Spyware / Malware / Virus Removal

Please help...tdss.e!rootkit infection

9 min read

Looking for the outcome? Ask AI

Lpool18 Topic Starter

Post #1June 22, 2011, 8:46 PM UTC

Hi Everyone Usually I can sort a lot of problems out on my pc myself but this one has me completely stumped, so I've come to the experts. Hopefully someone can help me. I'm running XP and have been infected with this tdss.e!rootkit. I've been using McAfee for some time now and as a back run both Malwarebytes and Super Anti Spyware at least once a month. All of these seem to detect the problem and 'quarantine/delete' the virus but when I restart, alas it's there. I've tried to run Kasperskys tdss killer but won't run for some reason (probably this virus stopping it I guess). I'm completely stumped with it and was wondering if someone can help me? Thanks Steve

Lpool18

Post #2June 22, 2011, 9:15 PM UTC

Sorry guys, I suppose I should have done this on the first post.

I've run Hijackthis and posted the log below, I hope this helps.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:12:52, on 22/06/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
C:\WINDOWS\system32\mfevtps.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Stevie\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20110622211955.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O8 - Extra context menu item: Download All By FlashGet3 - C:\Documents and Settings\Stevie\Application Data\FlashGetBHO\GetAllUrl.htm
O8 - Extra context menu item: Download By FlashGet3 - C:\Documents and Settings\Stevie\Application Data\FlashGetBHO\GetUrl.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Documents and Settings\Stevie\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\uk.htm
O15 - Trusted Zone: http://www.bitsoup.org
O16 - DPF: {0972B098-DEE9-4279-AC7E-4BAAA029102D} (PhotoboxPhotowaysUploader5 Control) - http://assets.photobox.com/assets/aurigma/…?20110428084740
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit…wn.cab56986.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1214166787500
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…tDetection2.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.orderingmemory.com/controls/cpcScanner.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Google Update Service (gupdate1ca8478a9da0ea4) (gupdate1ca8478a9da0ea4) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: McAfee Personal Firewall Service (McMPFSvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McAfee VirusScan Announcer (McNaiAnn) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
O23 - Service: McShield - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe
O23 - Service: McAfee Firewall Core Service (mfefire) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\WINDOWS\system32\mfevtps.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Rapport Management Service (RapportMgmtService) - Trusteer Ltd. - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

–
End of file - 11309 bytes

mowman

Post #3June 22, 2011, 11:43 PM UTC

Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
You may need two posts to fit them both in.

Please download Rootkit Unhooker and save it to your desktop.
Link 1
Now double-click on RKUnhookerLE.exe to run it.
Click the Report tab, then click Scan.
Check (Tick) Drivers and Stealth
Uncheck the rest. then click OK
When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
Wait till the scanner has finished and then click File > Save Report.
Save the report somewhere where you can find it. Click Close.
Copy the entire contents of the report and paste it in your next reply.

Note** you may get the following warning, just click OK and continue.

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

Lpool18

Post #4June 23, 2011, 6:16 PM UTC

Hi Mowman

Thank you for taking the time out to help me, I really do appreciate it. Ok, here are the results of the scans.

OTL logfile created on: 23/06/2011 18:46:55 - Run 1
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Documents and Settings\Stevie\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

959.48 Mb Total Physical Memory | 359.46 Mb Available Physical Memory | 37.46% Memory free
2.26 Gb Paging File | 1.51 Gb Available in Paging File | 66.69% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 34.28 Gb Total Space | 9.39 Gb Free Space | 27.40% Space Free | Partition Type: NTFS

Computer Name: SN037427820165 | User Name: Stevie | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Stevie\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Trusteer\Rapport\bin\RapportService.exe (Trusteer Ltd.)
PRC - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (Trusteer Ltd.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe (McAfee, Inc.)
PRC - C:\WINDOWS\system32\mfevtps.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
PRC - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\slserv.exe ( )

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Stevie\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\McAfee\SiteAdvisor\sahook.dll ()
MOD - C:\WINDOWS\system32\framedyn.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (Sukoku Service) – File not found
SRV - (HidServ) – File not found
SRV - (AppMgmt) – File not found
SRV - (RapportMgmtService) – C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (Trusteer Ltd.)
SRV - (mfefire) – C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV - (mfevtp) – C:\WINDOWS\system32\mfevtps.exe (McAfee, Inc.)
SRV - (nosGetPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper_3004.dll (NOS Microsystems Ltd.)
SRV - (TomTomHOMEService) – C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
SRV - (MatSvc) – C:\Program Files\Microsoft Fix it Center\Matsvc.exe (Microsoft Corporation)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (dgdersvc) – C:\WINDOWS\system32\dgdersvc.exe (Devguru Co., Ltd.)
SRV - (MSK80Service) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McProxy) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNASvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNaiAnn) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McMPFSvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (FsUsbExService) – C:\WINDOWS\system32\FsUsbExService.Exe (Teruten)
SRV - (McAfee SiteAdvisor Service) – C:\Program Files\McAfee\SiteAdvisor\McSACore.exe ()
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (SLService) – C:\WINDOWS\System32\slserv.exe ( )

========== Driver Services (SafeList) ==========

DRV - (RapportCerberus_26762) – C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\26762\RapportCerberus_26762.sys (Trusteer Ltd.)
DRV - (RapportEI) – C:\Program Files\Trusteer\Rapport\bin\RapportEI.sys (Trusteer Ltd.)
DRV - (RapportKELL) – C:\WINDOWS\System32\Drivers\RapportKELL.sys (Trusteer Ltd.)
DRV - (RapportPG) – C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (Trusteer Ltd.)
DRV - (mfehidk) – C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfefirek) – C:\WINDOWS\system32\drivers\mfefirek.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\WINDOWS\system32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\WINDOWS\system32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mfendiskmp) – C:\WINDOWS\system32\drivers\mfendisk.sys (McAfee, Inc.)
DRV - (mfendisk) – C:\WINDOWS\system32\drivers\mfendisk.sys (McAfee, Inc.)
DRV - (mferkdet) – C:\WINDOWS\system32\drivers\mferkdet.sys (McAfee, Inc.)
DRV - (mfetdi2k) – C:\WINDOWS\system32\drivers\mfetdi2k.sys (McAfee, Inc.)
DRV - (cfwids) – C:\WINDOWS\system32\drivers\cfwids.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\WINDOWS\system32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (PSSDKLBF) – C:\WINDOWS\system32\drivers\pssdklbf.sys (microOLAP Technologies LTD)
DRV - (PSSDK42) – C:\WINDOWS\system32\drivers\pssdk42.sys (microOLAP Technologies LTD)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (dgderdrv) – C:\WINDOWS\system32\drivers\dgderdrv.sys (Devguru Co., Ltd)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASENUM) – C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (FsUsbExDisk) – C:\WINDOWS\system32\FsUsbExDisk.Sys ()
DRV - (ssm_mdm) – C:\WINDOWS\system32\drivers\ssm_mdm.sys (MCCI Corporation)
DRV - (ssm_bus) SAMSUNG Mobile USB Device II 1.0 driver (WDM) – C:\WINDOWS\system32\drivers\ssm_bus.sys (MCCI Corporation)
DRV - (ssm_mdfl) – C:\WINDOWS\system32\drivers\ssm_mdfl.sys (MCCI Corporation)
DRV - (sscemdm) – C:\WINDOWS\system32\drivers\sscemdm.sys (MCCI Corporation)
DRV - (sscebus) SAMSUNG USB Composite Device V2 driver (WDM) – C:\WINDOWS\system32\drivers\sscebus.sys (MCCI Corporation)
DRV - (sscemdfl) – C:\WINDOWS\system32\drivers\sscemdfl.sys (MCCI Corporation)
DRV - (ss_bmdm) – C:\WINDOWS\system32\drivers\ss_bmdm.sys (MCCI Corporation)
DRV - (ss_bserd) – C:\WINDOWS\system32\drivers\ss_bserd.sys (MCCI Corporation)
DRV - (ss_bbus) SAMSUNG USB Mobile Device (WDM) – C:\WINDOWS\system32\drivers\ss_bbus.sys (MCCI)
DRV - (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter) – C:\WINDOWS\system32\drivers\ss_bmdfl.sys (MCCI Corporation)
DRV - (fssfltr) – C:\WINDOWS\system32\drivers\fssfltr_tdi.sys (Microsoft Corporation)
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (NCHSSVAD) – C:\WINDOWS\system32\drivers\nchssvad.sys (NCH Swift Sound)
DRV - (s716mdm) – C:\WINDOWS\system32\drivers\s716mdm.sys (MCCI Corporation)
DRV - (s716mdfl) – C:\WINDOWS\system32\drivers\s716mdfl.sys (MCCI Corporation)
DRV - (s716bus) Sony Ericsson Device 716 driver (WDM) – C:\WINDOWS\system32\drivers\s716bus.sys (MCCI Corporation)
DRV - (StarOpen) – C:\WINDOWS\System32\drivers\StarOpen.sys ()
DRV - (PRISM_A02) – C:\WINDOWS\system32\drivers\PRISMA02.sys (Conexant Systems, Inc.)
DRV - (RecAgent) – C:\WINDOWS\system32\drivers\recagent.sys (Smart Link)
DRV - (STAC97) Audio Driver (WDM) – C:\WINDOWS\system32\drivers\STAC97.sys (SigmaTel, Inc.)
DRV - (SiSkp) – C:\WINDOWS\system32\drivers\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (SiS315) – C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (sisagp) – C:\WINDOWS\System32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)
DRV - (Mtlstrm) – C:\WINDOWS\system32\drivers\mtlstrm.sys ( )
DRV - (SlNtHal) – C:\WINDOWS\system32\drivers\slnthal.sys ( )
DRV - (Slntamr) – C:\WINDOWS\system32\drivers\slntamr.sys ( )
DRV - (Mtlmnt5) – C:\WINDOWS\system32\drivers\mtlmnt5.sys ( )
DRV - (NtMtlFax) – C:\WINDOWS\system32\drivers\ntmtlfax.sys ( )
DRV - (SlWdmSup) – C:\WINDOWS\system32\drivers\slwdmsup.sys (Vireo Software)
DRV - (STAC97NH) – C:\WINDOWS\system32\drivers\stac97nh.sys (SigmaTel Inc.)
DRV - (STAC97NA) – C:\WINDOWS\system32\drivers\stac97na.sys (SigmaTel Inc.)
DRV - (Asapi) – C:\WINDOWS\System32\drivers\asapi.sys (VOB Computersysteme GmbH)
DRV - (rtl8139) – C:\WINDOWS\system32\drivers\R8139n51.sys (Realtek Semiconductor Corporation)
DRV - (ms_mpu401) – C:\WINDOWS\system32\drivers\msmpu401.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://uk.red.clientapps.yahoo.com/customi…fo/bt_side.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = EC FA E1 E2 16 B6 CB 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: [removed]:1.7.1
FF - prefs.js..extensions.enabledItems: [removed]:1.0.2

[2011/06/22 22:41:11 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Stevie\Application Data\Mozilla\Extensions
[2008/05/04 12:57:37 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Stevie\Application Data\Mozilla\Extensions\[removed]
[2011/04/15 18:45:34 | 000,000,000 | —D | M] (Map status indicator) – C:\PROGRAM FILES\TOMTOM HOME 2\XUL\EXTENSIONS\[removed]
[2011/04/14 14:01:38 | 000,024,376 | —- | M] (McAfee, Inc.) – C:\Program Files\Mozilla Firefox\components\Scriptff.dll

O1 HOSTS File: ([2008/06/22 20:55:33 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\McAfee\MSK\mskapbho.dll ()
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20110622211955.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (no name) - AutorunsDisabled - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\RunOnce: [Uninstall Adobe Download Manager] C:\Program Files\NOS\bin\getPlusUninst_Adobe.exe (NOS Microsystems Ltd.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Download All By FlashGet3 - C:\Documents and Settings\Stevie\Application Data\FlashGetBHO\GetAllUrl.htm ()
O8 - Extra context menu item: Download By FlashGet3 - C:\Documents and Settings\Stevie\Application Data\FlashGetBHO\GetUrl.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Documents and Settings\Stevie\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll (Google Inc.)
O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: bitsoup.org ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: motive.com ([pbttbc.bt] https in Trusted sites)
O16 - DPF: {0972B098-DEE9-4279-AC7E-4BAAA029102D} http://assets.photobox.com/assets/aurigma/…?20110428084740 (PhotoboxPhotowaysUploader5 Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/C/0…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} http://messenger.zone.msn.com/binary/Solit…wn.cab56986.cab (Solitaire Showdown Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1214166787500 (MUWebControl Class)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.hp.com/ediags/gmn2/inst…tDetection2.cab (GMNRev Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} http://www.orderingmemory.com/controls/cpcScanner.cab (Crucial cpcScan)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Documents and Settings\Stevie\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Stevie\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{0e1e4899-7379-11dc-86eb-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{0e1e4899-7379-11dc-86eb-806d6172696f}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{0e1e4899-7379-11dc-86eb-806d6172696f}\Shell\AutoRun\command - "" = D:\DVD-W.exe
O33 - MountPoints2\{1b6c03b8-9a64-11df-abeb-000b6b9f2e19}\Shell\AutoRun\command - "" = F:\pccompanion\Startme.exe
O33 - MountPoints2\{1b6c03b8-9a64-11df-abeb-000b6b9f2e19}\Shell\menu1\command - "" = F:\pccompanion\Startme.exe
O33 - MountPoints2\{5b9cef22-b737-11df-ac26-000b6b9f2e19}\Shell - "" = AutoRun
O33 - MountPoints2\{5b9cef22-b737-11df-ac26-000b6b9f2e19}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{5b9cef22-b737-11df-ac26-000b6b9f2e19}\Shell\AutoRun\command - "" = F:\USBAutoRun.exe
O33 - MountPoints2\{a252f9d4-a856-11df-ac07-000b6b9f2e19}\Shell - "" = AutoRun
O33 - MountPoints2\{a252f9d4-a856-11df-ac07-000b6b9f2e19}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{a252f9d4-a856-11df-ac07-000b6b9f2e19}\Shell\AutoRun\command - "" = F:\ICM_ML.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\System32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: msacm.voxacm160 - C:\WINDOWS\System32\vct3216.acm (Voxware, Inc.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll ()
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (17183584330711040)

========== Files/Folders - Created Within 30 Days ==========

[2011/06/23 18:42:52 | 000,579,072 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Stevie\Desktop\OTL.exe
[2011/06/23 13:50:35 | 000,000,000 | —D | C] – C:\WINDOWS\LastGood
[2011/06/23 09:43:15 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\McAfee
[2011/06/22 23:02:49 | 001,441,584 | —- | C] (Kaspersky Lab ZAO) – C:\Documents and Settings\Stevie\Desktop\tdsskiller.exe
[2011/06/22 22:12:10 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Stevie\Desktop\HiJackThis.exe
[2011/06/22 21:05:26 | 000,000,000 | —D | C] – C:\Program Files\NOS
[2011/06/22 21:05:26 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NOS
[2011/06/22 21:05:13 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\McAfee Security Scan Plus
[2011/06/22 21:04:43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NOS(7)
[2011/06/22 21:03:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NOS(6)
[2011/06/22 21:02:57 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NOS(5)
[2011/06/22 21:02:26 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NOS(4)
[2011/06/22 21:02:25 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NOS(3)
[2011/06/22 21:02:04 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe AIR
[2011/06/22 20:19:24 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NOS(2)
[2011/06/22 00:16:23 | 000,000,000 | –SD | C] – C:\Documents and Settings\Stevie\My Documents\My Data Sources
[2011/06/19 18:29:36 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\McAfee
[2011/06/17 18:17:44 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2011/06/17 18:14:28 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee Security Scan
[2011/06/17 18:14:21 | 000,000,000 | —D | C] – C:\Program Files\McAfee Security Scan
[2011/06/16 22:51:00 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Stevie\Recent
[2011/06/16 18:15:33 | 000,105,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mup.sys
[2011/05/25 22:15:02 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/05/25 22:07:02 | 000,000,000 | —D | C] – C:\Documents and Settings\Stevie\Local Settings\Application Data\FixItCenter
[2011/05/25 21:54:40 | 000,000,000 | —D | C] – C:\WINDOWS\MATS
[2011/05/25 21:54:36 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Fix it Center
[2011/05/25 21:45:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Stevie\Application Data\ElevatedDiagnostics
[2011/05/25 21:42:13 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Windows PowerShell 1.0
[2011/05/25 21:41:41 | 000,000,000 | —D | C] – C:\WINDOWS\System32\windowspowershell
[2011/05/25 20:49:02 | 000,000,000 | —D | C] – C:\Program Files\PC Speed Up
[2008/06/07 12:21:56 | 001,570,816 | —- | C] (Toshiba Samsung Storage Technology Coporation) – C:\Documents and Settings\Stevie\Application Data\tsdnwin.dll
[2004/07/15 10:51:07 | 000,014,976 | —- | C] ( ) – C:\WINDOWS\System32\drivers\winddx.sys
[1980/01/01 00:00:00 | 001,293,192 | —- | C] ( ) – C:\WINDOWS\System32\drivers\mtlstrm.sys
[1980/01/01 00:00:00 | 000,516,616 | —- | C] ( ) – C:\WINDOWS\System32\drivers\slntamr.sys
[1980/01/01 00:00:00 | 000,210,128 | —- | C] ( ) – C:\WINDOWS\System32\drivers\mtlmnt5.sys
[1980/01/01 00:00:00 | 000,162,136 | —- | C] ( ) – C:\WINDOWS\System32\drivers\ntmtlfax.sys
[1980/01/01 00:00:00 | 000,085,520 | —- | C] ( ) – C:\WINDOWS\System32\drivers\slnthal.sys
[1980/01/01 00:00:00 | 000,045,056 | —- | C] ( ) – C:\WINDOWS\System32\slserv.exe
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/23 18:43:09 | 000,579,072 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Stevie\Desktop\OTL.exe
[2011/06/23 18:04:01 | 000,000,580 | -H– | M] () – C:\WINDOWS\tasks\DataUpload.job
[2011/06/23 09:43:22 | 000,000,616 | -H– | M] () – C:\WINDOWS\tasks\ConfigExec.job
[2011/06/23 09:42:33 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/06/23 09:42:32 | 1006,161,920 | -HS- | M] () – C:\hiberfil.sys
[2011/06/22 23:03:08 | 001,441,584 | —- | M] (Kaspersky Lab ZAO) – C:\Documents and Settings\Stevie\Desktop\tdsskiller.exe
[2011/06/22 22:12:16 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Stevie\Desktop\HiJackThis.exe
[2011/06/22 21:08:44 | 000,001,170 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/06/21 19:01:24 | 000,436,014 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/06/21 19:01:24 | 000,068,926 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/06/17 18:14:25 | 000,001,619 | —- | M] () – C:\Documents and Settings\All Users\Desktop\McAfee Security Scan Plus.lnk
[2011/06/17 18:14:25 | 000,001,611 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2011/06/17 18:10:27 | 000,001,732 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2011/06/16 23:33:09 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/06/05 11:35:08 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/05 11:35:07 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/01 08:44:35 | 000,000,069 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2011/05/30 23:19:48 | 005,964,800 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mshtml.dll
[2011/05/27 18:20:29 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/05/25 21:54:51 | 000,000,723 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Microsoft Fix it Center.lnk
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/22 19:22:34 | 1006,161,920 | -HS- | C] () – C:\hiberfil.sys
[2011/06/17 18:14:25 | 000,001,619 | —- | C] () – C:\Documents and Settings\All Users\Desktop\McAfee Security Scan Plus.lnk
[2011/06/17 18:14:25 | 000,001,611 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2011/05/27 18:20:32 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/05/27 00:16:57 | 001,136,664 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/05/25 22:04:12 | 000,000,580 | -H– | C] () – C:\WINDOWS\tasks\DataUpload.job
[2011/05/25 22:04:11 | 000,000,616 | -H– | C] () – C:\WINDOWS\tasks\ConfigExec.job
[2011/05/25 21:54:51 | 000,000,729 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Fix it Center.lnk
[2011/05/25 21:54:51 | 000,000,723 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Microsoft Fix it Center.lnk
[2010/12/03 17:56:42 | 000,201,915 | —- | C] () – C:\WINDOWS\hpoins46.dat
[2010/12/03 17:56:42 | 000,000,606 | —- | C] () – C:\WINDOWS\hpomdl46.dat
[2010/09/29 17:21:35 | 000,040,960 | —- | C] () – C:\WINDOWS\Sublock.dll
[2010/09/29 17:21:34 | 000,221,291 | —- | C] () – C:\WINDOWS\Imei_dll.dll
[2010/07/17 11:57:55 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\FsUsbExDevice.Dll
[2010/07/17 11:57:55 | 000,036,640 | —- | C] () – C:\WINDOWS\System32\FsUsbExDisk.Sys
[2010/07/17 11:57:23 | 000,002,528 | -H– | C] () – C:\Documents and Settings\Stevie\Application Data\$_hpcst$.hpc
[2010/07/09 21:52:23 | 000,004,096 | —- | C] () – C:\WINDOWS\d3dx.dat
[2010/05/08 14:28:22 | 000,000,606 | —- | C] () – C:\WINDOWS\hpomdl46.dat.temp
[2010/04/16 18:35:51 | 000,000,034 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2010/04/15 18:33:40 | 000,023,113 | —- | C] () – C:\WINDOWS\hpqins15.dat
[2010/02/19 20:27:36 | 000,720,384 | —- | C] () – C:\WINDOWS\System32\DivX.dll
[2009/11/14 17:31:52 | 000,069,504 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2009/11/09 03:08:10 | 000,974,848 | —- | C] () – C:\WINDOWS\System32\cis-2.4.dll
[2009/11/09 03:08:10 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\issacapi_bs-2.3.dll
[2009/11/09 03:08:10 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\issacapi_pe-2.3.dll
[2009/11/09 03:08:10 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\issacapi_se-2.3.dll
[2009/10/20 20:02:11 | 000,000,025 | —- | C] () – C:\WINDOWS\libem.INI
[2009/10/20 19:59:53 | 000,000,248 | —- | C] () – C:\WINDOWS\System32\secustat.dat
[2009/10/06 08:16:00 | 000,819,200 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/08/28 22:21:02 | 000,000,037 | —- | C] () – C:\WINDOWS\ipixActivex.ini
[2009/08/16 15:57:30 | 005,419,576 | —- | C] () – C:\Program Files\SopCast-3.2.4.zip
[2009/08/06 13:02:40 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\libcurl.dll
[2009/08/06 13:02:22 | 000,143,360 | —- | C] () – C:\WINDOWS\System32\libexpatw.dll
[2009/06/26 21:52:38 | 000,000,048 | —- | C] () – C:\WINDOWS\cgminivw.ini
[2009/06/26 21:52:06 | 000,000,036 | —- | C] () – C:\WINDOWS\Tiny_Run.ini
[2009/03/23 15:08:29 | 000,000,145 | —- | C] () – C:\WINDOWS\System32\EBPPORT.DAT
[2009/02/18 19:03:46 | 000,000,020 | —- | C] () – C:\WINDOWS\popcinfot.dat
[2009/01/23 23:28:06 | 000,000,000 | —- | C] () – C:\Documents and Settings\All Users\Application Data\LauncherAccess.dt
[2009/01/23 23:20:59 | 000,005,632 | —- | C] () – C:\WINDOWS\System32\drivers\StarOpen.sys
[2008/11/13 19:20:56 | 000,000,039 | —- | C] () – C:\WINDOWS\wininit.ini
[2008/08/15 21:28:24 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\YCRWin32.dll
[2008/07/13 02:54:06 | 000,000,599 | —- | C] () – C:\WINDOWS\videoimp.ini
[2008/06/22 20:33:21 | 000,025,600 | —- | C] () – C:\WINDOWS\System32\WS2Fix.exe
[2008/06/22 20:33:20 | 000,051,200 | —- | C] () – C:\WINDOWS\System32\dumphive.exe
[2008/06/22 20:33:19 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\swsc.exe
[2008/06/22 20:23:55 | 000,001,152 | —- | C] () – C:\WINDOWS\System32\windrv.sys
[2008/05/13 17:46:23 | 000,000,087 | —- | C] () – C:\WINDOWS\ka.ini
[2008/04/24 14:27:10 | 000,000,151 | —- | C] () – C:\WINDOWS\PhotoSnapViewer.INI
[2008/04/18 15:30:03 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll
[2008/04/14 23:58:10 | 000,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2008/02/23 16:49:28 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2007/10/29 19:23:52 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2007/10/23 23:14:40 | 000,032,768 | —- | C] () – C:\Documents and Settings\Stevie\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/10/09 17:52:54 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\instlsp.exe
[2007/10/05 23:40:06 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2007/10/05 22:14:04 | 000,006,550 | —- | C] () – C:\WINDOWS\jautoexp.dat
[2005/09/21 17:38:10 | 000,000,677 | —- | C] () – C:\Program Files\lxce.vbs
[2004/07/15 11:25:00 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/07/15 11:09:17 | 000,006,451 | —- | C] () – C:\WINDOWS\HDReg.ini
[2004/07/15 11:07:16 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2004/07/15 10:58:05 | 000,005,007 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2004/07/15 10:55:44 | 000,115,383 | —- | C] () – C:\WINDOWS\VGAsetup.ini
[2004/07/15 10:55:37 | 000,102,004 | —- | C] () – C:\WINDOWS\System32\VGAunistlog.ini
[2004/07/15 10:55:28 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\sis760.bin
[2004/07/15 10:55:28 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\sis741.bin
[2004/07/15 10:55:28 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\sis660.bin
[2004/07/15 10:53:13 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/07/15 10:51:07 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\SLLights.dll
[2004/07/15 10:51:07 | 000,376,832 | —- | C] () – C:\WINDOWS\System32\slmh.exe
[2004/07/15 10:51:07 | 000,167,936 | —- | C] () – C:\WINDOWS\System32\minirec.exe
[2004/07/15 10:51:07 | 000,151,552 | —- | C] () – C:\WINDOWS\System32\amr_cpl.dll
[2004/07/15 10:51:07 | 000,061,440 | —- | C] () – C:\WINDOWS\SmCfg.exe
[2004/03/31 22:01:24 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2003/01/07 16:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/09/19 21:20:55 | 000,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2002/09/19 20:52:36 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2002/09/19 20:46:13 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2002/09/19 20:37:45 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2002/09/19 20:36:49 | 000,318,744 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2002/09/19 20:26:36 | 000,436,014 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2002/09/19 20:26:36 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2002/09/19 20:26:36 | 000,068,926 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2002/09/19 20:26:36 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2002/09/19 20:26:31 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2002/09/19 20:26:24 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2002/09/19 20:26:24 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2002/09/19 20:26:15 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2002/09/19 20:26:07 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2001/09/05 15:00:38 | 000,004,481 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2001/09/05 15:00:26 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\OEMBIOS.BIN
[2001/08/07 04:16:34 | 000,045,056 | —- | C] () – C:\WINDOWS\OTS_UI.EXE
[1999/03/23 14:46:24 | 000,040,448 | —- | C] () – C:\WINDOWS\System32\REGOBJ.DLL
[1999/01/22 19:46:58 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\MSRTEDIT.DLL
[1980/01/01 00:00:00 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\slextspk.dll
[1980/01/01 00:00:00 | 000,159,744 | —- | C] () – C:\WINDOWS\System32\SLGen.dll
[1980/01/01 00:00:00 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\coinst.dll
[1980/01/01 00:00:00 | 000,024,576 | —- | C] () – C:\WINDOWS\slrundll.exe

========== LOP Check ==========

[2009/10/01 20:35:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Azureus
[2011/04/03 10:50:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Big Fish Games
[2010/07/28 23:52:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\BVRP Software
[2011/03/15 22:47:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Caphyon
[2008/08/17 20:14:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Citrix
[2011/03/15 22:48:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ConeXware
[2009/02/21 00:47:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FarmFrenzy2
[2010/05/09 13:01:25 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GoBit Games
[2008/04/14 23:49:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\LightScribe
[2009/02/14 21:46:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9
[2010/08/20 22:36:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2010/07/22 13:28:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Suite
[2009/02/12 00:25:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap
[2009/02/18 19:03:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap Games
[2009/11/11 11:02:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PPLiveVA
[2007/10/07 14:39:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Prism
[2010/08/28 23:06:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Samsung
[2009/02/16 12:32:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sandlot Games
[2009/11/11 11:01:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Storm
[2011/04/03 10:56:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SugarGames
[2011/04/03 11:27:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2008/03/29 21:36:21 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TomTom
[2010/11/05 10:08:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Trusteer
[2007/10/06 04:19:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2010/10/29 07:16:21 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\VirtualizedApplications
[2009/07/17 18:12:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Vivitar
[2009/07/17 18:12:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Vivitar Experience Image Manager
[2009/06/14 21:31:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WildTangent
[2010/05/09 13:01:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Zylom
[2009/03/26 21:37:24 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2010/04/04 12:41:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/10/01 20:18:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/08 12:03:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2009/02/13 17:37:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\Alawar
[2010/12/16 04:15:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\Azureus
[2009/11/11 11:00:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\BITS
[2011/03/21 19:40:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\DVDVideoSoftIEHelpers
[2011/05/25 21:45:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\ElevatedDiagnostics
[2009/10/20 20:00:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\FlashGet
[2009/10/20 20:00:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\FlashGetBHO
[2009/11/09 22:11:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\FlashgetSetup
[2009/02/16 12:29:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\GameHouse
[2010/07/09 21:52:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\GamesCafe
[2010/09/03 16:32:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\LG Electronics
[2008/11/14 01:13:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\LimeWire
[2009/10/21 17:04:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\MxBoost
[2010/12/23 19:34:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\NCH Swift Sound
[2010/07/22 13:28:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\PC Suite
[2009/10/20 20:02:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\PPLiveVA
[2009/11/11 11:03:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\PPStream
[2010/12/13 21:38:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\PriceGong
[2010/08/15 15:28:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\Samsung
[2010/11/06 18:34:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\SoftGrid Client
[2010/07/28 17:42:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\Sony
[2010/07/28 17:29:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\Sony Setup
[2008/08/20 20:18:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\Teleca
[2007/10/12 19:45:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\Template
[2007/12/25 22:44:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\TomTom
[2010/10/10 12:06:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\TP
[2010/11/05 10:09:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\Trusteer
[2008/02/08 18:42:05 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\Uniblue
[2009/09/25 20:31:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\Xbins
[2009/04/16 09:03:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\Zylom
[2011/06/23 09:43:22 | 000,000,616 | -H– | M] () – C:\WINDOWS\Tasks\ConfigExec.job
[2011/06/23 18:04:01 | 000,000,580 | -H– | M] () – C:\WINDOWS\Tasks\DataUpload.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/08/15 15:28:07 | 000,002,006 | —- | M] () – C:\aqua_bitmap.cpp
[2004/07/15 11:01:24 | 000,000,193 | RHS- | M] () – C:\BOOT.BAK
[2010/07/10 16:27:28 | 000,000,281 | RHS- | M] () – C:\BOOT.INI
[2002/08/29 13:00:00 | 000,245,920 | RHS- | M] () – C:\cmldr
[2009/02/03 16:32:57 | 000,000,074 | —- | M] () – C:\CMLoader.log
[2004/07/15 10:49:16 | 000,006,238 | —- | M] () – C:\DWNLOG.TXT
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1028.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1031.txt
[2007/11/07 08:00:40 | 000,010,134 | —- | M] () – C:\eula.1033.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1036.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1040.txt
[2007/11/07 08:00:40 | 000,000,118 | —- | M] () – C:\eula.1041.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1042.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.2052.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.3082.txt
[2000/03/09 09:06:00 | 000,028,680 | —- | M] () – C:\FLIPART.EXE
[2002/10/16 09:52:00 | 000,000,890 | —- | M] () – C:\GETBOOTD.BAT
[2002/08/29 15:03:06 | 000,006,384 | —- | M] () – C:\GETDRIVE.EXE
[2007/11/07 08:00:40 | 000,001,110 | —- | M] () – C:\globdata.ini
[2011/06/23 09:42:32 | 1006,161,920 | -HS- | M] () – C:\hiberfil.sys
[2009/02/18 17:57:25 | 000,230,424 | —- | M] () – C:\img2-001.raw
[2007/11/07 08:00:40 | 000,000,843 | —- | M] () – C:\install.ini
[2007/11/07 08:03:18 | 000,076,304 | —- | M] (Microsoft Corporation) – C:\install.res.1028.dll
[2007/11/07 08:03:18 | 000,096,272 | —- | M] (Microsoft Corporation) – C:\install.res.1031.dll
[2007/11/07 08:03:18 | 000,091,152 | —- | M] (Microsoft Corporation) – C:\install.res.1033.dll
[2007/11/07 08:03:18 | 000,097,296 | —- | M] (Microsoft Corporation) – C:\install.res.1036.dll
[2007/11/07 08:03:18 | 000,095,248 | —- | M] (Microsoft Corporation) – C:\install.res.1040.dll
[2007/11/07 08:03:18 | 000,081,424 | —- | M] (Microsoft Corporation) – C:\install.res.1041.dll
[2007/11/07 08:03:18 | 000,079,888 | —- | M] (Microsoft Corporation) – C:\install.res.1042.dll
[2007/11/07 08:03:18 | 000,075,792 | —- | M] (Microsoft Corporation) – C:\install.res.2052.dll
[2007/11/07 08:03:18 | 000,096,272 | —- | M] (Microsoft Corporation) – C:\install.res.3082.dll
[2004/07/15 11:05:47 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2004/07/15 11:08:56 | 000,000,870 | -H– | M] () – C:\IPH.PH
[2009/09/28 06:56:15 | 000,006,575 | —- | M] () – C:\lxce.log
[2007/10/12 17:34:46 | 000,000,275 | —- | M] () – C:\lxcefire.000
[2009/02/04 18:33:08 | 000,000,275 | —- | M] () – C:\lxcefire.001
[2009/02/04 19:01:37 | 000,000,275 | —- | M] () – C:\lxcefire.002
[2009/02/04 19:06:07 | 000,000,275 | —- | M] () – C:\lxcefire.csv
[2007/10/12 17:35:28 | 000,000,867 | —- | M] () – C:\lxceinst.000
[2009/02/04 18:41:11 | 000,001,123 | —- | M] () – C:\lxceinst.001
[2009/02/04 19:03:25 | 000,001,124 | —- | M] () – C:\lxceinst.002
[2009/02/04 19:07:10 | 000,001,124 | —- | M] () – C:\lxceinst.csv
[2010/03/15 17:25:24 | 000,159,448 | —- | M] () – C:\lxcescan.log
[2009/02/03 16:54:43 | 000,298,856 | —- | M] () – C:\lxceUNST.000
[2009/02/03 16:55:08 | 000,298,856 | —- | M] () – C:\lxceUNST.001
[2009/02/03 16:56:45 | 000,600,108 | —- | M] () – C:\lxceUNST.002
[2010/03/15 17:27:03 | 000,617,062 | —- | M] () – C:\lxceUNST.csv
[2010/06/30 19:42:16 | 000,000,109 | —- | M] () – C:\mbam-error.txt
[2004/07/15 11:05:47 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2007/10/05 23:48:30 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/09/15 01:02:21 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/06/23 09:42:17 | 1509,138,432 | -HS- | M] () – C:\pagefile.sys
[2008/06/22 20:59:23 | 000,002,851 | —- | M] () – C:\rapport.txt
[2009/05/18 11:05:34 | 000,003,095 | —- | M] () – C:\Rooter.txt
[2009/06/06 00:13:56 | 000,000,232 | -H– | M] () – C:\sqmdata00.sqm
[2009/06/06 00:21:54 | 000,000,232 | -H– | M] () – C:\sqmdata01.sqm
[2009/06/06 10:24:27 | 000,000,232 | -H– | M] () – C:\sqmdata02.sqm
[2009/06/06 16:42:05 | 000,000,232 | -H– | M] () – C:\sqmdata03.sqm
[2009/06/07 02:37:09 | 000,000,232 | -H– | M] () – C:\sqmdata04.sqm
[2009/06/07 03:04:24 | 000,000,232 | -H– | M] () – C:\sqmdata05.sqm
[2009/06/25 17:23:26 | 000,000,232 | -H– | M] () – C:\sqmdata06.sqm
[2009/06/25 17:34:16 | 000,000,232 | -H– | M] () – C:\sqmdata07.sqm
[2009/06/26 00:11:13 | 000,000,232 | -H– | M] () – C:\sqmdata08.sqm
[2009/06/26 01:03:06 | 000,000,232 | -H– | M] () – C:\sqmdata09.sqm
[2009/06/26 01:09:30 | 000,000,232 | -H– | M] () – C:\sqmdata10.sqm
[2009/06/26 11:28:02 | 000,000,232 | -H– | M] () – C:\sqmdata11.sqm
[2009/06/26 13:07:04 | 000,000,232 | -H– | M] () – C:\sqmdata12.sqm
[2009/06/26 15:26:26 | 000,000,232 | -H– | M] () – C:\sqmdata13.sqm
[2009/06/26 16:33:19 | 000,000,232 | -H– | M] () – C:\sqmdata14.sqm
[2009/06/07 17:23:47 | 000,000,232 | -H– | M] () – C:\sqmdata15.sqm
[2009/06/07 23:55:28 | 000,000,232 | -H– | M] () – C:\sqmdata16.sqm
[2009/06/08 09:07:22 | 000,000,232 | -H– | M] () – C:\sqmdata17.sqm
[2009/06/08 14:01:34 | 000,000,232 | -H– | M] () – C:\sqmdata18.sqm
[2009/06/05 22:41:38 | 000,000,232 | -H– | M] () – C:\sqmdata19.sqm
[2009/06/06 00:13:56 | 000,000,244 | -H– | M] () – C:\sqmnoopt00.sqm
[2009/06/06 00:21:54 | 000,000,244 | -H– | M] () – C:\sqmnoopt01.sqm
[2009/06/06 10:24:27 | 000,000,244 | -H– | M] () – C:\sqmnoopt02.sqm
[2009/06/06 16:42:05 | 000,000,244 | -H– | M] () – C:\sqmnoopt03.sqm
[2009/06/07 02:37:09 | 000,000,244 | -H– | M] () – C:\sqmnoopt04.sqm
[2009/06/07 03:04:24 | 000,000,244 | -H– | M] () – C:\sqmnoopt05.sqm
[2009/06/25 17:23:26 | 000,000,244 | -H– | M] () – C:\sqmnoopt06.sqm
[2009/06/25 17:34:16 | 000,000,244 | -H– | M] () – C:\sqmnoopt07.sqm
[2009/06/26 00:11:12 | 000,000,244 | -H– | M] () – C:\sqmnoopt08.sqm
[2009/06/26 01:03:06 | 000,000,244 | -H– | M] () – C:\sqmnoopt09.sqm
[2009/06/26 01:09:30 | 000,000,244 | -H– | M] () – C:\sqmnoopt10.sqm
[2009/06/26 11:28:02 | 000,000,244 | -H– | M] () – C:\sqmnoopt11.sqm
[2009/06/26 13:07:04 | 000,000,244 | -H– | M] () – C:\sqmnoopt12.sqm
[2009/06/26 15:26:26 | 000,000,244 | -H– | M] () – C:\sqmnoopt13.sqm
[2009/06/26 16:33:18 | 000,000,244 | -H– | M] () – C:\sqmnoopt14.sqm
[2009/06/07 17:23:46 | 000,000,244 | -H– | M] () – C:\sqmnoopt15.sqm
[2009/06/07 23:55:28 | 000,000,244 | -H– | M] () – C:\sqmnoopt16.sqm
[2009/06/08 09:07:22 | 000,000,244 | -H– | M] () – C:\sqmnoopt17.sqm
[2009/06/08 14:01:33 | 000,000,244 | -H– | M] () – C:\sqmnoopt18.sqm
[2009/06/05 22:41:38 | 000,000,244 | -H– | M] () – C:\sqmnoopt19.sqm
[2007/11/07 08:00:40 | 000,005,686 | —- | M] () – C:\vcredist.bmp
[2007/11/07 08:09:22 | 001,442,522 | —- | M] () – C:\VC_RED.cab
[2007/11/07 08:12:28 | 000,232,960 | —- | M] () – C:\VC_RED.MSI

< %systemroot%\Fonts\*.com >
[2006/04/18 16:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 15:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 16:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 15:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2002/09/19 20:48:26 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 13:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2009/04/16 13:42:24 | 000,315,904 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpfpp70w.dll
[2007/04/09 13:23:54 | 000,028,552 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 11:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >
[2003/04/22 17:50:46 | 000,095,540 | —- | M] () – C:\WINDOWS\DESK01.JPG
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2003/12/01 10:36:56 | 000,471,040 | —- | M] (ScreenTime Media) – C:\WINDOWS\PackardBell2003.scr
[2010/04/17 01:04:40 | 000,306,032 | —- | M] (Microsoft Corporation) – C:\WINDOWS\WLXPGSS.SCR
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2005/09/21 17:38:10 | 000,000,677 | —- | M] () – C:\Program Files\lxce.vbs
[2009/08/16 15:57:45 | 005,419,576 | —- | M] () – C:\Program Files\SopCast-3.2.4.zip

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2002/09/19 20:36:08 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2002/09/19 20:36:08 | 000,602,112 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2002/09/19 20:36:06 | 000,380,928 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2008/09/15 01:33:08 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2007/10/06 00:45:36 | 000,000,177 | -HS- | M] () – C:\Documents and Settings\Stevie\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/06/22 22:12:16 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Stevie\Desktop\HiJackThis.exe
[2011/06/23 18:43:09 | 000,579,072 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Stevie\Desktop\OTL.exe
[2011/06/22 23:03:08 | 001,441,584 | —- | M] (Kaspersky Lab ZAO) – C:\Documents and Settings\Stevie\Desktop\tdsskiller.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >
[2010/10/20 23:23:26 | 000,000,698 | —- | M] () – C:\WINDOWS\AppPatch\Custom\{a9264802-8a7a-40fe-a135-5c6d204aed7a}.sdb
[2010/11/16 00:00:08 | 000,000,786 | —- | M] () – C:\WINDOWS\AppPatch\Custom\{c9920352-04e6-469d-bab8-e2b9c7c75415}.sdb

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >
[2009/05/19 21:47:06 | 000,654,920 | —- | M] () – C:\Documents and Settings\Stevie\My Documents\mtinst.exe

< %USERPROFILE%\*.exe >
[2008/08/17 20:12:11 | 000,061,480 | —- | M] () – C:\Documents and Settings\Stevie\GoToAssistDownloadHelper.exe

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2007/10/06 00:45:36 | 000,000,122 | -HS- | M] () – C:\Documents and Settings\Stevie\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >
[2010/07/26 14:18:38 | 000,974,848 | —- | M] () – C:\WINDOWS\system32\System32\cis-2.4.dll
[2010/07/26 14:18:38 | 000,081,920 | —- | M] () – C:\WINDOWS\system32\System32\issacapi_bs-2.3.dll
[2010/07/26 14:18:38 | 000,065,536 | —- | M] () – C:\WINDOWS\system32\System32\issacapi_pe-2.3.dll
[2010/07/26 14:18:38 | 000,057,344 | —- | M] () – C:\WINDOWS\system32\System32\issacapi_se-2.3.dll
[2010/07/26 14:18:38 | 000,045,056 | —- | M] ((주) 마크애니) – C:\WINDOWS\system32\System32\MACXMLProto.dll
[2010/07/26 14:18:38 | 000,118,784 | —- | M] ((주)마크애니) – C:\WINDOWS\system32\System32\MaDRM.dll
[2010/07/26 14:18:38 | 000,049,152 | —- | M] ((주) 마크애니) – C:\WINDOWS\system32\System32\MaJGUILib.dll
[2010/05/13 06:35:22 | 000,106,609 | —- | M] ((주) 마크애니, 컨텐츠 사업실) – C:\WINDOWS\system32\System32\MaJUtilLib.dll
[2010/07/26 14:18:38 | 000,040,960 | —- | M] (마크애니연구소) – C:\WINDOWS\system32\System32\MAMACExtract.dll
[2010/07/26 14:18:38 | 000,243,576 | —- | M] ((주)마크애니) – C:\WINDOWS\system32\System32\MASetupCaller.dll
[2010/07/26 14:18:38 | 000,024,576 | —- | M] ((주)마크애니) – C:\WINDOWS\system32\System32\MASetupCleaner.exe
[2010/07/26 14:18:38 | 000,045,056 | —- | M] ((주) 마크애니) – C:\WINDOWS\system32\System32\MaXMLProto.dll
[2010/07/26 14:18:38 | 000,057,344 | —- | M] (Marktek) – C:\WINDOWS\system32\System32\MK_Lyric.dll
[2010/07/26 14:18:38 | 000,245,760 | —- | M] (Teruten Inc.) – C:\WINDOWS\system32\System32\MSCLib.dll
[2010/07/26 14:18:38 | 000,155,648 | —- | M] (Teruten Inc.) – C:\WINDOWS\system32\System32\MSFLib.dll
[2010/07/26 14:18:38 | 000,352,256 | —- | M] (Sample Corporation) – C:\WINDOWS\system32\System32\MSLUR71.dll
[2010/07/26 14:18:38 | 000,413,696 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\System32\msvcp60.dll
[2010/07/26 14:18:38 | 000,040,960 | —- | M] (Telechips Inc.,) – C:\WINDOWS\system32\System32\MTTELECHIP.dll
[2010/07/26 14:18:38 | 000,057,344 | —- | M] (Marktek Inc.) – C:\WINDOWS\system32\System32\MTXSYNCICON.dll
[2010/07/26 14:18:38 | 000,135,168 | —- | M] (Musiccity Co.Ltd.) – C:\WINDOWS\system32\System32\muzaf1.dll
[2010/07/26 14:18:38 | 000,491,520 | —- | M] (Musiccity Co.Ltd.) – C:\WINDOWS\system32\System32\muzapp.dll
[2010/07/26 14:18:38 | 000,172,032 | —- | M] (Musiccity Co.Ltd.) – C:\WINDOWS\system32\System32\muzapp.exe
[2010/07/26 14:18:38 | 000,569,344 | —- | M] (© MusicCity) – C:\WINDOWS\system32\System32\muzdecode.ax
[2010/07/26 14:18:38 | 000,122,880 | —- | M] (© MUSICCITY) – C:\WINDOWS\system32\System32\muzeffect.ax
[2010/07/26 14:18:38 | 000,110,592 | —- | M] (© MusicCity) – C:\WINDOWS\system32\System32\muzmp4sp.ax
[2010/07/26 14:18:38 | 000,131,072 | —- | M] (© MusicCity) – C:\WINDOWS\system32\System32\muzmpgsp.ax
[2010/07/26 14:18:38 | 000,258,048 | —- | M] (© PeeringPortal) – C:\WINDOWS\system32\System32\muzoggsp.ax
[2010/07/26 14:18:38 | 000,200,704 | —- | M] ( © MusicCity) – C:\WINDOWS\system32\System32\muzwmts.dll
[2010/07/26 14:18:38 | 000,023,040 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\System32\psapi.dll

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2011/06/22 22:43:37 | 000,000,067 | -HS- | M] () – C:\Documents and Settings\Stevie\Cookies\desktop.ini
[2011/06/23 18:56:02 | 000,425,984 | -HS- | M] () – C:\Documents and Settings\Stevie\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-06-16 21:16:20

< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:014BC3B4
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E1F04E8D
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C46995DA
@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2CFBE2D1
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F085C8A1

< End of report >

OTL Extras logfile created on: 23/06/2011 18:46:55 - Run 1
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Documents and Settings\Stevie\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

959.48 Mb Total Physical Memory | 359.46 Mb Available Physical Memory | 37.46% Memory free
2.26 Gb Paging File | 1.51 Gb Available in Paging File | 66.69% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 34.28 Gb Total Space | 9.39 Gb Free Space | 27.40% Space Free | Partition Type: NTFS

Computer Name: SN037427820165 | User Name: Stevie | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] – rundll32.exe shdocvw.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = htmlfile] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
InternetShortcut [open] – rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OtsMedia.Surf] – Reg Error: Value error.
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"427:TCP" = 427:TCP:LocalSubNet:Enabled:SLP_Port(427)_TCP
"427:UDP" = 427:UDP:LocalSubNet:Enabled:SLP_Port(427)_UDP

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"3659:UDP" = 3659:UDP:*:Enabled:PS3
"6000:UDP" = 6000:UDP:*:Enabled:ps3
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"135:TCP" = 135:TCP:*:Enabled:TCP Port 135
"5000:TCP" = 5000:TCP:*:Enabled:TCP Port 5000
"5001:TCP" = 5001:TCP:*:Enabled:TCP Port 5001
"5002:TCP" = 5002:TCP:*:Enabled:TCP Port 5002
"5003:TCP" = 5003:TCP:*:Enabled:TCP Port 5003
"5004:TCP" = 5004:TCP:*:Enabled:TCP Port 5004
"5005:TCP" = 5005:TCP:*:Enabled:TCP Port 5005
"5006:TCP" = 5006:TCP:*:Enabled:TCP Port 5006
"5007:TCP" = 5007:TCP:*:Enabled:TCP Port 5007
"5008:TCP" = 5008:TCP:*:Enabled:TCP Port 5008
"5009:TCP" = 5009:TCP:*:Enabled:TCP Port 5009
"5010:TCP" = 5010:TCP:*:Enabled:TCP Port 5010
"5011:TCP" = 5011:TCP:*:Enabled:TCP Port 5011
"5012:TCP" = 5012:TCP:*:Enabled:TCP Port 5012
"5013:TCP" = 5013:TCP:*:Enabled:TCP Port 5013
"5014:TCP" = 5014:TCP:*:Enabled:TCP Port 5014
"5015:TCP" = 5015:TCP:*:Enabled:TCP Port 5015
"5016:TCP" = 5016:TCP:*:Enabled:TCP Port 5016
"5017:TCP" = 5017:TCP:*:Enabled:TCP Port 5017
"5018:TCP" = 5018:TCP:*:Enabled:TCP Port 5018
"5019:TCP" = 5019:TCP:*:Enabled:TCP Port 5019
"5020:TCP" = 5020:TCP:*:Enabled:TCP Port 5020
"427:TCP" = 427:TCP:LocalSubNet:Enabled:SLP_Port(427)_TCP
"427:UDP" = 427:UDP:LocalSubNet:Enabled:SLP_Port(427)_UDP

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)
"D:\setup\hpznui01.exe" = D:\setup\hpznui01.exe:*:Enabled:hpznui01.exe
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe:*:Enabled:hpqcopy2.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe – ()
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe – (Hewlett-Packard)
"C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe" = C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe:*:Enabled:hpqphotocrm.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe
"C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe
"C:\Program Files\HP\HP Software Update\HPWUCli.exe" = C:\Program Files\HP\HP Software Update\HPWUCli.exe:*:Enabled:hpwucli.exe – (Hewlett-Packard)
"C:\Program Files\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe" = C:\Program Files\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe – (Hewlett-Packard Co.)
"E:\setup\hpznui01.exe" = E:\setup\hpznui01.exe:*:Enabled:hpznui01.exe

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\lxcecoms.exe" = C:\WINDOWS\system32\lxcecoms.exe:*:Enabled:4300 Series Server
"C:\WINDOWS\system32\spool\drivers\w32x86\3\lxcepswx.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\lxcepswx.exe:*:Enabled:4300 Series Printer Status
"C:\Program Files\Sports Interactive\Football Manager 2008\fm.exe" = C:\Program Files\Sports Interactive\Football Manager 2008\fm.exe:*:Disabled:Football Manager 2008
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire
"C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)
"C:\Program Files\SopCast\adv\SopAdver.exe" = C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver – (www.sopcast.com)
"C:\Program Files\SopCast\SopCast.exe" = C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application – (www.sopcast.com)
"C:\Documents and Settings\Stevie\Local Settings\Temporary Internet Files\Content.IE5\39FJ7N51\xbins[1].exe" = C:\Documents and Settings\Stevie\Local Settings\Temporary Internet Files\Content.IE5\39FJ7N51\xbins[1].exe:*:Enabled:xbins[1]
"C:\DOCUME~1\Stevie\LOCALS~1\Temp\fgcn_548.exe" = C:\DOCUME~1\Stevie\LOCALS~1\Temp\fgcn_548.exe:*:Enabled:fg_ol_silent
"$INSTDIR\FlvDetector.exe" = C:\Program Files\FlashGet Network\FlashGet 3\FlvDetector.exe:*:Enabled:FGFlvDetector
"C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe" = C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe:*:Enabled:Flashget3
"C:\Documents and Settings\Stevie\My Documents\Free Football\PPStream\PPStream.exe" = C:\Documents and Settings\Stevie\My Documents\Free Football\PPStream\PPStream.exe:*:Enabled:PPSÍøÂçµçÊÓ
"C:\Documents and Settings\Stevie\My Documents\Free Football\PPStream\PPSAP.exe" = C:\Documents and Settings\Stevie\My Documents\Free Football\PPStream\PPSAP.exe:*:Enabled:PPS ÍøÂç¼ÓËÙÆ÷
"C:\Program Files\PPStream\PPStream.exe" = C:\Program Files\PPStream\PPStream.exe:*:Enabled:PPSÍøÂçµçÊÓ
"C:\Program Files\PPStream\PPSAP.exe" = C:\Program Files\PPStream\PPSAP.exe:*:Enabled:PPS ÍøÂç¼ÓËÙÆ÷
"C:\Program Files\PPLive\PPLive.exe" = C:\Program Files\PPLive\PPLive.exe:*:Enabled:PPLive
"C:\Program Files\PPLive\PPLiveU.exe" = C:\Program Files\PPLive\PPLiveU.exe:*:Enabled:PPLiveU
"C:\Program Files\PPLiveVA\PPLiveVA.exe" = C:\Program Files\PPLiveVA\PPLiveVA.exe:*:Enabled:PPLiveVA
"C:\Program Files\PPLiveVA\FlvPick.exe" = C:\Program Files\PPLiveVA\FlvPick.exe:*:Enabled:FlvPick
"C:\Program Files\PPLiveVA\CrashUpload.exe" = C:\Program Files\PPLiveVA\CrashUpload.exe:*:Enabled:CrashUpload
"C:\Program Files\PPLiveVA\Download.exe" = C:\Program Files\PPLiveVA\Download.exe:*:Enabled:Download
"C:\Program Files\PPLiveVA\DownloadProgress.exe" = C:\Program Files\PPLiveVA\DownloadProgress.exe:*:Enabled:DownloadProgress
"C:\Documents and Settings\All Users\Application Data\PPLiveVA\Application\PPAP.exe" = C:\Documents and Settings\All Users\Application Data\PPLiveVA\Application\PPAP.exe:*:Enabled:PPAP
"C:\Program Files\Vuze\Azureus.exe" = C:\Program Files\Vuze\Azureus.exe:*:Enabled:Azureus / Vuze
"C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe" = C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent
"D:\setup\hpznui01.exe" = D:\setup\hpznui01.exe:*:Enabled:hpznui01.exe
"C:\WINDOWS\system32\muzapp.exe" = C:\WINDOWS\system32\muzapp.exe:*:Enabled:MUZ AOD APP player – (Musiccity Co.Ltd.)
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe:*:Enabled:hpqcopy2.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe – ()
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe – (Hewlett-Packard)
"C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe" = C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe:*:Enabled:hpqphotocrm.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe
"C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe
"C:\Program Files\HP\HP Software Update\HPWUCli.exe" = C:\Program Files\HP\HP Software Update\HPWUCli.exe:*:Enabled:hpwucli.exe – (Hewlett-Packard)
"C:\Program Files\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe" = C:\Program Files\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe – (Hewlett-Packard Co.)
"E:\setup\hpznui01.exe" = E:\setup\hpznui01.exe:*:Enabled:hpznui01.exe
"C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" = C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe:*:Enabled:McAfee Shared Service Host – (McAfee, Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{06E6E30D-B498-442F-A943-07DE41D7F785}" = Microsoft Search Enhancement Pack
"{07FB17D8-7DB6-4F06-80C4-8BE1719CB6A1}" = hpWLPGInstaller
"{09B44E78-A988-4BC0-962F-63ECD3333708}" = Packard Bell Companion
"{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation®Store
"{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}" = Scan
"{14C35072-D7D0-4B29-B5BF-C94E426D77E9}" = Sky Broadband
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1A6A6531-08FC-47AD-BAC4-C41497E71033}" = Nero 7 Essentials
"{1BD07DF4-FB06-41BA-B896-B2DA59000C96}" = Windows Live Toolbar
"{1DD81E7D-0D28-4CEB-87B2-C041A4FCB215}" = Rapport
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{21A2F5EE-1DC5-488A-BE7E-E526F8C61488}" = DeviceDiscovery
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java™ 6 Update 20
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{34610DE0-3C13-42CA-8E32-01FFA38AB6E8}" = PC Connectivity Solution
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{497072FE-0A75-4E5C-A5B7-EB1FA67F66F1}" = DJ_AIO_06_F4500_SW_MIN
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{55A7B938-3D1E-4819-A87B-F83E736EF52E}" = F4500
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{68A10D12-0D0F-4212-BDE6-D87FAD32A8FA}" = SmartWebPrinting
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{7059BDA7-E1DB-442C-B7A1-6144596720A4}" = HP Update
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{75247E38-5C9B-45D6-ADF8-E11CB56B4990}" = Network
"{764D06D8-D8DE-411E-A1C8-D9E9380F8A84}" = Microsoft Works 7.0
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7F08A772-2816-4F46-84F1-49578502AD28}" = HP Deskjet F4500 Printer Driver Software 13.0 Rel .6
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{8FB53850-246A-3507-8ADE-0060093FFEA6}" = Visual Studio Tools for the Office system 3.0 Runtime
"{91CA0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Small Business Edition 2003
"{92127AF5-FDD8-4ADF-BC40-C356C9EE0B7D}" = 32 Bit HP CIO Components Installer
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95120000-0122-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{a9264802-8a7a-40fe-a135-5c6d204aed7a}.sdb" = Internet Explorer (Enable DEP)
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.5
"{AC76BA86-7AD7-5670-0000-900000000003}" = Korean Fonts Support For Adobe Reader 9
"{AE8705FB-E13C-40A9-8A2D-68D6733FBFC2}" = Status
"{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync
"{B395BC1D-CC06-425E-9049-4CD985EFF004}" = LightScribe 1.8.15.1
"{B57EAFF2-D6EE-4C6C-9175-ED9F17BFC1BC}" = Windows Live Messenger
"{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}" = PlayStation®Network Downloader
"{B7588D45-AFDC-4C93-9E2E-A100F3554B64}" = Microsoft Fix it Center
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{C75CDBA2-3C86-481e-BD10-BDDA758F9DFF}" = hpPrintProjects
"{c9920352-04e6-469d-bab8-e2b9c7c75415}.sdb" = Microsoft Automated Troubleshooting Services Shim
"{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}" = Kies
"{D92FF8EB-BD77-40AE-B68B-A6BFC6F8661D}" = Windows Live Family Safety
"{DC0A5F99-FD66-433F-9D3A-05DCBA64BE42}" = TrayApp
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E6158D07-2637-4ECF-B576-37C489669174}" = Windows Live Call
"{EE39FFBD-544E-49E4-A999-6819828EAE91}" = Windows Live Photo Gallery
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{FAF26102-09D7-4C58-AB01-0D59A2E517CA}" = Copy
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"DivX Setup.divx.com" = DivX Setup
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.35.324
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Print Projects" = HP Print Projects 1.0
"HP Smart Web Printing" = HP Smart Web Printing 4.5
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"InstallShield_{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}" = Kies
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSC" = McAfee Internet Security
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MyFreeCodec" = MyFreeCodec
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Rapport_msi" = Rapport
"RealPlayer 12.0" = RealPlayer
"SopCast" = SopCast 3.3.2
"TomTom HOME" = TomTom HOME 2.8.1.2218
"Uninstall_is1" = Uninstall 1.0.0.1
"Visual Studio Tools for the Office system 3.0 Runtime" = Visual Studio Tools for the Office system 3.0 Runtime
"Vivitar Experience Image Manager" = Vivitar Experience Image Manager
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"MyFreeCodec" = MyFreeCodec

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 02/06/2011 06:58:40 | Computer Name = SN037427820165 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 02/06/2011 06:58:40 | Computer Name = SN037427820165 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 02/06/2011 06:58:40 | Computer Name = SN037427820165 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 02/06/2011 06:58:40 | Computer Name = SN037427820165 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 02/06/2011 06:59:31 | Computer Name = SN037427820165 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 03/06/2011 15:47:36 | Computer Name = SN037427820165 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 04/06/2011 07:33:51 | Computer Name = SN037427820165 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 04/06/2011 08:42:21 | Computer Name = SN037427820165 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 09/06/2011 12:19:02 | Computer Name = SN037427820165 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 09/06/2011 12:19:02 | Computer Name = SN037427820165 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 23/06/2011 06:21:38 | Computer Name = SN037427820165 | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk0\D.

Error - 23/06/2011 06:21:39 | Computer Name = SN037427820165 | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk0\D.

Error - 23/06/2011 06:21:39 | Computer Name = SN037427820165 | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk0\D.

Error - 23/06/2011 06:21:40 | Computer Name = SN037427820165 | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk0\D.

Error - 23/06/2011 06:21:40 | Computer Name = SN037427820165 | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk0\D.

Error - 23/06/2011 06:21:42 | Computer Name = SN037427820165 | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk0\D.

Error - 23/06/2011 06:21:42 | Computer Name = SN037427820165 | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk0\D.

Error - 23/06/2011 06:21:43 | Computer Name = SN037427820165 | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk0\D.

Error - 23/06/2011 06:21:43 | Computer Name = SN037427820165 | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk0\D.

Error - 23/06/2011 06:21:44 | Computer Name = SN037427820165 | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk0\D.

< End of report >

RkU Version: 3.8.389.593, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Service Pack 3)
Number of processors #1
==============================================
>Drivers
==============================================
0x804D7000 C:\WINDOWS\system32\ntoskrnl.exe 2192768 bytes (Microsoft Corporation, NT Kernel & System)
0x804D7000 PnpManager 2192768 bytes
0x804D7000 RAW 2192768 bytes
0x804D7000 WMIxWDM 2192768 bytes
0xBF800000 Win32k 1859584 bytes
0xBF800000 C:\WINDOWS\System32\win32k.sys 1859584 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0xBF012000 C:\WINDOWS\System32\SiSGRV.dll 1134592 bytes (Silicon Integrated Systems Corporation, SiS Compatible Super VGA Driver)
0xF7230000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
0xEF6E6000 C:\WINDOWS\System32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0xF6459000 C:\WINDOWS\System32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
0xF72E7000 mfehidk.sys 380928 bytes (McAfee, Inc., McAfee Link Driver)
0xEF874000 C:\WINDOWS\System32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
0xEBE28000 C:\WINDOWS\System32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)
0xF6638000 C:\WINDOWS\System32\DRIVERS\slntamr.sys 323584 bytes ( , slntamr driver)
0xF65C9000 C:\WINDOWS\system32\drivers\mfefirek.sys 307200 bytes (McAfee, Inc., McAfee Core Firewall Engine Driver)
0xBF127000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
0xEB3D4000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
0xF6577000 C:\WINDOWS\system32\drivers\STAC97.sys 221184 bytes (SigmaTel, Inc., SigmaTel Audio Driver (WDM))
0xF66BE000 C:\WINDOWS\System32\DRIVERS\sisgrp.sys 212992 bytes (Silicon Integrated Systems Corporation, SiS Compatible Super VGA Driver)
0xF7438000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
0xEB0F6000 C:\WINDOWS\System32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0xF7203000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
0xF7393000 dac2w2k.sys 180224 bytes (Mylex Corporation, Mylex Disk Array Controller Driver)
0xECD89000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)
0xEF7A4000 C:\WINDOWS\System32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0xEF813000 C:\WINDOWS\System32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
0xEF83B000 C:\WINDOWS\System32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)
0xEF756000 C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys 155648 bytes (Trusteer Ltd., RapportPG)
0xF6614000 C:\WINDOWS\system32\drivers\mfeavfk.sys 147456 bytes (McAfee, Inc., Anti-Virus File System Filter Driver)
0xF6553000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0xF652F000 C:\WINDOWS\System32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0xF6687000 C:\WINDOWS\System32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
0xEF7F1000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0xEF7CF000 C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys 139264 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASKUTIL.SYS)
0x806EF000 ACPI_HAL 131840 bytes
0x806EF000 C:\WINDOWS\system32\hal.dll 131840 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0xF7356000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0xF7408000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
0xF7376000 viamraid.sys 118784 bytes (VIA Technologies inc,.ltd, VIA AHCI RAID DRIVER FOR WIN XP/SRV2003)
0xF65AD000 C:\WINDOWS\System32\DRIVERS\Mtlmnt5.sys 114688 bytes ( , mtlmnt5 driver)
0xF71E9000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0xF73BF000 adpu160m.sys 102400 bytes (Microsoft Corporation, Adaptec Ultra160 SCSI miniport)
0xF73D8000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
0xEB1BB000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes
0xF73F0000 C:\WINDOWS\System32\DRIVERS\SCSIPORT.SYS 98304 bytes (Microsoft Corporation, SCSI Port Driver)
0xF72D0000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xF64C8000 C:\WINDOWS\System32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xEC201000 C:\WINDOWS\system32\drivers\mfeapfk.sys 90112 bytes (McAfee, Inc., Access Protection Filter Driver)
0xEB8CB000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
0xF6507000 C:\WINDOWS\system32\DRIVERS\mfendisk.sys 81920 bytes (McAfee, Inc., McAfee NDIS Intermediate Driver)
0xF651B000 C:\WINDOWS\System32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)
0xF66AA000 C:\WINDOWS\System32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
0xEF8CD000 C:\WINDOWS\System32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
0xEF861000 C:\WINDOWS\system32\drivers\mfetdi2k.sys 77824 bytes (McAfee, Inc., Anti-Virus Mini-Firewall Driver)
0xF72BD000 WudfPf.sys 77824 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver)
0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
0xF7344000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
0xF7427000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0xF64B7000 C:\WINDOWS\System32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
0xF7697000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
0xF7179000 C:\WINDOWS\System32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0xF7617000 C:\WINDOWS\System32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)
0xF75F7000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0xF6308000 C:\Program Files\Trusteer\Rapport\bin\RapportEI.sys 61440 bytes (Trusteer Ltd., RapportEI)
0xF7169000 C:\WINDOWS\System32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)
0xEB998000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
0xF7657000 C:\WINDOWS\System32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
0xF74E7000 aic78u2.sys 57344 bytes (Microsoft Corporation, Adaptec Ultra2 SCSI miniport)
0xF74B7000 aic78xx.sys 57344 bytes (Microsoft Corporation, Adaptec Ultra SCSI miniport)
0xF7547000 C:\WINDOWS\System32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
0xF7627000 C:\WINDOWS\System32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)
0xF0CDB000 C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\26762\RapportCerberus_26762.sys 53248 bytes (Trusteer Ltd., RapportCerberus)
0xF7637000 C:\WINDOWS\System32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0xF74A7000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0xEC347000 C:\WINDOWS\system32\drivers\cfwids.sys 49152 bytes (McAfee, Inc., McAfee Personal Firewall IDS Plugin)
0xF6742000 C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys 49152 bytes (Microsoft Corporation, Family Safety Filter Driver (TDI))
0xF7527000 ql12160.sys 49152 bytes (QLogic Corporation, Miniport Driver for QLogic ISP PCI Adapters)
0xF7517000 ql1280.sys 49152 bytes (QLogic Corporation, Miniport Driver for QLogic ISP PCI Adapters)
0xF7607000 C:\WINDOWS\System32\DRIVERS\R8139n51.SYS 49152 bytes (Realtek Semiconductor Corporation, Realtek RTL8139/810x Family NDIS 5.1 Drv)
0xF7587000 RapportKELL.sys 49152 bytes (Trusteer Ltd., RapportKE)
0xF7667000 C:\WINDOWS\System32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0xF75B7000 agp440.sys 45056 bytes (Microsoft Corporation, 440 NT AGP Filter)
0xF75C7000 agpCPQ.sys 45056 bytes (Microsoft Corporation, CompatNT AGP Filter)
0xF7597000 alim1541.sys 45056 bytes (Microsoft Corporation, ALi M1541 NT AGP Filter)
0xF75A7000 amdagp.sys 45056 bytes (Advanced Micro Devices, Inc., AMD Win2000 AGP Filter)
0xF0CCB000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)
0xF7189000 C:\WINDOWS\System32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)
0xF7497000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
0xF7647000 C:\WINDOWS\System32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0xF7577000 viaagp.sys 45056 bytes (Microsoft Corporation, VIA NT AGP Filter)
0xF7159000 C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 40960 bytes (GEAR Software Inc., CD DVD Filter)
0xF7487000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)
0xF7677000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
0xF7557000 PxHelp20.sys 40960 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)
0xF7507000 ql1080.sys 40960 bytes (QLogic Corporation, Miniport Driver for QLogic ISP PCI Adapters)
0xF74D7000 ql1240.sys 40960 bytes (Microsoft Corporation, QLogic ISP PCI Adapters)
0xF7567000 SISAGPX.sys 40960 bytes (Silicon Integrated Systems Corporation, SiS AGPv3.5 Filter)
0xF6762000 C:\WINDOWS\System32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
0xEBD24000 C:\WINDOWS\System32\Drivers\BlackBox.SYS 36864 bytes (RKU Driver)
0xF7537000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
0xF7199000 C:\WINDOWS\System32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)
0xF6782000 C:\WINDOWS\System32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
0xF6338000 C:\WINDOWS\System32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
0xF74C7000 ql10wnt.sys 36864 bytes (Microsoft Corporation, Miniport Driver for QLogic ISP PCI Adapters)
0xF74F7000 ultra.sys 36864 bytes (Promise Technology, Inc., Promise Ultra66 Miniport Driver)
0xF0CBB000 C:\WINDOWS\System32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0xF7847000 C:\WINDOWS\System32\Drivers\Asapi.SYS 32768 bytes (VOB Computersysteme GmbH, ASAPI)
0xF77AF000 C:\WINDOWS\System32\Drivers\Modem.SYS 32768 bytes (Microsoft Corporation, Modem Device Driver)
0xF626A000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
0xF7737000 symc8xx.sys 32768 bytes (LSI Logic, Symbios 8XX SCSI Miniport Driver)
0xF7747000 sym_u3.sys 32768 bytes (LSI Logic, Symbios Ultra3 SCSI Miniport Driver)
0xF77BF000 C:\WINDOWS\System32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0xF771F000 asc.sys 28672 bytes (Advanced System Products, Inc., AdvanSys SCSI Controller Driver)
0xF77C7000 C:\WINDOWS\System32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)
0xF776F000 hpn.sys 28672 bytes (Microsoft Corporation, NetRAID-4M Miniport Driver)
0xF7707000 C:\WINDOWS\System32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0xF7767000 perc2.sys 28672 bytes (Microsoft Corporation, PERC 2 Miniport Driver)
0xF773F000 sym_hi.sys 28672 bytes (LSI Logic, Symbios Hi-Perf SCSI Miniport Driver)
0xF774F000 ABP480N5.SYS 24576 bytes (Microsoft Corporation, AdvanSys SCSI Controller Driver)
0xF7757000 asc3350p.sys 24576 bytes (Microsoft Corporation, AdvanSys SCSI Card Driver)
0xF77D7000 C:\WINDOWS\System32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
0xF77CF000 C:\WINDOWS\System32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
0xF625A000 C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS 24576 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASDIFSV.SYS)
0xF6262000 C:\WINDOWS\System32\Drivers\StarOpen.SYS 24576 bytes
0xF784F000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0xF775F000 dpti2o.sys 20480 bytes (Microsoft Corporation, DPT SmartRAID miniport)
0xF786F000 C:\WINDOWS\System32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver)
0xF772F000 i2omp.sys 20480 bytes (Microsoft Corporation, I2O Miniport Driver)
0xF7727000 mraid35x.sys 20480 bytes (American Megatrends Inc., MegaRAID RAID Controller Driver for Windows Whistler 32)
0xF6272000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
0xF770F000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
0xF77E7000 C:\WINDOWS\System32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
0xF77EF000 C:\WINDOWS\System32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver)
0xF77A7000 C:\WINDOWS\System32\DRIVERS\SlWdmSup.sys 20480 bytes (Vireo Software, Description string for SlWdmSup driver)
0xF7717000 sparrow.sys 20480 bytes (Adaptec, Inc., Adaptec AIC-6x60 series SCSI miniport)
0xF77DF000 C:\WINDOWS\System32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
0xF77B7000 C:\WINDOWS\System32\DRIVERS\usbohci.sys 20480 bytes (Microsoft Corporation, OHCI USB Miniport Driver)
0xF787F000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
0xF789F000 aha154x.sys 16384 bytes (Microsoft Corporation, Adaptec AHA-154x series SCSI miniport)
0xF78AF000 asc3550.sys 16384 bytes (Advanced System Products, Inc., AdvanSys Ultra-Wide PCI SCSI Driver)
0xEB16F000 C:\WINDOWS\System32\DRIVERS\asyncmac.sys 16384 bytes (Microsoft Corporation, MS Remote Access serial network driver)
0xF78B7000 cbidf2k.sys 16384 bytes (Microsoft Corporation, CardBus/PCMCIA IDE Miniport Driver)
0xF789B000 cpqarray.sys 16384 bytes (Microsoft Corporation, Compaq Drive Array Controllers SCSI Miniport Driver)
0xF78A7000 dac960nt.sys 16384 bytes (Microsoft Corporation, Mylex Disk Array Controller Driver)
0xF78B3000 ini910u.sys 16384 bytes (Microsoft Corporation, INITIO ini910u SCSI miniport)
0xF6837000 C:\WINDOWS\System32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
0xF0123000 C:\WINDOWS\System32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
0xF684F000 C:\WINDOWS\System32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)
0xF78A3000 symc810.sys 16384 bytes (Symbios Logic Inc., Symbios Logic Inc. SCSI Miniport Driver)
0xF78AB000 amsint.sys 12288 bytes (Microsoft Corporation, AMD SCSI/NET Controller)
0xF7897000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
0xEE0B9000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
0xF64FB000 C:\WINDOWS\System32\Drivers\i2omgmt.SYS 12288 bytes (Microsoft Corporation, I2O Utility Filter)
0xF683F000 C:\WINDOWS\System32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0xF64E7000 C:\WINDOWS\System32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xF0C3F000 C:\WINDOWS\System32\DRIVERS\srvkp.sys 12288 bytes (Silicon Integrated Systems Corporation, SiS VGA Driver Manager)
0xF0C43000 C:\WINDOWS\System32\drivers\ws2ifsl.sys 12288 bytes (Microsoft Corporation, Winsock2 IFS Layer)
0xF798B000 aliide.sys 8192 bytes (Acer Laboratories Inc., ALi mini IDE Driver)
0xF7A0B000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
0xF7995000 cd20xrnt.sys 8192 bytes (Microsoft Corporation, IBM Portable CD-ROM Drive Miniport)
0xF798D000 cmdide.sys 8192 bytes (CMD Technology, Inc., CMD PCI IDE Bus Driver)
0xEB1E1000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes
0xF7A09000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
0xF7993000 intelide.sys 8192 bytes (Microsoft Corporation, Intel PCI IDE Driver)
0xF7987000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0xF7A0D000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
0xF79F7000 C:\WINDOWS\System32\Drivers\ParVdm.SYS 8192 bytes (Microsoft Corporation, VDM Parallel Driver)
0xF7997000 perc2hib.sys 8192 bytes (Microsoft Corporation, PERC 2 Hibernate Driver)
0xF7A0F000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
0xF79CD000 C:\WINDOWS\System32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0xF798F000 toside.sys 8192 bytes (Microsoft Corporation, Toshiba PCI IDE Controller)
0xF79E5000 C:\WINDOWS\System32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0xF7991000 viaide.sys 8192 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
0xF7989000 C:\WINDOWS\System32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0xF7A5D000 C:\WINDOWS\System32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
0xF7BD5000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
0xF7B70000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
0xF7A4F000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
==============================================
>Stealth
==============================================
WARNING: Virus alike driver modification [hsfdpsp2.sys]
WARNING: Virus alike driver modification [atinrvxx.sys]
WARNING: Virus alike driver modification [wadv08nt.sys]
WARNING: Virus alike driver modification [ati1mdxx.sys]
WARNING: Virus alike driver modification [cpqdap01.sys]
WARNING: Virus alike driver modification [wadv07nt.sys]
WARNING: Virus alike driver modification [mdmxsdk.sys]
WARNING: Virus alike driver modification [wadv09nt.sys]
WARNING: Virus alike driver modification [wadv11nt.sys]
WARNING: Virus alike driver modification [nikedrv.sys]
WARNING: Virus alike driver modification [rio8drv.sys]
WARNING: Virus alike driver modification [riodrv.sys]
WARNING: Virus alike driver modification [ati1pdxx.sys]
WARNING: Virus alike driver modification [fsvga.sys]
WARNING: Virus alike driver modification [slnt7554.sys]
WARNING: Virus alike driver modification [atinmdxx.sys]
WARNING: Virus alike driver modification [atinttxx.sys]
0x8619DA91 Unknown page with executable code, 1391 bytes
WARNING: Virus alike driver modification [atinpdxx.sys]
WARNING: Virus alike driver modification [smclib.sys]
WARNING: Virus alike driver modification [winddx.sys]
WARNING: Virus alike driver modification [s3gnbm.sys]
WARNING: Virus alike driver modification [ati1ttxx.sys]
WARNING: Virus alike driver modification [tsbvcap.sys]
WARNING: Virus alike driver modification [hsfbs2s2.sys]
WARNING: Virus alike driver modification [watv06nt.sys]
WARNING: Virus alike driver modification [watv10nt.sys]
WARNING: Virus alike driver modification [cinemst2.sys]
WARNING: Virus alike driver modification [ati1snxx.sys]
WARNING: Virus alike driver modification [atinsnxx.sys]
WARNING: Virus alike driver modification [ati1xbxx.sys]
WARNING: Virus alike driver modification [ati1raxx.sys]
WARNING: Virus alike driver modification [atmepvc.sys]
WARNING: Virus alike driver modification [atinxbxx.sys]
WARNING: Virus alike driver modification [ati2mtaa.sys]
WARNING: Virus alike driver modification [rawwan.sys]
0x8619C288 Unknown page with executable code, 3448 bytes
WARNING: Virus alike driver modification [ati1xsxx.sys]
WARNING: Virus alike driver modification [atmuni.sys]
WARNING: Virus alike driver modification [ati1tuxx.sys]
0x8619E191 Unknown page with executable code, 3695 bytes
WARNING: Virus alike driver modification [mtxparhm.sys]
WARNING: Virus alike driver modification [tosdvd.sys]
WARNING: Virus alike driver modification [atinraxx.sys]
0xF74A7000 WARNING: Virus alike driver modification [VolSnap.sys], 53248 bytes
WARNING: Virus alike driver modification [nwlnkspx.sys]
WARNING: Virus alike driver modification [ati1btxx.sys]
WARNING: Virus alike driver modification [atinbtxx.sys]
WARNING: Virus alike driver modification [vdmindvd.sys]
WARNING: Virus alike driver modification [rootmdm.sys]
0x861A0E7A Unknown thread object [ ETHREAD 0x8611D020 ] TID: 136, 600 bytes
0x861A3008 Unknown thread object [ ETHREAD 0x8611DDA8 ] TID: 140, 600 bytes
WARNING: Virus alike driver modification [nwlnknb.sys]
WARNING: Virus alike driver modification [atinxsxx.sys]
WARNING: Virus alike driver modification [ati1rvxx.sys]
WARNING: Virus alike driver modification [hsfcxts2.sys]
WARNING: Virus alike driver modification [ati2mtag.sys]
WARNING: Virus alike driver modification [atintuxx.sys]
WARNING: Virus alike driver modification [mcd.sys]
0x861A2CDC Unknown page with executable code, 804 bytes

Thanks

mowman

Post #5June 23, 2011, 6:36 PM UTC

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See this Link for programs that need to be disabled and instruction on how to disable them.
Remember to re-enable them when we're done.
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

Lpool18

Post #6June 23, 2011, 10:12 PM UTC

Hi Mowman Ok, I've run the Combofix but I'm not sure if it's working? A blue DOS screen has appeared but no log is appearing on it. It's been running now for about 40mins. Another box appeared with the following in it about 30 secs after starting thee run: 'The driver 'VOLSNAP.SYS' has been patched with a rootkit. Attempting disinfection. Please be patient. This may take several minutes. I've hit 'ok' on that. It has produced a 'catchme.text' with the following log: File "C:\WINDOWS\system32\drivers\volsnap.sys" added successfully File list cleared File "C:\WINDOWS\system32\drivers\volsnap.sys" added successfully File list cleared Is this the log you need? I'll let Combofix run on incase this length of time is normal and another log appear on the DOS. If it does, I'll paste it here. Steve

Lpool18

Post #7June 23, 2011, 11:34 PM UTC

Hi Mowman

Ignore the above message…just had to be patient.

Here is the log from the Combifix run.

ComboFix 11-06-23.01 - Stevie 23/06/2011 23:40:48.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.959.452 [GMT 1:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Firewall *Disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
* Resident AV is active
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Default User\WINDOWS
c:\documents and settings\Stevie\Application Data\PriceGong
c:\documents and settings\Stevie\Application Data\PriceGong\Data\1.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\a.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\b.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\c.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\d.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\e.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\f.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\g.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\h.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\i.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\J.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\k.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\l.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\m.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\n.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\o.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\p.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\q.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\r.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\s.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\t.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\u.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\v.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\w.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\x.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\y.xml
c:\documents and settings\Stevie\Application Data\PriceGong\Data\z.xml
c:\documents and settings\Stevie\GoToAssistDownloadHelper.exe
c:\documents and settings\Stevie\WINDOWS
c:\windows\Downloaded Program Files\f3initialsetup1.0.1.1.inf
c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\system32\404Fix.exe
c:\windows\system32\config\systemprofile\WINDOWS
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\muzapp.exe
c:\windows\system32\regobj.dll
c:\windows\system32\SrchSTS.exe
c:\windows\system32\system32
c:\windows\system32\system32\cis-2.4.dll
c:\windows\system32\system32\issacapi_bs-2.3.dll
c:\windows\system32\system32\issacapi_pe-2.3.dll
c:\windows\system32\system32\issacapi_se-2.3.dll
c:\windows\system32\system32\MACXMLProto.dll
c:\windows\system32\system32\MaDRM.dll
c:\windows\system32\system32\MaJGUILib.dll
c:\windows\system32\system32\MaJUtilLib.dll
c:\windows\system32\system32\MAMACExtract.dll
c:\windows\system32\system32\MASetupCaller.dll
c:\windows\system32\system32\MASetupCleaner.exe
c:\windows\system32\system32\MaXMLProto.dll
c:\windows\system32\system32\MK_Lyric.dll
c:\windows\system32\system32\MSCLib.dll
c:\windows\system32\system32\MSFLib.dll
c:\windows\system32\system32\MSLUR71.dll
c:\windows\system32\system32\msvcp60.dll
c:\windows\system32\system32\MTTELECHIP.dll
c:\windows\system32\system32\MTXSYNCICON.dll
c:\windows\system32\system32\muzaf1.dll
c:\windows\system32\system32\muzapp.dll
c:\windows\system32\system32\muzapp.exe
c:\windows\system32\system32\muzdecode.ax
c:\windows\system32\system32\muzeffect.ax
c:\windows\system32\system32\muzmp4sp.ax
c:\windows\system32\system32\muzmpgsp.ax
c:\windows\system32\system32\muzoggsp.ax
c:\windows\system32\system32\muzwmts.dll
c:\windows\system32\system32\psapi.dll
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
.
Infected copy of c:\windows\system32\drivers\volsnap.sys was found and disinfected
Restored copy from - Kitty had a snack

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Legacy_Sukoku_Service
——-\Service_Sukoku Service
.
.
((((((((((((((((((((((((( Files Created from 2011-05-23 to 2011-06-23 )))))))))))))))))))))))))))))))
.
.
2011-06-22 20:06 . 2011-06-22 20:06 ——– d—–w- c:\windows\system32\wbem\Repository
2011-06-22 20:05 . 2011-06-23 12:55 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2011-06-22 20:05 . 2011-06-22 20:05 ——– d—–w- c:\program files\NOS
2011-06-22 20:02 . 2011-06-22 20:02 ——– d—–w- c:\program files\Common Files\Adobe AIR
2011-06-19 17:29 . 2011-06-19 17:29 ——– d—–w- c:\documents and settings\NetworkService\Application Data\McAfee
2011-06-17 17:14 . 2011-06-17 17:14 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2011-06-17 17:14 . 2011-06-23 20:59 ——– d—–w- c:\program files\McAfee Security Scan
2011-06-16 17:15 . 2011-04-21 13:37 105472 ——w- c:\windows\system32\dllcache\mup.sys
2011-06-07 11:35 . 2011-06-07 11:35 103864 —-a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
2011-05-25 21:07 . 2011-05-25 21:07 ——– d—–w- c:\documents and settings\Stevie\Local Settings\Application Data\FixItCenter
2011-05-25 20:54 . 2011-05-25 20:54 ——– d—–w- c:\windows\MATS
2011-05-25 20:54 . 2011-05-25 20:54 ——– d—–w- c:\program files\Microsoft Fix it Center
2011-05-25 20:45 . 2011-05-25 20:45 ——– d—–w- c:\documents and settings\Stevie\Application Data\ElevatedDiagnostics
2011-05-25 19:49 . 2011-05-28 07:48 ——– d—–w- c:\program files\PC Speed Up
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-02 15:31 . 2003-03-03 14:57 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-04-29 16:19 . 2002-09-19 19:26 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-28 13:34 . 2011-04-28 13:34 53816 —-a-w- c:\windows\system32\drivers\RapportKELL.sys
2011-04-25 16:11 . 2006-06-23 10:33 916480 —-a-w- c:\windows\system32\wininet.dll
2011-04-25 16:11 . 2002-09-19 19:26 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-04-25 16:11 . 2002-09-19 19:26 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2011-04-25 12:01 . 2004-08-04 05:59 385024 —-a-w- c:\windows\system32\html.iec
2011-04-21 13:37 . 2002-09-19 19:26 105472 —-a-w- c:\windows\system32\drivers\mup.sys
2011-04-14 13:01 . 2011-04-28 23:28 9344 —-a-w- c:\windows\system32\drivers\mfeclnk.sys
2011-04-14 13:01 . 2011-04-28 23:27 141792 —-a-w- c:\windows\system32\mfevtps.exe
2011-04-14 13:01 . 2011-04-28 23:27 95824 —-a-w- c:\windows\system32\drivers\mfeapfk.sys
2011-04-14 13:01 . 2011-04-28 23:27 88736 —-a-w- c:\windows\system32\drivers\mfendisk.sys
2011-04-14 13:01 . 2011-04-28 23:27 84488 —-a-w- c:\windows\system32\drivers\mferkdet.sys
2011-04-14 13:01 . 2011-04-28 23:27 84200 —-a-w- c:\windows\system32\drivers\mfetdi2k.sys
2011-04-14 13:01 . 2011-04-28 23:27 56064 —-a-w- c:\windows\system32\drivers\cfwids.sys
2011-04-14 13:01 . 2011-04-28 23:27 52320 —-a-w- c:\windows\system32\drivers\mfebopk.sys
2011-04-14 13:01 . 2011-04-28 23:27 387480 —-a-w- c:\windows\system32\drivers\mfehidk.sys
2011-04-14 13:01 . 2011-04-28 23:27 314088 —-a-w- c:\windows\system32\drivers\mfefirek.sys
2011-04-14 13:01 . 2011-04-28 23:27 153280 —-a-w- c:\windows\system32\drivers\mfeavfk.sys
2005-09-21 16:38 . 2005-09-21 16:38 677 -c–a-w- c:\program files\lxce.vbs
2011-04-14 13:01 . 2011-06-22 20:19 24376 —-a-w- c:\program files\mozilla firefox\components\Scriptff.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-22 68856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-17 421888]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2011-04-05 1195408]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-14 53760]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2009-05-19 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-05 15:18 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"$INSTDIR\\FlvDetector.exe"= c:\\Program Files\\FlashGet Network\\FlashGet 3\\FlvDetector.exe
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqcopy2.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\Bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Common Files\\McAfee\\McSvcHost\\McSvHost.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3659:UDP"= 3659:UDP:PS3
"6000:UDP"= 6000:UDP:ps3
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020
.
R0 RapportKELL;RapportKELL;c:\windows\system32\drivers\RapportKELL.sys [28/04/2011 14:34 53816]
R1 Asapi;Asapi;c:\windows\system32\drivers\asapi.sys [15/07/2004 11:11 11264]
R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [29/04/2011 00:27 84200]
R1 RapportCerberus_26762;RapportCerberus_26762;c:\documents and settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\26762\RapportCerberus_26762.sys [16/06/2011 23:02 57144]
R1 RapportEI;RapportEI;c:\program files\Trusteer\Rapport\bin\RapportEI.sys [28/04/2011 14:34 66360]
R1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [28/04/2011 14:34 158904]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [10/10/2006 12:53 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [27/02/2007 11:39 67656]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [08/05/2010 11:33 203280]
R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [29/04/2011 00:27 271480]
R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [29/04/2011 00:27 271480]
R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\mfefire.exe [29/04/2011 00:28 188136]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [29/04/2011 00:27 141792]
R2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [28/04/2011 14:34 870200]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [09/03/2011 13:30 92592]
R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [29/04/2011 00:27 56064]
R3 MatSvc;Microsoft Automated Troubleshooting Service;c:\program files\Microsoft Fix it Center\Matsvc.exe [16/11/2010 01:10 267568]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [29/04/2011 00:27 314088]
R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [29/04/2011 00:27 88736]
S2 gupdate1ca8478a9da0ea4;Google Update Service (gupdate1ca8478a9da0ea4);c:\program files\Google\Update\GoogleUpdate.exe [24/12/2009 10:08 133104]
S3 cpuz134;cpuz134;\??\c:\program files\CPUID\PC Wizard 2010\pcwiz_x32.sys –> c:\program files\CPUID\PC Wizard 2010\pcwiz_x32.sys [?]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [22/12/2009 03:31 18136]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [17/07/2010 11:57 36640]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [24/12/2009 10:08 133104]
S3 LgBttPort;LGE Bluetooth TransPort;c:\windows\system32\DRIVERS\lgbtport.sys –> c:\windows\system32\DRIVERS\lgbtport.sys [?]
S3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\DRIVERS\lgbtbus.sys –> c:\windows\system32\DRIVERS\lgbtbus.sys [?]
S3 LGVMODEM;LGE Virtual Modem;c:\windows\system32\DRIVERS\lgvmodem.sys –> c:\windows\system32\DRIVERS\lgvmodem.sys [?]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [15/01/2010 13:49 227232]
S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [29/04/2011 00:27 88736]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [29/04/2011 00:27 84488]
S3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [19/09/2002 20:26 14336]
S3 PSSDK42;PSSDK42;c:\windows\system32\drivers\pssdk42.sys [20/02/2011 18:31 38976]
S3 PSSDKLBF;PSSDKLBF;c:\windows\system32\drivers\pssdklbf.sys [20/02/2011 18:31 53312]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [16/02/2006 16:51 12872]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\drivers\ss_bbus.sys [15/08/2010 15:33 98432]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\drivers\ss_bmdfl.sys [15/08/2010 15:33 14848]
S3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\drivers\ss_bmdm.sys [15/08/2010 15:33 123648]
S3 ss_bserd;SAMSUNG USB Mobile Logging Driver;c:\windows\system32\drivers\ss_bserd.sys [15/08/2010 15:33 100224]
S3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\drivers\sscebus.sys [15/08/2010 15:33 98560]
S3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\drivers\sscemdfl.sys [15/08/2010 15:33 14848]
S3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\drivers\sscemdm.sys [15/08/2010 15:33 123648]
S3 STAC97NA;SigmaTel 3D Environmental Audio;c:\windows\system32\drivers\stac97na.sys [01/01/1980 296179]
S3 STAC97NH;STAC97NH;c:\windows\system32\drivers\stac97nh.sys [01/01/1980 231983]
S4 dgdersvc;Device Error Recovery Service;c:\windows\system32\dgdersvc.exe [22/12/2009 03:31 95568]
S4 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [17/07/2010 11:57 217088]
.
— Other Services/Drivers In Memory —
.
*Deregistered* - mfeavfk01
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-07-18 16:53 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-23 c:\windows\Tasks\ConfigExec.job
- c:\program files\Microsoft Fix it Center\MatsApi.dll [2010-11-16 00:09]
.
2011-06-23 c:\windows\Tasks\DataUpload.job
- c:\program files\Microsoft Fix it Center\MatsApi.dll [2010-11-16 00:09]
.
2011-06-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-24 09:08]
.
2011-06-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-24 09:08]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://google.co.uk/
IE: Download All By FlashGet3 - c:\documents and settings\Stevie\Application Data\FlashGetBHO\GetAllUrl.htm
IE: Download By FlashGet3 - c:\documents and settings\Stevie\Application Data\FlashGetBHO\GetUrl.htm
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Free YouTube to Mp3 Converter - c:\documents and settings\Stevie\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
Trusted Zone: bitsoup.org\www
Trusted Zone: motive.com\pbttbc.bt
TCP: DhcpNameServer = 192.168.0.1
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {0972B098-DEE9-4279-AC7E-4BAAA029102D} - hxxp://assets.photobox.com/assets/aurigma/ImageUploader5.cab?20110428084740
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-Adobe Flash Player ActiveX - c:\windows\system32\Macromed\Flash\FlashUtil10t_ActiveX.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-24 00:18
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,24,77,29,7c,89,b8,d0,47,b0,6f,23,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,24,77,29,7c,89,b8,d0,47,b0,6f,23,\
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(852)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(4072)
c:\windows\system32\WININET.dll
c:\program files\McAfee\SiteAdvisor\saHook.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Common Files\McAfee\SystemCore\mcshield.exe
c:\progra~1\mcafee\VIRUSS~1\mcvsshld.exe
.
**************************************************************************
.
Completion time: 2011-06-24 00:29:12 - machine was rebooted
ComboFix-quarantined-files.txt 2011-06-23 23:29
.
Pre-Run: 9,959,948,288 bytes free
Post-Run: 10,048,327,680 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
.
- - End Of File - - DBA1ACE1ABB3AF1FBB227A1B73BEE6BF

mowman

Post #8June 23, 2011, 11:50 PM UTC

Combofix normally takes about 20 mins but can take a lot longer for heavily infected machines.

Clean out your temp files.
Download Attribune's ATF Cleaner and save to your desktop.
Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opera browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

Please open your MalwareBytes AntiMalware Program
Click the Update Tab and search for updates
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Next

Run the following scan: Eset Online Scanner

Place a check mark in the box YES, I accept the Terms Of Use
Click the Start button.
Now click the Install button.
Click Start. The scanner engine will initialize and update.
Place a check mark in the box beside Remove found threats.
Click the Scan button. The scan will now run, please be patient.
When the scan finishes click the Details tab.
Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.

Lpool18

Post #9June 24, 2011, 5:57 PM UTC

Hi Mowman I run Malwarebytes and the log is below, it didn't find anything. I also ran the Eset Online Scanner. It didn't find anything either and there was no option button to click on details. I'm presuming thats normal if nothing is found? Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 5554 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 24/06/2011 17:12:10 mbam-log-2011-06-24 (17-12-10).txt Scan type: Quick scan Objects scanned: 150207 Time elapsed: 9 minute(s), 42 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

mowman

Post #10June 24, 2011, 10:04 PM UTC

Post a new OTL log and tell me how the computer is running now.

Lpool18

Post #11June 24, 2011, 11:49 PM UTC

Hi Mowman

The PC seems to be running pretty smooth now. No redirections as yet.As well as the OTL scan below, I run a quick scan on McAfee as it always picked up this virus within the 1st 50 files but nothing has been found so fingers crossed.

Do you know if this virus would stop me from being able to download updates for Adobe etc? I haven't tried since you started to help me with this but I used to get the 'delayed write' bubble appearing from the system tray anytime I tried to update anything. That hasn't appeared since but then again I haven't tried to download anything yet.

Here is the log from the latest OTL:

OTL logfile created on: 24/06/2011 23:47:45 - Run 2
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Documents and Settings\Stevie\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

959.48 Mb Total Physical Memory | 561.76 Mb Available Physical Memory | 58.55% Memory free
2.26 Gb Paging File | 1.81 Gb Available in Paging File | 80.08% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 34.28 Gb Total Space | 9.49 Gb Free Space | 27.68% Space Free | Partition Type: NTFS

Computer Name: SN037427820165 | User Name: Stevie | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Stevie\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Trusteer\Rapport\bin\RapportService.exe (Trusteer Ltd.)
PRC - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (Trusteer Ltd.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe (McAfee, Inc.)
PRC - C:\WINDOWS\system32\mfevtps.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
PRC - C:\Program Files\Microsoft Fix it Center\Matsvc.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\slserv.exe ( )

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Stevie\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\McAfee\SiteAdvisor\sahook.dll ()
MOD - C:\WINDOWS\system32\framedyn.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (HidServ) – File not found
SRV - (AppMgmt) – File not found
SRV - (RapportMgmtService) – C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (Trusteer Ltd.)
SRV - (mfefire) – C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV - (mfevtp) – C:\WINDOWS\system32\mfevtps.exe (McAfee, Inc.)
SRV - (nosGetPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper_3004.dll (NOS Microsystems Ltd.)
SRV - (TomTomHOMEService) – C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
SRV - (MatSvc) – C:\Program Files\Microsoft Fix it Center\Matsvc.exe (Microsoft Corporation)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (dgdersvc) – C:\WINDOWS\system32\dgdersvc.exe (Devguru Co., Ltd.)
SRV - (MSK80Service) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McProxy) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNASvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNaiAnn) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McMPFSvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (FsUsbExService) – C:\WINDOWS\system32\FsUsbExService.Exe (Teruten)
SRV - (McAfee SiteAdvisor Service) – C:\Program Files\McAfee\SiteAdvisor\McSACore.exe ()
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (SLService) – C:\WINDOWS\System32\slserv.exe ( )

========== Driver Services (SafeList) ==========

DRV - (RapportCerberus_26762) – C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\26762\RapportCerberus_26762.sys (Trusteer Ltd.)
DRV - (RapportEI) – C:\Program Files\Trusteer\Rapport\bin\RapportEI.sys (Trusteer Ltd.)
DRV - (RapportKELL) – C:\WINDOWS\System32\Drivers\RapportKELL.sys (Trusteer Ltd.)
DRV - (RapportPG) – C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (Trusteer Ltd.)
DRV - (mfehidk) – C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfefirek) – C:\WINDOWS\system32\drivers\mfefirek.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\WINDOWS\system32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\WINDOWS\system32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mfendiskmp) – C:\WINDOWS\system32\drivers\mfendisk.sys (McAfee, Inc.)
DRV - (mfendisk) – C:\WINDOWS\system32\drivers\mfendisk.sys (McAfee, Inc.)
DRV - (mferkdet) – C:\WINDOWS\system32\drivers\mferkdet.sys (McAfee, Inc.)
DRV - (mfetdi2k) – C:\WINDOWS\system32\drivers\mfetdi2k.sys (McAfee, Inc.)
DRV - (cfwids) – C:\WINDOWS\system32\drivers\cfwids.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\WINDOWS\system32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (PSSDKLBF) – C:\WINDOWS\system32\drivers\pssdklbf.sys (microOLAP Technologies LTD)
DRV - (PSSDK42) – C:\WINDOWS\system32\drivers\pssdk42.sys (microOLAP Technologies LTD)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (dgderdrv) – C:\WINDOWS\system32\drivers\dgderdrv.sys (Devguru Co., Ltd)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASENUM) – C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (FsUsbExDisk) – C:\WINDOWS\system32\FsUsbExDisk.Sys ()
DRV - (ssm_mdm) – C:\WINDOWS\system32\drivers\ssm_mdm.sys (MCCI Corporation)
DRV - (ssm_bus) SAMSUNG Mobile USB Device II 1.0 driver (WDM) – C:\WINDOWS\system32\drivers\ssm_bus.sys (MCCI Corporation)
DRV - (ssm_mdfl) – C:\WINDOWS\system32\drivers\ssm_mdfl.sys (MCCI Corporation)
DRV - (sscemdm) – C:\WINDOWS\system32\drivers\sscemdm.sys (MCCI Corporation)
DRV - (sscebus) SAMSUNG USB Composite Device V2 driver (WDM) – C:\WINDOWS\system32\drivers\sscebus.sys (MCCI Corporation)
DRV - (sscemdfl) – C:\WINDOWS\system32\drivers\sscemdfl.sys (MCCI Corporation)
DRV - (ss_bmdm) – C:\WINDOWS\system32\drivers\ss_bmdm.sys (MCCI Corporation)
DRV - (ss_bserd) – C:\WINDOWS\system32\drivers\ss_bserd.sys (MCCI Corporation)
DRV - (ss_bbus) SAMSUNG USB Mobile Device (WDM) – C:\WINDOWS\system32\drivers\ss_bbus.sys (MCCI)
DRV - (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter) – C:\WINDOWS\system32\drivers\ss_bmdfl.sys (MCCI Corporation)
DRV - (fssfltr) – C:\WINDOWS\system32\drivers\fssfltr_tdi.sys (Microsoft Corporation)
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (NCHSSVAD) – C:\WINDOWS\system32\drivers\nchssvad.sys (NCH Swift Sound)
DRV - (s716mdm) – C:\WINDOWS\system32\drivers\s716mdm.sys (MCCI Corporation)
DRV - (s716mdfl) – C:\WINDOWS\system32\drivers\s716mdfl.sys (MCCI Corporation)
DRV - (s716bus) Sony Ericsson Device 716 driver (WDM) – C:\WINDOWS\system32\drivers\s716bus.sys (MCCI Corporation)
DRV - (StarOpen) – C:\WINDOWS\System32\drivers\StarOpen.sys ()
DRV - (PRISM_A02) – C:\WINDOWS\system32\drivers\PRISMA02.sys (Conexant Systems, Inc.)
DRV - (RecAgent) – C:\WINDOWS\system32\drivers\recagent.sys (Smart Link)
DRV - (STAC97) Audio Driver (WDM) – C:\WINDOWS\system32\drivers\STAC97.sys (SigmaTel, Inc.)
DRV - (SiSkp) – C:\WINDOWS\system32\drivers\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (SiS315) – C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (sisagp) – C:\WINDOWS\System32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation)
DRV - (Mtlstrm) – C:\WINDOWS\system32\drivers\mtlstrm.sys ( )
DRV - (SlNtHal) – C:\WINDOWS\system32\drivers\slnthal.sys ( )
DRV - (Slntamr) – C:\WINDOWS\system32\drivers\slntamr.sys ( )
DRV - (Mtlmnt5) – C:\WINDOWS\system32\drivers\mtlmnt5.sys ( )
DRV - (NtMtlFax) – C:\WINDOWS\system32\drivers\ntmtlfax.sys ( )
DRV - (SlWdmSup) – C:\WINDOWS\system32\drivers\slwdmsup.sys (Vireo Software)
DRV - (STAC97NH) – C:\WINDOWS\system32\drivers\stac97nh.sys (SigmaTel Inc.)
DRV - (STAC97NA) – C:\WINDOWS\system32\drivers\stac97na.sys (SigmaTel Inc.)
DRV - (Asapi) – C:\WINDOWS\System32\drivers\asapi.sys (VOB Computersysteme GmbH)
DRV - (rtl8139) – C:\WINDOWS\system32\drivers\R8139n51.sys (Realtek Semiconductor Corporation)
DRV - (ms_mpu401) – C:\WINDOWS\system32\drivers\msmpu401.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://uk.red.clientapps.yahoo.com/customi…fo/bt_side.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = EC FA E1 E2 16 B6 CB 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: [removed]:1.7.1
FF - prefs.js..extensions.enabledItems: [removed]:1.0.2

[2011/06/22 22:41:11 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Stevie\Application Data\Mozilla\Extensions
[2008/05/04 12:57:37 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Stevie\Application Data\Mozilla\Extensions\[removed]
[2011/04/15 18:45:34 | 000,000,000 | —D | M] (Map status indicator) – C:\PROGRAM FILES\TOMTOM HOME 2\XUL\EXTENSIONS\[removed]
[2011/04/14 14:01:38 | 000,024,376 | —- | M] (McAfee, Inc.) – C:\Program Files\Mozilla Firefox\components\Scriptff.dll

O1 HOSTS File: ([2011/06/24 00:18:01 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\McAfee\MSK\mskapbho.dll ()
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20110622211955.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (no name) - AutorunsDisabled - No CLSID value found.
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Download All By FlashGet3 - C:\Documents and Settings\Stevie\Application Data\FlashGetBHO\GetAllUrl.htm ()
O8 - Extra context menu item: Download By FlashGet3 - C:\Documents and Settings\Stevie\Application Data\FlashGetBHO\GetUrl.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Documents and Settings\Stevie\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll (Google Inc.)
O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: bitsoup.org ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: motive.com ([pbttbc.bt] https in Trusted sites)
O16 - DPF: {0972B098-DEE9-4279-AC7E-4BAAA029102D} http://assets.photobox.com/assets/aurigma/…?20110428084740 (PhotoboxPhotowaysUploader5 Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/C/0…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} http://messenger.zone.msn.com/binary/Solit…wn.cab56986.cab (Solitaire Showdown Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1214166787500 (MUWebControl Class)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.hp.com/ediags/gmn2/inst…tDetection2.cab (GMNRev Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} http://www.orderingmemory.com/controls/cpcScanner.cab (Crucial cpcScan)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Documents and Settings\Stevie\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Stevie\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/06/24 23:39:29 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\McAfee
[2011/06/24 17:16:32 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/06/24 16:59:35 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/06/24 16:57:05 | 000,050,688 | —- | C] (Atribune.org) – C:\Documents and Settings\Stevie\Desktop\ATF-Cleaner.exe
[2011/06/23 23:34:56 | 000,000,000 | RHSD | C] – C:\cmdcons
[2011/06/23 23:28:28 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/06/23 23:28:24 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/06/23 23:28:24 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/06/23 23:28:24 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/06/23 22:42:09 | 000,000,000 | —D | C] – C:\Qoobox
[2011/06/23 22:32:21 | 004,135,090 | R— | C] (Swearware) – C:\Documents and Settings\Stevie\Desktop\ComboFix.exe
[2011/06/23 21:59:29 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\McAfee Security Scan Plus
[2011/06/23 18:42:52 | 000,579,072 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Stevie\Desktop\OTL.exe
[2011/06/22 23:02:49 | 001,441,584 | —- | C] (Kaspersky Lab ZAO) – C:\Documents and Settings\Stevie\Desktop\tdsskiller.exe
[2011/06/22 22:12:10 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Stevie\Desktop\HiJackThis.exe
[2011/06/22 21:05:26 | 000,000,000 | —D | C] – C:\Program Files\NOS
[2011/06/22 21:05:26 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NOS
[2011/06/22 21:04:43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NOS(7)
[2011/06/22 21:03:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NOS(6)
[2011/06/22 21:02:57 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NOS(5)
[2011/06/22 21:02:26 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NOS(4)
[2011/06/22 21:02:25 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NOS(3)
[2011/06/22 21:02:04 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe AIR
[2011/06/22 20:19:24 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NOS(2)
[2011/06/22 00:16:23 | 000,000,000 | –SD | C] – C:\Documents and Settings\Stevie\My Documents\My Data Sources
[2011/06/19 18:29:36 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\McAfee
[2011/06/17 18:17:44 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2011/06/17 18:14:28 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee Security Scan
[2011/06/17 18:14:21 | 000,000,000 | —D | C] – C:\Program Files\McAfee Security Scan
[2011/06/16 22:51:00 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Stevie\Recent
[2011/06/16 18:15:33 | 000,105,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mup.sys
[2008/06/07 12:21:56 | 001,570,816 | —- | C] (Toshiba Samsung Storage Technology Coporation) – C:\Documents and Settings\Stevie\Application Data\tsdnwin.dll
[2004/07/15 10:51:07 | 000,014,976 | —- | C] ( ) – C:\WINDOWS\System32\drivers\winddx.sys
[1980/01/01 00:00:00 | 001,293,192 | —- | C] ( ) – C:\WINDOWS\System32\drivers\mtlstrm.sys
[1980/01/01 00:00:00 | 000,516,616 | —- | C] ( ) – C:\WINDOWS\System32\drivers\slntamr.sys
[1980/01/01 00:00:00 | 000,210,128 | —- | C] ( ) – C:\WINDOWS\System32\drivers\mtlmnt5.sys
[1980/01/01 00:00:00 | 000,162,136 | —- | C] ( ) – C:\WINDOWS\System32\drivers\ntmtlfax.sys
[1980/01/01 00:00:00 | 000,085,520 | —- | C] ( ) – C:\WINDOWS\System32\drivers\slnthal.sys
[1980/01/01 00:00:00 | 000,045,056 | —- | C] ( ) – C:\WINDOWS\System32\slserv.exe
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/24 23:41:05 | 000,000,616 | -H– | M] () – C:\WINDOWS\tasks\ConfigExec.job
[2011/06/24 23:39:09 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/06/24 23:39:08 | 1006,161,920 | -HS- | M] () – C:\hiberfil.sys
[2011/06/24 22:04:01 | 000,000,580 | -H– | M] () – C:\WINDOWS\tasks\DataUpload.job
[2011/06/24 16:57:06 | 000,050,688 | —- | M] (Atribune.org) – C:\Documents and Settings\Stevie\Desktop\ATF-Cleaner.exe
[2011/06/24 00:18:01 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2011/06/23 23:35:06 | 000,000,327 | RHS- | M] () – C:\BOOT.INI
[2011/06/23 22:32:22 | 004,135,090 | R— | M] (Swearware) – C:\Documents and Settings\Stevie\Desktop\ComboFix.exe
[2011/06/23 21:59:29 | 000,001,619 | —- | M] () – C:\Documents and Settings\All Users\Desktop\McAfee Security Scan Plus.lnk
[2011/06/23 21:59:29 | 000,001,611 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2011/06/23 19:04:41 | 000,139,264 | —- | M] () – C:\Documents and Settings\Stevie\Desktop\RKUnhookerLE.EXE
[2011/06/23 18:43:09 | 000,579,072 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Stevie\Desktop\OTL.exe
[2011/06/22 23:03:08 | 001,441,584 | —- | M] (Kaspersky Lab ZAO) – C:\Documents and Settings\Stevie\Desktop\tdsskiller.exe
[2011/06/22 22:12:16 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Stevie\Desktop\HiJackThis.exe
[2011/06/22 21:08:44 | 000,001,170 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/06/21 19:01:24 | 000,436,014 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/06/21 19:01:24 | 000,068,926 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/06/17 18:10:27 | 000,001,732 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2011/06/16 23:33:09 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/06/05 11:35:08 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/05 11:35:07 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/01 08:44:35 | 000,000,069 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2011/05/30 23:19:48 | 005,964,800 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mshtml.dll
[2011/05/27 18:20:29 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/23 23:28:29 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/06/23 23:28:25 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/06/23 23:28:24 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/06/23 23:28:24 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/06/23 23:28:24 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/06/23 19:04:31 | 000,139,264 | —- | C] () – C:\Documents and Settings\Stevie\Desktop\RKUnhookerLE.EXE
[2011/06/22 19:22:34 | 1006,161,920 | -HS- | C] () – C:\hiberfil.sys
[2011/06/17 18:14:25 | 000,001,619 | —- | C] () – C:\Documents and Settings\All Users\Desktop\McAfee Security Scan Plus.lnk
[2011/06/17 18:14:25 | 000,001,611 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2011/05/27 18:20:32 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/05/27 00:16:57 | 001,136,664 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/12/03 17:56:42 | 000,201,915 | —- | C] () – C:\WINDOWS\hpoins46.dat
[2010/12/03 17:56:42 | 000,000,606 | —- | C] () – C:\WINDOWS\hpomdl46.dat
[2010/09/29 17:21:35 | 000,040,960 | —- | C] () – C:\WINDOWS\Sublock.dll
[2010/09/29 17:21:34 | 000,221,291 | —- | C] () – C:\WINDOWS\Imei_dll.dll
[2010/07/17 11:57:55 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\FsUsbExDevice.Dll
[2010/07/17 11:57:55 | 000,036,640 | —- | C] () – C:\WINDOWS\System32\FsUsbExDisk.Sys
[2010/07/17 11:57:23 | 000,002,528 | -H– | C] () – C:\Documents and Settings\Stevie\Application Data\$_hpcst$.hpc
[2010/07/09 21:52:23 | 000,004,096 | —- | C] () – C:\WINDOWS\d3dx.dat
[2010/05/08 14:28:22 | 000,000,606 | —- | C] () – C:\WINDOWS\hpomdl46.dat.temp
[2010/04/16 18:35:51 | 000,000,034 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2010/04/15 18:33:40 | 000,023,113 | —- | C] () – C:\WINDOWS\hpqins15.dat
[2009/11/14 17:31:52 | 000,069,504 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2009/11/09 03:08:10 | 000,974,848 | —- | C] () – C:\WINDOWS\System32\cis-2.4.dll
[2009/11/09 03:08:10 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\issacapi_bs-2.3.dll
[2009/11/09 03:08:10 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\issacapi_pe-2.3.dll
[2009/11/09 03:08:10 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\issacapi_se-2.3.dll
[2009/10/20 20:02:11 | 000,000,025 | —- | C] () – C:\WINDOWS\libem.INI
[2009/10/20 19:59:53 | 000,000,248 | —- | C] () – C:\WINDOWS\System32\secustat.dat
[2009/10/06 08:16:00 | 000,819,200 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/08/28 22:21:02 | 000,000,037 | —- | C] () – C:\WINDOWS\ipixActivex.ini
[2009/08/16 15:57:30 | 005,419,576 | —- | C] () – C:\Program Files\SopCast-3.2.4.zip
[2009/08/06 13:02:40 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\libcurl.dll
[2009/08/06 13:02:22 | 000,143,360 | —- | C] () – C:\WINDOWS\System32\libexpatw.dll
[2009/06/26 21:52:38 | 000,000,048 | —- | C] () – C:\WINDOWS\cgminivw.ini
[2009/06/26 21:52:06 | 000,000,036 | —- | C] () – C:\WINDOWS\Tiny_Run.ini
[2009/03/23 15:08:29 | 000,000,145 | —- | C] () – C:\WINDOWS\System32\EBPPORT.DAT
[2009/02/18 19:03:46 | 000,000,020 | —- | C] () – C:\WINDOWS\popcinfot.dat
[2009/01/23 23:28:06 | 000,000,000 | —- | C] () – C:\Documents and Settings\All Users\Application Data\LauncherAccess.dt
[2009/01/23 23:20:59 | 000,005,632 | —- | C] () – C:\WINDOWS\System32\drivers\StarOpen.sys
[2008/11/13 19:20:56 | 000,000,039 | —- | C] () – C:\WINDOWS\wininit.ini
[2008/08/15 21:28:24 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\YCRWin32.dll
[2008/07/13 02:54:06 | 000,000,599 | —- | C] () – C:\WINDOWS\videoimp.ini
[2008/06/22 20:23:55 | 000,001,152 | —- | C] () – C:\WINDOWS\System32\windrv.sys
[2008/05/13 17:46:23 | 000,000,087 | —- | C] () – C:\WINDOWS\ka.ini
[2008/04/24 14:27:10 | 000,000,151 | —- | C] () – C:\WINDOWS\PhotoSnapViewer.INI
[2008/04/18 15:30:03 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll
[2008/04/14 23:58:10 | 000,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2008/02/23 16:49:28 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2007/10/29 19:23:52 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2007/10/23 23:14:40 | 000,032,768 | —- | C] () – C:\Documents and Settings\Stevie\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/10/09 17:52:54 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\instlsp.exe
[2007/10/05 23:40:06 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2007/10/05 22:14:04 | 000,006,550 | —- | C] () – C:\WINDOWS\jautoexp.dat
[2005/09/21 17:38:10 | 000,000,677 | —- | C] () – C:\Program Files\lxce.vbs
[2004/07/15 11:25:00 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/07/15 11:09:17 | 000,006,451 | —- | C] () – C:\WINDOWS\HDReg.ini
[2004/07/15 11:07:16 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2004/07/15 10:58:05 | 000,005,007 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2004/07/15 10:55:44 | 000,115,383 | —- | C] () – C:\WINDOWS\VGAsetup.ini
[2004/07/15 10:55:37 | 000,102,004 | —- | C] () – C:\WINDOWS\System32\VGAunistlog.ini
[2004/07/15 10:55:28 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\sis760.bin
[2004/07/15 10:55:28 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\sis741.bin
[2004/07/15 10:55:28 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\sis660.bin
[2004/07/15 10:53:13 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/07/15 10:51:07 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\SLLights.dll
[2004/07/15 10:51:07 | 000,376,832 | —- | C] () – C:\WINDOWS\System32\slmh.exe
[2004/07/15 10:51:07 | 000,167,936 | —- | C] () – C:\WINDOWS\System32\minirec.exe
[2004/07/15 10:51:07 | 000,151,552 | —- | C] () – C:\WINDOWS\System32\amr_cpl.dll
[2004/07/15 10:51:07 | 000,061,440 | —- | C] () – C:\WINDOWS\SmCfg.exe
[2004/03/31 22:01:24 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2003/01/07 16:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/09/19 21:20:55 | 000,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2002/09/19 20:52:36 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2002/09/19 20:46:13 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2002/09/19 20:37:45 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2002/09/19 20:36:49 | 000,318,744 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2002/09/19 20:26:36 | 000,436,014 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2002/09/19 20:26:36 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2002/09/19 20:26:36 | 000,068,926 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2002/09/19 20:26:36 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2002/09/19 20:26:31 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2002/09/19 20:26:24 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2002/09/19 20:26:24 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2002/09/19 20:26:15 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2002/09/19 20:26:07 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2001/09/05 15:00:38 | 000,004,481 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2001/09/05 15:00:26 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\OEMBIOS.BIN
[2001/08/07 04:16:34 | 000,045,056 | —- | C] () – C:\WINDOWS\OTS_UI.EXE
[1999/01/22 19:46:58 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\MSRTEDIT.DLL
[1980/01/01 00:00:00 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\slextspk.dll
[1980/01/01 00:00:00 | 000,159,744 | —- | C] () – C:\WINDOWS\System32\SLGen.dll
[1980/01/01 00:00:00 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\coinst.dll
[1980/01/01 00:00:00 | 000,024,576 | —- | C] () – C:\WINDOWS\slrundll.exe

========== LOP Check ==========

[2009/10/01 20:35:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Azureus
[2011/04/03 10:50:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Big Fish Games
[2010/07/28 23:52:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\BVRP Software
[2011/03/15 22:47:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Caphyon
[2008/08/17 20:14:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Citrix
[2011/03/15 22:48:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ConeXware
[2009/02/21 00:47:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FarmFrenzy2
[2010/05/09 13:01:25 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GoBit Games
[2008/04/14 23:49:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\LightScribe
[2009/02/14 21:46:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9
[2010/08/20 22:36:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2010/07/22 13:28:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Suite
[2009/02/12 00:25:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap
[2009/02/18 19:03:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap Games
[2009/11/11 11:02:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PPLiveVA
[2007/10/07 14:39:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Prism
[2010/08/28 23:06:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Samsung
[2009/02/16 12:32:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sandlot Games
[2009/11/11 11:01:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Storm
[2011/04/03 10:56:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SugarGames
[2011/04/03 11:27:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2008/03/29 21:36:21 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TomTom
[2010/11/05 10:08:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Trusteer
[2007/10/06 04:19:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2010/10/29 07:16:21 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\VirtualizedApplications
[2009/07/17 18:12:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Vivitar
[2009/07/17 18:12:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Vivitar Experience Image Manager
[2009/06/14 21:31:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WildTangent
[2010/05/09 13:01:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Zylom
[2009/03/26 21:37:24 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2010/04/04 12:41:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/10/01 20:18:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/08 12:03:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2009/02/13 17:37:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\Alawar
[2010/12/16 04:15:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\Azureus
[2009/11/11 11:00:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\BITS
[2011/03/21 19:40:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\DVDVideoSoftIEHelpers
[2011/05/25 21:45:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\ElevatedDiagnostics
[2009/10/20 20:00:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\FlashGet
[2009/10/20 20:00:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\FlashGetBHO
[2009/11/09 22:11:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\FlashgetSetup
[2009/02/16 12:29:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\GameHouse
[2010/07/09 21:52:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\GamesCafe
[2010/09/03 16:32:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\LG Electronics
[2008/11/14 01:13:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\LimeWire
[2009/10/21 17:04:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\MxBoost
[2010/12/23 19:34:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\NCH Swift Sound
[2010/07/22 13:28:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\PC Suite
[2009/10/20 20:02:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\PPLiveVA
[2009/11/11 11:03:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\PPStream
[2010/08/15 15:28:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\Samsung
[2010/11/06 18:34:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\SoftGrid Client
[2010/07/28 17:42:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\Sony
[2010/07/28 17:29:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\Sony Setup
[2008/08/20 20:18:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\Teleca
[2007/10/12 19:45:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\Template
[2007/12/25 22:44:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\TomTom
[2010/10/10 12:06:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\TP
[2010/11/05 10:09:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\Trusteer
[2008/02/08 18:42:05 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\Uniblue
[2009/09/25 20:31:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\Xbins
[2009/04/16 09:03:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Stevie\Application Data\Zylom
[2011/06/24 23:41:05 | 000,000,616 | -H– | M] () – C:\WINDOWS\Tasks\ConfigExec.job
[2011/06/24 22:04:01 | 000,000,580 | -H– | M] () – C:\WINDOWS\Tasks\DataUpload.job

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:014BC3B4
@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E1F04E8D
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C46995DA
@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2CFBE2D1
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F085C8A1

< End of report >

mowman

Post #12June 25, 2011, 10:33 AM UTC

The Malwarebytes log shows a very old database,you need to update it and rescan as i can see a few bad files still which it will remove.

If you can't update it,uninstall and download a fresh copy from Here or Here

Lpool18

Post #13June 25, 2011, 11:36 AM UTC

Hi Mowman Yeh, it wouldn't let me update last night. But I've uninstalled and reinstalled as you suggested and it has worked fine. Here is the log report: Malwarebytes' Anti-Malware 1.51.0.1200 www.malwarebytes.org Database version: 6944 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 25/06/2011 12:16:07 mbam-log-2011-06-25 (12-16-06).txt Scan type: Quick scan Objects scanned: 168025 Time elapsed: 10 minute(s), 20 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

mowman

Post #14June 25, 2011, 12:21 PM UTC

You appear clean of infections,please do the following.

ComboFix - Cleanup
Time for some housekeeping

Click Start…select Run from the menu.
Copy and paste the following into the text entry box:
Combofix /Uninstall
Click the OK button. (See image below as reference.)

🖼Click to load external image (Posted Image)

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 26 and save it to your desktop.
Scroll down to where it says JDK 6 Update 26 (JDK or JRE)
Click the Download JRE button to the right
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u26 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u26-windows-i586-p.exe to install the newest version.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
  Trace and Log Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Window
Click OK to leave the Java Control Panel.

Here are some recommendations to help you stay clean.

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com/

Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
Please read this article 'Safe Computing Practices'.
So how did I get infected in the first place.

please take a moment to read quietman7's excellent prevention tips in post 3 here
Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection:

Preventing Infections in the Future

Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:

So How did I get infected?
Miekies' prevention suggestions
Hardening Windows Security - Part 1 & Part 2.

Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

Update Non-Microsoft Programs

It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.

Thats it you are good to go.Safe surfing

Lpool18

Post #15June 26, 2011, 12:17 PM UTC

Hi Mowman That's fantastic! Thanks for all your help on this

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Please help...tdss.e!rootkit infection

✨ Ask AI

Ask AI