Help Trojan Win32/Renos.IO [Solved], Win32 Renos Can't use Malwarebytes or other programs Firefox won&# |
Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!
  |
 Jul 3 2009, 02:39 PM
Post
#1
|
|
|
New Member  Posts: 4 OS: windows vista  |
Hi: Please Help! I stupidly allowed the Trojan downloader Win32/Renos.IO virus when I was asked to update media player with Flash. I have followed the Malware steps but when i download and install Malwarebytes it wont run, the same happens with Spybot and others. I also cant open mozilla. Running windows vista (sp1) Following is the logs for Rooter: Followed by OTL Rooter.exe (v1.0.2) by Eric_71 . The token does not have the SeDebugPrivilege privilege ! (error:1300) Can not acquire SeDebugPrivilege ! Please run the tool as administrator .. . Windows Vista Home Edition (6.0.6001) Service Pack 1 [32_bits] - x86 Family 15 Model 107 Stepping 2, AuthenticAMD . Error OpenService (wscsvc) : 6 Error OpenSCManager : 5 Error OpenService (MpsSvc) : 6 Windows Defender -> Enabled User Account Control (UAC) -> Enabled . Internet Explorer 7.0.6001.18000 Mozilla Firefox 3.0.11 (en-GB) . C:\ [Fixed-NTFS] .. ( Total:113 Go - Free:58 Go ) D:\ [Fixed-NTFS] .. ( Total:170 Go - Free:42 Go ) E:\ [CD_Rom] F:\ [Removable] G:\ [Removable] H:\ [Removable] I:\ [Removable] J:\ [Removable] K:\ [Fixed-FAT32] .. ( Total:149 Go - Free:3 Go ) M:\ [Removable] . Scan : 12:57.08 Path : C:\Users\Maxine\Documents\Downloads\Rooter.exe User : Maxine ( Administrator -> YES ) . ----------------------\\ Processes . Locked [System Process] (0) Locked System (4) Locked smss.exe (444) Locked csrss.exe (592) Locked wininit.exe (652) Locked csrss.exe (664) Locked services.exe (708) Locked lsass.exe (724) Locked lsm.exe (732) Locked winlogon.exe (764) Locked svchost.exe (980) Locked svchost.exe (1052) Locked svchost.exe (1168) Locked svchost.exe (1200) Locked Ati2evxx.exe (1236) Locked svchost.exe (1252) Locked svchost.exe (1312) Locked svchost.exe (1332) Locked audiodg.exe (1424) Locked SLsvc.exe (1468) Locked svchost.exe (1508) Locked Ati2evxx.exe (1656) ______ C:\Windows\system32\Dwm.exe (1932) Locked spoolsv.exe (2020) ______ C:\Windows\Explorer.EXE (124) Locked taskeng.exe (256) Locked svchost.exe (288) ______ C:\Windows\system32\taskeng.exe (1648) Rooter.exe (v1.0.2) by Eric_71 . The token does not have the SeDebugPrivilege privilege ! (error:1300) Can not acquire SeDebugPrivilege ! Please run the tool as administrator .. . Windows Vista Home Edition (6.0.6001) Service Pack 1 [32_bits] - x86 Family 15 Model 107 Stepping 2, AuthenticAMD . Error OpenService (wscsvc) : 6 Error OpenSCManager : 5 Error OpenService (MpsSvc) : 6 Windows Defender -> Enabled User Account Control (UAC) -> Enabled . Internet Explorer 7.0.6001.18000 Mozilla Firefox 3.0.11 (en-GB) . C:\ [Fixed-NTFS] .. ( Total:113 Go - Free:58 Go ) D:\ [Fixed-NTFS] .. ( Total:170 Go - Free:42 Go ) E:\ [CD_Rom] F:\ [Removable] G:\ [Removable] H:\ [Removable] I:\ [Removable] J:\ [Removable] K:\ [Fixed-FAT32] .. ( Total:149 Go - Free:3 Go ) M:\ [Removable] . Scan : 12:57.08 Path : C:\Users\Maxine\Documents\Downloads\Rooter.exe User : Maxine ( Administrator -> YES ) . ----------------------\\ Processes . Locked [System Process] (0) Locked System (4) Locked smss.exe (444) Locked csrss.exe (592) Locked wininit.exe (652) Locked csrss.exe (664) Locked services.exe (708) Locked lsass.exe (724) Locked lsm.exe (732) Locked winlogon.exe (764) Locked svchost.exe (980) Locked svchost.exe (1052) Locked svchost.exe (1168) Locked svchost.exe (1200) Locked Ati2evxx.exe (1236) Locked svchost.exe (1252) Locked svchost.exe (1312) Locked svchost.exe (1332) Locked audiodg.exe (1424) Locked SLsvc.exe (1468) Locked svchost.exe (1508) Locked Ati2evxx.exe (1656) ______ C:\Windows\system32\Dwm.exe (1932) Locked spoolsv.exe (2020) ______ C:\Windows\Explorer.EXE (124) Locked taskeng.exe (256) Locked svchost.exe (288) ______ C:\Windows\system32\taskeng.exe (1648) OTL logfile created on: 7/3/2009 1:32:06 PM - Run 2 OTL by OldTimer - Version 3.0.6.4 Folder = C:\Users\Maxine\Documents\Downloads Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 7.0.6001.18000) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 1.75 Gb Total Physical Memory | 0.92 Gb Available Physical Memory | 52.79% Memory free 3.75 Gb Paging File | 2.61 Gb Available in Paging File | 69.77% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 113.36 Gb Total Space | 57.91 Gb Free Space | 51.09% Space Free | Partition Type: NTFS Drive D: | 170.08 Gb Total Space | 42.52 Gb Free Space | 25.00% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Drive K: | 149.01 Gb Total Space | 3.41 Gb Free Space | 2.29% Space Free | Partition Type: FAT32 Drive M: | 967.22 Mb Total Space | 584.38 Mb Free Space | 60.42% Space Free | Partition Type: FAT Computer Name: KWOMAIS Current User Name: Maxine Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Windows\System32\Ati2evxx.exe (ATI Technologies Inc.) PRC - C:\Windows\System32\Ati2evxx.exe (ATI Technologies Inc.) PRC - C:\Windows\Explorer.EXE (Microsoft Corporation) PRC - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe (CyberLink) PRC - C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe (NewTech Infosystems, Inc.) PRC - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated) PRC - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe () PRC - C:\Program Files\AVG\AVG8\avgrsx.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files\AVG\AVG8\avgnsx.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company) PRC - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe (NewTech InfoSystems, Inc.) PRC - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe () PRC - C:\Program Files\CyberLink\Shared Files\RichVideo.exe () PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) PRC - C:\Program Files\Acer\Empowering Technology\SysMonitor.exe () PRC - C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe () PRC - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated) PRC - C:\Program Files\AVG\AVG8\avgcsrvx.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Windows\System32\WUDFHost.exe (Microsoft Corporation) PRC - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe () PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) PRC - C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.) PRC - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google) PRC - C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Advanced Micro Devices Inc.) PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) PRC - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (ATI Technologies Inc.) PRC - C:\Windows\ehome\ehtray.exe (Microsoft Corporation) PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) PRC - C:\Windows\ehome\ehmsas.exe (Microsoft Corporation) PRC - C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.) PRC - C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG) PRC - C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) PRC - C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (Nero AG) PRC - C:\Program Files\Northstar\SmartCopy\SmartCopy.exe () PRC - C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Program Files\Northstar\SmartLauncher\SmartLauncher.exe (North Star com.) PRC - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google) PRC - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (Nero AG) PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org) PRC - C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) PRC - C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) PRC - C:\Users\Maxine\Documents\Downloads\OTL (1).exe (OldTimer Tools) ========== Win32 Services (SafeList) ========== SRV - (Acer HomeMedia Connect Service [Auto | Running]) -- C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe (CyberLink) SRV - (Adobe LM Service [On_Demand | Stopped]) -- C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe (Adobe Systems) SRV - (Ati External Event Utility [Auto | Running]) -- C:\Windows\System32\Ati2evxx.exe (ATI Technologies Inc.) SRV - (avg8emc [Auto | Running]) -- C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.) SRV - (avg8wd [Auto | Running]) -- C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.) SRV - (BUNAgentSvc [Auto | Running]) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe (NewTech Infosystems, Inc.) SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (eDataSecurity Service [Auto | Running]) -- C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated) SRV - (ehRecvr [On_Demand | Stopped]) -- C:\Windows\ehome\ehRecvr.exe (Microsoft Corporation) SRV - (ehSched [On_Demand | Stopped]) -- C:\Windows\ehome\ehsched.exe (Microsoft Corporation) SRV - (ehstart [Auto | Stopped]) -- C:\Windows\ehome\ehstart.dll (Microsoft Corporation) SRV - (ETService [Auto | Running]) -- C:\Program Files\Acer\Empowering Technology\Service\ETService.exe () SRV - (Eventlog [Auto | Running]) -- C:\Windows\System32\wevtsvc.dll (Microsoft Corporation) SRV - (FontCache3.0.0.0 [On_Demand | Stopped]) -- C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation) SRV - (GoogleDesktopManager-080708-050100 [On_Demand | Stopped]) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google) SRV - (gupdate1c9868a27ed0780 [Auto | Stopped]) -- C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.) SRV - (gusvc [Auto | Stopped]) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google) SRV - (idsvc [Unknown | Stopped]) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation) SRV - (Lavasoft Ad-Aware Service [Auto | Stopped]) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft) SRV - (LightScribeService [Auto | Running]) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company) SRV - (NBService [On_Demand | Stopped]) -- C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe (Nero AG) SRV - (NetTcpPortSharing [Disabled | Stopped]) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation) SRV - (NMIndexingService [On_Demand | Running]) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (Nero AG) SRV - (NTIBackupSvc [Auto | Running]) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe (NewTech InfoSystems, Inc.) SRV - (NTISchedulerSvc [Auto | Running]) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe () SRV - (odserv [On_Demand | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation) SRV - (ose [On_Demand | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) SRV - (RichVideo [Auto | Running]) -- C:\Program Files\CyberLink\Shared Files\RichVideo.exe () SRV - (WinDefend [Auto | Running]) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SRV - (WMPNetworkSvc [On_Demand | Running]) -- C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (adp94xx [Disabled | Stopped]) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.) DRV - (adpahci [Disabled | Stopped]) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.) DRV - (adpu160m [Disabled | Stopped]) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.) DRV - (adpu320 [Disabled | Stopped]) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.) DRV - (ahcix86s [Boot | Running]) -- C:\Windows\system32\drivers\ahcix86s.sys (AMD Technologies Inc.) DRV - (aic78xx [Disabled | Stopped]) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.) DRV - (aliide [Disabled | Stopped]) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.) DRV - (arc [Disabled | Stopped]) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.) DRV - (arcsas [Disabled | Stopped]) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.) DRV - (atikmdag [On_Demand | Running]) -- C:\Windows\System32\DRIVERS\atikmdag.sys (ATI Technologies Inc.) DRV - (AtiPcie [Boot | Running]) -- C:\Windows\system32\DRIVERS\AtiPcie.sys (ATI Technologies Inc.) DRV - (AvgLdx86 [System | Running]) -- C:\Windows\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.) DRV - (AvgMfx86 [System | Running]) -- C:\Windows\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.) DRV - (AvgTdiX [System | Running]) -- C:\Windows\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.) DRV - (BrFiltLo [On_Demand | Stopped]) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.) DRV - (BrFiltUp [On_Demand | Stopped]) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.) DRV - (Brserid [Disabled | Stopped]) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.) DRV - (BrSerWdm [Disabled | Stopped]) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.) DRV - (BrUsbMdm [Disabled | Stopped]) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.) DRV - (BrUsbSer [On_Demand | Stopped]) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.) DRV - (cmdide [Disabled | Stopped]) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.) DRV - (E1G60 [On_Demand | Stopped]) -- C:\Windows\System32\DRIVERS\E1G60I32.sys (Intel Corporation) DRV - (elxstor [Disabled | Stopped]) -- C:\Windows\system32\drivers\elxstor.sys (Emulex) DRV - (HpCISSs [Disabled | Stopped]) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company) DRV - (iaStorV [Disabled | Stopped]) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation) DRV - (iirsp [Disabled | Stopped]) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (int15 [Auto | Running]) -- C:\Windows\System32\drivers\int15.sys (Acer, Inc.) DRV - (IntcAzAudAddService [On_Demand | Running]) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.) DRV - (iteatapi [Disabled | Stopped]) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.) DRV - (iteraid [Disabled | Stopped]) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.) DRV - (Lbd [Boot | Running]) -- C:\Windows\system32\DRIVERS\Lbd.sys (Lavasoft AB) DRV - (LSI_FC [Disabled | Stopped]) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic) DRV - (LSI_SAS [Disabled | Stopped]) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic) DRV - (LSI_SCSI [Disabled | Stopped]) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic) DRV - (megasas [Disabled | Stopped]) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation) DRV - (MegaSR [Disabled | Stopped]) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.) DRV - (MODEMCSA [On_Demand | Running]) -- C:\Windows\System32\drivers\MODEMCSA.sys (Microsoft Corporation) DRV - (Mraid35x [Disabled | Stopped]) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation) DRV - (nfrd960 [Disabled | Stopped]) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation) DRV - (NTIDrvr [On_Demand | Running]) -- C:\Windows\System32\DRIVERS\NTIDrvr.sys (NewTech Infosystems, Inc.) DRV - (ntrigdigi [Disabled | Stopped]) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies) DRV - (nvraid [Disabled | Stopped]) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation) DRV - (nvstor [Disabled | Stopped]) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation) DRV - (pcouffin [On_Demand | Running]) -- C:\Windows\System32\Drivers\pcouffin.sys (VSO Software) DRV - (PSDFilter [Boot | Running]) -- C:\Windows\system32\DRIVERS\psdfilter.sys (Egis Incorporated) DRV - (PSDNServ [Auto | Running]) -- C:\Windows\System32\DRIVERS\PSDNServ.sys (Egis Incorporated) DRV - (psdvdisk [Auto | Running]) -- C:\Windows\System32\DRIVERS\PSDVdisk.sys (Egis Incorporated) DRV - (ql2300 [Disabled | Stopped]) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation) DRV - (ql40xx [Disabled | Stopped]) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation) DRV - (secdrv [Auto | Running]) -- C:\Windows\System32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) DRV - (SiSRaid4 [Disabled | Stopped]) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems) DRV - (smserial [On_Demand | Running]) -- C:\Windows\System32\DRIVERS\smserial.sys (Motorola Inc.) DRV - (Symc8xx [Disabled | Stopped]) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic) DRV - (Sym_hi [Disabled | Stopped]) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic) DRV - (Sym_u3 [Disabled | Stopped]) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic) DRV - (tvicport [Auto | Running]) -- C:\Windows\System32\drivers\tvicport.sys (EnTech Taiwan) DRV - (UBHelper [Boot | Running]) -- C:\Windows\System32\drivers\UBHelper.sys (NewTech Infosystems Corporation) DRV - (uliahci [Disabled | Stopped]) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.) DRV - (UlSata [Disabled | Stopped]) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.) DRV - (ulsata2 [Disabled | Stopped]) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.) DRV - (viaide [Disabled | Stopped]) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.) DRV - (vsmraid [Disabled | Stopped]) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (WSVD [On_Demand | Stopped]) -- C:\Windows\System32\drivers\WSVD.sys (CyberLink) DRV - (yukonwlh [On_Demand | Running]) -- C:\Windows\System32\DRIVERS\yk60x86.sys (Marvell) DRV - (zntport [Auto | Running]) -- C:\Windows\System32\drivers\zntport.sys (Zeal SoftStudio) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a...;m=aspire_m1201 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a...;m=aspire_m1201 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://global.acer.com [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a...;m=aspire_m1201 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - URLSearchHook: *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Reg Error: Key error. File not found IE - URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll () IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:8.5 FF - prefs.js..extensions.enabledItems: avg@igeared:2.506.014.001 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13 FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:2.2.0.102 FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.5.200812101546 FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.11 FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG8\Firefox [2009/06/27 09:47:39 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG8\Toolbar\Firefox\avg@igeared [2009/06/27 09:47:39 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/06/12 10:21:00 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/06/23 21:40:11 | 00,000,000 | ---D | M] [2009/02/08 14:23:41 | 00,000,000 | ---D | M] -- C:\Users\Maxine\AppData\Roaming\mozilla\Extensions [2009/02/08 14:23:41 | 00,000,000 | ---D | M] -- C:\Users\Maxine\AppData\Roaming\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009/02/01 16:17:02 | 00,000,000 | ---D | M] -- C:\Users\Maxine\AppData\Roaming\mozilla\Firefox\extensions [2009/02/01 16:17:02 | 00,000,000 | ---D | M] -- C:\Users\Maxine\AppData\Roaming\mozilla\Firefox\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D} [2009/07/02 21:29:53 | 00,000,000 | ---D | M] -- C:\Users\Maxine\AppData\Roaming\mozilla\Firefox\Profiles\q873tpc8.default\extensions [2009/05/22 14:27:33 | 00,000,000 | ---D | M] -- C:\Users\Maxine\AppData\Roaming\mozilla\Firefox\Profiles\q873tpc8.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2008/11/24 15:50:50 | 00,000,838 | ---- | M] () -- C:\Users\Maxine\AppData\Roaming\Mozilla\FireFox\Profiles\q873tpc8.default\searchplugins\conduit.xml [2009/07/03 12:07:22 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions [2009/06/12 10:21:00 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009/02/11 02:11:42 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED} [2009/03/03 22:54:53 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} [2009/05/20 02:37:44 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [2009/06/12 10:20:59 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll [2009/06/12 10:20:59 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll [2007/04/10 17:21:08 | 00,163,256 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\np-mswmp.dll [2009/05/20 02:37:29 | 00,410,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeploytk.dll [2009/06/12 10:21:00 | 00,065,528 | ---- | M] (mozilla.org) -- C:\Program Files\mozilla firefox\plugins\npnul32.dll [2006/10/26 20:12:16 | 00,016,192 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL [2008/10/14 22:33:30 | 00,095,600 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2009/03/07 01:39:41 | 00,001,538 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml [2009/03/07 01:39:41 | 00,002,193 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml [2009/06/28 12:59:31 | 00,001,490 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg_igeared.xml [2009/02/20 17:25:41 | 00,002,194 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml [2009/03/07 01:39:41 | 00,000,947 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml [2009/03/07 01:39:41 | 00,001,534 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml [2009/03/07 01:39:41 | 00,000,759 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml [2009/03/07 01:39:41 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml [2009/03/07 01:39:41 | 00,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml [2009/03/07 01:39:41 | 00,000,831 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml O1 HOSTS File: (761 bytes) - C:\Windows\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com) O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll (Egis) O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll () O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll (Google Inc.) O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.) O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Ask Toolbar BHO) - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL (Ask.com) O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com) O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.) O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll () O3 - HKLM\..\Toolbar: (Ask Toolbar) - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL (Ask.com) O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.) O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com) O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll () O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {FE063DB9-4EC0-403E-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL (Ask.com) O4 - HKLM..\Run: [Acer Assist Launcher] C:\Program Files\Acer\Acer Assist\launcher.exe () O4 - HKLM..\Run: [Acer Empowering Technology Monitor] C:\Program Files\Acer\Empowering Technology\SysMonitor.exe () O4 - HKLM..\Run: [Acer Product Registration] File not found O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft) O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [BkupTray] C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe () O4 - HKLM..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe (Egis Incorporated) O4 - HKLM..\Run: [EmpoweringTechnology] C:\Program Files\Acer\Empowering Technology\Framework.Lau File not found O4 - HKLM..\Run: [Google Desktop Search] File not found O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [PCMMediaSharing] C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe () O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Skytel] C:\Windows\Skytel.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe (Sammsoft) O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG) O4 - HKCU..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe (Microsoft Corporation) O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.) O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.DLL (Microsoft Corporation) O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (Microsoft Corporation) O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] File not found O4 - Startup: C:\Users\Maxine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17 O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: 25 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet) O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files/Zuma/Images/stg_drm.ocx (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files/Tumblebugs/Images/armhelper.ocx (ArmHelper Control) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.154.133.68 75.154.133.100 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.132,85.255.112.188 O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com - No CLSID value found O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter: - x-sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.) O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google) O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/09/18 14:43:36 | 00,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2009/07/03 09:53:32 | 00,000,383 | RHS- | M] () - M:\autorun.inf -- [ FAT ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\Windows\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - File not found ========== Files/Folders - Created Within 30 Days ========== [2009/07/03 13:15:40 | 00,000,822 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2009/07/03 13:15:37 | 00,038,160 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2009/07/03 13:15:36 | 00,019,096 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2009/07/03 13:15:36 | 00,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2009/07/03 13:15:35 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2009/07/03 12:57:45 | 00,000,000 | ---D | C] -- C:\Users\Maxine\Desktop\nighmare [2009/07/03 12:57:14 | 00,000,000 | ---D | C] -- C:\Rooter$ [2009/07/03 12:56:13 | 00,000,000 | ---D | C] -- C:\Windows\ERDNT [2009/07/03 12:55:36 | 00,000,737 | ---- | C] () -- C:\Users\Maxine\Desktop\NTREGOPT.lnk [2009/07/03 12:55:36 | 00,000,718 | ---- | C] () -- C:\Users\Maxine\Desktop\ERUNT.lnk [2009/07/03 12:55:33 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT [2009/07/03 12:14:21 | 01,739,478 | -H-- | C] () -- C:\Users\Maxine\AppData\Local\IconCache.db [2009/07/03 12:08:55 | 18,781,88032 | -HS- | C] () -- C:\hiberfil.sys [2009/07/03 11:47:26 | 00,000,816 | ---- | C] () -- C:\Users\Maxine\Desktop\SpywareBlaster.lnk [2009/07/03 11:47:22 | 00,000,000 | ---D | C] -- C:\Program Files\SpywareBlaster [2009/07/03 09:34:51 | 00,000,264 | -H-- | C] () -- C:\Windows\tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job [2009/07/03 09:34:16 | 00,062,813 | ---- | C] () -- C:\Program Files\Uninstall.exe [2009/07/02 22:22:27 | 00,001,980 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk [2009/07/02 22:11:29 | 00,000,000 | ---D | C] -- C:\Windows\Google Earth Pro 4.2 [2009/07/02 22:11:29 | 00,000,000 | ---D | C] -- C:\Program Files\Google Earth Pro 4.2 [2009/06/30 14:15:46 | 00,000,000 | ---D | C] -- C:\ProgramData\vsosdk [2009/06/30 13:58:56 | 00,000,000 | ---D | C] -- C:\Users\Maxine\Documents\DVDFab [2009/06/30 13:56:26 | 00,087,608 | ---- | C] () -- C:\Users\Maxine\AppData\Roaming\inst.exe [2009/06/30 13:56:26 | 00,047,360 | ---- | C] (VSO Software) -- C:\Windows\System32\drivers\pcouffin.sys [2009/06/30 13:56:26 | 00,047,360 | ---- | C] (VSO Software) -- C:\Users\Maxine\AppData\Roaming\pcouffin.sys [2009/06/30 13:56:26 | 00,007,887 | ---- | C] () -- C:\Users\Maxine\AppData\Roaming\pcouffin.cat [2009/06/30 13:56:26 | 00,001,144 | ---- | C] () -- C:\Users\Maxine\AppData\Roaming\pcouffin.inf [2009/06/30 13:56:25 | 00,000,000 | ---D | C] -- C:\Users\Maxine\Documents\PcSetup [2009/06/30 13:56:25 | 00,000,000 | ---D | C] -- C:\Users\Maxine\AppData\Roaming\Vso [2009/06/30 13:56:08 | 00,000,000 | ---D | C] -- C:\Program Files\DVDFab 5 [2009/06/28 16:06:23 | 00,000,886 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2009/06/28 16:06:21 | 00,000,882 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2009/06/28 12:59:32 | 00,000,000 | ---D | C] -- C:\Users\Maxine\AppData\Local\AVG Security Toolbar [2009/06/26 19:46:38 | 00,000,000 | ---D | C] -- C:\Users\Maxine\Desktop\Wedding Invite [2009/06/26 19:31:46 | 00,000,000 | ---D | C] -- C:\Users\Maxine\Documents\Updater [2009/06/26 17:05:44 | 00,000,000 | ---D | C] -- C:\Users\Maxine\Desktop\TV Series FEB 2009 [2009/06/26 12:03:40 | 00,000,000 | ---D | C] -- C:\ProgramData\AVG Security Toolbar [2009/06/25 22:34:52 | 00,000,000 | ---D | C] -- C:\Users\Maxine\AppData\Roaming\WinRAR [2009/06/25 22:30:08 | 00,000,000 | ---D | C] -- C:\Program Files\WinRAR [2009/06/25 19:15:26 | 00,000,000 | ---D | C] -- C:\ProgramData\LightScribe [2009/06/25 19:15:19 | 00,002,533 | ---- | C] () -- C:\Users\Maxine\Desktop\Nero StartSmart.lnk [2009/06/24 09:59:46 | 00,000,000 | ---D | C] -- C:\Users\Maxine\AppData\Local\Ahead [2009/06/23 22:28:45 | 00,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini [2009/06/23 22:11:16 | 00,001,156 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk [2009/06/23 22:11:08 | 00,000,000 | ---D | C] -- C:\Users\Public\Documents\Adobe PDF [2009/06/23 22:10:44 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe Systems Shared [2009/06/23 21:59:45 | 00,000,000 | ---D | C] -- C:\Users\Maxine\AppData\Roaming\Ahead [2009/06/23 21:58:26 | 00,000,000 | ---D | C] -- C:\ProgramData\Nero [2009/06/23 21:58:25 | 00,000,000 | ---D | C] -- C:\Program Files\Nero [2009/06/23 21:58:25 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Ahead [2009/06/23 21:56:41 | 02,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_30.dll [2009/06/23 21:56:40 | 02,323,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_28.dll [2009/06/23 21:51:44 | 00,000,000 | ---D | C] -- C:\Program Files\AskTBar [2009/06/23 21:39:45 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft Visual Studio [2009/06/23 21:39:45 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER [2009/06/23 21:39:21 | 00,000,000 | ---D | C] -- C:\Windows\PCHEALTH [2009/06/23 21:39:21 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET [2009/06/23 21:35:32 | 00,000,000 | RH-D | C] -- C:\MSOCache [2009/06/23 19:12:47 | 00,000,000 | ---D | C] -- C:\Users\Maxine\Documents\The KMPlayer [2009/06/23 19:11:40 | 00,000,776 | ---- | C] () -- C:\Users\Maxine\Desktop\KMPlayer.lnk [2009/06/23 19:11:34 | 00,000,000 | ---D | C] -- C:\Program Files\The KMPlayer [2009/06/23 11:30:54 | 00,000,000 | ---D | C] -- C:\Program Files\uTorrent [2009/06/23 11:30:32 | 00,000,000 | ---D | C] -- C:\Users\Maxine\AppData\Roaming\uTorrent [2009/06/22 23:59:30 | 00,000,000 | ---D | C] -- C:\Program Files\Tumble Bugs1 [2009/06/22 23:55:52 | 00,000,000 | ---D | C] -- C:\Program Files\Trymedia [2009/06/22 23:55:39 | 00,000,000 | ---D | C] -- C:\Program Files\PopCap Games [2009/06/22 23:54:37 | 00,000,000 | ---D | C] -- C:\Users\Maxine\Desktop\GaMES [2009/06/22 23:45:49 | 00,000,000 | ---D | C] -- C:\Users\Maxine\Desktop\Martin [2009/06/16 12:51:47 | 00,428,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll [2009/06/16 12:51:47 | 00,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisdecd.dll [2009/06/16 12:51:47 | 00,217,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisrndr.ax [2009/06/16 12:51:47 | 00,177,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mpg2splt.ax [2009/06/16 12:51:47 | 00,080,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSNP.ax [2009/06/10 23:40:07 | 02,033,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2009/06/10 23:40:06 | 00,636,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\localspl.dll [2009/06/10 23:40:04 | 00,784,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rpcrt4.dll [2009/06/10 23:39:59 | 03,581,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.dll [2009/06/10 23:39:58 | 06,069,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieframe.dll [2009/06/10 23:39:58 | 01,166,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\urlmon.dll [2009/06/10 23:39:58 | 00,827,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wininet.dll [2009/06/10 23:39:58 | 00,270,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iertutil.dll [2009/06/10 23:39:57 | 00,671,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll [2009/06/10 23:39:57 | 00,458,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2009/06/10 23:39:57 | 00,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec [2009/06/10 23:39:57 | 00,389,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2009/06/10 23:39:57 | 00,230,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll [2009/06/10 23:39:57 | 00,102,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\occache.dll [2009/06/10 23:39:57 | 00,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieencode.dll [2009/06/10 23:39:57 | 00,028,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2009/06/10 23:39:57 | 00,026,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2009/06/10 23:39:56 | 01,383,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2009/02/01 03:17:33 | 00,000,674 | ---- | C] () -- C:\Windows\wininit.ini [2009/01/31 15:28:59 | 00,000,042 | ---- | C] () -- C:\Windows\Acer(Wide).ini [2009/01/31 15:28:56 | 00,000,044 | ---- | C] () -- C:\Windows\Acer(Normal).ini [2008/08/21 17:11:21 | 00,049,152 | ---- | C] ( ) -- C:\Windows\Interop.IWshRuntimeLibrary.dll [2008/08/21 17:10:21 | 00,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll [2008/08/21 14:09:23 | 00,001,024 | RH-- | C] () -- C:\Windows\System32\NTIOFM4.dll [2008/08/21 14:09:23 | 00,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN5.dll [2008/08/21 13:57:51 | 00,487,424 | ---- | C] () -- C:\Windows\System32\INT15.dll [2006/11/02 05:35:32 | 00,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006/11/02 03:23:31 | 00,000,219 | ---- | C] () -- C:\Windows\win.ini [2006/11/02 03:23:31 | 00,000,219 | ---- | C] () -- C:\Windows\system.ini [2006/11/02 00:40:29 | 00,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2001/12/26 13:12:30 | 00,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll [2001/09/03 20:46:38 | 00,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll [2001/07/30 13:33:56 | 00,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll [2001/07/23 19:04:36 | 00,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll ========== Files - Modified Within 30 Days ========== [2009/07/03 13:35:25 | 00,084,480 | ---- | M] () -- C:\Users\Maxine\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009/07/03 13:35:25 | 00,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini [2009/07/03 13:16:42 | 00,690,960 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2009/07/03 13:16:42 | 00,599,942 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2009/07/03 13:16:42 | 00,105,448 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2009/07/03 13:15:40 | 00,000,822 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2009/07/03 13:13:52 | 00,000,868 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job [2009/07/03 13:11:51 | 00,001,594 | ---- | M] () -- C:\Users\Maxine\Desktop\Clean Registry for Free!.lnk [2009/07/03 13:11:23 | 00,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2009/07/03 13:11:22 | 00,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2009/07/03 13:11:22 | 00,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2009/07/03 13:11:21 | 00,000,264 | -H-- | M] () -- C:\Windows\tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job [2009/07/03 13:11:18 | 00,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2009/07/03 13:11:15 | 00,067,584 | ---- | M] () -- C:\Windows\bootstat.dat [2009/07/03 13:11:07 | 18,781,88032 | -HS- | M] () -- C:\hiberfil.sys [2009/07/03 13:09:13 | 01,739,478 | -H-- | M] () -- C:\Users\Maxine\AppData\Local\IconCache.db [2009/07/03 12:55:36 | 00,000,737 | ---- | M] () -- C:\Users\Maxine\Desktop\NTREGOPT.lnk [2009/07/03 12:55:36 | 00,000,718 | ---- | M] () -- C:\Users\Maxine\Desktop\ERUNT.lnk [2009/07/03 12:11:00 | 00,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2009/07/03 11:47:26 | 00,000,816 | ---- | M] () -- C:\Users\Maxine\Desktop\SpywareBlaster.lnk [2009/07/03 09:56:03 | 00,000,000 | ---- | M] () -- C:\Windows\System32\LogConfigTemp.xml [2009/07/03 09:34:16 | 00,062,813 | ---- | M] () -- C:\Program Files\Uninstall.exe [2009/07/03 08:01:24 | 37,700,955 | ---- | M] () -- C:\Windows\System32\drivers\Avg\incavi.avm [2009/07/03 08:01:24 | 00,005,598 | ---- | M] () -- C:\Windows\System32\drivers\Avg\microavi.avg [2009/07/02 22:22:27 | 00,001,980 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk [2009/07/02 00:06:18 | 00,000,040 | ---- | M] () -- C:\Windows\popcinfo.dat [2009/06/30 13:56:26 | 00,087,608 | ---- | M] () -- C:\Users\Maxine\AppData\Roaming\inst.exe [2009/06/30 13:56:26 | 00,047,360 | ---- | M] (VSO Software) -- C:\Windows\System32\drivers\pcouffin.sys [2009/06/30 13:56:26 | 00,047,360 | ---- | M] (VSO Software) -- C:\Users\Maxine\AppData\Roaming\pcouffin.sys [2009/06/30 13:56:26 | 00,007,887 | ---- | M] () -- C:\Users\Maxine\AppData\Roaming\pcouffin.cat [2009/06/30 13:56:26 | 00,001,144 | ---- | M] () -- C:\Users\Maxine\AppData\Roaming\pcouffin.inf [2009/06/29 18:06:27 | 00,463,779 | ---- | M] () -- C:\Windows\System32\drivers\Avg\miniavi.avg [2009/06/29 16:17:00 | 00,000,472 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job [2009/06/26 12:02:51 | 00,327,688 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgldx86.sys [2009/06/26 12:02:51 | 00,027,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgmfx86.sys [2009/06/26 12:02:51 | 00,011,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\avgrsstx.dll [2009/06/25 19:15:19 | 00,002,533 | ---- | M] () -- C:\Users\Maxine\Desktop\Nero StartSmart.lnk [2009/06/24 09:59:49 | 00,092,176 | ---- | M] () -- C:\Users\Maxine\AppData\Local\GDIPFONTCACHEV1.DAT [2009/06/24 09:58:49 | 00,350,080 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2009/06/23 22:11:16 | 00,001,156 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk [2009/06/23 21:36:40 | 00,000,219 | ---- | M] () -- C:\Windows\win.ini [2009/06/23 19:12:40 | 00,000,776 | ---- | M] () -- C:\Users\Maxine\Desktop\KMPlayer.lnk [2009/06/23 13:33:07 | 00,001,975 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2009/06/17 11:27:56 | 00,038,160 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2009/06/17 11:27:44 | 00,019,096 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys ========== Alternate Data Streams ========== @Alternate Data Stream - 94 bytes -> C:\ProgramData\TEMP:C5E4F943 @Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:B623B5B8 @Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:5C321E34 @Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:793F316E @Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:8AB6C1D7 @Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:FC420CE6 @Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:DF30C7A6 @Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:D509ABF5 @Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:3E7393FC @Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:6D192E3A @Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:9F683177 @Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:2EF63291 @Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:0C988F7D @Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:19DEDE0B < End of report > |
 |
 
|
|
Jul 4 2009, 07:09 AM
Post
#2
|
|
 Trusted Helper  Posts: 9,206 OS: Windows XP |
double posted
This post has been edited by fenzodahl512: Jul 4 2009, 07:11 AM |
|
|
|
|
Jul 4 2009, 07:09 AM
Post
#3
|
|
|
Trusted Helper Posts: 9,206 OS: Windows XP |
double posted
This post has been edited by fenzodahl512: Jul 4 2009, 07:11 AM |
|
|
|
|
Jul 4 2009, 07:09 AM
Post
#4
|
|
|
Trusted Helper Posts: 9,206 OS: Windows XP |
Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix.. Please visit HERE if you don't know how.. Please re-enable them back after performing all steps given..
Please download ComboFix by sUBs from one of the locations below, and save it to your Desktop. Double click combofix.exe and follow the prompts. Please, never rename Combofix unless instructed. If ComboFix asked you to install Recovery Console, please do so.. It will be your best interest.. When finished, it shall produce a log for you. Post that log and a fresh HijackThis log in your next reply.. Note: DON'T do anything with your computer while ComboFix is running.. Let ComboFix finishes its job.. |
|
|
|
|
Jul 4 2009, 08:15 PM
Post
#5
|
|
|
New Member Posts: 4 OS: windows vista |
Hi thanks so much for your reply
 I was able to run malwarebytes so I have included a copy of that log as well. The logs that follow are 1) Malwarebytes 2) ComboFix 3) OTL 4) Extras (From the OTL scan) Thanks a million: Malwarebytes' Anti-Malware 1.38 Database version: 2374 Windows 6.0.6001 Service Pack 1 7/4/2009 4:41:24 PM mbam-log-2009-07-04 (16-41-24).txt Scan type: Full Scan (C:\|D:\|K:\|) Objects scanned: 217794 Time elapsed: 59 minute(s), 12 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ComboFix 09-07-04.04 - Maxine 07/04/2009 18:48.1 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.2.1033.18.1790.1009 [GMT -7:00] Running from: c:\users\Maxine\Desktop\Back up\ComboFix.exe SP: Lavasoft Ad-Watch Live! *enabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22} SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\users\Maxine\AppData\Roaming\.# c:\users\Maxine\AppData\Roaming\.#\MBX@1378@692990.### c:\users\Maxine\AppData\Roaming\.#\MBX@1378@6929C0.### c:\users\Maxine\AppData\Roaming\.#\MBX@1378@6929F0.### c:\users\Maxine\AppData\Roaming\.#\MBX@700@17B2990.### c:\users\Maxine\AppData\Roaming\.#\MBX@700@17B29C0.### c:\users\Maxine\AppData\Roaming\.#\MBX@700@17B29F0.### c:\users\Maxine\AppData\Roaming\.#\MBX@9C4@272990.### c:\users\Maxine\AppData\Roaming\.#\MBX@9C4@2729C0.### c:\users\Maxine\AppData\Roaming\.#\MBX@9C4@2729F0.### c:\users\Maxine\AppData\Roaming\bcrypt.html c:\users\Maxine\AppData\Roaming\inst.exe . ((((((((((((((((((((((((( Files Created from 2009-06-05 to 2009-07-05 ))))))))))))))))))))))))))))))) . 2009-07-05 01:23 . 2009-07-05 01:23 -------- d-----w- c:\users\Maxine\AppData\Local\AVG Security Toolbar 2009-07-04 22:29 . 2009-07-05 01:39 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-07-04 22:29 . 2009-07-05 01:38 -------- d-----w- c:\programdata\Spybot - Search & Destroy 2009-07-04 22:27 . 2009-06-17 18:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-07-04 22:27 . 2009-06-17 18:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-07-04 22:26 . 2009-07-04 05:46 325128 ----a-w- c:\programdata\avg8\update\backup\avgldx86.sys 2009-07-04 22:26 . 2009-07-04 05:46 27656 ----a-w- c:\programdata\avg8\update\backup\avgmfx86.sys 2009-07-04 22:26 . 2009-07-04 05:46 107272 ----a-w- c:\programdata\avg8\update\backup\avgtdix.sys 2009-07-04 22:26 . 2009-07-04 05:46 10520 ----a-w- c:\programdata\avg8\update\backup\avgrsstx.dll 2009-07-04 22:26 . 2009-07-04 05:44 484120 ----a-w- c:\programdata\avg8\update\backup\avgrsx.exe 2009-07-04 22:21 . 2009-07-04 05:44 1419544 ----a-w- c:\programdata\avg8\update\backup\avgupd.dll 2009-07-04 22:21 . 2009-07-04 05:44 1032984 ----a-w- c:\programdata\avg8\update\backup\avgupd.exe 2009-07-04 22:21 . 2009-07-04 05:44 744728 ----a-w- c:\programdata\avg8\update\backup\avginet.dll 2009-07-04 22:21 . 2009-07-04 05:44 578840 ----a-w- c:\programdata\avg8\update\backup\avgiproxy.exe 2009-07-04 03:59 . 2009-07-04 05:14 680 ----a-w- c:\users\Maxine\AppData\Local\d3d9caps.dat 2009-07-04 03:35 . 2009-07-04 03:35 -------- d-----w- c:\programdata\SUPERAntiSpyware.com 2009-07-04 03:34 . 2009-07-04 03:34 -------- d-----w- c:\program files\SUPERAntiSpyware 2009-07-04 03:34 . 2009-07-04 03:34 -------- d-----w- c:\users\Maxine\AppData\Roaming\SUPERAntiSpyware.com 2009-07-04 02:25 . 2009-07-04 02:25 -------- d-----w- c:\users\Maxine\AppData\Roaming\Malwarebytes 2009-07-04 02:25 . 2009-07-04 02:25 -------- d-----w- c:\programdata\Malwarebytes 2009-07-04 02:23 . 2009-07-04 02:23 -------- d--h--w- c:\windows\PIF 2009-07-03 21:23 . 2009-07-03 21:23 -------- d-----w- c:\users\Maxine\AppData\Local\ESET 2009-07-03 21:19 . 2009-07-03 21:19 -------- d-----w- c:\program files\ESET 2009-07-03 20:51 . 2009-07-03 20:51 -------- d-----w- c:\program files\Spyware Doctor 2009-07-03 20:51 . 2009-07-03 20:51 -------- d-----w- c:\users\Maxine\AppData\Roaming\PC Tools 2009-07-03 20:44 . 2009-07-03 20:51 -------- d-----w- c:\users\Maxine\AppData\Roaming\GetRightToGo 2009-07-03 20:15 . 2009-07-04 22:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-07-03 19:57 . 2009-07-03 20:31 -------- d-----w- C:\Rooter$ 2009-07-03 19:55 . 2009-07-03 19:55 -------- d-----w- c:\program files\ERUNT 2009-07-03 18:47 . 2009-07-04 22:29 -------- d-----w- c:\program files\SpywareBlaster 2009-07-03 05:11 . 2009-07-03 06:02 -------- d-----w- c:\program files\Google Earth Pro 4.2 2009-06-30 21:15 . 2009-06-30 21:15 -------- d-----w- c:\programdata\vsosdk 2009-06-30 20:56 . 2009-06-30 20:56 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys 2009-06-30 20:56 . 2009-06-30 20:56 47360 ----a-w- c:\users\Maxine\AppData\Roaming\pcouffin.sys 2009-06-30 20:56 . 2009-06-30 20:57 -------- d-----w- c:\users\Maxine\AppData\Roaming\Vso 2009-06-30 20:56 . 2009-06-30 20:56 -------- d-----w- c:\program files\DVDFab 5 2009-06-28 20:03 . 2009-06-14 23:07 1004800 ----a-w- c:\programdata\AVG Security Toolbar\IEToolbar.dll 2009-06-26 19:03 . 2009-07-04 05:20 -------- d-----w- c:\programdata\AVG Security Toolbar 2009-06-26 02:15 . 2009-06-26 02:15 -------- d-----w- c:\programdata\LightScribe 2009-06-24 16:59 . 2009-06-26 02:15 -------- d-----w- c:\users\Maxine\AppData\Local\Ahead 2009-06-24 05:10 . 2009-06-24 05:10 -------- d-----w- c:\program files\Common Files\Adobe Systems Shared 2009-06-24 04:59 . 2009-06-26 02:15 -------- d-----w- c:\users\Maxine\AppData\Roaming\Ahead 2009-06-24 04:58 . 2009-06-24 04:58 -------- d-----w- c:\programdata\Nero 2009-06-24 04:58 . 2009-06-24 04:59 -------- d-----w- c:\program files\Common Files\Ahead 2009-06-24 04:58 . 2009-06-24 04:58 -------- d-----w- c:\program files\Nero 2009-06-24 04:51 . 2009-06-24 04:51 -------- d-----w- c:\program files\AskTBar 2009-06-24 04:39 . 2009-06-24 04:39 -------- d-----w- c:\windows\PCHEALTH 2009-06-24 04:39 . 2009-06-24 04:39 -------- d-----w- c:\program files\Microsoft.NET 2009-06-24 04:35 . 2009-06-24 04:35 -------- d--h--r- C:\MSOCache 2009-06-24 02:11 . 2009-07-03 19:03 -------- d-----w- c:\program files\The KMPlayer 2009-06-23 18:30 . 2009-06-23 18:30 -------- d-----w- c:\program files\uTorrent 2009-06-23 18:30 . 2009-07-05 01:46 -------- d-----w- c:\users\Maxine\AppData\Roaming\uTorrent 2009-06-23 06:59 . 2009-06-23 06:59 -------- d-----w- c:\program files\Tumble Bugs1 2009-06-23 06:55 . 2009-06-23 06:55 -------- d-----w- c:\program files\Trymedia 2009-06-23 06:55 . 2009-06-23 06:55 -------- d-----w- c:\program files\PopCap Games 2009-06-21 18:00 . 2009-06-21 18:00 456304 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb52D4.tmp.exe 2009-06-16 19:51 . 2009-04-30 12:37 293376 ----a-w- c:\windows\system32\psisdecd.dll 2009-06-16 19:51 . 2009-04-30 12:37 428544 ----a-w- c:\windows\system32\EncDec.dll 2009-06-11 06:40 . 2009-04-21 11:55 2033152 ----a-w- c:\windows\system32\win32k.sys 2009-06-11 06:40 . 2009-04-23 12:42 636928 ----a-w- c:\windows\system32\localspl.dll 2009-06-11 06:40 . 2009-04-23 12:43 784896 ----a-w- c:\windows\system32\rpcrt4.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-05 01:27 . 2009-02-11 11:05 -------- d-----w- c:\users\Maxine\AppData\Roaming\Skype 2009-07-05 00:44 . 2009-02-11 11:09 -------- d-----w- c:\users\Maxine\AppData\Roaming\skypePM 2009-07-05 00:03 . 2009-02-02 00:15 -------- d-----w- c:\programdata\Lavasoft 2009-07-04 22:26 . 2009-02-02 00:07 11952 ----a-w- c:\windows\system32\avgrsstx.dll 2009-07-04 22:26 . 2009-02-02 00:07 327688 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2009-07-04 22:26 . 2009-02-02 00:07 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2009-07-04 22:26 . 2009-02-02 00:07 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2009-07-04 05:43 . 2009-02-02 00:07 -------- d-----w- c:\programdata\avg8 2009-07-04 05:23 . 2009-02-04 05:32 -------- d-----w- c:\programdata\Google Updater 2009-07-04 05:20 . 2008-08-21 20:51 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-07-04 05:20 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender 2009-07-04 05:20 . 2009-02-02 00:07 -------- d-----w- c:\program files\AVG 2009-07-04 05:20 . 2009-02-01 23:17 -------- d-----w- c:\program files\AskBarDis 2009-07-04 05:20 . 2009-01-31 22:15 -------- d-----w- c:\program files\Google 2009-07-04 01:12 . 2009-02-02 00:07 -------- d-----w- c:\program files\AVG(4) 2009-07-02 07:06 . 2009-02-11 09:54 40 ----a-w- c:\windows\popcinfo.dat 2009-06-24 16:59 . 2009-01-31 22:20 92176 ----a-w- c:\users\Maxine\AppData\Local\GDIPFONTCACHEV1.DAT 2009-06-24 05:11 . 2008-08-21 21:10 -------- d-----w- c:\program files\Common Files\Adobe 2009-06-24 04:41 . 2008-08-21 21:28 -------- d-----w- c:\programdata\Microsoft Help 2009-06-24 04:40 . 2008-08-21 21:30 -------- d-----w- c:\program files\Microsoft Works 2009-06-23 07:17 . 2009-02-01 01:35 -------- d-----w- c:\users\Maxine\AppData\Roaming\Wildfire 2009-06-23 06:51 . 2008-08-21 21:34 -------- d-----w- c:\programdata\eSobi 2009-05-23 19:25 . 2009-05-11 06:47 -------- d-----w- c:\program files\Tumble Bugs 2009-05-20 09:37 . 2009-05-20 09:37 410984 ----a-w- c:\windows\system32\deploytk.dll 2009-05-20 09:37 . 2009-03-04 05:53 -------- d-----w- c:\program files\Java 2009-05-13 10:00 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail 2009-05-12 17:34 . 2008-08-21 21:14 -------- d-----w- c:\program files\Acer GameZone 2009-05-12 06:43 . 2009-05-10 08:18 -------- d-----w- c:\program files\RealArcade 2009-05-11 06:47 . 2009-05-11 06:47 -------- d-----w- c:\program files\ReflexiveArcade 2009-05-10 08:34 . 2009-05-10 08:34 -------- d-----w- c:\programdata\n7-89-o9-3r-4t-r9 2009-05-10 08:34 . 2009-05-10 08:34 -------- d-----w- c:\users\Maxine\AppData\Roaming\GameHouse 2009-05-10 08:20 . 2009-05-10 08:20 -------- d-----w- c:\programdata\Trymedia 2009-05-10 08:16 . 2009-05-10 07:54 -------- d-----w- c:\programdata\PopCap Games 2009-04-24 16:05 . 2009-06-11 06:39 827904 ----a-w- c:\windows\system32\wininet.dll 2009-04-24 16:02 . 2009-06-11 06:39 78336 ----a-w- c:\windows\system32\ieencode.dll 2009-04-24 13:44 . 2009-06-11 06:39 26624 ----a-w- c:\windows\system32\ieUnatt.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}] 2008-08-06 23:20 279944 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}] 2009-06-14 23:07 1004800 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2008-07-29 21:52 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952] "AROReminder"="c:\program files\Advanced Registry Optimizer\ARO.exe" [2008-08-23 2084480] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-31 68856] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] "uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-06-23 287536] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 147456] "WindowsWelcomeCenter"="oobefldr.dll" - c:\windows\System32\oobefldr.dll [2008-01-21 2153472] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Acer Empowering Technology Monitor"="c:\program files\Acer\Empowering Technology\SysMonitor.exe" [2008-06-02 319488] "EmpoweringTechnology"="c:\program files\Acer\Empowering Technology\Framework.Launcher.exe" [2008-06-02 319488] "eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-07-29 526896] "PCMMediaSharing"="c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe" [2008-05-20 204908] "BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-26 28672] "SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2007-02-02 630784] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "Acer Product Registration"="c:\program files\Acer\Acer Registration\ACE1.exe" [2007-11-26 3387392] "Acer Assist Launcher"="c:\program files\Acer\Acer Assist\launcher.exe" [2007-11-19 1261568] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-01-31 24064] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-07-04 1948440] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-20 148888] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648] "RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-05-20 6144000] "Skytel"="Skytel.exe" - c:\windows\SkyTel.exe [2007-11-20 1826816] c:\users\Maxine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-12-15 384000] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664] SmartCopy.lnk - c:\program files\Northstar\SmartCopy\SmartCopy.exe [2009-1-31 319488] SmartLauncher.lnk - c:\program files\Northstar\SmartLauncher\SmartLauncher.exe [2009-1-31 335872] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll c:\windows\System32\avgrsstx.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{4FF257E2-8DA1-423C-8ADC-D3CD5EE84238}"= c:\program files\Acer Arcade Live\Acer Arcade Live Main Page\Acer Arcade Live.exe:Acer Arcade Live "{3DCE4F0B-9440-424B-A11C-D5A8A01DD912}"= c:\program files\Acer Arcade Live\Acer DV Magician\Acer DV Magician.exe:Acer DV Magician "{7C79F679-C823-4843-8551-E73E8C073486}"= c:\program files\Acer Arcade Live\Acer SlideShow DVD\Acer SlideShow DVD.exe:Acer SlideShow DVD "{0A0E389D-24D6-4DDA-AFAD-587E4BB62F08}"= c:\program files\Acer Arcade Live\Acer VideoMagician\Acer VideoMagician.exe:Acer VideoMagician "{AD806E74-BAB7-4231-B43D-6CB289B4979E}"= c:\program files\Acer Arcade Live\Acer DVDivine\Acer DVDivine.exe:Acer DVDivine "{97222F74-B54E-4EC0-838A-069853766115}"= c:\program files\Acer Arcade Live\Acer HomeMedia\Acer HomeMedia.exe:Acer HomeMedia "{54DC69A9-BB83-414D-8112-5AE902213F67}"= c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Acer HomeMedia Connect.exe:Acer HomeMedia Connect "{48DBF2ED-C154-4FC8-858F-0FB56CE5D571}"= c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.EXE:Acer HomeMedia Connect Service "{10C7F800-4480-4E48-B0B9-C0A6CA64B302}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe "{14BDD307-5317-4E0D-84A8-87B13D6EC887}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe "{E7E93ABC-4BD8-4BB3-8E1E-BFC0C46E5BC4}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe "{F0ADCB6B-7437-4424-933D-2BE641DFF206}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe "{D3037421-728E-4207-9D55-5F760B562B31}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe "{3F85997D-C5B6-40D8-8529-7082D35CE815}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe "{597F2D8A-5530-40A9-905F-C713CE3B28CF}"= c:\program files\Acer Arcade Live\Acer HomeMedia Trial Creator\Acer HomeMedia Trial Creator.exe:Acer HomeMedia Trial Creator "{0F0528C3-7C87-48E2-A32D-90CEAE8D1056}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{614DFC16-7958-452D-BD0C-742E1694FC3A}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{A4A1D024-17C1-429C-A14B-39B354A22B8E}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe "{F62D6474-99D1-4F65-B928-797224E82B49}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe "{668BFA75-F1A7-4AFB-9219-AB35213C3737}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe "{23A15222-CDDA-48ED-9C75-F40555FFC22A}"= c:\program files\Skype\Phone\Skype.exe:Skype "TCP Query User{95FE5D7B-F799-428E-A848-8FB7DBC0E983}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{651707C1-5701-4FBD-961B-C192E5E88AA2}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox "{D64741B0-F2CC-4BE9-BDFE-906EB1530526}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In) "{5C56082B-F67D-415F-8936-D7507BD85117}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In) "{8036581F-1DEA-4EEE-A0AF-6C7D4650414E}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "TCP Query User{E2B21470-4991-487A-AB6E-A31061DE6DA8}c:\\users\\maxine\\desktop\\martin\\utorrent.exe"= UDP:c:\users\maxine\desktop\martin\utorrent.exe:utorrent.exe "UDP Query User{4E4E30C1-E36E-4722-884B-CC384509AD5F}c:\\users\\maxine\\desktop\\martin\\utorrent.exe"= TCP:c:\users\maxine\desktop\martin\utorrent.exe:utorrent.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile] "EnableFirewall"= 0 (0x0) R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [2/1/2009 5:17 PM 64160] R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [2/1/2009 5:07 PM 327688] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [2/1/2009 5:07 PM 108552] R2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [8/21/2008 2:07 PM 269448] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [7/4/2009 3:26 PM 906520] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [7/4/2009 3:26 PM 298776] R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [3/3/2008 10:11 AM 16384] R2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [8/21/2008 1:57 PM 24576] R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [4/25/2008 6:36 PM 45056] R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [4/25/2008 6:36 PM 131072] S2 gupdate1c9868a27ed0780;Google Update Service (gupdate1c9868a27ed0780);c:\program files\Google\Update\GoogleUpdate.exe [2/3/2009 10:33 PM 133104] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;"c:\program files\Lavasoft\Ad-Aware\AAWService.exe" --> c:\program files\Lavasoft\Ad-Aware\AAWService.exe [?] S3 GoogleDesktopManager-080708-050100;Google Desktop Manager 5.7.808.7150;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [1/31/2009 3:15 PM 24064] S3 WSVD;WSVD;c:\windows\System32\drivers\WSVD.sys [3/9/2009 12:46 AM 81704] . Contents of the 'Scheduled Tasks' folder 2009-07-05 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-01-31 02:44] 2009-07-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-02-04 05:33] 2009-07-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-02-04 05:33] . - - - - ORPHANS REMOVED - - - - HKLM-Run-Ad-Watch - c:\program files\Lavasoft\Ad-Aware\AAWTray.exe HKLM-Run-eRecoveryService - (no file) . ------- Supplementary Scan ------- . uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=1009&s=1&o=vp32&d=0109&m=aspire_m1201 mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=1009&s=1&o=vp32&d=0109&m=aspire_m1201 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\users\Maxine\AppData\Roaming\Mozilla\Firefox\Profiles\q873tpc8.default\ FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} ---- FIREFOX POLICIES ---- FF - user.js: yahoo.homepage.dontask - true. ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-04 18:52 Windows 6.0.6001 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-3048674895-893951821-1459171092-1000\¬ î**] @Allowed: (Read) (RestrictedCode) "MachineID"=hex:b2,ee,d9,82,05,47,55,00 DUMPHIVE0.003 (REGF) [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Completion time: 2009-07-05 18:53 ComboFix-quarantined-files.txt 2009-07-05 01:53 Pre-Run: 41,205,493,760 bytes free Post-Run: 41,126,248,448 bytes free 280 --- E O F --- 2009-07-04 05:26 OTL logfile created on: 7/4/2009 7:02:46 PM - Run 1 OTL by OldTimer - Version 3.0.6.4 Folder = C:\Users\Maxine\Desktop\Back up Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 7.0.6001.18000) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 1.75 Gb Total Physical Memory | 0.83 Gb Available Physical Memory | 47.53% Memory free 3.74 Gb Paging File | 2.61 Gb Available in Paging File | 69.70% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 113.36 Gb Total Space | 38.38 Gb Free Space | 33.86% Space Free | Partition Type: NTFS Drive D: | 170.08 Gb Total Space | 42.52 Gb Free Space | 25.00% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Drive K: | 149.01 Gb Total Space | 2.42 Gb Free Space | 1.62% Space Free | Partition Type: FAT32 Drive M: | 967.22 Mb Total Space | 584.38 Mb Free Space | 60.42% Space Free | Partition Type: FAT Computer Name: KWOMAIS Current User Name: Maxine Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Windows\System32\Ati2evxx.exe (ATI Technologies Inc.) PRC - C:\Windows\System32\Ati2evxx.exe (ATI Technologies Inc.) PRC - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe (CyberLink) PRC - C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe (NewTech Infosystems, Inc.) PRC - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated) PRC - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe () PRC - C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company) PRC - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe (NewTech InfoSystems, Inc.) PRC - C:\Program Files\AVG\AVG8\avgrsx.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files\AVG\AVG8\avgnsx.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe () PRC - C:\Program Files\CyberLink\Shared Files\RichVideo.exe () PRC - C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Windows\System32\WUDFHost.exe (Microsoft Corporation) PRC - C:\Program Files\AVG\AVG8\avgcsrvx.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Windows\System32\mobsync.exe (Microsoft Corporation) PRC - C:\Program Files\Acer\Empowering Technology\SysMonitor.exe () PRC - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated) PRC - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe () PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) PRC - C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.) PRC - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google) PRC - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Advanced Micro Devices Inc.) PRC - C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.) PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) PRC - C:\Windows\ehome\ehtray.exe (Microsoft Corporation) PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) PRC - C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) PRC - C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG) PRC - C:\Program Files\Northstar\SmartCopy\SmartCopy.exe () PRC - C:\Program Files\Northstar\SmartLauncher\SmartLauncher.exe (North Star com.) PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org) PRC - C:\Windows\ehome\ehmsas.exe (Microsoft Corporation) PRC - C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (Nero AG) PRC - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (ATI Technologies Inc.) PRC - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (Nero AG) PRC - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google) PRC - C:\Windows\System32\conime.exe (Microsoft Corporation) PRC - C:\Windows\Explorer.exe (Microsoft Corporation) PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Users\Maxine\Desktop\Back up\OTL.exe (OldTimer Tools) ========== Win32 Services (SafeList) ========== SRV - (Acer HomeMedia Connect Service [Auto | Running]) -- C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe (CyberLink) SRV - (Adobe LM Service [On_Demand | Stopped]) -- C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe (Adobe Systems) SRV - (Ati External Event Utility [Auto | Running]) -- C:\Windows\System32\Ati2evxx.exe (ATI Technologies Inc.) SRV - (avg8emc [Auto | Running]) -- C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.) SRV - (avg8wd [Auto | Running]) -- C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.) SRV - (BUNAgentSvc [Auto | Running]) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe (NewTech Infosystems, Inc.) SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (eDataSecurity Service [Auto | Running]) -- C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated) SRV - (ehRecvr [On_Demand | Stopped]) -- C:\Windows\ehome\ehRecvr.exe (Microsoft Corporation) SRV - (ehSched [On_Demand | Stopped]) -- C:\Windows\ehome\ehsched.exe (Microsoft Corporation) SRV - (ehstart [Auto | Stopped]) -- C:\Windows\ehome\ehstart.dll (Microsoft Corporation) SRV - (ETService [Auto | Running]) -- C:\Program Files\Acer\Empowering Technology\Service\ETService.exe () SRV - (Eventlog [Auto | Running]) -- C:\Windows\System32\wevtsvc.dll (Microsoft Corporation) SRV - (FontCache3.0.0.0 [On_Demand | Stopped]) -- C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation) SRV - (GoogleDesktopManager-080708-050100 [On_Demand | Stopped]) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google) SRV - (gupdate1c9868a27ed0780 [Auto | Stopped]) -- C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.) SRV - (gusvc [Auto | Stopped]) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google) SRV - (idsvc [Unknown | Stopped]) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation) SRV - (Lavasoft Ad-Aware Service [Auto | Stopped]) -- File not found SRV - (LightScribeService [Auto | Running]) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company) SRV - (NBService [On_Demand | Stopped]) -- C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe (Nero AG) SRV - (NetTcpPortSharing [Disabled | Stopped]) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation) SRV - (NMIndexingService [On_Demand | Running]) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (Nero AG) SRV - (NTIBackupSvc [Auto | Running]) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe (NewTech InfoSystems, Inc.) SRV - (NTISchedulerSvc [Auto | Running]) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe () SRV - (odserv [On_Demand | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation) SRV - (ose [On_Demand | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) SRV - (RichVideo [Auto | Running]) -- C:\Program Files\CyberLink\Shared Files\RichVideo.exe () SRV - (WinDefend [Auto | Running]) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SRV - (WMPNetworkSvc [On_Demand | Running]) -- C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (adp94xx [Disabled | Stopped]) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.) DRV - (adpahci [Disabled | Stopped]) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.) DRV - (adpu160m [Disabled | Stopped]) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.) DRV - (adpu320 [Disabled | Stopped]) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.) DRV - (ahcix86s [Boot | Running]) -- C:\Windows\system32\drivers\ahcix86s.sys (AMD Technologies Inc.) DRV - (aic78xx [Disabled | Stopped]) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.) DRV - (aliide [Disabled | Stopped]) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.) DRV - (arc [Disabled | Stopped]) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.) DRV - (arcsas [Disabled | Stopped]) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.) DRV - (atikmdag [On_Demand | Running]) -- C:\Windows\System32\DRIVERS\atikmdag.sys (ATI Technologies Inc.) DRV - (AtiPcie [Boot | Running]) -- C:\Windows\system32\DRIVERS\AtiPcie.sys (ATI Technologies Inc.) DRV - (AvgLdx86 [System | Running]) -- C:\Windows\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.) DRV - (AvgMfx86 [System | Running]) -- C:\Windows\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.) DRV - (AvgTdiX [System | Running]) -- C:\Windows\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.) DRV - (BrFiltLo [On_Demand | Stopped]) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.) DRV - (BrFiltUp [On_Demand | Stopped]) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.) DRV - (Brserid [Disabled | Stopped]) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.) DRV - (BrSerWdm [Disabled | Stopped]) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.) DRV - (BrUsbMdm [Disabled | Stopped]) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.) DRV - (BrUsbSer [On_Demand | Stopped]) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.) DRV - (cmdide [Disabled | Stopped]) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.) DRV - (E1G60 [On_Demand | Stopped]) -- C:\Windows\System32\DRIVERS\E1G60I32.sys (Intel Corporation) DRV - (elxstor [Disabled | Stopped]) -- C:\Windows\system32\drivers\elxstor.sys (Emulex) DRV - (HpCISSs [Disabled | Stopped]) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company) DRV - (iaStorV [Disabled | Stopped]) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation) DRV - (iirsp [Disabled | Stopped]) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (int15 [Auto | Running]) -- C:\Windows\System32\drivers\int15.sys (Acer, Inc.) DRV - (IntcAzAudAddService [On_Demand | Running]) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.) DRV - (iteatapi [Disabled | Stopped]) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.) DRV - (iteraid [Disabled | Stopped]) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.) DRV - (Lbd [Boot | Running]) -- C:\Windows\system32\DRIVERS\Lbd.sys (Lavasoft AB) DRV - (LSI_FC [Disabled | Stopped]) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic) DRV - (LSI_SAS [Disabled | Stopped]) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic) DRV - (LSI_SCSI [Disabled | Stopped]) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic) DRV - (megasas [Disabled | Stopped]) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation) DRV - (MegaSR [Disabled | Stopped]) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.) DRV - (MODEMCSA [On_Demand | Running]) -- C:\Windows\System32\drivers\MODEMCSA.sys (Microsoft Corporation) DRV - (Mraid35x [Disabled | Stopped]) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation) DRV - (nfrd960 [Disabled | Stopped]) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation) DRV - (NTIDrvr [On_Demand | Running]) -- C:\Windows\System32\DRIVERS\NTIDrvr.sys (NewTech Infosystems, Inc.) DRV - (ntrigdigi [Disabled | Stopped]) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies) DRV - (nvraid [Disabled | Stopped]) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation) DRV - (nvstor [Disabled | Stopped]) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation) DRV - (pcouffin [On_Demand | Running]) -- C:\Windows\System32\Drivers\pcouffin.sys (VSO Software) DRV - (PSDFilter [Boot | Running]) -- C:\Windows\system32\DRIVERS\psdfilter.sys (Egis Incorporated) DRV - (PSDNServ [Auto | Running]) -- C:\Windows\System32\DRIVERS\PSDNServ.sys (Egis Incorporated) DRV - (psdvdisk [Auto | Running]) -- C:\Windows\System32\DRIVERS\PSDVdisk.sys (Egis Incorporated) DRV - (ql2300 [Disabled | Stopped]) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation) DRV - (ql40xx [Disabled | Stopped]) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation) DRV - (secdrv [Auto | Running]) -- C:\Windows\System32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) DRV - (SiSRaid4 [Disabled | Stopped]) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems) DRV - (smserial [On_Demand | Running]) -- C:\Windows\System32\DRIVERS\smserial.sys (Motorola Inc.) DRV - (Symc8xx [Disabled | Stopped]) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic) DRV - (Sym_hi [Disabled | Stopped]) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic) DRV - (Sym_u3 [Disabled | Stopped]) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic) DRV - (tvicport [Auto | Running]) -- C:\Windows\System32\drivers\tvicport.sys (EnTech Taiwan) DRV - (UBHelper [Boot | Running]) -- C:\Windows\System32\drivers\UBHelper.sys (NewTech Infosystems Corporation) DRV - (uliahci [Disabled | Stopped]) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.) DRV - (UlSata [Disabled | Stopped]) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.) DRV - (ulsata2 [Disabled | Stopped]) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.) DRV - (viaide [Disabled | Stopped]) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.) DRV - (vsmraid [Disabled | Stopped]) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (WSVD [On_Demand | Stopped]) -- C:\Windows\System32\drivers\WSVD.sys (CyberLink) DRV - (yukonwlh [On_Demand | Running]) -- C:\Windows\System32\DRIVERS\yk60x86.sys (Marvell) DRV - (zntport [Auto | Running]) -- C:\Windows\System32\drivers\zntport.sys (Zeal SoftStudio) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a...;m=aspire_m1201 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://global.acer.com [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a...;m=aspire_m1201 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - URLSearchHook: *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Reg Error: Key error. File not found IE - URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll () IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:8.5 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13 FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:2.2.0.102 FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.5.200812101546 FF - prefs.js..extensions.enabledItems: avg@igeared:2.506.014.001 FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.11 FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG8\Firefox [2009/07/04 15:35:09 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG8\Toolbar\Firefox\avg@igeared [2009/07/04 15:35:09 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/06/12 10:21:00 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/06/23 21:40:11 | 00,000,000 | ---D | M] [2009/02/08 14:23:41 | 00,000,000 | ---D | M] -- C:\Users\Maxine\AppData\Roaming\mozilla\Extensions [2009/02/08 14:23:41 | 00,000,000 | ---D | M] -- C:\Users\Maxine\AppData\Roaming\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009/02/01 16:17:02 | 00,000,000 | ---D | M] -- C:\Users\Maxine\AppData\Roaming\mozilla\Firefox\extensions [2009/02/01 16:17:02 | 00,000,000 | ---D | M] -- C:\Users\Maxine\AppData\Roaming\mozilla\Firefox\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D} [2009/07/04 10:25:51 | 00,000,000 | ---D | M] -- C:\Users\Maxine\AppData\Roaming\mozilla\Firefox\Profiles\q873tpc8.default\extensions [2009/05/22 14:27:33 | 00,000,000 | ---D | M] -- C:\Users\Maxine\AppData\Roaming\mozilla\Firefox\Profiles\q873tpc8.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2008/11/24 15:50:50 | 00,000,838 | ---- | M] () -- C:\Users\Maxine\AppData\Roaming\Mozilla\FireFox\Profiles\q873tpc8.default\searchplugins\conduit.xml [2009/07/04 18:23:21 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions [2009/06/12 10:21:00 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009/02/11 02:11:42 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED} [2009/03/03 22:54:53 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} [2009/05/20 02:37:44 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [2009/06/12 10:20:59 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll [2009/06/12 10:20:59 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll [2007/04/10 17:21:08 | 00,163,256 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\np-mswmp.dll [2009/05/20 02:37:29 | 00,410,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeploytk.dll [2009/06/12 10:21:00 | 00,065,528 | ---- | M] (mozilla.org) -- C:\Program Files\mozilla firefox\plugins\npnul32.dll [2006/10/26 20:12:16 | 00,016,192 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL [2008/10/14 22:33:30 | 00,095,600 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2009/03/07 01:39:41 | 00,001,538 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml [2009/03/07 01:39:41 | 00,002,193 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml [2009/07/04 18:23:22 | 00,001,490 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg_igeared.xml [2009/02/20 17:25:41 | 00,002,194 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml [2009/03/07 01:39:41 | 00,000,947 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml [2009/03/07 01:39:41 | 00,001,534 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml [2009/03/07 01:39:41 | 00,000,759 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml [2009/03/07 01:39:41 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml [2009/03/07 01:39:41 | 00,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml [2009/03/07 01:39:41 | 00,000,831 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml O1 HOSTS File: (761 bytes) - C:\Windows\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com) O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll (Egis) O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll () O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll (Google Inc.) O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.) O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Ask Toolbar BHO) - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL File not found O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com) O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.) O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll () O3 - HKLM\..\Toolbar: (Ask Toolbar) - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL File not found O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.) O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com) O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll () O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {FE063DB9-4EC0-403E-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL File not found O4 - HKLM..\Run: [Acer Assist Launcher] C:\Program Files\Acer\Acer Assist\launcher.exe () O4 - HKLM..\Run: [Acer Empowering Technology Monitor] C:\Program Files\Acer\Empowering Technology\SysMonitor.exe () O4 - HKLM..\Run: [Acer Product Registration] File not found O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [BkupTray] C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe () O4 - HKLM..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe (Egis Incorporated) O4 - HKLM..\Run: [EmpoweringTechnology] C:\Program Files\Acer\Empowering Technology\Framework.Lau File not found O4 - HKLM..\Run: [Google Desktop Search] File not found O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [PCMMediaSharing] C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe () O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Skytel] C:\Windows\Skytel.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKCU..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe (Sammsoft) O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG) O4 - HKCU..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe (Microsoft Corporation) O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.) O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.DLL (Microsoft Corporation) O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (Microsoft Corporation) O4 - Startup: C:\Users\Maxine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet) O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files/Zuma/Images/stg_drm.ocx (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files/Tumblebugs/Images/armhelper.ocx (ArmHelper Control) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.154.133.68 75.154.133.100 O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com - No CLSID value found O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter: - x-sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.) O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google) O20 - AppInit_DLLs: (C:\Windows\System32\avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\Explorer.exe (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/09/18 14:43:36 | 00,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2009/07/03 09:53:32 | 00,000,383 | RHS- | M] () - M:\autorun.inf -- [ FAT ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\Windows\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - File not found ========== Files/Folders - Created Within 30 Days ========== [2009/07/04 18:53:36 | 00,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2009/07/04 18:47:50 | 00,000,000 | --SD | C] -- C:\ComboFix [2009/07/04 18:37:14 | 00,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe [2009/07/04 18:37:14 | 00,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe [2009/07/04 18:37:14 | 00,155,136 | ---- | C] () -- C:\Windows\PEV.exe [2009/07/04 18:37:14 | 00,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe [2009/07/04 18:37:14 | 00,098,816 | ---- | C] () -- C:\Windows\sed.exe [2009/07/04 18:37:14 | 00,080,412 | ---- | C] () -- C:\Windows\grep.exe [2009/07/04 18:37:14 | 00,068,096 | ---- | C] () -- C:\Windows\zip.exe [2009/07/04 18:37:14 | 00,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe [2009/07/04 18:37:09 | 00,000,000 | ---D | C] -- C:\Windows\ERDNT [2009/07/04 18:36:19 | 00,000,000 | ---D | C] -- C:\Qoobox [2009/07/04 18:36:13 | 00,000,000 | RHS- | C] () -- C:\MSDOS.SYS [2009/07/04 18:36:13 | 00,000,000 | RHS- | C] () -- C:\IO.SYS [2009/07/04 18:23:22 | 00,000,000 | ---D | C] -- C:\Users\Maxine\AppData\Local\AVG Security Toolbar [2009/07/04 17:03:53 | 00,000,000 | -HSD | C] -- C:\Config.Msi [2009/07/04 16:41:50 | 00,000,000 | ---D | C] -- C:\Users\Maxine\Desktop\Scans [2009/07/04 15:29:17 | 00,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy [2009/07/04 15:29:17 | 00,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy [2009/07/04 15:27:56 | 00,038,160 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2009/07/04 15:27:55 | 00,019,096 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2009/07/04 15:16:32 | 02,062,933 | -H-- | C] () -- C:\Users\Maxine\AppData\Local\IconCache.db [2009/07/03 22:46:23 | 00,001,651 | ---- | C] () -- C:\Users\Public\Desktop\AVG Free 8.0.lnk [2009/07/03 22:21:55 | 18,781,88032 | -HS- | C] () -- C:\hiberfil.sys [2009/07/03 20:59:54 | 00,000,680 | ---- | C] () -- C:\Users\Maxine\AppData\Local\d3d9caps.dat [2009/07/03 20:35:36 | 00,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com [2009/07/03 20:34:52 | 00,000,000 | ---D | C] -- C:\Users\Maxine\AppData\Roaming\SUPERAntiSpyware.com [2009/07/03 20:34:52 | 00,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware [2009/07/03 20:04:33 | 00,000,000 | ---D | C] -- C:\Users\Maxine\Desktop\2 [2009/07/03 19:59:36 | 00,000,000 | ---D | C] -- C:\Users\Maxine\Desktop\New Folder [2009/07/03 19:25:26 | 00,000,000 | ---D | C] -- C:\Users\Maxine\AppData\Roaming\Malwarebytes [2009/07/03 19:25:21 | 00,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2009/07/03 19:23:59 | 00,000,000 | -H-D | C] -- C:\Windows\PIF [2009/07/03 14:23:50 | 00,000,000 | ---D | C] -- C:\Users\Maxine\AppData\Local\ESET [2009/07/03 14:20:46 | 00,000,000 | ---D | C] -- C:\Users\Maxine\AppData\Roaming\ESET [2009/07/03 14:19:51 | 00,000,000 | ---D | C] -- C:\ProgramData\ESET [2009/07/03 14:19:51 | 00,000,000 | ---D | C] -- C:\Program Files\ESET [2009/07/03 13:51:12 | 00,000,000 | ---D | C] -- C:\Users\Maxine\AppData\Roaming\PC Tools [2009/07/03 13:51:12 | 00,000,000 | ---D | C] -- C:\Program Files\Spyware Doctor [2009/07/03 13:44:55 | 00,000,000 | ---D | C] -- C:\Users\Maxine\AppData\Roaming\GetRightToGo [2009/07/03 13:15:35 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2009/07/03 12:57:45 | 00,000,000 | ---D | C] -- C:\Users\Maxine\Desktop\nighmare [2009/07/03 12:57:14 | 00,000,000 | ---D | C] -- C:\Rooter$ [2009/07/03 12:55:33 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT [2009/07/03 11:47:22 | 00,000,000 | ---D | C] -- C:\Program Files\SpywareBlaster [2009/07/02 22:11:29 | 00,000,000 | ---D | C] -- C:\Program Files\Google Earth Pro 4.2 [2009/06/30 14:15:46 | 00,000,000 | ---D | C] -- C:\ProgramData\vsosdk [2009/06/30 13:58:56 | 00,000,000 | ---D | C] -- C:\Users\Maxine\Documents\DVDFab [2009/06/30 13:56:26 | 00,047,360 | ---- | C] (VSO Software) -- C:\Windows\System32\drivers\pcouffin.sys [2009/06/30 13:56:26 | 00,047,360 | ---- | C] (VSO Software) -- C:\Users\Maxine\AppData\Roaming\pcouffin.sys [2009/06/30 13:56:26 | 00,007,887 | ---- | C] () -- C:\Users\Maxine\AppData\Roaming\pcouffin.cat [2009/06/30 13:56:26 | 00,001,144 | ---- | C] () -- C:\Users\Maxine\AppData\Roaming\pcouffin.inf [2009/06/30 13:56:25 | 00,000,000 | ---D | C] -- C:\Users\Maxine\Documents\PcSetup [2009/06/30 13:56:25 | 00,000,000 | ---D | C] -- C:\Users\Maxine\AppData\Roaming\Vso [2009/06/30 13:56:08 | 00,000,000 | ---D | C] -- C:\Program Files\DVDFab 5 [2009/06/28 16:06:23 | 00,000,886 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2009/06/28 16:06:21 | 00,000,882 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2009/06/26 19:46:38 | 00,000,000 | ---D | C] -- C:\Users\Maxine\Desktop\Wedding Invite [2009/06/26 19:31:46 | 00,000,000 | ---D | C] -- C:\Users\Maxine\Documents\Updater [2009/06/26 17:05:44 | 00,000,000 | ---D | C] -- C:\Users\Maxine\Desktop\TV Series FEB 2009 [2009/06/26 12:03:40 | 00,000,000 | ---D | C] -- C:\ProgramData\AVG Security Toolbar [2009/06/25 22:34:52 | 00,000,000 | ---D | C] -- C:\Users\Maxine\AppData\Roaming\WinRAR [2009/06/25 22:30:08 | 00,000,000 | ---D | C] -- C:\Program Files\WinRAR [2009/06/25 19:15:26 | 00,000,000 | ---D | C] -- C:\ProgramData\LightScribe [2009/06/25 19:15:19 | 00,002,533 | ---- | C] () -- C:\Users\Maxine\Desktop\Nero StartSmart.lnk [2009/06/24 09:59:46 | 00,000,000 | ---D | C] -- C:\Users\Maxine\AppData\Local\Ahead [2009/06/23 22:28:45 | 00,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini [2009/06/23 22:11:16 | 00,001,156 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk [2009/06/23 22:11:08 | 00,000,000 | ---D | C] -- C:\Users\Public\Documents\Adobe PDF [2009/06/23 22:10:44 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe Systems Shared [2009/06/23 21:59:45 | 00,000,000 | ---D | C] -- C:\Users\Maxine\AppData\Roaming\Ahead [2009/06/23 21:58:26 | 00,000,000 | ---D | C] -- C:\ProgramData\Nero [2009/06/23 21:58:25 | 00,000,000 | ---D | C] -- C:\Program Files\Nero [2009/06/23 21:58:25 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Ahead [2009/06/23 21:56:41 | 02,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_30.dll [2009/06/23 21:56:40 | 02,323,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_28.dll [2009/06/23 21:51:44 | 00,000,000 | ---D | C] -- C:\Program Files\AskTBar [2009/06/23 21:39:45 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft Visual Studio [2009/06/23 21:39:45 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER [2009/06/23 21:39:21 | 00,000,000 | ---D | C] -- C:\Windows\PCHEALTH [2009/06/23 21:39:21 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET [2009/06/23 21:35:32 | 00,000,000 | RH-D | C] -- C:\MSOCache [2009/06/23 19:12:47 | 00,000,000 | ---D | C] -- C:\Users\Maxine\Documents\The KMPlayer [2009/06/23 19:11:40 | 00,000,776 | ---- | C] () -- C:\Users\Maxine\Desktop\KMPlayer.lnk [2009/06/23 19:11:34 | 00,000,000 | ---D | C] -- C:\Program Files\The KMPlayer [2009/06/23 11:30:54 | 00,000,000 | ---D | C] -- C:\Program Files\uTorrent [2009/06/23 11:30:32 | 00,000,000 | ---D | C] -- C:\Users\Maxine\AppData\Roaming\uTorrent [2009/06/22 23:59:30 | 00,000,000 | ---D | C] -- C:\Program Files\Tumble Bugs1 [2009/06/22 23:55:52 | 00,000,000 | ---D | C] -- C:\Program Files\Trymedia [2009/06/22 23:55:39 | 00,000,000 | ---D | C] -- C:\Program Files\PopCap Games [2009/06/22 23:54:37 | 00,000,000 | ---D | C] -- C:\Users\Maxine\Desktop\GaMES [2009/06/22 23:45:49 | 00,000,000 | ---D | C] -- C:\Users\Maxine\Desktop\Martin [2009/06/16 12:51:47 | 00,428,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll [2009/06/16 12:51:47 | 00,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisdecd.dll [2009/06/16 12:51:47 | 00,217,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisrndr.ax [2009/06/16 12:51:47 | 00,177,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mpg2splt.ax [2009/06/16 12:51:47 | 00,080,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSNP.ax [2009/06/10 23:40:07 | 02,033,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2009/06/10 23:40:06 | 00,636,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\localspl.dll [2009/06/10 23:40:04 | 00,784,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rpcrt4.dll [2009/06/10 23:39:59 | 03,581,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.dll [2009/06/10 23:39:58 | 06,069,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieframe.dll [2009/06/10 23:39:58 | 01,166,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\urlmon.dll [2009/06/10 23:39:58 | 00,827,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wininet.dll [2009/06/10 23:39:58 | 00,270,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iertutil.dll [2009/06/10 23:39:57 | 00,671,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll [2009/06/10 23:39:57 | 00,458,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2009/06/10 23:39:57 | 00,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec [2009/06/10 23:39:57 | 00,389,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2009/06/10 23:39:57 | 00,230,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll [2009/06/10 23:39:57 | 00,102,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\occache.dll [2009/06/10 23:39:57 | 00,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieencode.dll [2009/06/10 23:39:57 | 00,028,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2009/06/10 23:39:57 | 00,026,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2009/06/10 23:39:56 | 01,383,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2009/02/01 03:17:33 | 00,000,925 | ---- | C] () -- C:\Windows\wininit.ini [2009/01/31 15:28:59 | 00,000,042 | ---- | C] () -- C:\Windows\Acer(Wide).ini [2009/01/31 15:28:56 | 00,000,044 | ---- | C] () -- C:\Windows\Acer(Normal).ini [2008/08/21 17:11:21 | 00,049,152 | ---- | C] ( ) -- C:\Windows\Interop.IWshRuntimeLibrary.dll [2008/08/21 17:10:21 | 00,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll [2008/08/21 14:09:23 | 00,001,024 | RH-- | C] () -- C:\Windows\System32\NTIOFM4.dll [2008/08/21 14:09:23 | 00,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN5.dll [2008/08/21 13:57:51 | 00,487,424 | ---- | C] () -- C:\Windows\System32\INT15.dll [2006/11/02 05:35:32 | 00,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006/11/02 03:23:31 | 00,000,219 | ---- | C] () -- C:\Windows\win.ini [2006/11/02 03:23:31 | 00,000,215 | ---- | C] () -- C:\Windows\system.ini [2006/11/02 00:40:29 | 00,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2001/12/26 13:12:30 | 00,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll [2001/09/03 20:46:38 | 00,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll [2001/07/30 13:33:56 | 00,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll [2001/07/23 19:04:36 | 00,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll ========== Files - Modified Within 30 Days ========== [2009/07/04 18:52:17 | 00,000,215 | ---- | M] () -- C:\Windows\system.ini [2009/07/04 18:47:44 | 00,095,744 | ---- | M] () -- C:\Users\Maxine\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009/07/04 18:47:44 | 00,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini [2009/07/04 18:44:46 | 00,690,960 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2009/07/04 18:44:46 | 00,599,942 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2009/07/04 18:44:46 | 00,105,448 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2009/07/04 18:42:34 | 00,000,868 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job [2009/07/04 18:40:37 | 00,001,594 | ---- | M] () -- C:\Users\Maxine\Desktop\Clean Registry for Free!.lnk [2009/07/04 18:40:22 | 00,000,000 | ---- | M] () -- C:\Windows\System32\LogConfigTemp.xml [2009/07/04 18:40:13 | 00,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2009/07/04 18:40:13 | 00,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2009/07/04 18:40:12 | 00,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2009/07/04 18:40:10 | 00,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2009/07/04 18:40:07 | 00,067,584 | ---- | M] () -- C:\Windows\bootstat.dat [2009/07/04 18:40:05 | 18,781,88032 | -HS- | M] () -- C:\hiberfil.sys [2009/07/04 18:39:00 | 02,062,933 | -H-- | M] () -- C:\Users\Maxine\AppData\Local\IconCache.db [2009/07/04 18:36:13 | 00,000,000 | RHS- | M] () -- C:\MSDOS.SYS [2009/07/04 18:36:13 | 00,000,000 | RHS- | M] () -- C:\IO.SYS [2009/07/04 18:11:45 | 00,000,925 | ---- | M] () -- C:\Windows\wininit.ini [2009/07/04 18:11:00 | 00,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2009/07/04 15:26:10 | 37,766,946 | ---- | M] () -- C:\Windows\System32\drivers\Avg\incavi.avm [2009/07/04 15:26:09 | 00,463,779 | ---- | M] () -- C:\Windows\System32\drivers\Avg\miniavi.avg [2009/07/04 15:26:09 | 00,327,688 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgldx86.sys [2009/07/04 15:26:09 | 00,027,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgmfx86.sys [2009/07/04 15:26:09 | 00,012,666 | ---- | M] () -- C:\Windows\System32\drivers\Avg\microavi.avg [2009/07/04 15:26:09 | 00,011,952 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\avgrsstx.dll [2009/07/04 15:26:06 | 00,108,552 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Windows\System32\drivers\avgtdix.sys [2009/07/03 22:46:23 | 00,001,651 | ---- | M] () -- C:\Users\Public\Desktop\AVG Free 8.0.lnk [2009/07/03 22:14:52 | 00,000,680 | ---- | M] () -- C:\Users\Maxine\AppData\Local\d3d9caps.dat [2009/07/02 00:06:18 | 00,000,040 | ---- | M] () -- C:\Windows\popcinfo.dat [2009/06/30 13:56:26 | 00,047,360 | ---- | M] (VSO Software) -- C:\Windows\System32\drivers\pcouffin.sys [2009/06/30 13:56:26 | 00,047,360 | ---- | M] (VSO Software) -- C:\Users\Maxine\AppData\Roaming\pcouffin.sys [2009/06/30 13:56:26 | 00,007,887 | ---- | M] () -- C:\Users\Maxine\AppData\Roaming\pcouffin.cat [2009/06/30 13:56:26 | 00,001,144 | ---- | M] () -- C:\Users\Maxine\AppData\Roaming\pcouffin.inf [2009/06/25 19:15:19 | 00,002,533 | ---- | M] () -- C:\Users\Maxine\Desktop\Nero StartSmart.lnk [2009/06/24 09:59:49 | 00,092,176 | ---- | M] () -- C:\Users\Maxine\AppData\Local\GDIPFONTCACHEV1.DAT [2009/06/24 09:58:49 | 00,350,080 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2009/06/23 22:11:16 | 00,001,156 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk [2009/06/23 21:36:40 | 00,000,219 | ---- | M] () -- C:\Windows\win.ini [2009/06/23 19:12:40 | 00,000,776 | ---- | M] () -- C:\Users\Maxine\Desktop\KMPlayer.lnk [2009/06/23 13:33:07 | 00,001,975 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2009/06/17 11:27:56 | 00,038,160 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2009/06/17 11:27:44 | 00,019,096 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2009/06/08 08:10:10 | 00,155,136 | ---- | M] () -- C:\Windows\PEV.exe ========== Alternate Data Streams ========== @Alternate Data Stream - 94 bytes -> C:\ProgramData\TEMP:C5E4F943 @Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:B623B5B8 @Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:5C321E34 @Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:793F316E @Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:8AB6C1D7 @Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:FC420CE6 @Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:DF30C7A6 @Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:D509ABF5 @Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:3E7393FC @Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:6D192E3A @Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:9F683177 @Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:2EF63291 @Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:DFC5A2B2 @Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:0C988F7D @Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:19DEDE0B < End of report > OTL Extras logfile created on: 7/4/2009 7:02:49 PM - Run 1 OTL by OldTimer - Version 3.0.6.4 Folder = C:\Users\Maxine\Desktop\Back up Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 7.0.6001.18000) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 1.75 Gb Total Physical Memory | 0.83 Gb Available Physical Memory | 47.53% Memory free 3.74 Gb Paging File | 2.61 Gb Available in Paging File | 69.70% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 113.36 Gb Total Space | 38.38 Gb Free Space | 33.86% Space Free | Partition Type: NTFS Drive D: | 170.08 Gb Total Space | 42.52 Gb Free Space | 25.00% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Drive K: | 149.01 Gb Total Space | 2.42 Gb Free Space | 1.62% Space Free | Partition Type: FAT32 Drive M: | 967.22 Mb Total Space | 584.38 Mb Free Space | 60.42% Space Free | Partition Type: FAT Computer Name: KWOMAIS Current User Name: Maxine Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 "FirewallDisableNotify" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 Reg Error: Unknown registry data type File not found [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0025DA8D-F344-E316-885A-2D71C66B0FB1}" = Catalyst Control Center Localization Norwegian "{0134A1A1-C283-4A47-91A1-92F19F960372}" = Adobe Creative Suite 2 "{01B0503D-45A2-CCA2-44DF-C716B80B7EB6}" = Catalyst Control Center Graphics Light "{0C74BC57-4128-D428-D4A5-267F66C80C7C}" = CCC Help German "{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard "{132888AE-EF67-41C5-BCA2-7D5D2488AB63}" = Acer HomeMedia Connect "{13D85C14-2B85-419F-AC41-C7F21E68B25D}" = Acer eSettings Management "{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2 "{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer "{1AEB447A-34B8-7DB5-67B8-1E54DADD6572}" = Catalyst Control Center Localization Polish "{1B897B3A-57C2-DF09-C6CC-E6B9FA0AC44F}" = CCC Help Thai "{2037D7FD-6401-DDC7-A499-2FDF9ADCD04F}" = CCC Help Turkish "{21AD8584-EDAC-7D00-71CC-79D111C5B27B}" = CCC Help Italian "{2295D7EE-0575-D2CC-E52A-102F2AF01169}" = CCC Help Russian "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer "{236BB7C4-4419-42FD-0C0A-1E257A25E34D}" = Adobe Photoshop CS2 "{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8 "{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0 "{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java™ 6 Update 13 "{2ED84754-62AA-80F6-E434-9C03FF1D4221}" = Catalyst Control Center Localization Korean "{30965141-4363-2683-885F-4A35810A382B}" = CCC Help Portuguese "{311D49FD-6B52-D68F-CFBC-796F22554404}" = Catalyst Control Center Localization Dutch "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7 "{3AD4FFEC-0DEC-5037-C92F-C294FEA8F320}" = Catalyst Control Center Localization Hungarian "{3C71054A-352C-4ABD-5643-4C8F8617AE08}" = CCC Help Danish "{3FE1C3BB-91B1-119B-47FE-49143E2AD10B}" = CCC Help Spanish "{41581EF5-45A7-11DA-9D78-000129760D75}" = Acer SlideShow DVD "{4677674C-59CE-41B0-AA32-44A30A9D1EEB}" = Catalyst Control Center - Branding "{48EF56FD-3B28-DEB7-7C63-85908395E6A6}" = Catalyst Control Center Localization Spanish "{4C7F547E-DDE3-51BF-1D2E-04816F30AD66}" = ATI Catalyst Install Manager "{4F896C8E-8AEF-4C27-31CD-56E6E200FAB4}" = CCC Help Dutch "{53C436CD-155C-6159-D12B-55967DAB8887}" = CCC Help Norwegian "{57634571-FD82-4BEC-B822-A1ED7765474F}_is1" = SmartLauncher "{5E396C14-A2E0-3F7B-42FE-15569155234A}" = CCC Help Chinese Standard "{60245C29-8A73-CF88-275F-A79BA580E748}" = CCC Help Korean "{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites "{68F2FB07-4F60-734A-46FD-493A109D1514}" = CCC Help English "{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin "{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works "{6FD29E18-619D-259B-948F-3A65967486A3}" = ccc-core-static "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{77FB2697-2C28-9572-6452-F2418A33834E}" = Catalyst Control Center Localization Russian "{786C5747-1437-443D-B06E-79A00FE45110}" = Adobe Stock Photos 1.0 "{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver "{7CC14E1A-17B4-27A6-2086-2A52BCC16A16}" = Catalyst Control Center Localization Italian "{7D30776C-F30F-4207-6A82-EF0E1D6DCD23}" = CCC Help Chinese Traditional "{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management "{8011B8CD-CD37-5B5D-4423-78D358B70C21}" = ccc-utility "{804AB28B-F929-370A-B3AB-5BB99DFD73DF}" = Catalyst Control Center Localization Chinese Standard "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110113233}" = Bookworm Deluxe "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11029123}" = Bricks of Egypt "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110322783}" = Big Kahuna Reef "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110411970}" = Chuzzle "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111199750}" = Cake Mania "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111252743}" = Mahjong Escape Ancient China "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111324990}" = Kick N Rush "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111543617}" = Backspin Billiards "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111692950}" = Mahjongg Artifacts "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112310577}" = Flip Words 2 "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112615863}" = Agatha Christie Death on the Nile "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}" = Alice Greenfingers "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113009953}" = Turbo Pizza "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113080210}" = Azada "{84E98285-BEC0-8C52-EB74-10C281737023}" = Catalyst Control Center Localization Portuguese "{862673D1-8F64-A109-47A9-CD5CFAABBD2A}" = Catalyst Control Center Localization Finnish "{89EFA70F-87DF-4B19-6366-77B9D693C20E}" = CCC Help Swedish "{8DB9E645-E6DB-A4BB-B18A-265435D13274}" = Catalyst Control Center Graphics Full Existing "{8E62F311-A40C-A7B3-C595-FE1E17D838F8}" = Skins "{8EDBA74D-0686-4C99-BFDD-F894678E5103}" = Adobe Common File Installer "{8F1B6239-FEA0-450A-A950-B05276CE177C}" = Acer Empowering Technology "{90120000-0015-0C0A-0000-0000000FF1CE}" = Microsoft Office Access MUI (Spanish) 2007 "{90120000-0016-0C0A-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Spanish) 2007 "{90120000-0018-0C0A-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Spanish) 2007 "{90120000-0019-0C0A-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Spanish) 2007 "{90120000-001A-0C0A-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Spanish) 2007 "{90120000-001B-0C0A-0000-0000000FF1CE}" = Microsoft Office Word MUI (Spanish) 2007 "{90120000-001F-0403-0000-0000000FF1CE}" = Microsoft Office Proof (Catalan) 2007 "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-0416-0000-0000000FF1CE}" = Microsoft Office Proof (Portuguese (Brazil)) 2007 "{90120000-001F-042D-0000-0000000FF1CE}" = Microsoft Office Proof (Basque) 2007 "{90120000-001F-0456-0000-0000000FF1CE}" = Microsoft Office Proof (Galician) 2007 "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007 "{90120000-002C-0C0A-0000-0000000FF1CE}" = Microsoft Office Proofing (Spanish) 2007 "{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007 "{90120000-0044-0C0A-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Spanish) 2007 "{90120000-006E-0C0A-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Spanish) 2007 "{90120000-00A1-0C0A-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Spanish) 2007 "{90120000-00BA-0C0A-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Spanish) 2007 "{901DD5DE-0798-883F-8B23-55D3843F3E59}" = Catalyst Control Center Localization Turkish "{92933B9E-3273-9DD6-7F47-EB6DD029C6AC}" = Catalyst Control Center Localization Chinese Traditional "{954513A8-AAE3-97E9-1FB8-A1D70FD1A549}" = CCC Help Greek "{9738C893-02C6-6694-DD7B-D50CC8D57248}" = Catalyst Control Center Core Implementation "{9A3D392C-B0BB-400A-A761-4B1497911033}" = Nero 7 Ultra Edition "{9DF93979-12BD-D361-0624-9025215FD8B5}" = CCC Help Finnish "{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable "{A4BEC8AC-0E57-E1F8-C3C5-01ED0F27ECB9}" = Catalyst Control Center Localization French "{A5633652-3795-4829-BB0B-644F0279E279}" = Acer eDataSecurity Management "{A91FB756-A9B5-7A88-7637-21B3061B97A7}" = Catalyst Control Center Graphics Full New "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AA4BF92B-2AAF-11DA-9D78-000129760D75}" = Acer HomeMedia "{AC4451B3-1CC2-7C5D-F0EC-AD2DADE9DFF2}" = CCC Help Japanese "{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.4 "{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8 "{AC9450D2-2344-132D-AAA8-DB418BC6F3E5}" = CCC Help Hungarian "{B145EC69-66F5-11D8-9D75-000129760D75}" = Acer DVDivine "{B2F6A8F0-927A-D0CC-D1CB-FCEBD7528799}" = Catalyst Control Center Localization Czech "{B580C409-E16F-44FF-904D-3AE94E113BE0}" = Acer HomeMedia Trial Creator "{B74D4E10-6884-0000-0000-000000000101}" = Adobe Bridge 1.0 "{B7BD291B-D415-4484-89A4-82077504BE93}_is1" = SmartCopy "{C0AF881D-EB63-A1D6-F29A-1EAD7BAEDB95}" = Catalyst Control Center Localization Japanese "{C49624DD-C504-4279-B9E0-65A2EB6E1619}" = PG583_32_inf "{C49DAA9C-5BA8-459A-8244-E57B69DF0F04}" = Suite Specific "{C75252FF-A765-B58A-44D1-D10C24E69E59}" = Catalyst Control Center Localization Thai "{CAAF4EB9-68E8-6BC9-ADC2-24491B70A84D}" = Catalyst Control Center Graphics Previews Vista "{CC016F21-3970-11DE-B878-005056806466}" = Google Earth "{CC25FBAD-153D-0EB7-5EC5-0DE97A7A8788}" = Catalyst Control Center Localization Danish "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe 1.4.142.1 "{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader "{E9787678-551D-4478-9682-DBB587257110}" = Adobe Help Center 1.0 "{EA34B5D9-A3C9-333A-B1CD-ABCC975FB5EF}" = CCC Help French "{EBCDE4F2-C6F7-1188-DDE7-15966902EC6A}" = Catalyst Control Center Localization Swedish "{EFBDC2B0-FAA8-4B78-8DE1-AEBE7958FA37}" = Acer Arcade Live Main Page "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729) "{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01 "{F44DA61E-720D-4E79-871F-F6E628B33242}" = OpenOffice.org 3.0 "{F66208C6-E88B-27B6-9C49-09E78739F017}" = Catalyst Control Center Localization German "{F6EFFB76-4A07-11DA-9D78-000129760D75}" = Acer DV Magician "{F79A208D-D929-11D9-9D77-000129760D75}" = Acer VideoMagician "{F9E0767F-6DB6-9B56-3BEF-50BAFC430934}" = Catalyst Control Center Localization Greek "{FCB5EE95-A308-F826-9C6B-18DD2EEA1992}" = CCC Help Polish "{FE8A68F6-3C7C-D143-F898-C6C1F26CB41E}" = CCC Help Czech "Acer Assist" = Acer Assist "Acer GameZone Console_is1" = Acer GameZone Console DTV 2.0.1.1 "Acer Registration" = Acer Registration "Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites "Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Advanced Registry Optimizer_is1" = Advanced Registry Optimizer "Ask Toolbar_is1" = Ask Toolbar "AVG8Uninstall" = AVG Free 8.0 "D7EC1A6C98F357A7E4C53FF66325D99F66B1F590" = Windows Driver Package - YUAN High-Tech Development Co. Ltd. (OmniTV) Media (12/14/2007 6.1.32.42) "DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile) 5_is1" = DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile) 5.2.5.0 "ENTERPRISE" = Microsoft Office Enterprise 2007 "GameHouse" = GameHouse "GOM Player" = GOM Player "Google Chrome" = Google Chrome "Google Desktop" = Google Desktop "Google Updater" = Google Updater "InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5 "InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2 "InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8 "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Mozilla Firefox (3.0.11)" = Mozilla Firefox (3.0.11) "ShockwaveFlash" = Adobe Flash Player 9 ActiveX "SMSERIAL" = Motorola SM56 Speakerphone Modem "SpywareBlaster_is1" = SpywareBlaster 4.2 "The KMPlayer" = The KMPlayer (remove only) "Tumble Bugs_is1" = Tumble Bugs "WinRAR archiver" = Compresor WinRAR "Zuma Deluxe 1.0" = Zuma Deluxe 1.0 ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "uTorrent" = µTorrent ========== Last 10 Event Log Errors ========== Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt! < End of report > |
|
|
|
|
Jul 4 2009, 10:18 PM
Post
#6
|
|
|
Trusted Helper Posts: 9,206 OS: Windows XP |
OTListIt2 Fix step
Open OTL then do below.. Copy/paste the following into the Costum Scans/Fixes box and then click on Run Fix button. CODE :processes explorer.exe :OTL @Alternate Data Stream - 94 bytes -> C:\ProgramData\TEMP:C5E4F943 @Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:B623B5B8 @Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:5C321E34 @Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:793F316E @Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:8AB6C1D7 @Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:FC420CE6 @Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:DF30C7A6 @Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:D509ABF5 @Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:3E7393FC @Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:6D192E3A @Alternate Data Stream - 108 bytes -> C:\ProgramData\TEMP:9F683177 @Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:2EF63291 @Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:DFC5A2B2 @Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:0C988F7D @Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:19DEDE0B :commands [purity] [emptytemp] [start explorer] [reboot] Let it run the fix. A log will then pop-up to your screen after the fix finish.. If it needs a reboot, just let it.. Post that log in your next reply... Please run a free online scan with the ESET Online Scanner Note: You will need to use Internet Explorer for this scan.
How's the computer now? 
|
|
|
|
|
Jul 5 2009, 12:09 PM
Post
#7
|
|
|
New Member Posts: 4 OS: windows vista |
Thanks alot. Feels like I'm getting my mom's computer back! I'll let you you know how it's running after a test run.
Here is the online ESET log file: ESETSmartInstaller@High as downloader log: all ok ESETSmartInstaller@High as downloader log: all ok # version=6 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.5863 # api_version=3.0.2 # EOSSerial=d2b6fa2f2dd65c4ca174e29846b8c310 # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2009-07-05 06:03:46 # local_time=2009-07-05 11:03:46 (-0800, Pacific Daylight Time) # country="United States" # lang=1033 # osver=6.0.6001 NT Service Pack 1 # compatibility_mode=1026 61 100 100 53441344003 # compatibility_mode=5889 61 66 100 459348134805687 # compatibility_mode=0 0 0 0 0 # scanned=127391 # found=3 # cleaned=3 # scan_time=3329 C:\Program Files\Acer Arcade Live\Acer HomeMedia Trial Creator\Export\SoftDMA_Trial\Autorun.inf INF/Autorun.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 K:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP165\A0064103.exe Win32/HackAV.BG application (cleaned by deleting - quarantined) 00000000000000000000000000000000 K:\UTorrent\COMPLETE\Beetle Bomp + Serpengo+ Bone Out from Boneville + Zuma Deluxe + Lemonade Tycoon 2 [found with kelforum.com ].rar Win32/Adware.Trymedia application (deleted - quarantined) 00000000000000000000000000000000 |
|
|
|
|
Jul 5 2009, 11:25 PM
Post
#8
|
|
|
Trusted Helper Posts: 9,206 OS: Windows XP |
Looks good to me.. Open OTL once again and click on the CleanUp! button.. Then, everything should be good to go..
Please response once again before we can close this topic
|
|
|
|
|
Jul 6 2009, 10:05 AM
Post
#9
|
|
|
New Member Posts: 4 OS: windows vista |
Yeah everything looks good! Thanks so much, awesome helper, awesome service, really great, moebius |
|
|
|
|
Jul 7 2009, 12:55 AM
Post
#10
|
|
|
Trusted Helper Posts: 9,206 OS: Windows XP |
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic. |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
Similar Topics
| Topic Title | Replies / Views | Topic Information | |||||
|---|---|---|---|---|---|---|---|
 |
1 / 1,079 | 11th June 2009 - 09:19 PM dezerbois started - last by dezerbois |
|||||
 |
 |
50 / 2,599 | 3rd September 2009 - 07:31 PM lttl.espana started - last by JSntgRvr |
||||
|
14 / 359 | 4th August 2009 - 11:00 PM jdugan83 started - last by fenzodahl512 |
|||||
|
2 / 398 | 29th July 2009 - 01:14 PM Kelly O started - last by Essexboy |
|||||
|
Time is now: 7th November 2009 - 09:15 PM |
Advertisements do not imply our endorsement of that product or service. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks mentioned on this page are the property of their respective owners.
© Geeks to Go, Inc. | All Rights Reserved | Privacy Policy | Advertising