webster10
OTL logfile created on: 4/24/2012 7:18:00 PM - Run 7
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
502.80 Mb Total Physical Memory | 332.85 Mb Available Physical Memory | 66.20% Memory free
843.82 Mb Paging File | 591.62 Mb Available in Paging File | 70.11% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 17.98 Gb Free Space | 48.23% Space Free | Partition Type: NTFS
Computer Name: PEGGY | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe (W3i, LLC)
PRC - C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiSeAgnt.exe (Trend Micro Inc.)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\Trend Micro\RUBotted\TMRUBottedLite.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\sndvol32.exe (Microsoft Corporation)
========== Modules (No Company Name) ==========
MOD - C:\Program Files\Trend Micro\UniClient\plugins\LUADLL.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\sqlite3.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\libprotobuf.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\update\iau_sdk\iaucore\iaucore.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\update\iau_sdk\iau.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\boost_date_time-vc80-mt-1_36.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\boost_thread-vc80-mt-1_36.dll ()
MOD - C:\Program Files\FileZilla FTP Client\fzshellext.dll ()
MOD - C:\Program Files\Trend Micro\RUBotted\TMRUBottedLite.exe ()
MOD - C:\WINDOWS\system32\Primomonnt.dll ()
========== Win32 Services (SafeList) ==========
SRV - (z800obex) – %systemroot%\system32\rollbackclientservice.dll File not found
SRV - (IntuitUpdateService) – %systemroot%\system32\imaservice.dll File not found
SRV - (HidServ) – %SystemRoot%\System32\hidserv.dll File not found
SRV - (Amsp) – C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe File not found
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (RUBotted) – C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe (Trend Micro Inc.)
========== Driver Services (SafeList) ==========
DRV - (WDICA) – File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (catchme) – C:\jgh\catchme.sys File not found
DRV - (76851537) – system32\drivers\21461316.sys File not found
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (TMPassthruMP) – C:\WINDOWS\system32\drivers\TMPassthru.sys (Trend Micro Inc.)
DRV - (TMPassthru) – C:\WINDOWS\system32\drivers\TMPassthru.sys (Trend Micro Inc.)
DRV - (AFS2K) – C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (iAimFP4) – C:\WINDOWS\system32\drivers\wvchntxx.sys (Intel® Corporation)
DRV - (iAimFP3) – C:\WINDOWS\system32\drivers\wsiintxx.sys (Intel® Corporation)
DRV - (iAimTV5) – C:\WINDOWS\system32\drivers\watv10nt.sys (Intel® Corporation)
DRV - (iAimTV4) – C:\WINDOWS\system32\drivers\wch7xxnt.sys (Intel® Corporation)
DRV - (iAimTV6) – C:\WINDOWS\system32\drivers\watv06nt.sys (Intel® Corporation)
DRV - (iAimTV3) – C:\WINDOWS\system32\drivers\watv04nt.sys (Intel® Corporation)
DRV - (iAimTV1) – C:\WINDOWS\system32\drivers\watv02nt.sys (Intel® Corporation)
DRV - (iAimTV0) – C:\WINDOWS\system32\drivers\watv01nt.sys (Intel® Corporation)
DRV - (iAimFP7) – C:\WINDOWS\system32\drivers\wadv09nt.sys (Intel® Corporation)
DRV - (iAimFP5) – C:\WINDOWS\system32\drivers\wadv07nt.sys (Intel® Corporation)
DRV - (iAimFP6) – C:\WINDOWS\system32\drivers\wadv08nt.sys (Intel® Corporation)
DRV - (i81x) – C:\WINDOWS\system32\drivers\i81xnt5.sys (Intel® Corporation)
DRV - (iAimFP0) – C:\WINDOWS\system32\drivers\wadv01nt.sys (Intel® Corporation)
DRV - (iAimFP1) – C:\WINDOWS\system32\drivers\wadv02nt.sys (Intel® Corporation)
DRV - (iAimFP2) – C:\WINDOWS\system32\drivers\wadv05nt.sys (Intel® Corporation)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (Symmpi) – C:\WINDOWS\system32\drivers\symmpi.sys (LSI Logic)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0409/bl8.asp
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{E4013329-B79F-4680-AD25-5D4D64F28342}: "URL" = http://www.onestepsearch.net/?prt=ONESTEP1…s={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\URLSearchHook: - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0C55421B-685A-4156-A691-073C1D6AEBD2}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKCU\..\SearchScopes\{0C55421B-685A-4156-A691-073C1D6AEBD2}: "URL" = http://search.yahoo.com/search?p={searchTe…-8&fr=b1ie7
IE - HKCU\..\SearchScopes\{579457C0-C7D6-481B-8DBF-3CA259316F8C}: "URL" = http://rover.ebay.com/rover/1/711-43047-14…e={searchTerms}
IE - HKCU\..\SearchScopes\{D5EF9B3F-A073-433A-BDDE-BE64509C0AB3}: "URL" = http://www.flickr.com/search/?q={searchTerms}
IE - HKCU\..\SearchScopes\{E58FD494-9104-4DA0-AD13-7C6A590592BD}: "URL" = http://delicious.com/search?p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p="
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.3.6.20110307083656
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p="
FF - prefs.js..network.proxy.type: 1
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/npracplug;version=1.0.0.0: C:\Program Files\Real\RealArcade\Plugins\Mozilla\npracplug.dll (RealNetworks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1505\6.6.1088\firefoxextension\ [2012/04/21 16:16:05 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/04/12 21:39:30 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/04/21 16:20:07 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.18\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2008/11/25 12:38:29 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.18\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{ABC82C52-8331-11E1-826D-B8AC6F996F26}: C:\Documents and Settings\Administrator\Local Settings\Application Data\{ABC82C52-8331-11E1-826D-B8AC6F996F26}\
[2008/12/23 10:38:55 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2012/02/03 17:55:28 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ugvbjuwp.default\extensions
[2012/01/25 17:25:51 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ugvbjuwp.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/04/12 21:39:26 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/04/12 21:39:27 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\distribution\extensions
[2012/04/12 21:39:27 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Program Files\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/11/20 23:04:51 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/02/03 18:28:29 | 000,028,472 | —- | M] (WebEx Communications, Inc) – C:\Program Files\mozilla firefox\plugins\atgpcdec.dll
[2010/02/03 18:28:29 | 000,185,224 | —- | M] (WebEx Communications, Inc) – C:\Program Files\mozilla firefox\plugins\atgpcext.dll
[2010/02/03 18:28:28 | 000,061,832 | —- | M] (WebEx Communications, Inc) – C:\Program Files\mozilla firefox\plugins\npatgpc.dll
[2011/03/18 13:32:12 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll
[2011/03/18 13:32:14 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npMozCouponPrinter.dll
[2011/11/20 20:04:05 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/11/20 20:04:05 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml
========== Chrome ==========
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}source
id=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
O1 HOSTS File: ([2012/04/12 19:36:46 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1505\6.6.1088\TmIEPlg.dll (Trend Micro Inc.)
O2 - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {871F91FD-3A92-4988-A842-16AB2CFF5AF1} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [srmclean] C:\cpqs\scom\srmclean.exe ()
O4 - HKLM..\Run: [TMRUBottedTray] C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [Trend Micro Client Framework] C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [Trend Micro Titanium] C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe (Trend Micro Inc.)
O4 - HKCU..\Run: [InstallIQUpdater] C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe (W3i, LLC)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKCU\..Trusted Domains: westlaw.com ([]* in Trusted sites)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Reg Error: Key error.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/C/0…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab (Symantec AntiVirus scanner)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://photos.walmart.com/WalmartActivia.cab (Snapfish Activia)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/…lscbase5483.cab (Windows Live Safety Center Base Module)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {6824D897-F7E1-4E41-B84B-B1D3FA4BF1BD} http://utilities.pcpitstop.com/Exterminate…opAntiVirus.dll (PCPitstop AntiVirus)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{293A756F-F0E8-4250-BFB4-F00ACF54F34F}: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll File not found
O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1505\6.6.1088\TmIEPlg.dll (Trend Micro Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - File not found
O24 - Desktop Components:0 () - http://mail.charter.net/images/portal/msgt…S&v=charter
O24 - Desktop Components:1 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2012/04/24 17:20:04 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\Downloaded Installations
[2012/04/17 10:15:17 | 001,268,204 | —- | C] (Agere Systems) – C:\WINDOWS\System32\drivers\AGRSM.sys
[2012/04/17 10:15:17 | 000,019,455 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wvchntxx.sys
[2012/04/17 10:15:17 | 000,019,455 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\wvchntxx.sys
[2012/04/17 10:15:16 | 000,012,063 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wsiintxx.sys
[2012/04/17 10:15:16 | 000,012,063 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\wsiintxx.sys
[2012/04/17 10:15:15 | 000,023,615 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wch7xxnt.sys
[2012/04/17 10:15:15 | 000,023,615 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\wch7xxnt.sys
[2012/04/17 10:15:14 | 000,033,599 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\watv04nt.sys
[2012/04/17 10:15:14 | 000,033,599 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\watv04nt.sys
[2012/04/17 10:15:14 | 000,025,471 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\watv10nt.sys
[2012/04/17 10:15:14 | 000,025,471 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\watv10nt.sys
[2012/04/17 10:15:14 | 000,019,551 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\watv02nt.sys
[2012/04/17 10:15:14 | 000,019,551 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\watv02nt.sys
[2012/04/17 10:15:13 | 000,029,311 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\watv01nt.sys
[2012/04/17 10:15:13 | 000,029,311 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\watv01nt.sys
[2012/04/17 10:15:13 | 000,011,871 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wadv09nt.sys
[2012/04/17 10:15:13 | 000,011,871 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\wadv09nt.sys
[2012/04/17 10:15:12 | 000,011,807 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wadv07nt.sys
[2012/04/17 10:15:12 | 000,011,807 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\wadv07nt.sys
[2012/04/17 10:15:12 | 000,011,775 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wadv05nt.sys
[2012/04/17 10:15:12 | 000,011,775 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\wadv05nt.sys
[2012/04/17 10:15:12 | 000,011,295 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wadv08nt.sys
[2012/04/17 10:15:12 | 000,011,295 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\wadv08nt.sys
[2012/04/17 10:15:11 | 000,012,415 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wadv01nt.sys
[2012/04/17 10:15:11 | 000,012,415 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\wadv01nt.sys
[2012/04/17 10:15:11 | 000,012,127 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wadv02nt.sys
[2012/04/17 10:15:11 | 000,012,127 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\wadv02nt.sys
[2012/04/17 10:15:10 | 000,022,271 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\watv06nt.sys
[2012/04/17 10:15:10 | 000,022,271 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\watv06nt.sys
[2012/04/17 10:15:05 | 000,161,020 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\i81xnt5.sys
[2012/04/17 10:15:05 | 000,161,020 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\i81xnt5.sys
[2012/04/17 10:15:04 | 000,000,000 | —D | C] – C:\_OTL
[2012/04/12 20:51:34 | 000,000,000 | —D | C] – C:\TDSSKiller_Quarantine
[2012/04/12 20:46:01 | 002,071,600 | —- | C] (Kaspersky Lab ZAO) – C:\Documents and Settings\Administrator\Desktop\tdsskiller.exe
[2012/04/12 20:41:09 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2012/04/11 17:53:40 | 000,034,735 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1xsxx.sys
[2012/04/11 17:53:40 | 000,034,735 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1xsxx.sys
[2012/04/11 17:53:39 | 000,036,463 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1tuxx.sys
[2012/04/11 17:53:39 | 000,036,463 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1tuxx.sys
[2012/04/11 17:53:39 | 000,029,455 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1xbxx.sys
[2012/04/11 17:53:39 | 000,029,455 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1xbxx.sys
[2012/04/11 17:53:39 | 000,026,367 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1snxx.sys
[2012/04/11 17:53:39 | 000,026,367 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1snxx.sys
[2012/04/11 17:53:39 | 000,021,343 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1ttxx.sys
[2012/04/11 17:53:39 | 000,021,343 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1ttxx.sys
[2012/04/11 17:53:38 | 000,063,663 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1rvxx.sys
[2012/04/11 17:53:38 | 000,063,663 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1rvxx.sys
[2012/04/11 17:53:38 | 000,030,671 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1raxx.sys
[2012/04/11 17:53:38 | 000,030,671 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1raxx.sys
[2012/04/11 17:53:38 | 000,012,047 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1pdxx.sys
[2012/04/11 17:53:38 | 000,012,047 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1pdxx.sys
[2012/04/11 17:53:37 | 000,056,623 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1btxx.sys
[2012/04/11 17:53:37 | 000,056,623 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1btxx.sys
[2012/04/11 17:53:37 | 000,011,615 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1mdxx.sys
[2012/04/11 17:53:37 | 000,011,615 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1mdxx.sys
[2012/04/11 17:35:09 | 000,000,000 | RHSD | C] – C:\cmdcons
[2012/04/11 17:32:03 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2012/04/11 17:32:03 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2012/04/11 17:32:03 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2012/04/11 17:32:02 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2012/04/11 17:31:24 | 000,000,000 | —D | C] – C:\Qoobox
[2012/04/11 17:27:36 | 004,458,963 | R— | C] (Swearware) – C:\Documents and Settings\Administrator\Desktop\jgh.exe
[2012/04/11 11:05:30 | 000,593,920 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/04/11 11:03:38 | 004,731,392 | —- | C] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2012/04/11 10:09:41 | 000,040,776 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012/04/10 17:59:43 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2012/04/10 17:59:35 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[1 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012/04/24 10:09:03 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/04/24 10:08:40 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/04/24 10:08:39 | 527,290,368 | -HS- | M] () – C:\hiberfil.sys
[2012/04/23 20:42:54 | 000,000,226 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\net.bat
[2012/04/23 17:32:55 | 000,736,238 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\mini-blind-window-shade.jpg
[2012/04/23 17:15:47 | 000,012,234 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\gray256.gif
[2012/04/21 16:20:07 | 000,001,729 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2012/04/21 16:14:18 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/04/18 11:16:45 | 000,007,028 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\PrimoPDFSet.xml
[2012/04/18 11:16:44 | 000,032,296 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\System Resource Report.pdf
[2012/04/12 21:39:34 | 000,000,742 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/04/12 21:39:34 | 000,000,724 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Mozilla Firefox.lnk
[2012/04/12 21:13:56 | 000,349,792 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/04/12 20:45:44 | 002,071,600 | —- | M] (Kaspersky Lab ZAO) – C:\Documents and Settings\Administrator\Desktop\tdsskiller.exe
[2012/04/12 19:36:46 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2012/04/12 12:07:59 | 000,115,686 | —- | M] () – C:\WINDOWS\System32\itldvupd.dat
[2012/04/12 03:15:02 | 000,456,014 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/04/12 03:15:02 | 000,076,230 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/04/12 03:04:14 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2012/04/11 17:35:31 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2012/04/11 17:26:00 | 004,458,963 | R— | M] (Swearware) – C:\Documents and Settings\Administrator\Desktop\jgh.exe
[2012/04/11 15:27:19 | 000,593,920 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/04/11 12:31:03 | 000,002,305 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Adobe Reader 9.lnk
[2012/04/11 11:21:06 | 000,002,463 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk
[2012/04/11 11:03:54 | 004,731,392 | —- | M] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2012/04/11 10:09:41 | 000,040,776 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012/04/10 18:52:33 | 000,011,914 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.jpg
[2012/04/10 18:52:33 | 000,002,180 | —- | M] () – C:\Documents and Settings\Administrator\.recently-used.xbel
[2012/04/10 18:36:09 | 000,081,049 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.gif
[2012/04/10 15:29:48 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/04/07 20:00:11 | 000,054,156 | -H– | M] () – C:\WINDOWS\QTFont.qfn
[2012/04/04 15:56:40 | 000,022,344 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2012/03/29 10:40:26 | 000,002,497 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Microsoft Office Word 2003.lnk
[1 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012/04/23 20:42:54 | 000,000,226 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\net.bat
[2012/04/23 17:32:54 | 000,736,238 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\mini-blind-window-shade.jpg
[2012/04/23 17:15:47 | 000,012,234 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\gray256.gif
[2012/04/21 16:18:27 | 000,001,729 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2012/04/21 16:18:26 | 000,002,347 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader 9.lnk
[2012/04/21 16:13:35 | 527,290,368 | -HS- | C] () – C:\hiberfil.sys
[2012/04/14 09:51:50 | 000,032,296 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\System Resource Report.pdf
[2012/04/12 16:37:55 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/04/11 17:35:30 | 000,000,211 | —- | C] () – C:\Boot.bak
[2012/04/11 17:35:14 | 000,260,272 | RHS- | C] () – C:\cmldr
[2012/04/11 17:32:03 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2012/04/11 17:32:03 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2012/04/11 17:32:03 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2012/04/11 17:32:03 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2012/04/11 17:32:03 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2012/04/11 08:59:44 | 000,115,686 | —- | C] () – C:\WINDOWS\System32\itldvupd.dat
[2012/04/10 18:52:33 | 000,002,180 | —- | C] () – C:\Documents and Settings\Administrator\.recently-used.xbel
[2012/04/10 18:42:29 | 000,011,914 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.jpg
[2012/04/10 18:36:09 | 000,081,049 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.gif
[2012/04/10 15:29:48 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/02/15 20:52:17 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2012/02/07 11:12:33 | 000,201,528 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/10/31 15:49:25 | 000,000,020 | —- | C] () – C:\WINDOWS\MainWHnd.INI
[2011/10/31 15:48:17 | 000,000,284 | —- | C] () – C:\WINDOWS\GvSaveImage.ini
[2011/10/31 15:48:13 | 000,000,512 | —- | C] () – C:\WINDOWS\GeoImageProcess_8200.ini
[2011/10/31 15:36:53 | 000,000,390 | —- | C] () – C:\WINDOWS\GeoLan.ini
[2011/10/31 15:36:45 | 000,000,082 | —- | C] () – C:\WINDOWS\GeoDebug61.ini
[2010/08/26 14:47:52 | 000,311,296 | R— | C] () – C:\WINDOWS\System32\SimplyVBUnitLib.dll
========== Custom Scans ==========
< HKEY_LOCAL_MACHINE\System\CrrentControlSet\Services\redbook /s >
"ImagePath" = system32\drivers\redbook.sys – [2012/04/12 20:52:57 | 000,057,600 | —- | M] (Microsoft Corporation)
< >
< HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\76851537 /s >
"Type" = 2
"ErrorControl" = 1
"Start" = 0
"ImagePath" = system32\drivers\21461316.sys
"Group" = System Reserved
"5781_5028" = [Binary data over 100 bytes]
< >
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}|UpperFilters /rs >
< >
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}|LowerFilters /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\\LowerFilters: AFS2K [binary data]
< End of report >
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
502.80 Mb Total Physical Memory | 332.85 Mb Available Physical Memory | 66.20% Memory free
843.82 Mb Paging File | 591.62 Mb Available in Paging File | 70.11% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 17.98 Gb Free Space | 48.23% Space Free | Partition Type: NTFS
Computer Name: PEGGY | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe (W3i, LLC)
PRC - C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiSeAgnt.exe (Trend Micro Inc.)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\Trend Micro\RUBotted\TMRUBottedLite.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\sndvol32.exe (Microsoft Corporation)
========== Modules (No Company Name) ==========
MOD - C:\Program Files\Trend Micro\UniClient\plugins\LUADLL.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\sqlite3.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\libprotobuf.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\update\iau_sdk\iaucore\iaucore.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\update\iau_sdk\iau.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\boost_date_time-vc80-mt-1_36.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\boost_thread-vc80-mt-1_36.dll ()
MOD - C:\Program Files\FileZilla FTP Client\fzshellext.dll ()
MOD - C:\Program Files\Trend Micro\RUBotted\TMRUBottedLite.exe ()
MOD - C:\WINDOWS\system32\Primomonnt.dll ()
========== Win32 Services (SafeList) ==========
SRV - (z800obex) – %systemroot%\system32\rollbackclientservice.dll File not found
SRV - (IntuitUpdateService) – %systemroot%\system32\imaservice.dll File not found
SRV - (HidServ) – %SystemRoot%\System32\hidserv.dll File not found
SRV - (Amsp) – C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe File not found
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (RUBotted) – C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe (Trend Micro Inc.)
========== Driver Services (SafeList) ==========
DRV - (WDICA) – File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (catchme) – C:\jgh\catchme.sys File not found
DRV - (76851537) – system32\drivers\21461316.sys File not found
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (TMPassthruMP) – C:\WINDOWS\system32\drivers\TMPassthru.sys (Trend Micro Inc.)
DRV - (TMPassthru) – C:\WINDOWS\system32\drivers\TMPassthru.sys (Trend Micro Inc.)
DRV - (AFS2K) – C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (iAimFP4) – C:\WINDOWS\system32\drivers\wvchntxx.sys (Intel® Corporation)
DRV - (iAimFP3) – C:\WINDOWS\system32\drivers\wsiintxx.sys (Intel® Corporation)
DRV - (iAimTV5) – C:\WINDOWS\system32\drivers\watv10nt.sys (Intel® Corporation)
DRV - (iAimTV4) – C:\WINDOWS\system32\drivers\wch7xxnt.sys (Intel® Corporation)
DRV - (iAimTV6) – C:\WINDOWS\system32\drivers\watv06nt.sys (Intel® Corporation)
DRV - (iAimTV3) – C:\WINDOWS\system32\drivers\watv04nt.sys (Intel® Corporation)
DRV - (iAimTV1) – C:\WINDOWS\system32\drivers\watv02nt.sys (Intel® Corporation)
DRV - (iAimTV0) – C:\WINDOWS\system32\drivers\watv01nt.sys (Intel® Corporation)
DRV - (iAimFP7) – C:\WINDOWS\system32\drivers\wadv09nt.sys (Intel® Corporation)
DRV - (iAimFP5) – C:\WINDOWS\system32\drivers\wadv07nt.sys (Intel® Corporation)
DRV - (iAimFP6) – C:\WINDOWS\system32\drivers\wadv08nt.sys (Intel® Corporation)
DRV - (i81x) – C:\WINDOWS\system32\drivers\i81xnt5.sys (Intel® Corporation)
DRV - (iAimFP0) – C:\WINDOWS\system32\drivers\wadv01nt.sys (Intel® Corporation)
DRV - (iAimFP1) – C:\WINDOWS\system32\drivers\wadv02nt.sys (Intel® Corporation)
DRV - (iAimFP2) – C:\WINDOWS\system32\drivers\wadv05nt.sys (Intel® Corporation)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (Symmpi) – C:\WINDOWS\system32\drivers\symmpi.sys (LSI Logic)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0409/bl8.asp
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{E4013329-B79F-4680-AD25-5D4D64F28342}: "URL" = http://www.onestepsearch.net/?prt=ONESTEP1…s={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\URLSearchHook: - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0C55421B-685A-4156-A691-073C1D6AEBD2}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKCU\..\SearchScopes\{0C55421B-685A-4156-A691-073C1D6AEBD2}: "URL" = http://search.yahoo.com/search?p={searchTe…-8&fr=b1ie7
IE - HKCU\..\SearchScopes\{579457C0-C7D6-481B-8DBF-3CA259316F8C}: "URL" = http://rover.ebay.com/rover/1/711-43047-14…e={searchTerms}
IE - HKCU\..\SearchScopes\{D5EF9B3F-A073-433A-BDDE-BE64509C0AB3}: "URL" = http://www.flickr.com/search/?q={searchTerms}
IE - HKCU\..\SearchScopes\{E58FD494-9104-4DA0-AD13-7C6A590592BD}: "URL" = http://delicious.com/search?p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p="
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.3.6.20110307083656
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p="
FF - prefs.js..network.proxy.type: 1
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/npracplug;version=1.0.0.0: C:\Program Files\Real\RealArcade\Plugins\Mozilla\npracplug.dll (RealNetworks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1505\6.6.1088\firefoxextension\ [2012/04/21 16:16:05 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/04/12 21:39:30 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/04/21 16:20:07 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.18\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2008/11/25 12:38:29 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.18\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{ABC82C52-8331-11E1-826D-B8AC6F996F26}: C:\Documents and Settings\Administrator\Local Settings\Application Data\{ABC82C52-8331-11E1-826D-B8AC6F996F26}\
[2008/12/23 10:38:55 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2012/02/03 17:55:28 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ugvbjuwp.default\extensions
[2012/01/25 17:25:51 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ugvbjuwp.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/04/12 21:39:26 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/04/12 21:39:27 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\distribution\extensions
[2012/04/12 21:39:27 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Program Files\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/11/20 23:04:51 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/02/03 18:28:29 | 000,028,472 | —- | M] (WebEx Communications, Inc) – C:\Program Files\mozilla firefox\plugins\atgpcdec.dll
[2010/02/03 18:28:29 | 000,185,224 | —- | M] (WebEx Communications, Inc) – C:\Program Files\mozilla firefox\plugins\atgpcext.dll
[2010/02/03 18:28:28 | 000,061,832 | —- | M] (WebEx Communications, Inc) – C:\Program Files\mozilla firefox\plugins\npatgpc.dll
[2011/03/18 13:32:12 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll
[2011/03/18 13:32:14 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npMozCouponPrinter.dll
[2011/11/20 20:04:05 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/11/20 20:04:05 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml
========== Chrome ==========
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}source
id=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
O1 HOSTS File: ([2012/04/12 19:36:46 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1505\6.6.1088\TmIEPlg.dll (Trend Micro Inc.)
O2 - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {871F91FD-3A92-4988-A842-16AB2CFF5AF1} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [srmclean] C:\cpqs\scom\srmclean.exe ()
O4 - HKLM..\Run: [TMRUBottedTray] C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [Trend Micro Client Framework] C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [Trend Micro Titanium] C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe (Trend Micro Inc.)
O4 - HKCU..\Run: [InstallIQUpdater] C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe (W3i, LLC)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKCU\..Trusted Domains: westlaw.com ([]* in Trusted sites)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Reg Error: Key error.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/C/0…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab (Symantec AntiVirus scanner)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://photos.walmart.com/WalmartActivia.cab (Snapfish Activia)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/…lscbase5483.cab (Windows Live Safety Center Base Module)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {6824D897-F7E1-4E41-B84B-B1D3FA4BF1BD} http://utilities.pcpitstop.com/Exterminate…opAntiVirus.dll (PCPitstop AntiVirus)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{293A756F-F0E8-4250-BFB4-F00ACF54F34F}: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll File not found
O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1505\6.6.1088\TmIEPlg.dll (Trend Micro Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - File not found
O24 - Desktop Components:0 () - http://mail.charter.net/images/portal/msgt…S&v=charter
O24 - Desktop Components:1 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2012/04/24 17:20:04 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\Downloaded Installations
[2012/04/17 10:15:17 | 001,268,204 | —- | C] (Agere Systems) – C:\WINDOWS\System32\drivers\AGRSM.sys
[2012/04/17 10:15:17 | 000,019,455 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wvchntxx.sys
[2012/04/17 10:15:17 | 000,019,455 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\wvchntxx.sys
[2012/04/17 10:15:16 | 000,012,063 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wsiintxx.sys
[2012/04/17 10:15:16 | 000,012,063 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\wsiintxx.sys
[2012/04/17 10:15:15 | 000,023,615 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wch7xxnt.sys
[2012/04/17 10:15:15 | 000,023,615 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\wch7xxnt.sys
[2012/04/17 10:15:14 | 000,033,599 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\watv04nt.sys
[2012/04/17 10:15:14 | 000,033,599 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\watv04nt.sys
[2012/04/17 10:15:14 | 000,025,471 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\watv10nt.sys
[2012/04/17 10:15:14 | 000,025,471 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\watv10nt.sys
[2012/04/17 10:15:14 | 000,019,551 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\watv02nt.sys
[2012/04/17 10:15:14 | 000,019,551 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\watv02nt.sys
[2012/04/17 10:15:13 | 000,029,311 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\watv01nt.sys
[2012/04/17 10:15:13 | 000,029,311 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\watv01nt.sys
[2012/04/17 10:15:13 | 000,011,871 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wadv09nt.sys
[2012/04/17 10:15:13 | 000,011,871 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\wadv09nt.sys
[2012/04/17 10:15:12 | 000,011,807 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wadv07nt.sys
[2012/04/17 10:15:12 | 000,011,807 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\wadv07nt.sys
[2012/04/17 10:15:12 | 000,011,775 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wadv05nt.sys
[2012/04/17 10:15:12 | 000,011,775 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\wadv05nt.sys
[2012/04/17 10:15:12 | 000,011,295 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wadv08nt.sys
[2012/04/17 10:15:12 | 000,011,295 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\wadv08nt.sys
[2012/04/17 10:15:11 | 000,012,415 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wadv01nt.sys
[2012/04/17 10:15:11 | 000,012,415 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\wadv01nt.sys
[2012/04/17 10:15:11 | 000,012,127 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wadv02nt.sys
[2012/04/17 10:15:11 | 000,012,127 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\wadv02nt.sys
[2012/04/17 10:15:10 | 000,022,271 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\watv06nt.sys
[2012/04/17 10:15:10 | 000,022,271 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\watv06nt.sys
[2012/04/17 10:15:05 | 000,161,020 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\i81xnt5.sys
[2012/04/17 10:15:05 | 000,161,020 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\dllcache\i81xnt5.sys
[2012/04/17 10:15:04 | 000,000,000 | —D | C] – C:\_OTL
[2012/04/12 20:51:34 | 000,000,000 | —D | C] – C:\TDSSKiller_Quarantine
[2012/04/12 20:46:01 | 002,071,600 | —- | C] (Kaspersky Lab ZAO) – C:\Documents and Settings\Administrator\Desktop\tdsskiller.exe
[2012/04/12 20:41:09 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2012/04/11 17:53:40 | 000,034,735 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1xsxx.sys
[2012/04/11 17:53:40 | 000,034,735 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1xsxx.sys
[2012/04/11 17:53:39 | 000,036,463 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1tuxx.sys
[2012/04/11 17:53:39 | 000,036,463 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1tuxx.sys
[2012/04/11 17:53:39 | 000,029,455 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1xbxx.sys
[2012/04/11 17:53:39 | 000,029,455 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1xbxx.sys
[2012/04/11 17:53:39 | 000,026,367 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1snxx.sys
[2012/04/11 17:53:39 | 000,026,367 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1snxx.sys
[2012/04/11 17:53:39 | 000,021,343 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1ttxx.sys
[2012/04/11 17:53:39 | 000,021,343 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1ttxx.sys
[2012/04/11 17:53:38 | 000,063,663 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1rvxx.sys
[2012/04/11 17:53:38 | 000,063,663 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1rvxx.sys
[2012/04/11 17:53:38 | 000,030,671 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1raxx.sys
[2012/04/11 17:53:38 | 000,030,671 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1raxx.sys
[2012/04/11 17:53:38 | 000,012,047 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1pdxx.sys
[2012/04/11 17:53:38 | 000,012,047 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1pdxx.sys
[2012/04/11 17:53:37 | 000,056,623 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1btxx.sys
[2012/04/11 17:53:37 | 000,056,623 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1btxx.sys
[2012/04/11 17:53:37 | 000,011,615 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1mdxx.sys
[2012/04/11 17:53:37 | 000,011,615 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1mdxx.sys
[2012/04/11 17:35:09 | 000,000,000 | RHSD | C] – C:\cmdcons
[2012/04/11 17:32:03 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2012/04/11 17:32:03 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2012/04/11 17:32:03 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2012/04/11 17:32:02 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2012/04/11 17:31:24 | 000,000,000 | —D | C] – C:\Qoobox
[2012/04/11 17:27:36 | 004,458,963 | R— | C] (Swearware) – C:\Documents and Settings\Administrator\Desktop\jgh.exe
[2012/04/11 11:05:30 | 000,593,920 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/04/11 11:03:38 | 004,731,392 | —- | C] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2012/04/11 10:09:41 | 000,040,776 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012/04/10 17:59:43 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2012/04/10 17:59:35 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[1 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012/04/24 10:09:03 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/04/24 10:08:40 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/04/24 10:08:39 | 527,290,368 | -HS- | M] () – C:\hiberfil.sys
[2012/04/23 20:42:54 | 000,000,226 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\net.bat
[2012/04/23 17:32:55 | 000,736,238 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\mini-blind-window-shade.jpg
[2012/04/23 17:15:47 | 000,012,234 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\gray256.gif
[2012/04/21 16:20:07 | 000,001,729 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2012/04/21 16:14:18 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/04/18 11:16:45 | 000,007,028 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\PrimoPDFSet.xml
[2012/04/18 11:16:44 | 000,032,296 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\System Resource Report.pdf
[2012/04/12 21:39:34 | 000,000,742 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/04/12 21:39:34 | 000,000,724 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Mozilla Firefox.lnk
[2012/04/12 21:13:56 | 000,349,792 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/04/12 20:45:44 | 002,071,600 | —- | M] (Kaspersky Lab ZAO) – C:\Documents and Settings\Administrator\Desktop\tdsskiller.exe
[2012/04/12 19:36:46 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2012/04/12 12:07:59 | 000,115,686 | —- | M] () – C:\WINDOWS\System32\itldvupd.dat
[2012/04/12 03:15:02 | 000,456,014 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/04/12 03:15:02 | 000,076,230 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/04/12 03:04:14 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2012/04/11 17:35:31 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2012/04/11 17:26:00 | 004,458,963 | R— | M] (Swearware) – C:\Documents and Settings\Administrator\Desktop\jgh.exe
[2012/04/11 15:27:19 | 000,593,920 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/04/11 12:31:03 | 000,002,305 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Adobe Reader 9.lnk
[2012/04/11 11:21:06 | 000,002,463 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk
[2012/04/11 11:03:54 | 004,731,392 | —- | M] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2012/04/11 10:09:41 | 000,040,776 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012/04/10 18:52:33 | 000,011,914 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.jpg
[2012/04/10 18:52:33 | 000,002,180 | —- | M] () – C:\Documents and Settings\Administrator\.recently-used.xbel
[2012/04/10 18:36:09 | 000,081,049 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.gif
[2012/04/10 15:29:48 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/04/07 20:00:11 | 000,054,156 | -H– | M] () – C:\WINDOWS\QTFont.qfn
[2012/04/04 15:56:40 | 000,022,344 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2012/03/29 10:40:26 | 000,002,497 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Microsoft Office Word 2003.lnk
[1 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012/04/23 20:42:54 | 000,000,226 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\net.bat
[2012/04/23 17:32:54 | 000,736,238 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\mini-blind-window-shade.jpg
[2012/04/23 17:15:47 | 000,012,234 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\gray256.gif
[2012/04/21 16:18:27 | 000,001,729 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2012/04/21 16:18:26 | 000,002,347 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader 9.lnk
[2012/04/21 16:13:35 | 527,290,368 | -HS- | C] () – C:\hiberfil.sys
[2012/04/14 09:51:50 | 000,032,296 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\System Resource Report.pdf
[2012/04/12 16:37:55 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/04/11 17:35:30 | 000,000,211 | —- | C] () – C:\Boot.bak
[2012/04/11 17:35:14 | 000,260,272 | RHS- | C] () – C:\cmldr
[2012/04/11 17:32:03 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2012/04/11 17:32:03 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2012/04/11 17:32:03 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2012/04/11 17:32:03 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2012/04/11 17:32:03 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2012/04/11 08:59:44 | 000,115,686 | —- | C] () – C:\WINDOWS\System32\itldvupd.dat
[2012/04/10 18:52:33 | 000,002,180 | —- | C] () – C:\Documents and Settings\Administrator\.recently-used.xbel
[2012/04/10 18:42:29 | 000,011,914 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.jpg
[2012/04/10 18:36:09 | 000,081,049 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.gif
[2012/04/10 15:29:48 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/02/15 20:52:17 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2012/02/07 11:12:33 | 000,201,528 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/10/31 15:49:25 | 000,000,020 | —- | C] () – C:\WINDOWS\MainWHnd.INI
[2011/10/31 15:48:17 | 000,000,284 | —- | C] () – C:\WINDOWS\GvSaveImage.ini
[2011/10/31 15:48:13 | 000,000,512 | —- | C] () – C:\WINDOWS\GeoImageProcess_8200.ini
[2011/10/31 15:36:53 | 000,000,390 | —- | C] () – C:\WINDOWS\GeoLan.ini
[2011/10/31 15:36:45 | 000,000,082 | —- | C] () – C:\WINDOWS\GeoDebug61.ini
[2010/08/26 14:47:52 | 000,311,296 | R— | C] () – C:\WINDOWS\System32\SimplyVBUnitLib.dll
========== Custom Scans ==========
< HKEY_LOCAL_MACHINE\System\CrrentControlSet\Services\redbook /s >
"ImagePath" = system32\drivers\redbook.sys – [2012/04/12 20:52:57 | 000,057,600 | —- | M] (Microsoft Corporation)
< >
< HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\76851537 /s >
"Type" = 2
"ErrorControl" = 1
"Start" = 0
"ImagePath" = system32\drivers\21461316.sys
"Group" = System Reserved
"5781_5028" = [Binary data over 100 bytes]
< >
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}|UpperFilters /rs >
< >
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}|LowerFilters /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\\LowerFilters: AFS2K [binary data]
< End of report >
