Right click starts windows installer [Closed]

Hi Folks,

I recently noticed that when I right click on anything the windows starts stating that it is starting to download "something" After running a HijackThis log I noticed that there might be a few items in there that shouldn't be.

Any help with my logs would be most appreciated. Thanks

OTL logfile created on: 14/12/2012 23:44:15 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Cragdo\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.50 Gb Total Physical Memory | 2.84 Gb Available Physical Memory | 81.08% Memory free
5.34 Gb Paging File | 4.43 Gb Available in Paging File | 83.09% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 931.50 Gb Total Space | 787.70 Gb Free Space | 84.56% Space Free | Partition Type: NTFS
Drive D: | 6.15 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: CRAZY-BOAB | User Name: Cragdo | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Cragdo\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Documents and Settings\Cragdo\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Documents and Settings\Cragdo\Application Data\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
PRC - C:\Program Files\IObit\Advanced SystemCare 6\ASC.exe (IObit)
PRC - C:\Program Files\IObit\Advanced SystemCare 6\ASCService.exe (IObit)
PRC - C:\Program Files\IObit\IObit Malware Fighter\IMF.exe (IObit)
PRC - C:\Program Files\IObit\Advanced SystemCare 6\ASCTray.exe (IObit)
PRC - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe (Adobe Systems Inc.)
PRC - C:\Program Files\IIS\Microsoft Web Deploy\MsDepSvc.exe (Microsoft Corporation)
PRC - C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe ()
PRC - C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe (Check Point Software Technologies)
PRC - C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
PRC - C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe (IObit)
PRC - C:\Program Files\Adobe\Adobe Bridge CS4\Bridge.exe (Adobe Systems, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\InstantEyedropper\InstantEyedropper.exe ()


========== Modules (No Company Name) ==========

MOD - C:\Program Files\AVAST Software\Avast\defs\12121400\algo.dll ()
MOD - C:\Program Files\IObit\Advanced SystemCare 6\Scan.dll ()
MOD - C:\Program Files\IObit\Advanced SystemCare 6\ASCExtMenu.dll ()
MOD - C:\Program Files\IObit\Advanced SystemCare 6\webres.dll ()
MOD - C:\Program Files\IObit\IObit Malware Fighter\Scan.dll ()
MOD - C:\Program Files\IObit\Advanced SystemCare 6\sqlite3.dll ()
MOD - C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe ()
MOD - C:\Program Files\FileZilla FTP Client\fzshellext.dll ()
MOD - C:\Program Files\IObit\IObit Malware Fighter\zlibwapi.dll ()
MOD - C:\Program Files\IObit\IObit Malware Fighter\unrar.dll ()
MOD - C:\Program Files\IObit\Advanced SystemCare 6\madbasic_.bpl ()
MOD - C:\Program Files\IObit\Advanced SystemCare 6\maddisAsm_.bpl ()
MOD - C:\Program Files\IObit\Advanced SystemCare 6\madexcept_.bpl ()
MOD - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\AcroTray.DEU ()
MOD - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\AcroTray.FRA ()
MOD - C:\Program Files\Adobe\Adobe Bridge CS4\FileInfo.dll ()
MOD - C:\Program Files\Adobe\Adobe Bridge CS4\AdobeXMPFiles.dll ()
MOD - C:\Program Files\Adobe\Adobe Bridge CS4\AdobeXMP.dll ()
MOD - C:\Program Files\Adobe\Adobe Bridge CS4\Symlib.dll ()
MOD - C:\Program Files\Adobe\Adobe Bridge CS4\libmysqld.dll ()
MOD - C:\Program Files\InstantEyedropper\InstantEyedropper.exe ()


========== Services (SafeList) ==========

SRV - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (AdvancedSystemCareService6) – C:\Program Files\IObit\Advanced SystemCare 6\ASCService.exe (IObit)
SRV - (nvUpdatusService) – C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (MsDepSvc) – C:\Program Files\IIS\Microsoft Web Deploy\MsDepSvc.exe (Microsoft Corporation)
SRV - (PassThru Service) – C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe ()
SRV - (vsmon) – C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)
SRV - (IswSvc) – C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe (Check Point Software Technologies)
SRV - (UMVPFSrv) – C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
SRV - (IMFservice) – C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe (IObit)
SRV - (Adobe Version Cue CS4) – C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe (Adobe Systems Incorporated)
SRV - (LBTServ) – C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe (Logitech, Inc.)


========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (AswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (UrlFilter) – C:\Program Files\IObit\IObit Malware Fighter\Drivers\wxp_x86\UrlFilter.sys (IObit.com)
DRV - (RegFilter) – C:\Program Files\IObit\IObit Malware Fighter\Drivers\wxp_x86\RegFilter.sys (IObit.com)
DRV - (Vsdatant) – C:\WINDOWS\system32\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (ISWKL) – C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys (Check Point Software Technologies)
DRV - (LVUVC) – C:\WINDOWS\system32\drivers\lvuvc.sys (Logitech Inc.)
DRV - (LVRS) – C:\WINDOWS\system32\drivers\lvrs.sys (Logitech Inc.)
DRV - (FileMonitor) – C:\Program Files\IObit\IObit Malware Fighter\Drivers\wxp_x86\FileMonitor.sys (IObit)
DRV - (RsFx0151) – C:\WINDOWS\system32\drivers\RsFx0151.sys (Microsoft Corporation)
DRV - (SmartDefragDriver) – C:\WINDOWS\system32\drivers\SmartDefragDriver.sys ()
DRV - (RTL8192su) – C:\WINDOWS\system32\drivers\RTL8192su.sys (Realtek Semiconductor Corporation )
DRV - (htcnprot) – C:\WINDOWS\system32\drivers\htcnprot.sys (Windows ® Win 7 DDK provider)
DRV - (HTCAND32) – C:\WINDOWS\system32\drivers\ANDROIDUSB.sys (HTC, Corporation)
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (VIAHdAudAddService) – C:\WINDOWS\system32\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV - (LMouKE) – C:\WINDOWS\system32\drivers\LMouKE.Sys (Logitech, Inc.)
DRV - (L8042mou) – C:\WINDOWS\system32\drivers\L8042mou.Sys (Logitech, Inc.)
DRV - (L8042Kbd) – C:\WINDOWS\system32\drivers\L8042Kbd.sys (Logitech, Inc.)
DRV - (monfilt) – C:\WINDOWS\system32\drivers\monfilt.sys (Creative Technology Ltd.)
DRV - (MTsensor) – C:\WINDOWS\system32\drivers\ASACPI.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a;…q={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sky.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchnu.com/406
IE - HKCU\..\URLSearchHook: {7473b6bd-4691-4744-a82b-7854eb3d70b6} - C:\Program Files\uTorrentControl_v2\prxtbuTor.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&a;…q={searchTerms}
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?…;ctid=CT3220468
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: [removed]:1.0
FF - prefs.js..extensions.enabledAddons: [removed]:308
FF - prefs.js..browser.search.selectedEngine: "Search Results"
FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..keyword.URL: "http://dts.search-results.com/sr?src=ffb&gct;=ds&appid;=394&systemid;=406&apn;_dtid=BND406&apn;_ptnrs=AG6&apn;_uid=0309348843184532&o;=APN10645&q;="
FF - prefs.js..browser.startup.homepage: "http://www.searchnu.com/406"


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.4: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll File not found

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2012/04/19 18:24:45 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012/11/13 21:50:12 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/04/20 14:57:26 | 000,000,000 | —D | M]

[2012/11/10 21:58:48 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Cragdo\Application Data\Mozilla\Extensions
[2012/11/10 22:00:54 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Cragdo\Application Data\Mozilla\Firefox\Profiles\f6ev4s0d.default\extensions
[2012/11/10 06:54:03 | 000,000,000 | —D | M] (uTorrentControl_v2) – C:\Documents and Settings\Cragdo\Application Data\Mozilla\Firefox\Profiles\f6ev4s0d.default\extensions\{7473b6bd-4691-4744-a82b-7854eb3d70b6}
[2012/07/30 18:25:26 | 000,000,000 | —D | M] (Firefogg) – C:\Documents and Settings\Cragdo\Application Data\Mozilla\Firefox\Profiles\f6ev4s0d.default\extensions\[removed]
[2012/11/10 19:57:57 | 000,213,316 | —- | M] () (No name found) – C:\Documents and Settings\Cragdo\Application Data\Mozilla\Firefox\Profiles\f6ev4s0d.default\extensions\[removed]
[2012/11/10 19:49:08 | 000,002,687 | —- | M] () – C:\Documents and Settings\Cragdo\Application Data\Mozilla\Firefox\Profiles\f6ev4s0d.default\searchplugins\Search_Results.xml
[2012/11/10 21:58:48 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/04/21 17:04:50 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
[2012/04/21 17:04:37 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
File not found (No name found) – C:\PROGRAM FILES\SEARCH RESULTS TOOLBAR\DATAMNGR\FIREFOXEXTENSION
[2012/03/13 04:39:39 | 000,097,208 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/03/13 04:38:32 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/11/10 19:49:08 | 000,002,687 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
[2012/03/13 04:38:32 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http://www.google.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie;={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl;={language}&q;={searchTerms}&sugkey;={google:suggestAPIKeyParameter},
CHR - homepage: http://www.google.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.97\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.97\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.97\pdf.dll
CHR - plugin: Conduit Chrome Plugin (Enabled) = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda\2.3.15.10_0\plugins/ConduitChromeApiPlugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: npFFApi (Enabled) = C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 7 U9 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Java Deployment Toolkit 7.0.90.5 (Enabled) = C:\WINDOWS\system32\npDeployJava1.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: jQuery API Browser = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\abefhanahjellfbchdmkjdcchkogijhk\1.6_0\
CHR - Extension: WhatFontis.com = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\abgojkiegljpbjgofklpmkakkeapjlpp\2.0_0\
CHR - Extension: HTML5 Outliner = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\afoibpobokebhgfnknfndkgemglggomo\0.5.1.72_0\
CHR - Extension: Validity = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbicmjjbohdfglopkidebfccilipgeif\1.2.4_0\
CHR - Extension: Web Developer = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bfbameneiokkgbdmiekhjnmfkcnldhhm\0.4.1_0\
CHR - Extension: YouTube = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: my code stock.com = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnlabgojebipbkffbebpecgapkakdikp\1.0.1_0\
CHR - Extension: Pixlr Grabber - Screen capture/image grabbing = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cjjghkapdciaiogkeofggpblmbbnjinn\1.0_0\
CHR - Extension: JS&CSS; Highlighter = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cjkhlhfecbaiapfkmmebdpbeengcelld\1.0.0_0\
CHR - Extension: RegExp Tester App = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cmmblmkfaijaadfjapjddbeaoffeccib\0.1.2_0\
CHR - Extension: Google Search = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: BuiltWith Technology Profiler = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\dapjbgnjinbpoindlpdmhochffioedbn\1.6_0\
CHR - Extension: Sprite Mapper = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\dmnphgbpmlpkhpbhfeckpcbebpjflnne\1.3.4_0\
CHR - Extension: XV \u2014 XML Viewer = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\eeocglpgjdpaefaedpblffpeebgmgddk\1.0.10_0\
CHR - Extension: Disable All Extensions Plus = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ejhdjfmkegkpenillofhpmikailkjpkb\1.2.2_0\
CHR - Extension: Bookmarks = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ffieaadkkhencgelmgbbmkkipeocbcbg\1.1_0\
CHR - Extension: Springpad = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\fkmopoamfjnmppabeaphohombnjcjgla\6_0\
CHR - Extension: Pendule = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gbkffbkamcejhkcaocmkdeiiccpmjfdi\1.0.0_0\
CHR - Extension: Javascript Object Browser = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gpaagbhojejffmocmmjclhedfijjafja\1.1.1_0\
CHR - Extension: TagMyCode = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\hppjochmjbebdchfbkomlnanalapcdif\0.1.1_0\
CHR - Extension: avast! WebRep = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1474_0\
CHR - Extension: Resolution Test = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\idhfcdbheobinplaamokffboaccidbal\2.0_0\
CHR - Extension: What's the font? = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ipooogmmnpmfmhbhlahhjkjiiamjllal\0.1.4_0\
CHR - Extension: WhatFont = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jabopobgcpjmedljpbcaablpmlmfcogm\2.0.1_0\
CHR - Extension: SingleFile Core = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jemlklgaibiijojffihnhieihhagocma\0.3.6_0\
CHR - Extension: LiveReload = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jnihajbhpnppcggbcgedagnkighmdlei\2.0.9_0\
CHR - Extension: Stylebot Social = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\kaifpdafpkbjghohkfkfmkcfcmmnbnaa\1_0\
CHR - Extension: StumbleUpon = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\kcahibnffhnnjcedflmchmokndkjnhpg\4.12.6.1_1\
CHR - Extension: Image Properties Context Menu = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\khagclindddokccfbmfmckaflngbmpon\0.7.5_0\
CHR - Extension: View Background Image = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\knnjokagadbonknppgkjgjpiolcijbmg\0.3_0\
CHR - Extension: Save as PDF = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\kpdjmbiefanbdgnkcikhllpmjnnllbbc\1.7_0\
CHR - Extension: Download Fonts = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lgmjfmdomlhhodhmmfaomfbbdadpeefk\1.2_0\
CHR - Extension: Current Source Code = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ljcogemcngolehdjglgiaphnmggiacca\1.1_0\
CHR - Extension: Springpad Extension = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\njhgeimnepehieioinbhmfpphfoocmng\2.5.1109.21_0\
CHR - Extension: CSS Playground = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nlpdejbmhfkbmlhgigfldhlajpbcakkc\1.0_0\
CHR - Extension: csscan = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nnklpgoldelpoigiacfpnpphpkkmbdkb\2.0.1_0\
CHR - Extension: Palette for Chrome = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\oolpphfmdmjbojolagcbgdemojhcnlod\1.5.2_0\
CHR - Extension: Gmail = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2008/04/14 12:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()
O2 - BHO: (Zonealarm Helper Object) - {2A841F7A-A014-4DA5-B6D9-8B913DFB7A8C} - C:\Program Files\Check Point Software Technologies LTD\zonealarm\1.5.20.3\bh\zonealarm.dll (Montera Technologeis LTD)
O2 - BHO: (uTorrentControl_v2 Toolbar) - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - C:\Program Files\uTorrentControl_v2\prxtbuTor.dll (Conduit Ltd.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Toolbar) - {438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59} - C:\Program Files\Check Point Software Technologies LTD\zonealarm\1.5.20.3\zonealarmTlbr.dll (Montera Technologeis LTD)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (uTorrentControl_v2 Toolbar) - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - C:\Program Files\uTorrentControl_v2\prxtbuTor.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O4 - HKLM..\Run: [Acrobat Assistant 8.0] c:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe_ID0ENQBO] C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4Tray.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [IObit Malware Fighter] C:\Program Files\IObit\IObit Malware Fighter\IMF.exe (IObit)
O4 - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe ()
O4 - HKLM..\Run: [ZoneAlarm] C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [AdobeBridge] C:\Program Files\Adobe\Adobe Bridge CS4\Bridge.exe (Adobe Systems, Inc.)
O4 - HKCU..\Run: [Advanced SystemCare 6] C:\Program Files\IObit\Advanced SystemCare 6\ASCTray.exe (IObit)
O4 - HKCU..\Run: [instanteyedropper] C:\Program Files\InstantEyedropper\InstantEyedropper.exe ()
O4 - HKCU..\Run: [Spotify Web Helper] C:\Documents and Settings\Cragdo\Application Data\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - Startup: C:\Documents and Settings\Cragdo\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\Cragdo\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: Sky - {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.sky.com File not found
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1335028509734 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{21BB7B97-A30B-4D20-9AC4-4B77B8C0FF55}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logitech\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\Logitech\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Cragdo\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Cragdo\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012/04/19 16:11:34 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\WINDOWS\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/12/14 23:40:04 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Cragdo\Desktop\OTL.exe
[2012/12/14 22:57:52 | 000,000,000 | —D | C] – C:\Program Files\7-Zip
[2012/12/14 22:57:52 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\7-Zip
[2012/12/14 22:28:50 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\IObit Malware Fighter
[2012/12/14 03:23:22 | 000,000,000 | —D | C] – C:\Program Files\Dropbox
[2012/12/11 23:08:14 | 000,000,000 | —D | C] – C:\WINDOWS\tasks\TaskDisabled
[2 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
[12 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/12/14 23:40:05 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Cragdo\Desktop\OTL.exe
[2012/12/14 23:22:00 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/12/14 23:01:19 | 000,002,809 | —- | M] () – C:\Documents and Settings\Cragdo\Desktop\HiJackThis.lnk
[2012/12/14 22:30:09 | 000,000,424 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{568ADC25-2016-40C7-A1A2-A5CEE082BB39}.job
[2012/12/14 22:29:23 | 000,000,282 | —- | M] () – C:\WINDOWS\tasks\SmartDefrag_Startup.job
[2012/12/14 22:28:51 | 000,000,826 | —- | M] () – C:\Documents and Settings\All Users\Desktop\IObit Malware Fighter.lnk
[2012/12/14 22:05:06 | 000,013,748 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/12/14 22:02:53 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/12/14 19:28:43 | 000,000,947 | —- | M] () – C:\Documents and Settings\Cragdo\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/12/14 19:22:01 | 000,000,316 | -H– | M] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2012/12/14 19:21:01 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/12/14 12:21:05 | 000,046,080 | —- | M] () – C:\Documents and Settings\Cragdo\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/12/14 03:23:37 | 000,001,029 | —- | M] () – C:\Documents and Settings\Cragdo\Start Menu\Programs\Startup\Dropbox.lnk
[2012/12/14 03:19:14 | 002,220,072 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/12/14 03:02:51 | 000,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[2012/12/13 19:54:04 | 000,002,625 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2012/12/11 23:21:27 | 000,599,098 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/12/11 23:21:27 | 000,125,162 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
[12 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/12/14 23:01:19 | 000,002,809 | —- | C] () – C:\Documents and Settings\Cragdo\Desktop\HiJackThis.lnk
[2012/12/14 22:28:51 | 000,000,826 | —- | C] () – C:\Documents and Settings\All Users\Desktop\IObit Malware Fighter.lnk
[2012/12/14 03:02:13 | 000,001,393 | —- | C] () – C:\WINDOWS\imsins.BAK
[2012/11/10 06:57:31 | 000,558,133 | —- | C] () – C:\WINDOWS\System32\sqlite3.dll
[2012/08/01 17:32:43 | 000,046,080 | —- | C] () – C:\Documents and Settings\Cragdo\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/05/30 01:00:48 | 000,603,496 | —- | C] () – C:\Documents and Settings\Cragdo\Local Settings\Application Data\census.cache
[2012/05/30 01:00:32 | 000,121,836 | —- | C] () – C:\Documents and Settings\Cragdo\Local Settings\Application Data\ars.cache
[2012/05/29 21:07:14 | 000,000,036 | —- | C] () – C:\Documents and Settings\Cragdo\Local Settings\Application Data\housecall.guid.cache
[2012/05/29 19:24:41 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/05/15 19:02:24 | 000,014,776 | —- | C] () – C:\WINDOWS\System32\drivers\SmartDefragDriver.sys
[2012/04/23 22:21:04 | 000,001,769 | —- | C] () – C:\WINDOWS\Language_trs.ini
[2012/04/21 15:15:54 | 002,592,466 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-507921405-1993962763-682003330-1003-0.dat
[2012/04/21 15:15:50 | 000,333,374 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2012/04/19 18:07:26 | 001,102,000 | —- | C] () – C:\WINDOWS\System32\nvdrsdb1.bin
[2012/04/19 18:07:26 | 001,102,000 | —- | C] () – C:\WINDOWS\System32\nvdrsdb0.bin
[2012/04/19 18:07:26 | 000,000,001 | —- | C] () – C:\WINDOWS\System32\nvdrssel.bin
[2012/04/19 18:07:04 | 002,811,988 | —- | C] () – C:\WINDOWS\System32\nvdata.data
[2012/04/19 17:23:55 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2012/04/19 16:16:57 | 000,018,416 | —- | C] () – C:\WINDOWS\Ascd_log.ini
[2012/04/19 16:16:44 | 000,018,169 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2012/04/19 16:16:43 | 000,005,810 | R— | C] () – C:\WINDOWS\System32\drivers\ASACPI.sys
[2012/04/19 16:16:36 | 000,012,536 | —- | C] () – C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2012/04/19 16:12:51 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2012/04/19 16:09:39 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2012/04/19 14:31:34 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2012/04/19 14:29:04 | 002,220,072 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/01/18 05:44:00 | 010,920,984 | —- | C] () – C:\WINDOWS\System32\LogiDPP.dll
[2012/01/18 05:44:00 | 000,336,408 | —- | C] () – C:\WINDOWS\System32\DevManagerCore.dll
[2012/01/18 05:44:00 | 000,104,472 | —- | C] () – C:\WINDOWS\System32\LogiDPPApp.exe
[2012/01/18 05:22:54 | 000,028,418 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2011/08/12 11:20:14 | 000,015,896 | —- | C] () – C:\WINDOWS\System32\drivers\iKeyLFT2.dll

========== ZeroAccess Check ==========

[2012/04/19 18:32:58 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2008/04/14 12:00:00 | 001,499,136 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll – [2009/02/09 12:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll – [2008/04/14 12:00:00 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2012/04/19 17:02:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2012/11/10 19:49:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\boost_interprocess
[2012/04/19 17:08:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\CheckPoint
[2012/04/20 14:58:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DFX
[2012/12/06 15:42:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\IObit
[2012/04/23 21:28:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\IswTmp
[2012/07/13 06:55:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Package Cache
[2012/11/10 22:01:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Tarma Installer
[2012/04/20 16:45:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\VS
[2012/04/23 22:40:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\AMPSoft
[2012/04/20 15:17:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\Check Point Software Technologies LTD
[2012/04/19 17:10:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\CheckPoint
[2012/04/21 20:06:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2012/12/14 22:06:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\Dropbox
[2012/04/19 18:16:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\FileZilla
[2012/04/20 15:17:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\Funmoods
[2012/05/18 13:42:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\HandBrake
[2012/04/19 19:05:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\HTC
[2012/05/16 20:38:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
[2012/12/14 22:28:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\IObit
[2012/04/23 18:12:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\Leadertech
[2012/04/22 01:52:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\OpenOffice.org
[2012/12/14 19:59:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\Spotify
[2012/12/14 22:27:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\uTorrent
[2012/04/21 17:27:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\Windows Desktop Search
[2012/05/16 14:31:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\Windows Search

========== Purity Check ==========



========== Custom Scans ==========

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

< MD5 for: EXPLORER.DESIGNER.VB >
[2009/12/21 10:28:26 | 000,036,545 | —- | M] () MD5=0BFA552D19A4A7F9130A71DFBBCB1407 – C:\Documents and Settings\All Users\Application Data\Microsoft\VSTAHost\SSIS_ScriptComponent\9.0\ItemTemplatesCache\VisualBasic\Windows Forms\1033\Explorer.zip\explorer.designer.vb
[2009/12/21 10:28:26 | 000,036,545 | —- | M] () MD5=0BFA552D19A4A7F9130A71DFBBCB1407 – C:\Documents and Settings\All Users\Application Data\Microsoft\VSTAHost\SSIS_ScriptTask\9.0\ItemTemplatesCache\VisualBasic\Windows Forms\1033\Explorer.zip\explorer.designer.vb

< MD5 for: EXPLORER.EXE >
[2008/04/14 12:00:00 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe
[2008/04/14 12:00:00 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\system32\dllcache\explorer.exe

< MD5 for: EXPLORER.EXE-082F38A9.PF >
[2012/12/14 03:20:00 | 000,045,170 | —- | M] () MD5=E5AB0189B7C70A3A1F820D45728AE520 – C:\WINDOWS\Prefetch\EXPLORER.EXE-082F38A9.pf

< MD5 for: EXPLORER.RESX >
[2009/12/21 10:28:26 | 000,040,049 | —- | M] () MD5=B16D2C77324DE7222CB0EA55C7B32784 – C:\Documents and Settings\All Users\Application Data\Microsoft\VSTAHost\SSIS_ScriptComponent\9.0\ItemTemplatesCache\VisualBasic\Windows Forms\1033\Explorer.zip\explorer.resx
[2009/12/21 10:28:26 | 000,040,049 | —- | M] () MD5=B16D2C77324DE7222CB0EA55C7B32784 – C:\Documents and Settings\All Users\Application Data\Microsoft\VSTAHost\SSIS_ScriptTask\9.0\ItemTemplatesCache\VisualBasic\Windows Forms\1033\Explorer.zip\explorer.resx

< MD5 for: EXPLORER.SCF >
[2008/04/14 12:00:00 | 000,000,080 | —- | M] () MD5=A3975A7D2C98B30A2AE010754FFB9392 – C:\WINDOWS\explorer.scf

< MD5 for: EXPLORER.VB >
[2009/12/21 10:28:26 | 000,008,501 | —- | M] () MD5=55808E7AF87B5C18B97707BEF8EBDDEA – C:\Documents and Settings\All Users\Application Data\Microsoft\VSTAHost\SSIS_ScriptComponent\9.0\ItemTemplatesCache\VisualBasic\Windows Forms\1033\Explorer.zip\explorer.vb
[2009/12/21 10:28:26 | 000,008,501 | —- | M] () MD5=55808E7AF87B5C18B97707BEF8EBDDEA – C:\Documents and Settings\All Users\Application Data\Microsoft\VSTAHost\SSIS_ScriptTask\9.0\ItemTemplatesCache\VisualBasic\Windows Forms\1033\Explorer.zip\explorer.vb

< MD5 for: EXPLORER.VSTEMPLATE >
[2009/12/21 10:28:26 | 000,006,491 | —- | M] () MD5=FB731348042E3356E2215A6747CE893C – C:\Documents and Settings\All Users\Application Data\Microsoft\VSTAHost\SSIS_ScriptComponent\9.0\ItemTemplatesCache\VisualBasic\Windows Forms\1033\Explorer.zip\explorer.vstemplate
[2009/12/21 10:28:26 | 000,006,491 | —- | M] () MD5=FB731348042E3356E2215A6747CE893C – C:\Documents and Settings\All Users\Application Data\Microsoft\VSTAHost\SSIS_ScriptTask\9.0\ItemTemplatesCache\VisualBasic\Windows Forms\1033\Explorer.zip\explorer.vstemplate

< MD5 for: EXPLORER.ZIP >
[2009/12/21 10:28:28 | 000,024,306 | —- | M] () MD5=1EFEA00EC1042E059C5602E46DA33421 – C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\ItemTemplates\VisualBasic\Windows Forms\1033\Explorer.zip

< MD5 for: IEXPLORE.CHM >
[2009/02/21 00:21:24 | 000,529,818 | —- | M] () MD5=1435F4731719DF5F57D17DC38196245D – C:\WINDOWS\Help\iexplore.chm
[2008/04/14 12:00:00 | 000,204,810 | —- | M] () MD5=60858526AAD1CC55F5F0055B8E3B66FE – C:\WINDOWS\ie8\iexplore.chm

< MD5 for: IEXPLORE.EXE >
[2008/04/14 12:00:00 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 – C:\WINDOWS\ie8\iexplore.exe
[2012/09/29 19:54:26 | 000,218,184 | —- | M] () MD5=8846E87210AD131CF71E3E2E49F647B0 – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\iexplore.exe
[2009/03/08 13:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\Program Files\Internet Explorer\iexplore.exe
[2009/03/08 13:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\WINDOWS\system32\dllcache\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2009/03/08 13:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2009/03/08 13:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Program Files\Internet Explorer\iexplore.exe.mui

< MD5 for: IEXPLORE.HLP >
[2008/04/14 12:00:00 | 000,180,335 | —- | M] () MD5=3F19AF1B745140DAFAC6F78F561A3C62 – C:\WINDOWS\Help\iexplore.hlp

< MD5 for: SERVICES >
[2008/04/14 12:00:00 | 000,007,116 | —- | M] () MD5=95826940E657FE0567A8EC0F2A6AD11A – C:\WINDOWS\system32\drivers\etc\services

< MD5 for: SERVICES.AIP >
[2008/09/18 02:07:48 | 000,118,784 | —- | M] (Adobe Systems Incorporated) MD5=41EE0A80B951D675B9227F29651511E0 – C:\Program Files\Adobe\Adobe Illustrator CS4\Plug-ins\Extensions\Services.aip

< MD5 for: SERVICES.EXE >
[2009/02/06 11:06:24 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=020CEAAEDC8EB655B6506B8C70D53BB6 – C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe
[2008/04/14 12:00:00 | 000,108,544 | —- | M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 – C:\WINDOWS\$NtUninstallKB956572$\services.exe
[2009/02/06 11:11:05 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\WINDOWS\system32\dllcache\services.exe
[2009/02/06 11:11:05 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\WINDOWS\system32\services.exe

< MD5 for: SERVICES.HTM >
[2010/02/22 11:19:52 | 000,018,643 | —- | M] () MD5=05261CE0F01EB69684531347950813D1 – C:\Documents and Settings\Cragdo\My Documents\Web Development\Web Works\cubed\services.htm
[2010/02/17 05:27:18 | 000,006,470 | —- | M] () MD5=200F5BF07206761591D3BA35C6510046 – C:\Documents and Settings\Cragdo\My Documents\Web Development\Web Works\nathan\services.htm
[2010/01/19 11:17:44 | 000,008,020 | —- | M] () MD5=791621C6A49E7F7AE2EEAEF1059AA103 – C:\Documents and Settings\Cragdo\My Documents\Web Development\Web Works\coda\services.htm
[2011/04/15 10:17:02 | 000,006,173 | —- | M] () MD5=995A1255C024A804C7DD7E350C44DAD3 – C:\Documents and Settings\Cragdo\My Documents\Dropbox\D-Box\Coda - New\services.htm
[2011/04/15 10:17:01 | 000,006,173 | —- | M] () MD5=995A1255C024A804C7DD7E350C44DAD3 – C:\Documents and Settings\Cragdo\My Documents\Web Development\Coda - New\services.htm

< MD5 for: SERVICES.LNK >
[2012/04/19 16:11:38 | 000,001,602 | —- | M] () MD5=C581E3D63204F455BEA4F0A146A286B7 – C:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Services.lnk

< MD5 for: SERVICES.MSC >
[2008/04/14 12:00:00 | 000,033,464 | —- | M] () MD5=E8089AA2A6F7FEE89B38C1F2D77BA6C6 – C:\WINDOWS\system32\services.msc

< MD5 for: SERVICES.PNG >
[2010/02/14 13:51:04 | 000,062,552 | —- | M] () MD5=0017D11D6784F35CCDE72192CB0FAAA7 – C:\Documents and Settings\Cragdo\My Documents\Web Development\Web Works\nathan\images\services.png
[2010/01/11 22:02:58 | 000,001,633 | —- | M] () MD5=65086620908DE497D24A4C6779DD26A3 – C:\Documents and Settings\Cragdo\My Documents\Web Development\Web Works\cubed\images\services.png

< MD5 for: SERVICES.RDB >
[2009/04/23 23:35:04 | 000,262,144 | —- | M] () MD5=00D8C85E07B0D69A27816B54E56EF85B – C:\Program Files\OpenOffice.org 3\URE\misc\services.rdb
[2009/04/23 23:34:14 | 005,472,256 | —- | M] () MD5=81CCB59A28A03DB55807B883CB679027 – C:\Program Files\OpenOffice.org 3\Basis\program\services.rdb

< MD5 for: WINLOGON.EXE >
[2012/09/29 19:54:26 | 000,218,184 | —- | M] () MD5=8846E87210AD131CF71E3E2E49F647B0 – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/04/14 12:00:00 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\dllcache\winlogon.exe
[2008/04/14 12:00:00 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

< %SYSTEMDRIVE%\*.* >
[2012/04/19 16:11:34 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2012/04/19 16:08:05 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2012/04/19 16:11:34 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2012/04/19 16:11:34 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2012/04/19 16:11:34 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2008/04/14 12:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/04/14 12:00:00 | 000,250,048 | RHS- | M] () – C:\ntldr
[2012/12/14 22:02:50 | 2145,386,496 | -HS- | M] () – C:\pagefile.sys
[2012/04/19 19:06:34 | 000,000,176 | —- | M] () – C:\user.js

< %systemroot%\Fonts\*.com >
[2006/04/18 14:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 13:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 14:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 13:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2012/04/19 16:11:16 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 12:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/07/06 10:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2012/10/30 22:51:07 | 000,041,224 | —- | M] (AVAST Software) – C:\WINDOWS\avastSS.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2012/04/19 14:28:16 | 000,094,208 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2012/04/19 14:28:16 | 001,089,536 | —- | M] () – C:\WINDOWS\System32\config\software.sav
[2012/04/19 14:28:15 | 000,913,408 | —- | M] () – C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2012/04/19 16:11:38 | 000,000,294 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2012/04/19 16:14:56 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\Cragdo\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2012/04/19 16:14:55 | 000,000,079 | —- | M] () – C:\Documents and Settings\Cragdo\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2012/12/14 23:40:05 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Cragdo\Desktop\OTL.exe
[2012/07/12 10:35:43 | 000,104,672 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Cragdo\Desktop\webmatrix.3f.3f.3fnew.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-12-14 03:02:58

========== Alternate Data Streams ==========

@Alternate Data Stream - 153 bytes -> C:\Documents and Settings\Cragdo\Desktop\WEBSITE WEE CHANGES.doc:com.dropbox.attributes

< End of report >

OTL Extras logfile created on: 14/12/2012 23:44:15 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Cragdo\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.50 Gb Total Physical Memory | 2.84 Gb Available Physical Memory | 81.08% Memory free
5.34 Gb Paging File | 4.43 Gb Available in Paging File | 83.09% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 931.50 Gb Total Space | 787.70 Gb Free Space | 84.56% Space Free | Partition Type: NTFS
Drive D: | 6.15 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: CRAZY-BOAB | User Name: Cragdo | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = ChromeHTML] – C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
http [open] – "C:\Program Files\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
https [open] – "C:\Program Files\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" (VideoLAN)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OpenAsAWebSite] – C:\Program Files\Microsoft WebMatrix\WebMatrix.exe #ExecuteCommand# SiteFromFolder %L (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" (VideoLAN)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"5985:TCP" = 5985:TCP:*:Disabled:Windows Remote Management
"80:TCP" = 80:TCP:*:Disabled:Windows Remote Management - Compatibility Mode (HTTP-In)
"5353:TCP" = 5353:TCP:*:Enabled:Adobe CSI CS4
"3703:TCP" = 3703:TCP:*:Enabled:Adobe Version Cue CS4 Server
"3704:TCP" = 3704:TCP:*:Enabled:Adobe Version Cue CS4 Server
"51000:TCP" = 51000:TCP:*:Enabled:Adobe Version Cue CS4 Server
"51001:TCP" = 51001:TCP:*:Enabled:Adobe Version Cue CS4 Server

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 – (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 – (Microsoft Corporation)
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger – (Logitech Inc.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 – (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 – (Microsoft Corporation)
"C:\Documents and Settings\Cragdo\Application Data\Dropbox\bin\Dropbox.exe" = C:\Documents and Settings\Cragdo\Application Data\Dropbox\bin\Dropbox.exe:*:Enabled:Dropbox – (Dropbox, Inc.)
"C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" = C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4 – (Adobe Systems Incorporated)
"C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe" = C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe:*:Enabled:Adobe Version Cue CS4 Server – (Adobe Systems Incorporated)
"C:\Documents and Settings\Cragdo\Application Data\Spotify\spotify.exe" = C:\Documents and Settings\Cragdo\Application Data\Spotify\spotify.exe:*:Enabled:Spotify – (Spotify Ltd)
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger – (Logitech Inc.)
"C:\Program Files\Logitech\Vid HD\Vid.exe" = C:\Program Files\Logitech\Vid HD\Vid.exe:*:Enabled:Logitech Vid HD – (Logitech Inc.)
"C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe" = C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe:*:Enabled:Daemonu.exe – (NVIDIA Corporation)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{020617D7-2F72-4D02-BF59-A5CBC1761177}" = SQL Server 2008 R2 SP1 Management Studio
"{0270CDDA-B19D-6A11-3530-28EC36DAE787}" = MyFonts Order M1833979 (M-U)
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{03DEEAD2-F3B7-45BF-9006-A25D015F00D2}" = Adobe Flash Player 10 Plugin
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{05855322-BE43-41FE-B583-D3AE0C326D58}" = Microsoft Silverlight 4 SDK
"{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{098A2A49-7CF3-4F08-A38D-FB879117152A}" = Adobe Color NA Extra Settings CS4
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0DC0E85F-36E4-463B-B3EA-4CD8ED2222A1}" = Adobe Color EU Recommended Settings CS4
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{121475F5-2598-4574-8801-8F6B3D6A99BB}" = SQL Server 2008 R2 SP1 Management Studio
"{138A4072-9E64-46BD-B5F9-DB2BB395391F}" = LWS VideoEffects
"{14C35072-D7D0-4B29-B5BF-C94E426D77E9}" = Sky Broadband
"{14DD7530-CCD2-3798-B37D-3839ED6A441C}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{14F70205-1940-4000-88C7-BE799A6B2CAD}" = Adobe Soundbooth CS4
"{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi
"{15D2101C-B306-4451-A23D-3A299B695481}" = Microsoft Web Deploy 3.0
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main
"{16E16F01-2E2D-4248-A42F-76261C147B6C}" = Adobe Drive CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{174A3B31-4C43-43DD-866F-73C9DB887B48}" = LWS Twitter
"{1803A630-3C38-4D2B-9B9A-0CB37243539C}" = Microsoft ASP.NET MVC 2
"{185292F7-7C0A-4F72-B2CC-CBEBD40B050E}" = Microsoft SQL Server 2008 R2 Native Client
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1B7C06E1-4888-47A6-992A-0990B9683486}" = Adobe Version Cue CS4 Server
"{1CA86915-6C2D-C7FE-B399-406B444A9FDA}" = MyFonts Order M1833979 (A-L)
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2012098D-EEE9-4769-8DD3-B038050854D4}" = Microsoft Silverlight 3 SDK
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{2168245A-B5AD-40D8-A641-48E3E070B5B6}" = Adobe Flash CS4 STI-en
"{21895F64-4DA5-4D5E-A5AC-BED10B81A09E}" = Microsoft ASP.NET Web Pages 2 Runtime
"{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin
"{21E7A706-31FF-46AA-A294-FA4A8917B59F}" = Microsoft ASP.NET MVC 3 - VWD Express 2010 Tools Update
"{23170F69-40C1-2701-0921-000001000000}" = 7-Zip 9.21
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java™ 6 Update 31
"{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 9
"{297190A1-4B0D-4CD6-8B9F-3907F15C3FD8}" = Adobe CS4 American English Speech Analysis Models
"{2FDD750F-49B7-40C1-9D5E-D2955BC0E2D8}" = NVIDIA PhysX
"{30C8AA56-4088-426F-91D1-0EDFD3A25678}" = Adobe Dreamweaver CS4
"{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper
"{31A559C1-9E4D-423B-9DD3-34A6C5398752}" = HTC BMP USB Driver
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{3732AF18-9C3C-428D-B944-F7E3FADEE3F3}" = Adobe Setup
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
"{3A30B5F5-F12C-490F-8CD4-D200C75DF7E8}" = IIS 7.5 Express
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3A6829EF-0791-4FDD-9382-C690DD0821B9}" = Adobe Flash Player 10 ActiveX
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3CFFC382-6C23-42CB-8B1E-625F9F84E362}" = Microsoft ASP.NET Web Pages - VWD Express 2010 Tools
"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT
"{428FDF9F-E010-4C4C-A8BB-156960AFCA1C}" = Adobe Fireworks CS4
"{43509E18-076E-40FE-AF38-CA5ED400A5A9}" = Pixel Bender Toolkit
"{44692C56-388C-D99B-BC4A-C828595D2E46}" = MyFonts Order M1833979A-L
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{47BE41E6-2F0F-4D17-9C2D-3850FFD9D405}" = Microsoft SQL Server VSS Writer
"{47FA2C44-D148-4DBC-AF60-B91934AA4842}" = Adobe AIR
"{48B08845-0CB0-45EC-893C-15319ADDA312}" = Microsoft SQL Server 2008 R2 Setup (English)
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C9D82EB-9001-4E59-8F64-0BEEE5F4A30A}" = SQL Server 2008 R2 SP1 Database Engine Shared
"{4ECF4BDC-8387-329A-ABE9-CF5798F84BB2}" = Microsoft Visual Studio Tools for Applications 2.0 - ENU
"{5134B35A-B559-4762-94A4-FD4918977953}" = Microsoft Web Deploy 2.0
"{52232EF4-CC12-4C21-ABCF-ADB79618302D}" = Adobe Soundbooth CS4 Codecs
"{57BB52B7-6B7B-31F3-89F4-4EE8FE5CEF6D}" = Microsoft Help Viewer 1.1
"{587178E7-B1DF-494E-9838-FA4DD36E873C}" = ASUSUpdate
"{58721EC3-8D4E-4B79-BC51-1054E2DDCD10}" = SQL Server 2008 R2 SP1 Database Engine Services
"{5BBD0D3F-E4B2-4EE4-806A-07A95D4E2683}" = Sky Broadband Browser Branding
"{5BDFAB82-060E-438B-AB4F-A2331B2294C0}" = Microsoft ASP.NET MVC 2 - VWD Express 2010 Tools
"{5D9ED403-94DE-3BA0-B1D6-71F4BDA412E6}" = Microsoft Visual C++ 2010 x86 Runtime - 10.0.40219
"{60DB5894-B5A1-4B62-B0F3-669A22C0EE5D}" = Adobe Dynamiclink Support
"{628C2C7D-8AD1-E614-E8E2-6EEAD8D5F2D0}" = Acrobat.com
"{631471BE-DEAB-454B-A9AC-CE3EB42C28B3}" = Microsoft ASP.NET Web Pages
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support
"{63E949F6-03BC-5C40-FF1F-C8B3B9A1E18E}" = Visual C++ 8.0 CRT.Policy (x86) WinSXS MSM
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
"{6D6664A9-3342-4948-9B7E-034EFE366F0F}" = HTC Driver Installer
"{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{793D1D88-6141-43DE-BE58-59BCE31B4090}" = Adobe Flash CS4 Extension - Flash Lite STI en
"{8186FF34-D389-4B7E-9A2F-C197585BCFBD}" = Adobe Media Encoder CS4 Importer
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{82284382-30E3-4DED-980B-746278DA6CC2}" = Microsoft SQL Server Compact 4.0 SP1 Scripting Tools ENU CTP1
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher
"{83F2B8F4-5CF3-4BE9-9772-9543EAE4AC5F}" = Microsoft SQL Server 2008 R2 Management Objects
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{85076DFF-7A17-3566-9CC0-488E6E6D4494}" = Microsoft Visual Web Developer 2010 Express - ENU
"{8524BBAC-E3A7-42F5-9B9A-5AE50A10C500}" = Belkin USB Wireless Adaptor
"{87532CAB-7932-4F84-8937-823337622807}" = Adobe Illustrator CS4
"{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8F3A8A33-D0EC-2E8F-3F22-B172680EEE33}" = MyFonts Order M1833979 (V-Z)
"{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}" = Logitech Desktop Messenger
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{93968FB2-C67A-4A9B-80C2-5D4D9393058E}" = Microsoft SQL Server 2008 R2 RsFx Driver
"{93998800-1608-403F-9A51-420A77D23C25}" = Sql Server Customer Experience Improvement Program
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{973805E6-9CDB-43F8-A14E-2161532B56A7}" = Microsoft SQL Server Compact 4.0 SP1 ENU CTP1
"{97BA2B90-AF72-35CF-BFDC-E06531811B20}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86)
"{98CB24AD-52FB-DB5F-FF1F-C8B3B9A1E18E}" = Visual C++ 8.0 CRT (x86) WinSXS MSM
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A51500FE-6408-4305-B071-B961F691A4CE}" = Microsoft SQL Server Compact 4.0 Web Tools ENU
"{A5630CB0-6D3C-4C93-9A51-03BEB835A982}" = NuGet
"{A6EC82A0-1414-475D-8AFD-469089F3080D}" = Adobe Contribute CS4
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB77DFDE-9949-4AEF-B180-BE322C3E65D0}" = HTC Sync
"{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Français, Deutsch
"{AC76BA86-1033-F400-7760-000000000004}_952" = Adobe Acrobat 9.5.2 - CPSID_83708
"{ACE28263-76A4-4BF5-B6F4-8BD719595969}" = Microsoft SQL Server Database Publishing Wizard 1.4
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 306.81
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 306.81
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView" = NVIDIA nView 136.28
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.12.0604
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B4D0E839-72DD-2F46-BEA7-D44926AA9BFA}" = MyFonts Order M2874875
"{B5153233-9AEE-4CD4-9D2C-4FAAC870DBE2}" = SQL Server 2008 R2 SP1 Database Engine Services
"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4
"{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974
"{B9F4561A-924D-4510-A85A-BB0960C338CB}" = Adobe Asset Services CS4
"{BA7A0575-644E-4D4F-B8EB-844114BD0B9E}" = Microsoft WebMatrix 2
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BF9BF038-FE03-429D-9B26-2FA0FD756052}" = Microsoft SQL Server Browser
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C3F6F200-6D7B-4879-B9EE-700C0CE1FCDA}" = Microsoft SQL Server System CLR Types
"{C444B26D-BCC7-4A2D-AC6B-5E01A19C8326}" = SQL Server 2008 R2 SP1 Common Files
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D21BC5B2-CBAC-48FA-A701-B5A63C1CA7B8}" = Microsoft SQL Server 2008 R2 Policies
"{D25C502E-FF51-424C-8C38-8596FE47D0CD}" = Visual Studio 2010 SP1 Tools for SQL Server Compact 4.0 ENU
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam Software
"{D441BD04-E548-4F8E-97A4-1B66135BAAA8}" = Microsoft SQL Server 2008 Setup Support Files
"{D9313DEC-F4B0-430A-8565-63F8450D2D42}" = ZoneAlarm Security
"{D9E6001A-5DC3-4620-AF7A-80B6CD48645D}" = WCF RIA Services V1.0 SP1
"{DCDEC776-BADD-48B9-8F9A-DFF513C3D7FA}" = Microsoft ASP.NET MVC 3
"{DDFD8348-058C-4F4B-85E5-6D740D4AB3FE}" = Microsoft SQL Server Compact 3.5 SP2 Query Tools ENU
"{DEB90B8E-0DCB-48CE-B90E-8842A2BD643E}" = Adobe Media Encoder CS4
"{E6B87DC4-2B3D-4483-ADFF-E483BF718991}" = OpenOffice.org 3.1
"{E7548460-5732-43C8-A205-B43669903470}" = SQL Server 2008 R2 SP1 Common Files
"{E8DBC0AE-4A2D-4859-84E9-C50C3EBA4DB0}" = ZoneAlarm Firewall
"{E9986555-6AE8-4BB3-B025-F3111C1587C3}" = Microsoft Web Platform Installer 4.0
"{ea76c490-c7cd-461a-93f2-e664d3e0d997}" = Microsoft ASP.NET Web Pages 2
"{ED780CA9-0687-3C12-B439-3369F224941F}" = Microsoft Visual Studio 2010 Service Pack 1
"{EED027B7-0DB6-404B-8F45-6DFEE34A0441}" = LWS Video Mask Maker
"{F021CC0C-21C3-4038-AA4A-6E3CBC669CE8}" = SQL Server 2008 R2 SP1 Database Engine Shared
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint
"{F4DA32EA-B9F2-4B22-87E2-E8937DA4F6A8}" = Adobe Creative Suite 4 Web Premium
"{F6E99614-F042-4459-82B7-8B38B2601356}" = Adobe Flash CS4
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"{FF167195-9EE4-46C0-8CD7-FBA3457E88AB}" = LWS Facebook
"Adobe AIR" = Adobe AIR
"Adobe_6f2ce928cc3187358f216191905bbea" = Adobe Creative Suite 4 Web Premium
"Advanced SystemCare 6_is1" = Advanced SystemCare 6
"AMP Font Viewer" = AMP Font Viewer
"avast" = avast! Free Antivirus
"CCleaner" = CCleaner
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"FeedDemon_is1" = FeedDemon
"FileZilla Client" = FileZilla Client 3.5.3
"Google Chrome" = Google Chrome
"HandBrake" = HandBrake 0.9.6
"ie8" = Windows Internet Explorer 8
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager
"InstallShield_{8524BBAC-E3A7-42F5-9B9A-5AE50A10C500}" = Belkin USB Wireless Adaptor
"Instant Eyedropper_is1" = Instant Eyedropper 1.75
"IObit Malware Fighter_is1" = IObit Malware Fighter
"Logitech Vid" = Logitech Vid HD
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.65.1.1000
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Help Viewer 1.1" = Microsoft Help Viewer 1.1
"Microsoft Report Viewer Redistributable 2008 (KB971119)" = Microsoft Report Viewer Redistributable 2008 SP1
"Microsoft SQL Server 10" = Microsoft SQL Server 2008 R2
"Microsoft SQL Server 2008 R2" = Microsoft SQL Server 2008 R2
"Microsoft Visual Studio 2010 Service Pack 1" = Microsoft Visual Studio 2010 Service Pack 1
"Microsoft Visual Studio 2010 Tools for Office Runtime (x86)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86)
"Microsoft Visual Web Developer 2010 Express - ENU" = Microsoft Visual Web Developer 2010 Express - ENU
"Mozilla Firefox 11.0 (x86 en-US)" = Mozilla Firefox 11.0 (x86 en-US)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Smart Defrag 2_is1" = Smart Defrag 2
"Un-Rar for Windows" = Un-Rar for Windows 9.22beta
"uTorrent" = µTorrent
"uTorrentControl_v2 Toolbar" = uTorrentControl_v2 Toolbar
"VLC media player" = VLC media player 2.0.4
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"ZoneAlarm Free" = ZoneAlarm Free
"ZoneAlarm LTD Toolbar" = ZoneAlarm LTD Toolbar
"ZoneAlarm Security Toolbar" = ZoneAlarm Security Toolbar

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"3956731793.go.sky.com" = Sky Go Desktop
"Dropbox" = Dropbox
"Spotify" = Spotify

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 13/12/2012 15:11:47 | Computer Name = CRAZY-BOAB | Source = NativeWrapper | ID = 5000
Description =

Error - 13/12/2012 15:11:53 | Computer Name = CRAZY-BOAB | Source = MsiInstaller | ID = 10005
Description =

Error - 13/12/2012 15:11:53 | Computer Name = CRAZY-BOAB | Source = MsiInstaller | ID = 1023
Description =

Error - 13/12/2012 15:11:53 | Computer Name = CRAZY-BOAB | Source = NativeWrapper | ID = 5000
Description =

Error - 13/12/2012 23:02:19 | Computer Name = CRAZY-BOAB | Source = MsiInstaller | ID = 10005
Description =

Error - 13/12/2012 23:02:19 | Computer Name = CRAZY-BOAB | Source = MsiInstaller | ID = 1023
Description =

Error - 13/12/2012 23:02:20 | Computer Name = CRAZY-BOAB | Source = NativeWrapper | ID = 5000
Description =

Error - 13/12/2012 23:02:40 | Computer Name = CRAZY-BOAB | Source = MsiInstaller | ID = 10005
Description =

Error - 13/12/2012 23:02:40 | Computer Name = CRAZY-BOAB | Source = MsiInstaller | ID = 1023
Description =

Error - 13/12/2012 23:02:40 | Computer Name = CRAZY-BOAB | Source = NativeWrapper | ID = 5000
Description =

[ System Events ]
Error - 13/12/2012 23:20:52 | Computer Name = CRAZY-BOAB | Source = Service Control Manager | ID = 7022
Description = The Web Deployment Agent Service service hung on starting.

Error - 14/12/2012 15:13:35 | Computer Name = CRAZY-BOAB | Source = Service Control Manager | ID = 7038
Description = The nvUpdatusService service was unable to log on as .\UpdatusUser
with the currently configured password due to the following error: %%1330 To ensure
that the service is configured properly, use the Services snap-in in Microsoft Management
Console
(MMC).

Error - 14/12/2012 15:13:35 | Computer Name = CRAZY-BOAB | Source = Service Control Manager | ID = 7000
Description = The NVIDIA Update Service Daemon service failed to start due to the
following error: %%1069

Error - 14/12/2012 15:15:02 | Computer Name = CRAZY-BOAB | Source = Service Control Manager | ID = 7022
Description = The Web Deployment Agent Service service hung on starting.

Error - 14/12/2012 15:21:08 | Computer Name = CRAZY-BOAB | Source = Service Control Manager | ID = 7038
Description = The nvUpdatusService service was unable to log on as .\UpdatusUser
with the currently configured password due to the following error: %%1330 To ensure
that the service is configured properly, use the Services snap-in in Microsoft Management
Console
(MMC).

Error - 14/12/2012 15:21:08 | Computer Name = CRAZY-BOAB | Source = Service Control Manager | ID = 7000
Description = The NVIDIA Update Service Daemon service failed to start due to the
following error: %%1069

Error - 14/12/2012 15:22:35 | Computer Name = CRAZY-BOAB | Source = Service Control Manager | ID = 7022
Description = The Web Deployment Agent Service service hung on starting.

Error - 14/12/2012 18:03:19 | Computer Name = CRAZY-BOAB | Source = Service Control Manager | ID = 7038
Description = The nvUpdatusService service was unable to log on as .\UpdatusUser
with the currently configured password due to the following error: %%1330 To ensure
that the service is configured properly, use the Services snap-in in Microsoft Management
Console
(MMC).

Error - 14/12/2012 18:03:19 | Computer Name = CRAZY-BOAB | Source = Service Control Manager | ID = 7000
Description = The NVIDIA Update Service Daemon service failed to start due to the
following error: %%1069

Error - 14/12/2012 18:05:05 | Computer Name = CRAZY-BOAB | Source = Service Control Manager | ID = 7022
Description = The Web Deployment Agent Service service hung on starting.


< End of report >

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:57:26, on 14/12/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\IObit\Advanced SystemCare 6\ASCService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe
C:\program files\adobe\acrobat 9.0\acrobat\acrotray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\InstantEyedropper\InstantEyedropper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Cragdo\Application Data\Spotify\Data\SpotifyWebHelper.exe
C:\Program Files\Adobe\Adobe Bridge CS4\Bridge.exe
C:\Program Files\IObit\Advanced SystemCare 6\ASCTray.exe
C:\Documents and Settings\Cragdo\Application Data\Dropbox\bin\Dropbox.exe
C:\Program Files\IObit\Advanced SystemCare 6\ASC.exe
C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe
C:\Program Files\IObit\IObit Malware Fighter\IMF.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Documents and Settings\Cragdo\Desktop\OTL.exe
C:\WINDOWS\notepad.exe
C:\WINDOWS\notepad.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sky.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchnu.com/406
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided By Sky Broadband
R3 - URLSearchHook: uTorrentControl_v2 Toolbar - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - C:\Program Files\uTorrentControl_v2\prxtbuTor.dll
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Zonealarm Helper Object - {2A841F7A-A014-4DA5-B6D9-8B913DFB7A8C} - C:\Program Files\Check Point Software Technologies LTD\zonealarm\1.5.20.3\bh\zonealarm.dll
O2 - BHO: uTorrentControl_v2 - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - C:\Program Files\uTorrentControl_v2\prxtbuTor.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O3 - Toolbar: ZoneAlarm Security Toolbar - {438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59} - C:\Program Files\Check Point Software Technologies LTD\zonealarm\1.5.20.3\zonealarmTlbr.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: uTorrentControl_v2 Toolbar - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - C:\Program Files\uTorrentControl_v2\prxtbuTor.dll
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe /icon="hidden"
O4 - HKLM\..\Run: [ZoneAlarm] C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] c:\program files\adobe\acrobat 9.0\acrobat\acrotray.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] khalmnpr.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] khalmnpr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe /installquiet
O4 - HKLM\..\Run: [IObit Malware Fighter] "C:\Program Files\IObit\IObit Malware Fighter\IMF.exe" /autostart
O4 - HKCU\..\Run: [instanteyedropper] "C:\Program Files\InstantEyedropper\InstantEyedropper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Spotify Web Helper] "C:\Documents and Settings\Cragdo\Application Data\Spotify\Data\SpotifyWebHelper.exe"
O4 - HKCU\..\Run: [AdobeBridge] "C:\Program Files\Adobe\Adobe Bridge CS4\Bridge.exe" -stealth
O4 - HKCU\..\Run: [Advanced SystemCare 6] "C:\Program Files\IObit\Advanced SystemCare 6\ASCTray.exe" /AutoStart
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: Dropbox.lnk = C:\Documents and Settings\Cragdo\Application Data\Dropbox\bin\Dropbox.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Dropbox.lnk = C:\Documents and Settings\Cragdo\Application Data\Dropbox\bin\Dropbox.exe (User 'Default user')
O4 - Startup: Dropbox.lnk = C:\Documents and Settings\Cragdo\Application Data\Dropbox\bin\Dropbox.exe
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O9 - Extra button: Sky - {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.sky.com (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1335028509734
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs:
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
O23 - Service: Advanced SystemCare Service 6 (AdvancedSystemCareService6) - IObit - C:\Program Files\IObit\Advanced SystemCare 6\ASCService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: IMF Service (IMFservice) - IObit - C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe
O23 - Service: ZoneAlarm LTD Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: Internet Pass-Through Service (PassThru Service) - Unknown owner - C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe
O23 - Service: UMVPFSrv - Logitech Inc. - C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe

–
End of file - 12643 bytes

.
DDS (Ver_11-03-05.01) - NTFSx86
Run by [removed] at 0:04:23.29 on 15/12/2012
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.9.2
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3583.2147 [GMT 0:00]
.
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Free Firewall *Enabled*
.
============== Running Processes ===============
.
C:\Program Files\IObit\Advanced SystemCare 6\ASCService.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
svchost.exe
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe
C:\program files\adobe\acrobat 9.0\acrobat\acrotray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\InstantEyedropper\InstantEyedropper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Cragdo\Application Data\Spotify\Data\SpotifyWebHelper.exe
C:\Program Files\Adobe\Adobe Bridge CS4\Bridge.exe
C:\Program Files\IObit\Advanced SystemCare 6\ASCTray.exe
C:\Documents and Settings\Cragdo\Application Data\Dropbox\bin\Dropbox.exe
C:\Program Files\IObit\Advanced SystemCare 6\ASC.exe
C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe
C:\Program Files\IObit\IObit Malware Fighter\IMF.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Documents and Settings\Cragdo\Desktop\OTL.exe
C:\WINDOWS\notepad.exe
C:\WINDOWS\notepad.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\Cragdo\Desktop\dds.scr
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.searchnu.com/406
uWindow Title = Internet Explorer Provided By Sky Broadband
uDefault_Page_URL = hxxp://www.sky.com
uURLSearchHooks: uTorrentControl_v2 Toolbar: {7473b6bd-4691-4744-a82b-7854eb3d70b6} - c:\program files\utorrentcontrol_v2\prxtbuTor.dll
BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - c:\program files\adobe\/Adobe Contribute CS4/contributeieplugin.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Zonealarm Helper Object: {2a841f7a-a014-4da5-b6d9-8b913dfb7a8c} - c:\program files\check point software technologies ltd\zonealarm\1.5.20.3\bh\zonealarm.dll
BHO: uTorrentControl_v2 Toolbar: {7473b6bd-4691-4744-a82b-7854eb3d70b6} - c:\program files\utorrentcontrol_v2\prxtbuTor.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre7\bin\ssv.dll
BHO: ZoneAlarm Security Engine Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre7\bin\jp2ssv.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: ZoneAlarm Security Engine: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
TB: ZoneAlarm Security Toolbar: {438fae3e-bdef-44d3-ab8b-0c7c8350df59} - c:\program files\check point software technologies ltd\zonealarm\1.5.20.3\zonealarmTlbr.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
TB: uTorrentControl_v2 Toolbar: {7473b6bd-4691-4744-a82b-7854eb3d70b6} - c:\program files\utorrentcontrol_v2\prxtbuTor.dll
uRun: [instanteyedropper] "c:\program files\instanteyedropper\InstantEyedropper.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Spotify Web Helper] "c:\documents and settings\cragdo\application data\spotify\data\SpotifyWebHelper.exe"
uRun: [AdobeBridge] "c:\program files\adobe\adobe bridge cs4\Bridge.exe" -stealth
uRun: [Advanced SystemCare 6] "c:\program files\iobit\advanced systemcare 6\ASCTray.exe" /AutoStart
mRun: [HDAudDeck] c:\program files\via\viaudioi\hdadeck\HDeck.exe 1
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
mRun: [ISW] c:\program files\checkpoint\zaforcefield\ForceField.exe /icon="hidden"
mRun: [ZoneAlarm] c:\program files\checkpoint\zonealarm\zatray.exe
mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
mRun: [Adobe_ID0ENQBO] c:\progra~1\common~1\adobe\adobev~1\server\bin\VERSIO~2.EXE
mRun: [Acrobat Assistant 8.0] c:\program files\adobe\acrobat 9.0\acrobat\acrotray.exe
mRun: [Kernel and Hardware Abstraction Layer] khalmnpr.exe
mRun: [Logitech Hardware Abstraction Layer] khalmnpr.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [IObit Malware Fighter] "c:\program files\iobit\iobit malware fighter\IMF.exe" /autostart
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\cragdo\startm~1\programs\startup\dropbox.lnk - c:\documents and settings\cragdo\application data\dropbox\bin\Dropbox.exe
IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
IE: {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.sky.com
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1335028509734
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll
Notify: LBTWlgn - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\docume~1\cragdo\applic~1\mozilla\firefox\profiles\f6ev4s0d.default\
FF - prefs.js: browser.search.selectedEngine - Search Results
FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&gct;=ds&appid;=394&systemid;=406&apn;_dtid=BND406&apn;_ptnrs=AG6&apn;_uid=0309348843184532&o;=APN10645&q;=
FF - prefs.js: browser.startup.homepage - hxxp://www.searchnu.com/406
FF - plugin: c:\program files\adobe\acrobat 9.0\acrobat\air\nppdf32.dll
FF - plugin: c:\program files\checkpoint\zaforcefield\trustchecker\bin\npFFApi.dll
FF - plugin: c:\program files\google\update\1.3.21.115\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npdeployJava1.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.10411.0\npctrlui.dll
.
—- FIREFOX POLICIES —-
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: browser.xul.error_pages.enabled - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.maxtextrun - 8191
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 750000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 750000
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 0
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
.
============= SERVICES / DRIVERS ===============
.
R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [2012-5-15 14776]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2012-4-19 738504]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2012-4-19 361032]
R1 Vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2012-3-19 525840]
R2 AdvancedSystemCareService6;Advanced SystemCare Service 6;c:\program files\iobit\advanced systemcare 6\ASCService.exe [2012-10-24 1026432]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2012-4-19 21256]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2012-4-19 44808]
R2 IMFservice;IMF Service;c:\program files\iobit\iobit malware fighter\IMFsrv.exe [2012-12-14 821592]
R2 ISWKL;ZoneAlarm LTD Toolbar ISWKL;c:\program files\checkpoint\zaforcefield\ISWKL.sys [2012-3-16 27016]
R2 IswSvc;ZoneAlarm LTD Toolbar IswSvc;c:\program files\checkpoint\zaforcefield\ISWSVC.exe [2012-3-16 497280]
R2 MsDepSvc;Web Deployment Agent Service;c:\program files\iis\microsoft web deploy\MsDepSvc.exe [2012-3-29 75592]
R2 PassThru Service;Internet Pass-Through Service;c:\program files\htc\internet pass-through\PassThruSvr.exe [2012-3-23 87040]
R2 vsmon;TrueVector Internet Monitor;c:\program files\checkpoint\zonealarm\vsmon.exe -service –> c:\program files\checkpoint\zonealarm\vsmon.exe -service [?]
R3 FileMonitor;FileMonitor;c:\program files\iobit\iobit malware fighter\drivers\wxp_x86\FileMonitor.sys [2012-12-14 246816]
R3 RegFilter;RegFilter;c:\program files\iobit\iobit malware fighter\drivers\wxp_x86\RegFilter.sys [2012-12-14 30408]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8192su.sys [2010-7-8 599936]
R3 UrlFilter;UrlFilter;c:\program files\iobit\iobit malware fighter\drivers\wxp_x86\UrlFilter.sys [2012-12-14 16248]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2012-4-19 845184]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2012-4-19 136176]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia update core\daemonu.exe [2012-4-19 1258856]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\common files\adobe\adobe version cue cs4\server\bin\VersionCueCS4.exe [2008-8-15 284016]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2012-4-19 136176]
S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\ANDROIDUSB.sys [2012-4-19 24576]
S3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\drivers\htcnprot.sys [2010-6-22 21248]
S3 UMVPFSrv;UMVPFSrv;c:\program files\common files\logishrd\lvmvfm\UMVPFSrv.exe [2012-1-18 450848]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2008-4-14 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2010-4-3 44896]
S4 RsFx0151;RsFx0151 Driver;c:\windows\system32\drivers\RsFx0151.sys [2011-6-17 240736]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\microsoft sql server\mssql10_50.sqlexpress\mssql\binn\SQLAGENT.EXE [2011-6-17 370016]
.
=============== Created Last 30 ================
.
2012-12-14 23:01:19 388096 —-a-r- c:\docume~1\cragdo\applic~1\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2012-12-14 03:23:22 ——– d—–w- c:\program files\Dropbox
.
==================== Find3M ====================
.
2012-11-13 01:25:12 1866368 —-a-w- c:\windows\system32\win32k.sys
2012-11-10 06:57:20 558133 —-a-w- c:\windows\system32\sqlite3.dll
2012-11-06 00:41:17 290560 —-a-w- c:\windows\system32\atmfd.dll
2012-11-02 02:02:42 375296 —-a-w- c:\windows\system32\dpnet.dll
2012-11-01 12:17:54 916992 —-a-w- c:\windows\system32\wininet.dll
2012-11-01 12:17:54 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-11-01 12:17:54 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-11-01 00:35:34 385024 —-a-w- c:\windows\system32\html.iec
2012-10-30 22:51:07 41224 —-a-w- c:\windows\avastSS.scr
2012-10-27 07:05:46 1102000 —-a-w- c:\windows\system32\nvdrsdb1.bin
2012-10-27 07:05:46 1 —-a-w- c:\windows\system32\nvdrssel.bin
2012-10-27 07:05:44 1102000 —-a-w- c:\windows\system32\nvdrsdb0.bin
2012-10-27 07:01:02 93672 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-10-27 07:00:57 143872 —-a-w- c:\windows\system32\javacpl.cpl
2012-10-27 07:00:55 821736 —-a-w- c:\windows\system32\npDeployJava1.dll
2012-10-27 07:00:55 746984 —-a-w- c:\windows\system32\deployJava1.dll
2012-10-12 18:09:40 22400 —-a-w- c:\windows\system32\RegistryDefragBootTime.exe
2012-10-02 18:04:21 58368 —-a-w- c:\windows\system32\synceng.dll
2012-09-23 14:28:00 888168 —-a-w- c:\windows\system32\nvdispgenco32.dll
2012-09-23 14:28:00 7446528 —-a-w- c:\windows\system32\nvcuda.dll
2012-09-23 14:28:00 5947392 —-a-w- c:\windows\system32\nvopencl.dll
2012-09-23 14:28:00 4494208 —-a-w- c:\windows\system32\nv4_disp.dll
2012-09-23 14:28:00 2578792 —-a-w- c:\windows\system32\nvcuvid.dll
2012-09-23 14:28:00 2376704 —-a-w- c:\windows\system32\nvapi.dll
2012-09-23 14:28:00 19103744 —-a-w- c:\windows\system32\nvoglnt.dll
2012-09-23 14:28:00 1866088 —-a-w- c:\windows\system32\nvcuvenc.dll
2012-09-23 14:28:00 17551360 —-a-w- c:\windows\system32\nvcompiler.dll
2012-09-23 14:28:00 1009512 —-a-w- c:\windows\system32\nvdispco32.dll
2012-09-23 13:04:24 54272 —-a-w- c:\windows\system32\nvwddi.dll
2012-09-23 13:04:12 15512424 —-a-w- c:\windows\system32\nvcpl.dll
2012-09-23 13:04:11 164200 —-a-w- c:\windows\system32\nvsvc32.exe
2012-09-23 13:04:11 143720 —-a-w- c:\windows\system32\nvcolor.exe
2012-09-23 13:04:11 108392 —-a-w- c:\windows\system32\nvmctray.dll
2012-04-19 17:10:35 3993600 —-a-w- c:\program files\GUT42.tmp
.
============= FINISH: 0:04:44.73 ===============

Hi Robybel, Managed to get this done earlier than thought. Thanks aswMBR version 0.9.9.1707 Copyright© 2011 AVAST Software Run date: 2012-12-17 18:53:53 —————————– 18:53:53.671 OS Version: Windows 5.1.2600 Service Pack 3 18:53:53.671 Number of processors: 2 586 0x170A 18:53:53.671 ComputerName: CRAZY-BOAB UserName: Cragdo 18:53:54.921 Initialize success 18:53:55.484 AVAST engine defs: 12121701 18:54:47.515 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-5 18:54:47.515 Disk 0 Vendor: Hitachi_HDT721010SLA360 ST6OA3AA Size: 953869MB BusType: 3 18:54:47.531 Disk 0 MBR read successfully 18:54:47.531 Disk 0 MBR scan 18:54:47.531 Disk 0 Windows XP default MBR code 18:54:47.531 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 953859 MB offset 63 18:54:47.531 Disk 0 scanning sectors +1953504000 18:54:47.578 Disk 0 scanning C:\WINDOWS\system32\drivers 18:54:51.484 Service scanning 18:55:02.359 Modules scanning 18:55:10.812 Disk 0 trace - called modules: 18:55:10.828 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 18:55:10.843 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a861ab8] 18:55:10.843 3 CLASSPNP.SYS[b80e8fd7] -> nt!IofCallDriver -> \Device\00000069[0x8a8b6540] 18:55:10.843 5 ACPI.sys[b7f7f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-5[0x8a89cb40] 18:55:11.921 AVAST engine scan C:\WINDOWS 18:55:15.421 AVAST engine scan C:\WINDOWS\system32 18:57:24.500 AVAST engine scan C:\WINDOWS\system32\drivers 18:57:45.375 AVAST engine scan C:\Documents and Settings\Cragdo 19:32:55.421 AVAST engine scan C:\Documents and Settings\All Users 19:35:10.234 Scan finished successfully 19:39:27.234 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Cragdo\Desktop\MBR.dat" 19:39:27.234 The log file has been saved successfully to "C:\Documents and Settings\Cragdo\Desktop\aswMBR.txt" # AdwCleaner v2.101 - Logfile created 12/17/2012 at 19:42:10 # Updated 16/12/2012 by Xplode # Operating system : Microsoft Windows XP Service Pack 3 (32 bits) # User : Cragdo - CRAZY-BOAB # Boot Mode : Normal # Running from : C:\Documents and Settings\Cragdo\Desktop\AdwCleaner.exe # Option [Delete] ***** [Services] ***** ***** [Files / Folders] ***** File Deleted : C:\Documents and Settings\Cragdo\Application Data\Mozilla\Firefox\Profiles\f6ev4s0d.default\searchplugins\Search_Results.xml File Deleted : C:\Program Files\Mozilla FireFox\searchplugins\Search_Results.xml File Deleted : C:\user.js Folder Deleted : C:\DOCUME~1\Cragdo\LOCALS~1\Temp\CT3220468 Folder Deleted : C:\Documents and Settings\All Users\Application Data\boost_interprocess Folder Deleted : C:\Documents and Settings\All Users\Application Data\Tarma Installer Folder Deleted : C:\Documents and Settings\Cragdo\Application Data\Funmoods Folder Deleted : C:\Documents and Settings\Cragdo\Application Data\Mozilla\Firefox\Profiles\f6ev4s0d.default\extensions\{7473b6bd-4691-4744-a82b-7854eb3d70b6} Folder Deleted : C:\Documents and Settings\Cragdo\Local Settings\Application Data\Conduit Folder Deleted : C:\Documents and Settings\Cragdo\Local Settings\Application Data\uTorrentControl_v2 Folder Deleted : C:\Program Files\Conduit Folder Deleted : C:\Program Files\uTorrentControl_v2 ***** [Registry] ***** Key Deleted : HKCU\Software\AppDataLow\Software\Conduit Key Deleted : HKCU\Software\Conduit Key Deleted : HKCU\Software\DataMngr Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Key Deleted : HKCU\Software\SmartBar Key Deleted : HKCU\Software\Softonic Key Deleted : HKCU\Software\SweetIM Key Deleted : HKCU\Software\uTorrentControl_v2 Key Deleted : HKCU\Toolbar Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C} Key Deleted : HKLM\SOFTWARE\Classes\AppID\BrowserConnection.dll Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{537F4F0B-3542-4C7D-A3E5-CF121482696C} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7473B6BD-4691-4744-A82B-7854EB3D70B6} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FFB96CC1-7EB3-449D-B827-DB661701C6BB} Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3220468 Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{48C9C8B0-A546-46C1-A81F-47A31E623E9D} Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\Software\Iminent Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5BD57720-0BED-4EB4-91AD-33A6E3DF50A1} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82E40E57-48E7-4AB4-92A8-C23697180EAC} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7473B6BD-4691-4744-A82B-7854EB3D70B6} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{537F4F0B-3542-4C7D-A3E5-CF121482696C} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrentControl_v2 Toolbar Key Deleted : HKLM\Software\SweetIM Key Deleted : HKLM\Software\Tarma Installer Key Deleted : HKLM\Software\uTorrentControl_v2 Value Deleted : HKCU\Software\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{7473B6BD-4691-4744-A82B-7854EB3D70B6}] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{7473B6BD-4691-4744-A82B-7854EB3D70B6}] ***** [Internet Browsers] ***** -\\ Internet Explorer v8.0.6001.18702 Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.searchnu.com/406 –> hxxp://www.google.com -\\ Mozilla Firefox v11.0 (en-US) Profile name : default File : C:\Documents and Settings\Cragdo\Application Data\Mozilla\Firefox\Profiles\f6ev4s0d.default\prefs.js C:\Documents and Settings\Cragdo\Application Data\Mozilla\Firefox\Profiles\f6ev4s0d.default\user.js … Deleted ! Deleted : user_pref("CT3220468.autoDisableScopes", -1); Deleted : user_pref("browser.search.defaultenginename", "Search Results"); Deleted : user_pref("browser.search.order.1", "Search Results"); Deleted : user_pref("browser.search.selectedEngine", "Search Results"); Deleted : user_pref("browser.startup.homepage", "hxxp://www.searchnu.com/406"); Deleted : user_pref("keyword.URL", "hxxp://dts.search-results.com/sr?src=ffb&gct=ds&appid=394&systemid=406&apn[…] -\\ Google Chrome v23.0.1271.97 File : C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences Deleted [l.18] : urls_to_restore_on_startup = [ "hxxp://www.google.co.uk/", "hxxp://www.searchnu.com/406" ] Deleted [l.3732] : urls_to_restore_on_startup = [ "hxxp://www.google.co.uk/", "hxxp://www.searchnu.com/406" ] ************************* AdwCleaner[S1].txt - [6554 octets] - [17/12/2012 19:42:10] ########## EOF - C:\AdwCleaner[S1].txt - [6614 octets] ##########

Hi Robybel,

Thank you once again for your quick reply. Combofix log below:

ComboFix 12-12-17.02 - Cragdo 18/12/2012 19:21:37.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3583.2902 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Free Firewall *Enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\EventSystem.log
c:\windows\system32\_000006_.tmp.dll
c:\windows\system32\_000007_.tmp.dll
c:\windows\system32\Cache
c:\windows\system32\SET3A2.tmp
c:\windows\system32\SET3B2.tmp
c:\windows\system32\SET3B3.tmp
c:\windows\system32\SET49E.tmp
c:\windows\system32\SET779.tmp
c:\windows\system32\SET77A.tmp
c:\windows\system32\SET77B.tmp
c:\windows\system32\SET8C.tmp
c:\windows\system32\SETA7.tmp
c:\windows\system32\SETA9.tmp
c:\windows\system32\SETB7.tmp
c:\windows\system32\sqlite3.dll
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\regtlib.exe
c:\windows\WindowsUpdate.log
.
.
((((((((((((((((((((((((( Files Created from 2012-11-18 to 2012-12-18 )))))))))))))))))))))))))))))))
.
.
2012-12-14 23:01 . 2012-12-14 23:01 388096 —-a-r- c:\documents and settings\Cragdo\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-12-14 22:57 . 2012-12-14 22:57 ——– d—–w- c:\program files\7-Zip
2012-12-14 03:23 . 2012-12-14 03:23 ——– d—–w- c:\program files\Dropbox
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-11-13 01:25 . 2008-04-14 12:00 1866368 —-a-w- c:\windows\system32\win32k.sys
2012-11-06 00:41 . 2008-04-14 12:00 290560 —-a-w- c:\windows\system32\atmfd.dll
2012-11-02 02:02 . 2008-04-14 12:00 375296 —-a-w- c:\windows\system32\dpnet.dll
2012-11-01 12:17 . 2008-04-14 12:00 916992 —-a-w- c:\windows\system32\wininet.dll
2012-11-01 12:17 . 2008-04-14 12:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-11-01 12:17 . 2008-04-14 12:00 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-11-01 00:35 . 2008-04-14 12:00 385024 —-a-w- c:\windows\system32\html.iec
2012-10-30 22:51 . 2012-04-19 17:02 361032 —-a-w- c:\windows\system32\drivers\aswSP.sys
2012-10-30 22:51 . 2012-04-19 17:02 35928 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2012-10-30 22:51 . 2012-04-19 17:02 738504 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2012-10-30 22:51 . 2012-04-19 17:02 54232 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2012-10-30 22:51 . 2012-04-19 17:02 97608 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2012-10-30 22:51 . 2012-04-19 17:02 89752 —-a-w- c:\windows\system32\drivers\aswmon.sys
2012-10-30 22:51 . 2012-04-19 17:02 21256 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-10-30 22:51 . 2012-04-19 17:02 25256 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2012-10-30 22:51 . 2012-04-19 17:02 41224 —-a-w- c:\windows\avastSS.scr
2012-10-30 22:50 . 2012-04-19 17:02 227648 —-a-w- c:\windows\system32\aswBoot.exe
2012-10-27 07:01 . 2012-10-27 07:01 93672 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-10-27 07:00 . 2012-04-21 17:04 143872 —-a-w- c:\windows\system32\javacpl.cpl
2012-10-27 07:00 . 2012-10-27 07:01 821736 —-a-w- c:\windows\system32\npDeployJava1.dll
2012-10-27 07:00 . 2012-04-21 17:04 746984 —-a-w- c:\windows\system32\deployJava1.dll
2012-10-12 18:09 . 2012-04-19 19:14 22400 —-a-w- c:\windows\system32\RegistryDefragBootTime.exe
2012-10-02 18:04 . 2008-04-14 12:00 58368 —-a-w- c:\windows\system32\synceng.dll
2012-09-29 19:54 . 2012-04-21 20:50 22856 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-09-23 14:28 . 2012-10-27 07:05 888168 —-a-w- c:\windows\system32\nvdispgenco32.dll
2012-09-23 14:28 . 2012-10-27 07:05 5947392 —-a-w- c:\windows\system32\nvopencl.dll
2012-09-23 14:28 . 2012-04-19 18:07 2578792 —-a-w- c:\windows\system32\nvcuvid.dll
2012-09-23 14:28 . 2012-04-19 18:07 1866088 —-a-w- c:\windows\system32\nvcuvenc.dll
2012-09-23 14:28 . 2012-04-19 18:07 1009512 —-a-w- c:\windows\system32\nvdispco32.dll
2012-09-23 14:28 . 2012-04-19 18:07 17551360 —-a-w- c:\windows\system32\nvcompiler.dll
2012-09-23 14:28 . 2009-01-14 10:49 7446528 —-a-w- c:\windows\system32\nvcuda.dll
2012-09-23 14:28 . 2009-01-14 10:49 4494208 —-a-w- c:\windows\system32\nv4_disp.dll
2012-09-23 14:28 . 2009-01-14 10:49 2376704 —-a-w- c:\windows\system32\nvapi.dll
2012-09-23 14:28 . 2009-01-14 10:49 19103744 —-a-w- c:\windows\system32\nvoglnt.dll
2012-09-23 14:28 . 2009-01-14 10:49 12557728 —-a-w- c:\windows\system32\drivers\nv4_mini.sys
2012-09-23 13:04 . 2009-01-14 10:49 54272 —-a-w- c:\windows\system32\nvwddi.dll
2012-09-23 13:04 . 2009-01-14 10:49 15512424 —-a-w- c:\windows\system32\nvcpl.dll
2012-09-23 13:04 . 2009-01-14 10:49 164200 —-a-w- c:\windows\system32\nvsvc32.exe
2012-09-23 13:04 . 2009-01-14 10:49 143720 —-a-w- c:\windows\system32\nvcolor.exe
2012-09-23 13:04 . 2009-01-14 10:49 108392 —-a-w- c:\windows\system32\nvmctray.dll
2012-04-19 17:10 . 2012-04-19 17:04 3993600 —-a-w- c:\program files\GUT42.tmp
2012-03-13 04:39 . 2012-04-20 14:57 97208 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50 121528 —-a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\Cragdo\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\Cragdo\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\Cragdo\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\Cragdo\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"instanteyedropper"="c:\program files\InstantEyedropper\InstantEyedropper.exe" [2007-10-17 352256]
"Spotify Web Helper"="c:\documents and settings\Cragdo\Application Data\Spotify\Data\SpotifyWebHelper.exe" [2012-10-26 1199576]
"AdobeBridge"="c:\program files\Adobe\Adobe Bridge CS4\Bridge.exe" [2008-08-28 13145448]
"Advanced SystemCare 6"="c:\program files\IObit\Advanced SystemCare 6\ASCTray.exe" [2012-09-24 490880]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2008-08-15 30003200]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2012-03-16 738944]
"ZoneAlarm"="c:\program files\CheckPoint\ZoneAlarm\zatray.exe" [2012-03-19 73360]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"Acrobat Assistant 8.0"="c:\program files\adobe\acrobat 9.0\acrobat\acrotray.exe" [2012-07-30 640480]
"Kernel and Hardware Abstraction Layer"="khalmnpr.exe" [2008-02-29 76304]
"Logitech Hardware Abstraction Layer"="khalmnpr.exe" [2008-02-29 76304]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2012-09-23 15512424]
"NvMediaCenter"="NvMCTray.dll" [2012-09-23 108392]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2012-09-23 1634112]
"IObit Malware Fighter"="c:\program files\IObit\IObit Malware Fighter\IMF.exe" [2012-09-28 4473728]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Cragdo\Start Menu\Programs\Startup\
Dropbox.lnk - c:\documents and settings\Cragdo\Application Data\Dropbox\bin\Dropbox.exe [2012-12-11 29425864]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 01:42 72208 —-a-w- c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-07-11 11:00 919008 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HTC Sync Loader]
2012-04-17 14:05 651264 —-a-w- c:\program files\HTC\HTC Sync 3.0\htcUPCTLoader.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LWS]
2011-11-11 13:08 205336 —-a-w- c:\program files\Logitech\LWS\Webcam Software\LWS.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Documents and Settings\\Cragdo\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS4\\Server\\bin\\VersionCueCS4.exe"=
"c:\\Documents and Settings\\Cragdo\\Application Data\\Spotify\\spotify.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\Logitech\\Vid HD\\Vid.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Update Core\\daemonu.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"3703:TCP"= 3703:TCP:Adobe Version Cue CS4 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS4 Server
"51000:TCP"= 51000:TCP:Adobe Version Cue CS4 Server
"51001:TCP"= 51001:TCP:Adobe Version Cue CS4 Server
.
R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [15/05/2012 19:02 14776]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [19/04/2012 17:02 738504]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [19/04/2012 17:02 361032]
R2 AdvancedSystemCareService6;Advanced SystemCare Service 6;c:\program files\IObit\Advanced SystemCare 6\ASCService.exe [24/10/2012 11:13 1026432]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [19/04/2012 17:02 21256]
R2 IMFservice;IMF Service;c:\program files\IObit\IObit Malware Fighter\IMFsrv.exe [14/12/2012 22:28 821592]
R2 ISWKL;ZoneAlarm LTD Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [16/03/2012 16:06 27016]
R2 IswSvc;ZoneAlarm LTD Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [16/03/2012 16:07 497280]
R2 MsDepSvc;Web Deployment Agent Service;c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe [29/03/2012 06:34 75592]
R2 PassThru Service;Internet Pass-Through Service;c:\program files\HTC\Internet Pass-Through\PassThruSvr.exe [23/03/2012 13:25 87040]
R3 FileMonitor;FileMonitor;c:\program files\IObit\IObit Malware Fighter\Drivers\wxp_x86\FileMonitor.sys [14/12/2012 22:28 246816]
R3 RegFilter;RegFilter;c:\program files\IObit\IObit Malware Fighter\Drivers\wxp_x86\RegFilter.sys [14/12/2012 22:28 30408]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8192su.sys [08/07/2010 14:09 599936]
R3 UrlFilter;UrlFilter;c:\program files\IObit\IObit Malware Fighter\Drivers\wxp_x86\UrlFilter.sys [14/12/2012 22:28 16248]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [19/04/2012 16:20 845184]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [15/08/2008 04:46 284016]
S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\ANDROIDUSB.sys [19/04/2012 19:03 24576]
S3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\drivers\htcnprot.sys [22/06/2010 17:01 21248]
S3 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [18/01/2012 05:44 450848]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [03/04/2010 18:56 44896]
S4 RsFx0151;RsFx0151 Driver;c:\windows\system32\drivers\RsFx0151.sys [17/06/2011 20:28 240736]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10_50.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [17/06/2011 21:19 370016]
.
Contents of the 'Scheduled Tasks' folder
.
2012-12-18 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2012-07-10 22:50]
.
2012-12-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-19 17:02]
.
2012-12-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-19 17:02]
.
2012-12-18 c:\windows\Tasks\SmartDefrag_Startup.job
- c:\program files\IObit\Smart Defrag 2\SmartDefrag.exe [2012-04-24 15:19]
.
2012-12-18 c:\windows\Tasks\User_Feed_Synchronization-{568ADC25-2016-40C7-A1A2-A5CEE082BB39}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 03:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk/
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
TCP: DhcpNameServer = 192.168.0.1
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\documents and settings\Cragdo\Application Data\Mozilla\Firefox\Profiles\f6ev4s0d.default\
FF - ExtSQL: 2012-11-10 06:54; {7473b6bd-4691-4744-a82b-7854eb3d70b6}; c:\documents and settings\Cragdo\Application Data\Mozilla\Firefox\Profiles\f6ev4s0d.default\extensions\{7473b6bd-4691-4744-a82b-7854eb3d70b6}
FF - ExtSQL: 2012-11-10 19:57; [removed]; c:\documents and settings\Cragdo\Application Data\Mozilla\Firefox\Profiles\f6ev4s0d.default\extensions\[removed]
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-10 - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-12-18 19:26
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MsDepSvc]
"ImagePath"="\"c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe\" -runService:MsDepSvc"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(652)
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
c:\program files\common files\logitech\bluetooth\LBTServ.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
- - - - - - - > 'lsass.exe'(708)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
Completion time: 2012-12-18 19:28:19
ComboFix-quarantined-files.txt 2012-12-18 19:28
.
Pre-Run: 836,665,864,192 bytes free
Post-Run: 837,282,226,176 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - D026541148ADFCFF4E53F0EACBFA1FFA

Hi Robybel,

Once again I salute you for your quick responses. it's most appreciated.

ComboFix 12-12-19.02 - Cragdo 19/12/2012 22:16:16.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3583.2735 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Free Firewall *Enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\OLD16E.tmp
.
.
((((((((((((((((((((((((( Files Created from 2012-11-19 to 2012-12-19 )))))))))))))))))))))))))))))))
.
.
2012-12-19 17:15 . 2012-12-19 17:15 ——– d—–w- c:\windows\LastGood
2012-12-19 17:15 . 2010-09-23 07:46 102416 —-a-w- c:\windows\system32\RTNUninst32.dll
2012-12-19 16:18 . 2012-12-19 16:18 ——– d—–w- c:\documents and settings\All Users\Application Data\nView_Profiles
2012-12-19 14:01 . 2007-07-27 17:30 8704 —-a-r- c:\windows\system32\viahdcpl.cpl
2012-12-19 14:01 . 2001-08-17 22:36 98304 -c–a-w- c:\windows\system32\dllcache\a3d.dll
2012-12-19 14:01 . 2001-08-17 22:36 98304 —-a-w- c:\windows\system32\a3d.dll
2012-12-19 14:00 . 2012-10-22 16:43 88696 —-a-r- c:\windows\system32\KaraokeSer.exe
2012-12-19 12:50 . 2012-12-19 12:50 73696 —-a-w- c:\program files\Mozilla Firefox\breakpadinjector.dll
2012-12-19 12:50 . 2012-12-19 12:50 421200 —-a-w- c:\program files\Mozilla Firefox\msvcp100.dll
2012-12-19 12:50 . 2012-12-19 12:50 770384 —-a-w- c:\program files\Mozilla Firefox\msvcr100.dll
2012-12-19 12:50 . 2012-12-19 12:50 96224 —-a-w- c:\program files\Mozilla Firefox\webapprt-stub.exe
2012-12-19 12:50 . 2012-12-19 12:50 157272 —-a-w- c:\program files\Mozilla Firefox\webapp-uninstaller.exe
2012-12-19 12:49 . 2012-12-19 14:57 ——– d—–w- c:\program files\Mozilla Maintenance Service
2012-12-19 12:48 . 2012-12-19 12:50 192728 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
2012-12-19 12:48 . 2012-12-19 12:50 115168 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
2012-12-19 08:52 . 2012-12-19 08:52 388096 —-a-r- c:\documents and settings\Cragdo\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-12-18 22:59 . 2012-12-18 22:59 ——– d—–w- c:\program files\Adobe Media Player
2012-12-14 22:57 . 2012-12-14 22:57 ——– d—–w- c:\program files\7-Zip
2012-12-14 03:23 . 2012-12-14 03:23 ——– d—–w- c:\program files\Dropbox
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-11-21 02:59 . 2012-04-19 16:22 373264 —-a-w- c:\windows\system32\drivers\Rtenicxp.sys
2012-11-13 01:25 . 2008-04-14 12:00 1866368 —-a-w- c:\windows\system32\win32k.sys
2012-11-06 00:41 . 2008-04-14 12:00 290560 —-a-w- c:\windows\system32\atmfd.dll
2012-11-02 02:02 . 2008-04-14 12:00 375296 —-a-w- c:\windows\system32\dpnet.dll
2012-11-01 12:17 . 2008-04-14 12:00 916992 —-a-w- c:\windows\system32\wininet.dll
2012-11-01 12:17 . 2008-04-14 12:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-11-01 12:17 . 2008-04-14 12:00 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-11-01 00:35 . 2008-04-14 12:00 385024 —-a-w- c:\windows\system32\html.iec
2012-10-30 22:51 . 2012-04-19 17:02 361032 —-a-w- c:\windows\system32\drivers\aswSP.sys
2012-10-30 22:51 . 2012-04-19 17:02 35928 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2012-10-30 22:51 . 2012-04-19 17:02 738504 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2012-10-30 22:51 . 2012-04-19 17:02 54232 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2012-10-30 22:51 . 2012-04-19 17:02 97608 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2012-10-30 22:51 . 2012-04-19 17:02 89752 —-a-w- c:\windows\system32\drivers\aswmon.sys
2012-10-30 22:51 . 2012-04-19 17:02 21256 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-10-30 22:51 . 2012-04-19 17:02 25256 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2012-10-30 22:51 . 2012-04-19 17:02 41224 —-a-w- c:\windows\avastSS.scr
2012-10-30 22:50 . 2012-04-19 17:02 227648 —-a-w- c:\windows\system32\aswBoot.exe
2012-10-27 07:01 . 2012-10-27 07:01 93672 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-10-27 07:00 . 2012-04-21 17:04 143872 —-a-w- c:\windows\system32\javacpl.cpl
2012-10-27 07:00 . 2012-10-27 07:01 821736 —-a-w- c:\windows\system32\npDeployJava1.dll
2012-10-27 07:00 . 2012-04-21 17:04 746984 —-a-w- c:\windows\system32\deployJava1.dll
2012-10-22 16:43 . 2012-04-19 16:20 2558200 —-a-r- c:\windows\system32\drivers\viahduaa.sys
2012-10-12 18:09 . 2012-04-19 19:14 22400 —-a-w- c:\windows\system32\RegistryDefragBootTime.exe
2012-10-02 18:04 . 2008-04-14 12:00 58368 —-a-w- c:\windows\system32\synceng.dll
2012-09-29 19:54 . 2012-04-21 20:50 22856 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-09-23 14:28 . 2012-10-27 07:05 888168 —-a-w- c:\windows\system32\nvdispgenco32.dll
2012-09-23 14:28 . 2012-10-27 07:05 5947392 —-a-w- c:\windows\system32\nvopencl.dll
2012-09-23 14:28 . 2012-04-19 18:07 2578792 —-a-w- c:\windows\system32\nvcuvid.dll
2012-09-23 14:28 . 2012-04-19 18:07 1866088 —-a-w- c:\windows\system32\nvcuvenc.dll
2012-09-23 14:28 . 2012-04-19 18:07 1009512 —-a-w- c:\windows\system32\nvdispco32.dll
2012-09-23 14:28 . 2012-04-19 18:07 17551360 —-a-w- c:\windows\system32\nvcompiler.dll
2012-09-23 14:28 . 2009-01-14 10:49 7446528 —-a-w- c:\windows\system32\nvcuda.dll
2012-09-23 14:28 . 2009-01-14 10:49 4494208 —-a-w- c:\windows\system32\nv4_disp.dll
2012-09-23 14:28 . 2009-01-14 10:49 2376704 —-a-w- c:\windows\system32\nvapi.dll
2012-09-23 14:28 . 2009-01-14 10:49 19103744 —-a-w- c:\windows\system32\nvoglnt.dll
2012-09-23 14:28 . 2009-01-14 10:49 12557728 —-a-w- c:\windows\system32\drivers\nv4_mini.sys
2012-09-23 13:04 . 2009-01-14 10:49 54272 —-a-w- c:\windows\system32\nvwddi.dll
2012-09-23 13:04 . 2009-01-14 10:49 15512424 —-a-w- c:\windows\system32\nvcpl.dll
2012-09-23 13:04 . 2009-01-14 10:49 164200 —-a-w- c:\windows\system32\nvsvc32.exe
2012-09-23 13:04 . 2009-01-14 10:49 143720 —-a-w- c:\windows\system32\nvcolor.exe
2012-09-23 13:04 . 2009-01-14 10:49 108392 —-a-w- c:\windows\system32\nvmctray.dll
2012-12-19 12:50 . 2012-04-20 14:57 262112 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50 121528 —-a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\Cragdo\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\Cragdo\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\Cragdo\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\Cragdo\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"instanteyedropper"="c:\program files\InstantEyedropper\InstantEyedropper.exe" [2007-10-17 352256]
"Spotify Web Helper"="c:\documents and settings\Cragdo\Application Data\Spotify\Data\SpotifyWebHelper.exe" [2012-10-26 1199576]
"AdobeBridge"="c:\program files\Adobe\Adobe Bridge CS4\Bridge.exe" [2008-08-28 13145448]
"Advanced SystemCare 6"="c:\program files\IObit\Advanced SystemCare 6\ASCTray.exe" [2012-09-24 490880]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2012-03-16 738944]
"ZoneAlarm"="c:\program files\CheckPoint\ZoneAlarm\zatray.exe" [2012-03-19 73360]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"Acrobat Assistant 8.0"="c:\program files\adobe\acrobat 9.0\acrobat\acrotray.exe" [2012-07-30 640480]
"Kernel and Hardware Abstraction Layer"="khalmnpr.exe" [2008-02-29 76304]
"Logitech Hardware Abstraction Layer"="khalmnpr.exe" [2008-02-29 76304]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2012-09-23 15512424]
"NvMediaCenter"="NvMCTray.dll" [2012-09-23 108392]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2012-09-23 1634112]
"IObit Malware Fighter"="c:\program files\IObit\IObit Malware Fighter\IMF.exe" [2012-09-28 4473728]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-09-23 926896]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2012-10-25 41134712]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Cragdo\Start Menu\Programs\Startup\
Dropbox.lnk - c:\documents and settings\Cragdo\Application Data\Dropbox\bin\Dropbox.exe [2012-12-11 29425864]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 01:42 72208 —-a-w- c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-09-23 20:43 926896 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HTC Sync Loader]
2012-04-17 14:05 651264 —-a-w- c:\program files\HTC\HTC Sync 3.0\htcUPCTLoader.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LWS]
2011-11-11 13:08 205336 —-a-w- c:\program files\Logitech\LWS\Webcam Software\LWS.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Documents and Settings\\Cragdo\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS4\\Server\\bin\\VersionCueCS4.exe"=
"c:\\Documents and Settings\\Cragdo\\Application Data\\Spotify\\spotify.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\Logitech\\Vid HD\\Vid.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Update Core\\daemonu.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"3703:TCP"= 3703:TCP:Adobe Version Cue CS4 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS4 Server
"51000:TCP"= 51000:TCP:Adobe Version Cue CS4 Server
"51001:TCP"= 51001:TCP:Adobe Version Cue CS4 Server
.
R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [15/05/2012 19:02 14776]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [19/04/2012 17:02 738504]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [19/04/2012 17:02 361032]
R2 AdvancedSystemCareService6;Advanced SystemCare Service 6;c:\program files\IObit\Advanced SystemCare 6\ASCService.exe [24/10/2012 11:13 1026432]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [19/04/2012 17:02 21256]
R2 IMFservice;IMF Service;c:\program files\IObit\IObit Malware Fighter\IMFsrv.exe [14/12/2012 22:28 821592]
R2 ISWKL;ZoneAlarm LTD Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [16/03/2012 16:06 27016]
R2 IswSvc;ZoneAlarm LTD Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [16/03/2012 16:07 497280]
R2 KaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\KaraokeSer.exe [19/12/2012 14:00 88696]
R2 MsDepSvc;Web Deployment Agent Service;c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe [29/03/2012 06:34 75592]
R2 PassThru Service;Internet Pass-Through Service;c:\program files\HTC\Internet Pass-Through\PassThruSvr.exe [23/03/2012 13:25 87040]
R3 FileMonitor;FileMonitor;c:\program files\IObit\IObit Malware Fighter\Drivers\wxp_x86\FileMonitor.sys [14/12/2012 22:28 246816]
R3 RegFilter;RegFilter;c:\program files\IObit\IObit Malware Fighter\Drivers\wxp_x86\RegFilter.sys [14/12/2012 22:28 30408]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8192su.sys [08/07/2010 14:09 599936]
R3 UrlFilter;UrlFilter;c:\program files\IObit\IObit Malware Fighter\Drivers\wxp_x86\UrlFilter.sys [14/12/2012 22:28 16248]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [19/04/2012 16:20 2558200]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [15/08/2008 04:46 284016]
S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\ANDROIDUSB.sys [19/04/2012 19:03 24576]
S3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\drivers\htcnprot.sys [22/06/2010 17:01 21248]
S3 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [18/01/2012 05:44 450848]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [03/04/2010 18:56 44896]
S4 RsFx0151;RsFx0151 Driver;c:\windows\system32\drivers\RsFx0151.sys [17/06/2011 20:28 240736]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10_50.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [17/06/2011 21:19 370016]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - KARAOKESERVICE
.
Contents of the 'Scheduled Tasks' folder
.
2012-12-19 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2012-07-10 22:50]
.
2012-12-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-19 17:02]
.
2012-12-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-19 17:02]
.
2012-12-19 c:\windows\Tasks\SmartDefrag_Startup.job
- c:\program files\IObit\Smart Defrag 2\SmartDefrag.exe [2012-04-24 15:19]
.
2012-12-19 c:\windows\Tasks\User_Feed_Synchronization-{568ADC25-2016-40C7-A1A2-A5CEE082BB39}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 03:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk/
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
TCP: DhcpNameServer = 192.168.0.1
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\documents and settings\Cragdo\Application Data\Mozilla\Firefox\Profiles\f6ev4s0d.default\
FF - ExtSQL: 2012-11-10 19:57; [removed]; c:\documents and settings\Cragdo\Application Data\Mozilla\Firefox\Profiles\f6ev4s0d.default\extensions\[removed]
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-12-19 23:00
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MsDepSvc]
"ImagePath"="\"c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe\" -runService:MsDepSvc"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(684)
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
c:\program files\common files\logitech\bluetooth\LBTServ.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
- - - - - - - > 'lsass.exe'(740)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
Completion time: 2012-12-19 23:02:08
ComboFix-quarantined-files.txt 2012-12-19 23:02
ComboFix2.txt 2012-12-18 22:32
ComboFix3.txt 2012-12-18 19:28
.
Pre-Run: 829,616,291,840 bytes free
Post-Run: 829,639,225,344 bytes free
.
- - End Of File - - 7A6ED5E8FF51B09C5141FD8660649C22


C:\Documents and Settings\Cragdo\My Documents\Downloads\Setup (1).exe probably a variant of Win32/Adware.iBryte.C application
C:\Documents and Settings\Cragdo\My Documents\Downloads\Setup.exe probably a variant of Win32/Adware.iBryte.C application
C:\System Volume Information\_restore{030D1565-CA97-41E2-AB57-141B13FC1772}\RP222\A0048415.dll a variant of Win32/Adware.Yontoo.A application
C:\System Volume Information\_restore{030D1565-CA97-41E2-AB57-141B13FC1772}\RP222\A0048418.dll a variant of Win32/Adware.Yontoo.B application
C:\System Volume Information\_restore{030D1565-CA97-41E2-AB57-141B13FC1772}\RP222\A0048469.exe Win32/Adware.1ClickDownload.K application

You're a star Robybel

ComboFix 12-12-20.02 - Cragdo 21/12/2012 22:09:31.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3583.2806 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Cragdo\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Free Firewall *Enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\EventSystem.log
.
.
((((((((((((((((((((((((( Files Created from 2012-11-21 to 2012-12-21 )))))))))))))))))))))))))))))))
.
.
2012-12-19 17:15 . 2010-09-23 07:46 102416 —-a-w- c:\windows\system32\RTNUninst32.dll
2012-12-19 16:18 . 2012-12-19 16:18 ——– d—–w- c:\documents and settings\All Users\Application Data\nView_Profiles
2012-12-19 14:01 . 2007-07-27 17:30 8704 —-a-r- c:\windows\system32\viahdcpl.cpl
2012-12-19 14:01 . 2001-08-17 22:36 98304 -c–a-w- c:\windows\system32\dllcache\a3d.dll
2012-12-19 14:01 . 2001-08-17 22:36 98304 —-a-w- c:\windows\system32\a3d.dll
2012-12-19 14:00 . 2012-10-22 16:43 88696 —-a-r- c:\windows\system32\KaraokeSer.exe
2012-12-19 12:50 . 2012-12-19 12:50 73696 —-a-w- c:\program files\Mozilla Firefox\breakpadinjector.dll
2012-12-19 12:50 . 2012-12-19 12:50 421200 —-a-w- c:\program files\Mozilla Firefox\msvcp100.dll
2012-12-19 12:50 . 2012-12-19 12:50 770384 —-a-w- c:\program files\Mozilla Firefox\msvcr100.dll
2012-12-19 12:50 . 2012-12-19 12:50 96224 —-a-w- c:\program files\Mozilla Firefox\webapprt-stub.exe
2012-12-19 12:50 . 2012-12-19 12:50 157272 —-a-w- c:\program files\Mozilla Firefox\webapp-uninstaller.exe
2012-12-19 12:49 . 2012-12-19 14:57 ——– d—–w- c:\program files\Mozilla Maintenance Service
2012-12-19 12:48 . 2012-12-19 12:50 192728 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
2012-12-19 12:48 . 2012-12-19 12:50 115168 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
2012-12-19 08:52 . 2012-12-19 08:52 388096 —-a-r- c:\documents and settings\Cragdo\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-12-18 22:59 . 2012-12-18 22:59 ——– d—–w- c:\program files\Adobe Media Player
2012-12-14 22:57 . 2012-12-14 22:57 ——– d—–w- c:\program files\7-Zip
2012-12-14 03:23 . 2012-12-14 03:23 ——– d—–w- c:\program files\Dropbox
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-16 12:23 . 2008-04-14 12:00 290560 —-a-w- c:\windows\system32\atmfd.dll
2012-11-21 02:59 . 2012-04-19 16:22 373264 —-a-w- c:\windows\system32\drivers\Rtenicxp.sys
2012-11-13 01:25 . 2008-04-14 12:00 1866368 —-a-w- c:\windows\system32\win32k.sys
2012-11-02 02:02 . 2008-04-14 12:00 375296 —-a-w- c:\windows\system32\dpnet.dll
2012-11-01 12:17 . 2008-04-14 12:00 916992 —-a-w- c:\windows\system32\wininet.dll
2012-11-01 12:17 . 2008-04-14 12:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-11-01 12:17 . 2008-04-14 12:00 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-11-01 00:35 . 2008-04-14 12:00 385024 —-a-w- c:\windows\system32\html.iec
2012-10-30 22:51 . 2012-04-19 17:02 361032 —-a-w- c:\windows\system32\drivers\aswSP.sys
2012-10-30 22:51 . 2012-04-19 17:02 35928 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2012-10-30 22:51 . 2012-04-19 17:02 738504 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2012-10-30 22:51 . 2012-04-19 17:02 54232 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2012-10-30 22:51 . 2012-04-19 17:02 97608 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2012-10-30 22:51 . 2012-04-19 17:02 89752 —-a-w- c:\windows\system32\drivers\aswmon.sys
2012-10-30 22:51 . 2012-04-19 17:02 21256 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-10-30 22:51 . 2012-04-19 17:02 25256 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2012-10-30 22:51 . 2012-04-19 17:02 41224 —-a-w- c:\windows\avastSS.scr
2012-10-30 22:50 . 2012-04-19 17:02 227648 —-a-w- c:\windows\system32\aswBoot.exe
2012-10-27 07:01 . 2012-10-27 07:01 93672 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-10-27 07:00 . 2012-04-21 17:04 143872 —-a-w- c:\windows\system32\javacpl.cpl
2012-10-27 07:00 . 2012-10-27 07:01 821736 —-a-w- c:\windows\system32\npDeployJava1.dll
2012-10-27 07:00 . 2012-04-21 17:04 746984 —-a-w- c:\windows\system32\deployJava1.dll
2012-10-22 16:43 . 2012-04-19 16:20 2558200 —-a-r- c:\windows\system32\drivers\viahduaa.sys
2012-10-12 18:09 . 2012-04-19 19:14 22400 —-a-w- c:\windows\system32\RegistryDefragBootTime.exe
2012-10-02 18:04 . 2008-04-14 12:00 58368 —-a-w- c:\windows\system32\synceng.dll
2012-09-29 19:54 . 2012-04-21 20:50 22856 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-09-23 14:28 . 2012-10-27 07:05 888168 —-a-w- c:\windows\system32\nvdispgenco32.dll
2012-09-23 14:28 . 2012-10-27 07:05 5947392 —-a-w- c:\windows\system32\nvopencl.dll
2012-09-23 14:28 . 2012-04-19 18:07 2578792 —-a-w- c:\windows\system32\nvcuvid.dll
2012-09-23 14:28 . 2012-04-19 18:07 1866088 —-a-w- c:\windows\system32\nvcuvenc.dll
2012-09-23 14:28 . 2012-04-19 18:07 1009512 —-a-w- c:\windows\system32\nvdispco32.dll
2012-09-23 14:28 . 2012-04-19 18:07 17551360 —-a-w- c:\windows\system32\nvcompiler.dll
2012-09-23 14:28 . 2009-01-14 10:49 7446528 —-a-w- c:\windows\system32\nvcuda.dll
2012-09-23 14:28 . 2009-01-14 10:49 4494208 —-a-w- c:\windows\system32\nv4_disp.dll
2012-09-23 14:28 . 2009-01-14 10:49 2376704 —-a-w- c:\windows\system32\nvapi.dll
2012-09-23 14:28 . 2009-01-14 10:49 19103744 —-a-w- c:\windows\system32\nvoglnt.dll
2012-09-23 14:28 . 2009-01-14 10:49 12557728 —-a-w- c:\windows\system32\drivers\nv4_mini.sys
2012-09-23 13:04 . 2009-01-14 10:49 54272 —-a-w- c:\windows\system32\nvwddi.dll
2012-09-23 13:04 . 2009-01-14 10:49 15512424 —-a-w- c:\windows\system32\nvcpl.dll
2012-09-23 13:04 . 2009-01-14 10:49 164200 —-a-w- c:\windows\system32\nvsvc32.exe
2012-09-23 13:04 . 2009-01-14 10:49 143720 —-a-w- c:\windows\system32\nvcolor.exe
2012-09-23 13:04 . 2009-01-14 10:49 108392 —-a-w- c:\windows\system32\nvmctray.dll
2012-12-19 12:50 . 2012-04-20 14:57 262112 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50 121528 —-a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\Cragdo\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\Cragdo\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\Cragdo\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 —-a-w- c:\documents and settings\Cragdo\Application Data\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"instanteyedropper"="c:\program files\InstantEyedropper\InstantEyedropper.exe" [2007-10-17 352256]
"Spotify Web Helper"="c:\documents and settings\Cragdo\Application Data\Spotify\Data\SpotifyWebHelper.exe" [2012-10-26 1199576]
"AdobeBridge"="c:\program files\Adobe\Adobe Bridge CS4\Bridge.exe" [2008-08-28 13145448]
"Advanced SystemCare 6"="c:\program files\IObit\Advanced SystemCare 6\ASCTray.exe" [2012-09-24 490880]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2012-03-16 738944]
"ZoneAlarm"="c:\program files\CheckPoint\ZoneAlarm\zatray.exe" [2012-03-19 73360]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"Acrobat Assistant 8.0"="c:\program files\adobe\acrobat 9.0\acrobat\acrotray.exe" [2012-07-30 640480]
"Kernel and Hardware Abstraction Layer"="khalmnpr.exe" [2008-02-29 76304]
"Logitech Hardware Abstraction Layer"="khalmnpr.exe" [2008-02-29 76304]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2012-09-23 15512424]
"NvMediaCenter"="NvMCTray.dll" [2012-09-23 108392]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2012-09-23 1634112]
"IObit Malware Fighter"="c:\program files\IObit\IObit Malware Fighter\IMF.exe" [2012-09-28 4473728]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-09-23 926896]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2012-10-25 41134712]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Cragdo\Start Menu\Programs\Startup\
Dropbox.lnk - c:\documents and settings\Cragdo\Application Data\Dropbox\bin\Dropbox.exe [2012-12-21 28539728]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 01:42 72208 —-a-w- c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-09-23 20:43 926896 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HTC Sync Loader]
2012-04-17 14:05 651264 —-a-w- c:\program files\HTC\HTC Sync 3.0\htcUPCTLoader.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LWS]
2011-11-11 13:08 205336 —-a-w- c:\program files\Logitech\LWS\Webcam Software\LWS.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Documents and Settings\\Cragdo\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS4\\Server\\bin\\VersionCueCS4.exe"=
"c:\\Documents and Settings\\Cragdo\\Application Data\\Spotify\\spotify.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\Logitech\\Vid HD\\Vid.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Update Core\\daemonu.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"3703:TCP"= 3703:TCP:Adobe Version Cue CS4 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS4 Server
"51000:TCP"= 51000:TCP:Adobe Version Cue CS4 Server
"51001:TCP"= 51001:TCP:Adobe Version Cue CS4 Server
.
R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [15/05/2012 19:02 14776]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [19/04/2012 17:02 738504]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [19/04/2012 17:02 361032]
R2 AdvancedSystemCareService6;Advanced SystemCare Service 6;c:\program files\IObit\Advanced SystemCare 6\ASCService.exe [24/10/2012 11:13 1026432]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [19/04/2012 17:02 21256]
R2 IMFservice;IMF Service;c:\program files\IObit\IObit Malware Fighter\IMFsrv.exe [14/12/2012 22:28 821592]
R2 ISWKL;ZoneAlarm LTD Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [16/03/2012 16:06 27016]
R2 IswSvc;ZoneAlarm LTD Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [16/03/2012 16:07 497280]
R2 KaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\KaraokeSer.exe [19/12/2012 14:00 88696]
R2 MsDepSvc;Web Deployment Agent Service;c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe [29/03/2012 06:34 75592]
R2 PassThru Service;Internet Pass-Through Service;c:\program files\HTC\Internet Pass-Through\PassThruSvr.exe [23/03/2012 13:25 87040]
R3 FileMonitor;FileMonitor;c:\program files\IObit\IObit Malware Fighter\Drivers\wxp_x86\FileMonitor.sys [14/12/2012 22:28 246816]
R3 RegFilter;RegFilter;c:\program files\IObit\IObit Malware Fighter\Drivers\wxp_x86\RegFilter.sys [14/12/2012 22:28 30408]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8192su.sys [08/07/2010 14:09 599936]
R3 UrlFilter;UrlFilter;c:\program files\IObit\IObit Malware Fighter\Drivers\wxp_x86\UrlFilter.sys [14/12/2012 22:28 16248]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [19/04/2012 16:20 2558200]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [15/08/2008 04:46 284016]
S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\ANDROIDUSB.sys [19/04/2012 19:03 24576]
S3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\drivers\htcnprot.sys [22/06/2010 17:01 21248]
S3 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [18/01/2012 05:44 450848]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [03/04/2010 18:56 44896]
S4 RsFx0151;RsFx0151 Driver;c:\windows\system32\drivers\RsFx0151.sys [17/06/2011 20:28 240736]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10_50.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [17/06/2011 21:19 370016]
.
Contents of the 'Scheduled Tasks' folder
.
2012-12-21 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2012-07-10 22:50]
.
2012-12-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-19 17:02]
.
2012-12-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-19 17:02]
.
2012-12-21 c:\windows\Tasks\SmartDefrag_Startup.job
- c:\program files\IObit\Smart Defrag 2\SmartDefrag.exe [2012-04-24 15:19]
.
2012-12-21 c:\windows\Tasks\User_Feed_Synchronization-{568ADC25-2016-40C7-A1A2-A5CEE082BB39}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 03:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk/
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
TCP: DhcpNameServer = 192.168.0.1
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\documents and settings\Cragdo\Application Data\Mozilla\Firefox\Profiles\f6ev4s0d.default\
FF - ExtSQL: 2012-11-10 19:57; [removed]; c:\documents and settings\Cragdo\Application Data\Mozilla\Firefox\Profiles\f6ev4s0d.default\extensions\[removed]
.
.
**************************************************************************
.
scan completed successfully
hidden files: 0
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-12-21 22:14
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MsDepSvc]
"ImagePath"="\"c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe\" -runService:MsDepSvc"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(660)
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
c:\program files\common files\logitech\bluetooth\LBTServ.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\windows\system32\ACTIVEDS.dll
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
- - - - - - - > 'lsass.exe'(716)
c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
.
Completion time: 2012-12-21 22:16:05
ComboFix-quarantined-files.txt 2012-12-21 22:16
ComboFix2.txt 2012-12-19 23:02
ComboFix3.txt 2012-12-18 22:32
ComboFix4.txt 2012-12-18 19:28
.
Pre-Run: 827,042,209,792 bytes free
Post-Run: 827,036,549,120 bytes free
.
- - End Of File - - 7B29B83AAC787F0F8C1BCAAC352751CC


OTL logfile created on: 21/12/2012 22:18:21 - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Cragdo\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.50 Gb Total Physical Memory | 2.76 Gb Available Physical Memory | 78.99% Memory free
5.34 Gb Paging File | 4.60 Gb Available in Paging File | 86.11% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 931.50 Gb Total Space | 770.26 Gb Free Space | 82.69% Space Free | Partition Type: NTFS
Drive D: | 6.15 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: CRAZY-BOAB | User Name: Cragdo | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Cragdo\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\WINDOWS\system32\KaraokeSer.exe (VIA Technologies, Inc.)
PRC - C:\Program Files\IObit\Advanced SystemCare 6\ASCService.exe (IObit)
PRC - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe (Adobe Systems Inc.)
PRC - C:\Program Files\IObit\Smart Defrag 2\SmartDefrag.exe (IObit)
PRC - C:\Program Files\IIS\Microsoft Web Deploy\MsDepSvc.exe (Microsoft Corporation)
PRC - C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe ()
PRC - C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe (Check Point Software Technologies)
PRC - C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
PRC - C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe (IObit)
PRC - C:\Program Files\Adobe\Adobe Bridge CS4\Bridge.exe (Adobe Systems, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\AVAST Software\Avast\defs\12122101\algo.dll ()
MOD - C:\Program Files\AVAST Software\Avast\defs\12122100\algo.dll ()
MOD - C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe ()
MOD - C:\Program Files\IObit\Smart Defrag 2\NtfsData.dll ()
MOD - C:\Program Files\IObit\Advanced SystemCare 6\madbasic_.bpl ()
MOD - C:\Program Files\IObit\Advanced SystemCare 6\maddisAsm_.bpl ()
MOD - C:\Program Files\IObit\Advanced SystemCare 6\madexcept_.bpl ()
MOD - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\AcroTray.DEU ()
MOD - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\AcroTray.FRA ()
MOD - C:\Program Files\Adobe\Adobe Bridge CS4\FileInfo.dll ()
MOD - C:\Program Files\Adobe\Adobe Bridge CS4\AdobeXMPFiles.dll ()
MOD - C:\Program Files\Adobe\Adobe Bridge CS4\AdobeXMP.dll ()
MOD - C:\Program Files\Adobe\Adobe Bridge CS4\Symlib.dll ()
MOD - C:\Program Files\Adobe\Adobe Bridge CS4\libmysqld.dll ()


========== Services (SafeList) ==========

SRV - (HidServ) – %SystemRoot%\System32\hidserv.dll File not found
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (KaraokeService) – C:\WINDOWS\system32\KaraokeSer.exe (VIA Technologies, Inc.)
SRV - (AdvancedSystemCareService6) – C:\Program Files\IObit\Advanced SystemCare 6\ASCService.exe (IObit)
SRV - (nvUpdatusService) – C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (MsDepSvc) – C:\Program Files\IIS\Microsoft Web Deploy\MsDepSvc.exe (Microsoft Corporation)
SRV - (PassThru Service) – C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe ()
SRV - (vsmon) – C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)
SRV - (IswSvc) – C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe (Check Point Software Technologies)
SRV - (UMVPFSrv) – C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
SRV - (IMFservice) – C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe (IObit)
SRV - (Adobe Version Cue CS4) – C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe (Adobe Systems Incorporated)
SRV - (LBTServ) – C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe (Logitech, Inc.)


========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (mbr) – C:\ComboFix\mbr.sys File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (catchme) – C:\DOCUME~1\Cragdo\LOCALS~1\Temp\catchme.sys File not found
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (AswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (VIAHdAudAddService) – C:\WINDOWS\system32\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV - (UrlFilter) – C:\Program Files\IObit\IObit Malware Fighter\Drivers\wxp_x86\UrlFilter.sys (IObit.com)
DRV - (RegFilter) – C:\Program Files\IObit\IObit Malware Fighter\Drivers\wxp_x86\RegFilter.sys (IObit.com)
DRV - (Vsdatant) – C:\WINDOWS\system32\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (ISWKL) – C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys (Check Point Software Technologies)
DRV - (LVUVC) – C:\WINDOWS\system32\drivers\lvuvc.sys (Logitech Inc.)
DRV - (LVRS) – C:\WINDOWS\system32\drivers\lvrs.sys (Logitech Inc.)
DRV - (FileMonitor) – C:\Program Files\IObit\IObit Malware Fighter\Drivers\wxp_x86\FileMonitor.sys (IObit)
DRV - (RsFx0151) – C:\WINDOWS\system32\drivers\RsFx0151.sys (Microsoft Corporation)
DRV - (SmartDefragDriver) – C:\WINDOWS\system32\drivers\SmartDefragDriver.sys ()
DRV - (RTL8192su) – C:\WINDOWS\system32\drivers\RTL8192su.sys (Realtek Semiconductor Corporation )
DRV - (htcnprot) – C:\WINDOWS\system32\drivers\htcnprot.sys (Windows ® Win 7 DDK provider)
DRV - (HTCAND32) – C:\WINDOWS\system32\drivers\ANDROIDUSB.sys (HTC, Corporation)
DRV - (LMouKE) – C:\WINDOWS\system32\drivers\LMouKE.Sys (Logitech, Inc.)
DRV - (L8042mou) – C:\WINDOWS\system32\drivers\L8042mou.Sys (Logitech, Inc.)
DRV - (L8042Kbd) – C:\WINDOWS\system32\drivers\L8042Kbd.sys (Logitech, Inc.)
DRV - (monfilt) – C:\WINDOWS\system32\drivers\monfilt.sys (Creative Technology Ltd.)
DRV - (MTsensor) – C:\WINDOWS\system32\drivers\ASACPI.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: firefogg%40firefogg.org:309
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.4: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2012/04/19 18:24:45 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012/11/13 21:50:12 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/12/19 12:50:08 | 000,000,000 | —D | M]

[2012/11/10 21:58:48 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Cragdo\Application Data\Mozilla\Extensions
[2012/12/19 12:49:07 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Cragdo\Application Data\Mozilla\Firefox\Profiles\f6ev4s0d.default\extensions
[2012/12/19 12:49:07 | 000,000,000 | —D | M] (Firefogg) – C:\Documents and Settings\Cragdo\Application Data\Mozilla\Firefox\Profiles\f6ev4s0d.default\extensions\[removed]
[2012/11/10 19:57:57 | 000,213,316 | —- | M] () (No name found) – C:\Documents and Settings\Cragdo\Application Data\Mozilla\Firefox\Profiles\f6ev4s0d.default\extensions\[removed]
[2012/12/19 12:49:01 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/12/19 12:50:08 | 000,262,112 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/12/19 12:50:05 | 000,002,465 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/12/19 12:50:05 | 000,002,058 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http://www.google.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie;={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl;={language}&q;={searchTerms}&sugkey;={google:suggestAPIKeyParameter},
CHR - homepage: http://www.google.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.97\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.97\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\23.0.1271.97\pdf.dll
CHR - plugin: Conduit Chrome Plugin (Enabled) = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda\2.3.15.10_0\plugins/ConduitChromeApiPlugin.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: npFFApi (Enabled) = C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 7 U9 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Java Deployment Toolkit 7.0.90.5 (Enabled) = C:\WINDOWS\system32\npDeployJava1.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: jQuery API Browser = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\abefhanahjellfbchdmkjdcchkogijhk\1.6_0\
CHR - Extension: WhatFontis.com = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\abgojkiegljpbjgofklpmkakkeapjlpp\2.0_0\
CHR - Extension: HTML5 Outliner = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\afoibpobokebhgfnknfndkgemglggomo\0.5.1.72_0\
CHR - Extension: Validity = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbicmjjbohdfglopkidebfccilipgeif\1.2.4_0\
CHR - Extension: Web Developer = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bfbameneiokkgbdmiekhjnmfkcnldhhm\0.4.1_0\
CHR - Extension: YouTube = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: my code stock.com = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bnlabgojebipbkffbebpecgapkakdikp\1.0.1_0\
CHR - Extension: Pixlr Grabber - Screen capture/image grabbing = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cjjghkapdciaiogkeofggpblmbbnjinn\1.0_0\
CHR - Extension: JS&CSS; Highlighter = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cjkhlhfecbaiapfkmmebdpbeengcelld\1.0.0_0\
CHR - Extension: RegExp Tester App = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cmmblmkfaijaadfjapjddbeaoffeccib\0.1.2_0\
CHR - Extension: Google Search = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: BuiltWith Technology Profiler = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\dapjbgnjinbpoindlpdmhochffioedbn\1.6_0\
CHR - Extension: Sprite Mapper = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\dmnphgbpmlpkhpbhfeckpcbebpjflnne\1.3.4_0\
CHR - Extension: XV \u2014 XML Viewer = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\eeocglpgjdpaefaedpblffpeebgmgddk\1.0.10_0\
CHR - Extension: Disable All Extensions Plus = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ejhdjfmkegkpenillofhpmikailkjpkb\1.2.2_0\
CHR - Extension: Bookmarks = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ffieaadkkhencgelmgbbmkkipeocbcbg\1.1_0\
CHR - Extension: Springpad = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\fkmopoamfjnmppabeaphohombnjcjgla\6_0\
CHR - Extension: Pendule = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gbkffbkamcejhkcaocmkdeiiccpmjfdi\1.0.0_0\
CHR - Extension: Javascript Object Browser = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gpaagbhojejffmocmmjclhedfijjafja\1.1.1_0\
CHR - Extension: TagMyCode = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\hppjochmjbebdchfbkomlnanalapcdif\0.1.1_0\
CHR - Extension: avast! WebRep = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1474_0\
CHR - Extension: Resolution Test = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\idhfcdbheobinplaamokffboaccidbal\2.0_0\
CHR - Extension: What's the font? = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ipooogmmnpmfmhbhlahhjkjiiamjllal\0.1.4_0\
CHR - Extension: WhatFont = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jabopobgcpjmedljpbcaablpmlmfcogm\2.0.1_0\
CHR - Extension: SingleFile Core = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jemlklgaibiijojffihnhieihhagocma\0.3.6_0\
CHR - Extension: LiveReload = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jnihajbhpnppcggbcgedagnkighmdlei\2.0.9_0\
CHR - Extension: Stylebot Social = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\kaifpdafpkbjghohkfkfmkcfcmmnbnaa\1_0\
CHR - Extension: StumbleUpon = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\kcahibnffhnnjcedflmchmokndkjnhpg\4.12.6.1_0\
CHR - Extension: Image Properties Context Menu = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\khagclindddokccfbmfmckaflngbmpon\0.7.5_0\
CHR - Extension: View Background Image = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\knnjokagadbonknppgkjgjpiolcijbmg\0.3_0\
CHR - Extension: Save as PDF = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\kpdjmbiefanbdgnkcikhllpmjnnllbbc\1.7_0\
CHR - Extension: Download Fonts = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lgmjfmdomlhhodhmmfaomfbbdadpeefk\1.2_0\
CHR - Extension: Current Source Code = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ljcogemcngolehdjglgiaphnmggiacca\1.1_0\
CHR - Extension: Springpad Extension = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\njhgeimnepehieioinbhmfpphfoocmng\2.5.1109.21_0\
CHR - Extension: CSS Playground = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nlpdejbmhfkbmlhgigfldhlajpbcakkc\1.0_0\
CHR - Extension: csscan = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nnklpgoldelpoigiacfpnpphpkkmbdkb\2.0.1_0\
CHR - Extension: Palette for Chrome = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\oolpphfmdmjbojolagcbgdemojhcnlod\1.5.2_0\
CHR - Extension: Gmail = C:\Documents and Settings\Cragdo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012/12/21 22:14:01 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()
O2 - BHO: (Zonealarm Helper Object) - {2A841F7A-A014-4DA5-B6D9-8B913DFB7A8C} - C:\Program Files\Check Point Software Technologies LTD\zonealarm\1.5.20.3\bh\zonealarm.dll (Montera Technologeis LTD)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Toolbar) - {438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59} - C:\Program Files\Check Point Software Technologies LTD\zonealarm\1.5.20.3\zonealarmTlbr.dll (Montera Technologeis LTD)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O4 - HKLM..\Run: [Acrobat Assistant 8.0] c:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe_ID0ENQBO] C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4Tray.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [IObit Malware Fighter] C:\Program Files\IObit\IObit Malware Fighter\IMF.exe (IObit)
O4 - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe ()
O4 - HKLM..\Run: [ZoneAlarm] C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [AdobeBridge] C:\Program Files\Adobe\Adobe Bridge CS4\Bridge.exe (Adobe Systems, Inc.)
O4 - HKCU..\Run: [Advanced SystemCare 6] C:\Program Files\IObit\Advanced SystemCare 6\ASCTray.exe (IObit)
O4 - HKCU..\Run: [instanteyedropper] C:\Program Files\InstantEyedropper\InstantEyedropper.exe ()
O4 - HKCU..\Run: [Spotify Web Helper] C:\Documents and Settings\Cragdo\Application Data\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - Startup: C:\Documents and Settings\Cragdo\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\Cragdo\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: Sky - {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.sky.com File not found
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1335028509734 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{21BB7B97-A30B-4D20-9AC4-4B77B8C0FF55}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logitech\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\Logitech\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Cragdo\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Cragdo\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012/04/19 16:11:34 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/12/19 23:05:55 | 002,322,184 | —- | C] (ESET) – C:\Documents and Settings\Cragdo\Desktop\esetsmartinstaller_enu.exe
[2012/12/19 16:18:40 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\nView_Profiles
[2012/12/19 14:01:00 | 000,098,304 | —- | C] (Aureal Semiconductor) – C:\WINDOWS\System32\dllcache\a3d.dll
[2012/12/19 14:01:00 | 000,098,304 | —- | C] (Aureal Semiconductor) – C:\WINDOWS\System32\a3d.dll
[2012/12/19 14:01:00 | 000,008,704 | R— | C] (Windows ® Codename Longhorn DDK provider) – C:\WINDOWS\System32\viahdcpl.cpl
[2012/12/19 13:56:58 | 000,000,000 | —D | C] – C:\Documents and Settings\Cragdo\Desktop\v10_1200a
[2012/12/19 12:49:03 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Maintenance Service
[2012/12/19 12:49:03 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Mozilla
[2012/12/18 22:59:22 | 000,000,000 | —D | C] – C:\Program Files\Adobe Media Player
[2012/12/18 22:59:22 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Adobe
[2012/12/18 19:20:13 | 000,000,000 | RHSD | C] – C:\cmdcons
[2012/12/18 19:18:18 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2012/12/18 19:18:18 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2012/12/18 19:18:18 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2012/12/18 19:18:18 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2012/12/18 19:18:04 | 000,000,000 | —D | C] – C:\Qoobox
[2012/12/18 19:17:39 | 000,000,000 | —D | C] – C:\WINDOWS\erdnt
[2012/12/18 19:12:10 | 005,012,825 | R— | C] (Swearware) – C:\Documents and Settings\Cragdo\Desktop\ComboFix.exe
[2012/12/17 18:52:13 | 004,732,416 | —- | C] (AVAST Software) – C:\Documents and Settings\Cragdo\Desktop\aswMBR.exe
[2012/12/14 23:40:04 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Cragdo\Desktop\OTL.exe
[2012/12/14 22:57:52 | 000,000,000 | —D | C] – C:\Program Files\7-Zip
[2012/12/14 22:57:52 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\7-Zip
[2012/12/14 22:28:50 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\IObit Malware Fighter
[2012/12/14 03:23:22 | 000,000,000 | —D | C] – C:\Program Files\Dropbox
[2012/12/11 23:08:14 | 000,000,000 | —D | C] – C:\WINDOWS\tasks\TaskDisabled
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/12/21 22:16:11 | 000,000,316 | -H– | M] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2012/12/21 22:16:10 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/12/21 22:16:09 | 000,000,282 | —- | M] () – C:\WINDOWS\tasks\SmartDefrag_Startup.job
[2012/12/21 22:14:01 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2012/12/21 22:06:51 | 005,012,825 | R— | M] (Swearware) – C:\Documents and Settings\Cragdo\Desktop\ComboFix.exe
[2012/12/21 21:22:00 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/12/21 21:14:34 | 000,000,424 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{568ADC25-2016-40C7-A1A2-A5CEE082BB39}.job
[2012/12/21 17:58:32 | 000,013,748 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/12/21 17:58:21 | 002,213,440 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/12/21 17:58:11 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/12/21 17:51:50 | 001,102,000 | —- | M] () – C:\WINDOWS\System32\nvdrsdb1.bin
[2012/12/21 17:51:50 | 000,000,001 | —- | M] () – C:\WINDOWS\System32\nvdrssel.bin
[2012/12/21 17:51:44 | 001,102,000 | —- | M] () – C:\WINDOWS\System32\nvdrsdb0.bin
[2012/12/21 17:51:21 | 000,001,029 | —- | M] () – C:\Documents and Settings\Cragdo\Start Menu\Programs\Startup\Dropbox.lnk
[2012/12/19 23:05:57 | 002,322,184 | —- | M] (ESET) – C:\Documents and Settings\Cragdo\Desktop\esetsmartinstaller_enu.exe
[2012/12/19 22:12:37 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/12/19 18:45:36 | 000,050,176 | —- | M] () – C:\Documents and Settings\Cragdo\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/12/19 09:15:52 | 000,002,625 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2012/12/19 08:52:18 | 000,002,809 | —- | M] () – C:\Documents and Settings\Cragdo\Desktop\HiJackThis.lnk
[2012/12/19 08:52:18 | 000,002,467 | —- | M] () – C:\Documents and Settings\Cragdo\Application Data\Microsoft\Internet Explorer\Quick Launch\HiJackThis.lnk
[2012/12/19 07:16:12 | 000,599,098 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/12/19 07:16:12 | 000,125,162 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/12/18 19:20:18 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2012/12/17 22:39:31 | 000,001,971 | —- | M] () – C:\Documents and Settings\Cragdo\Desktop\Sky Go Desktop.lnk
[2012/12/17 20:00:36 | 000,000,546 | —- | M] () – C:\Documents and Settings\Cragdo\Desktop\MBR.zip
[2012/12/17 19:40:40 | 000,547,175 | —- | M] () – C:\Documents and Settings\Cragdo\Desktop\AdwCleaner.exe
[2012/12/17 19:39:27 | 000,000,512 | —- | M] () – C:\Documents and Settings\Cragdo\Desktop\MBR.dat
[2012/12/17 18:52:57 | 004,732,416 | —- | M] (AVAST Software) – C:\Documents and Settings\Cragdo\Desktop\aswMBR.exe
[2012/12/15 00:40:27 | 000,000,947 | —- | M] () – C:\Documents and Settings\Cragdo\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/12/15 00:19:48 | 000,005,392 | —- | M] () – C:\Documents and Settings\Cragdo\Desktop\Attach.zip
[2012/12/15 00:03:32 | 000,625,664 | —- | M] () – C:\Documents and Settings\Cragdo\Desktop\dds.scr
[2012/12/14 23:40:05 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Cragdo\Desktop\OTL.exe
[2012/12/14 22:28:51 | 000,000,826 | —- | M] () – C:\Documents and Settings\All Users\Desktop\IObit Malware Fighter.lnk
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/12/21 17:51:21 | 000,001,029 | —- | C] () – C:\Documents and Settings\Cragdo\Start Menu\Programs\Startup\Dropbox.lnk
[2012/12/19 14:01:02 | 000,000,855 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\HD ADeck.lnk
[2012/12/19 08:39:11 | 000,001,804 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader XI.lnk
[2012/12/18 19:20:17 | 000,000,211 | —- | C] () – C:\Boot.bak
[2012/12/18 19:20:15 | 000,260,272 | RHS- | C] () – C:\cmldr
[2012/12/18 19:18:18 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2012/12/18 19:18:18 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2012/12/18 19:18:18 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2012/12/18 19:18:18 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2012/12/18 19:18:18 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2012/12/17 22:39:31 | 000,001,977 | —- | C] () – C:\Documents and Settings\Cragdo\Start Menu\Programs\Sky Go Desktop.lnk
[2012/12/17 22:39:31 | 000,001,971 | —- | C] () – C:\Documents and Settings\Cragdo\Desktop\Sky Go Desktop.lnk
[2012/12/17 20:00:36 | 000,000,546 | —- | C] () – C:\Documents and Settings\Cragdo\Desktop\MBR.zip
[2012/12/17 19:40:38 | 000,547,175 | —- | C] () – C:\Documents and Settings\Cragdo\Desktop\AdwCleaner.exe
[2012/12/17 19:39:27 | 000,000,512 | —- | C] () – C:\Documents and Settings\Cragdo\Desktop\MBR.dat
[2012/12/15 00:19:48 | 000,005,392 | —- | C] () – C:\Documents and Settings\Cragdo\Desktop\Attach.zip
[2012/12/15 00:03:31 | 000,625,664 | —- | C] () – C:\Documents and Settings\Cragdo\Desktop\dds.scr
[2012/12/14 23:01:19 | 000,002,809 | —- | C] () – C:\Documents and Settings\Cragdo\Desktop\HiJackThis.lnk
[2012/12/14 22:28:51 | 000,000,826 | —- | C] () – C:\Documents and Settings\All Users\Desktop\IObit Malware Fighter.lnk
[2012/08/01 17:32:43 | 000,050,176 | —- | C] () – C:\Documents and Settings\Cragdo\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/05/30 01:00:48 | 000,603,496 | —- | C] () – C:\Documents and Settings\Cragdo\Local Settings\Application Data\census.cache
[2012/05/30 01:00:32 | 000,121,836 | —- | C] () – C:\Documents and Settings\Cragdo\Local Settings\Application Data\ars.cache
[2012/05/29 21:07:14 | 000,000,036 | —- | C] () – C:\Documents and Settings\Cragdo\Local Settings\Application Data\housecall.guid.cache
[2012/05/29 19:24:41 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/05/15 19:02:24 | 000,014,776 | —- | C] () – C:\WINDOWS\System32\drivers\SmartDefragDriver.sys
[2012/04/23 22:21:04 | 000,001,769 | —- | C] () – C:\WINDOWS\Language_trs.ini
[2012/04/21 15:15:54 | 002,592,466 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-507921405-1993962763-682003330-1003-0.dat
[2012/04/21 15:15:50 | 000,333,374 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2012/04/19 18:07:26 | 001,102,000 | —- | C] () – C:\WINDOWS\System32\nvdrsdb1.bin
[2012/04/19 18:07:26 | 001,102,000 | —- | C] () – C:\WINDOWS\System32\nvdrsdb0.bin
[2012/04/19 18:07:26 | 000,000,001 | —- | C] () – C:\WINDOWS\System32\nvdrssel.bin
[2012/04/19 18:07:04 | 002,811,988 | —- | C] () – C:\WINDOWS\System32\nvdata.data
[2012/04/19 17:23:55 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2012/04/19 16:16:57 | 000,018,416 | —- | C] () – C:\WINDOWS\Ascd_log.ini
[2012/04/19 16:16:44 | 000,018,169 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2012/04/19 16:16:43 | 000,005,810 | R— | C] () – C:\WINDOWS\System32\drivers\ASACPI.sys
[2012/04/19 16:16:36 | 000,012,536 | —- | C] () – C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2012/04/19 16:12:51 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2012/04/19 16:09:39 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2012/04/19 14:31:34 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2012/04/19 14:29:04 | 002,213,440 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/01/18 05:44:00 | 010,920,984 | —- | C] () – C:\WINDOWS\System32\LogiDPP.dll
[2012/01/18 05:44:00 | 000,336,408 | —- | C] () – C:\WINDOWS\System32\DevManagerCore.dll
[2012/01/18 05:44:00 | 000,104,472 | —- | C] () – C:\WINDOWS\System32\LogiDPPApp.exe
[2012/01/18 05:22:54 | 000,028,418 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2011/08/12 11:20:14 | 000,015,896 | —- | C] () – C:\WINDOWS\System32\drivers\iKeyLFT2.dll

========== ZeroAccess Check ==========

[2012/04/19 18:32:58 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2008/04/14 12:00:00 | 001,499,136 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2009/02/09 12:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2008/04/14 12:00:00 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2012/04/19 17:02:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2012/04/19 17:08:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\CheckPoint
[2012/04/20 14:58:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DFX
[2012/12/06 15:42:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\IObit
[2012/04/23 21:28:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\IswTmp
[2012/07/13 06:55:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Package Cache
[2012/04/20 16:45:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\VS
[2012/04/23 22:40:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\AMPSoft
[2012/04/20 15:17:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\Check Point Software Technologies LTD
[2012/04/19 17:10:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\CheckPoint
[2012/04/21 20:06:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2012/12/21 18:01:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\Dropbox
[2012/04/19 18:16:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\FileZilla
[2012/05/18 13:42:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\HandBrake
[2012/04/19 19:05:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\HTC
[2012/05/16 20:38:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
[2012/12/14 22:28:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\IObit
[2012/04/23 18:12:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\Leadertech
[2012/04/22 01:52:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\OpenOffice.org
[2012/12/19 15:37:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\Spotify
[2012/04/21 17:27:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\Windows Desktop Search
[2012/05/16 14:31:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Cragdo\Application Data\Windows Search

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 153 bytes -> C:\Documents and Settings\Cragdo\Desktop\WEBSITE WEE CHANGES.doc:com.dropbox.attributes

< End of report >