-afef-4444-85a9-ecb16c048784} - C:\Program Files\playfingamestoolbar\vmntemplateX.dll
O9 - Extra button: Go to PlaySushi web site - {EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - (no file)
O2 - BHO: Free Ride Games Toolbar - {f92a9fe4-2850-4198-b9d5-279880e49b16} - C:\Program Files\Free_Ride_Games\tbFree.dll
O3 - Toolbar: Free Ride Games Toolbar - {f92a9fe4-2850-4198-b9d5-279880e49b16} - C:\Program Files\Free_Ride_Games\tbFree.dll

:Commands
[purity]
[emptytemp]
[emptyflash]
[createrestorepoint]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post the resulting OTL log

There are still a lot of toolbars on this machine. While they are not malware in and of themselves, they may slow down the browser. It would be advisable to remove any that your friend doesn't use regularly to help improve the browsing experience.

I see you have Malwarebytes already on your machine. Please run it by right-clicking and choosing Run as Administrator on the icon on the desktop.

Click on the tab labeled Update and then click on the button Check for updates.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
[external image: Posted Image]
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

Update Adobe Reader
There have been updates to Adobe Reader to address security vulnerabilities. You should download the latest version from the Adobe website.

Download TFC to your desktop

Close any open windows.
Double click the TFC icon to run the program
TFC will close all open programs itself in order to run,
Click the Start button to begin the process.
Allow TFC to run uninterrupted.
The program should not take long to finish it's job
Once its finished it should automatically reboot your machine,
if it doesn't, manually reboot to ensure a complete clean

This scan make take awhile depending on how many items are on the computer. You may want to run it at a time you won't be needing the machine. It should be run from IE and I'd recommend not doing anything else while it's running.

http://www.eset.eu/online-scanner
Go here to run an online scannner from ESET.
Click the green ESET Online Scanner button.
Read the End User License Agreement and check the box: YES, I accept the Terms of Use.
Click on the Start button next to it.
You may receive an alert on the address bar that "This site might require the following ActiveX control…Click here to install…". Click on that alert and then click Insall ActiveX component.
A new window will appear asking "Do you want to install this software?"".
Answer Yes to download and install the ActiveX controls that allows the scan to run.
Click Start.
Uncheck Remove found threats.
Click Scan to begin.
If offered the option to get information or buy software. Just close the window.
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
Copy and paste that log as a reply to this topic.

farmgirl806

Post #7June 24, 2011, 12:24 AM UTC

Thanks for the compliment but I don't hold a candle to your ability. I agree with you about all the toolbars. I think I can get rid of them. I believe I will tell my friend that she can only play games where they do not require a toolbar. She could not possibly play all these anyway. I also want to say that in my first post I mentioned the computer was waking up all the time on its own. I believe I have found the reason. I changed the settings in network. Lan was waking it up. So that I think is ok.

Here is the log OTL. I will do malwarebytes now.

OTL logfile created on: 6/23/2011 7:04:31 PM - Run 1
OTL by OldTimer - Version 3.2.24.1 Folder = c:\Users\Tanja-PC\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.18 Gb Available Physical Memory | 59.26% Memory free
4.22 Gb Paging File | 3.20 Gb Available in Paging File | 75.79% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 326.00 Gb Total Space | 210.67 Gb Free Space | 64.62% Space Free | Partition Type: NTFS
Drive D: | 9.35 Gb Total Space | 0.99 Gb Free Space | 10.59% Space Free | Partition Type: NTFS
Drive E: | 111.76 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: TANJA-PC-PC | User Name: Tanja-PC | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/06/23 18:47:48 | 000,579,072 | —- | M] (OldTimer Tools) – c:\Users\Tanja-PC\Desktop\OTL.exe
PRC - [2011/06/18 11:58:03 | 000,240,288 | —- | M] (Adobe Systems, Inc.) – C:\Windows\System32\Macromed\Flash\FlashUtil10t_ActiveX.exe
PRC - [2011/06/10 19:56:57 | 002,424,192 | —- | M] (SUPERAntiSpyware.com) – C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
PRC - [2011/05/20 20:20:58 | 000,167,936 | —- | M] (iBryte) – C:\Program Files\iBryte\playbryte\iBryteDesktop.exe
PRC - [2011/05/10 07:10:58 | 003,459,712 | —- | M] (AVAST Software) – C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2009/04/11 01:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2008/06/05 17:06:32 | 000,125,208 | —- | M] (Yahoo! Inc.) – C:\Program Files\Yahoo!\Common\YMailAdvisor.exe
PRC - [2007/10/25 08:52:08 | 004,702,208 | —- | M] (Realtek Semiconductor) – C:\Windows\RtHDVCpl.exe
PRC - [2007/04/18 10:01:34 | 000,065,536 | —- | M] (Hewlett-Packard Company) – C:\hp\support\hpsysdrv.exe

========== Modules (SafeList) ==========

MOD - [2011/06/23 18:47:48 | 000,579,072 | —- | M] (OldTimer Tools) – c:\Users\Tanja-PC\Desktop\OTL.exe
MOD - [2011/05/10 07:10:55 | 000,199,792 | —- | M] (AVAST Software) – C:\Program Files\AVAST Software\Avast\snxhk.dll
MOD - [2010/08/31 10:43:52 | 001,686,016 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - [2011/06/09 08:21:44 | 002,978,720 | —- | M] (Emsi Software GmbH) [Auto | Running] – C:\Program Files\Emsisoft Anti-Malware\a2service.exe – (a2AntiMalware)
SRV - [2011/05/10 07:10:57 | 000,042,184 | —- | M] (AVAST Software) [Auto | Running] – C:\Program Files\AVAST Software\Avast\AvastSvc.exe – (avast! Antivirus)
SRV - [2010/10/12 12:59:12 | 000,206,072 | —- | M] (WildTangent, Inc.) [On_Demand | Stopped] – C:\Program Files\WildTangent Games\App\GamesAppService.exe – (GamesAppService)
SRV - [2009/08/24 06:36:45 | 000,377,344 | —- | M] (Microsoft Corporation) [On_Demand | Running] – winhttp.dll – (WinHttpAutoProxySvc)
SRV - [2008/11/09 15:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) [Auto | Running] – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe – (YahooAUService)
SRV - [2008/01/19 02:38:24 | 000,272,952 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)

========== Driver Services (SafeList) ==========

DRV - [2011/05/29 09:11:30 | 000,039,984 | —- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mbamswissarmy.sys – (MBAMSwissArmy)
DRV - [2011/05/10 07:03:54 | 000,441,176 | —- | M] (AVAST Software) [File_System | System | Running] – C:\Windows\System32\drivers\aswSnx.sys – (aswSnx)
DRV - [2011/05/10 07:03:44 | 000,307,928 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\Windows\System32\drivers\aswSP.sys – (aswSP)
DRV - [2011/05/10 07:02:37 | 000,049,240 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\Windows\System32\drivers\aswTdi.sys – (aswTdi)
DRV - [2011/05/10 06:59:56 | 000,025,432 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\Windows\System32\drivers\aswRdr.sys – (aswRdr)
DRV - [2011/05/10 06:59:44 | 000,053,592 | —- | M] (AVAST Software) [File_System | Auto | Running] – C:\Windows\System32\drivers\aswMonFlt.sys – (aswMonFlt)
DRV - [2011/05/10 06:59:35 | 000,019,544 | —- | M] (AVAST Software) [File_System | Auto | Running] – C:\Windows\System32\drivers\aswFsBlk.sys – (aswFsBlk)
DRV - [2011/02/20 21:30:06 | 000,073,728 | —- | M] (Emsi Software GmbH) [File_System | On_Demand | Stopped] – C:\Program Files\Emsisoft Anti-Malware\a2accx86.sys – (a2acc)
DRV - [2010/06/20 18:56:32 | 000,067,656 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS – (SASKUTIL)
DRV - [2010/02/18 18:30:02 | 000,012,872 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS – (SASDIFSV)
DRV - [2010/02/18 18:30:02 | 000,012,872 | —- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Stopped] – C:\Program Files\SUPERAntiSpyware\SASENUM.SYS – (SASENUM)
DRV - [2009/12/30 11:21:18 | 000,027,192 | —- | M] (VS Revo Group) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\revoflt.sys – (Revoflt)
DRV - [2008/05/08 05:05:18 | 000,266,752 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\HSXHWBS2.sys – (HSXHWBS2)
DRV - [2008/05/08 05:03:18 | 000,980,992 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\HSX_DP.sys – (HSF_DP)
DRV - [2007/10/18 07:36:54 | 000,008,704 | —- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] – C:\Windows\System32\drivers\XAudio.sys – (XAudio)
DRV - [2007/08/03 05:44:00 | 000,091,648 | —- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\Rtlh86.sys – (RTL8169)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
IE - HKLM\..\URLSearchHook: {f92a9fe4-2850-4198-b9d5-279880e49b16} - C:\Program Files\Free_Ride_Games\tbFree.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?fr=ffsp1&p;="
FF - prefs.js..browser.search.selectedEngine: "Yahoo!"
FF - prefs.js..browser.startup.homepage: "http://www.ask.com/?o=20011&l;=dis"
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=ffds1&p;="

[2010/04/19 14:21:22 | 000,000,000 | —D | M] (No name found) – C:\Users\Tanja-PC\AppData\Roaming\Mozilla\Extensions
[2011/06/06 13:52:23 | 000,000,000 | —D | M] (No name found) – C:\Users\Tanja-PC\AppData\Roaming\Mozilla\Firefox\Profiles\qjslwjvr.default\extensions
[2008/10/20 08:29:13 | 000,000,000 | —D | M] (No name found) – C:\Users\Tanja-PC\AppData\Roaming\Mozilla\Firefox\Profiles\qjslwjvr.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2009/08/20 00:10:47 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Tanja-PC\AppData\Roaming\Mozilla\Firefox\Profiles\qjslwjvr.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/05/20 20:20:49 | 000,000,000 | —D | M] (ShopToWin12) – C:\Users\Tanja-PC\AppData\Roaming\Mozilla\Firefox\Profiles\qjslwjvr.default\extensions\{70263cf9-d46a-4be4-adc6-29500ba884e1}
[2009/10/19 23:14:06 | 000,000,000 | —D | M] ("Ask Toolbar for Firefox") – C:\Users\Tanja-PC\AppData\Roaming\Mozilla\Firefox\Profiles\qjslwjvr.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
[2011/06/12 18:14:03 | 000,000,000 | —D | M] (No name found) – C:\Users\Tanja-PC\AppData\Roaming\Mozilla\Firefox\Profiles\qjslwjvr.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
[2011/05/20 20:20:59 | 000,000,000 | —D | M] (PlayBryte) – C:\Users\Tanja-PC\AppData\Roaming\Mozilla\Firefox\Profiles\qjslwjvr.default\extensions\[removed]
[2008/10/20 08:29:13 | 000,000,000 | —D | M] (No name found) – C:\Users\Tanja-PC\AppData\Roaming\Mozilla\Firefox\Profiles\qjslwjvr.default\extensions\staged-xpis
[2011/05/12 19:46:51 | 000,000,000 | —D | M] ("ArcadeWeb") – C:\Users\Tanja-PC\AppData\Roaming\Mozilla\Firefox\Profiles\qjslwjvr.default\extensions\[removed]
[2011/06/12 18:13:53 | 000,000,000 | —D | M] (No name found) – C:\Users\Tanja-PC\AppData\Roaming\Mozilla\Firefox\Profiles\qjslwjvr.default\extensions\[removed]
[2010/05/26 15:18:50 | 000,002,333 | —- | M] () – C:\Users\Tanja-PC\AppData\Roaming\Mozilla\Firefox\Profiles\qjslwjvr.default\searchplugins\askcom.xml
[2011/05/20 20:20:58 | 000,002,230 | —- | M] () – C:\Users\Tanja-PC\AppData\Roaming\Mozilla\Firefox\Profiles\qjslwjvr.default\searchplugins\iBryte_playbryte.xml
[2010/04/29 04:50:51 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2008/11/12 10:00:28 | 000,000,000 | —D | M] (Seekeen) – C:\Program Files\Mozilla Firefox\extensions\{DB390D2E-0FB4-413F-B039-AE342D1D40BA}
[2010/03/12 17:28:47 | 000,000,000 | —D | M] (Free Ride Games Toolbar) – C:\Program Files\Mozilla Firefox\extensions\{f92a9fe4-2850-4198-b9d5-279880e49b16}
[2008/06/18 02:43:04 | 000,086,016 | —- | M] (Coupons, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
[2009/03/30 17:13:54 | 000,098,304 | —- | M] (RealNetworks) – C:\Program Files\Mozilla Firefox\plugins\npraclient.dll
[2005/04/27 15:10:49 | 000,102,400 | —- | M] (RealNetworks) – C:\Program Files\Mozilla Firefox\plugins\npracplug.dll
[2009/07/02 11:19:28 | 000,102,400 | —- | M] (Zylom) – C:\Program Files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
[2008/11/12 10:00:26 | 000,002,386 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\seekeen.xml
[2009/04/07 13:59:38 | 000,000,872 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\Yahooober15672203.gif
[2010/07/26 19:34:27 | 000,000,199 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\Yahooober15672203.src

O1 HOSTS File: ([2006/09/18 16:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Shop to Win 12) - {1F44B5B5-7976-4378-9A7F-FE6435E9660F} - C:\Program Files\Shop to Win 12\Shop to Win 12.dll (Shop To Win, LLC)
O2 - BHO: (no name) - {399C60D2-38B1-4E25-B9E7-6498C1BC2DCD} - No CLSID value found.
O2 - BHO: (PlayBryte BHO) - {61e0ef7a-9bc0-45ea-9b2f-f3e9f02692bd} - mscoree.dll (Microsoft Corporation)
O2 - BHO: (Playfin Games Toolbar) - {6905e4b1-afef-4444-85a9-ecb16c048784} - C:\Program Files\playfingamestoolbar\vmntemplateX.dll ()
O2 - BHO: (ArcadeWeb Class) - {78919608-B066-4B5A-B248-38E12A783E05} - C:\Program Files\ArcadeWeb\arcadeweb32.dll (ArcadeWeb LLC)
O2 - BHO: (no name) - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - No CLSID value found.
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found.
O2 - BHO: (Free Ride Games Toolbar) - {f92a9fe4-2850-4198-b9d5-279880e49b16} - C:\Program Files\Free_Ride_Games\tbFree.dll (Conduit Ltd.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Playfin Games Toolbar) - {6905e4b1-afef-4444-85a9-ecb16c048784} - C:\Program Files\playfingamestoolbar\vmntemplateX.dll ()
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (PlayBryte Toolbar) - {b278d9f8-0fa9-465e-9938-0c392605d8e3} - mscoree.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (no name) - {C53FE659-316A-4F56-A194-A5BE491BE866} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (Free Ride Games Toolbar) - {f92a9fe4-2850-4198-b9d5-279880e49b16} - C:\Program Files\Free_Ride_Games\tbFree.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C53FE659-316A-4F56-A194-A5BE491BE866} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D0523BB4-21E7-11DD-9AB7-415B56D89593} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Free Ride Games Toolbar) - {F92A9FE4-2850-4198-B9D5-279880E49B16} - C:\Program Files\Free_Ride_Games\tbFree.dll (Conduit Ltd.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [iBryte playbryte Desktop] C:\Program Files\iBryte\playbryte\iBryteDesktop.exe (iBryte)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [YMailAdvisor] C:\Program Files\Yahoo!\Common\YMailAdvisor.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - HKCU..\RunOnce: [Shockwave Updater] File not found
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll (Google Inc.)
O9 - Extra Button: Go to PlaySushi web site - {EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - Reg Error: Key error. File not found
O13 - gopher Prefix: missing
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files/Exorcist/Images/stg_drm.ocx (SpinTop DRM Control)
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img14.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img14.jpg
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O29 - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/12/08 16:22:02 | 000,000,074 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{05a99047-80ef-11dd-9459-001e8c4e4d02}\Shell - "" = AutoRun
O33 - MountPoints2\{05a99047-80ef-11dd-9459-001e8c4e4d02}\Shell\AutoRun\command - "" = J:\Imageviewer.exe
O33 - MountPoints2\{9880dcb8-58c5-11dd-bf03-001e8c4e4d02}\Shell\AutoRun\command - "" = J:\setupSNK.exe
O33 - MountPoints2\{a550a9b0-58c4-11dd-91e8-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{a550a9b0-58c4-11dd-91e8-806e6f6e6963}\Shell\AutoRun\command - "" = E:\setup.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/06/23 18:47:48 | 000,579,072 | —- | C] (OldTimer Tools) – C:\Users\Tanja-PC\Desktop\OTL.exe
[2011/06/23 10:49:54 | 000,000,000 | —D | C] – C:\Users\Tanja-PC\Desktop\gmer
[2011/06/18 11:45:34 | 000,000,000 | —D | C] – C:\Users\Tanja-PC\Documents\backups
[2011/06/16 03:01:42 | 002,382,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/06/16 03:01:40 | 001,797,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript9.dll
[2011/06/16 03:01:40 | 000,716,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript.dll
[2011/06/16 03:01:40 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/06/12 15:27:30 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos
[2011/06/12 15:27:29 | 000,000,000 | —D | C] – C:\Program Files\Sophos
[2011/06/12 15:26:01 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2011/06/12 15:25:57 | 000,000,000 | —D | C] – C:\ProgramData\Spybot - Search & Destroy
[2011/06/12 15:25:57 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2011/06/10 21:01:35 | 000,000,000 | R–D | C] – C:\Users\Tanja-PC\Desktop\Fix it
[2011/06/10 20:53:07 | 000,000,000 | —D | C] – C:\Program Files\Windows Installer Clean Up
[2011/06/10 20:52:23 | 000,000,000 | —D | C] – C:\Program Files\MSECACHE
[2011/06/09 11:49:37 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
[2011/06/09 11:49:14 | 000,000,000 | —D | C] – C:\Program Files\Emsisoft Anti-Malware
[2011/06/09 11:49:14 | 000,000,000 | —D | C] – C:\Users\Tanja-PC\Documents\Anti-Malware
[2011/06/08 21:58:51 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\Tanja-PC\Desktop\HijackThis.exe
[2011/06/08 15:57:13 | 000,000,000 | —D | C] – C:\Windows\pss
[2011/06/08 13:50:13 | 000,000,000 | —D | C] – C:\Users\Tanja-PC\AppData\Local\VS Revo Group
[2011/06/08 13:50:08 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro
[2011/06/08 13:50:07 | 000,027,192 | —- | C] (VS Revo Group) – C:\Windows\System32\drivers\revoflt.sys
[2011/06/08 13:50:05 | 000,000,000 | —D | C] – C:\Program Files\VS Revo Group
[2011/06/07 22:29:07 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2011/06/07 22:29:06 | 000,019,544 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswFsBlk.sys
[2011/06/07 22:29:05 | 000,307,928 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswSP.sys
[2011/06/07 22:29:01 | 000,025,432 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswRdr.sys
[2011/06/07 22:28:59 | 000,049,240 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswTdi.sys
[2011/06/07 22:28:58 | 000,441,176 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswSnx.sys
[2011/06/07 22:28:56 | 000,053,592 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswMonFlt.sys
[2011/06/07 22:28:28 | 000,199,304 | —- | C] (AVAST Software) – C:\Windows\System32\aswBoot.exe
[2011/06/07 22:28:28 | 000,040,112 | —- | C] (AVAST Software) – C:\Windows\avastSS.scr
[2011/06/07 22:27:53 | 000,000,000 | —D | C] – C:\ProgramData\AVAST Software
[2011/06/07 22:27:53 | 000,000,000 | —D | C] – C:\Program Files\AVAST Software
[2011/06/06 21:48:29 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2011/06/06 21:40:13 | 000,189,520 | —- | C] (Trend Micro Inc.) – C:\Windows\System32\drivers\tmcomm.sys
[2011/06/06 13:48:45 | 000,000,000 | —D | C] – C:\Users\Tanja-PC\AppData\Roaming\Malwarebytes
[2011/06/06 13:48:40 | 000,039,984 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/06/06 13:48:40 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/06/06 13:48:39 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011/06/06 13:48:36 | 000,022,712 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2011/06/06 13:48:36 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/05/25 22:45:56 | 000,000,000 | —D | C] – C:\Users\Tanja-PC\AppData\Roaming\GuardiansOfMagic
[2011/05/25 05:19:22 | 000,000,000 | —D | C] – C:\Users\Tanja-PC\AppData\Local\Wild Tangent
[2008/11/12 09:59:21 | 000,774,144 | —- | C] (RealNetworks, Inc.) – C:\Program Files\RngInterstitial.dll

========== Files - Modified Within 30 Days ==========

[2011/06/23 19:00:00 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/23 19:00:00 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/23 18:57:58 | 000,604,264 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/06/23 18:57:58 | 000,103,964 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/06/23 18:52:39 | 000,003,696 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/06/23 18:52:38 | 000,003,696 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/06/23 18:52:28 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/06/23 18:47:48 | 000,579,072 | —- | M] (OldTimer Tools) – C:\Users\Tanja-PC\Desktop\OTL.exe
[2011/06/23 10:49:40 | 000,293,977 | —- | M] () – C:\Users\Tanja-PC\Desktop\gmer.zip
[2011/06/20 09:42:22 | 252,469,762 | —- | M] () – C:\Windows\MEMORY.DMP
[2011/06/18 11:58:03 | 000,404,640 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/06/18 11:51:55 | 000,030,990 | —- | M] () – C:\Users\Tanja-PC\Documents\cc_20110618_115151.reg
[2011/06/18 11:49:54 | 000,000,770 | —- | M] () – C:\Users\Public\Desktop\CCleaner.lnk
[2011/06/15 00:01:04 | 000,001,977 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2011/06/12 21:38:19 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2011/06/12 21:38:19 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2011/06/12 18:13:45 | 000,000,544 | —- | M] () – C:\Windows\wininit.ini
[2011/06/12 15:26:01 | 000,001,021 | —- | M] () – C:\Users\Tanja-PC\Desktop\Spybot - Search & Destroy.lnk
[2011/06/08 21:58:51 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\Tanja-PC\Desktop\HijackThis.exe
[2011/06/08 16:45:21 | 000,000,436 | —- | M] () – C:\Windows\tasks\Error Fix Scan.job
[2011/06/08 16:45:21 | 000,000,376 | —- | M] () – C:\Windows\tasks\Error Fix Startup.job
[2011/06/08 13:50:09 | 000,001,031 | —- | M] () – C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk
[2011/06/07 22:29:07 | 000,001,795 | —- | M] () – C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2011/06/07 22:28:56 | 000,002,577 | —- | M] () – C:\Windows\System32\config.nt
[2011/06/07 20:35:02 | 000,286,720 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2011/06/07 20:33:23 | 000,494,932 | —- | M] () – C:\Users\Tanja-PC\Documents\cc_20110607_203310.reg
[2011/06/07 06:37:09 | 000,000,116 | —- | M] () – C:\Users\Tanja-PC\Desktop\Appearance and Personalization - Shortcut.lnk
[2011/06/06 21:40:04 | 000,000,036 | —- | M] () – C:\Users\Tanja-PC\AppData\Local\housecall.guid.cache
[2011/05/29 09:11:30 | 000,039,984 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/05/29 09:11:20 | 000,022,712 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2011/05/24 19:14:10 | 000,222,080 | —- | M] (Microsoft Corporation) – C:\Windows\System32\MpSigStub.exe

========== Files Created - No Company Name ==========

[2011/06/23 10:49:39 | 000,293,977 | —- | C] () – C:\Users\Tanja-PC\Desktop\gmer.zip
[2011/06/20 09:42:22 | 252,469,762 | —- | C] () – C:\Windows\MEMORY.DMP
[2011/06/18 11:51:53 | 000,030,990 | —- | C] () – C:\Users\Tanja-PC\Documents\cc_20110618_115151.reg
[2011/06/18 11:49:54 | 000,000,770 | —- | C] () – C:\Users\Public\Desktop\CCleaner.lnk
[2011/06/12 21:38:19 | 000,000,000 | RHS- | C] () – C:\MSDOS.SYS
[2011/06/12 21:38:19 | 000,000,000 | RHS- | C] () – C:\IO.SYS
[2011/06/12 18:13:45 | 000,000,544 | —- | C] () – C:\Windows\wininit.ini
[2011/06/12 15:26:01 | 000,001,021 | —- | C] () – C:\Users\Tanja-PC\Desktop\Spybot - Search & Destroy.lnk
[2011/06/10 20:53:07 | 000,002,375 | —- | C] () – C:\Users\Tanja-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Install Clean Up.lnk
[2011/06/08 13:50:09 | 000,001,031 | —- | C] () – C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk
[2011/06/07 22:29:07 | 000,001,795 | —- | C] () – C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2011/06/07 20:33:18 | 000,494,932 | —- | C] () – C:\Users\Tanja-PC\Documents\cc_20110607_203310.reg
[2011/06/07 06:37:09 | 000,000,116 | —- | C] () – C:\Users\Tanja-PC\Desktop\Appearance and Personalization - Shortcut.lnk
[2011/06/06 21:40:04 | 000,000,036 | —- | C] () – C:\Users\Tanja-PC\AppData\Local\housecall.guid.cache
[2011/02/14 14:46:15 | 000,000,212 | —- | C] () – C:\Users\Tanja-PC\AppData\Roaming\Lucid_player_profiles_data.dat
[2011/02/14 14:46:15 | 000,000,008 | —- | C] () – C:\Users\Tanja-PC\AppData\Roaming\Lucid_player_highscore.dat
[2010/09/28 13:50:50 | 000,153,088 | —- | C] () – C:\Program Files\UNWISE.EXE
[2010/03/02 16:33:56 | 000,140,692 | —- | C] () – C:\Windows\hpoins14.dat
[2010/01/30 19:45:14 | 000,023,090 | —- | C] () – C:\Windows\hpqins15.dat
[2009/11/04 09:03:28 | 000,000,004 | —- | C] () – C:\Users\Tanja-PC\AppData\Roaming\gleb9h4rxtbv9ht6tbj10itkgksqc9t4v0j1tesolm5
[2009/10/29 03:59:12 | 000,024,206 | —- | C] () – C:\Users\Tanja-PC\AppData\Roaming\UserTile.png
[2009/09/11 06:45:43 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2009/09/11 06:45:42 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/06/25 12:01:04 | 000,000,029 | —- | C] () – C:\Windows\popcinfo.dat
[2009/02/25 10:14:39 | 000,013,540 | —- | C] () – C:\Users\Tanja-PC\AppData\Local\slot1.mm1
[2009/02/20 04:27:08 | 000,140,692 | —- | C] () – C:\Windows\hpoins14.dat.temp
[2009/02/20 04:27:08 | 000,002,000 | —- | C] () – C:\Windows\hpomdl14.dat.temp
[2009/02/08 04:31:22 | 000,000,064 | —- | C] () – C:\Windows\GPlrLanc.dat
[2008/12/08 10:23:51 | 000,004,096 | —- | C] () – C:\Windows\d3dx.dat
[2008/11/24 04:01:28 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/10/20 08:27:47 | 000,000,000 | —- | C] () – C:\Windows\nsreg.dat
[2008/07/26 16:47:06 | 000,015,872 | —- | C] () – C:\Users\Tanja-PC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/07/23 08:30:48 | 000,000,680 | —- | C] () – C:\Users\Tanja-PC\AppData\Local\d3d9caps.dat
[2008/03/25 16:56:08 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1461.dll
[2007/12/08 16:11:51 | 000,102,451 | —- | C] () – C:\Windows\hpqins13.dat
[2007/12/08 16:02:46 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1332.dll
[2007/12/08 15:53:38 | 000,061,440 | —- | C] () – C:\Windows\System32\OsdRemove.exe
[2007/12/08 15:51:18 | 000,327,680 | —- | C] () – C:\Windows\System32\pythoncom25.dll
[2007/12/08 15:51:18 | 000,102,400 | —- | C] () – C:\Windows\System32\pywintypes25.dll
[2007/06/05 18:07:34 | 000,002,000 | —- | C] () – C:\Windows\hpomdl14.dat
[2007/03/11 14:04:43 | 000,106,767 | —- | C] () – C:\Windows\hpqins11.dat
[2006/11/02 07:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 07:47:37 | 000,286,720 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 07:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 05:33:01 | 000,604,264 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 05:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 05:33:01 | 000,103,964 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 05:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 05:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 03:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 03:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 02:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 02:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat

========== Alternate Data Streams ==========

@Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:F0AB86C0
@Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:EEB25EAE
@Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:EE39C93C
@Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:7F66BF58
@Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:6CC147C9
@Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:4A392155
@Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:3991CD7D
@Alternate Data Stream - 98 bytes -> C:\ProgramData\TEMP:E1982A23
@Alternate Data Stream - 98 bytes -> C:\ProgramData\TEMP:71173EF9
@Alternate Data Stream - 98 bytes -> C:\ProgramData\TEMP:426796C0
@Alternate Data Stream - 98 bytes -> C:\ProgramData\TEMP:0C5BC70E
@Alternate Data Stream - 97 bytes -> C:\ProgramData\TEMP:B47F9D81
@Alternate Data Stream - 97 bytes -> C:\ProgramData\TEMP:1ECED34B
@Alternate Data Stream - 97 bytes -> C:\ProgramData\TEMP:1E5E0A4D
@Alternate Data Stream - 96 bytes -> C:\ProgramData\TEMP:C771E1BC
@Alternate Data Stream - 96 bytes -> C:\ProgramData\TEMP:A01617F0
@Alternate Data Stream - 96 bytes -> C:\ProgramData\TEMP:538A9F02
@Alternate Data Stream - 96 bytes -> C:\ProgramData\TEMP:43982D5E
@Alternate Data Stream - 96 bytes -> C:\ProgramData\TEMP:3D36932D
@Alternate Data Stream - 96 bytes -> C:\ProgramData\TEMP:179D1352
@Alternate Data Stream - 96 bytes -> C:\ProgramData\TEMP:0C9CD455
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:F7DFDC37
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:E51234A9
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:D853F961
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:D68FBF6D
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:7881FECE
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:5A99DEB7
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:59C113EC
@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:0F2BA284
@Alternate Data Stream - 94 bytes -> C:\ProgramData\TEMP:D2249B7E
@Alternate Data Stream - 94 bytes -> C:\ProgramData\TEMP:5E9B629B
@Alternate Data Stream - 206 bytes -> C:\ProgramData\TEMP:1C5692E6
@Alternate Data Stream - 153 bytes -> C:\ProgramData\TEMP:798A3728
@Alternate Data Stream - 152 bytes -> C:\ProgramData\TEMP:E6427C0F
@Alternate Data Stream - 152 bytes -> C:\ProgramData\TEMP:BE3E263A
@Alternate Data Stream - 152 bytes -> C:\ProgramData\TEMP:AB554F94
@Alternate Data Stream - 152 bytes -> C:\ProgramData\TEMP:9B0F9E15
@Alternate Data Stream - 152 bytes -> C:\ProgramData\TEMP:390B30B4
@Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:6B15C5BC
@Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:0D4B1B5B
@Alternate Data Stream - 150 bytes -> C:\ProgramData\TEMP:F3600258
@Alternate Data Stream - 150 bytes -> C:\ProgramData\TEMP:E55CE2D1
@Alternate Data Stream - 150 bytes -> C:\ProgramData\TEMP:A724744F
@Alternate Data Stream - 150 bytes -> C:\ProgramData\TEMP:75B1A93C
@Alternate Data Stream - 150 bytes -> C:\ProgramData\TEMP:0B9176C0
@Alternate Data Stream - 149 bytes -> C:\ProgramData\TEMP:B745EBA5
@Alternate Data Stream - 149 bytes -> C:\ProgramData\TEMP:9E999B93
@Alternate Data Stream - 149 bytes -> C:\ProgramData\TEMP:5095D8B1
@Alternate Data Stream - 149 bytes -> C:\ProgramData\TEMP:3E7C402E
@Alternate Data Stream - 149 bytes -> C:\ProgramData\TEMP:0B352B60
@Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:9C68C476
@Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:81F83028
@Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:249F95D0
@Alternate Data Stream - 148 bytes -> C:\ProgramData\TEMP:14168AA3
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:BE0BAFE1
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:B894C266
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:80F63EC3
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:756C8543
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:33E12B7A
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:082EF53F
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:F8A67568
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:EB333CFC
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:E35A81F4
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:BA4AE5FC
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:A118E9A3
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:92D91D7E
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:66FC2E6F
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:5856B2C0
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:40EE25BB
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:3A7527E8
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:36FFA2FB
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:123A86B5
@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:0E341035
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:EF4B1DA9
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:E8C4808B
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:B4FDEF97
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:A9CF7CB5
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:9D86EE01
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:798F4CE4
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:5EC637CB
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:21625197
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:18FCA3F2
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:07348C09
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:CFE0B346
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:CBAC4FD8
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:93EB7685
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:45FE2B4E
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:FBE5FDB9
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:FB44C2A7
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:EDC744FB
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:EB4FEEF5
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:E4786545
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:E3B5F2D1
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:BCDC6E07
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:A2FF62A6
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:71612023
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:6E5C36BA
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:6CC86DF2
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:54CB420C
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:50A11A00
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:2495D97A
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:F878F14A
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:ED66F190
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:96F344DB
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:8924043A
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:759B7D6F
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:71004506
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:4C745529
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:1D60AEC3
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:10873493
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:DF0DB8AB
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:DDCD5068
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:C4AB79AE
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:BCDBBA6D
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:8D4852A2
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:89C28CF6
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:73D27958
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:5CE91C67
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:56EE2CAF
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:32FFF2D1
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:2556A8A0
@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:0081FF0F
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:FC420CE6
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:F854B030
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:F0A06891
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:EA10407C
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:E895790F
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:AC733A73
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:9A2521F1
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:92C45D1A
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:8750DCE4
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:753F86A9
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:6247E766
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:6122E243
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:49F896E9
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:48529647
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:3E7393FC
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:3BAD46F6
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:3B3A35EC
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:32ED8AE7
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:16ADBA30
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:EAB1AD1B
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:EA1919C7
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:E6C6EB3B
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:E29063FF
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:DC21D414
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:D4BB0AD6
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:C7F08EA3
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:C48A983C
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:B709343D
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:B42328DE
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:AD020DC3
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:A0921B2C
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:9E76E7F3
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:9C337CCE
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:7CACEF61
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:3F22DA14
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:2E45FA8F
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:12C82FA4
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:124B94C0
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:0EC7A545
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:F8F070C2
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:F7124EAF
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:F41E22A9
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:EBCF5924
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:E60D24D7
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:C76CFF82
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:C24B973A
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:B9E9A5F9
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:ABCD2B94
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:A4009933
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:89CF6F9C
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:89CC7FD8
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:8599F087
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:84744B34
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:2430E4FC
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:F19A4790
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:E7729B98
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:D51F4BAE
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:C3A4217C
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:95FC57E0
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:9491C9C7
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:88D7DDBC
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:82C50600
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:6B7447D4
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:67310058
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:53DF4438
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:3086B95F
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:05670151
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:FB384C06
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:F9EDCFB0
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:EA983230
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:DD842FD5
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:C10635F6
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:B652B720
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:ABE818FA
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:9AB56A06
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:816255C3
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:6C75AF4C
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:61B54B15
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:5C12E68D
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:4D066AD2
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:4BB26BE9
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:3C9CF9A7
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:39F44D9C
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:2727F067
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:21BB9E99
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:13EF4AF6
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:E66AC371
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:D6BE1CEA
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:BD8C785E
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:94188BC6
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:8B2A99C5
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:864A52B8
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:80BFDE16
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:78739EC9
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:6F0B6A5A
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:62B9E014
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:57B4E612
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:51574724
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:33A7CC67
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:193426B4
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:E411AA0D
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:E1610EDC
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:DB0CD29E
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:D93AABC7
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:C49185DC
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:B7ADB4DA
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:A0405560
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:8B4B9596
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:708AB985
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:5E748D4C
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:4AA3DAA3
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:436BE28C
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:21032CDA
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:174B11D8
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:0E22C5DB
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:F791B5EF
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:EF0C5444
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:DDF112BD
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:C5DB32A7
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:A7596EAE
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:596E2371
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:571CCF8E
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:4C528C86
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:147A3409
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:0588E665
@Alternate Data Stream - 133 bytes -> C:\ProgramData\TEMP:04FDFCF6
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:FED25C29
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:FD931C5F
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:E8A39657
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:DF3D49ED
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:D3A89E47
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:D390A6A7
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:A5A2814C
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:88C0A705
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:86F974EB
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:7D9D2CAF
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:4E243396
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:32A82570
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:2504A086
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:21F28B00
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:1AE68282
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:054F0F17
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:F82297CD
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:EE9409C0
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:DE9AC04F
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:C6D0ABC3
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:B4F0E275
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:AE75CCC8
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:ADAD2FFE
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:88A44CC1
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:7FCB9D0D
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:7DC5D762
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:671AABFB
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:64170090
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:5C07C19F
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:5080697C
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:3B9582E0
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:ED51D3ED
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:DEC7E19B
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:DCDE7C60
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:D1BCFD4A
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:B60D5127
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:95B8F7F6
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:7FD903D7
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:7C3E753C
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:557AD709
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:2FBB2B9B
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:1181620C
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:0FF23B70
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:0E660858
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:F0660E7D
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:E774F04D
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:DD831FA6
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:DB77E2C4
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:CF2C26D2
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:7FC6987F
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:4D1D6B2D
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:48977386
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:478FEFC3
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:0A73A758
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:00C7AB47
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:F94CB4DD
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:E90251A2
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:DD04902E
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:C3C72D5F
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:B6C84920
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:9F405A6B
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:9B7E8561
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:996104FC
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:6017A808
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:5E413CD6
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:59465B40
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:583600BF
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:4EFDF5FB
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:4A448DB2
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:3D186293
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:329BA65B
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:24AD822E
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:16A4620C
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:0F38B460
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:0A9883D3
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:B190BE3A
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:AED33A42
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:ADE67221
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:A02025CE
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:8A0772D3
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:5FD47318
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:5025C6E4
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:4EE323A4
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:2B856118
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:1BC99E01
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:0DA384B0
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:E9FAC3AB
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:E07EA07E
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:DD160B0D
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:D31BE97C
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:91FFEC32
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:8999FD56
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:895A78C5
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:7E5B14AE
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:666D6386
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:5FA4CB99
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:5BDD0820
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:50636E35
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:3447AB86
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:341C1FBD
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:268BA8AB
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:1F7A10DD
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:1B7E2022
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:0FB9F88B
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:F1DEA771
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:EF5B3572
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:C30487EE
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:BBCB4421
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:B64F7263
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:ABFCD3CD
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:A167A0BB
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:92A815D8
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:8AD1F2E0
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:7EABF26C
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:6444B424
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:5D17C178
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:5A27D490
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:5A15BCD4
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:57176330
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:560D46AC
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:424D7CFE
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:337FC984
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:2C678471
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:2871B698
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:1170D6E4
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:0988A428
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:0207454C
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:ED2998F5
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:BE40B295
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:988216DA
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:97AB2056
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:93D985FC
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:933FD10F
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:86FA1A34
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:864881BF
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:849CB650
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:69D59C23
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:68DA8CC0
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:6710EF08
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:64648EF8
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:5D351BC6
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:4DA79A6D
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:3C859CF5
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:3BF63E4A
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:2D3CB929
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:131C0EE9
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:0AC32449
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:06754597
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:FB65A4AA
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:F8435088
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:ED194880
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:E98C5DD9
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:CDBFA5BD
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:C7973317
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:C46995DA
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:943E8182
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:72E546C1
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:68EF6203
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:68B61847
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:63980330
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:54362937
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:4B1195DD
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:3651A580
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:2FAFBD6A
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:2E0F1A0A
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:2BC498A4
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:26FBC1F9
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:1B1330FD
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:F3029A65
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:D7DEAA30
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:D5E5CFEC
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:C44E62F1
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:B8384DB6
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:9FA9052D
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:9530B6DE
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:9290C91C
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:8C458D50
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:8160BC44
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:7B52659E
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:7A032A04
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:6E7B4F69
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:5FFC2819
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:5FD35242
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:34BCB6A9
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:206470A5
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:163B8B93
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:132714FA
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:0E684AC9
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:03A039A3
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:FE4E15B1
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:F8AC0D6D
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:F6424B89
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:D8D58038
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:D48500F8
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:C72A744C
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:C40E212B
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:B6E6C4EA
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:94B46CA2
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:82529191
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:7A0FEE87
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:718C16DC
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:687D1056
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:6713E91B
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:5C6EBC69
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:58C9BCAC
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:53DF59D1
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:405D842B
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:3B812EE0
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:2EA99C48
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:2BFCDF84
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:24876EB6
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:133CC4C3
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:0A74923C
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:00258EE7
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:FC2D0F32
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:DF53BA0A
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:D2593961
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:CA0CE093
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:BA209A10
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:A0CB43B2
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:9DF9F99A
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:98982C88
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:84415AE8
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:609CAC7C
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:5D10C56A
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:55374FBA
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:389D51A1
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:2BDCFAD6
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:090FB735
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:FEB0595A
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:D41AB8D0
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:CCB49694
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:BF2E2F0E
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:BC2A20FD
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:96C9689F
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:737160C1
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:6FD219F5
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:5BBAFAAC
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:5B6F7F60
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:370E4EFB
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:2B1EA607
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:1ED30878
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:13B137AF
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:0DAD93FF
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:DE6EED8B
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:CD9109D4
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:BA05E0C4
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:A4F63AED
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:A31B5E9B
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:8D02044C
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:89A5891E
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:7C819E94
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:78AFAE94
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:71187328
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:70CB0237
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:6FE17A89
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:54F1BE9B
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:3A6F413D
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:35A81752
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:2E0B7D8A
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:20DB61D6
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:1CDEDE11
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:1198CD34
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:F0A3E54E
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:C63E7DE2
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:BE40C8A2
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:B1786630
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:A58B27C9
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:9F68E699
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:9E4F05ED
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:98F6F85C
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:981349EA
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:935FDE88
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:91DEEE71
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:8F292FAC
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:88BFF41D
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:848CC150
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:6E86D926
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:6407DD2D
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:57DC3B52
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:22313216
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:1C6CB897
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:0CE0AE44
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:03B3646C
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:F1175E1D
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:EB40BC91
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:E89EDC52
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:E7B49FBF
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:D4E73D7F
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:BEC3E79A
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:B18C4339
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:97C4F81F
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:8BB2EC84
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:89C22C79
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:8207F3D4
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:62E437EB
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:4DBBB4EA
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:488F7244
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:45F3AD49
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:2F6462DF
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:2B9555D8
@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:1709732A
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:E91ADC66
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:DFC3B090
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:D92485C9
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:C22674B6
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:AA243C48
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:887F3A41
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:831C6B2D
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:618BF152
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:588B60C7
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:441D63A8
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:2832349A
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:2512FA90
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:12D9D48F
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:0FA1EAA7
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:0C13C008
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:04CE8640
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:FD000392
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:EC855C73
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:DE9F4320
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:CB52BE62
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:B67A5784
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:A644A4BC
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:9331E9D2
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:7C60A173
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:6A7B7A50
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:3E06C78F
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:2FCCEABB
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:29629382
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:237E4B91
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:1CB4A530
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:09708CB7
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:00D5EBC2
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:FC8FFA4E
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:E80802C7
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:C8EAE2CC
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:AECF4772
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:A7BCEE7D
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:73AFBB96
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:5EF1AD34
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:580E04D8
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:569CEE83
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:4C255337
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:3E69E337
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:221F35CC
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:0AE94DED
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:0ADB5110
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:EC9787B3
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:C7857F06
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:C67CB31A
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:B8EB1B99
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:B845F669
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:A60D0FA6
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:8DB31C20
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:8098DADD
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:793A793F
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:78E0DF72
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:774A0E14
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:63CFD724
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:60A4BB64
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:5BB7898D
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:177313FB
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:0D3CE40A
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:F92AD177
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:C17FCA88
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:98DFF516
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:814B9485
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:5DC406F6
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:5345C8F6
@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:2D5907B8
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:FF818E2B
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:FA8B212D
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:E2DEF21B
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:DCF7E75A
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:CB16385F
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:870649A4
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:61F0C8FB
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:598E0FFA
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:53C0A7FF
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:4673E9EA
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:437B9941
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:270A3983
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:239CC213
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:0F0A5896
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:FFC893E1
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:F1C0B203
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:F14D1F80
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:C36B1175
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:7972CF54
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:4FE42FFC
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:4CF76F21
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:25249477
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:24FECE50
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:20685A31
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:086DE893
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:E9B5CB53
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:DE892EFB
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:D8C96088
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:C472D998
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:BBE01348
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:A916C041
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:90B52091
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:8401B6D5
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:6F1F66C0
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:66D5476F
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:2F141B68
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:1DEE6B65
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:1A7E6B73
@Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:05113FB9
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:FA206A00
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:F3EFA8A8
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:D507B5A8
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:A7DA2BCD
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:A39CF033
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:A2CEDFBB
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:9ACB70D7
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:7AA6FC81
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:76403E94
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:561B1D2B
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:359163DE
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:28CDD861
@Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:9E9BA8D0
@Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:85C3B823
@Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:40D8F125
@Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:313C5814
@Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:11411CE5
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:C8E82994
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:BCD2C50C
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:BB71BBA2
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:ABE30DDB
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:7F33DA7F
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:6FCD73D7
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:69AF9D20
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:68F4B378
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:551BED5F
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:315B4A13
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:FC2E567F
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:D35663D1
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:C9FD258B
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:BD27B7FC
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:9ACE4E8E
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:8DF68137
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:55E1514E
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:3C77A608
@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:12D2EB9C
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:ECCE99EF
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:E5294695
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:E3CEEC4C
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:AABCC5A7
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:8F09BC2E
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:77A023CE
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:70E897B5
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:302376F2
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:17C48B08
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:118318EC
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:0104E054
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:00F7B10F
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:DA18FD1D
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:C07A6A6B
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:A4076A3B
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:9DF07E8F
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:65929158
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:3FD496E1
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:211ED887
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:F0BD89FA
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:EB6F81E8
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:DC293BD3
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:AC95B5ED
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:5197985B
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:3C75E5BE
@Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:2E49D185
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:EDD903C5
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:D650D56C
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:D0668210
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:CF61CE5A
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:9BD7A247
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:96C05DC7
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:93B8F954
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:55818279
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:52A6151E
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:51E1A4D8
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:491EFB75
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:260575F1

< End of report >

patndoris

Post #8June 24, 2011, 12:45 AM UTC

It doesn't look like that fix ran properly, and the OTL results show a couple other leftover toolbar entries. Let's try this fix again and see what we get.

Run OTL.exe by right-clicking and choosing Run as Administrator on the icon.

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services
:OTL
FF - prefs.js..browser.startup.homepage: "http://www.ask.com/?o=20011&l=dis"
[2009/10/19 23:14:06 | 000,000,000 | —D | M] ("Ask Toolbar for Firefox") – C:\Users\Tanja-PC\AppData\Roaming\Mozilla\Firefox\Profiles\qjslwjvr.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
[2010/05/26 15:18:50 | 000,002,333 | —- | M] () – C:\Users\Tanja-PC\AppData\Roaming\Mozilla\Firefox\Profiles\qjslwjvr.default\searchplugins\askcom.xml
O2 - BHO: (Playfin Games Toolbar) - {6905e4b1-afef-4444-85a9-ecb16c048784} - C:\Program Files\playfingamestoolbar\vmntemplateX.dll ()
O2 - BHO: (no name) - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Playfin Games Toolbar) - {6905e4b1-afef-4444-85a9-ecb16c048784} - C:\Program Files\playfingamestoolbar\vmntemplateX.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D0523BB4-21E7-11DD-9AB7-415B56D89593} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O9 - Extra Button: Go to PlaySushi web site - {EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - Reg Error: Key error. File not found
:Commands
[purity]
[emptytemp]
[emptyflash]
[createrestorepoint]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post the resulting OTL log

farmgirl806

Post #9June 24, 2011, 1:44 AM UTC

ok, I am unable to update adobe reader. I thought I should look to uninstall the old one but it is not the to uninstall. It is not in ccleaner to uninstall either. I think I can solve that problem later if that is ok with you. I can run the eset program when I quit for tonight. Here is the new log for OTL. Hope it is better. All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== Prefs.js: "http://www.ask.com/?o=20011&l=dis" removed from browser.startup.homepage C:\Users\Tanja-PC\AppData\Roaming\Mozilla\Firefox\Profiles\qjslwjvr.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\META-INF folder moved successfully. C:\Users\Tanja-PC\AppData\Roaming\Mozilla\Firefox\Profiles\qjslwjvr.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences folder moved successfully. C:\Users\Tanja-PC\AppData\Roaming\Mozilla\Firefox\Profiles\qjslwjvr.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults folder moved successfully. C:\Users\Tanja-PC\AppData\Roaming\Mozilla\Firefox\Profiles\qjslwjvr.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\chrome folder moved successfully. C:\Users\Tanja-PC\AppData\Roaming\Mozilla\Firefox\Profiles\qjslwjvr.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D} folder moved successfully. C:\Users\Tanja-PC\AppData\Roaming\Mozilla\Firefox\Profiles\qjslwjvr.default\searchplugins\askcom.xml moved successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6905e4b1-afef-4444-85a9-ecb16c048784}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6905e4b1-afef-4444-85a9-ecb16c048784}\ deleted successfully. C:\Program Files\playfingamestoolbar\vmntemplateX.dll moved successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{6905e4b1-afef-4444-85a9-ecb16c048784} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6905e4b1-afef-4444-85a9-ecb16c048784}\ not found. File C:\Program Files\playfingamestoolbar\vmntemplateX.dll not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{604BC32A-9680-40D1-9AC6-E06B23A1BA4C}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D0523BB4-21E7-11DD-9AB7-415B56D89593} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D0523BB4-21E7-11DD-9AB7-415B56D89593}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EBD24BD3-E272-4FA3-A8BA-C5D709757CAB}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EBD24BD3-E272-4FA3-A8BA-C5D709757CAB}\ not found. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Public User: Tanja-PC ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 4223127 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 0 bytes ->Google Chrome cache emptied: 0 bytes ->Flash cache emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 1552 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 4.00 mb [EMPTYFLASH] User: All Users User: Default User: Default User User: Public User: Tanja-PC ->Flash cache emptied: 0 bytes Total Flash Files Cleaned = 0.00 mb OTL by OldTimer - Version 3.2.24.1 log created on 06232011_203742 Files\Folders moved on Reboot… C:\Users\Tanja-PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U60VM4G3\iframe[1].htm moved successfully. C:\Users\Tanja-PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\C2XZ21XE\index[2].htm moved successfully. C:\Users\Tanja-PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\C2XZ21XE\like[1].htm moved successfully. C:\Users\Tanja-PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully. C:\Users\Tanja-PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully. File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot. Registry entries deleted on Reboot…

patndoris

Post #10June 24, 2011, 1:56 AM UTC

Much better! You can post the ESET log tomorrow. We can certainly deal with Adobe later. When you post the logs tomorrow, please let me know how the machine is running. Are there any lingering problems that you are experiencing on it?

farmgirl806

Post #11June 24, 2011, 2:13 AM UTC

Thank you so much for helping me. I would love to learn what you do. Did it take a long time to learn this? I see they have a class. I will get on this in the morning and post as soon as I can. Then you can help me when you can. Thanks again.

patndoris

Post #12June 24, 2011, 2:45 AM UTC

How long it takes to learn to fight malware varies by person. If you are interested in learning, you can get more information on the What the Tech Classroom and apply to the program here. If you'd like to know more about my personal experience with the training, feel free to PM me.

farmgirl806

Post #13June 24, 2011, 6:54 PM UTC

Hello! Here is the log from the link C:\Program Files\Eset\Eset Online Scanner\log.txt ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK In the program itself I found this C:\ProgramData\Spybot - Search & Destroy\Recovery\SweetIM30.zip Win32/Bagle.gen.zip worm C:\Users\All Users\Spybot - Search & Destroy\Recovery\SweetIM30.zip Win32/Bagle.gen.zip worm C:\Users\Tanja-PC\AppData\Local\VirtualStore\Program Files\Mozilla Firefox\chrome\m3ffxtbr.jar Win32/Toolbar.MyWebSearch application I have not clicked anything in the program. It has not cleaned any of the infected files so if I click finish will the files still be there? Sorry it took so long for me to get back to you. I had to be gone this morning.

patndoris

Post #14June 24, 2011, 9:16 PM UTC

Sorry, I was at work and couldn't respond earlier.

You can go ahead and click out of the program. We'll use OTL to remove those.

Run OTL.exe by right-clicking and choosing Run as Administrator on the icon.

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services

:Files
C:\ProgramData\Spybot - Search & Destroy\Recovery\SweetIM30.zip	Win32/Bagle.gen.zip worm
C:\Users\All Users\Spybot - Search & Destroy\Recovery\SweetIM30.zip	Win32/Bagle.gen.zip worm
C:\Users\Tanja-PC\AppData\Local\VirtualStore\Program Files\Mozilla Firefox\chrome\m3ffxtbr.jar	Win32/Toolbar.MyWebSearch application

:Commands
[purity]
[emptytemp]
[emptyflash]
[createrestorepoint]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post the resulting OTL log

How is the machine running now? Are you having any problems or concerns at this point?

farmgirl806

Post #15June 25, 2011, 12:38 AM UTC

Ok, here is the log. The computer seems good. The directions you gave me found more of the virus stuff so I guess if a person gets a virus and runs several malware programs you should still get help from whatthetech. I really appreciate your help. All processes killed ========== SERVICES/DRIVERS ========== ========== FILES ========== Invalid Switch: Bagle.gen.zip worm Invalid Switch: Bagle.gen.zip worm Invalid Switch: Toolbar.MyWebSearch application ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Public User: Tanja-PC ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 10242419 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 0 bytes ->Google Chrome cache emptied: 0 bytes ->Flash cache emptied: 456 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 6522 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 10.00 mb [EMPTYFLASH] User: All Users User: Default User: Default User User: Public User: Tanja-PC ->Flash cache emptied: 0 bytes Total Flash Files Cleaned = 0.00 mb OTL by OldTimer - Version 3.2.24.1 log created on 06242011_192716 Files\Folders moved on Reboot… C:\Users\Tanja-PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\NH1MTLIL\index[1].htm moved successfully. C:\Users\Tanja-PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GHAGXON5\iframe[1].htm moved successfully. C:\Users\Tanja-PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\E8MD7KBX\like[1].htm moved successfully. C:\Users\Tanja-PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully. C:\Users\Tanja-PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully. File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot. Registry entries deleted on Reboot…

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

please check my log

✨ Ask AI

Ask AI