WTF is this zombie virus or malware? [Closed]

Pardon the strongly worded "wtf", but I'm a bit frustrated with this little mamajama virus.
Something is eating up all my RAM and causing my PC to run ubber slow.
I've done virus and malware scans and zelch, nada, nothing turns up.
It not only makes things slow, but none of my personal settingsalways save.
Nothing is ever remembered on my start menu window.
And just some other random stuff.

What to do?
I ran the OTL scan and here is what I got.

OTL logfile created on: 5/17/2012 9:17:09 PM - Run 1
OTL by OldTimer - Version 3.2.43.0 Folder = C:\Users\Fernanda\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.87 Gb Total Physical Memory | 1.25 Gb Available Physical Memory | 66.86% Memory free
3.98 Gb Paging File | 3.30 Gb Available in Paging File | 82.97% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 136.49 Gb Total Space | 71.40 Gb Free Space | 52.31% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 6.62 Gb Free Space | 66.19% Space Free | Partition Type: NTFS

Computer Name: FERNANDA-PC | User Name: Fernanda | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/05/17 21:16:11 | 000,595,456 | —- | M] (OldTimer Tools) – C:\Users\Fernanda\Desktop\OTL.exe
PRC - [2011/04/19 02:44:40 | 000,399,416 | —- | M] (Secunia) – C:\Program Files\Secunia\PSI\sua.exe
PRC - [2011/02/23 10:04:20 | 003,451,496 | —- | M] (AVAST Software) – C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2011/02/23 10:04:19 | 000,042,184 | —- | M] (AVAST Software) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2011/02/23 10:04:17 | 000,121,000 | —- | M] (AVAST Software) – C:\Program Files\AVAST Software\Avast\afwServ.exe
PRC - [2009/04/11 02:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2007/09/13 15:45:38 | 000,102,400 | —- | M] (IDT, Inc.) – C:\Windows\System32\stacsv.exe
PRC - [2007/09/13 15:44:48 | 000,405,504 | —- | M] (IDT, Inc.) – C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
PRC - [2006/11/02 05:45:59 | 000,215,552 | —- | M] (Microsoft Corporation) – C:\Windows\WindowsMobile\wmdSync.exe


========== Modules (No Company Name) ==========

MOD - [2007/03/21 02:03:44 | 000,159,744 | —- | M] () – C:\Windows\System32\atitmmxx.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] – C:\Program Files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe – (IHA_MessageCenter)
SRV - File not found [Auto | Stopped] – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon – (CLTNetCnService)
SRV - [2012/05/06 00:27:15 | 000,257,696 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/04/20 21:16:42 | 000,129,976 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2011/04/19 02:44:40 | 000,993,848 | —- | M] (Secunia) [On_Demand | Stopped] – C:\Program Files\Secunia\PSI\psia.exe – (Secunia PSI Agent)
SRV - [2011/04/19 02:44:40 | 000,399,416 | —- | M] (Secunia) [Auto | Running] – C:\Program Files\Secunia\PSI\sua.exe – (Secunia Update Agent)
SRV - [2011/02/23 10:04:19 | 000,042,184 | —- | M] (AVAST Software) [Auto | Running] – C:\Program Files\AVAST Software\Avast\AvastSvc.exe – (avast! Antivirus)
SRV - [2011/02/23 10:04:17 | 000,121,000 | —- | M] (AVAST Software) [Auto | Running] – C:\Program Files\AVAST Software\Avast\afwServ.exe – (avast! Firewall)
SRV - [2008/01/19 03:38:24 | 000,272,952 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2008/01/19 03:36:49 | 000,365,568 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\WindowsMobile\wcescomm.dll – (WcesComm)
SRV - [2008/01/19 03:36:15 | 000,167,936 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\WindowsMobile\rapimgr.dll – (RapiMgr)
SRV - [2007/10/09 19:56:30 | 000,202,544 | —- | M] (SupportSoft, Inc.) [Disabled | Stopped] – C:\Program Files\Dell Support Center\bin\sprtsvc.exe – (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
SRV - [2007/09/20 15:31:10 | 000,073,728 | —- | M] (Andrea Electronics Corporation) [Disabled | Stopped] – C:\Windows\System32\AEstSrv.exe – (AESTFilters)
SRV - [2007/09/13 15:45:38 | 000,102,400 | —- | M] (IDT, Inc.) [Auto | Running] – C:\Windows\System32\stacsv.exe – (STacSV)
SRV - [2007/03/19 13:44:44 | 000,070,656 | —- | M] () [Disabled | Stopped] – C:\Program Files\DellSupport\brkrsvc.exe – (DSBrokerService)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – – (PCD5SRVC{FBEA8B78-1B22F121-05040000})
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkfwd.sys – (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkflt.sys – (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS – (MRESP50)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS – (MRENDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS – (MREMPR5)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS – (MREMP50)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\ipinip.sys – (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Users\Fernanda\AppData\Local\Temp\catchme.sys – (catchme)
DRV - File not found [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\blbdrive.sys – (blbdrive)
DRV - [2011/02/23 09:57:38 | 000,101,976 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\Windows\System32\drivers\aswFW.sys – (aswFW)
DRV - [2011/02/23 09:56:55 | 000,371,544 | —- | M] (AVAST Software) [File_System | System | Running] – C:\Windows\System32\drivers\aswSnx.sys – (aswSnx)
DRV - [2011/02/23 09:56:45 | 000,301,528 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\Windows\System32\drivers\aswSP.sys – (aswSP)
DRV - [2011/02/23 09:56:41 | 000,192,728 | —- | M] (AVAST Software) [Kernel | Boot | Running] – C:\Windows\System32\drivers\aswNdis2.sys – (aswNdis2)
DRV - [2011/02/23 09:55:49 | 000,049,240 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\Windows\System32\drivers\aswTdi.sys – (aswTdi)
DRV - [2011/02/23 09:55:10 | 000,025,432 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\Windows\System32\drivers\aswRdr.sys – (aswRdr)
DRV - [2011/02/23 09:55:03 | 000,053,592 | —- | M] (AVAST Software) [File_System | Auto | Running] – C:\Windows\System32\drivers\aswMonFlt.sys – (aswMonFlt)
DRV - [2011/02/23 09:54:55 | 000,019,544 | —- | M] (AVAST Software) [File_System | Auto | Running] – C:\Windows\System32\drivers\aswFsBlk.sys – (aswFsBlk)
DRV - [2011/02/23 08:34:54 | 000,012,112 | —- | M] (ALWIL Software) [Kernel | Boot | Running] – C:\Windows\System32\drivers\aswNdis.sys – (aswNdis)
DRV - [2010/09/01 04:30:58 | 000,015,544 | —- | M] (Secunia) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\psi_mf.sys – (PSI)
DRV - [2008/01/18 05:00:00 | 000,385,072 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys – (eeCtrl)
DRV - [2007/10/10 18:03:00 | 000,235,648 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\OEM02Dev.sys – (OEM02Dev)
DRV - [2007/09/13 15:46:06 | 000,330,240 | —- | M] (IDT, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\stwrt.sys – (STHDA)
DRV - [2007/03/21 02:13:08 | 002,411,520 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\atikmdag.sys – (R300)
DRV - [2007/03/21 02:13:08 | 002,411,520 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\atikmdag.sys – (atikmdag)
DRV - [2007/03/05 22:45:00 | 000,007,424 | —- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\OEM02Vfx.sys – (OEM02Vfx)
DRV - [2007/02/25 13:10:48 | 000,005,376 | –S- | M] (Gteko Ltd.) [Kernel | Auto | Running] – C:\Windows\System32\drivers\dsunidrv.sys – (dsunidrv)
DRV - [2006/11/21 08:25:44 | 000,045,568 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\bcm4sbxp.sys – (bcm4sbxp)
DRV - [2006/11/15 04:16:24 | 000,032,256 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rimmptsk.sys – (rimmptsk)
DRV - [2006/11/14 23:42:46 | 000,043,520 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rimsptsk.sys – (rimsptsk)
DRV - [2006/11/14 21:35:20 | 000,037,376 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rixdptsk.sys – (rismxdp)
DRV - [2006/11/02 03:30:55 | 000,200,704 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\e1e6032.sys – (e1express) Intel®
DRV - [2006/10/30 11:23:12 | 000,007,680 | —- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] – C:\Windows\System32\drivers\AtiPcie.sys – (AtiPcie) ATI PCI Express (3GIO)
DRV - [2006/10/05 18:07:28 | 000,004,736 | —- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] – C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys – (DSproct)
DRV - [2006/08/04 20:39:10 | 000,008,192 | —- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] – C:\Windows\System32\drivers\XAudio.sys – (XAudio)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…amp;rlz=1I7DKUS

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?fr=fp-yie8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {8E02D41C-5924-4816-9490-33CCD28BEB72}
IE - HKCU\..\SearchScopes\{04C005E1-6F34-4AFE-BBD4-2EE140B0A189}: "URL" = http://delicious.com/search?p={searchTerms}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{5AC0E922-88E6-4863-8D7B-450A84B30D1B}: "URL" = http://www.flickr.com/search/?q={searchTerms}
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…amp;rlz=1I7DKUS
IE - HKCU\..\SearchScopes\{8E02D41C-5924-4816-9490-33CCD28BEB72}: "URL" = http://us.yhs.search.yahoo.com/avg/search?…p={searchTerms}
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?p={searchTerms}
IE - HKCU\..\SearchScopes\{E219C572-B093-42B4-B0EE-DF84B9E4D687}: "URL" = http://rover.ebay.com/rover/1/711-43047-14…e={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.3: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Fernanda\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Fernanda\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012/05/17 10:34:08 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/05/16 23:58:41 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/05/16 22:52:59 | 000,000,000 | —D | M]

[2009/09/17 19:30:10 | 000,000,000 | —D | M] (No name found) – C:\Users\Fernanda\AppData\Roaming\Mozilla\Extensions
[2009/09/17 19:30:10 | 000,000,000 | —D | M] (No name found) – C:\Users\Fernanda\AppData\Roaming\Mozilla\Extensions\[removed]
[2012/05/16 22:31:09 | 000,000,000 | —D | M] (No name found) – C:\Users\Fernanda\AppData\Roaming\Mozilla\Firefox\Profiles\ebmqvnyy.default\extensions
[2012/05/16 23:58:41 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/06/22 12:33:25 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/01/08 16:06:01 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/05/17 10:34:08 | 000,000,000 | —D | M] (avast! WebRep) – C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
[2012/04/20 21:18:00 | 000,097,208 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/05/16 22:56:59 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012/04/20 22:09:17 | 000,001,525 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2012/04/20 22:09:17 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/04/20 22:09:17 | 000,000,935 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2012/04/20 22:09:17 | 000,001,166 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2012/04/20 22:09:17 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml
[2012/04/20 22:09:18 | 000,001,121 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2011/06/19 10:00:31 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll ()
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} http://www.seehere.com/ips-opdata/layout/f…dan-canvasx.cab (JordanUploader Class)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://www2.snapfish.com/SnapfishActivia.cab (Snapfish Activia)
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} http://lads.myspace.com/upload/MySpaceUploader1006.cab (MySpace Uploader Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos-beta/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} http://web1.shutterfly.com/downloads/Uploader.cab (Shutterfly Picture Upload Plugin)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} http://www.adobe.com/products/acrobat/nos/gp.cab (get_atlcom Class)
O16 - DPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} http://www.cvsphoto.com/upload/activex/v3_…veX_Control.cab (Photo Upload Plugin Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3ABB5C2C-F4B7-4364-B0E6-9ADC038D41C9}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Fernanda\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Fernanda\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/05/17 21:16:00 | 000,595,456 | —- | C] (OldTimer Tools) – C:\Users\Fernanda\Desktop\OTL.exe
[2012/05/17 10:37:59 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Internet Security
[2012/05/17 10:37:58 | 000,019,544 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswFsBlk.sys
[2012/05/17 10:37:57 | 000,301,528 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswSP.sys
[2012/05/17 10:37:49 | 000,101,976 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswFW.sys
[2012/05/17 10:35:16 | 000,192,728 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswNdis2.sys
[2012/05/17 10:35:16 | 000,025,432 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswRdr.sys
[2012/05/17 10:35:15 | 000,371,544 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswSnx.sys
[2012/05/17 10:35:15 | 000,053,592 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswMonFlt.sys
[2012/05/17 10:35:15 | 000,049,240 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswTdi.sys
[2012/05/17 10:34:04 | 000,012,112 | —- | C] (ALWIL Software) – C:\Windows\System32\drivers\aswNdis.sys
[2012/05/17 10:34:03 | 000,040,648 | —- | C] (AVAST Software) – C:\Windows\avastSS.scr
[2012/05/17 10:34:02 | 000,190,016 | —- | C] (AVAST Software) – C:\Windows\System32\aswBoot.exe
[2012/05/16 22:58:36 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2012/05/16 22:55:04 | 000,000,000 | —D | C] – C:\Users\Fernanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012/05/16 22:52:45 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2012/05/16 22:52:18 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2012/05/16 22:34:50 | 000,000,000 | —D | C] – C:\ProgramData\Mozilla
[2012/05/16 22:34:49 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Maintenance Service

========== Files - Modified Within 30 Days ==========

[2012/05/17 21:33:00 | 000,000,428 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{6A6FD9FB-878B-4FBC-9D07-70ED794E872E}.job
[2012/05/17 21:27:02 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/05/17 21:16:11 | 000,595,456 | —- | M] (OldTimer Tools) – C:\Users\Fernanda\Desktop\OTL.exe
[2012/05/17 21:11:23 | 000,003,680 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/05/17 21:11:22 | 000,003,680 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/05/17 21:11:05 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/05/17 21:11:00 | 2011,324,416 | -HS- | M] () – C:\hiberfil.sys
[2012/05/17 21:04:00 | 000,000,920 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1809433382-771992600-2837674101-1000UA.job
[2012/05/17 10:37:59 | 000,001,831 | —- | M] () – C:\Users\Public\Desktop\avast! Internet Security.lnk
[2012/05/17 10:35:15 | 000,002,577 | —- | M] () – C:\Windows\System32\config.nt
[2012/05/17 10:28:00 | 000,604,502 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/05/17 10:28:00 | 000,104,170 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/05/16 23:58:45 | 000,000,872 | —- | M] () – C:\Users\Fernanda\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/05/16 23:58:45 | 000,000,848 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/05/16 23:35:36 | 000,000,945 | —- | M] () – C:\Users\Fernanda\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/05/16 23:25:24 | 000,008,798 | —- | M] () – C:\Windows\System32\icrav03.rat
[2012/05/16 23:25:24 | 000,001,988 | —- | M] () – C:\Windows\System32\ticrf.rat
[2012/05/16 23:24:50 | 000,072,822 | —- | M] () – C:\Windows\System32\ieuinit.inf
[2012/05/16 23:23:50 | 000,000,908 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/05/16 23:04:00 | 000,000,868 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1809433382-771992600-2837674101-1000Core.job
[2012/05/16 22:52:45 | 000,001,728 | —- | M] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2012/05/16 22:52:42 | 014,901,760 | —- | M] () – C:\Users\Fernanda\Desktop\JavaJRE_6u31_32-bit.exe
[2012/05/16 22:49:13 | 028,193,792 | —- | M] () – C:\Users\Fernanda\Desktop\GoogleChrome_19.0.1084.46_SPS.exe
[2012/05/16 22:45:49 | 000,001,889 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 8.lnk
[2012/05/09 10:05:55 | 000,287,672 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT

========== Files Created - No Company Name ==========

[2012/05/17 11:18:07 | 2011,324,416 | -HS- | C] () – C:\hiberfil.sys
[2012/05/17 10:37:59 | 000,001,831 | —- | C] () – C:\Users\Public\Desktop\avast! Internet Security.lnk
[2012/05/16 23:57:20 | 000,000,864 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
[2012/05/16 23:35:36 | 000,000,945 | —- | C] () – C:\Users\Fernanda\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/05/16 23:24:50 | 000,072,822 | —- | C] () – C:\Windows\System32\ieuinit.inf
[2012/05/16 23:23:50 | 000,000,908 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/05/16 22:54:15 | 000,000,920 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1809433382-771992600-2837674101-1000UA.job
[2012/05/16 22:54:12 | 000,000,868 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1809433382-771992600-2837674101-1000Core.job
[2012/05/16 22:52:45 | 000,001,728 | —- | C] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2012/05/16 22:51:35 | 014,901,760 | —- | C] () – C:\Users\Fernanda\Desktop\JavaJRE_6u31_32-bit.exe
[2012/05/16 22:48:17 | 028,193,792 | —- | C] () – C:\Users\Fernanda\Desktop\GoogleChrome_19.0.1084.46_SPS.exe
[2012/05/16 22:45:49 | 000,001,889 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader 8.lnk
[2012/05/16 22:34:55 | 000,000,848 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/06/19 09:44:04 | 000,256,512 | —- | C] () – C:\Windows\PEV.exe
[2011/06/19 09:44:04 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2011/06/19 09:44:04 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2011/06/19 09:44:04 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2011/06/19 09:44:04 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2011/05/24 14:31:37 | 000,000,144 | —- | C] () – C:\ProgramData\~36429560r
[2011/05/24 14:31:37 | 000,000,112 | —- | C] () – C:\ProgramData\~36429560
[2011/05/24 14:29:51 | 000,000,336 | —- | C] () – C:\ProgramData\36429560

========== LOP Check ==========

[2007/11/13 20:30:23 | 000,000,000 | —D | M] – C:\Users\Fernanda\AppData\Roaming\MyPublisher
[2011/03/01 16:14:31 | 000,000,000 | —D | M] – C:\Users\Fernanda\AppData\Roaming\TechWizard
[2007/08/23 01:15:19 | 000,000,000 | —D | M] – C:\Users\Fernanda\AppData\Roaming\tmp
[2009/07/22 15:41:34 | 000,000,000 | —D | M] – C:\Users\Fernanda\AppData\Roaming\WinPatrol
[2012/05/17 21:09:50 | 000,032,546 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2012/05/17 21:33:00 | 000,000,428 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{6A6FD9FB-878B-4FBC-9D07-70ED794E872E}.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:DFC5A2B2

< End of report >

Hey Jeff,
Thanx for the quick response.

Here is the New OTL log post:


OTL logfile created on: 5/20/2012 5:18:13 PM - Run 2
OTL by OldTimer - Version 3.2.43.0 Folder = C:\Users\Fernanda\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.87 Gb Total Physical Memory | 0.98 Gb Available Physical Memory | 52.22% Memory free
3.99 Gb Paging File | 3.00 Gb Available in Paging File | 75.35% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 136.49 Gb Total Space | 73.38 Gb Free Space | 53.77% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 6.62 Gb Free Space | 66.19% Space Free | Partition Type: NTFS

Computer Name: FERNANDA-PC | User Name: Fernanda | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/05/17 21:16:11 | 000,595,456 | —- | M] (OldTimer Tools) – C:\Users\Fernanda\Desktop\OTL.exe
PRC - [2012/04/20 21:16:21 | 000,924,600 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011/04/19 02:44:40 | 000,399,416 | —- | M] (Secunia) – C:\Program Files\Secunia\PSI\sua.exe
PRC - [2011/02/23 10:04:20 | 003,451,496 | —- | M] (AVAST Software) – C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2011/02/23 10:04:19 | 000,042,184 | —- | M] (AVAST Software) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2011/02/23 10:04:17 | 000,121,000 | —- | M] (AVAST Software) – C:\Program Files\AVAST Software\Avast\afwServ.exe
PRC - [2009/04/11 02:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2007/09/13 15:45:38 | 000,102,400 | —- | M] (IDT, Inc.) – C:\Windows\System32\stacsv.exe
PRC - [2007/09/13 15:44:48 | 000,405,504 | —- | M] (IDT, Inc.) – C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
PRC - [2006/11/02 05:45:59 | 000,215,552 | —- | M] (Microsoft Corporation) – C:\Windows\WindowsMobile\wmdSync.exe


========== Modules (No Company Name) ==========

MOD - [2012/05/06 00:27:11 | 008,797,856 | —- | M] () – C:\Windows\System32\Macromed\Flash\NPSWF32_11_2_202_235.dll
MOD - [2012/04/20 21:16:53 | 001,952,696 | —- | M] () – C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2007/03/21 02:03:44 | 000,159,744 | —- | M] () – C:\Windows\System32\atitmmxx.dll
MOD - [2006/12/19 20:16:04 | 000,073,728 | —- | M] () – C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] – C:\Program Files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe – (IHA_MessageCenter)
SRV - File not found [Auto | Stopped] – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon – (CLTNetCnService)
SRV - [2012/05/06 00:27:15 | 000,257,696 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2012/04/20 21:16:42 | 000,129,976 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2011/04/19 02:44:40 | 000,993,848 | —- | M] (Secunia) [On_Demand | Stopped] – C:\Program Files\Secunia\PSI\psia.exe – (Secunia PSI Agent)
SRV - [2011/04/19 02:44:40 | 000,399,416 | —- | M] (Secunia) [Auto | Running] – C:\Program Files\Secunia\PSI\sua.exe – (Secunia Update Agent)
SRV - [2011/02/23 10:04:19 | 000,042,184 | —- | M] (AVAST Software) [Auto | Running] – C:\Program Files\AVAST Software\Avast\AvastSvc.exe – (avast! Antivirus)
SRV - [2011/02/23 10:04:17 | 000,121,000 | —- | M] (AVAST Software) [Auto | Running] – C:\Program Files\AVAST Software\Avast\afwServ.exe – (avast! Firewall)
SRV - [2008/01/19 03:38:24 | 000,272,952 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2008/01/19 03:36:49 | 000,365,568 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\WindowsMobile\wcescomm.dll – (WcesComm)
SRV - [2008/01/19 03:36:15 | 000,167,936 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\WindowsMobile\rapimgr.dll – (RapiMgr)
SRV - [2007/10/09 19:56:30 | 000,202,544 | —- | M] (SupportSoft, Inc.) [Disabled | Stopped] – C:\Program Files\Dell Support Center\bin\sprtsvc.exe – (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
SRV - [2007/09/20 15:31:10 | 000,073,728 | —- | M] (Andrea Electronics Corporation) [Disabled | Stopped] – C:\Windows\System32\AEstSrv.exe – (AESTFilters)
SRV - [2007/09/13 15:45:38 | 000,102,400 | —- | M] (IDT, Inc.) [Auto | Running] – C:\Windows\System32\stacsv.exe – (STacSV)
SRV - [2007/03/19 13:44:44 | 000,070,656 | —- | M] () [Disabled | Stopped] – C:\Program Files\DellSupport\brkrsvc.exe – (DSBrokerService)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – – (PCD5SRVC{FBEA8B78-1B22F121-05040000})
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkfwd.sys – (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkflt.sys – (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS – (MRESP50)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS – (MRENDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS – (MREMPR5)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS – (MREMP50)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\ipinip.sys – (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Users\Fernanda\AppData\Local\Temp\catchme.sys – (catchme)
DRV - File not found [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\blbdrive.sys – (blbdrive)
DRV - [2011/02/23 09:57:38 | 000,101,976 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\Windows\System32\drivers\aswFW.sys – (aswFW)
DRV - [2011/02/23 09:56:55 | 000,371,544 | —- | M] (AVAST Software) [File_System | System | Running] – C:\Windows\System32\drivers\aswSnx.sys – (aswSnx)
DRV - [2011/02/23 09:56:45 | 000,301,528 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\Windows\System32\drivers\aswSP.sys – (aswSP)
DRV - [2011/02/23 09:56:41 | 000,192,728 | —- | M] (AVAST Software) [Kernel | Boot | Running] – C:\Windows\System32\drivers\aswNdis2.sys – (aswNdis2)
DRV - [2011/02/23 09:55:49 | 000,049,240 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\Windows\System32\drivers\aswTdi.sys – (aswTdi)
DRV - [2011/02/23 09:55:10 | 000,025,432 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\Windows\System32\drivers\aswRdr.sys – (aswRdr)
DRV - [2011/02/23 09:55:03 | 000,053,592 | —- | M] (AVAST Software) [File_System | Auto | Running] – C:\Windows\System32\drivers\aswMonFlt.sys – (aswMonFlt)
DRV - [2011/02/23 09:54:55 | 000,019,544 | —- | M] (AVAST Software) [File_System | Auto | Running] – C:\Windows\System32\drivers\aswFsBlk.sys – (aswFsBlk)
DRV - [2011/02/23 08:34:54 | 000,012,112 | —- | M] (ALWIL Software) [Kernel | Boot | Running] – C:\Windows\System32\drivers\aswNdis.sys – (aswNdis)
DRV - [2010/09/01 04:30:58 | 000,015,544 | —- | M] (Secunia) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\psi_mf.sys – (PSI)
DRV - [2008/01/18 05:00:00 | 000,385,072 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys – (eeCtrl)
DRV - [2007/10/10 18:03:00 | 000,235,648 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\OEM02Dev.sys – (OEM02Dev)
DRV - [2007/09/13 15:46:06 | 000,330,240 | —- | M] (IDT, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\stwrt.sys – (STHDA)
DRV - [2007/03/21 02:13:08 | 002,411,520 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\atikmdag.sys – (R300)
DRV - [2007/03/21 02:13:08 | 002,411,520 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\atikmdag.sys – (atikmdag)
DRV - [2007/03/05 22:45:00 | 000,007,424 | —- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\OEM02Vfx.sys – (OEM02Vfx)
DRV - [2007/02/25 13:10:48 | 000,005,376 | –S- | M] (Gteko Ltd.) [Kernel | Auto | Running] – C:\Windows\System32\drivers\dsunidrv.sys – (dsunidrv)
DRV - [2006/11/21 08:25:44 | 000,045,568 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\bcm4sbxp.sys – (bcm4sbxp)
DRV - [2006/11/15 04:16:24 | 000,032,256 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rimmptsk.sys – (rimmptsk)
DRV - [2006/11/14 23:42:46 | 000,043,520 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rimsptsk.sys – (rimsptsk)
DRV - [2006/11/14 21:35:20 | 000,037,376 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rixdptsk.sys – (rismxdp)
DRV - [2006/11/02 03:30:55 | 000,200,704 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\e1e6032.sys – (e1express) Intel®
DRV - [2006/10/30 11:23:12 | 000,007,680 | —- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] – C:\Windows\System32\drivers\AtiPcie.sys – (AtiPcie) ATI PCI Express (3GIO)
DRV - [2006/10/05 18:07:28 | 000,004,736 | —- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] – C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys – (DSproct)
DRV - [2006/08/04 20:39:10 | 000,008,192 | —- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] – C:\Windows\System32\drivers\XAudio.sys – (XAudio)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…amp;rlz=1I7DKUS

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?fr=fp-yie8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {8E02D41C-5924-4816-9490-33CCD28BEB72}
IE - HKCU\..\SearchScopes\{04C005E1-6F34-4AFE-BBD4-2EE140B0A189}: "URL" = http://delicious.com/search?p={searchTerms}
IE - HKCU\..\SearchScopes\{5AC0E922-88E6-4863-8D7B-450A84B30D1B}: "URL" = http://www.flickr.com/search/?q={searchTerms}
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…amp;rlz=1I7DKUS
IE - HKCU\..\SearchScopes\{8E02D41C-5924-4816-9490-33CCD28BEB72}: "URL" = http://us.yhs.search.yahoo.com/avg/search?…p={searchTerms}
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?p={searchTerms}
IE - HKCU\..\SearchScopes\{E219C572-B093-42B4-B0EE-DF84B9E4D687}: "URL" = http://rover.ebay.com/rover/1/711-43047-14…e={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.3: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Fernanda\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Fernanda\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012/05/17 10:34:08 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/05/16 23:58:41 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/05/16 22:52:59 | 000,000,000 | —D | M]

[2009/09/17 19:30:10 | 000,000,000 | —D | M] (No name found) – C:\Users\Fernanda\AppData\Roaming\Mozilla\Extensions
[2009/09/17 19:30:10 | 000,000,000 | —D | M] (No name found) – C:\Users\Fernanda\AppData\Roaming\Mozilla\Extensions\[removed]
[2012/05/16 22:31:09 | 000,000,000 | —D | M] (No name found) – C:\Users\Fernanda\AppData\Roaming\Mozilla\Firefox\Profiles\ebmqvnyy.default\extensions
[2012/05/16 23:58:41 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/06/22 12:33:25 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/01/08 16:06:01 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/05/17 10:34:08 | 000,000,000 | —D | M] (avast! WebRep) – C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
[2012/04/20 21:18:00 | 000,097,208 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/05/16 22:56:59 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012/04/20 22:09:17 | 000,001,525 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2012/04/20 22:09:17 | 000,000,935 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2012/04/20 22:09:17 | 000,001,166 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2012/04/20 22:09:17 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml
[2012/04/20 22:09:18 | 000,001,121 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2011/06/19 10:00:31 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll ()
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll ()
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Fernanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} http://www.seehere.com/ips-opdata/layout/f…dan-canvasx.cab (JordanUploader Class)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://www2.snapfish.com/SnapfishActivia.cab (Snapfish Activia)
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} http://lads.myspace.com/upload/MySpaceUploader1006.cab (MySpace Uploader Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos-beta/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} http://web1.shutterfly.com/downloads/Uploader.cab (Shutterfly Picture Upload Plugin)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} http://www.adobe.com/products/acrobat/nos/gp.cab (get_atlcom Class)
O16 - DPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} http://www.cvsphoto.com/upload/activex/v3_…veX_Control.cab (Photo Upload Plugin Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3ABB5C2C-F4B7-4364-B0E6-9ADC038D41C9}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Fernanda\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Fernanda\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/05/20 16:43:43 | 000,000,000 | —D | C] – C:\_OTL
[2012/05/20 16:40:25 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2012/05/20 16:40:24 | 000,000,000 | —D | C] – C:\Program Files\ERUNT
[2012/05/20 16:39:17 | 000,791,393 | —- | C] (Lars Hederer ) – C:\Users\Fernanda\Desktop\erunt-setup.exe
[2012/05/20 15:21:51 | 004,731,392 | —- | C] (AVAST Software) – C:\Users\Fernanda\Desktop\aswMBR.exe
[2012/05/17 21:16:00 | 000,595,456 | —- | C] (OldTimer Tools) – C:\Users\Fernanda\Desktop\OTL.exe
[2012/05/17 10:53:09 | 002,382,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2012/05/17 10:53:05 | 001,799,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript9.dll
[2012/05/17 10:53:02 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2012/05/17 10:53:01 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2012/05/17 10:53:01 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2012/05/17 10:52:59 | 001,427,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2012/05/17 10:37:59 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Internet Security
[2012/05/17 10:37:58 | 000,019,544 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswFsBlk.sys
[2012/05/17 10:37:57 | 000,301,528 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswSP.sys
[2012/05/17 10:37:49 | 000,101,976 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswFW.sys
[2012/05/17 10:35:16 | 000,192,728 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswNdis2.sys
[2012/05/17 10:35:16 | 000,025,432 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswRdr.sys
[2012/05/17 10:35:15 | 000,371,544 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswSnx.sys
[2012/05/17 10:35:15 | 000,053,592 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswMonFlt.sys
[2012/05/17 10:35:15 | 000,049,240 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswTdi.sys
[2012/05/17 10:34:04 | 000,012,112 | —- | C] (ALWIL Software) – C:\Windows\System32\drivers\aswNdis.sys
[2012/05/17 10:34:03 | 000,040,648 | —- | C] (AVAST Software) – C:\Windows\avastSS.scr
[2012/05/17 10:34:02 | 000,190,016 | —- | C] (AVAST Software) – C:\Windows\System32\aswBoot.exe
[2012/05/16 23:26:26 | 016,339,280 | —- | C] (Mozilla) – C:\Users\Fernanda\Desktop\Firefox Setup 12.0.exe
[2012/05/16 23:24:53 | 000,161,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msls31.dll
[2012/05/16 23:24:52 | 000,162,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msrating.dll
[2012/05/16 23:24:52 | 000,086,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2012/05/16 23:24:52 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\SetIEInstalledDate.exe
[2012/05/16 23:24:52 | 000,074,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RegisterIEPKEYs.exe
[2012/05/16 23:24:52 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtmler.dll
[2012/05/16 23:24:51 | 000,367,104 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2012/05/16 23:24:51 | 000,353,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxtmsft.dll
[2012/05/16 23:24:51 | 000,223,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxtrans.dll
[2012/05/16 23:24:50 | 003,695,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dat
[2012/05/16 23:24:50 | 000,434,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dll
[2012/05/16 23:24:50 | 000,353,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2012/05/16 23:24:50 | 000,078,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inseng.dll
[2012/05/16 23:24:50 | 000,074,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2012/05/16 23:24:50 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2012/05/16 23:24:50 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2012/05/16 23:24:50 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2012/05/16 23:24:49 | 000,580,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2012/05/16 23:24:49 | 000,152,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wextract.exe
[2012/05/16 23:24:49 | 000,150,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iexpress.exe
[2012/05/16 23:24:48 | 000,227,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieaksie.dll
[2012/05/16 23:24:48 | 000,163,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieakui.dll
[2012/05/16 23:24:48 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2012/05/16 23:24:48 | 000,101,888 | —- | C] (Microsoft Corporation) – C:\Windows\System32\admparse.dll
[2012/05/16 23:24:48 | 000,054,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\pngfilt.dll
[2012/05/16 23:24:47 | 000,130,560 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieakeng.dll
[2012/05/16 23:24:47 | 000,118,784 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2012/05/16 23:24:47 | 000,110,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\IEAdvpack.dll
[2012/05/16 23:24:47 | 000,041,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2012/05/16 23:24:47 | 000,035,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\imgutil.dll
[2012/05/16 23:24:47 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2012/05/16 22:58:36 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2012/05/16 22:57:34 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaws.exe
[2012/05/16 22:57:34 | 000,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaw.exe
[2012/05/16 22:57:34 | 000,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\java.exe
[2012/05/16 22:55:04 | 000,000,000 | —D | C] – C:\Users\Fernanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012/05/16 22:52:45 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2012/05/16 22:52:18 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2012/05/16 22:34:50 | 000,000,000 | —D | C] – C:\ProgramData\Mozilla
[2012/05/16 22:34:49 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Maintenance Service
[2012/05/09 00:31:29 | 001,069,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DWrite.dll
[2012/05/09 00:31:29 | 000,219,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1core.dll
[2012/05/09 00:31:28 | 001,172,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10warp.dll
[2012/05/09 00:31:28 | 000,683,008 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d2d1.dll
[2012/05/09 00:31:28 | 000,160,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1.dll
[2012/05/09 00:29:28 | 003,550,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2012/05/09 00:29:27 | 003,602,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2012/05/09 00:29:26 | 002,044,928 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys

========== Files - Modified Within 30 Days ==========

[2012/05/20 17:33:00 | 000,000,428 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{6A6FD9FB-878B-4FBC-9D07-70ED794E872E}.job
[2012/05/20 17:27:00 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/05/20 17:06:45 | 000,003,680 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/05/20 17:06:45 | 000,003,680 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/05/20 17:06:32 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/05/20 17:06:24 | 2011,324,416 | -HS- | M] () – C:\hiberfil.sys
[2012/05/20 17:04:01 | 000,000,920 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1809433382-771992600-2837674101-1000UA.job
[2012/05/20 16:40:31 | 000,000,915 | —- | M] () – C:\Users\Fernanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2012/05/20 16:40:25 | 000,000,735 | —- | M] () – C:\Users\Fernanda\Desktop\NTREGOPT.lnk
[2012/05/20 16:40:25 | 000,000,716 | —- | M] () – C:\Users\Fernanda\Desktop\ERUNT.lnk
[2012/05/20 16:39:18 | 000,791,393 | —- | M] (Lars Hederer ) – C:\Users\Fernanda\Desktop\erunt-setup.exe
[2012/05/20 15:33:19 | 000,000,512 | —- | M] () – C:\Users\Fernanda\Desktop\MBR.dat
[2012/05/20 15:22:57 | 004,731,392 | —- | M] (AVAST Software) – C:\Users\Fernanda\Desktop\aswMBR.exe
[2012/05/20 15:14:33 | 000,000,868 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1809433382-771992600-2837674101-1000Core.job
[2012/05/17 21:16:11 | 000,595,456 | —- | M] (OldTimer Tools) – C:\Users\Fernanda\Desktop\OTL.exe
[2012/05/17 10:37:59 | 000,001,831 | —- | M] () – C:\Users\Public\Desktop\avast! Internet Security.lnk
[2012/05/17 10:35:15 | 000,002,577 | —- | M] () – C:\Windows\System32\config.nt
[2012/05/17 10:28:00 | 000,604,502 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/05/17 10:28:00 | 000,104,170 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/05/16 23:58:45 | 000,000,872 | —- | M] () – C:\Users\Fernanda\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/05/16 23:58:45 | 000,000,848 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/05/16 23:35:36 | 000,000,945 | —- | M] () – C:\Users\Fernanda\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/05/16 23:27:10 | 016,339,280 | —- | M] (Mozilla) – C:\Users\Fernanda\Desktop\Firefox Setup 12.0.exe
[2012/05/16 23:25:24 | 000,008,798 | —- | M] () – C:\Windows\System32\icrav03.rat
[2012/05/16 23:25:24 | 000,001,988 | —- | M] () – C:\Windows\System32\ticrf.rat
[2012/05/16 23:24:53 | 000,161,792 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msls31.dll
[2012/05/16 23:24:52 | 000,162,304 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msrating.dll
[2012/05/16 23:24:52 | 000,086,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2012/05/16 23:24:52 | 000,076,800 | —- | M] (Microsoft Corporation) – C:\Windows\System32\SetIEInstalledDate.exe
[2012/05/16 23:24:52 | 000,074,752 | —- | M] (Microsoft Corporation) – C:\Windows\System32\RegisterIEPKEYs.exe
[2012/05/16 23:24:52 | 000,048,640 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mshtmler.dll
[2012/05/16 23:24:51 | 000,367,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2012/05/16 23:24:51 | 000,353,792 | —- | M] (Microsoft Corporation) – C:\Windows\System32\dxtmsft.dll
[2012/05/16 23:24:51 | 000,223,232 | —- | M] (Microsoft Corporation) – C:\Windows\System32\dxtrans.dll
[2012/05/16 23:24:50 | 003,695,416 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dat
[2012/05/16 23:24:50 | 000,434,176 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dll
[2012/05/16 23:24:50 | 000,353,584 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2012/05/16 23:24:50 | 000,078,848 | —- | M] (Microsoft Corporation) – C:\Windows\System32\inseng.dll
[2012/05/16 23:24:50 | 000,074,752 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2012/05/16 23:24:50 | 000,074,240 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2012/05/16 23:24:50 | 000,072,822 | —- | M] () – C:\Windows\System32\ieuinit.inf
[2012/05/16 23:24:50 | 000,031,744 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2012/05/16 23:24:50 | 000,023,552 | —- | M] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2012/05/16 23:24:49 | 000,580,608 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2012/05/16 23:24:49 | 000,152,064 | —- | M] (Microsoft Corporation) – C:\Windows\System32\wextract.exe
[2012/05/16 23:24:49 | 000,150,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iexpress.exe
[2012/05/16 23:24:48 | 000,227,840 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieaksie.dll
[2012/05/16 23:24:48 | 000,163,840 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieakui.dll
[2012/05/16 23:24:48 | 000,142,848 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2012/05/16 23:24:48 | 000,101,888 | —- | M] (Microsoft Corporation) – C:\Windows\System32\admparse.dll
[2012/05/16 23:24:48 | 000,054,272 | —- | M] (Microsoft Corporation) – C:\Windows\System32\pngfilt.dll
[2012/05/16 23:24:47 | 000,130,560 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieakeng.dll
[2012/05/16 23:24:47 | 000,118,784 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2012/05/16 23:24:47 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\Windows\System32\IEAdvpack.dll
[2012/05/16 23:24:47 | 000,041,472 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2012/05/16 23:24:47 | 000,035,840 | —- | M] (Microsoft Corporation) – C:\Windows\System32\imgutil.dll
[2012/05/16 23:24:47 | 000,010,752 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2012/05/16 23:23:50 | 000,000,908 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/05/16 22:56:59 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\deployJava1.dll
[2012/05/16 22:56:59 | 000,157,472 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\javaws.exe
[2012/05/16 22:56:59 | 000,149,280 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\javaw.exe
[2012/05/16 22:56:59 | 000,149,280 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\java.exe
[2012/05/16 22:52:45 | 000,001,728 | —- | M] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2012/05/16 22:52:42 | 014,901,760 | —- | M] () – C:\Users\Fernanda\Desktop\JavaJRE_6u31_32-bit.exe
[2012/05/16 22:49:13 | 028,193,792 | —- | M] () – C:\Users\Fernanda\Desktop\GoogleChrome_19.0.1084.46_SPS.exe
[2012/05/16 22:45:49 | 000,001,889 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 8.lnk
[2012/05/09 10:05:55 | 000,287,672 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2012/05/06 00:27:12 | 000,419,488 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerApp.exe
[2012/05/06 00:27:11 | 000,070,304 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl

========== Files Created - No Company Name ==========

[2012/05/20 16:40:31 | 000,000,915 | —- | C] () – C:\Users\Fernanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2012/05/20 16:40:25 | 000,000,735 | —- | C] () – C:\Users\Fernanda\Desktop\NTREGOPT.lnk
[2012/05/20 16:40:25 | 000,000,716 | —- | C] () – C:\Users\Fernanda\Desktop\ERUNT.lnk
[2012/05/20 15:33:19 | 000,000,512 | —- | C] () – C:\Users\Fernanda\Desktop\MBR.dat
[2012/05/17 11:18:07 | 2011,324,416 | -HS- | C] () – C:\hiberfil.sys
[2012/05/17 10:37:59 | 000,001,831 | —- | C] () – C:\Users\Public\Desktop\avast! Internet Security.lnk
[2012/05/16 23:57:20 | 000,000,864 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
[2012/05/16 23:35:36 | 000,000,945 | —- | C] () – C:\Users\Fernanda\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/05/16 23:24:50 | 000,072,822 | —- | C] () – C:\Windows\System32\ieuinit.inf
[2012/05/16 23:23:50 | 000,000,908 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/05/16 22:54:15 | 000,000,920 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1809433382-771992600-2837674101-1000UA.job
[2012/05/16 22:54:12 | 000,000,868 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1809433382-771992600-2837674101-1000Core.job
[2012/05/16 22:52:45 | 000,001,728 | —- | C] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2012/05/16 22:51:35 | 014,901,760 | —- | C] () – C:\Users\Fernanda\Desktop\JavaJRE_6u31_32-bit.exe
[2012/05/16 22:48:17 | 028,193,792 | —- | C] () – C:\Users\Fernanda\Desktop\GoogleChrome_19.0.1084.46_SPS.exe
[2012/05/16 22:45:49 | 000,001,889 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader 8.lnk
[2012/05/16 22:34:55 | 000,000,848 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/06/19 09:44:04 | 000,256,512 | —- | C] () – C:\Windows\PEV.exe
[2011/06/19 09:44:04 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2011/06/19 09:44:04 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2011/06/19 09:44:04 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2011/06/19 09:44:04 | 000,068,096 | —- | C] () – C:\Windows\zip.exe

========== Alternate Data Streams ==========

@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:DFC5A2B2

< End of report >

ComboFix 12-05-22.02 - Fernanda 05/22/2012 23:27:14.1.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.1917.916 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: avast! Internet Security *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
FW: avast! Internet Security *Disabled* {131692B0-0864-D491-4E21-3A3A1D8BBB47}
SP: avast! Internet Security *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Desktop\004.JPG
c:\users\Desktop\005.JPG
c:\users\Desktop\007.JPG
c:\users\Desktop\009.JPG
c:\users\Desktop\010.JPG
c:\users\Desktop\011.JPG
c:\users\Desktop\012.JPG
c:\users\Desktop\013.JPG
c:\users\Desktop\014.JPG
c:\users\Desktop\015.JPG
c:\users\Desktop\016.JPG
c:\users\Desktop\017.JPG
c:\users\Desktop\018.JPG
c:\users\Desktop\019.JPG
c:\users\Desktop\021.JPG
c:\users\Desktop\022.JPG
c:\users\Desktop\024.JPG
c:\users\Desktop\025.JPG
c:\users\Desktop\027.JPG
c:\users\Desktop\028.JPG
c:\users\Desktop\029.JPG
c:\users\Desktop\030.JPG
c:\users\Desktop\031.JPG
c:\users\Desktop\032.JPG
c:\users\Desktop\033.JPG
c:\users\Desktop\034.JPG
c:\users\Desktop\035.JPG
c:\users\Desktop\036.JPG
c:\users\Desktop\037.JPG
c:\users\Desktop\040.JPG
c:\users\Desktop\042.JPG
c:\users\Desktop\043.JPG
c:\users\Desktop\044.JPG
c:\users\Desktop\045.JPG
c:\users\Desktop\046.JPG
c:\users\Desktop\0462.jpg
c:\users\Desktop\047.JPG
c:\users\Desktop\048.JPG
c:\users\Desktop\049.JPG
c:\users\Desktop\051.JPG
c:\users\Desktop\053.JPG
c:\users\Desktop\055.JPG
c:\users\Desktop\056.JPG
c:\users\Desktop\060.JPG
c:\users\Desktop\061.JPG
c:\users\Desktop\063.JPG
c:\users\Desktop\065.JPG
c:\users\Desktop\066.JPG
c:\users\Desktop\067.JPG
c:\users\Desktop\071.JPG
c:\users\Desktop\077.JPG
c:\users\Desktop\079.JPG
c:\users\Desktop\082.JPG
c:\users\Desktop\083.JPG
c:\users\Desktop\084.JPG
c:\users\Desktop\085.JPG
c:\users\Desktop\086.JPG
c:\users\Desktop\087.JPG
c:\users\Desktop\088.JPG
c:\users\Desktop\089.JPG
c:\users\Desktop\090.JPG
c:\users\Desktop\091.JPG
c:\users\Desktop\092.JPG
c:\users\Desktop\093.JPG
c:\users\Desktop\094.JPG
c:\users\Desktop\095.JPG
c:\users\Desktop\096.JPG
c:\users\Desktop\097.JPG
c:\users\Desktop\098.JPG
c:\users\Desktop\099.JPG
c:\users\Desktop\100.JPG
c:\users\Desktop\101.JPG
c:\users\Desktop\102.JPG
c:\users\Desktop\103.JPG
c:\users\Desktop\104.JPG
c:\users\Desktop\105.JPG
c:\users\Desktop\106.JPG
c:\users\Desktop\107.JPG
c:\users\Desktop\109.JPG
c:\users\Desktop\110.JPG
c:\users\Desktop\111.JPG
c:\users\Desktop\112.JPG
c:\users\Desktop\113.JPG
c:\users\Desktop\117.JPG
c:\users\Desktop\126.JPG
c:\users\Desktop\127.JPG
c:\windows\security\Database\tmp.edb
.
.
((((((((((((((((((((((((( Files Created from 2012-04-23 to 2012-05-23 )))))))))))))))))))))))))))))))
.
.
2012-05-23 03:46 . 2012-05-23 03:46 ——– d—–w- c:\users\Fernanda\AppData\Local\temp
2012-05-23 03:46 . 2012-05-23 03:46 ——– d—–w- c:\users\Public\AppData\Local\temp
2012-05-23 03:46 . 2012-05-23 03:46 ——– d—–w- c:\users\Guest\AppData\Local\temp
2012-05-23 03:46 . 2012-05-23 03:46 ——– d—–w- c:\users\Desktop\AppData\Local\temp
2012-05-23 03:46 . 2012-05-23 03:46 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-05-23 03:19 . 2012-05-08 16:40 6737808 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5363B9CC-CC1A-4993-93BB-FDB50B3DB1B6}\mpengine.dll
2012-05-21 03:21 . 2012-05-21 03:21 ——– d—–w- c:\program files\ESET
2012-05-21 02:26 . 2012-05-21 02:26 ——– d—–w- c:\program files\iPod
2012-05-21 02:26 . 2012-05-21 02:28 ——– d—–w- c:\program files\iTunes
2012-05-21 02:17 . 2012-05-21 02:17 ——– d—–w- c:\program files\Bonjour
2012-05-20 20:43 . 2012-05-20 20:43 ——– d—–w- C:\_OTL
2012-05-20 20:40 . 2012-05-20 20:40 ——– d—–w- c:\program files\ERUNT
2012-05-17 14:53 . 2012-02-28 01:03 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2012-05-17 14:53 . 2012-02-28 01:58 141112 —-a-w- c:\program files\Internet Explorer\sqmapi.dll
2012-05-17 14:53 . 2012-02-28 01:08 194048 —-a-w- c:\program files\Internet Explorer\IEShims.dll
2012-05-17 14:53 . 2012-02-28 01:18 1799168 —-a-w- c:\windows\system32\jscript9.dll
2012-05-17 14:53 . 2012-02-28 01:11 1127424 —-a-w- c:\windows\system32\wininet.dll
2012-05-17 14:52 . 2012-02-28 01:13 678912 —-a-w- c:\program files\Internet Explorer\iedvtool.dll
2012-05-17 14:52 . 2012-02-28 01:11 1427456 —-a-w- c:\windows\system32\inetcpl.cpl
2012-05-17 14:37 . 2011-02-23 13:54 19544 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-05-17 14:37 . 2011-02-23 13:56 301528 —-a-w- c:\windows\system32\drivers\aswSP.sys
2012-05-17 14:37 . 2011-02-23 13:57 101976 —-a-w- c:\windows\system32\drivers\aswFW.sys
2012-05-17 14:35 . 2011-02-23 13:56 192728 —-a-w- c:\windows\system32\drivers\aswNdis2.sys
2012-05-17 14:35 . 2011-02-23 13:55 25432 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2012-05-17 14:35 . 2011-02-23 13:56 371544 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2012-05-17 14:35 . 2011-02-23 13:55 49240 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2012-05-17 14:35 . 2011-02-23 13:55 53592 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-05-17 14:34 . 2011-02-23 12:34 12112 —-a-w- c:\windows\system32\drivers\aswNdis.sys
2012-05-17 14:34 . 2011-02-23 14:04 40648 —-a-w- c:\windows\avastSS.scr
2012-05-17 14:34 . 2011-02-23 14:04 190016 —-a-w- c:\windows\system32\aswBoot.exe
2012-05-17 02:58 . 2012-05-17 02:58 ——– d—–w- c:\program files\Common Files\Java
2012-05-17 02:34 . 2012-05-17 03:55 ——– d—–w- c:\program files\Mozilla Maintenance Service
2012-05-17 02:34 . 2012-04-21 01:18 97208 —-a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2012-05-17 02:34 . 2012-04-21 01:16 43960 —-a-w- c:\program files\Mozilla Firefox\mozglue.dll
2012-05-17 02:34 . 2012-04-21 01:16 157352 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
2012-05-17 02:34 . 2012-04-21 01:16 129976 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
2012-05-17 02:34 . 2012-04-21 01:16 588728 —-a-w- c:\program files\Mozilla Firefox\gkmedias.dll
2012-05-09 04:31 . 2012-03-30 12:39 905600 —-a-w- c:\windows\system32\drivers\tcpip.sys
2012-05-09 04:31 . 2012-02-01 15:10 936960 —-a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2012-05-09 04:31 . 2012-02-01 15:10 1404928 —-a-w- c:\program files\Common Files\Microsoft Shared\ink\InkObj.dll
2012-05-09 04:31 . 2012-03-01 14:46 219648 —-a-w- c:\windows\system32\d3d10_1core.dll
2012-05-09 04:31 . 2012-02-29 13:41 1069056 —-a-w- c:\windows\system32\DWrite.dll
2012-05-09 04:31 . 2012-03-01 14:46 160768 —-a-w- c:\windows\system32\d3d10_1.dll
2012-05-09 04:31 . 2012-02-29 14:08 1172480 —-a-w- c:\windows\system32\d3d10warp.dll
2012-05-09 04:31 . 2012-02-29 13:44 683008 —-a-w- c:\windows\system32\d2d1.dll
2012-05-09 04:30 . 2012-03-20 23:28 53120 —-a-w- c:\windows\system32\drivers\partmgr.sys
2012-05-09 04:29 . 2012-04-03 08:16 3550080 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-05-09 04:29 . 2012-04-03 08:16 3602816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-09 04:29 . 2012-04-02 13:36 2044928 —-a-w- c:\windows\system32\win32k.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-17 02:56 . 2011-06-22 01:55 472808 —-a-w- c:\windows\system32\deployJava1.dll
2012-05-06 04:27 . 2012-04-01 16:19 419488 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-06 04:27 . 2011-05-31 21:10 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-19 00:56 . 2012-04-19 00:56 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2012-04-19 00:56 . 2012-04-19 00:56 69632 —-a-w- c:\windows\system32\QuickTime.qts
2012-04-04 19:56 . 2011-06-21 23:19 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-02-29 15:11 . 2012-04-12 07:16 5120 —-a-w- c:\windows\system32\wmi.dll
2012-02-29 15:11 . 2012-04-12 07:16 172032 —-a-w- c:\windows\system32\wintrust.dll
2012-02-29 15:09 . 2012-04-12 07:16 157696 —-a-w- c:\windows\system32\imagehlp.dll
2012-02-29 13:32 . 2012-04-12 07:16 12800 —-a-w- c:\windows\system32\drivers\fs_rec.sys
2012-02-23 14:18 . 2011-03-25 00:01 237072 ——w- c:\windows\system32\MpSigStub.exe
2012-04-21 01:18 . 2012-05-17 02:34 97208 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-02-23 14:04 122512 —-a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-04-28 857648]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-08-31 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-09-13 405504]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-04-19 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-02-23 3451496]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-27 421736]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"HideFastUserSwitching"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickSet.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\QuickSet.lnk
backup=c:\windows\pss\QuickSet.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^Fernanda^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ERUNT AutoBackup.lnk]
path=c:\users\Fernanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
backup=c:\windows\pss\ERUNT AutoBackup.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-08-31 01:57 40368 —-a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
2007-03-21 19:33 1548288 —-a-w- c:\windows\System32\WLTRAY.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DELL Webcam Manager]
2007-06-07 16:14 118784 ——w- c:\program files\Dell\DELL Webcam Manager\DellWMgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2007-03-15 17:09 460784 —-a-w- c:\program files\DellSupport\DSAgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupportCenter]
2007-10-09 23:56 202544 —-a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dscactivate]
2007-10-09 23:57 16384 —-a-w- c:\program files\Dell Support Center\gs_agent\custom\dsca.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ECenter]
2007-03-16 10:20 17920 —-a-w- c:\dell\E-Center\EULALauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2006-10-03 16:37 81920 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2012-03-27 09:09 421736 —-a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
2006-05-18 15:29 49152 —-a-w- c:\program files\CyberLink\PowerDVD\Language\Language.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OEM02Mon.exe]
2007-05-09 22:01 36864 —-a-w- c:\windows\OEM02Mon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
2007-08-20 15:58 184320 ——w- c:\program files\Dell\MediaDirect\PCMService.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2012-04-19 00:56 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2005-12-08 02:57 30208 ——w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
2007-09-13 19:44 405504 —-a-w- c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 20:07 2260480 ——w- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile-based device management]
2006-11-02 09:45 215552 —-a-w- c:\windows\WindowsMobile\wmdSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-19 07:33 202240 —-a-w- c:\program files\Windows Media Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
2007-08-27 21:19 4670704 —-a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-06 257696]
R4 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2007-09-20 73728]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2012-05-17 03:24 114176 —-a-w- c:\windows\System32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
2012-05-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 04:27]
.
2012-05-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1809433382-771992600-2837674101-1000Core.job
- c:\users\Fernanda\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-17 02:54]
.
2012-05-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1809433382-771992600-2837674101-1000UA.job
- c:\users\Fernanda\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-17 02:54]
.
2012-05-23 c:\windows\Tasks\User_Feed_Synchronization-{6A6FD9FB-878B-4FBC-9D07-70ED794E872E}.job
- c:\windows\system32\msfeedssync.exe [2012-05-17 03:24]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/?fr=fp-yie8
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = [removed] [removed]
DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} - hxxp://www.seehere.com/ips-opdata/layout/fujius02/objects/jordan-canvasx.cab
FF - ProfilePath - c:\users\Fernanda\AppData\Roaming\Mozilla\Firefox\Profiles\ebmqvnyy.default\
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-ihanotify - c:\program files\Verizon\FiOS\ihs\IHANotify.exe
MSConfigStartUp-Verizon_McciTrayApp - c:\program files\Verizon\McciTrayApp.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-22 23:46
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aac\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flac\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ogg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pls\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.spx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\S-1-5-21-1809433382-771992600-2837674101-1000\¬ î**]
@Allowed: (Read) (RestrictedCode)
"MachineID"=hex:e9,3c,6e,fa,17,34,1a,00
DUMPHIVE0.003 (REGF)
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2012-05-22 23:54:31
ComboFix-quarantined-files.txt 2012-05-23 03:54
ComboFix2.txt 2011-06-19 14:05
.
Pre-Run: 78,735,577,088 bytes free
Post-Run: 78,884,274,176 bytes free
.
- - End Of File - - 4343447F2A918B9D1DF1B2ABC5E278EB

ComboFix 12-05-22.02 - Fernanda 05/23/2012 16:02:15.2.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.1917.1212 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Fernanda\Desktop\CFScript.txt
AV: avast! Internet Security *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
FW: avast! Internet Security *Disabled* {131692B0-0864-D491-4E21-3A3A1D8BBB47}
SP: avast! Internet Security *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2012-04-23 to 2012-05-23 )))))))))))))))))))))))))))))))
.
.
2012-05-23 20:17 . 2012-05-23 20:17 ——– d—–w- c:\users\Fernanda\AppData\Local\temp
2012-05-23 20:17 . 2012-05-23 20:17 ——– d—–w- c:\users\Public\AppData\Local\temp
2012-05-23 20:17 . 2012-05-23 20:17 ——– d—–w- c:\users\Guest\AppData\Local\temp
2012-05-23 20:17 . 2012-05-23 20:17 ——– d—–w- c:\users\Desktop\AppData\Local\temp
2012-05-23 20:17 . 2012-05-23 20:17 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-05-23 03:19 . 2012-05-08 16:40 6737808 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5363B9CC-CC1A-4993-93BB-FDB50B3DB1B6}\mpengine.dll
2012-05-21 03:21 . 2012-05-21 03:21 ——– d—–w- c:\program files\ESET
2012-05-21 02:26 . 2012-05-21 02:26 ——– d—–w- c:\program files\iPod
2012-05-21 02:26 . 2012-05-21 02:28 ——– d—–w- c:\program files\iTunes
2012-05-21 02:17 . 2012-05-21 02:17 ——– d—–w- c:\program files\Bonjour
2012-05-20 20:43 . 2012-05-20 20:43 ——– d—–w- C:\_OTL
2012-05-20 20:40 . 2012-05-20 20:40 ——– d—–w- c:\program files\ERUNT
2012-05-17 14:53 . 2012-02-28 01:03 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2012-05-17 14:53 . 2012-02-28 01:58 141112 —-a-w- c:\program files\Internet Explorer\sqmapi.dll
2012-05-17 14:53 . 2012-02-28 01:08 194048 —-a-w- c:\program files\Internet Explorer\IEShims.dll
2012-05-17 14:53 . 2012-02-28 01:18 1799168 —-a-w- c:\windows\system32\jscript9.dll
2012-05-17 14:53 . 2012-02-28 01:11 1127424 —-a-w- c:\windows\system32\wininet.dll
2012-05-17 14:52 . 2012-02-28 01:13 678912 —-a-w- c:\program files\Internet Explorer\iedvtool.dll
2012-05-17 14:52 . 2012-02-28 01:11 1427456 —-a-w- c:\windows\system32\inetcpl.cpl
2012-05-17 14:37 . 2011-02-23 13:54 19544 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-05-17 14:37 . 2011-02-23 13:56 301528 —-a-w- c:\windows\system32\drivers\aswSP.sys
2012-05-17 14:37 . 2011-02-23 13:57 101976 —-a-w- c:\windows\system32\drivers\aswFW.sys
2012-05-17 14:35 . 2011-02-23 13:56 192728 —-a-w- c:\windows\system32\drivers\aswNdis2.sys
2012-05-17 14:35 . 2011-02-23 13:55 25432 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2012-05-17 14:35 . 2011-02-23 13:56 371544 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2012-05-17 14:35 . 2011-02-23 13:55 49240 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2012-05-17 14:35 . 2011-02-23 13:55 53592 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-05-17 14:34 . 2011-02-23 12:34 12112 —-a-w- c:\windows\system32\drivers\aswNdis.sys
2012-05-17 14:34 . 2011-02-23 14:04 40648 —-a-w- c:\windows\avastSS.scr
2012-05-17 14:34 . 2011-02-23 14:04 190016 —-a-w- c:\windows\system32\aswBoot.exe
2012-05-17 02:58 . 2012-05-17 02:58 ——– d—–w- c:\program files\Common Files\Java
2012-05-17 02:34 . 2012-05-17 03:55 ——– d—–w- c:\program files\Mozilla Maintenance Service
2012-05-17 02:34 . 2012-04-21 01:18 97208 —-a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2012-05-17 02:34 . 2012-04-21 01:16 43960 —-a-w- c:\program files\Mozilla Firefox\mozglue.dll
2012-05-17 02:34 . 2012-04-21 01:16 157352 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
2012-05-17 02:34 . 2012-04-21 01:16 129976 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
2012-05-17 02:34 . 2012-04-21 01:16 588728 —-a-w- c:\program files\Mozilla Firefox\gkmedias.dll
2012-05-09 04:31 . 2012-03-30 12:39 905600 —-a-w- c:\windows\system32\drivers\tcpip.sys
2012-05-09 04:31 . 2012-02-01 15:10 936960 —-a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2012-05-09 04:31 . 2012-02-01 15:10 1404928 —-a-w- c:\program files\Common Files\Microsoft Shared\ink\InkObj.dll
2012-05-09 04:31 . 2012-03-01 14:46 219648 —-a-w- c:\windows\system32\d3d10_1core.dll
2012-05-09 04:31 . 2012-02-29 13:41 1069056 —-a-w- c:\windows\system32\DWrite.dll
2012-05-09 04:31 . 2012-03-01 14:46 160768 —-a-w- c:\windows\system32\d3d10_1.dll
2012-05-09 04:31 . 2012-02-29 14:08 1172480 —-a-w- c:\windows\system32\d3d10warp.dll
2012-05-09 04:31 . 2012-02-29 13:44 683008 —-a-w- c:\windows\system32\d2d1.dll
2012-05-09 04:30 . 2012-03-20 23:28 53120 —-a-w- c:\windows\system32\drivers\partmgr.sys
2012-05-09 04:29 . 2012-04-03 08:16 3550080 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-05-09 04:29 . 2012-04-03 08:16 3602816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-09 04:29 . 2012-04-02 13:36 2044928 —-a-w- c:\windows\system32\win32k.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-17 02:56 . 2011-06-22 01:55 472808 —-a-w- c:\windows\system32\deployJava1.dll
2012-05-06 04:27 . 2012-04-01 16:19 419488 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-06 04:27 . 2011-05-31 21:10 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-19 00:56 . 2012-04-19 00:56 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2012-04-19 00:56 . 2012-04-19 00:56 69632 —-a-w- c:\windows\system32\QuickTime.qts
2012-04-04 19:56 . 2011-06-21 23:19 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-02-29 15:11 . 2012-04-12 07:16 5120 —-a-w- c:\windows\system32\wmi.dll
2012-02-29 15:11 . 2012-04-12 07:16 172032 —-a-w- c:\windows\system32\wintrust.dll
2012-02-29 15:09 . 2012-04-12 07:16 157696 —-a-w- c:\windows\system32\imagehlp.dll
2012-02-29 13:32 . 2012-04-12 07:16 12800 —-a-w- c:\windows\system32\drivers\fs_rec.sys
2012-04-21 01:18 . 2012-05-17 02:34 97208 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-02-23 14:04 122512 —-a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-04-28 857648]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-08-31 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-09-13 405504]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-04-19 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-02-23 3451496]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-27 421736]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"HideFastUserSwitching"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickSet.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\QuickSet.lnk
backup=c:\windows\pss\QuickSet.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^Fernanda^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ERUNT AutoBackup.lnk]
path=c:\users\Fernanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
backup=c:\windows\pss\ERUNT AutoBackup.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-08-31 01:57 40368 —-a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
2007-03-21 19:33 1548288 —-a-w- c:\windows\System32\WLTRAY.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DELL Webcam Manager]
2007-06-07 16:14 118784 ——w- c:\program files\Dell\DELL Webcam Manager\DellWMgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2007-03-15 17:09 460784 —-a-w- c:\program files\DellSupport\DSAgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupportCenter]
2007-10-09 23:56 202544 —-a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dscactivate]
2007-10-09 23:57 16384 —-a-w- c:\program files\Dell Support Center\gs_agent\custom\dsca.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ECenter]
2007-03-16 10:20 17920 —-a-w- c:\dell\E-Center\EULALauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2006-10-03 16:37 81920 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2012-03-27 09:09 421736 —-a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
2006-05-18 15:29 49152 —-a-w- c:\program files\CyberLink\PowerDVD\Language\Language.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OEM02Mon.exe]
2007-05-09 22:01 36864 —-a-w- c:\windows\OEM02Mon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
2007-08-20 15:58 184320 ——w- c:\program files\Dell\MediaDirect\PCMService.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2012-04-19 00:56 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2005-12-08 02:57 30208 ——w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
2007-09-13 19:44 405504 —-a-w- c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 20:07 2260480 ——w- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile-based device management]
2006-11-02 09:45 215552 —-a-w- c:\windows\WindowsMobile\wmdSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-19 07:33 202240 —-a-w- c:\program files\Windows Media Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
2007-08-27 21:19 4670704 —-a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-06 257696]
R4 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2007-09-20 73728]
.
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2012-05-17 03:24 114176 —-a-w- c:\windows\System32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
2012-05-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 04:27]
.
2012-05-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1809433382-771992600-2837674101-1000Core.job
- c:\users\Fernanda\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-17 02:54]
.
2012-05-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1809433382-771992600-2837674101-1000UA.job
- c:\users\Fernanda\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-17 02:54]
.
2012-05-23 c:\windows\Tasks\User_Feed_Synchronization-{6A6FD9FB-878B-4FBC-9D07-70ED794E872E}.job
- c:\windows\system32\msfeedssync.exe [2012-05-17 03:24]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/?fr=fp-yie8
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = [removed] [removed]
DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} - hxxp://www.seehere.com/ips-opdata/layout/fujius02/objects/jordan-canvasx.cab
FF - ProfilePath - c:\users\Fernanda\AppData\Roaming\Mozilla\Firefox\Profiles\ebmqvnyy.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-23 16:17
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aac\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flac\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ogg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pls\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.spx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="YMP.Media"
.
[HKEY_USERS\S-1-5-21-1809433382-771992600-2837674101-1000\¬ î**]
@Allowed: (Read) (RestrictedCode)
"MachineID"=hex:e9,3c,6e,fa,17,34,1a,00
DUMPHIVE0.003 (REGF)
.
Completion time: 2012-05-23 16:24:34
ComboFix-quarantined-files.txt 2012-05-23 20:24
ComboFix2.txt 2012-05-23 03:54
ComboFix3.txt 2011-06-19 14:05
.
Pre-Run: 78,533,459,968 bytes free
Post-Run: 78,492,188,672 bytes free
.
- - End Of File - - E3FF1311F13C8E1CBDA81CA54838973C