Searchqu/406

I had to disable AVAST in order to open and run OTL.exe, but otherwise, there were no problems:

OTL logfile created on: 7/16/2011 8:39:23 PM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = E:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.36 Gb Available Physical Memory | 67.89% Memory free
3.85 Gb Paging File | 3.23 Gb Available in Paging File | 83.83% Paging File free
Paging file location(s): E:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = E: | %SystemRoot% = E:\WINDOWS | %ProgramFiles% = E:\Program Files
Drive C: | 58.75 Gb Total Space | 12.29 Gb Free Space | 20.92% Space Free | Partition Type: NTFS
Drive D: | 67.69 Gb Total Space | 61.46 Gb Free Space | 90.80% Space Free | Partition Type: NTFS
Drive E: | 106.44 Gb Total Space | 79.80 Gb Free Space | 74.97% Space Free | Partition Type: NTFS

Computer Name: EXPERIEN-255718 | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - E:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - E:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - E:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - E:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
PRC - D:\Program files\iTunesHelper.exe (Apple Inc.)
PRC - D:\QTTask.exe (Apple Inc.)
PRC - E:\WINDOWS\ALCFDRTM.EXE (Realtek Semiconductor Corp.)
PRC - E:\Program Files\PPStream\PPSAP.exe (PPStream Inc)
PRC - E:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe (PC Tools)
PRC - E:\Program Files\PC Tools Firewall Plus\FWService.exe (PC Tools)
PRC - E:\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
PRC - E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - E:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - E:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (Nero AG)
PRC - E:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
PRC - E:\WINDOWS\vsnp325.exe ()
PRC - E:\WINDOWS\tsnp325.exe ()
PRC - E:\WINDOWS\tsnp2std.exe ()


========== Modules (SafeList) ==========

MOD - E:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
MOD - E:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5508_x-ww_35d3ce4a\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – File not found
SRV - (ALG) – File not found
SRV - (avast! Antivirus) – E:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (PCToolsFirewallPlus) – E:\Program Files\PC Tools Firewall Plus\FWService.exe (PC Tools)


========== Driver Services (SafeList) ==========

DRV - (aswSnx) – E:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – E:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) – E:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) – E:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswRdr) – E:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (Aavmker4) – E:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (aswFsBlk) – E:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (dyimmgirbow) – E:\WINDOWS\system32\drivers\qwurkdtdcs.sys ()
DRV - (SASKUTIL) – E:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – E:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (pctplfw) – E:\WINDOWS\system32\drivers\pctplfw.sys (PC Tools)
DRV - (PCTFW-PacketFilter) – E:\WINDOWS\system32\drivers\pctNdis-PacketFilter.sys (PC Tools)
DRV - (pctgntdi) – E:\WINDOWS\system32\drivers\pctgntdi.sys (PC Tools)
DRV - (pctNDIS) – E:\WINDOWS\system32\drivers\pctNdis.sys (PC Tools)
DRV - (PCTAppEvent) – E:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – E:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (Ambfilt) – E:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)
DRV - (Tcpip6) – E:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (FsVga) – E:\WINDOWS\system32\drivers\fsvga.sys (Microsoft Corporation)
DRV - (SNP325) USB PC Camera (SNPSTD325) – E:\WINDOWS\system32\drivers\snp325.sys (Sonix Co. Ltd.)
DRV - (RTLE8023xp) – E:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (AmdK8) – E:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (Monfilt) – E:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie_rsearch.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.selectedEngine: "Search Results"
FF - prefs.js..browser.startup.homepage: "http://www.searchqu.com/406"
FF - prefs.js..extensions.enabledItems: [removed]:6.0.1203
FF - prefs.js..keyword.URL: "http://dts.search-results.com/sr?src=ffb&appid=102&systemid=406&q="
FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: E:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Program files\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: E:\Program Files\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: D:\Program files\DivX\DivX Web Player\npdivx32.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: D:\Program files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: E:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: D:\Program files\Picasa3\npPicasa3.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: E:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: e:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: E:\Program Files\Google\Update\1.2.183.29\npGoogleOneClick8.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\[removed]/YahooActiveXPluginBridge;version=1.0.0.1: E:\Program Files\Yahoo!\Common\npyaxmpb.dll File not found

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: E:\Program Files\Alwil Software\Avast5\WebRep\FF [2011/07/15 23:55:01 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.18\extensions\\Components: E:\Program Files\Mozilla Firefox\components [2011/06/25 19:01:21 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.18\extensions\\Plugins: E:\Program Files\Mozilla Firefox\plugins [2011/06/25 19:01:21 | 000,000,000 | —D | M]

[2011/07/02 13:14:50 | 000,000,000 | —D | M] (No name found) – E:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2009/03/26 16:40:34 | 000,000,000 | —D | M] (No name found) – E:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions\[removed]
[2011/07/15 22:57:07 | 000,000,000 | —D | M] (No name found) – E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\r0w7w5f6.default\extensions
[2011/07/02 11:51:50 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\r0w7w5f6.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2011/07/01 21:16:14 | 000,002,501 | —- | M] () – E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\r0w7w5f6.default\searchplugins\SearchResults.xml
[2011/07/02 14:04:03 | 000,000,000 | —D | M] (No name found) – E:\Program Files\Mozilla Firefox\extensions
[2011/07/15 23:55:01 | 000,000,000 | —D | M] (avast! WebRep) – E:\PROGRAM FILES\ALWIL SOFTWARE\AVAST5\WEBREP\FF
[2011/03/03 17:43:40 | 000,001,538 | —- | M] () – E:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2011/03/03 17:43:40 | 000,000,947 | —- | M] () – E:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2011/03/03 17:43:40 | 000,000,769 | —- | M] () – E:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2011/07/01 21:16:14 | 000,002,501 | —- | M] () – E:\Program Files\mozilla firefox\searchplugins\SearchResults.xml
[2011/03/03 17:43:40 | 000,001,135 | —- | M] () – E:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2010/08/25 17:57:47 | 000,418,087 | —- | M]) - E:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 123topsearch.com
O1 - Hosts: 127.0.0.1 www.123topsearch.com
O1 - Hosts: 127.0.0.1 132.com
O1 - Hosts: 127.0.0.1 www.132.com
O1 - Hosts: 127.0.0.1 www.136136.net
O1 - Hosts: 127.0.0.1 136136.net
O1 - Hosts: 14433 more lines…
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - No CLSID value found.
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - E:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found.
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - E:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - E:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - E:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - E:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [00PCTFW] E:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe (PC Tools)
O4 - HKLM..\Run: [avast5] E:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [EPSON ME 200] E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBFC.EXE (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [IMJPMIG8.1] E:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [iTunesHelper] D:\Program files\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [MSPY2002] E:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
O4 - HKLM..\Run: [NvCplDaemon] E:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] E:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] E:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PHIME2002A] E:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] E:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [QuickTime Task] D:\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [snp325] E:\WINDOWS\vsnp325.exe ()
O4 - HKLM..\Run: [TkBellExe] File not found
O4 - HKLM..\Run: [tsnp2std] E:\WINDOWS\tsnp2std.exe ()
O4 - HKLM..\Run: [tsnp325] E:\WINDOWS\tsnp325.exe ()
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] E:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [BitTorrent DNA] E:\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
O4 - HKCU..\Run: [PPS Accelerator] E:\Program Files\PPStream\PPSAP.exe (PPStream Inc)
O4 - HKCU..\Run: [SpybotSD TeaTimer] E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [SUPERAntiSpyware] E:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - Startup: E:\Documents and Settings\Administrator\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = E:\Program Files\ERUNT\AUTOBACK.EXE ()
O4 - Startup: E:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = D:\Program files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRemoteRecursiveEvents = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: MemCheckBoxInRunDlg = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuFavorites = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Start_ShowMyComputer = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Start_ShowMyDocs = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Start_ShowMyMusic = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Start_ShowRun = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Start_ShowSearch = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableStatusMessages = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: VerboseStatus = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoInternetOpenWith = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: MemCheckBoxInRunDlg = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSharedDocuments = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - E:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xport to Microsoft Excel - D:\Program files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Google Sidewiki… - E:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_43C348BC2E93EB2B.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - E:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: pps.tv ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: ppstream.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: webscache.com ([]http in Trusted sites)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} E:\Program Files\Yahoo!\Common\yinsthelper.dll (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - E:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - E:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - E:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\74b28f26502: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O20 - Winlogon\Notify\avgrsstarter: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - E:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/10/16 23:20:53 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2008/01/31 19:59:10 | 000,045,056 | R— | M] () - D:\AutoUpdate.dll – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O35 - HKCU\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/07/16 20:33:18 | 001,906,176 | —- | C] (AVAST Software) – E:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2011/07/16 20:32:25 | 000,579,584 | —- | C] (OldTimer Tools) – E:\Documents and Settings\Administrator\Desktop\OTL.exe
[2011/07/16 08:02:29 | 000,000,000 | RH-D | C] – E:\Documents and Settings\Administrator\Recent
[2011/07/16 00:40:08 | 000,000,000 | —D | C] – E:\desktop
[2011/07/15 02:39:52 | 000,000,000 | —D | C] – E:\WINDOWS\CSC
[2011/07/15 02:16:27 | 000,404,640 | —- | C] (Adobe Systems Incorporated) – E:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/07/14 05:40:07 | 000,000,000 | —D | C] – E:\Documents and Settings\Administrator\Start Menu\Programs\Revo Uninstaller
[2011/07/02 13:45:32 | 000,000,000 | —D | C] – E:\Program Files\Trend Micro
[2011/07/01 21:35:04 | 000,000,000 | —D | C] – E:\Documents and Settings\Administrator\Local Settings\Application Data\Ilivid Player
[2011/07/01 21:18:55 | 000,000,000 | -H-D | C] – E:\Documents and Settings\All Users\Application Data\{C1D18E30-468F-478F-8837-B6CBA25F6547}
[2011/07/01 21:18:54 | 000,000,000 | —D | C] – E:\Documents and Settings\All Users\Start Menu\Programs\iLivid
[2011/07/01 21:18:34 | 000,000,000 | —D | C] – E:\Program Files\iLivid
[2011/07/01 21:16:15 | 000,000,000 | —D | C] – E:\Documents and Settings\All Users\Application Data\boost_interprocess
[2011/07/01 21:15:57 | 000,000,000 | —D | C] – E:\Program Files\Windows iLivid Toolbar
[2011/07/01 18:15:07 | 000,000,000 | —D | C] – E:\Documents and Settings\Administrator\Local Settings\Application Data\PackageAware
[2011/06/25 18:43:06 | 000,441,176 | —- | C] (AVAST Software) – E:\WINDOWS\System32\drivers\aswSnx.sys
[2009/03/03 19:47:09 | 000,147,456 | —- | C] ( ) – E:\WINDOWS\System32\rsnp325.dll
[2009/03/03 19:47:09 | 000,057,344 | —- | C] ( ) – E:\WINDOWS\System32\vsnp325.dll
[2009/03/03 19:47:09 | 000,053,248 | —- | C] ( ) – E:\WINDOWS\System32\csnp325.dll
[2009/03/03 19:46:07 | 000,147,456 | —- | C] ( ) – E:\WINDOWS\rsnp2std.dll
[2009/03/03 19:46:07 | 000,053,248 | —- | C] ( ) – E:\WINDOWS\System32\csnp2std.dll
[4 E:\WINDOWS\*.tmp files -> E:\WINDOWS\*.tmp -> ]
[1 E:\WINDOWS\System32\*.tmp files -> E:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/07/16 20:35:00 | 001,906,176 | —- | M] (AVAST Software) – E:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2011/07/16 20:32:01 | 000,579,584 | —- | M] (OldTimer Tools) – E:\Documents and Settings\Administrator\Desktop\OTL.exe
[2011/07/16 19:49:00 | 000,000,886 | —- | M] () – E:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/07/16 08:03:36 | 000,001,816 | —- | M] () – E:\WINDOWS\psnetwork.ini
[2011/07/16 07:59:18 | 000,000,090 | —- | M] () – E:\WINDOWS\PCDNSetting.ini
[2011/07/16 07:57:46 | 000,081,858 | —- | M] () – E:\WINDOWS\System32\nvapps.xml
[2011/07/16 07:57:23 | 000,000,882 | —- | M] () – E:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/07/16 07:57:22 | 000,000,294 | —- | M] () – E:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1275210071-1645522239-725345543-500.job
[2011/07/16 07:57:13 | 000,002,206 | —- | M] () – E:\WINDOWS\System32\wpa.dbl
[2011/07/16 07:57:11 | 000,002,048 | –S- | M] () – E:\WINDOWS\bootstat.dat
[2011/07/16 07:11:02 | 000,000,284 | —- | M] () – E:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/07/15 23:55:02 | 000,002,626 | —- | M] () – E:\WINDOWS\System32\CONFIG.NT
[2011/07/15 04:44:12 | 000,000,981 | —- | M] () – E:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/07/15 04:44:12 | 000,000,963 | —- | M] () – E:\Documents and Settings\Administrator\Desktop\Spybot - Search & Destroy.lnk
[2011/07/15 02:16:27 | 000,404,640 | —- | M] (Adobe Systems Incorporated) – E:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/07/14 05:40:07 | 000,000,917 | —- | M] () – E:\Documents and Settings\Administrator\Desktop\Revo Uninstaller.lnk
[2011/07/11 21:05:00 | 000,000,302 | —- | M] () – E:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1275210071-1645522239-725345543-500.job
[2011/07/06 19:52:42 | 000,041,272 | —- | M] (Malwarebytes Corporation) – E:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/07/06 19:52:42 | 000,022,712 | —- | M] (Malwarebytes Corporation) – E:\WINDOWS\System32\drivers\mbam.sys
[2011/07/04 12:43:53 | 000,040,112 | —- | M] (AVAST Software) – E:\WINDOWS\avastSS.scr
[2011/07/04 12:43:51 | 000,199,304 | —- | M] (AVAST Software) – E:\WINDOWS\System32\aswBoot.exe
[2011/07/04 12:36:43 | 000,441,176 | —- | M] (AVAST Software) – E:\WINDOWS\System32\drivers\aswSnx.sys
[2011/07/04 12:36:32 | 000,309,848 | —- | M] (AVAST Software) – E:\WINDOWS\System32\drivers\aswSP.sys
[2011/07/04 12:35:23 | 000,043,608 | —- | M] (AVAST Software) – E:\WINDOWS\System32\drivers\aswTdi.sys
[2011/07/04 12:35:12 | 000,102,616 | —- | M] (AVAST Software) – E:\WINDOWS\System32\drivers\aswmon2.sys
[2011/07/04 12:35:09 | 000,096,344 | —- | M] (AVAST Software) – E:\WINDOWS\System32\drivers\aswmon.sys
[2011/07/04 12:32:32 | 000,025,432 | —- | M] (AVAST Software) – E:\WINDOWS\System32\drivers\aswRdr.sys
[2011/07/04 12:32:13 | 000,030,808 | —- | M] (AVAST Software) – E:\WINDOWS\System32\drivers\aavmker4.sys
[2011/07/04 12:32:12 | 000,019,544 | —- | M] (AVAST Software) – E:\WINDOWS\System32\drivers\aswFsBlk.sys
[2011/07/03 20:56:17 | 000,000,069 | —- | M] () – E:\WINDOWS\NeroDigital.ini
[4 E:\WINDOWS\*.tmp files -> E:\WINDOWS\*.tmp -> ]
[1 E:\WINDOWS\System32\*.tmp files -> E:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/05/24 22:42:13 | 000,013,258 | -HS- | C] () – E:\Documents and Settings\All Users\Application Data\yo11nhy47rhv4pq0uemw1ulh8oh
[2011/05/24 22:42:13 | 000,013,258 | -HS- | C] () – E:\Documents and Settings\Administrator\Local Settings\Application Data\yo11nhy47rhv4pq0uemw1ulh8oh
[2011/05/21 17:18:49 | 000,013,458 | -HS- | C] () – E:\Documents and Settings\All Users\Application Data\wd5r61txwyhk4p0hkw0jcp7lmy7v883d3j0i2buux84c
[2011/05/21 17:18:49 | 000,013,458 | -HS- | C] () – E:\Documents and Settings\Administrator\Local Settings\Application Data\wd5r61txwyhk4p0hkw0jcp7lmy7v883d3j0i2buux84c
[2011/02/01 10:22:12 | 000,055,552 | —- | C] () – E:\WINDOWS\System32\drivers\qwurkdtdcs.sys
[2011/01/31 07:16:27 | 000,000,027 | —- | C] () – E:\WINDOWS\OOIIEProxy.ini
[2010/11/19 20:36:09 | 000,000,090 | —- | C] () – E:\WINDOWS\PCDNSetting.ini
[2010/11/19 20:32:56 | 000,000,060 | —- | C] () – E:\WINDOWS\MediaList.ini
[2010/11/19 20:32:31 | 000,001,374 | —- | C] () – E:\WINDOWS\Powerlist.ini
[2010/11/19 20:32:28 | 000,001,426 | —- | C] () – E:\WINDOWS\powerplayer.ini
[2010/11/19 20:32:25 | 000,001,816 | —- | C] () – E:\WINDOWS\psnetwork.ini
[2010/10/08 23:53:01 | 000,049,140 | -H– | C] () – E:\WINDOWS\System32\mlfcache.dat
[2010/09/05 13:58:52 | 000,000,000 | —- | C] () – E:\Documents and Settings\Administrator\Local Settings\Application Data\prvlcl.dat
[2010/08/21 11:05:31 | 000,001,697 | —- | C] () – E:\Documents and Settings\Administrator\Application Data\a0000001d05d0b.xml
[2010/06/16 16:32:54 | 000,111,932 | —- | C] () – E:\WINDOWS\System32\EPPICPrinterDB.dat
[2010/06/16 16:32:54 | 000,031,053 | —- | C] () – E:\WINDOWS\System32\EPPICPattern131.dat
[2010/06/16 16:32:54 | 000,027,417 | —- | C] () – E:\WINDOWS\System32\EPPICPattern121.dat
[2010/06/16 16:32:54 | 000,026,154 | —- | C] () – E:\WINDOWS\System32\EPPICPattern1.dat
[2010/06/16 16:32:54 | 000,024,903 | —- | C] () – E:\WINDOWS\System32\EPPICPattern3.dat
[2010/06/16 16:32:54 | 000,021,390 | —- | C] () – E:\WINDOWS\System32\EPPICPattern5.dat
[2010/06/16 16:32:54 | 000,020,148 | —- | C] () – E:\WINDOWS\System32\EPPICPattern2.dat
[2010/06/16 16:32:54 | 000,011,811 | —- | C] () – E:\WINDOWS\System32\EPPICPattern4.dat
[2010/06/16 16:32:54 | 000,004,943 | —- | C] () – E:\WINDOWS\System32\EPPICPattern6.dat
[2010/06/16 16:32:54 | 000,001,146 | —- | C] () – E:\WINDOWS\System32\EPPICPresetData_DU.dat
[2010/06/16 16:32:54 | 000,001,139 | —- | C] () – E:\WINDOWS\System32\EPPICPresetData_PT.dat
[2010/06/16 16:32:54 | 000,001,139 | —- | C] () – E:\WINDOWS\System32\EPPICPresetData_BP.dat
[2010/06/16 16:32:54 | 000,001,136 | —- | C] () – E:\WINDOWS\System32\EPPICPresetData_ES.dat
[2010/06/16 16:32:54 | 000,001,129 | —- | C] () – E:\WINDOWS\System32\EPPICPresetData_FR.dat
[2010/06/16 16:32:54 | 000,001,129 | —- | C] () – E:\WINDOWS\System32\EPPICPresetData_CF.dat
[2010/06/16 16:32:54 | 000,001,120 | —- | C] () – E:\WINDOWS\System32\EPPICPresetData_IT.dat
[2010/06/16 16:32:54 | 000,001,107 | —- | C] () – E:\WINDOWS\System32\EPPICPresetData_GE.dat
[2010/06/16 16:32:54 | 000,001,104 | —- | C] () – E:\WINDOWS\System32\EPPICPresetData_EN.dat
[2010/06/16 16:32:54 | 000,000,097 | —- | C] () – E:\WINDOWS\System32\PICSDK.ini
[2010/06/16 16:26:09 | 000,000,025 | —- | C] () – E:\WINDOWS\CDE ME 200EC.ini
[2010/02/23 21:08:45 | 000,016,968 | —- | C] () – E:\WINDOWS\System32\drivers\hitmanpro35.sys
[2009/10/23 10:23:17 | 000,000,664 | —- | C] () – E:\Documents and Settings\Administrator\Local Settings\Application Data\FASTWiz.html
[2009/09/24 00:28:27 | 000,001,815 | —- | C] () – E:\WINDOWS\hpdj5100.ini
[2009/09/14 07:21:14 | 000,196,640 | -HS- | C] () – E:\WINDOWS\System32\drivers\fidbox2.dat
[2009/09/14 07:21:14 | 000,000,032 | -HS- | C] () – E:\WINDOWS\System32\drivers\fidbox.dat
[2009/04/02 19:28:01 | 000,000,136 | —- | C] () – E:\WINDOWS\System32\cid_store.dat
[2009/04/02 19:24:39 | 000,000,020 | —- | C] () – E:\WINDOWS\System32\pub_store.dat
[2009/03/03 19:47:09 | 000,835,584 | —- | C] () – E:\WINDOWS\vsnp325.exe
[2009/03/03 19:47:09 | 000,270,336 | —- | C] () – E:\WINDOWS\tsnp325.exe
[2009/03/03 19:47:09 | 000,015,498 | —- | C] () – E:\WINDOWS\snp325.ini
[2009/03/03 19:46:09 | 000,020,480 | —- | C] () – E:\WINDOWS\FixCamera.exe
[2009/03/03 19:46:08 | 000,262,144 | —- | C] () – E:\WINDOWS\tsnp2std.exe
[2009/03/03 19:46:08 | 000,015,497 | —- | C] () – E:\WINDOWS\snp2std.ini
[2009/03/03 19:46:07 | 010,305,280 | —- | C] () – E:\WINDOWS\System32\drivers\snp2sxp.sys
[2009/03/03 19:46:07 | 000,024,832 | —- | C] () – E:\WINDOWS\System32\drivers\sncamd.sys
[2009/02/17 21:38:16 | 000,000,151 | —- | C] () – E:\WINDOWS\PhotoSnapViewer.INI
[2008/12/30 18:01:46 | 000,008,704 | —- | C] () – E:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/12/16 20:36:46 | 000,000,038 | —- | C] () – E:\WINDOWS\avisplitter.ini
[2008/12/16 20:36:45 | 000,755,027 | —- | C] () – E:\WINDOWS\System32\xvidcore.dll
[2008/12/16 20:36:44 | 000,159,839 | —- | C] () – E:\WINDOWS\System32\xvidvfw.dll
[2008/12/16 20:36:43 | 000,057,344 | —- | C] () – E:\WINDOWS\System32\ff_vfw.dll
[2008/12/04 19:33:57 | 000,000,664 | —- | C] () – E:\WINDOWS\System32\d3d9caps.dat
[2008/11/01 09:47:08 | 000,000,376 | —- | C] () – E:\WINDOWS\ODBC.INI
[2008/10/30 08:00:17 | 000,000,754 | —- | C] () – E:\WINDOWS\WORDPAD.INI
[2008/10/29 10:16:50 | 000,000,069 | —- | C] () – E:\WINDOWS\NeroDigital.ini
[2008/10/17 05:04:59 | 000,000,496 | —- | C] () – E:\WINDOWS\cdplayer.ini
[2008/10/17 04:46:37 | 000,000,029 | —- | C] () – E:\WINDOWS\AdvConfig.ini
[2008/10/17 03:43:34 | 000,000,000 | —- | C] () – E:\WINDOWS\nsreg.dat
[2008/10/17 01:58:59 | 000,049,152 | —- | C] () – E:\WINDOWS\System32\ChCfg.exe
[2008/10/17 00:14:17 | 000,004,161 | —- | C] () – E:\WINDOWS\ODBCINST.INI
[2008/10/17 00:10:55 | 000,228,800 | —- | C] () – E:\WINDOWS\System32\FNTCACHE.DAT
[2008/10/16 23:23:15 | 000,000,135 | —- | C] () – E:\WINDOWS\System32\prio.ini
[2008/10/16 23:22:54 | 000,462,848 | —- | C] () – E:\WINDOWS\System32\lame_enc.dll
[2008/10/16 23:22:53 | 000,155,720 | —- | C] () – E:\WINDOWS\System32\CDR.exe
[2008/10/16 23:22:53 | 000,110,080 | —- | C] () – E:\WINDOWS\System32\cdimage.exe
[2008/10/16 23:22:53 | 000,005,405 | —- | C] () – E:\WINDOWS\System32\CHNGTEXT.EXE
[2008/10/16 23:22:53 | 000,001,754 | —- | C] () – E:\WINDOWS\System32\CHOICE.COM
[2008/10/16 23:21:18 | 000,002,048 | –S- | C] () – E:\WINDOWS\bootstat.dat
[2008/10/16 23:18:15 | 000,021,640 | —- | C] () – E:\WINDOWS\System32\emptyregdb.dat
[2008/09/16 01:14:24 | 003,596,288 | —- | C] () – E:\WINDOWS\System32\qt-dx331.dll
[2008/05/03 13:00:00 | 013,107,200 | —- | C] () – E:\WINDOWS\System32\oembios.bin
[2008/05/03 13:00:00 | 000,673,088 | —- | C] () – E:\WINDOWS\System32\mlang.dat
[2008/05/03 13:00:00 | 000,432,492 | —- | C] () – E:\WINDOWS\System32\perfh009.dat
[2008/05/03 13:00:00 | 000,272,128 | —- | C] () – E:\WINDOWS\System32\perfi009.dat
[2008/05/03 13:00:00 | 000,218,003 | —- | C] () – E:\WINDOWS\System32\dssec.dat
[2008/05/03 13:00:00 | 000,152,576 | —- | C] () – E:\WINDOWS\System32\makecab.exe
[2008/05/03 13:00:00 | 000,067,448 | —- | C] () – E:\WINDOWS\System32\perfc009.dat
[2008/05/03 13:00:00 | 000,046,258 | —- | C] () – E:\WINDOWS\System32\mib.bin
[2008/05/03 13:00:00 | 000,028,626 | —- | C] () – E:\WINDOWS\System32\perfd009.dat
[2008/05/03 13:00:00 | 000,004,569 | —- | C] () – E:\WINDOWS\System32\secupd.dat
[2008/05/03 13:00:00 | 000,004,463 | —- | C] () – E:\WINDOWS\System32\oembios.dat
[2008/05/03 13:00:00 | 000,001,804 | —- | C] () – E:\WINDOWS\System32\Dcache.bin
[2008/05/03 13:00:00 | 000,000,741 | —- | C] () – E:\WINDOWS\System32\noise.dat
[2007/02/09 10:25:06 | 000,230,424 | —- | C] () – E:\WINDOWS\ptm_nt.dll
[2006/08/11 14:45:20 | 000,581,632 | —- | C] () – E:\WINDOWS\System32\nvhwvid.dll
[2006/08/11 14:43:10 | 000,196,608 | —- | C] () – E:\WINDOWS\System32\nvapi.dll
[2006/08/11 14:43:00 | 001,662,976 | —- | C] () – E:\WINDOWS\System32\nvwdmcpl.dll
[2006/08/11 14:43:00 | 001,519,616 | —- | C] () – E:\WINDOWS\System32\nwiz.exe
[2006/08/11 14:43:00 | 001,470,464 | —- | C] () – E:\WINDOWS\System32\nview.dll
[2006/08/11 14:43:00 | 001,339,392 | —- | C] () – E:\WINDOWS\System32\nvdspsch.exe
[2006/08/11 14:43:00 | 001,019,904 | —- | C] () – E:\WINDOWS\System32\nvwimg.dll
[2006/08/11 14:43:00 | 000,466,944 | —- | C] () – E:\WINDOWS\System32\nvshell.dll
[2006/08/11 14:43:00 | 000,442,368 | —- | C] () – E:\WINDOWS\System32\nvappbar.exe
[2006/08/11 14:43:00 | 000,425,984 | —- | C] () – E:\WINDOWS\System32\keystone.exe
[2006/08/11 14:43:00 | 000,286,720 | —- | C] () – E:\WINDOWS\System32\nvnt4cpl.dll
[2002/10/15 23:54:04 | 000,153,088 | —- | C] () – E:\WINDOWS\System32\unrar.dll

========== LOP Check ==========

[2010/12/02 19:37:57 | 000,000,000 | —D | M] – E:\Documents and Settings\Administrator\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/10/05 12:21:02 | 000,000,000 | —D | M] – E:\Documents and Settings\Administrator\Application Data\DeviceDoctorSoftware
[2011/07/16 20:39:14 | 000,000,000 | —D | M] – E:\Documents and Settings\Administrator\Application Data\DNA
[2010/06/16 17:17:12 | 000,000,000 | —D | M] – E:\Documents and Settings\Administrator\Application Data\EPSON
[2009/11/11 22:17:03 | 000,000,000 | —D | M] – E:\Documents and Settings\Administrator\Application Data\Kingsoft
[2010/08/01 17:19:07 | 000,000,000 | —D | M] – E:\Documents and Settings\Administrator\Application Data\Lingoes
[2010/04/04 08:40:23 | 000,000,000 | —D | M] – E:\Documents and Settings\Administrator\Application Data\NCH Swift Sound
[2008/11/16 03:55:01 | 000,000,000 | —D | M] – E:\Documents and Settings\Administrator\Application Data\NJStar
[2010/08/24 11:46:13 | 000,000,000 | —D | M] – E:\Documents and Settings\Administrator\Application Data\Nokia
[2008/10/20 04:17:54 | 000,000,000 | —D | M] – E:\Documents and Settings\Administrator\Application Data\OpenOffice.org
[2011/03/20 20:06:18 | 000,000,000 | —D | M] – E:\Documents and Settings\Administrator\Application Data\Opera
[2010/03/02 17:15:05 | 000,000,000 | —D | M] – E:\Documents and Settings\Administrator\Application Data\PCToolsFirewallPlus
[2011/01/31 07:21:15 | 000,000,000 | —D | M] – E:\Documents and Settings\Administrator\Application Data\PPStream
[2010/12/12 23:18:09 | 000,000,000 | —D | M] – E:\Documents and Settings\Administrator\Application Data\QuickScan
[2010/04/07 14:49:54 | 000,000,000 | —D | M] – E:\Documents and Settings\Administrator\Application Data\Recordpad
[2009/12/07 19:01:04 | 000,000,000 | —D | M] – E:\Documents and Settings\Administrator\Application Data\SogouPY
[2010/07/06 00:13:49 | 000,000,000 | —D | M] – E:\Documents and Settings\Administrator\Application Data\UDC Profiles
[2010/12/02 15:56:21 | 000,000,000 | —D | M] – E:\Documents and Settings\Administrator\Application Data\uTorrent
[2009/09/22 05:25:49 | 000,000,000 | —D | M] – E:\Documents and Settings\Administrator\Application Data\Xerox
[2010/09/08 23:16:06 | 000,000,000 | —D | M] – E:\Documents and Settings\All Users\Application Data\Alwil Software
[2011/07/02 11:56:27 | 000,000,000 | —D | M] – E:\Documents and Settings\All Users\Application Data\boost_interprocess
[2010/02/23 21:13:00 | 000,000,000 | —D | M] – E:\Documents and Settings\All Users\Application Data\Hitman Pro
[2009/11/11 22:16:19 | 000,000,000 | —D | M] – E:\Documents and Settings\All Users\Application Data\Kingsoft
[2010/08/01 17:19:03 | 000,000,000 | —D | M] – E:\Documents and Settings\All Users\Application Data\Lingoes
[2010/04/04 08:40:29 | 000,000,000 | —D | M] – E:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2010/10/03 22:13:01 | 000,000,000 | —D | M] – E:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2011/07/16 11:04:53 | 000,000,000 | —D | M] – E:\Documents and Settings\All Users\Application Data\TEMP
[2010/11/12 19:20:06 | 000,000,000 | —D | M] – E:\Documents and Settings\All Users\Application Data\Thunder Network
[2010/06/16 16:36:04 | 000,000,000 | —D | M] – E:\Documents and Settings\All Users\Application Data\UDL
[2010/11/09 08:29:53 | 000,000,000 | —D | M] – E:\Documents and Settings\All Users\Application Data\Xunlei
[2009/04/03 15:18:39 | 000,000,000 | —D | M] – E:\Documents and Settings\All Users\Application Data\Yodao
[2011/06/21 12:47:11 | 000,000,000 | —D | M] – E:\Documents and Settings\All Users\Application Data\Youdao
[2010/05/29 07:53:18 | 000,000,000 | —D | M] – E:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/10/10 12:48:29 | 000,000,000 | —D | M] – E:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/05/30 07:25:27 | 000,000,000 | —D | M] – E:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2011/07/01 21:18:55 | 000,000,000 | -H-D | M] – E:\Documents and Settings\All Users\Application Data\{C1D18E30-468F-478F-8837-B6CBA25F6547}

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 95 bytes -> E:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
@Alternate Data Stream - 120 bytes -> E:\Documents and Settings\All Users\Application Data\TEMP:C31F31E6

< End of report >

OTL Extras logfile created on: 7/16/2011 8:39:23 PM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = E:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.36 Gb Available Physical Memory | 67.89% Memory free
3.85 Gb Paging File | 3.23 Gb Available in Paging File | 83.83% Paging File free
Paging file location(s): E:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = E: | %SystemRoot% = E:\WINDOWS | %ProgramFiles% = E:\Program Files
Drive C: | 58.75 Gb Total Space | 12.29 Gb Free Space | 20.92% Space Free | Partition Type: NTFS
Drive D: | 67.69 Gb Total Space | 61.46 Gb Free Space | 90.80% Space Free | Partition Type: NTFS
Drive E: | 106.44 Gb Total Space | 79.80 Gb Free Space | 74.97% Space Free | Partition Type: NTFS

Computer Name: EXPERIEN-255718 | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = Reg Error: Key error.] – Reg Error: Key error. File not found

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – E:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
htmlfile – "D:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "D:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] – "E:\Program Files\Google\Chrome\Application\chrome.exe" – "%1"
https [open] – "E:\Program Files\Google\Chrome\Application\chrome.exe" – "%1"
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /k cd "%L" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Notepad] – Reg Error: Key error.
Directory [openNew] – explorer %1 (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"E:\Program Files\DNA\btdna.exe" = E:\Program Files\DNA\btdna.exe:*:Enabled:DNA – (BitTorrent, Inc.)
"E:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 2009\english\setup.exe" = E:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 2009\english\setup.exe:*:Enabled:Kaspersky Internet Security 2009 Setup – (Kaspersky Lab)
"E:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe" = E:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe:*:Enabled:Nero Home – (Nero AG)
"E:\Documents and Settings\Administrator\Local Settings\Application Data\TOMSkypeData\TOMSkypeData.exe" = E:\Documents and Settings\Administrator\Local Settings\Application Data\TOMSkypeData\TOMSkypeData.exe:*:Enabled:TOMSkypeData
"E:\Program Files\PPStream\PPStream.exe" = E:\Program Files\PPStream\PPStream.exe:*:Enabled:PPS网络电视 – (PPStream Inc.)
"E:\Program Files\PPStream\PPSAP.exe" = E:\Program Files\PPStream\PPSAP.exe:*:Enabled:PPS 网络加速器 – (PPStream Inc)
"E:\Documents and Settings\Administrator\Application Data\PPStream\ppsdown.exe" = E:\Documents and Settings\Administrator\Application Data\PPStream\ppsdown.exe:*:Enabled:PPSdown
"E:\Program Files\PPSGame\PPSGame.exe" = E:\Program Files\PPSGame\PPSGame.exe:*:Enabled:游戏大厅客户端 – (传聚网络科技有限公司)
"D:\Program files\iTunes.exe" = D:\Program files\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0
"{26671921-A46D-4639-B7EF-E43BE6F2AE73}" = EASEUS Data Recovery Wizard 4.3.6 Demo
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 24
"{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}" = EPSON Scan Assistant
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C84E54C-47ED-40BE-93D3-9277FC26C2DB}" = No-Limit Chinese
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5BF5F9C5-E95B-4AFA-94BE-F2A9CA73B61D}" = Apple Mobile Device Support
"{67EDD823-135A-4D59-87BD-950616D6E857}" = EPSON Copy Utility 3
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{75438C0E-9925-412E-AD85-D0E71C6CE2ED}" = USB2.0 PC Camera
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}" = EPSON Web-To-Page
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8D15E1B2-D2B7-4A17-B44B-D2DDE5981406}" = iLivid
"{90110409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional
"{90240409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Resource Kit
"{90260409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Web Components
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AAD47011-8518-4608-9656-951DA35B587B}" = iTunes
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.1
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B3FED300-806C-11E0-A0D0-B8AC6F97B88E}" = Google Earth
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B90450DF-E781-46FD-B1F1-0C86DA40E443}" = PIF DESIGNER
"{BC69DDB8-4840-4D9B-BB31-0D4DB2BA1312}" = EPSON Easy Photo Print
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CC65ECBC-E543-40DE-A115-F1CC59191033}" = Nero 7 Essentials
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF9CD37C-E29A-11D5-AE3D-005004B8E30C}" = Digital Photo Navigator 1.5
"{E86BC406-944E-41F6-ADE6-2C136734C96B}" = EPSON File Manager
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F44DA61E-720D-4E79-871F-F6E628B33242}" = OpenOffice.org 3.0
"{F9466082-90E9-4BE4-92F0-CF0AF195B0CF}" = 525 USB PC Camera
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"avast" = avast! Free Antivirus
"CCleaner" = CCleaner
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"EME200 User's Guide" = EME200 User's Guide
"EPSON Printer and Utilities" = EPSON Printer Software
"EPSON Scanner" = EPSON Scan
"ERUNT_is1" = ERUNT 1.1j
"ESET Online Scanner" = ESET Online Scanner v3
"GooglePinyin2" = 谷歌拼音输入法 2.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"IEAK5" = Microsoft Internet Explorer Administration Kit 5
"InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email
"John Constable Painting Screensaver - Screen Saver" = John Constable Painting Screensaver - Screen Saver
"KLiteCodecPack_is1" = K-Lite Codec Pack 4.3.4 (Full)
"Lingoes Translator_is1" = Lingoes 2.7.1
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.18)" = Mozilla Firefox (3.6.18)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"PC Tools Firewall Plus" = PC Tools Firewall Plus 6.0
"Picasa 3" = Picasa 3
"PPSGame" = PPS游戏 V1.0.1.238
"PPStream" = PPS影音 V2.7.0.1166 正式版
"Revo Uninstaller" = Revo Uninstaller 1.92
"SpywareBlaster_is1" = SpywareBlaster 4.4
"Universal Document Converter_is1" = Universal Document Converter (Demo)
"VirusTotalUploader2.0" = VirusTotal Uploader 2.0
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Winmx Community 1" = Winmx Community 1
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"YInstHelper" = Yahoo! Install Manager
"有道工具栏" = 有道工具栏
"有道桌面词典" = 有道桌面词典

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent DNA" = DNA
"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 6/25/2011 3:12:24 PM | Computer Name = EXPERIEN-255718 | Source = MsiInstaller | ID = 1024
Description = Product: Adobe Reader 9.4.5 - Update 'Adobe Reader 9.4.2 - CPSID_83708'
could not be installed. Error code 1603. Windows Installer can create logs to help
troubleshoot issues with installing software packages. Use the following link for
instructions on turning on logging support: http://go.microsoft.com/fwlink/?LinkId=23127

Error - 6/27/2011 4:14:29 AM | Computer Name = EXPERIEN-255718 | Source = Application Error | ID = 1000
Description = Faulting application plugin-container.exe, version 1.9.2.4182, faulting
module ntdll.dll, version 5.1.2600.5755, fault address 0x0000100b.

Error - 7/1/2011 12:45:24 PM | Computer Name = EXPERIEN-255718 | Source = Application Error | ID = 1000
Description = Faulting application plugin-container.exe, version 1.9.2.4182, faulting
module ntdll.dll, version 5.1.2600.5755, fault address 0x0000100b.

Error - 7/6/2011 6:43:15 AM | Computer Name = EXPERIEN-255718 | Source = Application Error | ID = 1000
Description = Faulting application plugin-container.exe, version 1.9.2.4182, faulting
module ntdll.dll, version 5.1.2600.5755, fault address 0x0000100b.

Error - 7/8/2011 11:56:42 AM | Computer Name = EXPERIEN-255718 | Source = Application Error | ID = 1000
Description = Faulting application emule.exe, version 0.50.0.4, faulting module
emule.exe, version 0.50.0.4, fault address 0x000d27c4.

Error - 7/10/2011 4:51:27 PM | Computer Name = EXPERIEN-255718 | Source = Application Error | ID = 1000
Description = Faulting application plugin-container.exe, version 1.9.2.4182, faulting
module ntdll.dll, version 5.1.2600.5755, fault address 0x0000100b.

Error - 7/11/2011 12:29:31 PM | Computer Name = EXPERIEN-255718 | Source = Application Error | ID = 1000
Description = Faulting application plugin-container.exe, version 1.9.2.4182, faulting
module ntdll.dll, version 5.1.2600.5755, fault address 0x0000100b.

Error - 7/14/2011 1:04:27 AM | Computer Name = EXPERIEN-255718 | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting
module msxml3.dll, version 8.100.1051.0, fault address 0x000a142d.

Error - 7/14/2011 11:50:29 PM | Computer Name = EXPERIEN-255718 | Source = Google Update | ID = 20
Description =

Error - 7/15/2011 12:03:13 AM | Computer Name = EXPERIEN-255718 | Source = Google Update | ID = 20
Description =

[ System Events ]
Error - 7/14/2011 2:07:29 AM | Computer Name = EXPERIEN-255718 | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 14 minutes. NtpClient has no source of accurate
time.

Error - 7/14/2011 2:08:03 AM | Computer Name = EXPERIEN-255718 | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the NVSvc service.

Error - 7/14/2011 5:00:27 AM | Computer Name = EXPERIEN-255718 | Source = W32Time | ID = 39452689
Description = Time Provider NtpClient: An error occurred during DNS lookup of the
manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup
again in 15 minutes. The error was: A socket operation was attempted to an unreachable
host. (0x80072751)

Error - 7/14/2011 5:00:27 AM | Computer Name = EXPERIEN-255718 | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 14 minutes. NtpClient has no source of accurate
time.

Error - 7/14/2011 5:01:00 AM | Computer Name = EXPERIEN-255718 | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the NVSvc service.

Error - 7/14/2011 9:27:48 PM | Computer Name = EXPERIEN-255718 | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the NVSvc service.

Error - 7/14/2011 9:41:06 PM | Computer Name = EXPERIEN-255718 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 7/14/2011 9:41:07 PM | Computer Name = EXPERIEN-255718 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 7/14/2011 9:42:11 PM | Computer Name = EXPERIEN-255718 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Aavmker4 AmdK8 aswSnx aswSP aswTdi Fips SASDIFSV SASKUTIL

Error - 7/14/2011 11:05:21 PM | Computer Name = EXPERIEN-255718 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}


< End of report >

I forgot to say that, when I open Firefox, the page address is still http://www.searchqu.com/406.

ComboFix:

ComboFix 11-07-17.03 - Administrator 8/2011 Mon 0:58.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.936.86.1033.18.2046.1350 [GMT 1:00]
执行位置: e:\documents and settings\Administrator\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: PC Tools Firewall Plus *Disabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}
.
.
((((((((((((((((((((((((((((((((((((((( 被删除的档案 )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
E:\readme.txt
e:\windows\system32\drivers\qwurkdtdcs.sys
.
.
((((((((((((((((((((((((((((((((((((((( 驱动/服务 )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Service_dyimmgirbow
.
.
((((((((((((((((((((((((( 2011-06-18 至 2011-07-18 的新的档案 )))))))))))))))))))))))))))))))
.
.
2011-07-15 23:40 . 2011-07-16 03:27 ——– d—–w- E:\desktop
2011-07-15 01:16 . 2011-07-15 01:16 404640 —-a-w- e:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-02 12:45 . 2011-07-02 12:45 ——– d—–w- e:\program files\Trend Micro
2011-07-01 20:35 . 2011-07-02 12:19 ——– d—–w- e:\documents and settings\Administrator\Local Settings\Application Data\Ilivid Player
2011-07-01 20:18 . 2011-07-01 20:18 ——– d–h–w- e:\documents and settings\All Users\Application Data\{C1D18E30-468F-478F-8837-B6CBA25F6547}
2011-07-01 20:18 . 2011-07-02 11:58 ——– d—–w- e:\program files\iLivid
2011-07-01 20:16 . 2011-07-02 10:56 ——– d—–w- e:\documents and settings\All Users\Application Data\boost_interprocess
2011-07-01 20:15 . 2011-07-02 12:14 ——– d—–w- e:\program files\Windows iLivid Toolbar
2011-07-01 17:15 . 2011-07-01 17:15 ——– d—–w- e:\documents and settings\Administrator\Local Settings\Application Data\PackageAware
2011-06-25 17:43 . 2011-07-04 11:36 441176 —-a-w- e:\windows\system32\drivers\aswSnx.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( 在三个月内被修改的档案 ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-06 18:52 . 2010-08-25 15:57 41272 —-a-w- e:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 18:52 . 2010-08-25 15:57 22712 —-a-w- e:\windows\system32\drivers\mbam.sys
2011-07-04 11:43 . 2010-09-08 22:16 40112 —-a-w- e:\windows\avastSS.scr
2011-07-04 11:43 . 2010-09-08 22:16 199304 —-a-w- e:\windows\system32\aswBoot.exe
2011-07-04 11:36 . 2010-09-08 22:16 309848 —-a-w- e:\windows\system32\drivers\aswSP.sys
2011-07-04 11:35 . 2010-09-08 22:16 43608 —-a-w- e:\windows\system32\drivers\aswTdi.sys
2011-07-04 11:35 . 2010-09-08 22:16 102616 —-a-w- e:\windows\system32\drivers\aswmon2.sys
2011-07-04 11:35 . 2010-09-08 22:16 96344 —-a-w- e:\windows\system32\drivers\aswmon.sys
2011-07-04 11:32 . 2010-09-08 22:16 25432 —-a-w- e:\windows\system32\drivers\aswRdr.sys
2011-07-04 11:32 . 2010-09-08 22:16 30808 —-a-w- e:\windows\system32\drivers\aavmker4.sys
2011-07-04 11:32 . 2010-09-08 22:16 19544 —-a-w- e:\windows\system32\drivers\aswFsBlk.sys
.
.
——- Sigcheck ——-
Note: Unsigned files aren't necessarily malware.
.
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . e:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . e:\windows\ERDNT\cache\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . e:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 . 4AFB3B0919649F95C1964AA1FAD27D73 . 361600 . . [5.1.2600.5625] . . e:\windows\system32\drivers\tcpip.sys
[-] 2008-05-03 . 37D8387CBD4437C55F454209BE10EF11 . 361344 . . [5.1.2600.5508] . . e:\windows\$NtUninstallKB951748$\tcpip.sys
[-] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . e:\windows\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( 重要登入点 ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*注意* 空白与合法缺省登录将不会被显示
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 122512 —-a-w- e:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="e:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-05-09 39408]
"BitTorrent DNA"="e:\program files\DNA\btdna.exe" [2009-11-06 323392]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="e:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 153136]
"PPS Accelerator"="e:\program files\PPStream\ppsap.exe" [2010-02-24 214408]
"SUPERAntiSpyware"="e:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-07-01 2424192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="e:\windows\system32\NvCpl.dll" [2006-08-11 7630848]
"nwiz"="nwiz.exe" [2006-08-11 1519616]
"IMJPMIG8.1"="e:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-05-03 208952]
"MSPY2002"="e:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-05-03 59392]
"PHIME2002ASync"="e:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-05-03 455168]
"PHIME2002A"="e:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-05-03 455168]
"tsnp325"="e:\windows\tsnp325.exe" [2007-04-21 270336]
"snp325"="e:\windows\vsnp325.exe" [2007-05-09 835584]
"00PCTFW"="e:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2010-01-12 3168216]
"tsnp2std"="e:\windows\tsnp2std.exe" [2006-12-05 262144]
"NvMediaCenter"="e:\windows\system32\NvMcTray.dll" [2006-08-11 86016]
"RTHDCPL"="RTHDCPL.EXE" [2009-08-14 18702336]
"Adobe ARM"="e:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"iTunesHelper"="d:\program files\iTunesHelper.exe" [2011-01-25 421160]
"SunJavaUpdateSched"="e:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"QuickTime Task"="D:\QTTask.exe" [2010-11-29 421888]
.
e:\documents and settings\Administrator\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - e:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
.
e:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - d:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 1 (0x1)
"StartMenuFavorites"= 0 (0x0)
"Start_ShowMyComputer"= 1 (0x1)
"Start_ShowMyDocs"= 1 (0x1)
"Start_ShowMyMusic"= 0 (0x0)
"Start_ShowRun"= 1 (0x1)
"Start_ShowSearch"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "e:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 —-a-w- e:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\keyboard layouts\e0220804]
Ime File REG_SZ GOOGLEPINYIN2.IME
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"YodaoDict"="d:\deskdict2\RunDict.exe" -hide
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"FixCamera"=e:\windows\FixCamera.exe
"iTunesHelper"="d:\program files\iTunesHelper.exe"
"Google Pinyin 2 Autoupdater"="e:\program files\Google\Google Pinyin 2\GooglePinyinDaemon.exe"
"NeroFilterCheck"=e:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"e:\\Program Files\\DNA\\btdna.exe"=
"e:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\english\\setup.exe"=
"e:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"e:\\Program Files\\Skype\\Phone\\Skype.exe"=
"e:\\Program Files\\PPStream\\PPStream.exe"=
"e:\\Program Files\\PPStream\\PPSAP.exe"=
"e:\\Program Files\\PPSGame\\PPSGame.exe"=
"e:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\Program files\\iTunes.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R1 aswSnx;aswSnx;e:\windows\system32\drivers\aswSnx.sys [6/25/2011 6:43 PM 441176]
R1 aswSP;aswSP;e:\windows\system32\drivers\aswSP.sys [9/8/2010 11:16 PM 309848]
R1 pctgntdi;pctgntdi;e:\windows\system32\drivers\pctgntdi.sys [3/2/2010 5:13 PM 233136]
R1 SASDIFSV;SASDIFSV;e:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 7:25 PM 12872]
R1 SASKUTIL;SASKUTIL;e:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 7:41 PM 67656]
R2 aswFsBlk;aswFsBlk;e:\windows\system32\drivers\aswFsBlk.sys [9/8/2010 11:16 PM 19544]
R2 PCTAppEvent;PCTAppEvent Driver;e:\windows\system32\drivers\PCTAppEvent.sys [3/2/2010 5:13 PM 88040]
R3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;e:\windows\system32\drivers\pctNdis-PacketFilter.sys [3/2/2010 5:12 PM 70664]
R3 pctNDIS;PC Tools Driver;e:\windows\system32\drivers\pctNdis.sys [3/2/2010 5:12 PM 58816]
R3 pctplfw;pctplfw;e:\windows\system32\drivers\pctplfw.sys [3/2/2010 5:12 PM 115216]
S0 qdda;qdda;e:\windows\system32\drivers\ualn.sys –> e:\windows\system32\drivers\ualn.sys [?]
S0 smfgt;smfgt;e:\windows\system32\drivers\loqem.sys –> e:\windows\system32\drivers\loqem.sys [?]
S2 gupdate1ca3fbff137535e;Google Update Service (gupdate1ca3fbff137535e);e:\program files\Google\Update\GoogleUpdate.exe [9/27/2009 11:14 PM 133104]
S3 Ambfilt;Ambfilt;e:\windows\system32\drivers\Ambfilt.sys [10/5/2010 3:25 PM 1684736]
S3 SNP325;USB PC Camera (SNPSTD325);e:\windows\system32\drivers\snp325.sys [3/3/2009 7:47 PM 10343168]
S3 ViaUsbEtsDriver;Nokia 1506 USB Device Driver;e:\windows\system32\drivers\ViaUsbEts.sys –> e:\windows\system32\drivers\ViaUsbEts.sys [?]
.
‘计划任务’ 文件夹 里的内容
.
2011-07-16 e:\windows\Tasks\AppleSoftwareUpdate.job
- e:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
2011-07-18 e:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- e:\program files\Google\Update\GoogleUpdate.exe [2009-09-27 22:14]
.
2011-07-17 e:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- e:\program files\Google\Update\GoogleUpdate.exe [2009-09-27 22:14]
.
.
——- 而外的扫描 ——-
.
uStart Page = hxxp://www.google.co.uk/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: ????(&Y)
IE: Add to Google Photos Screensa&ver - e:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~1\Office10\EXCEL.EXE/3000
IE: Google Sidewiki… - e:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_43C348BC2E93EB2B.dll/cmsidewiki.html
IE: 使用迅雷下载 - e:\docume~1\ADMINI~1\LOCALS~1\Temp\Rar$EX18.516\Thunder\Program\geturl.htm
IE: 使用迅雷下载全部链接 - e:\docume~1\ADMINI~1\LOCALS~1\Temp\Rar$EX18.516\Thunder\Program\getallurl.htm
IE: 有道搜索(&Y) - d:\toolbar\ydtbv2.2\YodaoToolbar.dll/158.htm
Trusted Zone: pps.tv
Trusted Zone: ppstream.com
Trusted Zone: webscache.com
FF - ProfilePath - e:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\r0w7w5f6.default\
FF - prefs.js: browser.search.selectedEngine - Search Results
FF - prefs.js: browser.startup.homepage - hxxp://www.searchqu.com/406
FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&appid=102&systemid=406&q=
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - e:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Ext: avast! WebRep: [removed] - e:\program files\Alwil Software\Avast5\WebRep\FF
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
Toolbar-10 - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-Run-TkBellExe - e:\program files\Common Files\Real\Update_OB\realsched.exe
Notify-74b28f26502 - (no file)
Notify-avgrsstarter - (no file)
AddRemove-Picasa 3 - d:\program files\Picasa3\Uninstall.exe
AddRemove-{7585478E9D9B42108671C12F8714CEFE} - d:\program files\DivX\DivXConverterUninstall.exe
AddRemove-{8ADFC4160D694100B5B8A22DE9DCABD9} - d:\program files\DivX\DivXPlayerUninstall.exe
AddRemove-{B13A7C41581B411290FBC0395694E2A9} - d:\program files\DivX\DivXConverterUninstall.exe
AddRemove-{B7050CBDB2504B34BC2A9CA0A692CC29} - d:\program files\DivX\DivXWebPlayerUninstall.exe
AddRemove-uTorrent - d:\program files\uTorrent.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-18 01:08
Windows 5.1.2600 Service Pack 3 NTFS
.
扫描被隐藏的进程 。。。
.
扫描被隐藏的启动组 。。。
.
扫描被隐藏的文件 。。。
.
.
e:\windows\TEMP\BIT5.tmp 0 bytes
e:\windows\TEMP\BIT7.tmp 0 bytes
e:\windows\TEMP\GUR1.tmp 0 bytes
e:\windows\TEMP\GUR4.tmp 0 bytes
.
扫描完成
被隐藏的档案: 4
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-1275210071-1645522239-725345543-500\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (Administrator)
"{99079A25-328F-4BD4-BE04-00955ACAA0A7}"=hex:51,66,7a,6c,4c,1d,3b,1b,35,85,17,
87,bd,63,ba,06,a2,08,43,d5,5b,8f,e1,be
"{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}"=hex:51,66,7a,6c,4c,1d,3b,1b,d5,d9,1d,
ba,e2,28,c6,01,bd,89,cc,b9,88,ea,50,0c
.
[HKEY_USERS\S-1-5-21-1275210071-1645522239-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ea,83,66,8e,97,4c,99,4c,b9,37,fa,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,6c,94,48,1e,56,81,53,4d,a3,04,a7,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ea,83,66,8e,97,4c,99,4c,b9,37,fa,\
.
[HKEY_USERS\S-1-5-21-1275210071-1645522239-725345543-500\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F58D41D6-2C87-FDA2-A848-31A6860F7C39}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— 运行进程下的动态链接库 ———————
.
- - - - - - - > 'winlogon.exe'(1116)
e:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
- - - - - - - > 'explorer.exe'(400)
e:\program files\Common Files\Ahead\Lib\NeroSearchBar.dll
e:\program files\Common Files\Ahead\Lib\MFC71U.DLL
e:\program files\Common Files\Ahead\Lib\BCGCBPRO860un71.dll
e:\windows\system32\ieframe.dll
e:\windows\system32\webcheck.dll
e:\windows\system32\WPDShServiceObj.dll
e:\windows\system32\PortableDeviceTypes.dll
e:\windows\system32\PortableDeviceApi.dll
e:\windows\system32\OneX.DLL
.
———————— 其他运行进程 ————————
.
e:\program files\Alwil Software\Avast5\AvastSvc.exe
e:\windows\system32\conime.exe
e:\windows\RTHDCPL.EXE
e:\windows\ALCFDRTM.EXE
e:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
e:\program files\Bonjour\mDNSResponder.exe
e:\program files\Java\jre6\bin\jqs.exe
e:\windows\system32\nvsvc32.exe
e:\program files\PC Tools Firewall Plus\FWService.exe
e:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
e:\program files\iPod\bin\iPodService.exe
e:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
e:\windows\system32\wscntfy.exe
.
**************************************************************************
.
完成时间: 2011-07-18 01:15:15 - 电脑已重新启动
ComboFix-quarantined-files.txt 2011-07-18 00:15
.
Pre-Run: 85,539,201,024 bytes free
Post-Run: 85,663,662,080 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CHS.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(3)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(3)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 7619773616FEEFC753ED9246DAE83970

This is the pre-reboot text for OTL:

OTL logfile created on: 7/19/2011 1:41:23 AM - Run 3
OTL by OldTimer - Version 3.2.26.1 Folder = E:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.38 Gb Available Physical Memory | 69.16% Memory free
3.85 Gb Paging File | 3.38 Gb Available in Paging File | 87.75% Paging File free
Paging file location(s): E:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = E: | %SystemRoot% = E:\WINDOWS | %ProgramFiles% = E:\Program Files
Drive C: | 58.75 Gb Total Space | 12.28 Gb Free Space | 20.91% Space Free | Partition Type: NTFS
Drive D: | 67.69 Gb Total Space | 61.46 Gb Free Space | 90.80% Space Free | Partition Type: NTFS
Drive E: | 106.44 Gb Total Space | 79.75 Gb Free Space | 74.92% Space Free | Partition Type: NTFS

Computer Name: EXPERIEN-255718 | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - E:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - E:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - E:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - E:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
PRC - D:\Program files\iTunesHelper.exe (Apple Inc.)
PRC - D:\QTTask.exe (Apple Inc.)
PRC - E:\WINDOWS\ALCFDRTM.EXE (Realtek Semiconductor Corp.)
PRC - E:\Program Files\PPStream\PPSAP.exe (PPStream Inc)
PRC - E:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe (PC Tools)
PRC - E:\Program Files\PC Tools Firewall Plus\FWService.exe (PC Tools)
PRC - E:\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
PRC - E:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - E:\WINDOWS\system32\savedump.exe (Microsoft Corporation)
PRC - E:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (Nero AG)
PRC - E:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
PRC - E:\WINDOWS\vsnp325.exe ()
PRC - E:\WINDOWS\tsnp325.exe ()
PRC - E:\WINDOWS\tsnp2std.exe ()


========== Modules (SafeList) ==========

MOD - E:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
MOD - E:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5508_x-ww_35d3ce4a\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (wuauserv) – File not found
SRV - (HidServ) – File not found
SRV - (ALG) – File not found
SRV - (avast! Antivirus) – E:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (PCToolsFirewallPlus) – E:\Program Files\PC Tools Firewall Plus\FWService.exe (PC Tools)


========== Driver Services (SafeList) ==========

DRV - (aswSnx) – E:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – E:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) – E:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) – E:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswRdr) – E:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (Aavmker4) – E:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (aswFsBlk) – E:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (SASKUTIL) – E:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – E:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (pctplfw) – E:\WINDOWS\system32\drivers\pctplfw.sys (PC Tools)
DRV - (PCTFW-PacketFilter) – E:\WINDOWS\system32\drivers\pctNdis-PacketFilter.sys (PC Tools)
DRV - (pctgntdi) – E:\WINDOWS\system32\drivers\pctgntdi.sys (PC Tools)
DRV - (pctNDIS) – E:\WINDOWS\system32\drivers\pctNdis.sys (PC Tools)
DRV - (PCTAppEvent) – E:\WINDOWS\system32\drivers\PCTAppEvent.sys (PC Tools)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – E:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (Ambfilt) – E:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)
DRV - (Tcpip6) – E:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (FsVga) – E:\WINDOWS\system32\drivers\fsvga.sys (Microsoft Corporation)
DRV - (SNP325) USB PC Camera (SNPSTD325) – E:\WINDOWS\system32\drivers\snp325.sys (Sonix Co. Ltd.)
DRV - (RTLE8023xp) – E:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (AmdK8) – E:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (Monfilt) – E:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.selectedEngine: "Search Results"
FF - prefs.js..browser.startup.homepage: "http://www.searchqu.com/406"
FF - prefs.js..extensions.enabledItems: [removed]:6.0.1203
FF - prefs.js..keyword.URL: "http://dts.search-results.com/sr?src=ffb&appid=102&systemid=406&q="
FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: E:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Program files\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: E:\Program Files\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: D:\Program files\DivX\DivX Web Player\npdivx32.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: D:\Program files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: E:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: D:\Program files\Picasa3\npPicasa3.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: E:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: e:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: E:\Program Files\Google\Update\1.2.183.29\npGoogleOneClick8.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\[removed]/YahooActiveXPluginBridge;version=1.0.0.1: E:\Program Files\Yahoo!\Common\npyaxmpb.dll File not found

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: E:\Program Files\Alwil Software\Avast5\WebRep\FF [2011/07/15 23:55:01 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.18\extensions\\Components: E:\Program Files\Mozilla Firefox\components [2011/06/25 19:01:21 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.18\extensions\\Plugins: E:\Program Files\Mozilla Firefox\plugins [2011/06/25 19:01:21 | 000,000,000 | —D | M]

[2011/07/02 13:14:50 | 000,000,000 | —D | M] (No name found) – E:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2009/03/26 16:40:34 | 000,000,000 | —D | M] (No name found) – E:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions\[removed]
[2011/07/18 23:31:57 | 000,000,000 | —D | M] (No name found) – E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\r0w7w5f6.default\extensions
[2011/07/02 11:51:50 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\r0w7w5f6.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2011/07/01 21:16:14 | 000,002,501 | —- | M] () – E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\r0w7w5f6.default\searchplugins\SearchResults.xml
[2011/07/02 14:04:03 | 000,000,000 | —D | M] (No name found) – E:\Program Files\Mozilla Firefox\extensions
[2011/07/15 23:55:01 | 000,000,000 | —D | M] (avast! WebRep) – E:\PROGRAM FILES\ALWIL SOFTWARE\AVAST5\WEBREP\FF
[2011/03/03 17:43:40 | 000,001,538 | —- | M] () – E:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2011/03/03 17:43:40 | 000,000,947 | —- | M] () – E:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2011/03/03 17:43:40 | 000,000,769 | —- | M] () – E:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2011/07/01 21:16:14 | 000,002,501 | —- | M] () – E:\Program Files\mozilla firefox\searchplugins\SearchResults.xml
[2011/03/03 17:43:40 | 000,001,135 | —- | M] () – E:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2011/07/18 01:06:34 | 000,000,027 | —- | M]) - E:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (no name) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - No CLSID value found.
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - E:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - E:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - E:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - E:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKCU\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - E:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [00PCTFW] E:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe (PC Tools)
O4 - HKLM..\Run: [IMJPMIG8.1] E:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [iTunesHelper] D:\Program files\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [MSPY2002] E:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
O4 - HKLM..\Run: [NvCplDaemon] E:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] E:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] E:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PHIME2002A] E:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] E:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [QuickTime Task] D:\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [snp325] E:\WINDOWS\vsnp325.exe ()
O4 - HKLM..\Run: [tsnp2std] E:\WINDOWS\tsnp2std.exe ()
O4 - HKLM..\Run: [tsnp325] E:\WINDOWS\tsnp325.exe ()
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] E:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [BitTorrent DNA] E:\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
O4 - HKCU..\Run: [PPS Accelerator] E:\Program Files\PPStream\PPSAP.exe (PPStream Inc)
O4 - HKCU..\Run: [SUPERAntiSpyware] E:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - Startup: E:\Documents and Settings\Administrator\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = E:\Program Files\ERUNT\AUTOBACK.EXE ()
O4 - Startup: E:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = D:\Program files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRemoteRecursiveEvents = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: MemCheckBoxInRunDlg = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuFavorites = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Start_ShowMyComputer = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Start_ShowMyDocs = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Start_ShowMyMusic = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Start_ShowRun = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Start_ShowSearch = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableStatusMessages = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: VerboseStatus = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoInternetOpenWith = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: MemCheckBoxInRunDlg = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSharedDocuments = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - E:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xport to Microsoft Excel - D:\Program files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Google Sidewiki… - E:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_43C348BC2E93EB2B.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - E:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: pps.tv ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: ppstream.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: webscache.com ([]http in Trusted sites)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} E:\Program Files\Yahoo!\Common\yinsthelper.dll (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - E:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - E:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - E:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - E:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/10/16 23:20:53 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2008/01/31 19:59:10 | 000,045,056 | R— | M] () - D:\AutoUpdate.dll – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O35 - HKCU\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/07/19 01:34:43 | 000,000,000 | —D | C] – E:\_OTL
[2011/07/19 00:43:11 | 000,000,000 | RH-D | C] – E:\Documents and Settings\Administrator\Recent
[2011/07/19 00:35:19 | 000,000,000 | -HSD | C] – E:\RECYCLER
[2011/07/18 00:38:00 | 000,518,144 | —- | C] (SteelWerX) – E:\WINDOWS\SWREG.exe
[2011/07/18 00:38:00 | 000,406,528 | —- | C] (SteelWerX) – E:\WINDOWS\SWSC.exe
[2011/07/18 00:38:00 | 000,212,480 | —- | C] (SteelWerX) – E:\WINDOWS\SWXCACLS.exe
[2011/07/18 00:38:00 | 000,060,416 | —- | C] (NirSoft) – E:\WINDOWS\NIRCMD.exe
[2011/07/18 00:37:42 | 000,000,000 | —D | C] – E:\Qoobox
[2011/07/17 23:55:20 | 004,154,783 | R— | C] (Swearware) – E:\Documents and Settings\Administrator\Desktop\ComboFix.exe
[2011/07/16 20:33:18 | 001,906,176 | —- | C] (AVAST Software) – E:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2011/07/16 20:32:25 | 000,579,584 | —- | C] (OldTimer Tools) – E:\Documents and Settings\Administrator\Desktop\OTL.exe
[2011/07/16 00:40:08 | 000,000,000 | —D | C] – E:\desktop
[2011/07/15 02:39:52 | 000,000,000 | —D | C] – E:\WINDOWS\CSC
[2011/07/15 02:16:27 | 000,404,640 | —- | C] (Adobe Systems Incorporated) – E:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/07/14 05:40:07 | 000,000,000 | —D | C] – E:\Documents and Settings\Administrator\Start Menu\Programs\Revo Uninstaller
[2011/07/02 13:45:32 | 000,000,000 | —D | C] – E:\Program Files\Trend Micro
[2011/07/01 21:35:04 | 000,000,000 | —D | C] – E:\Documents and Settings\Administrator\Local Settings\Application Data\Ilivid Player
[2011/07/01 21:18:55 | 000,000,000 | -H-D | C] – E:\Documents and Settings\All Users\Application Data\{C1D18E30-468F-478F-8837-B6CBA25F6547}
[2011/07/01 21:18:54 | 000,000,000 | —D | C] – E:\Documents and Settings\All Users\Start Menu\Programs\iLivid
[2011/07/01 21:18:34 | 000,000,000 | —D | C] – E:\Program Files\iLivid
[2011/07/01 21:16:15 | 000,000,000 | —D | C] – E:\Documents and Settings\All Users\Application Data\boost_interprocess
[2011/07/01 21:15:57 | 000,000,000 | —D | C] – E:\Program Files\Windows iLivid Toolbar
[2011/07/01 18:15:07 | 000,000,000 | —D | C] – E:\Documents and Settings\Administrator\Local Settings\Application Data\PackageAware
[2011/06/25 18:43:06 | 000,441,176 | —- | C] (AVAST Software) – E:\WINDOWS\System32\drivers\aswSnx.sys
[2009/03/03 19:47:09 | 000,147,456 | —- | C] ( ) – E:\WINDOWS\System32\rsnp325.dll
[2009/03/03 19:47:09 | 000,057,344 | —- | C] ( ) – E:\WINDOWS\System32\vsnp325.dll
[2009/03/03 19:47:09 | 000,053,248 | —- | C] ( ) – E:\WINDOWS\System32\csnp325.dll
[2009/03/03 19:46:07 | 000,147,456 | —- | C] ( ) – E:\WINDOWS\rsnp2std.dll
[2009/03/03 19:46:07 | 000,053,248 | —- | C] ( ) – E:\WINDOWS\System32\csnp2std.dll
[4 E:\WINDOWS\*.tmp files -> E:\WINDOWS\*.tmp -> ]
[1 E:\WINDOWS\System32\*.tmp files -> E:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/07/19 01:39:58 | 000,001,816 | —- | M] () – E:\WINDOWS\psnetwork.ini
[2011/07/19 01:39:57 | 000,000,090 | —- | M] () – E:\WINDOWS\PCDNSetting.ini
[2011/07/19 01:38:35 | 000,081,858 | —- | M] () – E:\WINDOWS\System32\nvapps.xml
[2011/07/19 01:38:28 | 000,000,882 | —- | M] () – E:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/07/19 01:38:17 | 000,002,206 | —- | M] () – E:\WINDOWS\System32\wpa.dbl
[2011/07/19 01:38:15 | 000,002,048 | –S- | M] () – E:\WINDOWS\bootstat.dat
[2011/07/19 01:16:45 | 000,000,512 | —- | M] () – E:\Documents and Settings\Administrator\Desktop\MBR.dat
[2011/07/19 00:49:01 | 000,000,886 | —- | M] () – E:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/07/18 01:06:34 | 000,000,027 | —- | M] () – E:\WINDOWS\System32\drivers\etc\hosts
[2011/07/17 23:55:56 | 004,154,783 | R— | M] (Swearware) – E:\Documents and Settings\Administrator\Desktop\ComboFix.exe
[2011/07/16 20:35:00 | 001,906,176 | —- | M] (AVAST Software) – E:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2011/07/16 20:32:01 | 000,579,584 | —- | M] (OldTimer Tools) – E:\Documents and Settings\Administrator\Desktop\OTL.exe
[2011/07/16 07:11:02 | 000,000,284 | —- | M] () – E:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/07/15 23:55:02 | 000,002,626 | —- | M] () – E:\WINDOWS\System32\CONFIG.NT
[2011/07/15 04:44:12 | 000,000,981 | —- | M] () – E:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/07/15 04:44:12 | 000,000,963 | —- | M] () – E:\Documents and Settings\Administrator\Desktop\Spybot - Search & Destroy.lnk
[2011/07/15 02:16:27 | 000,404,640 | —- | M] (Adobe Systems Incorporated) – E:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/07/14 05:40:07 | 000,000,917 | —- | M] () – E:\Documents and Settings\Administrator\Desktop\Revo Uninstaller.lnk
[2011/07/06 19:52:42 | 000,041,272 | —- | M] (Malwarebytes Corporation) – E:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/07/06 19:52:42 | 000,022,712 | —- | M] (Malwarebytes Corporation) – E:\WINDOWS\System32\drivers\mbam.sys
[2011/07/04 12:43:53 | 000,040,112 | —- | M] (AVAST Software) – E:\WINDOWS\avastSS.scr
[2011/07/04 12:43:51 | 000,199,304 | —- | M] (AVAST Software) – E:\WINDOWS\System32\aswBoot.exe
[2011/07/04 12:36:43 | 000,441,176 | —- | M] (AVAST Software) – E:\WINDOWS\System32\drivers\aswSnx.sys
[2011/07/04 12:36:32 | 000,309,848 | —- | M] (AVAST Software) – E:\WINDOWS\System32\drivers\aswSP.sys
[2011/07/04 12:35:23 | 000,043,608 | —- | M] (AVAST Software) – E:\WINDOWS\System32\drivers\aswTdi.sys
[2011/07/04 12:35:12 | 000,102,616 | —- | M] (AVAST Software) – E:\WINDOWS\System32\drivers\aswmon2.sys
[2011/07/04 12:35:09 | 000,096,344 | —- | M] (AVAST Software) – E:\WINDOWS\System32\drivers\aswmon.sys
[2011/07/04 12:32:32 | 000,025,432 | —- | M] (AVAST Software) – E:\WINDOWS\System32\drivers\aswRdr.sys
[2011/07/04 12:32:13 | 000,030,808 | —- | M] (AVAST Software) – E:\WINDOWS\System32\drivers\aavmker4.sys
[2011/07/04 12:32:12 | 000,019,544 | —- | M] (AVAST Software) – E:\WINDOWS\System32\drivers\aswFsBlk.sys
[2011/07/03 20:56:17 | 000,000,069 | —- | M] () – E:\WINDOWS\NeroDigital.ini
[2011/06/26 07:45:56 | 000,256,000 | —- | M] () – E:\WINDOWS\PEV.exe
[4 E:\WINDOWS\*.tmp files -> E:\WINDOWS\*.tmp -> ]
[1 E:\WINDOWS\System32\*.tmp files -> E:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/07/19 01:16:45 | 000,000,512 | —- | C] () – E:\Documents and Settings\Administrator\Desktop\MBR.dat
[2011/07/18 00:38:00 | 000,256,000 | —- | C] () – E:\WINDOWS\PEV.exe
[2011/07/18 00:38:00 | 000,208,896 | —- | C] () – E:\WINDOWS\MBR.exe
[2011/07/18 00:38:00 | 000,098,816 | —- | C] () – E:\WINDOWS\sed.exe
[2011/07/18 00:38:00 | 000,080,412 | —- | C] () – E:\WINDOWS\grep.exe
[2011/07/18 00:38:00 | 000,068,096 | —- | C] () – E:\WINDOWS\zip.exe
[2011/05/24 22:42:13 | 000,013,258 | -HS- | C] () – E:\Documents and Settings\All Users\Application Data\yo11nhy47rhv4pq0uemw1ulh8oh
[2011/05/24 22:42:13 | 000,013,258 | -HS- | C] () – E:\Documents and Settings\Administrator\Local Settings\Application Data\yo11nhy47rhv4pq0uemw1ulh8oh
[2011/05/21 17:18:49 | 000,013,458 | -HS- | C] () – E:\Documents and Settings\All Users\Application Data\wd5r61txwyhk4p0hkw0jcp7lmy7v883d3j0i2buux84c
[2011/05/21 17:18:49 | 000,013,458 | -HS- | C] () – E:\Documents and Settings\Administrator\Local Settings\Application Data\wd5r61txwyhk4p0hkw0jcp7lmy7v883d3j0i2buux84c
[2011/01/31 07:16:27 | 000,000,027 | —- | C] () – E:\WINDOWS\OOIIEProxy.ini
[2010/11/19 20:36:09 | 000,000,090 | —- | C] () – E:\WINDOWS\PCDNSetting.ini
[2010/11/19 20:32:56 | 000,000,060 | —- | C] () – E:\WINDOWS\MediaList.ini
[2010/11/19 20:32:31 | 000,001,374 | —- | C] () – E:\WINDOWS\Powerlist.ini
[2010/11/19 20:32:28 | 000,001,426 | —- | C] () – E:\WINDOWS\powerplayer.ini
[2010/11/19 20:32:25 | 000,001,816 | —- | C] () – E:\WINDOWS\psnetwork.ini
[2010/10/08 23:53:01 | 000,049,140 | -H– | C] () – E:\WINDOWS\System32\mlfcache.dat
[2010/09/05 13:58:52 | 000,000,000 | —- | C] () – E:\Documents and Settings\Administrator\Local Settings\Application Data\prvlcl.dat
[2010/08/21 11:05:31 | 000,001,697 | —- | C] () – E:\Documents and Settings\Administrator\Application Data\a0000001d05d0b.xml
[2010/06/16 16:32:54 | 000,111,932 | —- | C] () – E:\WINDOWS\System32\EPPICPrinterDB.dat
[2010/06/16 16:32:54 | 000,031,053 | —- | C] () – E:\WINDOWS\System32\EPPICPattern131.dat
[2010/06/16 16:32:54 | 000,027,417 | —- | C] () – E:\WINDOWS\System32\EPPICPattern121.dat
[2010/06/16 16:32:54 | 000,026,154 | —- | C] () – E:\WINDOWS\System32\EPPICPattern1.dat
[2010/06/16 16:32:54 | 000,024,903 | —- | C] () – E:\WINDOWS\System32\EPPICPattern3.dat
[2010/06/16 16:32:54 | 000,021,390 | —- | C] () – E:\WINDOWS\System32\EPPICPattern5.dat
[2010/06/16 16:32:54 | 000,020,148 | —- | C] () – E:\WINDOWS\System32\EPPICPattern2.dat
[2010/06/16 16:32:54 | 000,011,811 | —- | C] () – E:\WINDOWS\System32\EPPICPattern4.dat
[2010/06/16 16:32:54 | 000,004,943 | —- | C] () – E:\WINDOWS\System32\EPPICPattern6.dat
[2010/06/16 16:32:54 | 000,001,146 | —- | C] () – E:\WINDOWS\System32\EPPICPresetData_DU.dat
[2010/06/16 16:32:54 | 000,001,139 | —- | C] () – E:\WINDOWS\System32\EPPICPresetData_PT.dat
[2010/06/16 16:32:54 | 000,001,139 | —- | C] () – E:\WINDOWS\System32\EPPICPresetData_BP.dat
[2010/06/16 16:32:54 | 000,001,136 | —- | C] () – E:\WINDOWS\System32\EPPICPresetData_ES.dat
[2010/06/16 16:32:54 | 000,001,129 | —- | C] () – E:\WINDOWS\System32\EPPICPresetData_FR.dat
[2010/06/16 16:32:54 | 000,001,129 | —- | C] () – E:\WINDOWS\System32\EPPICPresetData_CF.dat
[2010/06/16 16:32:54 | 000,001,120 | —- | C] () – E:\WINDOWS\System32\EPPICPresetData_IT.dat
[2010/06/16 16:32:54 | 000,001,107 | —- | C] () – E:\WINDOWS\System32\EPPICPresetData_GE.dat
[2010/06/16 16:32:54 | 000,001,104 | —- | C] () – E:\WINDOWS\System32\EPPICPresetData_EN.dat
[2010/06/16 16:32:54 | 000,000,097 | —- | C] () – E:\WINDOWS\System32\PICSDK.ini
[2010/06/16 16:26:09 | 000,000,025 | —- | C] () – E:\WINDOWS\CDE ME 200EC.ini
[2010/02/23 21:08:45 | 000,016,968 | —- | C] () – E:\WINDOWS\System32\drivers\hitmanpro35.sys
[2009/10/23 10:23:17 | 000,000,664 | —- | C] () – E:\Documents and Settings\Administrator\Local Settings\Application Data\FASTWiz.html
[2009/09/24 00:28:27 | 000,001,815 | —- | C] () – E:\WINDOWS\hpdj5100.ini
[2009/09/14 07:21:14 | 000,196,640 | -HS- | C] () – E:\WINDOWS\System32\drivers\fidbox2.dat
[2009/09/14 07:21:14 | 000,000,032 | -HS- | C] () – E:\WINDOWS\System32\drivers\fidbox.dat
[2009/04/02 19:28:01 | 000,000,136 | —- | C] () – E:\WINDOWS\System32\cid_store.dat
[2009/04/02 19:24:39 | 000,000,020 | —- | C] () – E:\WINDOWS\System32\pub_store.dat
[2009/03/03 19:47:09 | 000,835,584 | —- | C] () – E:\WINDOWS\vsnp325.exe
[2009/03/03 19:47:09 | 000,270,336 | —- | C] () – E:\WINDOWS\tsnp325.exe
[2009/03/03 19:47:09 | 000,015,498 | —- | C] () – E:\WINDOWS\snp325.ini
[2009/03/03 19:46:09 | 000,020,480 | —- | C] () – E:\WINDOWS\FixCamera.exe
[2009/03/03 19:46:08 | 000,262,144 | —- | C] () – E:\WINDOWS\tsnp2std.exe
[2009/03/03 19:46:08 | 000,015,497 | —- | C] () – E:\WINDOWS\snp2std.ini
[2009/03/03 19:46:07 | 010,305,280 | —- | C] () – E:\WINDOWS\System32\drivers\snp2sxp.sys
[2009/03/03 19:46:07 | 000,024,832 | —- | C] () – E:\WINDOWS\System32\drivers\sncamd.sys
[2009/02/17 21:38:16 | 000,000,151 | —- | C] () – E:\WINDOWS\PhotoSnapViewer.INI
[2008/12/30 18:01:46 | 000,008,704 | —- | C] () – E:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/12/16 20:36:46 | 000,000,038 | —- | C] () – E:\WINDOWS\avisplitter.ini
[2008/12/16 20:36:45 | 000,755,027 | —- | C] () – E:\WINDOWS\System32\xvidcore.dll
[2008/12/16 20:36:44 | 000,159,839 | —- | C] () – E:\WINDOWS\System32\xvidvfw.dll
[2008/12/16 20:36:43 | 000,057,344 | —- | C] () – E:\WINDOWS\System32\ff_vfw.dll
[2008/12/04 19:33:57 | 000,000,664 | —- | C] () – E:\WINDOWS\System32\d3d9caps.dat
[2008/11/01 09:47:08 | 000,000,376 | —- | C] () – E:\WINDOWS\ODBC.INI
[2008/10/30 08:00:17 | 000,000,754 | —- | C] () – E:\WINDOWS\WORDPAD.INI
[2008/10/29 10:16:50 | 000,000,069 | —- | C] () – E:\WINDOWS\NeroDigital.ini
[2008/10/17 05:04:59 | 000,000,496 | —- | C] () – E:\WINDOWS\cdplayer.ini
[2008/10/17 04:46:37 | 000,000,029 | —- | C] () – E:\WINDOWS\AdvConfig.ini
[2008/10/17 03:43:34 | 000,000,000 | —- | C] () – E:\WINDOWS\nsreg.dat
[2008/10/17 01:58:59 | 000,049,152 | —- | C] () – E:\WINDOWS\System32\ChCfg.exe
[2008/10/17 00:14:17 | 000,004,161 | —- | C] () – E:\WINDOWS\ODBCINST.INI
[2008/10/17 00:10:55 | 000,228,800 | —- | C] () – E:\WINDOWS\System32\FNTCACHE.DAT
[2008/10/16 23:23:15 | 000,000,135 | —- | C] () – E:\WINDOWS\System32\prio.ini
[2008/10/16 23:22:54 | 000,462,848 | —- | C] () – E:\WINDOWS\System32\lame_enc.dll
[2008/10/16 23:22:53 | 000,155,720 | —- | C] () – E:\WINDOWS\System32\CDR.exe
[2008/10/16 23:22:53 | 000,110,080 | —- | C] () – E:\WINDOWS\System32\cdimage.exe
[2008/10/16 23:22:53 | 000,005,405 | —- | C] () – E:\WINDOWS\System32\CHNGTEXT.EXE
[2008/10/16 23:22:53 | 000,001,754 | —- | C] () – E:\WINDOWS\System32\CHOICE.COM
[2008/10/16 23:21:18 | 000,002,048 | –S- | C] () – E:\WINDOWS\bootstat.dat
[2008/10/16 23:18:15 | 000,021,640 | —- | C] () – E:\WINDOWS\System32\emptyregdb.dat
[2008/09/16 01:14:24 | 003,596,288 | —- | C] () – E:\WINDOWS\System32\qt-dx331.dll
[2008/05/03 13:00:00 | 013,107,200 | —- | C] () – E:\WINDOWS\System32\oembios.bin
[2008/05/03 13:00:00 | 000,673,088 | —- | C] () – E:\WINDOWS\System32\mlang.dat
[2008/05/03 13:00:00 | 000,432,492 | —- | C] () – E:\WINDOWS\System32\perfh009.dat
[2008/05/03 13:00:00 | 000,272,128 | —- | C] () – E:\WINDOWS\System32\perfi009.dat
[2008/05/03 13:00:00 | 000,218,003 | —- | C] () – E:\WINDOWS\System32\dssec.dat
[2008/05/03 13:00:00 | 000,152,576 | —- | C] () – E:\WINDOWS\System32\makecab.exe
[2008/05/03 13:00:00 | 000,067,448 | —- | C] () – E:\WINDOWS\System32\perfc009.dat
[2008/05/03 13:00:00 | 000,046,258 | —- | C] () – E:\WINDOWS\System32\mib.bin
[2008/05/03 13:00:00 | 000,028,626 | —- | C] () – E:\WINDOWS\System32\perfd009.dat
[2008/05/03 13:00:00 | 000,004,569 | —- | C] () – E:\WINDOWS\System32\secupd.dat
[2008/05/03 13:00:00 | 000,004,463 | —- | C] () – E:\WINDOWS\System32\oembios.dat
[2008/05/03 13:00:00 | 000,001,804 | —- | C] () – E:\WINDOWS\System32\Dcache.bin
[2008/05/03 13:00:00 | 000,000,741 | —- | C] () – E:\WINDOWS\System32\noise.dat
[2007/02/09 10:25:06 | 000,230,424 | —- | C] () – E:\WINDOWS\ptm_nt.dll
[2006/08/11 14:45:20 | 000,581,632 | —- | C] () – E:\WINDOWS\System32\nvhwvid.dll
[2006/08/11 14:43:10 | 000,196,608 | —- | C] () – E:\WINDOWS\System32\nvapi.dll
[2006/08/11 14:43:00 | 001,662,976 | —- | C] () – E:\WINDOWS\System32\nvwdmcpl.dll
[2006/08/11 14:43:00 | 001,519,616 | —- | C] () – E:\WINDOWS\System32\nwiz.exe
[2006/08/11 14:43:00 | 001,470,464 | —- | C] () – E:\WINDOWS\System32\nview.dll
[2006/08/11 14:43:00 | 001,339,392 | —- | C] () – E:\WINDOWS\System32\nvdspsch.exe
[2006/08/11 14:43:00 | 001,019,904 | —- | C] () – E:\WINDOWS\System32\nvwimg.dll
[2006/08/11 14:43:00 | 000,466,944 | —- | C] () – E:\WINDOWS\System32\nvshell.dll
[2006/08/11 14:43:00 | 000,442,368 | —- | C] () – E:\WINDOWS\System32\nvappbar.exe
[2006/08/11 14:43:00 | 000,425,984 | —- | C] () – E:\WINDOWS\System32\keystone.exe
[2006/08/11 14:43:00 | 000,286,720 | —- | C] () – E:\WINDOWS\System32\nvnt4cpl.dll
[2002/10/15 23:54:04 | 000,153,088 | —- | C] () – E:\WINDOWS\System32\unrar.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 95 bytes -> E:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
@Alternate Data Stream - 110 bytes -> E:\Documents and Settings\All Users\Application Data\TEMP:C31F31E6

< End of report >

Post-reboot:

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Prefs.js: "Search Results" removed from browser.search.defaultenginename
Prefs.js: "Search Results" removed from browser.search.order.1
Prefs.js: "Search Results" removed from browser.search.selectedEngine
Prefs.js: "http://www.searchqu.com/406" removed from browser.startup.homepage
Prefs.js: "http://dts.search-results.com/sr?src=ffb&appid=102&systemid=406&q=" removed from keyword.URL
Starting removal of ActiveX control {30528230-99f7-4bb4-88d8-fa1d4f56a2ab}
E:\Program Files\Yahoo!\Common\yinst.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\74b28f26502\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter\ not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Ilivid Player folder moved successfully.
E:\Documents and Settings\All Users\Application Data\{C1D18E30-468F-478F-8837-B6CBA25F6547} folder moved successfully.
E:\Documents and Settings\All Users\Start Menu\Programs\iLivid folder moved successfully.
E:\Program Files\iLivid\VLC\skins\fonts folder moved successfully.
E:\Program Files\iLivid\VLC\skins folder moved successfully.
E:\Program Files\iLivid\VLC\sdk\lib\pkgconfig folder moved successfully.
E:\Program Files\iLivid\VLC\sdk\lib folder moved successfully.
E:\Program Files\iLivid\VLC\sdk\include\vlc\plugins folder moved successfully.
E:\Program Files\iLivid\VLC\sdk\include\vlc folder moved successfully.
E:\Program Files\iLivid\VLC\sdk\include folder moved successfully.
E:\Program Files\iLivid\VLC\sdk folder moved successfully.
E:\Program Files\iLivid\VLC\plugins folder moved successfully.
E:\Program Files\iLivid\VLC\osdmenu\default\volume folder moved successfully.
E:\Program Files\iLivid\VLC\osdmenu\default\selection folder moved successfully.
E:\Program Files\iLivid\VLC\osdmenu\default\selected folder moved successfully.
E:\Program Files\iLivid\VLC\osdmenu\default folder moved successfully.
E:\Program Files\iLivid\VLC\osdmenu folder moved successfully.
E:\Program Files\iLivid\VLC\NSIS folder moved successfully.
E:\Program Files\iLivid\VLC\mozilla folder moved successfully.
E:\Program Files\iLivid\VLC\lua\sd folder moved successfully.
E:\Program Files\iLivid\VLC\lua\playlist folder moved successfully.
E:\Program Files\iLivid\VLC\lua\modules folder moved successfully.
E:\Program Files\iLivid\VLC\lua\meta\reader folder moved successfully.
E:\Program Files\iLivid\VLC\lua\meta\fetcher folder moved successfully.
E:\Program Files\iLivid\VLC\lua\meta\art folder moved successfully.
E:\Program Files\iLivid\VLC\lua\meta folder moved successfully.
E:\Program Files\iLivid\VLC\lua\intf\modules folder moved successfully.
E:\Program Files\iLivid\VLC\lua\intf folder moved successfully.
E:\Program Files\iLivid\VLC\lua\http\requests folder moved successfully.
E:\Program Files\iLivid\VLC\lua\http\js folder moved successfully.
E:\Program Files\iLivid\VLC\lua\http\images folder moved successfully.
E:\Program Files\iLivid\VLC\lua\http\dialogs folder moved successfully.
E:\Program Files\iLivid\VLC\lua\http folder moved successfully.
E:\Program Files\iLivid\VLC\lua\extensions folder moved successfully.
E:\Program Files\iLivid\VLC\lua folder moved successfully.
E:\Program Files\iLivid\VLC\locale\zh_TW\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\zh_TW folder moved successfully.
E:\Program Files\iLivid\VLC\locale\zh_CN\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\zh_CN folder moved successfully.
E:\Program Files\iLivid\VLC\locale\wa\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\wa folder moved successfully.
E:\Program Files\iLivid\VLC\locale\vi\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\vi folder moved successfully.
E:\Program Files\iLivid\VLC\locale\uk\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\uk folder moved successfully.
E:\Program Files\iLivid\VLC\locale\tr\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\tr folder moved successfully.
E:\Program Files\iLivid\VLC\locale\tl\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\tl folder moved successfully.
E:\Program Files\iLivid\VLC\locale\th\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\th folder moved successfully.
E:\Program Files\iLivid\VLC\locale\tet\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\tet folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ta\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ta folder moved successfully.
E:\Program Files\iLivid\VLC\locale\sv\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\sv folder moved successfully.
E:\Program Files\iLivid\VLC\locale\sr\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\sr folder moved successfully.
E:\Program Files\iLivid\VLC\locale\sq\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\sq folder moved successfully.
E:\Program Files\iLivid\VLC\locale\sl\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\sl folder moved successfully.
E:\Program Files\iLivid\VLC\locale\sk\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\sk folder moved successfully.
E:\Program Files\iLivid\VLC\locale\si\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\si folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ru\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ru folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ro\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ro folder moved successfully.
E:\Program Files\iLivid\VLC\locale\qt4 folder moved successfully.
E:\Program Files\iLivid\VLC\locale\pt_PT\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\pt_PT folder moved successfully.
E:\Program Files\iLivid\VLC\locale\pt_BR\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\pt_BR folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ps\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ps folder moved successfully.
E:\Program Files\iLivid\VLC\locale\pl\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\pl folder moved successfully.
E:\Program Files\iLivid\VLC\locale\pa\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\pa folder moved successfully.
E:\Program Files\iLivid\VLC\locale\oc\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\oc folder moved successfully.
E:\Program Files\iLivid\VLC\locale\nn\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\nn folder moved successfully.
E:\Program Files\iLivid\VLC\locale\nl\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\nl folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ne\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ne folder moved successfully.
E:\Program Files\iLivid\VLC\locale\nb\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\nb folder moved successfully.
E:\Program Files\iLivid\VLC\locale\my\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\my folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ms\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ms folder moved successfully.
E:\Program Files\iLivid\VLC\locale\mn\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\mn folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ml\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ml folder moved successfully.
E:\Program Files\iLivid\VLC\locale\mk\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\mk folder moved successfully.
E:\Program Files\iLivid\VLC\locale\lv\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\lv folder moved successfully.
E:\Program Files\iLivid\VLC\locale\lt\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\lt folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ko\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ko folder moved successfully.
E:\Program Files\iLivid\VLC\locale\km\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\km folder moved successfully.
E:\Program Files\iLivid\VLC\locale\kk\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\kk folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ka\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ka folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ja\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ja folder moved successfully.
E:\Program Files\iLivid\VLC\locale\it\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\it folder moved successfully.
E:\Program Files\iLivid\VLC\locale\id\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\id folder moved successfully.
E:\Program Files\iLivid\VLC\locale\hu\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\hu folder moved successfully.
E:\Program Files\iLivid\VLC\locale\hr\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\hr folder moved successfully.
E:\Program Files\iLivid\VLC\locale\hi\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\hi folder moved successfully.
E:\Program Files\iLivid\VLC\locale\he\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\he folder moved successfully.
E:\Program Files\iLivid\VLC\locale\gl\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\gl folder moved successfully.
E:\Program Files\iLivid\VLC\locale\fur\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\fur folder moved successfully.
E:\Program Files\iLivid\VLC\locale\fr\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\fr folder moved successfully.
E:\Program Files\iLivid\VLC\locale\fi\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\fi folder moved successfully.
E:\Program Files\iLivid\VLC\locale\fa\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\fa folder moved successfully.
E:\Program Files\iLivid\VLC\locale\eu\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\eu folder moved successfully.
E:\Program Files\iLivid\VLC\locale\et\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\et folder moved successfully.
E:\Program Files\iLivid\VLC\locale\es\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\es folder moved successfully.
E:\Program Files\iLivid\VLC\locale\en_GB\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\en_GB folder moved successfully.
E:\Program Files\iLivid\VLC\locale\el\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\el folder moved successfully.
E:\Program Files\iLivid\VLC\locale\de\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\de folder moved successfully.
E:\Program Files\iLivid\VLC\locale\da\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\da folder moved successfully.
E:\Program Files\iLivid\VLC\locale\cs\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\cs folder moved successfully.
E:\Program Files\iLivid\VLC\locale\co\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\co folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ckb\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ckb folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ca\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ca folder moved successfully.
E:\Program Files\iLivid\VLC\locale\bn\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\bn folder moved successfully.
E:\Program Files\iLivid\VLC\locale\bg\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\bg folder moved successfully.
E:\Program Files\iLivid\VLC\locale\be\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\be folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ar\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\ar folder moved successfully.
E:\Program Files\iLivid\VLC\locale\af\LC_MESSAGES folder moved successfully.
E:\Program Files\iLivid\VLC\locale\af folder moved successfully.
E:\Program Files\iLivid\VLC\locale folder moved successfully.
E:\Program Files\iLivid\VLC\languages folder moved successfully.
E:\Program Files\iLivid\VLC\http\requests folder moved successfully.
E:\Program Files\iLivid\VLC\http\js folder moved successfully.
E:\Program Files\iLivid\VLC\http\images folder moved successfully.
E:\Program Files\iLivid\VLC\http\dialogs folder moved successfully.
E:\Program Files\iLivid\VLC\http folder moved successfully.
E:\Program Files\iLivid\VLC\activex folder moved successfully.
E:\Program Files\iLivid\VLC folder moved successfully.
E:\Program Files\iLivid\imageformats folder moved successfully.
E:\Program Files\iLivid folder moved successfully.
E:\Program Files\Windows iLivid Toolbar\Datamngr\FirefoxExtension folder moved successfully.
E:\Program Files\Windows iLivid Toolbar\Datamngr folder moved successfully.
E:\Program Files\Windows iLivid Toolbar folder moved successfully.
E:\Documents and Settings\All Users\Application Data\yo11nhy47rhv4pq0uemw1ulh8oh moved successfully.
E:\Documents and Settings\Administrator\Local Settings\Application Data\yo11nhy47rhv4pq0uemw1ulh8oh moved successfully.
E:\Documents and Settings\All Users\Application Data\wd5r61txwyhk4p0hkw0jcp7lmy7v883d3j0i2buux84c moved successfully.
E:\Documents and Settings\Administrator\Local Settings\Application Data\wd5r61txwyhk4p0hkw0jcp7lmy7v883d3j0i2buux84c moved successfully.
File E:\WINDOWS\System32\drivers\qwurkdtdcs.sys not found.
E:\Documents and Settings\Administrator\Application Data\a0000001d05d0b.xml moved successfully.
ADS E:\Documents and Settings\All Users\Application Data\TEMP:5C321E34 deleted successfully.
ADS E:\Documents and Settings\All Users\Application Data\TEMP:C31F31E6 deleted successfully.
========== COMMANDS ==========
Restore point Set: OTL Restore Point (0)

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 1831026 bytes
->Temporary Internet Files folder emptied: 692882 bytes
->Java cache emptied: 1098911 bytes
->FireFox cache emptied: 46524316 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 49146 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 41620 bytes

User: LocalService
->Temp folder emptied: 65748 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1764644 bytes
%systemroot%\System32 .tmp files removed: 18298 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16384 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 50.00 mb


OTL by OldTimer - Version 3.2.26.1 log created on 07192011_014647

Files\Folders moved on Reboot…

Registry entries deleted on Reboot…

Thank you.

Nick

Hello NickM,

Thank you for the explanation on the "?????" = ?????


Please read carefully and follow these steps.

• Download TDSSKiller and save it to your Desktop.
• Extract its contents to your desktop.
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
  
  🖼Click to load external image (Posted Image)
  
• If an infected file is detected, the default action will be Cure, click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
  
  🖼Click to load external image (Posted Image)
  
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

====================

• Please Rerun ComboFix
  
  Please disable any Antivirus or Firewall you have active,
  
• Double click on ComboFix.exe & follow the prompts
• Click on Yes, to continue scanning for malware.
• When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply

A word of warning: Neither I nor sUBs are responsible for any damage you may cause to your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper
===========================
Please include in your next reply:
1. Any problem executing the instructions?
2. TDSS log
3. ComboFix log
4. How is the computer behaving?

There were no problems in running the two programmes, although my firewall (PC Tools Firewall Plus) afterwrds warned of an "unknown application trying to access computer", which I blocked.

TDSSKiller:

2011/07/20 00:02:40.0656 3188 TDSS rootkit removing tool 2.5.11.0 Jul 11 2011 16:56:56
2011/07/20 00:02:42.0656 3188 ================================================================================
2011/07/20 00:02:42.0656 3188 SystemInfo:
2011/07/20 00:02:42.0656 3188
2011/07/20 00:02:42.0656 3188 OS Version: 5.1.2600 ServicePack: 3.0
2011/07/20 00:02:42.0656 3188 Product type: Workstation
2011/07/20 00:02:42.0656 3188 ComputerName: EXPERIEN-255718
2011/07/20 00:02:42.0656 3188 UserName: Administrator
2011/07/20 00:02:42.0656 3188 Windows directory: E:\WINDOWS
2011/07/20 00:02:42.0656 3188 System windows directory: E:\WINDOWS
2011/07/20 00:02:42.0656 3188 Processor architecture: Intel x86
2011/07/20 00:02:42.0656 3188 Number of processors: 2
2011/07/20 00:02:42.0656 3188 Page size: 0x1000
2011/07/20 00:02:42.0656 3188 Boot type: Normal boot
2011/07/20 00:02:42.0656 3188 ================================================================================
2011/07/20 00:02:43.0500 3188 Initialize success
2011/07/20 00:02:57.0218 3388 ================================================================================
2011/07/20 00:02:57.0218 3388 Scan started
2011/07/20 00:02:57.0218 3388 Mode: Manual;
2011/07/20 00:02:57.0218 3388 ================================================================================
2011/07/20 00:02:57.0531 3388 Aavmker4 (dfcdd5936cad0138775d5a105d4c7716) E:\WINDOWS\system32\drivers\Aavmker4.sys
2011/07/20 00:02:57.0640 3388 ACPI (7517e9b5fe4811cbd7712af820028cc4) E:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/07/20 00:02:57.0687 3388 ACPIEC (9859c0f6936e723e4892d7141b1327d5) E:\WINDOWS\system32\drivers\ACPIEC.sys
2011/07/20 00:02:57.0734 3388 aec (8bed39e3c35d6a489438b8141717a557) E:\WINDOWS\system32\drivers\aec.sys
2011/07/20 00:02:57.0796 3388 AFD (7e775010ef291da96ad17ca4b17137d7) E:\WINDOWS\System32\drivers\afd.sys
2011/07/20 00:02:57.0968 3388 Ambfilt (f6af59d6eee5e1c304f7f73706ad11d8) E:\WINDOWS\system32\drivers\Ambfilt.sys
2011/07/20 00:02:58.0062 3388 AmdK8 (0a4d13b388c814560bd69c3a496ecfa8) E:\WINDOWS\system32\DRIVERS\AmdK8.sys
2011/07/20 00:02:58.0218 3388 aswFsBlk (861cb512e4e850e87dd2316f88d69330) E:\WINDOWS\system32\drivers\aswFsBlk.sys
2011/07/20 00:02:58.0234 3388 aswMon2 (7857e0b4c817f69ff463eea2c63e56f9) E:\WINDOWS\system32\drivers\aswMon2.sys
2011/07/20 00:02:58.0265 3388 aswRdr (8db043bf96bb6d334e5b4888e709e1c7) E:\WINDOWS\system32\drivers\aswRdr.sys
2011/07/20 00:02:58.0328 3388 aswSnx (17230708a2028cd995656df455f2e303) E:\WINDOWS\system32\drivers\aswSnx.sys
2011/07/20 00:02:58.0359 3388 aswSP (dbedd9d43b00630966ef05d2d8d04cee) E:\WINDOWS\system32\drivers\aswSP.sys
2011/07/20 00:02:58.0390 3388 aswTdi (984cfce2168286c2511695c2f9621475) E:\WINDOWS\system32\drivers\aswTdi.sys
2011/07/20 00:02:58.0421 3388 AsyncMac (34c951228c152a248357409cb680ce13) E:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/07/20 00:02:58.0468 3388 atapi (65ea06f8711fb3a64ec7d323e350f456) E:\WINDOWS\system32\DRIVERS\atapi.sys
2011/07/20 00:02:58.0500 3388 Atmarpc (ce372a820e4f4e808b574050ec35c049) E:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/07/20 00:02:58.0546 3388 audstub (d9f724aa26c010a217c97606b160ed68) E:\WINDOWS\system32\DRIVERS\audstub.sys
2011/07/20 00:02:58.0609 3388 Beep (da1f27d85e0d1525f6621372e7b685e9) E:\WINDOWS\system32\drivers\Beep.sys
2011/07/20 00:02:58.0687 3388 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) E:\WINDOWS\system32\drivers\cbidf2k.sys
2011/07/20 00:02:58.0718 3388 CCDECODE (e55191f6306f267bf9191e09e9ca6cae) E:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2011/07/20 00:02:58.0765 3388 Cdaudio (c1b486a7658353d33a10cc15211a873b) E:\WINDOWS\system32\drivers\Cdaudio.sys
2011/07/20 00:02:58.0812 3388 Cdfs (3a8d04c6533a344973ba5cce5be2609b) E:\WINDOWS\system32\drivers\Cdfs.sys
2011/07/20 00:02:58.0843 3388 Cdrom (0cc13b7fe6d2f64efc82cebfe9d2b8f0) E:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/07/20 00:02:59.0031 3388 Disk (db7ba51015765db476457bedd53d3cfe) E:\WINDOWS\system32\DRIVERS\disk.sys
2011/07/20 00:02:59.0078 3388 dmboot (ba1f9637c50d105fb8ebe334d57bc16e) E:\WINDOWS\system32\drivers\dmboot.sys
2011/07/20 00:02:59.0109 3388 dmio (a29d408f65291721091bc21a48ceed00) E:\WINDOWS\system32\drivers\dmio.sys
2011/07/20 00:02:59.0140 3388 dmload (e9317282a63ca4d188c0df5e09c6ac5f) E:\WINDOWS\system32\drivers\dmload.sys
2011/07/20 00:02:59.0187 3388 DMusic (0fdc464e960b5c9665d89fe00bc972a3) E:\WINDOWS\system32\drivers\DMusic.sys
2011/07/20 00:02:59.0234 3388 drmkaud (6d5ca8474cf00a2765b6d6b35a57e89c) E:\WINDOWS\system32\drivers\drmkaud.sys
2011/07/20 00:02:59.0312 3388 Fastfat (bb9c87cc84a747f68c4d0e24d5841e61) E:\WINDOWS\system32\drivers\Fastfat.sys
2011/07/20 00:02:59.0328 3388 Fdc (bafd3cc668a29f5070da63469c273127) E:\WINDOWS\system32\DRIVERS\fdc.sys
2011/07/20 00:02:59.0359 3388 Fips (cd7388a0e1f2585d0300c9533f4de221) E:\WINDOWS\system32\drivers\Fips.sys
2011/07/20 00:02:59.0375 3388 Flpydisk (50cd9634d0d4e6c9c6e2e8ea27f8e2f6) E:\WINDOWS\system32\DRIVERS\flpydisk.sys
2011/07/20 00:02:59.0421 3388 FltMgr (d1338fb4160e250ae8a9202f8ac3860f) E:\WINDOWS\system32\DRIVERS\fltMgr.sys
2011/07/20 00:02:59.0468 3388 FsVga (455f778ee14368468560bd7cb8c854d0) E:\WINDOWS\system32\DRIVERS\fsvga.sys
2011/07/20 00:02:59.0515 3388 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) E:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/07/20 00:02:59.0531 3388 Ftdisk (6ac26732762483366c3969c9e4d2259d) E:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/07/20 00:02:59.0578 3388 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) E:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
2011/07/20 00:02:59.0609 3388 Gpc (8c7faa02a68d9eef68287a2842bb4f71) E:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/07/20 00:02:59.0687 3388 HDAudBus (573c7d0a32852b48f3058cfd8026f511) E:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/07/20 00:02:59.0734 3388 HidUsb (81d2ffea0965a205f257160f1328f18e) E:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/07/20 00:02:59.0828 3388 HTTP (f80a415ef82cd06ffaf0d971528ead38) E:\WINDOWS\system32\Drivers\HTTP.sys
2011/07/20 00:02:59.0906 3388 i8042prt (f641d64e8fd069d91e60511bb5cf4a2d) E:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/07/20 00:02:59.0953 3388 Imapi (df47d4e6ed89cd0ad7248a7604af706e) E:\WINDOWS\system32\DRIVERS\imapi.sys
2011/07/20 00:03:00.0171 3388 IntcAzAudAddService (e8656858d8b2da7c9cf59fb4e5ce32ed) E:\WINDOWS\system32\drivers\RtkHDAud.sys
2011/07/20 00:03:00.0265 3388 Ip6Fw (0f2a14149b767cd62559a4e060d63e0a) E:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2011/07/20 00:03:00.0296 3388 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) E:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/07/20 00:03:00.0312 3388 IpInIp (f6e4f5f17ead48851b2ca24faf595693) E:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/07/20 00:03:00.0359 3388 IpNat (04191cc82eda72c44f9c154bc094ea0d) E:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/07/20 00:03:00.0375 3388 IPSec (84f6866f355c4c2185eb68206d55c591) E:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/07/20 00:03:00.0421 3388 IRENUM (ca98b430387b7d73d9b52eb4e0ab9d92) E:\WINDOWS\system32\DRIVERS\irenum.sys
2011/07/20 00:03:00.0468 3388 isapnp (5a59964bfb9dca86af0c4ae8cc1d6a32) E:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/07/20 00:03:00.0500 3388 Kbdclass (4780a418e0fa859b09311c87980d0f7e) E:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/07/20 00:03:00.0546 3388 kmixer (e30be31b27e6fd0c3ab65e87f794e5df) E:\WINDOWS\system32\drivers\kmixer.sys
2011/07/20 00:03:00.0578 3388 KSecDD (b467646c54cc746128904e1654c750c1) E:\WINDOWS\system32\drivers\KSecDD.sys
2011/07/20 00:03:00.0671 3388 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) E:\WINDOWS\system32\drivers\mnmdd.sys
2011/07/20 00:03:00.0718 3388 Modem (8c0f9f5a284b1db052c31ed629c2a5c3) E:\WINDOWS\system32\drivers\Modem.sys
2011/07/20 00:03:00.0812 3388 Monfilt (9fa7207d1b1adead88ae8eed9cdbbaa5) E:\WINDOWS\system32\drivers\Monfilt.sys
2011/07/20 00:03:00.0890 3388 Mouclass (06515a5d8482b44e55bab35981888a0e) E:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/07/20 00:03:00.0921 3388 mouhid (b1c303e17fb9d46e87a98e4ba6769685) E:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/07/20 00:03:00.0968 3388 MountMgr (8b64fa7814ed005e57d43155de88398a) E:\WINDOWS\system32\drivers\MountMgr.sys
2011/07/20 00:03:01.0000 3388 MRxDAV (53cb9e3b300f4ea15d5b2679b102d09f) E:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/07/20 00:03:01.0062 3388 MRxSmb (421f7b922cec5a5f340e7574a98f7b7c) E:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/07/20 00:03:01.0109 3388 Msfs (79e4458da04664b431e6728a18199300) E:\WINDOWS\system32\drivers\Msfs.sys
2011/07/20 00:03:01.0156 3388 MSKSSRV (241e77138dee16d546080a794b80284b) E:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/07/20 00:03:01.0187 3388 MSPCLOCK (f46de5b07ea15e0727f12eb12e710f71) E:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/07/20 00:03:01.0203 3388 MSPQM (c53927217ac0834dc547b396ffc495d9) E:\WINDOWS\system32\drivers\MSPQM.sys
2011/07/20 00:03:01.0250 3388 mssmbios (146e70915c378f02476a10bcec3a95c2) E:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/07/20 00:03:01.0281 3388 MSTEE (63f6b38ed547e3a9d0f7c06ed911fec1) E:\WINDOWS\system32\drivers\MSTEE.sys
2011/07/20 00:03:01.0328 3388 Mup (254717fc83220bdc790f6c2e57c620bf) E:\WINDOWS\system32\drivers\Mup.sys
2011/07/20 00:03:01.0359 3388 NABTSFEC (5d973966a07d5282bd783256a21bfc25) E:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2011/07/20 00:03:01.0406 3388 NDIS (aff1aed224d17c8bc38174ed932f68b6) E:\WINDOWS\system32\drivers\NDIS.sys
2011/07/20 00:03:01.0453 3388 NdisIP (0ee9498525d120386935cf53452da6ab) E:\WINDOWS\system32\DRIVERS\NdisIP.sys
2011/07/20 00:03:01.0484 3388 NdisTapi (eaeecd0001f1d43bb3e81b77e8b8483e) E:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/07/20 00:03:01.0500 3388 Ndisuio (077c330d7e12669d57ed16e4dfabf700) E:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/07/20 00:03:01.0531 3388 NdisWan (36a503c26f7c81fe7ce71b0b467605dd) E:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/07/20 00:03:01.0546 3388 NDProxy (21769bbeb1b70ddad968002390100b3a) E:\WINDOWS\system32\drivers\NDProxy.sys
2011/07/20 00:03:01.0578 3388 NetBIOS (4977fd4bad4b94188e7b101df0e017ef) E:\WINDOWS\system32\DRIVERS\netbios.sys
2011/07/20 00:03:01.0609 3388 NetBT (3294dc900631ee18c86f49e7c26e416b) E:\WINDOWS\system32\DRIVERS\netbt.sys
2011/07/20 00:03:01.0671 3388 Npfs (bff3844722d795df4c5066aaae957ec8) E:\WINDOWS\system32\drivers\Npfs.sys
2011/07/20 00:03:01.0703 3388 Ntfs (d7f8a3f743c54c13d78954176ad483a2) E:\WINDOWS\system32\drivers\Ntfs.sys
2011/07/20 00:03:01.0765 3388 Null (73c1e1f395918bc2c6dd67af7591a3ad) E:\WINDOWS\system32\drivers\Null.sys
2011/07/20 00:03:01.0921 3388 nv (5645072033c2e51386e91bc137c0beb5) E:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2011/07/20 00:03:02.0062 3388 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) E:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/07/20 00:03:02.0078 3388 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) E:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/07/20 00:03:02.0125 3388 Parport (9f84cffa068c474084a99bc68bf3ea63) E:\WINDOWS\system32\DRIVERS\parport.sys
2011/07/20 00:03:02.0140 3388 PartMgr (64fc948a8387d3a5fba3cdeb539b1514) E:\WINDOWS\system32\drivers\PartMgr.sys
2011/07/20 00:03:02.0171 3388 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) E:\WINDOWS\system32\drivers\ParVdm.sys
2011/07/20 00:03:02.0203 3388 PCI (ef6876118575c85ca4ad39ac6490656c) E:\WINDOWS\system32\DRIVERS\pci.sys
2011/07/20 00:03:02.0250 3388 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) E:\WINDOWS\system32\DRIVERS\pciide.sys
2011/07/20 00:03:02.0296 3388 Pcmcia (c1bc00b2c7a782cf5207f1a13745ab65) E:\WINDOWS\system32\drivers\Pcmcia.sys
2011/07/20 00:03:02.0328 3388 PCTAppEvent (cc174f32cc9c18ea3109c4b0fc2ca8df) E:\WINDOWS\system32\drivers\PCTAppEvent.sys
2011/07/20 00:03:02.0359 3388 PCTFW-PacketFilter (4a7ef973fcd9c6cad6040ebb61262a5c) E:\WINDOWS\system32\drivers\pctNdis-PacketFilter.sys
2011/07/20 00:03:02.0406 3388 pctgntdi (39e8623f9f29dbc9e053a696d85f8ac6) E:\WINDOWS\system32\drivers\pctgntdi.sys
2011/07/20 00:03:02.0437 3388 pctNDIS (8bbe917bc4da64b0ba8db33d4c0e0b7d) E:\WINDOWS\system32\DRIVERS\pctNdis.sys
2011/07/20 00:03:02.0484 3388 pctplfw (6d74df36716a458619a62dd764fc4f8b) E:\WINDOWS\system32\drivers\pctplfw.sys
2011/07/20 00:03:02.0671 3388 PptpMiniport (7065eaef0b12cc5339425d575e5a71d3) E:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/07/20 00:03:02.0703 3388 PSched (7c8c04b524b0823a29ee6b0818ecbbb3) E:\WINDOWS\system32\DRIVERS\psched.sys
2011/07/20 00:03:02.0734 3388 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) E:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/07/20 00:03:02.0765 3388 PxHelp20 (49452bfcec22f36a7a9b9c2181bc3042) E:\WINDOWS\system32\Drivers\PxHelp20.sys
2011/07/20 00:03:02.0906 3388 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) E:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/07/20 00:03:02.0968 3388 Rasl2tp (1d0743f4b97fd729511ad5022e0bcbc1) E:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/07/20 00:03:02.0984 3388 RasPppoe (04a17ced474f4444d6eff7a1ba169a2e) E:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/07/20 00:03:03.0015 3388 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) E:\WINDOWS\system32\DRIVERS\raspti.sys
2011/07/20 00:03:03.0062 3388 Rdbss (d2fd6bd47a5ad252745c96b61b55d7be) E:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/07/20 00:03:03.0078 3388 RDPCDD (4912d5b403614ce99c28420f75353332) E:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/07/20 00:03:03.0140 3388 rdpdr (00f5b19217f0ea9a513789dd8214c79b) E:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/07/20 00:03:03.0187 3388 RDPWD (e92dd0b4ab8d73f72fef85282f8dd2e2) E:\WINDOWS\system32\drivers\RDPWD.sys
2011/07/20 00:03:03.0234 3388 redbook (bf1bfdad19fd920cc0856886ce91b208) E:\WINDOWS\system32\DRIVERS\redbook.sys
2011/07/20 00:03:03.0312 3388 RTLE8023xp (25be98c05808c57e4d8d26477dc12d39) E:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
2011/07/20 00:03:03.0406 3388 SASDIFSV (a3281aec37e0720a2bc28034c2df2a56) E:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
2011/07/20 00:03:03.0437 3388 SASKUTIL (61db0d0756a99506207fd724e3692b25) E:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
2011/07/20 00:03:03.0593 3388 Secdrv (90a3935d05b494a5a39d37e71f09a677) E:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/07/20 00:03:03.0640 3388 serenum (19f5a2b382c281ea02525566e8fe6980) E:\WINDOWS\system32\DRIVERS\serenum.sys
2011/07/20 00:03:03.0656 3388 Serial (3dae0c3747f4065d18617ca36f63f104) E:\WINDOWS\system32\DRIVERS\serial.sys
2011/07/20 00:03:03.0703 3388 Sfloppy (0e0d508c42ed31e0ce4877bcbd1dac7e) E:\WINDOWS\system32\drivers\Sfloppy.sys
2011/07/20 00:03:03.0765 3388 SLIP (c42785be4713d0131cbb31956b08e4d0) E:\WINDOWS\system32\DRIVERS\SLIP.sys
2011/07/20 00:03:04.0093 3388 SNP325 (c397234c360d9c5e0396f0fac69d1bad) E:\WINDOWS\system32\DRIVERS\snp325.sys
2011/07/20 00:03:04.0390 3388 splitter (d15d4f064889adae4ef9a44797361a95) E:\WINDOWS\system32\drivers\splitter.sys
2011/07/20 00:03:04.0453 3388 sr (b0a078e4f5c4b11ddca9fe48e860687f) E:\WINDOWS\system32\DRIVERS\sr.sys
2011/07/20 00:03:04.0484 3388 Srv (89220b427890aa1dffd1a02648ae51c3) E:\WINDOWS\system32\DRIVERS\srv.sys
2011/07/20 00:03:04.0531 3388 streamip (a0923063cdc2b5ab75116dc35b22f5eb) E:\WINDOWS\system32\DRIVERS\StreamIP.sys
2011/07/20 00:03:04.0562 3388 swenum (52ca69522d2780008679f486ff2d16a9) E:\WINDOWS\system32\DRIVERS\swenum.sys
2011/07/20 00:03:04.0609 3388 swmidi (d9f7f799db20ce348d2c7f374aae5133) E:\WINDOWS\system32\drivers\swmidi.sys
2011/07/20 00:03:04.0718 3388 sysaudio (ac17b7e3da6fc911466962bbe1596239) E:\WINDOWS\system32\drivers\sysaudio.sys
2011/07/20 00:03:04.0765 3388 Tcpip (4afb3b0919649f95c1964aa1fad27d73) E:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/07/20 00:03:04.0812 3388 Tcpip6 (fb9f32acc1d3ad523f7ec900b66fc1bb) E:\WINDOWS\system32\DRIVERS\tcpip6.sys
2011/07/20 00:03:04.0843 3388 TDPIPE (acbb991ba7710ca13e3f7c581365eec0) E:\WINDOWS\system32\drivers\TDPIPE.sys
2011/07/20 00:03:04.0875 3388 TDTCP (b4b829f1accaa80686a9f9264f2050d0) E:\WINDOWS\system32\drivers\TDTCP.sys
2011/07/20 00:03:04.0906 3388 TermDD (9357984830dc4f40c3c82489b56ec95b) E:\WINDOWS\system32\DRIVERS\termdd.sys
2011/07/20 00:03:05.0000 3388 tunmp (7dfeb4edcd8635eb74f5a08bd67c00bb) E:\WINDOWS\system32\DRIVERS\tunmp.sys
2011/07/20 00:03:05.0031 3388 Udfs (007c5857eca3624845005d800986e400) E:\WINDOWS\system32\drivers\Udfs.sys
2011/07/20 00:03:05.0093 3388 Update (4b633414b8231060c8ceac4575fcb00e) E:\WINDOWS\system32\DRIVERS\update.sys
2011/07/20 00:03:05.0140 3388 usbccgp (7d9ac2328255cb506a9b74fdf2977ce1) E:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/07/20 00:03:05.0156 3388 usbehci (8e9d9764dd8030160fc42e183001113d) E:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/07/20 00:03:05.0187 3388 usbhub (32889e8b3bb890d5dbcdf866598a2b45) E:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/07/20 00:03:05.0203 3388 usbohci (4a5f04ade6c2ce8eb1fe966b498b47cd) E:\WINDOWS\system32\DRIVERS\usbohci.sys
2011/07/20 00:03:05.0265 3388 usbprint (0c92e95006b083ba25c0e805e6e7b1d6) E:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/07/20 00:03:05.0296 3388 usbscan (bd381322d0db6d18f42c0df992e8a7cb) E:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/07/20 00:03:05.0328 3388 USBSTOR (4c11e52f58b8f691099f9c1b0432a6a6) E:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/07/20 00:03:05.0359 3388 VgaSave (27573609ed1a48065a7174fa6b7f36e5) E:\WINDOWS\System32\drivers\vga.sys
2011/07/20 00:03:05.0437 3388 VolSnap (999a7ab63b8f364f4df130d48ba7e972) E:\WINDOWS\system32\drivers\VolSnap.sys
2011/07/20 00:03:05.0484 3388 Wanarp (4d91cdfecb032a34c550080b62720e15) E:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/07/20 00:03:05.0562 3388 wdmaud (971260ff2bdf0371c11e811fa9c64bd8) E:\WINDOWS\system32\drivers\wdmaud.sys
2011/07/20 00:03:05.0656 3388 WSTCODEC (3d53ff6387d51c62ef628973455fcda6) E:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2011/07/20 00:03:05.0703 3388 WudfPf (f15feafffbb3644ccc80c5da584e6311) E:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/07/20 00:03:05.0718 3388 WudfRd (28b524262bce6de1f7ef9f510ba3985b) E:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/07/20 00:03:05.0796 3388 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
2011/07/20 00:03:05.0890 3388 Boot (0x1200) (d4b4fb2ec2eef19e466ad5c4916e1caf) \Device\Harddisk0\DR0\Partition0
2011/07/20 00:03:05.0921 3388 Boot (0x1200) (fcb4b33b0b50adaacbaab673eeecafd5) \Device\Harddisk0\DR0\Partition1
2011/07/20 00:03:05.0953 3388 Boot (0x1200) (52d0375fefa6b3a58176a6c96de9deaf) \Device\Harddisk0\DR0\Partition2
2011/07/20 00:03:05.0953 3388 ================================================================================
2011/07/20 00:03:05.0953 3388 Scan finished
2011/07/20 00:03:05.0953 3388 ================================================================================
2011/07/20 00:03:05.0968 3024 Detected object count: 0
2011/07/20 00:03:05.0968 3024 Actual detected object count: 0


ComboFix:

ComboFix 11-07-19.04 - Administrator 0/2011 Wed 0:11.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.936.86.1033.18.2046.1377 [GMT 1:00]
执行位置: e:\documents and settings\Administrator\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: PC Tools Firewall Plus *Disabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}
.
.
((((((((((((((((((((((((((((((((((((((( 被删除的档案 )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
e:\documents and settings\Administrator\Application Data\Microsoft\Internet Explorer\Desktop.htt
.
.
((((((((((((((((((((((((( 2011-06-19 至 2011-07-19 的新的档案 )))))))))))))))))))))))))))))))
.
.
2011-07-19 00:34 . 2011-07-19 00:34 ——– d—–w- E:\_OTL
2011-07-15 23:40 . 2011-07-16 03:27 ——– d—–w- E:\desktop
2011-07-15 01:16 . 2011-07-15 01:16 404640 —-a-w- e:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-02 12:45 . 2011-07-02 12:45 ——– d—–w- e:\program files\Trend Micro
2011-07-01 20:16 . 2011-07-02 10:56 ——– d—–w- e:\documents and settings\All Users\Application Data\boost_interprocess
2011-07-01 17:15 . 2011-07-01 17:15 ——– d—–w- e:\documents and settings\Administrator\Local Settings\Application Data\PackageAware
2011-06-25 17:43 . 2011-07-04 11:36 441176 —-a-w- e:\windows\system32\drivers\aswSnx.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( 在三个月内被修改的档案 ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-06 18:52 . 2010-08-25 15:57 41272 —-a-w- e:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 18:52 . 2010-08-25 15:57 22712 —-a-w- e:\windows\system32\drivers\mbam.sys
2011-07-04 11:43 . 2010-09-08 22:16 40112 —-a-w- e:\windows\avastSS.scr
2011-07-04 11:43 . 2010-09-08 22:16 199304 —-a-w- e:\windows\system32\aswBoot.exe
2011-07-04 11:36 . 2010-09-08 22:16 309848 —-a-w- e:\windows\system32\drivers\aswSP.sys
2011-07-04 11:35 . 2010-09-08 22:16 43608 —-a-w- e:\windows\system32\drivers\aswTdi.sys
2011-07-04 11:35 . 2010-09-08 22:16 102616 —-a-w- e:\windows\system32\drivers\aswmon2.sys
2011-07-04 11:35 . 2010-09-08 22:16 96344 —-a-w- e:\windows\system32\drivers\aswmon.sys
2011-07-04 11:32 . 2010-09-08 22:16 25432 —-a-w- e:\windows\system32\drivers\aswRdr.sys
2011-07-04 11:32 . 2010-09-08 22:16 30808 —-a-w- e:\windows\system32\drivers\aavmker4.sys
2011-07-04 11:32 . 2010-09-08 22:16 19544 —-a-w- e:\windows\system32\drivers\aswFsBlk.sys
.
.
——- Sigcheck ——-
Note: Unsigned files aren't necessarily malware.
.
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . e:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . e:\windows\ERDNT\cache\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . e:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 . 4AFB3B0919649F95C1964AA1FAD27D73 . 361600 . . [5.1.2600.5625] . . e:\windows\system32\drivers\tcpip.sys
[-] 2008-05-03 . 37D8387CBD4437C55F454209BE10EF11 . 361344 . . [5.1.2600.5508] . . e:\windows\$NtUninstallKB951748$\tcpip.sys
[-] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . e:\windows\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\tcpip.sys
.
((((((((((((((((((((((((((((( SnapShot@2011-07-18_00.07.08 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-07-19 22:51 . 2011-07-19 22:51 16384 e:\windows\temp\Perflib_Perfdata_c38.dat
+ 2011-07-19 00:38 . 2011-07-19 00:38 360448 e:\windows\ERDNT\AutoBackup\7-19-2011\Users\00000002\UsrClass.dat
+ 2011-07-19 00:38 . 2005-10-20 11:02 163328 e:\windows\ERDNT\AutoBackup\7-19-2011\ERDNT.EXE
+ 2011-07-19 00:38 . 2011-07-19 00:38 9707520 e:\windows\ERDNT\AutoBackup\7-19-2011\Users\00000001\NTUSER.DAT
+ 2011-06-08 04:39 . 2011-06-08 04:39 19798016 e:\windows\Installer\2c599.msp
+ 2011-01-31 10:45 . 2011-01-31 10:45 11135488 e:\windows\Installer\2c598.msp
.
((((((((((((((((((((((((((((((((((((( 重要登入点 ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*注意* 空白与合法缺省登录将不会被显示
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 122512 —-a-w- e:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="e:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-05-09 39408]
"BitTorrent DNA"="e:\program files\DNA\btdna.exe" [2009-11-06 323392]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="e:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 153136]
"PPS Accelerator"="e:\program files\PPStream\ppsap.exe" [2010-02-24 214408]
"SUPERAntiSpyware"="e:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-07-01 2424192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="e:\windows\system32\NvCpl.dll" [2006-08-11 7630848]
"nwiz"="nwiz.exe" [2006-08-11 1519616]
"IMJPMIG8.1"="e:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-05-03 208952]
"MSPY2002"="e:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-05-03 59392]
"PHIME2002ASync"="e:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-05-03 455168]
"PHIME2002A"="e:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-05-03 455168]
"tsnp325"="e:\windows\tsnp325.exe" [2007-04-21 270336]
"snp325"="e:\windows\vsnp325.exe" [2007-05-09 835584]
"00PCTFW"="e:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2010-01-12 3168216]
"tsnp2std"="e:\windows\tsnp2std.exe" [2006-12-05 262144]
"NvMediaCenter"="e:\windows\system32\NvMcTray.dll" [2006-08-11 86016]
"RTHDCPL"="RTHDCPL.EXE" [2009-08-14 18702336]
"Adobe ARM"="e:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"iTunesHelper"="d:\program files\iTunesHelper.exe" [2011-01-25 421160]
"SunJavaUpdateSched"="e:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"QuickTime Task"="D:\QTTask.exe" [2010-11-29 421888]
.
e:\documents and settings\Administrator\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - e:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
.
e:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - d:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 1 (0x1)
"StartMenuFavorites"= 0 (0x0)
"Start_ShowMyComputer"= 1 (0x1)
"Start_ShowMyDocs"= 1 (0x1)
"Start_ShowMyMusic"= 0 (0x0)
"Start_ShowRun"= 1 (0x1)
"Start_ShowSearch"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "e:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 —-a-w- e:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\keyboard layouts\e0220804]
Ime File REG_SZ GOOGLEPINYIN2.IME
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"YodaoDict"="d:\deskdict2\RunDict.exe" -hide
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"FixCamera"=e:\windows\FixCamera.exe
"iTunesHelper"="d:\program files\iTunesHelper.exe"
"Google Pinyin 2 Autoupdater"="e:\program files\Google\Google Pinyin 2\GooglePinyinDaemon.exe"
"NeroFilterCheck"=e:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"e:\\Program Files\\DNA\\btdna.exe"=
"e:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\english\\setup.exe"=
"e:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"e:\\Program Files\\Skype\\Phone\\Skype.exe"=
"e:\\Program Files\\PPStream\\PPStream.exe"=
"e:\\Program Files\\PPStream\\PPSAP.exe"=
"e:\\Program Files\\PPSGame\\PPSGame.exe"=
"e:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\Program files\\iTunes.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R1 aswSnx;aswSnx;e:\windows\system32\drivers\aswSnx.sys [6/25/2011 6:43 PM 441176]
R1 aswSP;aswSP;e:\windows\system32\drivers\aswSP.sys [9/8/2010 11:16 PM 309848]
R1 pctgntdi;pctgntdi;e:\windows\system32\drivers\pctgntdi.sys [3/2/2010 5:13 PM 233136]
R1 SASDIFSV;SASDIFSV;e:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 7:25 PM 12872]
R1 SASKUTIL;SASKUTIL;e:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 7:41 PM 67656]
R2 aswFsBlk;aswFsBlk;e:\windows\system32\drivers\aswFsBlk.sys [9/8/2010 11:16 PM 19544]
R2 PCTAppEvent;PCTAppEvent Driver;e:\windows\system32\drivers\PCTAppEvent.sys [3/2/2010 5:13 PM 88040]
R3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;e:\windows\system32\drivers\pctNdis-PacketFilter.sys [3/2/2010 5:12 PM 70664]
R3 pctNDIS;PC Tools Driver;e:\windows\system32\drivers\pctNdis.sys [3/2/2010 5:12 PM 58816]
R3 pctplfw;pctplfw;e:\windows\system32\drivers\pctplfw.sys [3/2/2010 5:12 PM 115216]
S0 qdda;qdda;e:\windows\system32\drivers\ualn.sys –> e:\windows\system32\drivers\ualn.sys [?]
S0 smfgt;smfgt;e:\windows\system32\drivers\loqem.sys –> e:\windows\system32\drivers\loqem.sys [?]
S2 gupdate1ca3fbff137535e;Google Update Service (gupdate1ca3fbff137535e);e:\program files\Google\Update\GoogleUpdate.exe [9/27/2009 11:14 PM 133104]
S3 Ambfilt;Ambfilt;e:\windows\system32\drivers\Ambfilt.sys [10/5/2010 3:25 PM 1684736]
S3 SNP325;USB PC Camera (SNPSTD325);e:\windows\system32\drivers\snp325.sys [3/3/2009 7:47 PM 10343168]
S3 ViaUsbEtsDriver;Nokia 1506 USB Device Driver;e:\windows\system32\drivers\ViaUsbEts.sys –> e:\windows\system32\drivers\ViaUsbEts.sys [?]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - 98163884
*Deregistered* - 98163884
.
‘计划任务’ 文件夹 里的内容
.
2011-07-16 e:\windows\Tasks\AppleSoftwareUpdate.job
- e:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
2011-07-19 e:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- e:\program files\Google\Update\GoogleUpdate.exe [2009-09-27 22:14]
.
2011-07-19 e:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- e:\program files\Google\Update\GoogleUpdate.exe [2009-09-27 22:14]
.
.
——- 而外的扫描 ——-
.
uStart Page = hxxp://www.google.co.uk/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: ????(&Y)
IE: Add to Google Photos Screensa&ver - e:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~1\Office10\EXCEL.EXE/3000
IE: Google Sidewiki… - e:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_43C348BC2E93EB2B.dll/cmsidewiki.html
IE: 使用迅雷下载 - e:\docume~1\ADMINI~1\LOCALS~1\Temp\Rar$EX18.516\Thunder\Program\geturl.htm
IE: 使用迅雷下载全部链接 - e:\docume~1\ADMINI~1\LOCALS~1\Temp\Rar$EX18.516\Thunder\Program\getallurl.htm
IE: 有道搜索(&Y) - d:\toolbar\ydtbv2.2\YodaoToolbar.dll/158.htm
Trusted Zone: pps.tv
Trusted Zone: ppstream.com
Trusted Zone: webscache.com
TCP: Interfaces\{99BC8365-CA5D-4372-B626-E3D75C8E53DC}: NameServer = 202.103.24.68 202.103.44.150
FF - ProfilePath - e:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\r0w7w5f6.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - e:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Ext: avast! WebRep: [removed] - e:\program files\Alwil Software\Avast5\WebRep\FF
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-{8D15E1B2-D2B7-4A17-B44B-D2DDE5981406} - e:\documents and settings\All Users\Application Data\{C1D18E30-468F-478F-8837-B6CBA25F6547}\iLividSetupV1.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-20 00:18
Windows 5.1.2600 Service Pack 3 NTFS
.
扫描被隐藏的进程 。。。
.
扫描被隐藏的启动组 。。。
.
扫描被隐藏的文件 。。。
.
扫描完成
被隐藏的档案: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-1275210071-1645522239-725345543-500\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (Administrator)
"{99079A25-328F-4BD4-BE04-00955ACAA0A7}"=hex:51,66,7a,6c,4c,1d,3b,1b,35,85,17,
87,bd,63,ba,06,a2,08,43,d5,5b,8f,e1,be
"{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}"=hex:51,66,7a,6c,4c,1d,3b,1b,d5,d9,1d,
ba,e2,28,c6,01,bd,89,cc,b9,88,ea,50,0c
.
[HKEY_USERS\S-1-5-21-1275210071-1645522239-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ea,83,66,8e,97,4c,99,4c,b9,37,fa,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,6c,94,48,1e,56,81,53,4d,a3,04,a7,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ea,83,66,8e,97,4c,99,4c,b9,37,fa,\
.
[HKEY_USERS\S-1-5-21-1275210071-1645522239-725345543-500\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F58D41D6-2C87-FDA2-A848-31A6860F7C39}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— 运行进程下的动态链接库 ———————
.
- - - - - - - > 'winlogon.exe'(1116)
e:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
完成时间: 2011-07-20 00:22:45
ComboFix-quarantined-files.txt 2011-07-19 23:22
ComboFix2.txt 2011-07-18 00:15
.
Pre-Run: 85,479,215,104 bytes free
Post-Run: 85,462,130,688 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CHS.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(3)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(3)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 64E9874B912C34E91A691CF04BE8F762