Virus - XP Internet Security 2012 [Solved]

I have the virus called "XP Internet Security 2012". I have logged into the net via another machine in order to learn about this. I understand that it goes by many different names. Learning from another site, I have fired up this machine via "Safe Mode with Networking". I have changed:
> Tools
> Network
> Settings
Set "No Proxy"

After this, I am able to get onto the internet.

Next, I ran "FixNCR.reg"
http://www.bleepingcomputer.com/download/anti-virus/rkill

Next, I ran "rkill.com"
http://www.bleepingcomputer.com/download/anti-virus/rkill

Here is the resultant log file:
= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =
This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 01/12/2012 at 17:54:23.
Operating System: Microsoft Windows XP

Processes terminated by Rkill or while it was running:

Rkill completed on 01/12/2012 at 17:54:27.
= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

I have read the Whatthetech page:
http://forums.whatthetech.com/index.php?showtopic=106388

I understand that any of the above executables are not recommended to be run w/o assistance.

My OS is XP

Currently, I am able to log into the internet via "Safe Mode with Networking". I am currently logged on using the infected machine.
On my machine, I am able to use not of these:
Windows Explorer
video applications
games
virtually no files can I run.

Also, I have no USB ports available, as they have shorted out due to an unrelated problem.

Here is my Hijack This:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 6:01:58 PM, on 1/12/2012
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Peter\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/def…/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/def…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/?.intl=us
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/def…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: EpicPlay Games - {56E4076B-A42B-4745-BA35-34DA8AC4C2F2} - C:\Program Files\EpicPlay\epicPlayGames.dll (file missing)
O2 - BHO: Freecause Shopping BHO - {8C423C72-F06E-43B3-A3E8-A435FFF9E9E0} - C:\Program Files\Shop to Win 14\Shop to Win 14.dll (file missing)
O2 - BHO: BHO Project - {de4e75d3-60aa-4f02-a0e4-c8a40576574c} - (no file)
O3 - Toolbar: Search Toolbar - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll
O3 - Toolbar: FVD Suite Toolbar - {2B171655-A69C-5c18-B693-6CB5DC269D41} - C:\Program Files\FVD Suite\addons\IE\FVDToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KONICA MINOLTA magicolor 2400W STD] C:\WINDOWS\system32\MSTMON_S.EXE STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CommonToolkitTray] C:\Program Files\Fighters\Tray\FightersTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netwaiting.exe
O4 - HKCU\..\Run: [Shop To Win] C:\Program Files\Shop To Win\ShopToWin.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O8 - Extra context menu item: &WordWeb… - res://C:\WINDOWS\wweb32.dll/lookup.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Search Using Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.dll/INTEGRATION_MENU_SEARCHEXT
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra 'Tools' menuitem: Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Companion\Modules\messmod2\v4\yhexbmes.dll (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Companion\Modules\messmod2\v4\yhexbmes.dll (file missing)
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Open FVD Suite Toolbar - {2B171655-A69C-5c18-B693-6CB5DC269D43} - C:\Program Files\FVD Suite\addons\IE\FVDToolbar.dll (HKCU)
O9 - Extra 'Tools' menuitem: Open FVD Suite Toolbar - {2B171655-A69C-5c18-B693-6CB5DC269D43} - C:\Program Files\FVD Suite\addons\IE\FVDToolbar.dll (HKCU)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CDT/ie/bridge-c15.cab
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

–
End of file - 7543 bytes

Answering Q:

Re: "What happens when you try to boot to normal windows?"
The virus runs & displays all of its "warning" boxes. If I try to run any browser [FF, IE, Avant, or Opera], a warning box appears & will not allow me to get on the internet.
Also, as I posted, I cannot run any executables [i.e. Games, videos, windows explorer, etc]. If I attempt any of these, I recieve a warning box instead.

Re: "Please do not uninstall/install any programs . . . . . . absence of symptoms does not mean a clean machine."
I understand :-)

Re: "Any particular reason for not being on SP3?"
There is a long history to this machine, heading for a slow death. In a nutshell, this hard drive is the original Hard drive, 60Gb. I had upgraded to a 100Gb Hd & run with that for several years, while this Hd lay unused [i.e. & consequently, OS not maintained]. Then the 100Gb Hd bit the dust. Currently, the 100Gb Hd has been completely reformatted, yet I have no idea how to get it to gain access to the internet. I dragged this one out of the drawer [out of mothballs] & fired up my machine with it about 2 mos ago. [ergo: not recent updates]

Re: "Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted . . . . "

Done

Re: Double click the aswMBR.exe to run it. Click the "Scan" button to start scan"

Done

I attempted to maintain FF in order not to lose my connection with this forum. However,
During this process running aswMBR.exe, I experienced several FF crashes. This may have been due to the aswMBR scan
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Mozilla Crash Reporter
We're Sorry
Firefox had a problem and crashed. We'll try to restore your tabs and windows when it restarts.
To help us diagnose and fix the problem, you can send us a crash report.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

I understand that restarting my machine, will also restart this virus .
Therefore, I will not shut my machine down until it is safe to do so. Please advise.


Three Logs to follow & marked as:
OTL.txt
Extras.txt
aswMBR.txt
===============================================================================
===============================================================================
OTL.txt
OTL logfile created on: 1/12/2012 9:06:42 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Peter\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.48 Mb Total Physical Memory | 60.31 Mb Available Physical Memory | 11.79% Memory free
1.22 Gb Paging File | 0.77 Gb Available in Paging File | 63.08% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 57.26 Gb Total Space | 10.11 Gb Free Space | 17.66% Space Free | Partition Type: NTFS
Drive D: | 306.88 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 298.09 Gb Total Space | 66.25 Gb Free Space | 22.23% Space Free | Partition Type: NTFS

Computer Name: PH | User Name: Peter | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Peter\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========

MOD - C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{6414808a-6bbd-4b88-abce-d80baefe9aad}\components\RadioWMPCoreGecko5.dll ()
MOD - C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\[removed]\components\epicPlayGames.dll ()
MOD - C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{9051303c-7e41-4311-a783-d6fe5ef2832d}\components\gecko5\fvd_connector.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - C:\Program Files\SpywareGuard\spywareguard.dll ()
MOD - C:\WINDOWS\system32\tsd32.dll ()


========== Win32 Services (SafeList) ==========

SRV - (MsaSvc) – File not found
SRV - (HidServ) – File not found
SRV - (AppMgmt) – File not found
SRV - (NMSAccess) – C:\Program Files\CDBurnerXP\NMSAccessU.exe ()


========== Driver Services (SafeList) ==========

DRV - (epmntdrv) – C:\WINDOWS\system32\epmntdrv.sys ()
DRV - (EuGdiDrv) – C:\WINDOWS\system32\EuGdiDrv.sys ()
DRV - (StarOpen) – C:\WINDOWS\System32\drivers\StarOpen.sys ()
DRV - (AVG Anti-Rootkit) – C:\WINDOWS\System32\DRIVERS\anti_rkt.sys (GRISOFT, s.r.o.)
DRV - (AVG Clean Driver) – C:\WINDOWS\System32\DRIVERS\cleanDrv.sys (GRISOFT, s.r.o.)
DRV - (BANTExt) – C:\WINDOWS\System32\Drivers\BANTExt.sys ()
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (xmasscsi) – C:\WINDOWS\System32\Drivers\xmasscsi.sys ( )
DRV - (xmasbus) – C:\WINDOWS\System32\DRIVERS\xmasbus.sys ( )
DRV - (MLPTDR_Q) – C:\WINDOWS\system32\MLPTDR_Q.SYS (KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.)
DRV - (nvnforce) Service for NVIDIA® nForce™ – C:\WINDOWS\system32\drivers\nvapu.sys (NVIDIA Corporation)
DRV - (nvax) Service for NVIDIA® nForce™ – C:\WINDOWS\system32\drivers\nvax.sys (NVIDIA Corporation)
DRV - (NVENET) – C:\WINDOWS\system32\drivers\NVENET.sys (NVIDIA Corporation)
DRV - (nvidesm) – C:\WINDOWS\system32\drivers\nvidesm.sys (NVIDIA Corporation)
DRV - (Winachcf) – C:\WINDOWS\system32\drivers\winachcf.sys (Conexant)
DRV - (nv_agp) – C:\WINDOWS\System32\DRIVERS\nv_agp.sys (NVIDIA Corporation)
DRV - (HCF_MSFT) – C:\WINDOWS\system32\drivers\HCF_MSFT.sys (Conexant)
DRV - (ms_mpu401) – C:\WINDOWS\system32\drivers\msmpu401.sys (Microsoft Corporation)
DRV - (GoldrushUSB) – C:\WINDOWS\system32\drivers\goldrush.sys (Agilent Technologies)
DRV - (SetupNT) – C:\WINDOWS\system32\SetupNT.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/def…/search/ie.html
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/def…//www.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/?.intl=us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://mail.yahoo.com/?.intl=us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0: C:\Program Files\DivX\DivX Content Uploader\npUpload.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.1: C:\Program Files\Yahoo!\Shared\npYState.dll ( )
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2027: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2088: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1040: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll ()

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{9051303c-7e41-4311-a783-d6fe5ef2832d}: C:\Program Files\FVD Suite\addons\Firefox [2011/12/01 07:46:56 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla 1.7.8\Extensions\\Components: C:\Program Files\mozilla.org\Mozilla\Components [2008/10/13 19:47:17 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla 1.7.8\Extensions\\Plugins: C:\Program Files\mozilla.org\Mozilla\Plugins [2008/10/13 19:47:17 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/11/13 19:01:23 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/11/13 22:21:38 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{EB132DB0-A4CA-11DF-9732-0E29E0D72085}: C:\Program Files\Object\facetheme
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla 1.7.8\Extensions\\Components: C:\Program Files\mozilla.org\Mozilla\Components [2008/10/13 19:47:17 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla 1.7.8\Extensions\\Plugins: C:\Program Files\mozilla.org\Mozilla\Plugins [2008/10/13 19:47:17 | 000,000,000 | —D | M]

[2011/11/15 18:23:18 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Extensions
[2012/01/09 07:52:29 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions
[2011/11/13 18:55:36 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/12/12 14:43:56 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/01/09 07:52:29 | 000,000,000 | —D | M] (Fvd Suite Community Toolbar) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{6414808a-6bbd-4b88-abce-d80baefe9aad}
[2011/12/29 09:15:13 | 000,000,000 | —D | M] ("FVD Suite Toolbar") – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{9051303c-7e41-4311-a783-d6fe5ef2832d}
[2011/12/25 21:33:04 | 000,000,000 | —D | M] (DownloadHelper) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011/11/15 18:23:18 | 000,000,000 | —D | M] (EpicPlay Games) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\[removed]
[2006/11/06 14:02:48 | 000,000,000 | —D | M] ("VideoDownloader") – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\[removed]
[2011/11/13 22:21:44 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/11/13 22:21:45 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
[2011/11/13 19:01:23 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\distribution\extensions
[2011/11/13 19:01:23 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Program Files\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/06/15 23:17:34 | 000,142,296 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/11/13 22:21:19 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/01/01 03:00:00 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml.old

O1 HOSTS File: ([2004/08/21 22:07:46 | 000,000,848 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SpywareGuardDLBLOCK.CBrowserHelper) - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll ()
O2 - BHO: (EpicPlay Games) - {56E4076B-A42B-4745-BA35-34DA8AC4C2F2} - C:\Program Files\EpicPlay\epicPlayGames.dll File not found
O2 - BHO: (Shop to Win) - {8C423C72-F06E-43B3-A3E8-A435FFF9E9E0} - C:\Program Files\Shop to Win 14\Shop to Win 14.dll File not found
O2 - BHO: (no name) - {de4e75d3-60aa-4f02-a0e4-c8a40576574c} - No CLSID value found.
O3 - HKLM\..\Toolbar: (FVD Suite Toolbar) - {2B171655-A69C-5c18-B693-6CB5DC269D41} - C:\Program Files\FVD Suite\addons\IE\FVDToolbar.dll (www.flashvideodownloader.org/fvd-suite/)
O3 - HKLM\..\Toolbar: (Search Toolbar) - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Copernic Agent) - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll (Copernic Technologies Inc.)
O4 - HKLM..\Run: [CommonToolkitTray] C:\Program Files\Fighters\Tray\FightersTray.exe File not found
O4 - HKLM..\Run: [KONICA MINOLTA magicolor 2400W STD] C:\WINDOWS\System32\MSTMON_S.EXE (KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netwaiting.exe ()
O4 - HKCU..\Run: [Shop To Win] C:\Program Files\Shop To Win\ShopToWin.exe File not found
O4 - HKCU..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe ()
O4 - HKLM..\RunOnceEx: [] File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe ()
O4 - Startup: C:\Documents and Settings\Peter\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O4 - Startup: C:\Documents and Settings\Peter\Start Menu\Programs\Startup\SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe ()
O4 - Startup: C:\Documents and Settings\Peter\Start Menu\Programs\Startup\WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe (Antony Lewis)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O8 - Extra context menu item: &WordWeb… - C:\WINDOWS\wweb32.dll (Antony Lewis)
O8 - Extra context menu item: &Yahoo! Search - C:\Program Files\Yahoo!\Common [2006/09/13 16:27:22 | 000,000,000 | —D | M]
O8 - Extra context menu item: Search Using Copernic Agent - C:\Program Files\Copernic Agent\CopernicAgentExt.dll (Copernic Technologies Inc.)
O8 - Extra context menu item: Yahoo! &Dictionary - C:\Program Files\Yahoo!\Common [2006/09/13 16:27:22 | 000,000,000 | —D | M]
O8 - Extra context menu item: Yahoo! &Maps - C:\Program Files\Yahoo!\Common [2006/09/13 16:27:22 | 000,000,000 | —D | M]
O9 - Extra 'Tools' menuitem : Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\Program Files\Copernic Agent\CopernicAgent.exe (Copernic Technologies Inc.)
O9 - Extra Button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Companion\Modules\messmod2\v4\yhexbmes.dll File not found
O9 - Extra 'Tools' menuitem : Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Companion\Modules\messmod2\v4\yhexbmes.dll File not found
O9 - Extra Button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\Program Files\Copernic Agent\CopernicAgent.exe (Copernic Technologies Inc.)
O9 - Extra Button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll (Apple Computer, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: aol.com ([free] http in Trusted sites)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab (Reg Error: Key error.)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} http://static.windupdates.com/cab/CDT/ie/bridge-c15.cab (Reg Error: Key error.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/get/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} http://support.f-secure.com/ols/fscax.cab (F-Secure Online Scanner)
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_09)
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_10)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {DE22A7AB-A739-4C58-AD52-21F9CD6306B7} http://download.microsoft.com/download/7/E…04/clearadj.cab (CTAdjust Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A67D86CB-7EF9-414A-BC85-AC3EEF166B61}: DhcpNameServer = 192.168.1.1 [removed] [removed]
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\copernicagent {A979B6BD-E40B-4A07-ABDD-A62C64A4EBF6} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll (Copernic Technologies Inc.)
O18 - Protocol\Handler\copernicagentcache {AAC34CFD-274D-4A9D-B0DC-C74C05A67E1D} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll (Copernic Technologies Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Peter\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Peter\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {81559C35-8464-49F7-BB0E-07A383BEF910} - C:\Program Files\SpywareGuard\spywareguard.dll ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/06/26 14:00:20 | 000,000,032 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2000/06/01 03:39:56 | 000,000,524 | R— | M] () - D:\AUTORUN.INF – [ CDFS ]
O33 - MountPoints2\{5a4cfafa-8d83-11d8-91a8-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{5a4cfafa-8d83-11d8-91a8-806d6172696f}\Shell\adobe\command - "" = goodies\ar405eng.exe
O33 - MountPoints2\{5a4cfafa-8d83-11d8-91a8-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{5a4cfafa-8d83-11d8-91a8-806d6172696f}\Shell\AutoRun\command - "" = D:\aocsetup.exe – [2001/07/20 19:29:50 | 000,553,017 | R— | M] (Microsoft Corporation)
O33 - MountPoints2\{5a4cfafa-8d83-11d8-91a8-806d6172696f}\Shell\log\command - "" = D:\goodies\machine\machine.exe – [2000/08/30 17:07:26 | 000,262,144 | R— | M] (Microsoft Corporation)
O33 - MountPoints2\{5a4cfafa-8d83-11d8-91a8-806d6172696f}\Shell\machine\command - "" = D:\GOODIES\MACHINE\MACHINE.EXE – [2000/08/30 17:07:26 | 000,262,144 | R— | M] (Microsoft Corporation)
O33 - MountPoints2\{5a4cfafa-8d83-11d8-91a8-806d6172696f}\Shell\setup\command - "" = D:\aocsetup.exe – [2001/07/20 19:29:50 | 000,553,017 | R— | M] (Microsoft Corporation)
O33 - MountPoints2\{5a4cfafa-8d83-11d8-91a8-806d6172696f}\Shell\zone\command - "" = D:\GOODIES\MSZONE\ZONEA660.EXE – [2000/04/05 17:44:16 | 006,928,087 | R— | M] ()
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Sharedaccess - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: Ip6FwHlp - File not found

CREATERESTOREPOINT
Error creating restore point.

========== Files/Folders - Created Within 30 Days ==========

[2012/01/12 21:07:33 | 004,713,472 | —- | C] (AVAST Software) – C:\Documents and Settings\Peter\Desktop\aswMBR.exe
[2012/01/12 20:48:06 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Peter\Desktop\OTL.exe
[2012/01/12 09:20:49 | 000,271,872 | —- | C] (Корпорация Майкрософт) – C:\Documents and Settings\Peter\Local Settings\Application Data\rmq.exe
[2012/01/08 16:57:57 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Grau Software
[2012/01/08 16:57:54 | 000,000,000 | —D | C] – C:\Program Files\CountDown
[2012/01/08 16:57:31 | 000,299,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\Setup1.exe
[2012/01/08 16:57:28 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\ST6UNST.EXE
[2012/01/07 06:34:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Pazera Free FLV to AVI Converter
[2011/12/23 23:11:04 | 000,000,000 | —D | C] – C:\Documents and Settings\Peter\Desktop\Movies Thought were no good
[2011/12/21 07:30:41 | 000,000,000 | —D | C] – C:\Documents and Settings\Peter\Application Data\WinRAR
[2011/12/21 07:30:40 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\WinRAR
[2011/12/21 07:30:37 | 000,000,000 | —D | C] – C:\Documents and Settings\Peter\Start Menu\Programs\WinRAR
[2011/12/21 07:30:31 | 000,000,000 | —D | C] – C:\Program Files\WinRAR
[2011/12/18 22:52:03 | 000,000,000 | —D | C] – C:\Documents and Settings\Peter\Application Data\vlc
[2011/12/18 22:51:09 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\VideoLAN
[2011/12/18 22:50:44 | 000,000,000 | —D | C] – C:\Program Files\VideoLAN
[2004/09/29 07:01:29 | 000,140,800 | —- | C] ( ) – C:\WINDOWS\System32\drivers\xmasbus.sys
[2004/09/29 07:01:29 | 000,005,248 | —- | C] ( ) – C:\WINDOWS\System32\drivers\xmasscsi.sys
[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/01/12 21:08:02 | 004,713,472 | —- | M] (AVAST Software) – C:\Documents and Settings\Peter\Desktop\aswMBR.exe
[2012/01/12 20:48:06 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Peter\Desktop\OTL.exe
[2012/01/12 18:16:00 | 000,025,600 | —- | M] () – C:\Documents and Settings\Peter\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/01/12 18:01:00 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Peter\Desktop\HijackThis.exe
[2012/01/12 17:56:41 | 001,008,141 | —- | M] () – C:\Documents and Settings\Peter\Desktop\RKill-iExplore.exe
[2012/01/12 17:56:12 | 001,008,141 | —- | M] () – C:\Documents and Settings\Peter\Desktop\Rkill-eXplorer.exe
[2012/01/12 17:51:08 | 001,008,141 | —- | M] () – C:\Documents and Settings\Peter\Desktop\rkill.com
[2012/01/12 17:45:17 | 000,001,205 | —- | M] () – C:\Documents and Settings\Peter\Desktop\FixNCR.reg
[2012/01/12 17:38:24 | 000,001,374 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/01/12 17:37:51 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/01/12 17:30:58 | 000,011,778 | -HS- | M] () – C:\Documents and Settings\Peter\Local Settings\Application Data\y28b2hp613vrq77p76
[2012/01/12 17:30:58 | 000,011,778 | -HS- | M] () – C:\Documents and Settings\All Users\Application Data\y28b2hp613vrq77p76
[2012/01/12 16:30:22 | 010,421,248 | R— | M] () – C:\Documents and Settings\All Users\Documents\ESBK.mbb
[2012/01/12 16:30:22 | 004,206,592 | R— | M] () – C:\Documents and Settings\All Users\Documents\ESBK.mb
[2012/01/12 16:28:57 | 000,019,116 | —- | M] () – C:\WINDOWS\MSTMON_S.INI
[2012/01/12 16:28:52 | 000,003,725 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2012/01/12 16:28:45 | 000,000,384 | —- | M] () – C:\WINDOWS\tasks\SLOW-PCfighter-Peter-Notification.job
[2012/01/12 16:28:45 | 000,000,356 | —- | M] () – C:\WINDOWS\tasks\SLOW-PCfighter-Peter-Startup.job
[2012/01/12 09:31:51 | 000,002,577 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2012/01/12 09:20:49 | 000,271,872 | —- | M] (Корпорация Майкрософт) – C:\Documents and Settings\Peter\Local Settings\Application Data\rmq.exe
[2012/01/11 10:43:18 | 000,000,700 | —- | M] () – C:\Documents and Settings\Peter\Desktop\ADDonTFX.lnk
[2012/01/11 10:00:00 | 000,000,306 | —- | M] () – C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job
[2012/01/08 16:57:31 | 000,299,008 | —- | M] (Microsoft Corporation) – C:\WINDOWS\Setup1.exe
[2012/01/08 16:57:28 | 000,073,216 | —- | M] (Microsoft Corporation) – C:\WINDOWS\ST6UNST.EXE
[2012/01/07 06:34:16 | 000,000,924 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Pazera Free FLV to AVI Converter.lnk
[2011/12/25 16:47:29 | 000,000,435 | —- | M] () – C:\Documents and Settings\Peter\Desktop\FrostWire.lnk
[2011/12/23 23:12:10 | 000,000,388 | —- | M] () – C:\Documents and Settings\Peter\Desktop\Movies.lnk
[2011/12/21 20:54:28 | 000,082,354 | —- | M] () – C:\Documents and Settings\Peter\Desktop\400807_346365918711058_100000129595072_1577023_1135765565_n.jpg
[2011/12/18 22:51:10 | 000,000,719 | —- | M] () – C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/01/12 17:56:41 | 001,008,141 | —- | C] () – C:\Documents and Settings\Peter\Desktop\RKill-iExplore.exe
[2012/01/12 17:56:11 | 001,008,141 | —- | C] () – C:\Documents and Settings\Peter\Desktop\Rkill-eXplorer.exe
[2012/01/12 17:51:08 | 001,008,141 | —- | C] () – C:\Documents and Settings\Peter\Desktop\rkill.com
[2012/01/12 17:45:17 | 000,001,205 | —- | C] () – C:\Documents and Settings\Peter\Desktop\FixNCR.reg
[2012/01/12 09:21:13 | 000,011,778 | -HS- | C] () – C:\Documents and Settings\Peter\Local Settings\Application Data\y28b2hp613vrq77p76
[2012/01/12 09:21:13 | 000,011,778 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\y28b2hp613vrq77p76
[2012/01/11 10:43:17 | 000,000,700 | —- | C] () – C:\Documents and Settings\Peter\Desktop\ADDonTFX.lnk
[2012/01/07 06:34:16 | 000,000,924 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Pazera Free FLV to AVI Converter.lnk
[2011/12/25 16:47:29 | 000,000,435 | —- | C] () – C:\Documents and Settings\Peter\Desktop\FrostWire.lnk
[2011/12/23 23:12:10 | 000,000,388 | —- | C] () – C:\Documents and Settings\Peter\Desktop\Movies.lnk
[2011/12/21 20:55:18 | 000,082,354 | —- | C] () – C:\Documents and Settings\Peter\Desktop\400807_346365918711058_100000129595072_1577023_1135765565_n.jpg
[2011/12/18 22:51:10 | 000,000,719 | —- | C] () – C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2011/11/22 17:17:21 | 000,355,496 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/11/22 14:07:34 | 000,000,275 | —- | C] () – C:\Documents and Settings\Peter\Local Settings\Application Data\HamsterVideoConverterSettings.cfg
[2011/11/16 14:26:57 | 000,044,544 | —- | C] () – C:\WINDOWS\System32\GIF89.DLL
[2011/11/16 14:26:55 | 000,237,568 | —- | C] () – C:\WINDOWS\System32\lame_enc.dll
[2011/11/13 22:30:44 | 002,469,760 | —- | C] () – C:\WINDOWS\System32\BootMan.exe
[2011/11/13 22:30:44 | 000,086,408 | —- | C] () – C:\WINDOWS\System32\setupempdrv03.exe
[2011/11/13 22:30:44 | 000,019,840 | —- | C] () – C:\WINDOWS\System32\EuEpmGdi.dll
[2011/11/13 22:30:44 | 000,013,192 | —- | C] () – C:\WINDOWS\System32\epmntdrv.sys
[2011/11/13 22:30:44 | 000,008,456 | —- | C] () – C:\WINDOWS\System32\EuGdiDrv.sys
[2010/12/01 21:06:37 | 000,007,168 | —- | C] () – C:\WINDOWS\System32\drivers\StarOpen.sys
[2009/04/14 18:18:48 | 000,000,127 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2006/11/19 18:11:03 | 000,004,212 | -H– | C] () – C:\WINDOWS\System32\zllictbl.dat
[2006/11/14 16:58:37 | 000,175,616 | —- | C] () – C:\WINDOWS\System32\strings.exe
[2006/11/14 16:58:37 | 000,126,976 | —- | C] () – C:\WINDOWS\System32\zip.exe
[2006/11/14 16:58:37 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\pv.exe
[2006/11/14 16:58:37 | 000,039,184 | —- | C] () – C:\WINDOWS\System32\Ntrights.exe
[2006/11/14 16:58:37 | 000,011,254 | —- | C] () – C:\WINDOWS\System32\locate.com
[2006/01/26 17:47:56 | 000,019,253 | —- | C] () – C:\WINDOWS\MSUMLT_S.ini
[2005/11/07 14:44:21 | 000,000,022 | —- | C] () – C:\WINDOWS\kodakpcd.Peter.ini
[2005/09/20 05:50:23 | 000,001,759 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2005/05/25 12:32:55 | 000,099,024 | —- | C] () – C:\WINDOWS\MozillaUninstall.exe
[2005/05/25 12:32:31 | 000,098,512 | —- | C] () – C:\WINDOWS\GREUninstall.exe
[2005/05/25 12:20:29 | 000,099,965 | —- | C] () – C:\WINDOWS\UninstallFirefox.exe
[2005/05/09 08:45:29 | 000,037,027 | —- | C] () – C:\WINDOWS\atmoUn.exe
[2005/04/25 20:50:26 | 000,019,116 | —- | C] () – C:\WINDOWS\MSTMON_S.INI
[2005/02/20 04:19:14 | 000,000,694 | —- | C] () – C:\WINDOWS\wininit.ini
[2005/02/17 23:26:54 | 000,003,840 | —- | C] () – C:\WINDOWS\System32\drivers\BANTExt.sys
[2005/02/04 06:19:02 | 000,000,892 | —- | C] () – C:\WINDOWS\keythf2.ini
[2005/01/28 21:02:52 | 000,000,694 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2004/12/31 20:01:44 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/12/29 06:49:25 | 000,027,622 | —- | C] () – C:\WINDOWS\System32\nlsfuncs.exe
[2004/12/29 06:49:25 | 000,022,337 | —- | C] () – C:\WINDOWS\System32\qappsrvc32.exe
[2004/12/29 06:49:25 | 000,010,872 | —- | C] () – C:\WINDOWS\System32\unlodctl.exe
[2004/12/29 06:49:25 | 000,010,872 | —- | C] () – C:\WINDOWS\System32\iecust.exe
[2004/12/29 06:49:25 | 000,009,377 | —- | C] () – C:\WINDOWS\System32\openconf.exe
[2004/12/27 19:57:37 | 000,030,773 | —- | C] () – C:\WINDOWS\iecust.exe
[2004/12/27 19:56:13 | 000,030,773 | —- | C] () – C:\WINDOWS\nlsfuncs.exe
[2004/12/27 19:55:18 | 000,030,773 | —- | C] () – C:\WINDOWS\openconf.exe
[2004/12/27 19:55:17 | 000,030,773 | —- | C] () – C:\WINDOWS\unlodctl.exe
[2004/12/27 19:55:04 | 000,030,773 | —- | C] () – C:\WINDOWS\taskopen.exe
[2004/12/25 23:58:42 | 000,000,063 | —- | C] () – C:\WINDOWS\sb_affiliate.ini
[2004/12/25 22:20:37 | 000,000,019 | —- | C] () – C:\WINDOWS\System32\date.dat
[2004/10/08 10:05:45 | 000,000,314 | —- | C] () – C:\WINDOWS\mpsettings.ini
[2004/09/21 14:00:25 | 000,109,782 | —- | C] () – C:\WINDOWS\CopernicAgentUninstall.exe
[2004/09/20 08:23:08 | 000,000,000 | —- | C] () – C:\Documents and Settings\Peter\Application Data\dm.ini
[2004/09/17 11:39:32 | 000,000,142 | —- | C] () – C:\WINDOWS\bestplayer.ini
[2004/09/14 20:13:48 | 000,000,156 | —- | C] () – C:\WINDOWS\TOPO.INI
[2004/08/22 22:09:06 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2004/08/22 22:08:20 | 000,025,701 | —- | C] () – C:\WINDOWS\mozver.dat
[2004/08/10 10:13:58 | 000,054,802 | —- | C] () – C:\WINDOWS\System32\adwfil.dll
[2004/08/10 10:13:58 | 000,012,684 | —- | C] () – C:\WINDOWS\System32\gblfil.dll
[2004/08/10 10:13:58 | 000,010,644 | —- | C] () – C:\WINDOWS\System32\chtfil.dll
[2004/08/10 10:13:58 | 000,005,782 | —- | C] () – C:\WINDOWS\System32\vgamfil.dll
[2004/08/10 10:13:58 | 000,005,160 | —- | C] () – C:\WINDOWS\System32\wfileu.drv
[2004/08/10 10:13:58 | 000,004,572 | —- | C] () – C:\WINDOWS\System32\iawfil.dll
[2004/08/10 10:13:58 | 000,004,442 | —- | C] () – C:\WINDOWS\System32\hatfil.dll
[2004/08/10 10:13:58 | 000,004,084 | —- | C] () – C:\WINDOWS\System32\viofil.dll
[2004/08/10 10:13:58 | 000,003,398 | —- | C] () – C:\WINDOWS\System32\srchin.dll
[2004/08/10 10:13:58 | 000,002,706 | —- | C] () – C:\WINDOWS\System32\lgwfil.dll
[2004/08/10 10:13:58 | 000,001,830 | —- | C] () – C:\WINDOWS\System32\cultfil.dll
[2004/08/10 10:13:58 | 000,000,434 | —- | C] () – C:\WINDOWS\System32\imgfil.dll
[2004/08/10 10:13:58 | 000,000,400 | —- | C] () – C:\WINDOWS\bsnlst.dll
[2004/08/10 10:13:58 | 000,000,306 | —- | C] () – C:\WINDOWS\System32\picsfil.dll
[2004/08/10 10:13:58 | 000,000,258 | —- | C] () – C:\WINDOWS\System32\srchout.dll
[2004/08/10 10:13:57 | 000,121,856 | —- | C] () – C:\WINDOWS\System32\mslspc.exe
[2004/08/10 10:13:57 | 000,000,027 | —- | C] () – C:\WINDOWS\liccyval.dat
[2004/07/23 10:49:31 | 000,044,032 | —- | C] () – C:\WINDOWS\unwash.exe
[2004/07/06 09:05:48 | 000,126,976 | R— | C] () – C:\WINDOWS\System32\cmdinterface.dll
[2004/07/06 09:05:48 | 000,010,321 | R— | C] () – C:\WINDOWS\System32\concord.dll
[2004/07/06 09:04:48 | 000,000,021 | —- | C] () – C:\WINDOWS\arcsuite.ini
[2004/07/06 07:23:16 | 000,002,611 | —- | C] () – C:\WINDOWS\photoimpression.ini
[2004/06/27 13:22:27 | 000,025,600 | —- | C] () – C:\Documents and Settings\Peter\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/04/14 18:06:42 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/04/13 14:58:54 | 000,000,478 | —- | C] () – C:\WINDOWS\ODBC.INI
[2004/04/13 00:01:35 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/04/13 00:00:35 | 000,565,504 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2004/04/12 16:19:07 | 000,001,024 | R— | C] () – C:\WINDOWS\System32\drivers\jedih2rx.bin
[2004/04/12 16:19:07 | 000,000,122 | R— | C] () – C:\WINDOWS\System32\drivers\ramsed.bin
[2004/04/12 16:18:37 | 000,003,000 | R— | C] () – C:\WINDOWS\System32\SetupNT.sys
[2004/04/12 16:09:07 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2004/04/12 16:04:41 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2003/06/29 22:55:36 | 000,011,521 | —- | C] () – C:\WINDOWS\MSUMLT_Q.INI
[2003/03/31 07:00:00 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2003/03/31 07:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2003/03/31 07:00:00 | 000,435,260 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2003/03/31 07:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2003/03/31 07:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2003/03/31 07:00:00 | 000,068,156 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2003/03/31 07:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2003/03/31 07:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2003/03/31 07:00:00 | 000,004,461 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2003/03/31 07:00:00 | 000,001,788 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2003/03/31 07:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/03/14 11:00:26 | 000,038,567 | —- | C] () – C:\WINDOWS\System32\pcpbios.exe
[2000/09/08 17:53:50 | 000,073,839 | —- | C] () – C:\WINDOWS\System32\KodakOneTouch.dll
[1998/08/16 04:00:00 | 000,004,096 | —- | C] () – C:\WINDOWS\System32\sysres.dll
[1997/06/13 21:56:08 | 000,056,832 | —- | C] () – C:\WINDOWS\System32\iyvu9_32.dll

========== LOP Check ==========

[2010/12/01 21:06:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Canneverbe Limited
[2011/11/15 18:25:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Fighters
[2010/12/01 19:52:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2004/05/04 14:31:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap
[2010/12/01 21:51:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2005/05/09 08:45:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2006/04/19 17:48:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Advanced Browser
[2009/04/14 19:58:47 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Avant Browser
[2011/11/25 01:27:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Azureus
[2010/12/01 21:06:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Canneverbe Limited
[2004/09/21 14:00:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Copernic
[2008/03/02 14:54:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Enigma Browser
[2011/11/15 18:23:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\FCSB000063443
[2011/11/15 18:25:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Fighters
[2011/12/01 07:47:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\FVDToolbar
[2011/11/30 07:15:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\HamsterSoft
[2004/09/21 22:38:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Opera
[2004/09/15 21:04:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Thunderbird
[2006/04/26 21:38:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\UVC
[2010/12/01 21:04:44 | 000,000,298 | —- | M] () – C:\WINDOWS\Tasks\expressburnShakeIcon.job
[2012/01/12 16:28:45 | 000,000,384 | —- | M] () – C:\WINDOWS\Tasks\SLOW-PCfighter-Peter-Notification.job
[2012/01/12 16:28:45 | 000,000,356 | —- | M] () – C:\WINDOWS\Tasks\SLOW-PCfighter-Peter-Startup.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2004/04/18 13:39:51 | 000,004,499 | —- | M] () – C:\aoesync.txt
[2005/06/26 14:00:20 | 000,000,032 | —- | M] () – C:\AUTOEXEC.BAT
[2006/11/18 11:29:31 | 000,004,408 | —- | M] () – C:\avenger.txt
[2004/12/31 20:34:33 | 000,000,211 | RHS- | M] () – C:\boot.ini
[2007/01/12 20:56:10 | 000,001,024 | —- | M] () – C:\callerid.fic
[2004/04/12 16:26:56 | 000,000,003 | —- | M] () – C:\CHKMB.TXT
[2006/11/18 22:35:25 | 000,007,476 | —- | M] () – C:\ComboFix.txt
[2006/11/18 09:45:08 | 000,008,906 | —- | M] () – C:\ComboFix2.txt
[2006/11/17 21:47:14 | 000,008,705 | —- | M] () – C:\ComboFix3.txt
[2004/04/12 16:07:04 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2006/11/14 16:58:37 | 000,000,048 | —- | M] () – C:\direct.txt
[2005/11/07 13:13:59 | 005,408,141 | —- | M] () – C:\EasyShare.dmp
[2006/12/14 06:39:35 | 000,000,656 | —- | M] () – C:\EasyShareInstall.log
[2005/07/12 08:40:24 | 000,000,046 | —- | M] () – C:\hWaitEventRetryInstall
[2004/04/18 21:43:54 | 000,000,434 | —- | M] () – C:\INSTALL.LOG
[2004/04/12 16:07:04 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2004/04/12 16:07:04 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/12/31 20:23:39 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2004/12/31 20:23:39 | 000,250,032 | RHS- | M] () – C:\ntldr
[2012/01/12 17:37:43 | 805,306,368 | -HS- | M] () – C:\pagefile.sys
[2004/08/19 23:27:39 | 000,000,299 | —- | M] () – C:\PPCleanDeleteAtReboot.bat
[2012/01/12 17:54:27 | 000,000,359 | —- | M] () – C:\rkill.log
[2005/06/26 14:02:44 | 000,008,532 | —- | M] () – C:\S4FINSTALL.LOG

< %systemroot%\Fonts\*.com >
[2006/04/18 14:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 13:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 14:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 13:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/04/12 16:06:43 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 07:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2003/06/18 17:31:48 | 000,018,944 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2003/07/22 01:45:20 | 000,010,240 | —- | M] (Zenographics, Inc.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\MIMFPR_Q.DLL
[2005/03/08 00:47:30 | 000,010,752 | —- | M] (KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\MIMFPR_S.DLL
[2008/07/06 05:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >
[2004/05/18 10:50:58 | 000,000,204 | —- | M] () – C:\Documents and Settings\All Users\Favorites\My Yahoo!.url
[2004/05/18 10:49:54 | 000,000,213 | —- | M] () – C:\Documents and Settings\All Users\Favorites\Yahoo! Bookmarks.url
[2004/05/18 16:26:04 | 000,000,208 | —- | M] () – C:\Documents and Settings\All Users\Favorites\Yahoo! Mail.url
[2004/05/18 16:13:06 | 000,000,207 | —- | M] () – C:\Documents and Settings\All Users\Favorites\Yahoo!.url

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2004/04/12 23:59:06 | 000,094,208 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2004/04/12 23:59:06 | 000,602,112 | —- | M] () – C:\WINDOWS\System32\config\software.sav
[2004/04/12 23:59:06 | 000,397,312 | —- | M] () – C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lîk /x >
[2004/12/31 20:33:55 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini
[2008/10/13 19:10:24 | 000,000,851 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Get OpenOffice.org.lnk
[2006/10/30 21:51:26 | 000,002,505 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\New Office Document.lnk
[2006/10/30 21:51:26 | 000,002,515 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Open Office Document.lnk
[2004/12/31 20:33:55 | 000,001,563 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Set Program Access and Defaults.lnk
[2004/04/12 16:07:09 | 000,000,398 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Windows Catalog.lnk
[2004/04/12 16:07:09 | 000,001,507 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Windows Update.lnk
[2004/07/20 09:16:30 | 000,000,736 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\WinZip.lnk

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >
[2004/11/17 17:37:45 | 000,007,168 | -HS- | M] () – C:\WINDOWS\system32\Thumbs.db
[5 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x >

< %USERPROFILE%\Desktop\*.exe >
[2012/01/12 21:08:02 | 004,713,472 | —- | M] (AVAST Software) – C:\Documents and Settings\Peter\Desktop\aswMBR.exe
[2012/01/12 18:01:00 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Peter\Desktop\HijackThis.exe
[2012/01/12 20:48:06 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Peter\Desktop\OTL.exe
[2012/01/12 17:56:12 | 001,008,141 | —- | M] () – C:\Documents and Settings\Peter\Desktop\Rkill-eXplorer.exe
[2012/01/12 17:56:41 | 001,008,141 | —- | M] () – C:\Documents and Settings\Peter\Desktop\RKill-iExplore.exe
[2011/11/13 18:59:28 | 013,943,432 | —- | M] (Mozilla) – C:\Documents and Settings\Peter\Desktop\yahoo_firefox_5.0_setup_us.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-01-12 00:30:47

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s >


< MD5 for: EXPLORER.BH3 >
[2003/04/18 18:57:40 | 000,014,023 | —- | M] () MD5=7A8BC9CC3B897C66F90F94952EE1F40E – C:\Program Files\Microsoft Games\Rise of Nations\art\explorer.bh3
[2004/03/29 17:50:39 | 000,014,023 | —- | M] () MD5=7A8BC9CC3B897C66F90F94952EE1F40E – C:\Program Files\Microsoft Games\Rise of Nations\Thrones and Patriots\art\explorer.bh3

< MD5 for: EXPLORER.DAT >
[2006/03/19 14:38:52 | 000,068,772 | —- | M] () MD5=3046904800A565CD1D747EFA8AFC9463 – C:\Program Files\Free Easy Burner\Ressources\Explorer.DAT

< MD5 for: EXPLORER.EXE >
[2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\explorer.exe
[2007/06/13 06:26:03 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 – C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2007/06/13 05:23:07 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 – C:\WINDOWS\explorer.exe
[2007/06/13 05:23:07 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 – C:\WINDOWS\system32\dllcache\explorer.exe
[2004/08/04 02:56:49 | 001,032,192 | —- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 – C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
[2004/08/04 02:56:49 | 001,032,192 | —- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 – C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2003/05/11 20:12:10 | 000,996,352 | —- | M] (Microsoft Corporation) MD5=A73BC66A95CF4F7B597FC8975778A889 – C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2003/03/31 07:00:00 | 001,004,032 | —- | M] (Microsoft Corporation) MD5=A82B28BFC2E4455FE43022A498C0EF0A – C:\WINDOWS\$NtUninstallKB820291$\explorer.exe

< MD5 for: EXPLORER.EXE-082F38A9.PF >
[2012/01/12 16:29:22 | 000,080,936 | —- | M] () MD5=88D222BB95229A09CE8EDFBDE4E0A1F2 – C:\WINDOWS\Prefetch\EXPLORER.EXE-082F38A9.pf

< MD5 for: EXPLORER.SCF >
[2003/03/31 07:00:00 | 000,000,080 | —- | M] () MD5=A3975A7D2C98B30A2AE010754FFB9392 – C:\WINDOWS\explorer.scf

< MD5 for: EXPLORER.TGA >
[2003/04/18 18:57:40 | 000,016,115 | —- | M] () MD5=7257E1D90C422A75F20E1FFEFB959889 – C:\Program Files\Microsoft Games\Rise of Nations\art\explorer.tga

< MD5 for: IEXPLORE.CHM >
[2003/03/31 07:00:00 | 000,167,956 | —- | M] () MD5=13A43EAD75BC03C50815444AC3018010 – C:\WINDOWS\$NtServicePackUninstall$\iexplore.chm
[2004/07/17 13:40:16 | 000,204,810 | —- | M] () MD5=60858526AAD1CC55F5F0055B8E3B66FE – C:\WINDOWS\ie7\iexplore.chm
[2004/07/17 13:40:16 | 000,204,810 | —- | M] () MD5=60858526AAD1CC55F5F0055B8E3B66FE – C:\WINDOWS\ServicePackFiles\i386\iexplore.chm
[2006/09/01 07:43:50 | 000,503,758 | —- | M] () MD5=652E46500C149D1DC948BF9CEA8C4933 – C:\WINDOWS\Help\iexplore.chm

< MD5 for: IEXPLORE.CHW >
[2006/05/19 17:38:30 | 000,185,057 | —- | M] () MD5=0B905321D2D2C61BE0E21F6DB37FC72C – C:\WINDOWS\Help\iexplore.chw

< MD5 for: IEXPLORE.EXE >
[2007/04/24 09:26:26 | 000,625,152 | —- | M] (Microsoft Corporation) MD5=10BDB55982586A432A3951EB19A26009 – C:\WINDOWS\ie7updates\KB944533-IE7\iexplore.exe
[2008/08/23 00:56:15 | 000,635,848 | —- | M] (Microsoft Corporation) MD5=1F03216084447F990AE797317D0A6E70 – C:\WINDOWS\ie7updates\KB963027-IE7\iexplore.exe
[2007/12/06 06:01:25 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=2703D940A62B731AA220529DD7331A78 – C:\WINDOWS\ie7updates\KB956390-IE7\iexplore.exe
[2003/03/31 07:00:00 | 000,091,136 | —- | M] (Microsoft Corporation) MD5=418D301C3B1FA94B19584AEEB3D65166 – C:\WINDOWS\$NtServicePackUninstall$\iexplore.exe
[2006/10/17 12:04:40 | 000,622,080 | —- | M] (Microsoft Corporation) MD5=5334D4461AA92A7B008755FE6D13C5F2 – C:\WINDOWS\ie7updates\KB928090-IE7\iexplore.exe
[2008/04/13 19:12:22 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\iexplore.exe
[2007/12/06 03:34:45 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=809D17D8FA0FDAEE07778CD821CAFFDE – C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\iexplore.exe
[2007/01/08 18:08:42 | 000,623,616 | —- | M] (Microsoft Corporation) MD5=93A6A4F5293AE19E3B37021AABCF0902 – C:\WINDOWS\ie7updates\KB933566-IE7\iexplore.exe
[2007/04/24 09:20:41 | 000,625,152 | —- | M] (Microsoft Corporation) MD5=9B3516C1F30DA17ADD3818573047D63C – C:\WINDOWS\$hf_mig$\KB933566-IE7\SP2QFE\iexplore.exe
[2009/02/27 23:54:41 | 000,636,072 | —- | M] (Microsoft Corporation) MD5=A251068640DDB69FD7805B57D89D7FF7 – C:\WINDOWS\ie7updates\KB982381-IE7\iexplore.exe
[2010/04/16 06:08:29 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=B24A4E23A2FEDB6976EB04D334AD82B2 – C:\WINDOWS\$hf_mig$\KB982381-IE7\SP3QFE\iexplore.exe
[2009/02/27 23:54:44 | 000,636,088 | —- | M] (Microsoft Corporation) MD5=BCD8E48709BE4A79606F0B6E8E9A6162 – C:\WINDOWS\$hf_mig$\KB963027-IE7\SP3QFE\iexplore.exe
[2010/04/16 06:43:25 | 000,634,656 | —- | M] (Microsoft Corporation) MD5=C4BA5E36FB57F547117305BF1E0FE454 – C:\Program Files\Internet Explorer\iexplore.exe
[2010/04/16 06:43:25 | 000,634,656 | —- | M] (Microsoft Corporation) MD5=C4BA5E36FB57F547117305BF1E0FE454 – C:\WINDOWS\system32\dllcache\iexplore.exe
[2004/08/04 02:56:50 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=E7484514C0464642BE7B4DC2689354C8 – C:\WINDOWS\ie7\iexplore.exe
[2004/08/04 02:56:50 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=E7484514C0464642BE7B4DC2689354C8 – C:\WINDOWS\ServicePackFiles\i386\iexplore.exe
[2008/08/23 00:56:16 | 000,635,848 | —- | M] (Microsoft Corporation) MD5=E8305C30D35E85D6657ED3E9934CB302 – C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2006/10/17 12:04:26 | 000,573,440 | —- | M] (Microsoft Corporation) MD5=E83C9C1F9DD9D47BB44871BFC7E69DDD – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui

< MD5 for: IEXPLORE.EXE-27122324.PF >
[2012/01/11 13:03:19 | 000,056,196 | —- | M] () MD5=7C58E5F8F02C3F3CDCD6D41706B6B897 – C:\WINDOWS\Prefetch\IEXPLORE.EXE-27122324.pf

< MD5 for: IEXPLORE.HLP >
[2003/03/31 07:00:00 | 000,180,335 | —- | M] () MD5=3F19AF1B745140DAFAC6F78F561A3C62 – C:\WINDOWS\Help\iexplore.hlp

< MD5 for: WINLOGON.EXE >
[2004/08/04 02:56:57 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2004/08/04 02:56:57 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\WINDOWS\system32\winlogon.exe
[2003/03/31 07:00:00 | 000,516,608 | —- | M] (Microsoft Corporation) MD5=2246D8D8F4714A2CEDB21AB9B1849ABB – C:\WINDOWS\$NtUninstallKB841533$\winlogon.exe
[2004/05/26 20:38:46 | 000,483,328 | —- | M] (Microsoft Corporation) MD5=E7F9D2E4E4A94A6F58014E5FFA16A65E – C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008/04/13 19:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\winlogon.exe

< MD5 for: WINLOGON.EXE-32C57D49.PF >
[2012/01/10 05:40:26 | 000,057,684 | —- | M] () MD5=0A3157C44CC4D5BDC550550F8672A068 – C:\WINDOWS\Prefetch\WINLOGON.EXE-32C57D49.pf

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\Peter\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf:SummaryInformation
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CEF69E3D

< End of report >









===============================================================================
===============================================================================
Extras.txt
OTL Extras logfile created on: 1/12/2012 9:06:42 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Peter\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.48 Mb Total Physical Memory | 60.31 Mb Available Physical Memory | 11.79% Memory free
1.22 Gb Paging File | 0.77 Gb Available in Paging File | 63.08% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 57.26 Gb Total Space | 10.11 Gb Free Space | 17.66% Space Free | Partition Type: NTFS
Drive D: | 306.88 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 298.09 Gb Total Space | 66.25 Gb Free Space | 22.23% Space Free | Partition Type: NTFS

Computer Name: PH | User Name: Peter | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromiumHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
http [open] – "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] – "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – C:\Program Files\VideoLAN\VLC\vlc.exe –started-from-file –playlist-enqueue "%1" ()
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – C:\Program Files\VideoLAN\VLC\vlc.exe –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 1
"FirewallOverride" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0008546E-DF6E-4CC1-AFD0-2CB8E16C95A2}" = Notifier
"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
"{073F22CE-9A5B-4A40-A604-C7270AC6BF34}" = ESSSONIC
"{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}" = OpenOffice.org Installer 1.0
"{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}" = ESSPCD
"{154508C0-07C5-4659-A7A0-E49968750D21}" = HLPPDOCK
"{26A24AE4-039D-4CA4-87B4-2F83216029FF}" = Java™ 6 Update 29
"{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}" = essvatgt
"{3248F0A8-6813-11D6-A77B-00B0D0150090}" = J2SE Runtime Environment 5.0 Update 9
"{3248F0A8-6813-11D6-A77B-00B0D0150100}" = J2SE Runtime Environment 5.0 Update 10
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java™ 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3CA39B0C-BA85-4D42-AC0F-1FF5F60C3353}" = OTtBPSDK
"{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}" = Google Earth
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{432C3720-37BF-4BD7-8E49-F38E090246D0}" = CR2
"{446DBFFA-4088-48E3-8932-74316BA4CAE4}" = iTunes
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{54C8FE84-89C4-40E8-976C-439EB0729BD6}" = CardRd81
"{605A4E39-613C-4A12-B56F-DEFBE6757237}" = SHASTA
"{643EAE81-920C-4931-9F0B-4B343B225CA6}" = ESSBrwr
"{76EFFC7C-17A6-479D-9E47-8E658C1695AE}" = Windows Backup Utility
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{80E4B2D6-BFF2-402C-96C4-3942DF24CABB}_is1" = FVD Suite 2.6.9
"{87843A41-7808-4F2E-B13F-25C1E67CF2FD}" = ESShelp
"{8943CE61-53BD-475E-90E1-A580869E98A2}" = staticcr
"{8A502E38-29C9-49FA-BCFA-D727CA062589}" = ESSTOOLS
"{8E92D746-CD9F-4B90-9668-42B74C14F765}" = ESSini
"{91517631-A9F3-4B7C-B482-43E0068FD55A}" = ESSgui
"{91CA0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Small Business Edition 2003
"{999D43F4-9709-4887-9B1A-83EBB15A8370}" = VPRINTOL
"{9D8FEE90-0377-49A9-AEFB-525BDE549BA4}" = ESScore
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{ABEB838C-A1A7-4C5D-B7E1-8B4314600816}" = MSN Messenger 7.0
"{AC76BA86-7AD7-1033-7B44-A70000000000}" = Adobe Reader 7.0.8
"{AC76BA86-7AD7-5464-3428-7050000000A7}" = Adobe Reader 7.0.5 Language Support
"{AC76BA86-7AD7-5464-3428-7E8A450000A7}" = Spelling Dictionaries For Adobe Reader Package
"{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}" = ESSCDBK
"{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}" = OfotoXMI
"{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}" = CCScore
"{B997C2A0-4383-41BF-B76E-9B8B7ECFB267}" = KSU
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1973749-F5E7-40EB-B528-F2B78685B9FF}" = essvcpt
"{D32470A1-B10C-4059-BA53-CF0486F68EBC}" = Kodak EasyShare software
"{DB02F716-6275-42E9-B8D2-83BA2BF5100B}" = SFR
"{E0A96F36-D546-4A2A-BDAA-2A2A578B2C0D}" = Bonjour
"{E82A57BC-E9B8-42F9-BDC7-4950BD73EA32}_is1" = Pazera Free FLV to AVI Converter 1.4
"{E9F81423-211E-46B6-9AE0-38568BC5CF6F}" = Alcohol 120% (Trial Version)
"{F22C222C-3CE2-4A4B-A83F-AF4681371ABE}" = kgcbase
"{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}" = SKINXSDK
"{F6FCC591-A21B-47C7-BCB3-F535FBA210E2}" = SLOW-PCfighter
"{F71760CD-0F8B-4DCC-B7B7-6B223CC3843C}" = OTtBP
"{F9593CFB-D836-49BC-BFF1-0E669A411D9F}" = WIRELESS
"{FCDB1C92-03C6-4C76-8625-371224256091}" = ESSPDock
"{FDF9943A-3D5C-46B3-9679-586BD237DDEE}" = SKIN0001
"Active@ Data CD/DVD Burner v 2.0" = Active@ Data CD/DVD Burner v 2.0
"Ad-Aware SE Personal" = Ad-Aware SE Personal
"Adobe Atmosphere Player" = Adobe Atmosphere Player for Acrobat and Adobe Reader
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AdobeESD" = Adobe Download Manager 1.2 (Remove Only)
"Advanced Browser" = Advanced Browser (remove only)
"Age of Empires 2.0" = Microsoft Age of Empires II
"Age of Empires Gold 1.0" = Microsoft Age of Empires Gold
"Age of Empires II: The Conquerors Expansion 1.0" = Microsoft Age of Empires II: The Conquerors Expansion
"ArcSoft Camera Suite" = ArcSoft Camera Suite
"AvantBrowser" = Avant Browser (remove only)
"AVGantiRootkit" = AVG Anti-Rootkit Beta
"Belarc Advisor 2.0" = Belarc Advisor 7.1
"Burn4Free CD & DVD_is1" = Burn4Free CD & DVD 5.1.0.0
"Comodo Dragon" = Comodo Dragon
"Copernic Agent Basic" = Copernic Agent Basic
"CXT1059" = Broadxent V.92 PCI DI3631-1
"EASEUS Partition Master Home Edition_is1" = EASEUS Partition Master 9.1.0 Home Edition
"Enigma Browser" = Enigma Browser (remove only)
"ERUNT_is1" = ERUNT 1.1j
"ExpressBurn" = Express Burn Disc Burning Software
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free Easy Burner_is1" = Free Easy Burner V 3.8
"FrostWire 5" = FrostWire 5.2.10
"Hamster Free Video Converter_is1" = HamsterFreeVideoConverter
"HijackThis" = HijackThis 1.99.1
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{E0A96F36-D546-4A2A-BDAA-2A2A578B2C0D}" = Bonjour
"IrfanView" = IrfanView (remove only)
"KONICA MINOLTA magicolor 2400W" = KONICA MINOLTA magicolor 2400W
"KONICA MINOLTA PagePro 1350W" = KONICA MINOLTA PagePro 1350W
"Macromedia Shockwave Player" = Macromedia Shockwave Player
"MavisBeacon5" = Mavis Beacon Teaches Typing
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MOV Converter 3" = MOV Converter 3
"Mozilla (1.7.8)" = Mozilla (1.7.8)
"Mozilla Firefox 5.0 (x86 en-US)" = Mozilla Firefox 5.0 (x86 en-US)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSN Music Assistant" = MSN Music Assistant
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Display Driver" = NVIDIA Display Driver
"NVIDIAnForce" = NVIDIA Windows 2000/XP nForce Drivers
"Opera" = Opera
"RealPlayer 6.0" = RealPlayer
"RiseOfNationsExpansion 1.0" = Rise of Nations
"Rocket Division Software Grab & Burn_is1" = Grab & Burn, Version 4.0.1 ( Build 2005-09-21, Win32, CSS )
"Search Toolbar" = Search Toolbar
"ShockwaveFlash" = Macromedia Flash Player 8
"SpywareBlaster_is1" = SpywareBlaster v3.5.1
"SpywareGuard_is1" = SpywareGuard v2.2
"ST6UNST #1" = Grau Software CountDown 8.01
"TeamSpeak 2 RC2_is1" = TeamSpeak 2 RC2
"TOPO!" = TOPO!
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 0.9.8a
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows XP Service Pack" = Windows XP Service Pack 2
"WinRAR archiver" = WinRAR 4.01 (32-bit)
"WinZip" = WinZip
"WMFDist11" = Windows Media Format 11 runtime
"WordWeb" = WordWeb
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahoo! Anti-Spy" = Yahoo! Anti-Spy
"Yahoo! Customizations" = Yahoo! extras
"Yahoo! Internet Mail" = Yahoo! Internet Mail
"Yahoo! Mail AutoComplete" = Yahoo! Address AutoComplete
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Messenger Explorer Bar" = Yahoo! Messenger Explorer Bar
"YInstHelper" = Yahoo! Install Manager

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/6/2012 3:13:38 PM | Computer Name = PH | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.3156, faulting
module nvcpl.dll, version 6.14.10.5672, fault address 0x000270d8.

Error - 1/6/2012 3:29:33 PM | Computer Name = PH | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.3156, faulting
module nvcpl.dll, version 6.14.10.5672, fault address 0x000270d8.

Error - 1/6/2012 3:34:45 PM | Computer Name = PH | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.3156, faulting
module nvcpl.dll, version 6.14.10.5672, fault address 0x000270d8.

Error - 1/7/2012 11:43:47 AM | Computer Name = PH | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.3156, faulting
module nvcpl.dll, version 6.14.10.5672, fault address 0x000270d8.

Error - 1/8/2012 1:17:27 AM | Computer Name = PH | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.3156, faulting
module nvcpl.dll, version 6.14.10.5672, fault address 0x000270d8.

Error - 1/8/2012 3:55:22 AM | Computer Name = PH | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.3156, faulting
module nvcpl.dll, version 6.14.10.5672, fault address 0x000270d8.

Error - 1/9/2012 8:17:52 AM | Computer Name = PH | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.3156, faulting
module nvcpl.dll, version 6.14.10.5672, fault address 0x000270d8.

Error - 1/10/2012 8:55:52 AM | Computer Name = PH | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.3156, faulting
module nvcpl.dll, version 6.14.10.5672, fault address 0x000270d8.

Error - 1/12/2012 11:16:02 AM | Computer Name = PH | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This operation returned because the timeout period expired.

Error - 1/12/2012 11:16:02 AM | Computer Name = PH | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This operation returned because the timeout period expired.

[ System Events ]
Error - 1/12/2012 6:47:04 PM | Computer Name = PH | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 1/12/2012 6:56:07 PM | Computer Name = PH | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 1/12/2012 6:56:38 PM | Computer Name = PH | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 1/12/2012 7:01:17 PM | Computer Name = PH | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 1/12/2012 7:51:14 PM | Computer Name = PH | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 1/12/2012 8:11:15 PM | Computer Name = PH | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 1/12/2012 10:13:24 PM | Computer Name = PH | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 1/12/2012 10:14:04 PM | Computer Name = PH | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 1/12/2012 10:15:14 PM | Computer Name = PH | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error - 1/12/2012 10:15:14 PM | Computer Name = PH | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service StiSvc with
arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}


< End of report >








===============================================================================
===============================================================================
aswMBR.txt

aswMBR version 0.9.9.1297 Copyright© 2011 AVAST Software
Run date: 2012-01-12 21:23:21
—————————–
21:23:21.765 OS Version: Windows 5.1.2600 Service Pack 2
21:23:21.765 Number of processors: 1 586 0xA00
21:23:21.765 ComputerName: PH UserName:
21:23:24.671 Initialize success
21:56:07.140 AVAST engine defs: 12011201
22:01:38.531 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Scsi\nvidesm1Port0Path0Target0Lun0
22:01:38.546 Disk 0 Vendor: Maxtor_6 YAR4 Size: 58644MB BusType: 1
22:01:38.562 Disk 1 \Device\Harddisk1\DR1 -> \Device\Scsi\nvidesm1Port0Path0Target1Lun0
22:01:38.593 Disk 1 Vendor: WDC_WD32 00.0 Size: 305245MB BusType: 1
22:01:38.609 Device \Driver\nvidesm -> DriverStartIo SCSIPORT.SYS f846740e
22:01:38.656 Disk 0 MBR read successfully
22:01:38.671 Disk 0 MBR scan
22:01:38.906 Disk 0 Windows XP default MBR code
22:01:38.953 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 58635 MB offset 63
22:01:39.000 Disk 0 scanning sectors +120085875
22:01:39.250 Disk 0 scanning C:\WINDOWS\system32\drivers
22:02:16.109 Service scanning
22:02:52.078 Modules scanning
22:02:57.484 Module: C:\WINDOWS\system32\hal.dll **SUSPICIOUS**
22:02:58.140 Module: C:\WINDOWS\System32\Drivers\ACPI.sys **SUSPICIOUS**
22:02:59.875 Module: C:\WINDOWS\system32\drivers\SCSIPORT.SYS **SUSPICIOUS**
22:03:00.937 Module: C:\WINDOWS\System32\Drivers\KSecDD.sys **SUSPICIOUS**
22:03:01.515 Module: C:\WINDOWS\System32\Drivers\Ntfs.sys **SUSPICIOUS**
22:03:02.015 Module: C:\WINDOWS\System32\Drivers\NDIS.sys **SUSPICIOUS**
22:03:02.640 Module: C:\WINDOWS\System32\Drivers\Mup.sys **SUSPICIOUS**
22:03:03.296 Module: C:\WINDOWS\System32\DRIVERS\USBPORT.SYS **SUSPICIOUS**
22:03:06.921 Module: C:\WINDOWS\System32\DRIVERS\ipsec.sys **SUSPICIOUS**
22:03:07.453 Module: C:\WINDOWS\System32\DRIVERS\tcpip.sys **SUSPICIOUS**
22:03:07.921 Module: C:\WINDOWS\System32\DRIVERS\netbt.sys **SUSPICIOUS**
22:03:08.390 Module: C:\WINDOWS\System32\drivers\afd.sys **SUSPICIOUS**
22:03:09.078 Module: C:\WINDOWS\System32\DRIVERS\mrxsmb.sys **SUSPICIOUS**
22:03:10.312 Module: C:\WINDOWS\System32\win32k.sys **SUSPICIOUS**
22:03:38.656 Module: C:\WINDOWS\System32\DRIVERS\srv.sys **SUSPICIOUS**
22:03:39.109 Module: C:\WINDOWS\System32\Drivers\Fastfat.SYS **SUSPICIOUS**
22:03:39.765 Module: C:\WINDOWS\system32\ntdll.dll **SUSPICIOUS**
22:03:39.843 Disk 0 trace - called modules:
22:03:40.078 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll SCSIPORT.SYS nvidesm.sys
22:03:40.312 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x823443a0]
22:03:40.546 3 CLASSPNP.SYS[f857705b] -> nt!IofCallDriver -> \Device\00000066[0x82374920]
22:03:40.765 5 ACPI.sys[f84ca620] -> nt!IofCallDriver -> \Device\Scsi\nvidesm1Port0Path0Target0Lun0[0x8232a030]
22:03:42.250 AVAST engine scan C:\WINDOWS
22:04:00.906 File: C:\WINDOWS\TMP_FILE_4.tmp **INFECTED** Win32:Adware-gen [Adw]
22:04:05.312 AVAST engine scan C:\WINDOWS\system32
22:06:46.984 AVAST engine scan C:\WINDOWS\system32\drivers
22:07:09.187 AVAST engine scan C:\Documents and Settings\Peter
22:26:02.953 File: C:\Documents and Settings\Peter\My Documents\Firefox-Downloads\cnet2_fvdsuite-2_6_9-release_exe.exe **HIDDEN**
22:27:53.781 File: C:\Documents and Settings\Peter\My Documents\Firefox-Downloads\wrar401.exe **HIDDEN**
22:27:58.250 AVAST engine scan C:\Documents and Settings\All Users
22:35:17.796 Scan finished successfully
22:40:35.046 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Peter\Desktop\MBR.dat"
22:40:35.109 The log file has been saved successfully to "C:\Documents and Settings\Peter\Desktop\aswMBR.txt"

OTL log to follow:

OTL logfile created on: 1/13/2012 2:10:18 PM - Run 2
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Peter\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.48 Mb Total Physical Memory | 84.29 Mb Available Physical Memory | 16.48% Memory free
1.22 Gb Paging File | 0.87 Gb Available in Paging File | 70.87% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 57.26 Gb Total Space | 10.02 Gb Free Space | 17.49% Space Free | Partition Type: NTFS
Drive D: | 306.88 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 298.09 Gb Total Space | 66.25 Gb Free Space | 22.23% Space Free | Partition Type: NTFS

Computer Name: PH | User Name: Peter | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days

========== Custom Scans ==========



< MD5 for: ACPI.INF >
[2003/03/31 07:00:00 | 000,004,727 | —- | M] () MD5=51FE7D176D893D40FE7A4036B2D9C982 – C:\WINDOWS\inf\acpi.inf
[2003/03/31 07:00:00 | 000,004,727 | —- | M] () MD5=51FE7D176D893D40FE7A4036B2D9C982 – C:\WINDOWS\ServicePackFiles\i386\acpi.inf

< MD5 for: ACPI.PNF >
[2004/04/12 18:05:58 | 000,012,512 | —- | M] () MD5=5920141B9E3B57B4F3B5CEBD680BE907 – C:\WINDOWS\inf\acpi.PNF

< MD5 for: ACPI.SYS >
[2008/04/13 13:36:35 | 000,187,776 | —- | M] (Microsoft Corporation) MD5=8FD99680A539792A30E97944FDAECF17 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\acpi.sys
[2003/03/31 07:00:00 | 000,179,328 | —- | M] (Microsoft Corporation) MD5=94DDD4B3ACBD7A9558E1762CD58386F9 – C:\WINDOWS\$NtServicePackUninstall$\acpi.sys
[2004/08/04 01:07:38 | 000,187,776 | —- | M] (Microsoft Corporation) MD5=A10C7534F7223F4A73A948967D00E69B – C:\WINDOWS\ServicePackFiles\i386\acpi.sys
[2004/08/04 01:07:38 | 000,187,776 | —- | M] (Microsoft Corporation) MD5=A10C7534F7223F4A73A948967D00E69B – C:\WINDOWS\system32\drivers\acpi.sys

< MD5 for: AFD.SYS >
[2008/04/13 14:19:23 | 000,138,112 | —- | M] (Microsoft Corporation) MD5=322D0E36693D6E24A2398BEE62A268CD – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\afd.sys
[2008/08/14 05:34:26 | 000,138,496 | —- | M] (Microsoft Corporation) MD5=4D43E74F2A1239D53929B82600F1971C – C:\WINDOWS\$hf_mig$\KB956803\SP3QFE\afd.sys
[2003/03/31 07:00:00 | 000,131,968 | —- | M] (Microsoft Corporation) MD5=51B1872B62D1C335BAC53313913C8D5B – C:\WINDOWS\$NtServicePackUninstall$\afd.sys
[2008/08/14 04:51:43 | 000,138,368 | —- | M] (Microsoft Corporation) MD5=55E6E1C51B6D30E54335750955453702 – C:\WINDOWS\system32\dllcache\afd.sys
[2008/08/14 04:51:43 | 000,138,368 | —- | M] (Microsoft Corporation) MD5=55E6E1C51B6D30E54335750955453702 – C:\WINDOWS\system32\drivers\afd.sys
[2004/08/04 01:14:14 | 000,138,496 | —- | M] (Microsoft Corporation) MD5=5AC495F4CB807B2B98AD2AD591E6D92E – C:\WINDOWS\$NtUninstallKB951748$\afd.sys
[2004/08/04 01:14:14 | 000,138,496 | —- | M] (Microsoft Corporation) MD5=5AC495F4CB807B2B98AD2AD591E6D92E – C:\WINDOWS\ServicePackFiles\i386\afd.sys
[2008/08/14 04:48:52 | 000,138,368 | —- | M] (Microsoft Corporation) MD5=6A0397376853E604DE8E1E7A87FC08AC – C:\WINDOWS\$hf_mig$\KB956803\SP2QFE\afd.sys
[2008/08/14 05:04:36 | 000,138,496 | —- | M] (Microsoft Corporation) MD5=7E775010EF291DA96AD17CA4B17137D7 – C:\WINDOWS\$hf_mig$\KB956803\SP3GDR\afd.sys
[2008/06/20 05:44:38 | 000,138,368 | —- | M] (Microsoft Corporation) MD5=944CA435BFCFC82CC1ED9E3A7D731AA9 – C:\WINDOWS\$NtUninstallKB956803$\afd.sys
[2008/06/20 06:48:03 | 000,138,496 | —- | M] (Microsoft Corporation) MD5=D6EE6014241D034E63C49A50CB2B442A – C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\afd.sys
[2008/06/20 05:44:08 | 000,138,368 | —- | M] (Microsoft Corporation) MD5=D99DDFFB33DEACDCF20717CB520379F6 – C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\afd.sys
[2008/06/20 06:40:08 | 000,138,496 | —- | M] (Microsoft Corporation) MD5=E3049B90FE06F3F740B7CFDA44995E2C – C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\afd.sys

< MD5 for: FASTFAT.SYS >
[2004/08/04 01:14:16 | 000,143,360 | —- | M] (Microsoft Corporation) MD5=3117F595E9615E04F05A54FC15A03B20 – C:\WINDOWS\ServicePackFiles\i386\fastfat.sys
[2004/08/04 01:14:16 | 000,143,360 | —- | M] (Microsoft Corporation) MD5=3117F595E9615E04F05A54FC15A03B20 – C:\WINDOWS\system32\drivers\fastfat.sys
[2008/04/13 14:14:29 | 000,143,744 | —- | M] (Microsoft Corporation) MD5=38D332A6D56AF32635675F132548343E – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\fastfat.sys
[2003/03/31 07:00:00 | 000,145,152 | —- | M] (Microsoft Corporation) MD5=E4A3A8F3E60B542A747B10E86FAA5DAD – C:\WINDOWS\$NtServicePackUninstall$\fastfat.sys

< MD5 for: HAL.DLL >
[2008/04/13 13:31:32 | 000,105,344 | —- | M] (Microsoft Corporation) MD5=6DB1E72AD3B372DFC451B7F54BA08AA7 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\hal.dll
[2004/08/04 00:59:19 | 000,105,472 | —- | M] (Microsoft Corporation) MD5=C321C95318495909A0066FB0EDC97287 – C:\WINDOWS\ServicePackFiles\i386\hal.dll
[2003/03/31 07:00:00 | 000,127,872 | —- | M] (Microsoft Corporation) MD5=E8D2B5D5186A9B93D7019D7A74D77A1E – C:\WINDOWS\$NtServicePackUninstall$\hal.dll
[2004/08/04 00:59:09 | 000,131,968 | —- | M] (Microsoft Corporation) MD5=F9A0F579FC18036FFDD9E26E0D268CCD – C:\WINDOWS\system32\HAL.DLL

< MD5 for: HAL.INF >
[2003/03/31 07:00:00 | 000,006,053 | —- | M] () MD5=7C10F1B5639ACF1949A82EFA6CB94A54 – C:\WINDOWS\inf\hal.inf

< MD5 for: HAL.PNF >
[2004/04/12 18:06:02 | 000,011,468 | —- | M] () MD5=22285353A524AA55FD1C4195085544C9 – C:\WINDOWS\inf\hal.PNF

< MD5 for: IPSEC.SYS >
[2003/03/31 07:00:00 | 000,057,984 | —- | M] (Microsoft Corporation) MD5=1C4802409CFD4A7051F458B744CFCAA5 – C:\WINDOWS\$NtServicePackUninstall$\ipsec.sys
[2008/04/13 14:19:42 | 000,075,264 | —- | M] (Microsoft Corporation) MD5=23C74D75E36E7158768DD63D92789A91 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\ipsec.sys
[2004/08/04 01:14:28 | 000,074,752 | —- | M] (Microsoft Corporation) MD5=64537AA5C003A6AFEEE1DF819062D0D1 – C:\WINDOWS\ServicePackFiles\i386\ipsec.sys
[2004/08/04 01:14:28 | 000,074,752 | —- | M] (Microsoft Corporation) MD5=64537AA5C003A6AFEEE1DF819062D0D1 – C:\WINDOWS\system32\drivers\ipsec.sys

< MD5 for: KSECDD.SYS >
[2008/04/13 13:31:43 | 000,092,288 | —- | M] (Microsoft Corporation) MD5=1705745D900DABF2D89F90EBADDC7517 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\ksecdd.sys
[2009/06/22 06:35:44 | 000,092,544 | —- | M] (Microsoft Corporation) MD5=1BE7CC2535D760AE4D481576EB789F24 – C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\ksecdd.sys
[2009/06/22 06:34:52 | 000,092,544 | —- | M] (Microsoft Corporation) MD5=674D3E5A593475915DC6643317192403 – C:\WINDOWS\system32\dllcache\ksecdd.sys
[2009/06/22 06:34:52 | 000,092,544 | —- | M] (Microsoft Corporation) MD5=674D3E5A593475915DC6643317192403 – C:\WINDOWS\system32\drivers\ksecdd.sys
[2003/03/31 07:00:00 | 000,079,744 | —- | M] (Microsoft Corporation) MD5=ABC70E8B89CCE44731A346DEB764BF95 – C:\WINDOWS\$NtServicePackUninstall$\ksecdd.sys
[2009/06/24 06:18:41 | 000,092,928 | —- | M] (Microsoft Corporation) MD5=B467646C54CC746128904E1654C750C1 – C:\WINDOWS\$hf_mig$\KB968389\SP3GDR\ksecdd.sys
[2009/06/24 05:28:51 | 000,092,928 | —- | M] (Microsoft Corporation) MD5=C6EBF1D6AD71DF30DB49B8D3287E1368 – C:\WINDOWS\$hf_mig$\KB968389\SP3QFE\ksecdd.sys
[2004/08/04 00:59:47 | 000,092,032 | —- | M] (Microsoft Corporation) MD5=EB7FFE87FD367EA8FCA0506F74A87FBB – C:\WINDOWS\$NtUninstallKB968389$\ksecdd.sys
[2004/08/04 00:59:47 | 000,092,032 | —- | M] (Microsoft Corporation) MD5=EB7FFE87FD367EA8FCA0506F74A87FBB – C:\WINDOWS\ServicePackFiles\i386\ksecdd.sys

< MD5 for: MRXSMB.SYS >
[2006/05/05 04:41:45 | 000,453,120 | —- | M] (Microsoft Corporation) MD5=025AF03CE51645C62F3B6907A7E2BE5E – C:\WINDOWS\$NtUninstallKB957097$\mrxsmb.sys
[2004/08/04 01:15:16 | 000,451,456 | —- | M] (Microsoft Corporation) MD5=1FD607FC67F7F7C633C3DA65BFC53D18 – C:\WINDOWS\$NtUninstallKB885835$\mrxsmb.sys
[2004/08/04 01:15:16 | 000,451,456 | —- | M] (Microsoft Corporation) MD5=1FD607FC67F7F7C633C3DA65BFC53D18 – C:\WINDOWS\ServicePackFiles\i386\mrxsmb.sys
[2010/02/24 07:48:23 | 000,457,216 | —- | M] (Microsoft Corporation) MD5=3500E756812E716351F2D341AE1D5623 – C:\WINDOWS\$hf_mig$\KB980232\SP2QFE\mrxsmb.sys
[2005/01/18 23:26:52 | 000,451,584 | —- | M] (Microsoft Corporation) MD5=5DDC9A1B2EB5A4BF010CE8C019A18C1F – C:\WINDOWS\$NtUninstallKB914389$\mrxsmb.sys
[2008/10/24 06:21:09 | 000,455,296 | —- | M] (Microsoft Corporation) MD5=60AE98742484E7AB80C3C1450E708148 – C:\WINDOWS\$hf_mig$\KB957097\SP3GDR\mrxsmb.sys
[2008/04/13 14:17:01 | 000,456,576 | —- | M] (Microsoft Corporation) MD5=68755F0FF16070178B54674FE5B847B0 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\mrxsmb.sys
[2008/10/24 06:10:42 | 000,453,632 | —- | M] (Microsoft Corporation) MD5=6F2D483B97B395544E59749C47963C6A – C:\WINDOWS\$NtUninstallKB980232$\mrxsmb.sys
[2008/10/24 06:41:11 | 000,455,936 | —- | M] (Microsoft Corporation) MD5=7170AB42B51954DEF2781A4D1CCE65F4 – C:\WINDOWS\$hf_mig$\KB957097\SP3QFE\mrxsmb.sys
[2006/05/05 05:16:39 | 000,454,400 | —- | M] (Microsoft Corporation) MD5=7412CE77C6FD823F8889B4DF420C680B – C:\WINDOWS\$hf_mig$\KB914389\SP2QFE\mrxsmb.sys
[2003/03/31 07:00:00 | 000,407,552 | —- | M] (Microsoft Corporation) MD5=7A3A2BE44E12E2ABDE1AF891E83AC130 – C:\WINDOWS\$NtUninstallKB826939$\mrxsmb.sys
[2005/01/18 22:51:57 | 000,451,584 | —- | M] (Microsoft Corporation) MD5=7B195060FF456FA65954C72C5C1640FF – C:\WINDOWS\$hf_mig$\KB885250\SP2QFE\mrxsmb.sys
[2004/10/27 20:15:16 | 000,448,128 | —- | M] (Microsoft Corporation) MD5=A1BE3CB080DCC0A8270D21E3CA3B7005 – C:\WINDOWS\$hf_mig$\KB885835\SP2QFE\mrxsmb.sys
[2004/10/27 20:14:18 | 000,448,128 | —- | M] (Microsoft Corporation) MD5=C9D17DAA82B917CF2FD6E4F595974934 – C:\WINDOWS\$hf_mig$\KB885835\SP2GDR\mrxsmb.sys
[2004/10/27 20:14:18 | 000,448,128 | —- | M] (Microsoft Corporation) MD5=C9D17DAA82B917CF2FD6E4F595974934 – C:\WINDOWS\$NtUninstallKB885250$\mrxsmb.sys
[2008/10/24 06:25:29 | 000,455,936 | —- | M] (Microsoft Corporation) MD5=D07DA410091143336DAE419A921AAE2B – C:\WINDOWS\$hf_mig$\KB957097\SP2QFE\mrxsmb.sys
[2010/02/24 06:57:57 | 000,457,216 | —- | M] (Microsoft Corporation) MD5=D09B9F0B9960DD41E73127B7814C115F – C:\WINDOWS\$hf_mig$\KB980232\SP3QFE\mrxsmb.sys
[2002/11/18 13:27:40 | 000,392,576 | —- | M] (Microsoft Corporation) MD5=D4BD5EF775AD4FB0B8E3786F674DABDD – C:\WINDOWS\$NtUninstallKB885835_0$\mrxsmb.sys
[2004/10/12 11:22:52 | 000,436,608 | —- | M] (Microsoft Corporation) MD5=E5D956E9839C75CCABDDEDC07E17670C – C:\WINDOWS\$NtServicePackUninstall$\mrxsmb.sys
[2010/02/24 08:11:07 | 000,455,680 | —- | M] (Microsoft Corporation) MD5=F3AEFB11ABC521122B67095044169E98 – C:\WINDOWS\$hf_mig$\KB980232\SP3GDR\mrxsmb.sys
[2010/02/24 07:31:30 | 000,454,016 | —- | M] (Microsoft Corporation) MD5=FB6C89BB3CE282B08BDB1E3C179E1C39 – C:\WINDOWS\Driver Cache\i386\mrxsmb.sys
[2010/02/24 07:31:30 | 000,454,016 | —- | M] (Microsoft Corporation) MD5=FB6C89BB3CE282B08BDB1E3C179E1C39 – C:\WINDOWS\system32\dllcache\mrxsmb.sys
[2010/02/24 07:31:30 | 000,454,016 | —- | M] (Microsoft Corporation) MD5=FB6C89BB3CE282B08BDB1E3C179E1C39 – C:\WINDOWS\system32\drivers\mrxsmb.sys

< MD5 for: MUP.SYS >
[2003/03/31 07:00:00 | 000,104,064 | —- | M] (Microsoft Corporation) MD5=08C56887F06473B09FC1B39E7DEC0FB6 – C:\WINDOWS\$NtServicePackUninstall$\mup.sys
[2008/04/13 14:17:05 | 000,105,344 | —- | M] (Microsoft Corporation) MD5=2F625D11385B1A94360BFC70AAEFDEE1 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\mup.sys
[2004/08/04 01:15:20 | 000,107,904 | —- | M] (Microsoft Corporation) MD5=82035E0F41C2DD05AE41D27FE6CF7DE1 – C:\WINDOWS\ServicePackFiles\i386\mup.sys
[2004/08/04 01:15:20 | 000,107,904 | —- | M] (Microsoft Corporation) MD5=82035E0F41C2DD05AE41D27FE6CF7DE1 – C:\WINDOWS\system32\drivers\mup.sys

< MD5 for: NDIS.SYS >
[2008/04/13 14:20:37 | 000,182,656 | —- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\ndis.sys
[2003/03/31 07:00:00 | 000,167,552 | —- | M] (Microsoft Corporation) MD5=3B350E5A2A5E951453F3993275A4523A – C:\WINDOWS\$NtUninstallKB826942$\ndis.sys
[2004/08/04 01:14:28 | 000,182,912 | —- | M] (Microsoft Corporation) MD5=558635D3AF1C7546D26067D5D9B6959E – C:\WINDOWS\ServicePackFiles\i386\ndis.sys
[2004/08/04 01:14:28 | 000,182,912 | —- | M] (Microsoft Corporation) MD5=558635D3AF1C7546D26067D5D9B6959E – C:\WINDOWS\system32\drivers\ndis.sys
[2003/10/04 02:54:08 | 000,168,192 | —- | M] (Microsoft Corporation) MD5=D999CE17681D7D074D534FC5BC662E0A – C:\WINDOWS\$NtServicePackUninstall$\ndis.sys

< MD5 for: NETBT.SYS >
[2004/08/04 01:14:37 | 000,162,816 | —- | M] (Microsoft Corporation) MD5=0C80E410CD2F47134407EE7DD19CC86B – C:\WINDOWS\ServicePackFiles\i386\netbt.sys
[2004/08/04 01:14:37 | 000,162,816 | —- | M] (Microsoft Corporation) MD5=0C80E410CD2F47134407EE7DD19CC86B – C:\WINDOWS\system32\drivers\netbt.sys
[2008/04/13 14:21:00 | 000,162,816 | —- | M] (Microsoft Corporation) MD5=74B2B2F5BEA5E9A3DC021D685551BD3D – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\netbt.sys
[2003/07/08 18:48:54 | 000,149,248 | —- | M] (Microsoft Corporation) MD5=C6ED759F45B762CD5C1F69023AB90F4C – C:\WINDOWS\$NtServicePackUninstall$\netbt.sys
[2003/03/31 07:00:00 | 000,157,056 | —- | M] (Microsoft Corporation) MD5=D96F3BC5A6E7452B0E3275B560DC8528 – C:\WINDOWS\$NtUninstallKB824105$\netbt.sys

< MD5 for: NTDLL.DLL >
[2008/04/13 19:11:24 | 000,706,048 | —- | M] (Microsoft Corporation) MD5=27D9ED8CB8B62D1E0A8E5ACE6CF52E2F – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\ntdll.dll
[2009/02/09 05:01:52 | 000,715,264 | —- | M] (Microsoft Corporation) MD5=2F868BFFBF50524653D7FE0D99AFB064 – C:\WINDOWS\$hf_mig$\KB956572\SP2QFE\ntdll.dll
[2003/05/01 18:56:12 | 000,654,336 | —- | M] (Microsoft Corporation) MD5=8FAB3A5FB1ACAD55D2A4837A4FFE4D5C – C:\WINDOWS\$NtServicePackUninstall$\ntdll.dll
[2009/02/09 07:10:48 | 000,714,752 | —- | M] (Microsoft Corporation) MD5=911DDF2E16761643A47225F654D811E5 – C:\WINDOWS\$hf_mig$\KB956572\SP3GDR\ntdll.dll
[2003/03/31 07:00:00 | 000,668,672 | —- | M] (Microsoft Corporation) MD5=983940F6627F77C250BE0AE398FC53FB – C:\WINDOWS\$NtUninstallKB826939$\ntdll.dll
[2009/02/09 05:56:35 | 000,715,264 | —- | M] (Microsoft Corporation) MD5=B0913005EE3FC15D7F72472D0B8A30EB – C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\ntdll.dll
[2004/08/04 02:56:36 | 000,708,096 | —- | M] (Microsoft Corporation) MD5=BB5CBFFC096497506167BCE1D9690EF2 – C:\WINDOWS\$NtUninstallKB956572$\ntdll.dll
[2004/08/04 02:56:36 | 000,708,096 | —- | M] (Microsoft Corporation) MD5=BB5CBFFC096497506167BCE1D9690EF2 – C:\WINDOWS\ServicePackFiles\i386\ntdll.dll
[2009/02/09 05:20:33 | 000,714,752 | —- | M] (Microsoft Corporation) MD5=C06986B55981B355090DD34DE809E4BB – C:\WINDOWS\system32\dllcache\ntdll.dll
[2009/02/09 05:20:33 | 000,714,752 | —- | M] (Microsoft Corporation) MD5=C06986B55981B355090DD34DE809E4BB – C:\WINDOWS\system32\ntdll.dll

< MD5 for: NTFS.SYS >
[2007/02/09 06:23:36 | 000,574,976 | —- | M] (Microsoft Corporation) MD5=05AB81909514BFD69CBB1F2C147CF6B9 – C:\WINDOWS\$hf_mig$\KB930916\SP2QFE\ntfs.sys
[2007/02/09 06:10:35 | 000,574,464 | —- | M] (Microsoft Corporation) MD5=19A811EF5F1ED5C926A028CE107FF1AF – C:\WINDOWS\system32\dllcache\ntfs.sys
[2007/02/09 06:10:35 | 000,574,464 | —- | M] (Microsoft Corporation) MD5=19A811EF5F1ED5C926A028CE107FF1AF – C:\WINDOWS\system32\drivers\ntfs.sys
[2008/04/13 14:15:53 | 000,574,976 | —- | M] (Microsoft Corporation) MD5=78A08DD6A8D65E697C18E1DB01C5CDCA – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\ntfs.sys
[2004/08/04 01:15:09 | 000,574,592 | —- | M] (Microsoft Corporation) MD5=B78BE402C3F63DD55521F73876951CDD – C:\WINDOWS\$NtUninstallKB930916$\ntfs.sys
[2004/08/04 01:15:09 | 000,574,592 | —- | M] (Microsoft Corporation) MD5=B78BE402C3F63DD55521F73876951CDD – C:\WINDOWS\ServicePackFiles\i386\ntfs.sys
[2003/03/31 07:00:00 | 000,561,920 | —- | M] (Microsoft Corporation) MD5=E3AE9C79498210A5F39FE5A9AD62BC55 – C:\WINDOWS\$NtServicePackUninstall$\ntfs.sys

< MD5 for: SCSIPORT.SYS >
[2008/04/13 13:40:30 | 000,096,384 | —- | M] (Microsoft Corporation) MD5=76C465F570E90C28942D52CCB2580A10 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\scsiport.sys
[2004/08/04 00:59:41 | 000,096,256 | —- | M] (Microsoft Corporation) MD5=D7FD0FF761E28AC0EA35AD71E0CD67E9 – C:\WINDOWS\ServicePackFiles\i386\scsiport.sys
[2004/08/04 00:59:41 | 000,096,256 | —- | M] (Microsoft Corporation) MD5=D7FD0FF761E28AC0EA35AD71E0CD67E9 – C:\WINDOWS\system32\drivers\scsiport.sys
[2003/03/31 07:00:00 | 000,090,240 | —- | M] (Microsoft Corporation) MD5=F1D2D6D805AE2856F3D923E949AD917D – C:\WINDOWS\$NtServicePackUninstall$\scsiport.sys

< MD5 for: SRV.SYS >
[2003/03/28 13:54:56 | 000,322,048 | —- | M] (Microsoft Corporation) MD5=042BEB03B0E917B530E78B8A08D48749 – C:\WINDOWS\$NtServicePackUninstall$\srv.sys
[2004/08/04 01:14:45 | 000,336,256 | —- | M] (Microsoft Corporation) MD5=20B7E396720353E4117D64D9DCB926CA – C:\WINDOWS\$NtUninstallKB896422$\srv.sys
[2004/08/04 01:14:45 | 000,336,256 | —- | M] (Microsoft Corporation) MD5=20B7E396720353E4117D64D9DCB926CA – C:\WINDOWS\ServicePackFiles\i386\srv.sys
[2010/01/01 02:58:29 | 000,353,792 | —- | M] (Microsoft Corporation) MD5=30EFED0C77D59AE0CACB0B5C756767ED – C:\WINDOWS\$hf_mig$\KB971468\SP3QFE\srv.sys
[2008/12/11 05:57:09 | 000,333,952 | —- | M] (Microsoft Corporation) MD5=3BB03F2BA89D2BE417206C373D2AF17C – C:\WINDOWS\$hf_mig$\KB958687\SP3GDR\srv.sys
[2008/09/08 05:41:42 | 000,333,824 | —- | M] (Microsoft Corporation) MD5=4F8A43ADEF66F135564085A9DCA96A26 – C:\WINDOWS\$hf_mig$\KB957095\SP3GDR\srv.sys
[2006/08/14 07:00:42 | 000,332,928 | —- | M] (Microsoft Corporation) MD5=5230953C21C811B5FC1FF31AE2B48097 – C:\WINDOWS\$hf_mig$\KB923414\SP2QFE\srv.sys
[2008/04/13 14:15:11 | 000,334,848 | —- | M] (Microsoft Corporation) MD5=5252605079810904E31C332E241CD59B – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\srv.sys
[2005/05/09 19:22:21 | 000,332,544 | —- | M] (Microsoft Corporation) MD5=54E79B08D0ABC9C551D0FE69CC2F87EC – C:\WINDOWS\$hf_mig$\KB896422\SP2QFE\srv.sys
[2005/05/09 19:17:51 | 000,332,544 | —- | M] (Microsoft Corporation) MD5=553007ECCE7F6565BBE645BEB66D3B69 – C:\WINDOWS\$NtUninstallKB917159$\srv.sys
[2006/04/21 01:46:15 | 000,332,800 | —- | M] (Microsoft Corporation) MD5=58BB0CC6BE72899190505741E3B83464 – C:\WINDOWS\$hf_mig$\KB917159\SP2QFE\srv.sys
[2008/08/28 05:35:33 | 000,333,056 | —- | M] (Microsoft Corporation) MD5=5BFA06B8583279D277CCB469A9983998 – C:\WINDOWS\$hf_mig$\KB957095\SP2QFE\srv.sys
[2008/12/11 05:24:44 | 000,333,184 | —- | M] (Microsoft Corporation) MD5=6BFA2B79451F961D4A3DD896659193DF – C:\WINDOWS\$hf_mig$\KB958687\SP2QFE\srv.sys
[2008/08/28 05:04:17 | 000,333,056 | —- | M] (Microsoft Corporation) MD5=7A0111577D8046633D5162A3CE15E9E1 – C:\WINDOWS\$NtUninstallKB958687$\srv.sys
[2009/12/31 11:14:12 | 000,352,640 | —- | M] (Microsoft Corporation) MD5=7A4F147CC6B133F905F6E65E2F8669FB – C:\WINDOWS\system32\dllcache\srv.sys
[2009/12/31 11:14:12 | 000,352,640 | —- | M] (Microsoft Corporation) MD5=7A4F147CC6B133F905F6E65E2F8669FB – C:\WINDOWS\system32\drivers\srv.sys
[2009/12/31 11:50:03 | 000,353,792 | —- | M] (Microsoft Corporation) MD5=89220B427890AA1DFFD1A02648AE51C3 – C:\WINDOWS\$hf_mig$\KB971468\SP3GDR\srv.sys
[2003/03/31 07:00:00 | 000,330,368 | —- | M] (Microsoft Corporation) MD5=94619EB663216F9BF12F9B950FCAB3C0 – C:\WINDOWS\$NtUninstallKB826939$\srv.sys
[2008/12/11 06:57:21 | 000,333,184 | —- | M] (Microsoft Corporation) MD5=AB9C79ED12D65E800AAAD3D72A04792F – C:\WINDOWS\$NtUninstallKB971468$\srv.sys
[2008/09/08 06:37:19 | 000,333,824 | —- | M] (Microsoft Corporation) MD5=AE4D13B572399B206B43D65DA4D9983D – C:\WINDOWS\$hf_mig$\KB957095\SP3QFE\srv.sys
[2009/12/31 10:06:53 | 000,352,640 | —- | M] (Microsoft Corporation) MD5=D4AF9861C3B6A2163D26DC6B9CF05E2A – C:\WINDOWS\$hf_mig$\KB971468\SP2QFE\srv.sys
[2006/04/21 01:12:27 | 000,332,800 | —- | M] (Microsoft Corporation) MD5=E03B4EA274C9E509CCA7F9F0CEC24232 – C:\WINDOWS\$NtUninstallKB923414$\srv.sys
[2008/12/11 07:33:59 | 000,333,952 | —- | M] (Microsoft Corporation) MD5=E89B42B216BC86ADA4345908284519CB – C:\WINDOWS\$hf_mig$\KB958687\SP3QFE\srv.sys
[2006/08/14 05:34:41 | 000,332,928 | —- | M] (Microsoft Corporation) MD5=EA554A3FFC3F536FE8320EB38F5E4843 – C:\WINDOWS\$NtUninstallKB957095$\srv.sys

< MD5 for: TCPIP.CHM >
[2003/03/31 07:00:00 | 000,038,234 | —- | M] () MD5=11F1003A66472DBCBD02A54E9CB4163C – C:\WINDOWS\Help\tcpip.chm

< MD5 for: TCPIP.SYS >
[2006/04/20 06:51:50 | 000,359,808 | —- | M] (Microsoft Corporation) MD5=1DBF125862891817F374F407626967F4 – C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys
[2003/03/31 07:00:00 | 000,332,928 | —- | M] (Microsoft Corporation) MD5=244A2F9816BC9B593957281EF577D976 – C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
[2008/06/20 05:45:13 | 000,360,320 | —- | M] (Microsoft Corporation) MD5=2A5554FC5B1E04E131230E3CE035C3F9 – C:\WINDOWS\system32\dllcache\tcpip.sys
[2008/06/20 05:45:13 | 000,360,320 | —- | M] (Microsoft Corporation) MD5=2A5554FC5B1E04E131230E3CE035C3F9 – C:\WINDOWS\system32\drivers\tcpip.sys
[2006/01/13 12:07:08 | 000,360,448 | —- | M] (Microsoft Corporation) MD5=5562CC0A47B2AEF06D3417B733F3C195 – C:\WINDOWS\$hf_mig$\KB913446\SP2QFE\tcpip.sys
[2006/01/12 21:28:14 | 000,359,808 | —- | M] (Microsoft Corporation) MD5=583E063FDC888CA30D05C2724B0D7EF4 – C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
[2005/05/25 14:07:12 | 000,359,936 | —- | M] (Microsoft Corporation) MD5=63FDFEA54EB53DE2D863EE454937CE1E – C:\WINDOWS\$hf_mig$\KB893066\SP2QFE\tcpip.sys
[2007/10/30 11:53:32 | 000,360,832 | —- | M] (Microsoft Corporation) MD5=64798ECFA43D78C7178375FCDD16D8C8 – C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[2008/06/20 05:44:42 | 000,360,960 | —- | M] (Microsoft Corporation) MD5=744E57C99232201AE98C49168B918F48 – C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[2005/05/25 14:04:02 | 000,359,808 | —- | M] (Microsoft Corporation) MD5=88763A98A4C26C409741B4AA162720C9 – C:\WINDOWS\$NtUninstallKB913446$\tcpip.sys
[2007/10/30 12:20:55 | 000,360,064 | —- | M] (Microsoft Corporation) MD5=90CAFF4B094573449A0872A0F919B178 – C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys
[2008/04/13 14:20:16 | 000,361,344 | —- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\tcpip.sys
[2008/06/20 06:51:12 | 000,361,600 | —- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D – C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[2004/08/04 01:14:40 | 000,359,040 | —- | M] (Microsoft Corporation) MD5=9F4B36614A0FC234525BA224957DE55C – C:\WINDOWS\$NtUninstallKB893066$\tcpip.sys
[2004/08/04 01:14:40 | 000,359,040 | —- | M] (Microsoft Corporation) MD5=9F4B36614A0FC234525BA224957DE55C – C:\WINDOWS\ServicePackFiles\i386\tcpip.sys
[2008/06/20 06:59:02 | 000,361,600 | —- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E – C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[2006/04/20 07:18:35 | 000,360,576 | —- | M] (Microsoft Corporation) MD5=B2220C618B42A2212A59D91EBD6FC4B4 – C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys

< MD5 for: USBPORT.INF >
[2003/03/31 07:00:00 | 000,021,090 | —- | M] () MD5=9183581BC11D3B7CB05109E0A9F4B6B2 – C:\WINDOWS\$NtServicePackUninstall$\usbport.inf
[2008/04/13 11:31:42 | 000,023,708 | —- | M] () MD5=A8EA9342527A8E1916D08F78285230F2 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\ic\usbport.inf
[2004/08/04 00:11:08 | 000,023,708 | —- | M] () MD5=C95B6D242641267E83DEA82290F55048 – C:\WINDOWS\inf\usbport.inf
[2004/08/04 00:11:08 | 000,023,708 | —- | M] () MD5=C95B6D242641267E83DEA82290F55048 – C:\WINDOWS\ServicePackFiles\i386\usbport.inf

< MD5 for: USBPORT.PNF >
[2005/04/16 11:15:03 | 000,051,448 | —- | M] () MD5=0576637A0885B7B1685E613BDB3F7D69 – C:\WINDOWS\inf\usbport.PNF

< MD5 for: USBPORT.SYS >
[2004/08/04 01:08:42 | 000,142,976 | —- | M] (Microsoft Corporation) MD5=2034CA78F9C6E787B4B76D81AC888351 – C:\WINDOWS\ServicePackFiles\i386\usbport.sys
[2004/08/04 01:08:42 | 000,142,976 | —- | M] (Microsoft Corporation) MD5=2034CA78F9C6E787B4B76D81AC888351 – C:\WINDOWS\system32\drivers\usbport.sys
[2003/03/31 07:00:00 | 000,135,552 | —- | M] (Microsoft Corporation) MD5=2ECABA73E8A4E58499BCC1FDB534EF34 – C:\WINDOWS\$NtUninstallKB822603$\usbport.sys
[2003/07/03 16:49:30 | 000,138,752 | —- | M] (Microsoft Corporation) MD5=53780A23FDC340D77B29DDF592F2E2CC – C:\WINDOWS\$NtServicePackUninstall$\usbport.sys
[2008/04/13 13:45:36 | 000,143,872 | —- | M] (Microsoft Corporation) MD5=791912E524CC2CC6F50B5F2B52D1EB71 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\usbport.sys

< MD5 for: WIN32K.SYS >
[2009/02/09 06:13:27 | 001,846,784 | —- | M] (Microsoft Corporation) MD5=16B961A0552BC09B9E3A338FC816FFE5 – C:\WINDOWS\$hf_mig$\KB958690\SP3GDR\win32k.sys
[2009/02/09 06:08:53 | 001,847,552 | —- | M] (Microsoft Corporation) MD5=1D20198F208006C3BB5ACB50D32CFC66 – C:\WINDOWS\$hf_mig$\KB958690\SP3QFE\win32k.sys
[2003/03/31 07:00:00 | 001,813,632 | —- | M] (Microsoft Corporation) MD5=5448B072D5754F286859901C7F4E8F67 – C:\WINDOWS\$NtUninstallKB826939$\win32k.sys
[2007/03/08 08:47:48 | 001,843,584 | —- | M] (Microsoft Corporation) MD5=5B5AD4F40BE00F56F51F286BE72C0376 – C:\WINDOWS\$NtUninstallKB954211$\win32k.sys
[2008/09/15 07:25:27 | 001,846,912 | —- | M] (Microsoft Corporation) MD5=692E8FC363300FA7951594A1A7A1F193 – C:\WINDOWS\$hf_mig$\KB954211\SP3QFE\win32k.sys
[2010/05/02 00:56:34 | 001,850,880 | —- | M] (Microsoft Corporation) MD5=7190A8EBD16D56C78864E49C9BB5FE7D – C:\WINDOWS\system32\dllcache\win32k.sys
[2010/05/02 00:56:34 | 001,850,880 | —- | M] (Microsoft Corporation) MD5=7190A8EBD16D56C78864E49C9BB5FE7D – C:\WINDOWS\system32\win32k.sys
[2008/09/15 07:17:07 | 001,846,912 | —- | M] (Microsoft Corporation) MD5=88D9ED62433A8C3F1F8D20E97F20A1AD – C:\WINDOWS\$hf_mig$\KB954211\SP2QFE\win32k.sys
[2002/10/23 10:55:02 | 001,694,336 | —- | M] (Microsoft Corporation) MD5=8E0799A05EF782C1DD9E6F95FFE73F6F – C:\WINDOWS\$NtUninstallKB824141$\win32k.sys
[2005/10/05 19:10:04 | 001,839,360 | —- | M] (Microsoft Corporation) MD5=98D0393AEBA65F52FE5B66845C5F3A6A – C:\WINDOWS\$hf_mig$\KB896424\SP2QFE\win32k.sys
[2010/05/02 01:34:15 | 001,860,352 | —- | M] (Microsoft Corporation) MD5=A3D4A7B714D4A74B7CD4296302F1A9FA – C:\WINDOWS\$hf_mig$\KB979559\SP3QFE\win32k.sys
[2005/10/05 19:05:59 | 001,839,488 | —- | M] (Microsoft Corporation) MD5=AD247B4B1EB5FA17C73908CFAE001237 – C:\WINDOWS\$NtUninstallKB925902$\win32k.sys
[2003/09/25 11:35:48 | 001,796,864 | —- | M] (Microsoft Corporation) MD5=B119A168C9E9E1C346890D7607B7BFFA – C:\WINDOWS\$NtUninstallKB840987$\win32k.sys
[2008/09/15 06:57:41 | 001,846,016 | —- | M] (Microsoft Corporation) MD5=B34375E53CDEDF4BDFE3EB2A271FB398 – C:\WINDOWS\$NtUninstallKB958690$\win32k.sys
[2004/08/04 01:17:40 | 001,835,904 | —- | M] (Microsoft Corporation) MD5=B74C69A810949E7A54DC688CAE662206 – C:\WINDOWS\$NtUninstallKB890859$\win32k.sys
[2004/08/04 01:17:40 | 001,835,904 | —- | M] (Microsoft Corporation) MD5=B74C69A810949E7A54DC688CAE662206 – C:\WINDOWS\ServicePackFiles\i386\win32k.sys
[2010/05/02 00:22:50 | 001,851,264 | —- | M] (Microsoft Corporation) MD5=B9D41312F6D9FFA8D1D80488D9FDE849 – C:\WINDOWS\$hf_mig$\KB979559\SP3GDR\win32k.sys
[2007/03/08 08:49:49 | 001,843,968 | —- | M] (Microsoft Corporation) MD5=B9D8F5E6D1A7AC9977CC50ECE7C7FF74 – C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\win32k.sys
[2009/02/09 05:19:34 | 001,846,272 | —- | M] (Microsoft Corporation) MD5=CBE3C46513AE586C6AFEE810DDDD122D – C:\WINDOWS\$NtUninstallKB979559$\win32k.sys
[2008/09/15 07:12:56 | 001,846,400 | —- | M] (Microsoft Corporation) MD5=D21A189185D3A74512CC8E68F16E3FCF – C:\WINDOWS\$hf_mig$\KB954211\SP3GDR\win32k.sys
[2005/03/01 20:06:57 | 001,836,288 | —- | M] (Microsoft Corporation) MD5=D9228D813D601BA27AF486D4D167C83E – C:\WINDOWS\$NtUninstallKB896424$\win32k.sys
[2008/04/13 14:30:10 | 001,845,632 | —- | M] (Microsoft Corporation) MD5=DE01D79A607C7B9AE7FF88E934D0FFB2 – C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\win32k.sys
[2009/02/09 05:20:05 | 001,847,424 | —- | M] (Microsoft Corporation) MD5=EC24AD3CDA5F04A4F76FE2659B5E6CBE – C:\WINDOWS\$hf_mig$\KB958690\SP2QFE\win32k.sys
[2010/05/02 02:09:03 | 001,859,968 | —- | M] (Microsoft Corporation) MD5=F358F5E1DC4976FAF5D59E781629145C – C:\WINDOWS\$hf_mig$\KB979559\SP2QFE\win32k.sys
[2005/03/01 20:11:25 | 001,836,160 | —- | M] (Microsoft Corporation) MD5=F92DA2BB088A56B3A5FB8151E58F2964 – C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\win32k.sys
[2004/08/05 13:15:00 | 001,845,888 | —- | M] (Microsoft Corporation) MD5=FE5C17327038423078CD3E24528F6B8C – C:\WINDOWS\$NtServicePackUninstall$\win32k.sys

< End of report >

Hello Oldman960,
First, to take this time to thank you for your time & expertise. I have the utmost appreciation for the service which you have provided


OTL file follows:
=============================================================================

OTL logfile created on: 1/13/2012 10:54:34 PM - Run 3
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Peter\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.48 Mb Total Physical Memory | 127.83 Mb Available Physical Memory | 24.99% Memory free
1.22 Gb Paging File | 0.82 Gb Available in Paging File | 67.25% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 57.26 Gb Total Space | 10.02 Gb Free Space | 17.50% Space Free | Partition Type: NTFS
Drive D: | 306.88 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 298.09 Gb Total Space | 66.25 Gb Free Space | 22.23% Space Free | Partition Type: NTFS

Computer Name: PH | User Name: Peter | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Peter\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe ()
PRC - C:\Program Files\WordWeb\wweb32.exe (Antony Lewis)
PRC - C:\WINDOWS\system32\MSTMON_S.EXE (KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe ()
PRC - C:\Program Files\SpywareGuard\sgmain.exe ()
PRC - C:\Program Files\SpywareGuard\sgbhp.exe ()
PRC - C:\WINDOWS\system32\sndvol32.exe (Microsoft Corporation)
PRC - C:\Program Files\NetWaiting\netwaiting.exe ()


========== Modules (No Company Name) ==========

MOD - C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{6414808a-6bbd-4b88-abce-d80baefe9aad}\components\RadioWMPCoreGecko5.dll ()
MOD - C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\[removed]\components\epicPlayGames.dll ()
MOD - C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{9051303c-7e41-4311-a783-d6fe5ef2832d}\components\gecko5\fvd_connector.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxCmp.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxCommon.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VPrintOnline.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxXML2.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxBase.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxIm.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxProc.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxFF.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SpiffyExt.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VPrintOnlineHelper40.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\areaifdll.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\ESSkin.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\ESEmail.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\ESCom.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VistaAdapter.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\Atlas.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VistaPrintOnline.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\KFx.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\AppCore.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VistaControls.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\Pcd.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\kpries40.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\IStorageMediaStore.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VistaCDBackup.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\LocAcqMod.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\keml40.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\DXRawFormatHandler.esx ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\DibLibIP.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\LocCamBack.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\KPCDInterface.dll ()
MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe ()
MOD - C:\Program Files\Kodak\KODAK Software Updater\7288971\6.3.2.62-7288971L\Program\bwfiles.dll ()
MOD - C:\Program Files\Kodak\KODAK Software Updater\7288971\6.3.2.62-7288971L\Program\FrExt.dll ()
MOD - C:\Program Files\Kodak\KODAK Software Updater\7288971\6.3.2.62-7288971L\Program\clntutil.dll ()
MOD - C:\Program Files\SpywareGuard\sgmain.exe ()
MOD - C:\Program Files\SpywareGuard\sgbhp.exe ()
MOD - C:\Program Files\SpywareGuard\spywareguard.dll ()
MOD - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\BWTargetInf.dll ()
MOD - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\frext-7288971.dll ()
MOD - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\BWfiles-7288971.dll ()
MOD - C:\Program Files\NetWaiting\netwaiting.exe ()


========== Win32 Services (SafeList) ==========

SRV - (MsaSvc) – File not found
SRV - (HidServ) – File not found
SRV - (AppMgmt) – File not found
SRV - (NMSAccess) – C:\Program Files\CDBurnerXP\NMSAccessU.exe ()


========== Driver Services (SafeList) ==========

DRV - (epmntdrv) – C:\WINDOWS\system32\epmntdrv.sys ()
DRV - (EuGdiDrv) – C:\WINDOWS\system32\EuGdiDrv.sys ()
DRV - (StarOpen) – C:\WINDOWS\System32\drivers\StarOpen.sys ()
DRV - (AVG Anti-Rootkit) – C:\WINDOWS\System32\DRIVERS\anti_rkt.sys (GRISOFT, s.r.o.)
DRV - (AVG Clean Driver) – C:\WINDOWS\System32\DRIVERS\cleanDrv.sys (GRISOFT, s.r.o.)
DRV - (BANTExt) – C:\WINDOWS\System32\Drivers\BANTExt.sys ()
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (xmasscsi) – C:\WINDOWS\System32\Drivers\xmasscsi.sys ( )
DRV - (xmasbus) – C:\WINDOWS\System32\DRIVERS\xmasbus.sys ( )
DRV - (MLPTDR_Q) – C:\WINDOWS\system32\MLPTDR_Q.SYS (KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.)
DRV - (nvnforce) Service for NVIDIA® nForce™ – C:\WINDOWS\system32\drivers\nvapu.sys (NVIDIA Corporation)
DRV - (nvax) Service for NVIDIA® nForce™ – C:\WINDOWS\system32\drivers\nvax.sys (NVIDIA Corporation)
DRV - (NVENET) – C:\WINDOWS\system32\drivers\NVENET.sys (NVIDIA Corporation)
DRV - (nvidesm) – C:\WINDOWS\system32\drivers\nvidesm.sys (NVIDIA Corporation)
DRV - (Winachcf) – C:\WINDOWS\system32\drivers\winachcf.sys (Conexant)
DRV - (nv_agp) – C:\WINDOWS\System32\DRIVERS\nv_agp.sys (NVIDIA Corporation)
DRV - (HCF_MSFT) – C:\WINDOWS\system32\drivers\HCF_MSFT.sys (Conexant)
DRV - (ms_mpu401) – C:\WINDOWS\system32\drivers\msmpu401.sys (Microsoft Corporation)
DRV - (GoldrushUSB) – C:\WINDOWS\system32\drivers\goldrush.sys (Agilent Technologies)
DRV - (SetupNT) – C:\WINDOWS\system32\SetupNT.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/def…/search/ie.html
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/def…//www.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr;=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/?.intl=us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://mail.yahoo.com/?.intl=us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0: C:\Program Files\DivX\DivX Content Uploader\npUpload.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.1: C:\Program Files\Yahoo!\Shared\npYState.dll ( )
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2027: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2088: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1040: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll ()

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{9051303c-7e41-4311-a783-d6fe5ef2832d}: C:\Program Files\FVD Suite\addons\Firefox [2011/12/01 07:46:56 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla 1.7.8\Extensions\\Components: C:\Program Files\mozilla.org\Mozilla\Components [2008/10/13 19:47:17 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla 1.7.8\Extensions\\Plugins: C:\Program Files\mozilla.org\Mozilla\Plugins [2008/10/13 19:47:17 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/11/13 19:01:23 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/11/13 22:21:38 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{EB132DB0-A4CA-11DF-9732-0E29E0D72085}: C:\Program Files\Object\facetheme
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla 1.7.8\Extensions\\Components: C:\Program Files\mozilla.org\Mozilla\Components [2008/10/13 19:47:17 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla 1.7.8\Extensions\\Plugins: C:\Program Files\mozilla.org\Mozilla\Plugins [2008/10/13 19:47:17 | 000,000,000 | —D | M]

[2011/11/15 18:23:18 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Extensions
[2012/01/09 07:52:29 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions
[2011/11/13 18:55:36 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/12/12 14:43:56 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/01/09 07:52:29 | 000,000,000 | —D | M] (Fvd Suite Community Toolbar) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{6414808a-6bbd-4b88-abce-d80baefe9aad}
[2011/12/29 09:15:13 | 000,000,000 | —D | M] ("FVD Suite Toolbar") – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{9051303c-7e41-4311-a783-d6fe5ef2832d}
[2011/12/25 21:33:04 | 000,000,000 | —D | M] (DownloadHelper) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011/11/15 18:23:18 | 000,000,000 | —D | M] (EpicPlay Games) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\[removed]
[2006/11/06 14:02:48 | 000,000,000 | —D | M] ("VideoDownloader") – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\[removed]
[2011/11/13 22:21:44 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/11/13 22:21:45 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
[2011/11/13 19:01:23 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\distribution\extensions
[2011/11/13 19:01:23 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Program Files\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/06/15 23:17:34 | 000,142,296 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/11/13 22:21:19 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/01/01 03:00:00 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml.old

O1 HOSTS File: ([2004/08/21 22:07:46 | 000,000,848 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SpywareGuardDLBLOCK.CBrowserHelper) - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll ()
O2 - BHO: (no name) - {de4e75d3-60aa-4f02-a0e4-c8a40576574c} - No CLSID value found.
O3 - HKLM\..\Toolbar: (FVD Suite Toolbar) - {2B171655-A69C-5c18-B693-6CB5DC269D41} - C:\Program Files\FVD Suite\addons\IE\FVDToolbar.dll (www.flashvideodownloader.org/fvd-suite/)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Copernic Agent) - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll (Copernic Technologies Inc.)
O4 - HKLM..\Run: [CommonToolkitTray] C:\Program Files\Fighters\Tray\FightersTray.exe File not found
O4 - HKLM..\Run: [KONICA MINOLTA magicolor 2400W STD] C:\WINDOWS\System32\MSTMON_S.EXE (KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netwaiting.exe ()
O4 - HKCU..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe ()
O4 - HKLM..\RunOnceEx: [] File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe ()
O4 - Startup: C:\Documents and Settings\Peter\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O4 - Startup: C:\Documents and Settings\Peter\Start Menu\Programs\Startup\SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe ()
O4 - Startup: C:\Documents and Settings\Peter\Start Menu\Programs\Startup\WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe (Antony Lewis)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O8 - Extra context menu item: &WordWeb;… - C:\WINDOWS\wweb32.dll (Antony Lewis)
O8 - Extra context menu item: &Yahoo;! Search - C:\Program Files\Yahoo!\Common [2006/09/13 16:27:22 | 000,000,000 | —D | M]
O8 - Extra context menu item: Search Using Copernic Agent - C:\Program Files\Copernic Agent\CopernicAgentExt.dll (Copernic Technologies Inc.)
O8 - Extra context menu item: Yahoo! &Dictionary; - C:\Program Files\Yahoo!\Common [2006/09/13 16:27:22 | 000,000,000 | —D | M]
O8 - Extra context menu item: Yahoo! &Maps; - C:\Program Files\Yahoo!\Common [2006/09/13 16:27:22 | 000,000,000 | —D | M]
O9 - Extra 'Tools' menuitem : Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\Program Files\Copernic Agent\CopernicAgent.exe (Copernic Technologies Inc.)
O9 - Extra Button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Companion\Modules\messmod2\v4\yhexbmes.dll File not found
O9 - Extra 'Tools' menuitem : Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Companion\Modules\messmod2\v4\yhexbmes.dll File not found
O9 - Extra Button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\Program Files\Copernic Agent\CopernicAgent.exe (Copernic Technologies Inc.)
O9 - Extra Button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll (Apple Computer, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: aol.com ([free] http in Trusted sites)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://a1540.g.akamai.net/7/1540/52/200612…ex/qtplugin.cab (Reg Error: Key error.)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} http://static.windupdates.com/cab/CDT/ie/bridge-c15.cab (Reg Error: Key error.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/get/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} http://support.f-secure.com/ols/fscax.cab (F-Secure Online Scanner)
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_09)
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_10)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {DE22A7AB-A739-4C58-AD52-21F9CD6306B7} http://download.microsoft.com/download/7/E…04/clearadj.cab (CTAdjust Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A67D86CB-7EF9-414A-BC85-AC3EEF166B61}: DhcpNameServer = 192.168.1.1 [removed] [removed]
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\copernicagent {A979B6BD-E40B-4A07-ABDD-A62C64A4EBF6} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll (Copernic Technologies Inc.)
O18 - Protocol\Handler\copernicagentcache {AAC34CFD-274D-4A9D-B0DC-C74C05A67E1D} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll (Copernic Technologies Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Peter\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Peter\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {81559C35-8464-49F7-BB0E-07A383BEF910} - C:\Program Files\SpywareGuard\spywareguard.dll ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/06/26 14:00:20 | 000,000,032 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2000/06/01 03:39:56 | 000,000,524 | R— | M] () - D:\AUTORUN.INF – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/01/13 20:31:12 | 000,000,000 | —D | C] – C:\_OTL
[2012/01/12 21:07:33 | 004,713,472 | —- | C] (AVAST Software) – C:\Documents and Settings\Peter\Desktop\aswMBR.exe
[2012/01/12 20:48:06 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Peter\Desktop\OTL.exe
[2012/01/08 16:57:57 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Grau Software
[2012/01/08 16:57:54 | 000,000,000 | —D | C] – C:\Program Files\CountDown
[2012/01/07 06:34:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Pazera Free FLV to AVI Converter
[2011/12/23 23:11:04 | 000,000,000 | —D | C] – C:\Documents and Settings\Peter\Desktop\Movies Thought were no good
[2011/12/21 07:30:41 | 000,000,000 | —D | C] – C:\Documents and Settings\Peter\Application Data\WinRAR
[2011/12/21 07:30:40 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\WinRAR
[2011/12/21 07:30:37 | 000,000,000 | —D | C] – C:\Documents and Settings\Peter\Start Menu\Programs\WinRAR
[2011/12/21 07:30:31 | 000,000,000 | —D | C] – C:\Program Files\WinRAR
[2011/12/18 22:52:03 | 000,000,000 | —D | C] – C:\Documents and Settings\Peter\Application Data\vlc
[2011/12/18 22:51:09 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\VideoLAN
[2011/12/18 22:50:44 | 000,000,000 | —D | C] – C:\Program Files\VideoLAN
[2004/09/29 07:01:29 | 000,140,800 | —- | C] ( ) – C:\WINDOWS\System32\drivers\xmasbus.sys
[2004/09/29 07:01:29 | 000,005,248 | —- | C] ( ) – C:\WINDOWS\System32\drivers\xmasscsi.sys
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/01/13 21:14:06 | 000,028,672 | —- | M] () – C:\Documents and Settings\Peter\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/01/13 21:00:17 | 000,001,374 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/01/13 20:58:39 | 010,421,248 | R— | M] () – C:\Documents and Settings\All Users\Documents\ESBK.mbb
[2012/01/13 20:58:39 | 004,206,592 | R— | M] () – C:\Documents and Settings\All Users\Documents\ESBK.mb
[2012/01/13 20:58:17 | 000,019,116 | —- | M] () – C:\WINDOWS\MSTMON_S.INI
[2012/01/13 20:58:15 | 000,003,725 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2012/01/13 20:58:11 | 000,000,384 | —- | M] () – C:\WINDOWS\tasks\SLOW-PCfighter-Peter-Notification.job
[2012/01/13 20:58:10 | 000,000,356 | —- | M] () – C:\WINDOWS\tasks\SLOW-PCfighter-Peter-Startup.job
[2012/01/13 20:57:35 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/01/12 22:46:38 | 000,000,499 | —- | M] () – C:\Documents and Settings\Peter\Desktop\MBR.zip
[2012/01/12 22:40:35 | 000,000,512 | —- | M] () – C:\Documents and Settings\Peter\Desktop\MBR.dat
[2012/01/12 21:32:51 | 000,010,999 | —- | M] () – C:\Documents and Settings\Peter\Desktop\Install Fail.JPG
[2012/01/12 21:08:02 | 004,713,472 | —- | M] (AVAST Software) – C:\Documents and Settings\Peter\Desktop\aswMBR.exe
[2012/01/12 20:48:06 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Peter\Desktop\OTL.exe
[2012/01/12 18:01:00 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Peter\Desktop\HijackThis.exe
[2012/01/12 17:56:41 | 001,008,141 | —- | M] () – C:\Documents and Settings\Peter\Desktop\RKill-iExplore.exe
[2012/01/12 17:56:12 | 001,008,141 | —- | M] () – C:\Documents and Settings\Peter\Desktop\Rkill-eXplorer.exe
[2012/01/12 17:51:08 | 001,008,141 | —- | M] () – C:\Documents and Settings\Peter\Desktop\rkill.com
[2012/01/12 17:45:17 | 000,001,205 | —- | M] () – C:\Documents and Settings\Peter\Desktop\FixNCR.reg
[2012/01/12 09:31:51 | 000,002,577 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2012/01/11 10:43:18 | 000,000,700 | —- | M] () – C:\Documents and Settings\Peter\Desktop\ADDonTFX.lnk
[2012/01/11 10:00:00 | 000,000,306 | —- | M] () – C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job
[2012/01/07 06:34:16 | 000,000,924 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Pazera Free FLV to AVI Converter.lnk
[2011/12/25 16:47:29 | 000,000,435 | —- | M] () – C:\Documents and Settings\Peter\Desktop\FrostWire.lnk
[2011/12/23 23:12:10 | 000,000,388 | —- | M] () – C:\Documents and Settings\Peter\Desktop\Movies.lnk
[2011/12/21 20:54:28 | 000,082,354 | —- | M] () – C:\Documents and Settings\Peter\Desktop\400807_346365918711058_100000129595072_1577023_1135765565_n.jpg
[2011/12/18 22:51:10 | 000,000,719 | —- | M] () – C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/01/12 22:46:38 | 000,000,499 | —- | C] () – C:\Documents and Settings\Peter\Desktop\MBR.zip
[2012/01/12 22:40:35 | 000,000,512 | —- | C] () – C:\Documents and Settings\Peter\Desktop\MBR.dat
[2012/01/12 21:32:51 | 000,010,999 | —- | C] () – C:\Documents and Settings\Peter\Desktop\Install Fail.JPG
[2012/01/12 17:56:41 | 001,008,141 | —- | C] () – C:\Documents and Settings\Peter\Desktop\RKill-iExplore.exe
[2012/01/12 17:56:11 | 001,008,141 | —- | C] () – C:\Documents and Settings\Peter\Desktop\Rkill-eXplorer.exe
[2012/01/12 17:51:08 | 001,008,141 | —- | C] () – C:\Documents and Settings\Peter\Desktop\rkill.com
[2012/01/12 17:45:17 | 000,001,205 | —- | C] () – C:\Documents and Settings\Peter\Desktop\FixNCR.reg
[2012/01/11 10:43:17 | 000,000,700 | —- | C] () – C:\Documents and Settings\Peter\Desktop\ADDonTFX.lnk
[2012/01/07 06:34:16 | 000,000,924 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Pazera Free FLV to AVI Converter.lnk
[2011/12/25 16:47:29 | 000,000,435 | —- | C] () – C:\Documents and Settings\Peter\Desktop\FrostWire.lnk
[2011/12/23 23:12:10 | 000,000,388 | —- | C] () – C:\Documents and Settings\Peter\Desktop\Movies.lnk
[2011/12/21 20:55:18 | 000,082,354 | —- | C] () – C:\Documents and Settings\Peter\Desktop\400807_346365918711058_100000129595072_1577023_1135765565_n.jpg
[2011/12/18 22:51:10 | 000,000,719 | —- | C] () – C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2011/11/22 17:17:21 | 000,355,496 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/11/22 14:07:34 | 000,000,275 | —- | C] () – C:\Documents and Settings\Peter\Local Settings\Application Data\HamsterVideoConverterSettings.cfg
[2011/11/16 14:26:57 | 000,044,544 | —- | C] () – C:\WINDOWS\System32\GIF89.DLL
[2011/11/16 14:26:55 | 000,237,568 | —- | C] () – C:\WINDOWS\System32\lame_enc.dll
[2011/11/13 22:30:44 | 002,469,760 | —- | C] () – C:\WINDOWS\System32\BootMan.exe
[2011/11/13 22:30:44 | 000,086,408 | —- | C] () – C:\WINDOWS\System32\setupempdrv03.exe
[2011/11/13 22:30:44 | 000,019,840 | —- | C] () – C:\WINDOWS\System32\EuEpmGdi.dll
[2011/11/13 22:30:44 | 000,013,192 | —- | C] () – C:\WINDOWS\System32\epmntdrv.sys
[2011/11/13 22:30:44 | 000,008,456 | —- | C] () – C:\WINDOWS\System32\EuGdiDrv.sys
[2010/12/01 21:06:37 | 000,007,168 | —- | C] () – C:\WINDOWS\System32\drivers\StarOpen.sys
[2009/04/14 18:18:48 | 000,000,127 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2006/11/19 18:11:03 | 000,004,212 | -H– | C] () – C:\WINDOWS\System32\zllictbl.dat
[2006/11/14 16:58:37 | 000,175,616 | —- | C] () – C:\WINDOWS\System32\strings.exe
[2006/11/14 16:58:37 | 000,126,976 | —- | C] () – C:\WINDOWS\System32\zip.exe
[2006/11/14 16:58:37 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\pv.exe
[2006/11/14 16:58:37 | 000,039,184 | —- | C] () – C:\WINDOWS\System32\Ntrights.exe
[2006/11/14 16:58:37 | 000,011,254 | —- | C] () – C:\WINDOWS\System32\locate.com
[2006/01/26 17:47:56 | 000,019,253 | —- | C] () – C:\WINDOWS\MSUMLT_S.ini
[2005/11/07 14:44:21 | 000,000,022 | —- | C] () – C:\WINDOWS\kodakpcd.Peter.ini
[2005/09/20 05:50:23 | 000,001,759 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2005/05/25 12:32:55 | 000,099,024 | —- | C] () – C:\WINDOWS\MozillaUninstall.exe
[2005/05/25 12:32:31 | 000,098,512 | —- | C] () – C:\WINDOWS\GREUninstall.exe
[2005/05/25 12:20:29 | 000,099,965 | —- | C] () – C:\WINDOWS\UninstallFirefox.exe
[2005/05/09 08:45:29 | 000,037,027 | —- | C] () – C:\WINDOWS\atmoUn.exe
[2005/04/25 20:50:26 | 000,019,116 | —- | C] () – C:\WINDOWS\MSTMON_S.INI
[2005/02/20 04:19:14 | 000,000,694 | —- | C] () – C:\WINDOWS\wininit.ini
[2005/02/17 23:26:54 | 000,003,840 | —- | C] () – C:\WINDOWS\System32\drivers\BANTExt.sys
[2005/02/04 06:19:02 | 000,000,892 | —- | C] () – C:\WINDOWS\keythf2.ini
[2005/01/28 21:02:52 | 000,000,694 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2004/12/31 20:01:44 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/12/29 06:49:25 | 000,027,622 | —- | C] () – C:\WINDOWS\System32\nlsfuncs.exe
[2004/12/29 06:49:25 | 000,022,337 | —- | C] () – C:\WINDOWS\System32\qappsrvc32.exe
[2004/12/29 06:49:25 | 000,010,872 | —- | C] () – C:\WINDOWS\System32\unlodctl.exe
[2004/12/29 06:49:25 | 000,010,872 | —- | C] () – C:\WINDOWS\System32\iecust.exe
[2004/12/29 06:49:25 | 000,009,377 | —- | C] () – C:\WINDOWS\System32\openconf.exe
[2004/12/27 19:57:37 | 000,030,773 | —- | C] () – C:\WINDOWS\iecust.exe
[2004/12/27 19:56:13 | 000,030,773 | —- | C] () – C:\WINDOWS\nlsfuncs.exe
[2004/12/27 19:55:18 | 000,030,773 | —- | C] () – C:\WINDOWS\openconf.exe
[2004/12/27 19:55:17 | 000,030,773 | —- | C] () – C:\WINDOWS\unlodctl.exe
[2004/12/27 19:55:04 | 000,030,773 | —- | C] () – C:\WINDOWS\taskopen.exe
[2004/12/25 23:58:42 | 000,000,063 | —- | C] () – C:\WINDOWS\sb_affiliate.ini
[2004/12/25 22:20:37 | 000,000,019 | —- | C] () – C:\WINDOWS\System32\date.dat
[2004/10/08 10:05:45 | 000,000,314 | —- | C] () – C:\WINDOWS\mpsettings.ini
[2004/09/21 14:00:25 | 000,109,782 | —- | C] () – C:\WINDOWS\CopernicAgentUninstall.exe
[2004/09/20 08:23:08 | 000,000,000 | —- | C] () – C:\Documents and Settings\Peter\Application Data\dm.ini
[2004/09/17 11:39:32 | 000,000,142 | —- | C] () – C:\WINDOWS\bestplayer.ini
[2004/09/14 20:13:48 | 000,000,156 | —- | C] () – C:\WINDOWS\TOPO.INI
[2004/08/22 22:09:06 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2004/08/22 22:08:20 | 000,025,701 | —- | C] () – C:\WINDOWS\mozver.dat
[2004/08/10 10:13:58 | 000,054,802 | —- | C] () – C:\WINDOWS\System32\adwfil.dll
[2004/08/10 10:13:58 | 000,012,684 | —- | C] () – C:\WINDOWS\System32\gblfil.dll
[2004/08/10 10:13:58 | 000,010,644 | —- | C] () – C:\WINDOWS\System32\chtfil.dll
[2004/08/10 10:13:58 | 000,005,782 | —- | C] () – C:\WINDOWS\System32\vgamfil.dll
[2004/08/10 10:13:58 | 000,005,160 | —- | C] () – C:\WINDOWS\System32\wfileu.drv
[2004/08/10 10:13:58 | 000,004,572 | —- | C] () – C:\WINDOWS\System32\iawfil.dll
[2004/08/10 10:13:58 | 000,004,442 | —- | C] () – C:\WINDOWS\System32\hatfil.dll
[2004/08/10 10:13:58 | 000,004,084 | —- | C] () – C:\WINDOWS\System32\viofil.dll
[2004/08/10 10:13:58 | 000,003,398 | —- | C] () – C:\WINDOWS\System32\srchin.dll
[2004/08/10 10:13:58 | 000,002,706 | —- | C] () – C:\WINDOWS\System32\lgwfil.dll
[2004/08/10 10:13:58 | 000,001,830 | —- | C] () – C:\WINDOWS\System32\cultfil.dll
[2004/08/10 10:13:58 | 000,000,434 | —- | C] () – C:\WINDOWS\System32\imgfil.dll
[2004/08/10 10:13:58 | 000,000,400 | —- | C] () – C:\WINDOWS\bsnlst.dll
[2004/08/10 10:13:58 | 000,000,306 | —- | C] () – C:\WINDOWS\System32\picsfil.dll
[2004/08/10 10:13:58 | 000,000,258 | —- | C] () – C:\WINDOWS\System32\srchout.dll
[2004/08/10 10:13:57 | 000,121,856 | —- | C] () – C:\WINDOWS\System32\mslspc.exe
[2004/08/10 10:13:57 | 000,000,027 | —- | C] () – C:\WINDOWS\liccyval.dat
[2004/07/23 10:49:31 | 000,044,032 | —- | C] () – C:\WINDOWS\unwash.exe
[2004/07/06 09:05:48 | 000,126,976 | R— | C] () – C:\WINDOWS\System32\cmdinterface.dll
[2004/07/06 09:05:48 | 000,010,321 | R— | C] () – C:\WINDOWS\System32\concord.dll
[2004/07/06 09:04:48 | 000,000,021 | —- | C] () – C:\WINDOWS\arcsuite.ini
[2004/07/06 07:23:16 | 000,002,611 | —- | C] () – C:\WINDOWS\photoimpression.ini
[2004/06/27 13:22:27 | 000,028,672 | —- | C] () – C:\Documents and Settings\Peter\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/04/14 18:06:42 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/04/13 14:58:54 | 000,000,478 | —- | C] () – C:\WINDOWS\ODBC.INI
[2004/04/13 00:01:35 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/04/13 00:00:35 | 000,565,504 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2004/04/12 16:19:07 | 000,001,024 | R— | C] () – C:\WINDOWS\System32\drivers\jedih2rx.bin
[2004/04/12 16:19:07 | 000,000,122 | R— | C] () – C:\WINDOWS\System32\drivers\ramsed.bin
[2004/04/12 16:18:37 | 000,003,000 | R— | C] () – C:\WINDOWS\System32\SetupNT.sys
[2004/04/12 16:09:07 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2004/04/12 16:04:41 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2003/06/29 22:55:36 | 000,011,521 | —- | C] () – C:\WINDOWS\MSUMLT_Q.INI
[2003/03/31 07:00:00 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2003/03/31 07:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2003/03/31 07:00:00 | 000,435,260 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2003/03/31 07:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2003/03/31 07:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2003/03/31 07:00:00 | 000,068,156 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2003/03/31 07:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2003/03/31 07:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2003/03/31 07:00:00 | 000,004,461 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2003/03/31 07:00:00 | 000,001,788 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2003/03/31 07:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/03/14 11:00:26 | 000,038,567 | —- | C] () – C:\WINDOWS\System32\pcpbios.exe
[2000/09/08 17:53:50 | 000,073,839 | —- | C] () – C:\WINDOWS\System32\KodakOneTouch.dll
[1998/08/16 04:00:00 | 000,004,096 | —- | C] () – C:\WINDOWS\System32\sysres.dll
[1997/06/13 21:56:08 | 000,056,832 | —- | C] () – C:\WINDOWS\System32\iyvu9_32.dll

========== LOP Check ==========

[2010/12/01 21:06:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Canneverbe Limited
[2011/11/15 18:25:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Fighters
[2010/12/01 19:52:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2004/05/04 14:31:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap
[2010/12/01 21:51:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2005/05/09 08:45:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2006/04/19 17:48:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Advanced Browser
[2009/04/14 19:58:47 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Avant Browser
[2011/11/25 01:27:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Azureus
[2010/12/01 21:06:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Canneverbe Limited
[2004/09/21 14:00:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Copernic
[2008/03/02 14:54:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Enigma Browser
[2011/11/15 18:23:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\FCSB000063443
[2011/11/15 18:25:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Fighters
[2011/12/01 07:47:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\FVDToolbar
[2011/11/30 07:15:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\HamsterSoft
[2004/09/21 22:38:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Opera
[2004/09/15 21:04:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\Thunderbird
[2006/04/26 21:38:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Peter\Application Data\UVC
[2010/12/01 21:04:44 | 000,000,298 | —- | M] () – C:\WINDOWS\Tasks\expressburnShakeIcon.job
[2012/01/13 20:58:11 | 000,000,384 | —- | M] () – C:\WINDOWS\Tasks\SLOW-PCfighter-Peter-Notification.job
[2012/01/13 20:58:10 | 000,000,356 | —- | M] () – C:\WINDOWS\Tasks\SLOW-PCfighter-Peter-Startup.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\Peter\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf:SummaryInformation
@Alternate Data Stream - 108 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CEF69E3D

< End of report >

Hello Oldman960,

I understand about FrostWire, Thank you.

Very old vulnerable java uninstalled.

Re: "What are you using for an antivirus program?"
I was using Avast. But I think I had had a virus before this, because I was not able to update my Avast. Possibly now, I can re-register with Avast.

Java™ 6 Updated to Java™ 6 Update 30
Q> Can you tell me why with THIS update, that Java 29 has been automatically removed, yet with so many other updates [as you saw], the previous version was NOT automatically removed?

MBAM encountered no file difficult to remove


OTL fix log & mbam-log marked
OTL fix log to follow:
=============================================================================

All processes killed
========== SERVICES/DRIVERS ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Kids
->Temp folder emptied: 786 bytes
->Temporary Internet Files folder emptied: 41456 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 98127 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Non-Admin
->Temp folder emptied: 643 bytes
->Temporary Internet Files folder emptied: 105899 bytes
->FireFox cache emptied: 8061413 bytes

User: Peter
->Temp folder emptied: 251461223 bytes
->Temporary Internet Files folder emptied: 75997933 bytes
->Java cache emptied: 828768 bytes
->FireFox cache emptied: 208885233 bytes
->Flash cache emptied: 42075 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1120506 bytes
%systemroot%\System32 .tmp files removed: 3613716 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 479942 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 65833004 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 6537077916 bytes

Total Files Cleaned = 6,822.00 mb

Restore point Set: OTL Restore Point (0)

OTL by OldTimer - Version 3.2.31.0 log created on 01142012_091233

Files\Folders moved on Reboot…

Registry entries deleted on Reboot…




=============================================================================
mbam-log
=============================================================================

Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Database version: v2012.01.14.02

Windows XP Service Pack 2 x86 NTFS
Internet Explorer 7.0.5730.11
Peter :: PH [administrator]

1/14/2012 9:36:08 AM
mbam-log-2012-01-14 (09-36-08).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 197818
Time elapsed: 10 minute(s), 13 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 9
HKCR\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Trymedia Systems (Adware.TryMedia) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Google\Chrome\Extensions\kincjchfokkeneeofpeefomkikfkiedl (PUP.FCTPlugin) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 3
HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.
HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.
HKLM\SOFTWARE\Microsoft\Security Center|UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

Folders Detected: 1
C:\Program Files\Object (PUP.FCTPlugin) -> Quarantined and deleted successfully.

Files Detected: 5
C:\Documents and Settings\Peter\My Documents\Downloads\SoftonicDownloader_for_hamster-free-video-converter_2.0.0.24.exe (PUP.BundleOffer.Downloader.S) -> Quarantined and deleted successfully.
C:\Documents and Settings\Peter\My Documents\Downloads\cnet2_Pazera_Free_FLV_to_AVI_Converter_exe.exe (PUP.CNET.Adware.Bundle) -> Quarantined and deleted successfully.
C:\Program Files\Object\enable.txt (PUP.FCTPlugin) -> Quarantined and deleted successfully.
C:\Program Files\Object\config.ini (PUP.FCTPlugin) -> Quarantined and deleted successfully.
C:\Program Files\Object\status2.txt (PUP.FCTPlugin) -> Quarantined and deleted successfully.

(end)