http://www.geekstogo...82#entry1754782
...as per cbarnard's request. Apologies for not posting in this area of the forum right from the get-go, but I was pretty sure I didn't have an infection so that's why I didn't post here to begin with.
Anyway I followed the spyware/malware/blah removal guide. I am putting the logs in code boxes for your sanity. You will thank me.
Firstly, the MBAM log. Very brief and tells me what I already knew:
Database version _linenums:3681'>Malwarebytes' Anti-Malware 1.44Database version: 3681Windows 5.1.2600 Service Pack 3Internet Explorer 8.0.6001.187023/02/2010 7:47:51 PMmbam-log-2010-02-03 (19-47-51).txtScan type: Quick ScanObjects scanned: 133976Time elapsed: 4 minute(s), 40 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected)
Here's the OTL log. Read at your own risk. It seems very interested in files that are on my desktop for some reason.
OTL logfile created on: 3/02/2010 7:51:18 PM - Run 2OTL by OldTimer - Version 3.1.27.1 Folder = C:\Documents and Settings\Smegma Fondue\My Documents\DownloadsWindows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstationInternet Explorer (Version = 8.0.6001.18702)Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy 1,022.00 Mb Total Physical Memory | 252.00 Mb Available Physical Memory | 25.00% Memory free2.00 Gb Paging File | 2.00 Gb Available in Paging File | 69.00% Paging File freePaging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program FilesDrive C: | 149.04 Gb Total Space | 37.48 Gb Free Space | 25.15% Space Free | Partition Type: NTFSD: Drive not present or media not loadedDrive E: | 127.99 Gb Total Space | 2.53 Gb Free Space | 1.98% Space Free | Partition Type: NTFSF: Drive not present or media not loadedDrive G: | 37.26 Gb Total Space | 9.07 Gb Free Space | 24.36% Space Free | Partition Type: FAT32H: Drive not present or media not loadedI: Drive not present or media not loaded Computer Name: [bleep]2Current User Name: Smegma FondueLogged in as Administrator. Current Boot Mode: NormalScan Mode: Current userCompany Name Whitelist: OnSkip Microsoft Files: OnFile Age = 14 DaysOutput = StandardQuick Scan ========== Processes (SafeList) ========== PRC - [2010/02/03 15:50:07 | 000,548,864 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Smegma Fondue\My Documents\Downloads\OTL.exePRC - [2010/01/07 10:40:41 | 000,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exePRC - [2010/01/05 07:56:02 | 002,002,160 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exePRC - [2009/12/28 14:38:15 | 000,188,968 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrB.exePRC - [2009/11/28 00:58:38 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exePRC - [2009/11/28 00:58:38 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exePRC - [2009/10/24 12:35:59 | 001,217,808 | ---- | M] (Valve Corporation) -- C:\Program Files\Steam\Steam.exePRC - [2009/07/05 00:27:50 | 000,075,064 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exePRC - [2009/03/02 14:08:47 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exePRC - [2009/01/15 08:19:00 | 000,163,908 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exePRC - [2008/07/02 16:16:20 | 000,393,216 | ---- | M] (Sony Ericsson Mobile Communications AB) -- C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exePRC - [2008/04/14 10:42:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exePRC - [2008/02/18 11:16:30 | 000,110,592 | ---- | M] (Apple, Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exePRC - [2007/07/24 15:17:08 | 000,229,376 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exePRC - [2005/07/09 00:55:10 | 001,397,760 | ---- | M] (Nero AG) -- C:\Program Files\Ahead\InCD\InCD.exePRC - [2005/07/08 17:24:46 | 000,871,424 | ---- | M] (Nero AG) -- C:\Program Files\Ahead\InCD\InCDsrv.exePRC - [2005/01/12 03:01:32 | 000,032,768 | ---- | M] (Cyberlink Corp.) -- C:\Program Files\CyberLink\PowerDVD\PDVDServ.exePRC - [2004/01/09 13:13:38 | 000,401,408 | ---- | M] () -- C:\Program Files\ALIRAID\ALiRaid.exe ========== Modules (SafeList) ========== MOD - [2010/02/03 15:50:07 | 000,548,864 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Smegma Fondue\My Documents\Downloads\OTL.exe ========== Win32 Services (SafeList) ========== SRV - [2009/12/28 14:38:15 | 000,188,968 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\PnkBstrB.exe -- (PnkBstrB)SRV - [2009/11/28 00:58:38 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)SRV - [2009/11/28 00:58:38 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)SRV - [2009/09/01 15:32:53 | 000,152,984 | ---- | M] (Sun Microsystems, Inc.) [On_Demand | Stopped] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService)SRV - [2009/07/05 00:27:50 | 000,075,064 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\PnkBstrA.exe -- (PnkBstrA)SRV - [2009/01/15 08:19:00 | 000,163,908 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc)SRV - [2008/02/19 13:10:24 | 000,504,104 | ---- | M] (Apple Inc.) [On_Demand | Stopped] -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service)SRV - [2008/02/18 11:16:30 | 000,110,592 | ---- | M] (Apple, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)SRV - [2007/10/25 16:27:54 | 000,266,240 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\installer\WLSetupSvc.exe -- (WLSetupSvc)SRV - [2007/07/24 15:17:08 | 000,229,376 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)SRV - [2006/11/24 17:36:15 | 000,295,424 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\termsrv32.dll -- (TermService)SRV - [2005/07/08 17:24:46 | 000,871,424 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Ahead\InCD\InCDsrv.exe -- (InCDsrv) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [url="http://www.hotmail.com/"]http://www.hotmail.com/[/url]IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.update: falseFF - prefs.js..browser.startup.homepage: "http://www.hotmail.com/"FF - prefs.js..extensions.enabledItems: [email protected]:1.01FF - prefs.js..extensions.enabledItems: [email protected]:1.0 FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/07 10:40:45 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/01/07 10:40:45 | 000,000,000 | ---D | M] [2008/08/28 23:18:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Smegma Fondue\Application Data\Mozilla\Extensions[2010/02/03 12:51:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Smegma Fondue\Application Data\Mozilla\Firefox\Profiles\6p0r1cn5.default\extensions[2010/02/03 12:51:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Smegma Fondue\Application Data\Mozilla\Firefox\Profiles\6p0r1cn5.default\extensions\[email protected][2007/09/21 00:48:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Smegma Fondue\Application Data\Mozilla\Firefox\Profiles\6p0r1cn5.default\extensions\[email protected][2010/02/03 12:51:40 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions[2009/07/16 05:20:22 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml[2009/07/16 05:20:22 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml[2009/07/16 05:20:22 | 000,000,769 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml[2009/07/16 05:20:22 | 000,000,831 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml O1 HOSTS File: ([2010/02/03 02:30:44 | 000,379,019 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hostsO1 - Hosts: 127.0.0.1 localhostO1 - Hosts: 127.0.0.1 007guard.comO1 - Hosts: 127.0.0.1 www.007guard.comO1 - Hosts: 127.0.0.1 008i.comO1 - Hosts: 127.0.0.1 008k.comO1 - Hosts: 127.0.0.1 www.008k.comO1 - Hosts: 127.0.0.1 00hq.comO1 - Hosts: 127.0.0.1 www.00hq.comO1 - Hosts: 127.0.0.1 010402.comO1 - Hosts: 127.0.0.1 032439.comO1 - Hosts: 127.0.0.1 www.032439.comO1 - Hosts: 127.0.0.1 100888290cs.comO1 - Hosts: 127.0.0.1 www.100888290cs.comO1 - Hosts: 127.0.0.1 100sexlinks.comO1 - Hosts: 127.0.0.1 www.100sexlinks.comO1 - Hosts: 127.0.0.1 10sek.comO1 - Hosts: 127.0.0.1 www.10sek.comO1 - Hosts: 127.0.0.1 123topsearch.comO1 - Hosts: 127.0.0.1 www.123topsearch.comO1 - Hosts: 127.0.0.1 132.comO1 - Hosts: 127.0.0.1 www.132.comO1 - Hosts: 127.0.0.1 136136.netO1 - Hosts: 127.0.0.1 www.136136.netO1 - Hosts: 127.0.0.1 163ns.comO1 - Hosts: 127.0.0.1 www.163ns.comO1 - Hosts: 13063 more lines...O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx ()O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)O4 - HKLM..\Run: [ALiRaid] C:\Program Files\ALIRAID\ALiRaid.exe ()O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)O4 - HKLM..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe (Nero AG)O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (Macrovision Corporation)O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)O4 - HKLM..\Run: [RemoteControl] C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe (Cyberlink Corp.)O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)O4 - HKCU..\Run: [PowerBar] File not foundO4 - HKCU..\Run: [Sony Ericsson PC Suite] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe (Sony Ericsson Mobile Communications AB)O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - Reg Error: Key error. File not foundO10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (Intertrust Technologies, Inc.)O15 - HKLM\..Trusted Domains: 66 domain(s) and sub-domain(s) not assigned to a zone.O15 - HKCU\..Trusted Domains: ([]msn in My Computer)O15 - HKCU\..Trusted Domains: 65 domain(s) and sub-domain(s) not assigned to a zone.O16 - DPF: {00000161-9980-0010-8000-00AA00389B71} [url="http://codecs.microsoft.com/codecs/i386/msaud.cab"]http://codecs.microsoft.com/codecs/i386/msaud.cab[/url] (Reg Error: Key error.)O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\yinsthelper.dll (YInstStarter Class)O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} [url="http://update.microsoft.com/windowsupdate/v6/V5Controls/"]http://update.microsoft.com/windowsupdate/v6/V5Controls/[/url]en/x86/client/wuweb_site.cab?1164360158288 (WUWebControl Class)O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} [url="http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-"]http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-[/url]windows-i586.cab (Java Plug-in 1.6.0_14)O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} [url="http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-"]http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-[/url]windows-i586.cab (Java Plug-in 1.6.0_14)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [url="http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-"]http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-[/url]windows-i586.cab (Java Plug-in 1.6.0_14)O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} [url="http://fpdownload2.macromedia.com/get/flashplayer/curren"]http://fpdownload2.macromedia.com/get/flashplayer/curren[/url]t/swflash.cab (Shockwave Flash Object)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 61.9.226.33 61.9.242.33O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)O32 - HKLM CDRom: AutoRun - 1O32 - AutoRun File - [2006/11/24 21:21:05 | 000,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]O34 - HKLM BootExecute: (autocheck autochk *) - File not foundO35 - comfile [open] -- "%1" %*O35 - exefile [open] -- "%1" %* NetSvcs: 6to4 - File not foundNetSvcs: Ias - C:\WINDOWS\system32\ias [2006/11/24 17:39:22 | 000,000,000 | ---D | M]NetSvcs: Iprip - File not foundNetSvcs: Irmon - File not foundNetSvcs: NWCWorkstation - File not foundNetSvcs: Nwsapagent - File not foundNetSvcs: Wmi - C:\WINDOWS\system32\wmi.dll (Microsoft Corporation)NetSvcs: WmdmPmSp - File not foundNetSvcs: TermService - C:\WINDOWS\system32\termsrv32.dll (Microsoft Corporation) CREATERESTOREPOINTRestore point Set: OTL Restore Point (17173366603513856) ========== Files/Folders - Created Within 14 Days ========== [2010/02/03 15:43:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT[2010/02/03 15:43:08 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT[2010/02/03 13:03:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com[2010/02/03 13:03:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Smegma Fondue\Application Data\SUPERAntiSpyware.com[2010/02/03 13:03:21 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware[2010/02/03 12:43:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Smegma Fondue\Application Data\Malwarebytes[2010/02/03 12:43:29 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys[2010/02/03 12:43:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes[2010/02/03 12:43:21 | 000,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys[2010/02/03 12:43:20 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware[2010/01/29 02:05:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Blizzard[2010/01/29 02:03:51 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Blizzard Entertainment[2007/11/13 19:24:23 | 000,098,304 | ---- | C] (SCEE) -- C:\Program Files\TeenageMutantNinjaPuppets.exe[2007/01/26 00:03:43 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft[2007/01/25 23:34:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft[2006/11/24 17:41:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft[2006/11/24 17:39:25 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft ========== Files - Modified Within 14 Days ========== [2010/02/03 19:47:48 | 011,534,336 | -H-- | M] () -- C:\Documents and Settings\Smegma Fondue\NTUSER.DAT[2010/02/03 16:14:24 | 000,136,704 | ---- | M] () -- C:\Documents and Settings\Smegma Fondue\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini[2010/02/03 15:39:59 | 000,012,598 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl[2010/02/03 15:39:37 | 000,198,504 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml[2010/02/03 15:39:25 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT[2010/02/03 15:39:23 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat[2010/02/03 14:41:01 | 000,170,273 | ---- | M] () -- C:\Documents and Settings\Smegma Fondue\Desktop\taskman.jpg[2010/02/03 13:03:26 | 000,000,780 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk[2010/02/03 04:35:33 | 000,000,558 | ---- | M] () -- C:\WINDOWS\DFC.INI[2010/02/03 04:21:55 | 000,442,368 | ---- | M] () -- C:\WINDOWS\outlook.pst[2010/02/03 04:21:39 | 000,000,896 | ---- | M] () -- C:\WINDOWS\win.ini[2010/02/03 02:30:44 | 000,379,019 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts[2010/01/31 16:32:15 | 000,192,512 | ---- | M] () -- C:\Documents and Settings\Smegma Fondue\My Documents\ggwords.doc[2010/01/29 03:33:11 | 000,460,515 | ---- | M] () -- C:\Documents and Settings\Smegma Fondue\Desktop\kat08.jpg[2010/01/29 03:32:30 | 000,487,792 | ---- | M] () -- C:\Documents and Settings\Smegma Fondue\Desktop\kat07.jpg[2010/01/29 03:32:07 | 000,474,231 | ---- | M] () -- C:\Documents and Settings\Smegma Fondue\Desktop\kat06.jpg[2010/01/29 03:31:20 | 000,273,097 | ---- | M] () -- C:\Documents and Settings\Smegma Fondue\Desktop\kat05.jpg[2010/01/29 03:30:28 | 000,407,263 | ---- | M] () -- C:\Documents and Settings\Smegma Fondue\Desktop\kat04.jpg[2010/01/29 03:30:04 | 000,402,805 | ---- | M] () -- C:\Documents and Settings\Smegma Fondue\Desktop\kat03.jpg[2010/01/29 03:29:39 | 000,391,629 | ---- | M] () -- C:\Documents and Settings\Smegma Fondue\Desktop\kat02.jpg[2010/01/29 03:28:12 | 000,376,944 | ---- | M] () -- C:\Documents and Settings\Smegma Fondue\Desktop\kat01.jpg[2010/01/29 03:16:16 | 001,527,997 | ---- | M] () -- C:\Documents and Settings\Smegma Fondue\Desktop\DSC01257.JPG[2010/01/29 03:15:38 | 001,541,695 | ---- | M] () -- C:\Documents and Settings\Smegma Fondue\Desktop\DSC01256.JPG[2010/01/29 03:15:20 | 001,375,498 | ---- | M] () -- C:\Documents and Settings\Smegma Fondue\Desktop\DSC01255.JPG[2010/01/29 03:15:07 | 001,329,258 | ---- | M] () -- C:\Documents and Settings\Smegma Fondue\Desktop\DSC01254.JPG[2010/01/29 03:14:42 | 001,531,939 | ---- | M] () -- C:\Documents and Settings\Smegma Fondue\Desktop\DSC01253.JPG[2010/01/29 03:12:58 | 001,425,763 | ---- | M] () -- C:\Documents and Settings\Smegma Fondue\Desktop\DSC01251.JPG[2010/01/29 03:11:44 | 001,456,125 | ---- | M] () -- C:\Documents and Settings\Smegma Fondue\Desktop\DSC01250.JPG[2010/01/29 03:09:24 | 001,427,116 | ---- | M] () -- C:\Documents and Settings\Smegma Fondue\Desktop\DSC01247.JPG[2010/01/29 03:08:32 | 001,399,791 | ---- | M] () -- C:\Documents and Settings\Smegma Fondue\Desktop\DSC01245.JPG[2010/01/29 03:08:10 | 001,501,371 | ---- | M] () -- C:\Documents and Settings\Smegma Fondue\Desktop\DSC01244.JPG[2010/01/29 03:06:02 | 000,838,953 | ---- | M] () -- C:\Documents and Settings\Smegma Fondue\Desktop\DSC01243.JPG[2010/01/25 20:53:46 | 000,083,773 | ---- | M] () -- C:\Documents and Settings\Smegma Fondue\Desktop\SPs.gif[2010/01/25 14:55:26 | 000,320,125 | ---- | M] () -- C:\Documents and Settings\Smegma Fondue\Desktop\so4332wa.gif ========== Files Created - No Company Name ========== [2010/02/03 14:40:57 | 000,170,273 | ---- | C] () -- C:\Documents and Settings\Smegma Fondue\Desktop\taskman.jpg[2010/02/03 13:03:26 | 000,000,780 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk[2010/01/29 03:33:09 | 000,460,515 | ---- | C] () -- C:\Documents and Settings\Smegma Fondue\Desktop\kat08.jpg[2010/01/29 03:32:29 | 000,487,792 | ---- | C] () -- C:\Documents and Settings\Smegma Fondue\Desktop\kat07.jpg[2010/01/29 03:32:06 | 000,474,231 | ---- | C] () -- C:\Documents and Settings\Smegma Fondue\Desktop\kat06.jpg[2010/01/29 03:31:19 | 000,273,097 | ---- | C] () -- C:\Documents and Settings\Smegma Fondue\Desktop\kat05.jpg[2010/01/29 03:30:27 | 000,407,263 | ---- | C] () -- C:\Documents and Settings\Smegma Fondue\Desktop\kat04.jpg[2010/01/29 03:30:02 | 000,402,805 | ---- | C] () -- C:\Documents and Settings\Smegma Fondue\Desktop\kat03.jpg[2010/01/29 03:29:37 | 000,391,629 | ---- | C] () -- C:\Documents and Settings\Smegma Fondue\Desktop\kat02.jpg[2010/01/29 03:28:11 | 000,376,944 | ---- | C] () -- C:\Documents and Settings\Smegma Fondue\Desktop\kat01.jpg[2010/01/29 03:16:16 | 001,527,997 | ---- | C] () -- C:\Documents and Settings\Smegma Fondue\Desktop\DSC01257.JPG[2010/01/29 03:15:38 | 001,541,695 | ---- | C] () -- C:\Documents and Settings\Smegma Fondue\Desktop\DSC01256.JPG[2010/01/29 03:15:20 | 001,375,498 | ---- | C] () -- C:\Documents and Settings\Smegma Fondue\Desktop\DSC01255.JPG[2010/01/29 03:15:07 | 001,329,258 | ---- | C] () -- C:\Documents and Settings\Smegma Fondue\Desktop\DSC01254.JPG[2010/01/29 03:14:42 | 001,531,939 | ---- | C] () -- C:\Documents and Settings\Smegma Fondue\Desktop\DSC01253.JPG[2010/01/29 03:12:58 | 001,425,763 | ---- | C] () -- C:\Documents and Settings\Smegma Fondue\Desktop\DSC01251.JPG[2010/01/29 03:11:44 | 001,456,125 | ---- | C] () -- C:\Documents and Settings\Smegma Fondue\Desktop\DSC01250.JPG[2010/01/29 03:09:24 | 001,427,116 | ---- | C] () -- C:\Documents and Settings\Smegma Fondue\Desktop\DSC01247.JPG[2010/01/29 03:08:32 | 001,399,791 | ---- | C] () -- C:\Documents and Settings\Smegma Fondue\Desktop\DSC01245.JPG[2010/01/29 03:08:10 | 001,501,371 | ---- | C] () -- C:\Documents and Settings\Smegma Fondue\Desktop\DSC01244.JPG[2010/01/29 03:06:02 | 000,838,953 | ---- | C] () -- C:\Documents and Settings\Smegma Fondue\Desktop\DSC01243.JPG[2010/01/25 20:53:45 | 000,083,773 | ---- | C] () -- C:\Documents and Settings\Smegma Fondue\Desktop\SPs.gif[2010/01/25 14:55:26 | 000,320,125 | ---- | C] () -- C:\Documents and Settings\Smegma Fondue\Desktop\so4332wa.gif[2009/09/15 14:11:13 | 000,185,936 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat[2009/08/17 01:29:38 | 000,000,272 | ---- | C] () -- C:\WINDOWS\_delis32.ini[2009/02/13 19:26:41 | 000,056,320 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll[2009/02/13 19:11:57 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll[2008/12/12 17:07:59 | 000,000,262 | ---- | C] () -- C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini[2008/10/26 22:02:56 | 000,279,712 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys[2008/10/26 22:02:56 | 000,025,888 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys[2008/10/07 09:13:30 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll[2008/10/07 09:13:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll[2008/02/21 19:41:28 | 000,022,328 | ---- | C] () -- C:\Documents and Settings\Smegma Fondue\Application Data\PnkBstrK.sys[2008/02/21 19:41:01 | 000,000,323 | ---- | C] () -- C:\WINDOWS\game.ini[2008/02/02 16:38:55 | 000,000,097 | ---- | C] () -- C:\WINDOWS\WirelessFTP.INI[2008/02/02 16:38:27 | 000,000,000 | ---- | C] () -- C:\WINDOWS\tosOBEX.INI[2007/07/18 19:46:07 | 000,000,292 | ---- | C] () -- C:\WINDOWS\vtmb.ini[2007/06/16 15:50:02 | 000,000,023 | ---- | C] () -- C:\WINDOWS\BlendSettings.ini[2007/05/25 21:06:23 | 000,000,525 | ---- | C] () -- C:\WINDOWS\QIII.INI[2007/04/09 02:34:56 | 000,138,736 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys[2007/02/25 10:25:36 | 000,000,031 | ---- | C] () -- C:\WINDOWS\galaxy.ini[2007/01/26 00:30:30 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini[2006/12/14 21:47:33 | 000,040,960 | ---- | C] () -- C:\Program Files\Uninstall_CDS.exe[2006/12/14 01:05:55 | 000,000,021 | ---- | C] () -- C:\Program Files\Common Files\appop.log[2006/12/14 00:44:55 | 000,030,208 | ---- | C] () -- C:\WINDOWS\System32\WNASPI32.DLL[2006/12/14 00:44:55 | 000,000,291 | ---- | C] () -- C:\WINDOWS\msfsetup.ini[2006/12/14 00:41:18 | 000,003,654 | ---- | C] () -- C:\WINDOWS\System32\drivers\Sonyhcp.dll[2006/12/07 19:33:25 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\CNMVS6e.DLL[2006/11/29 23:05:17 | 000,069,632 | R--- | C] () -- C:\WINDOWS\System32\xmltok.dll[2006/11/29 23:05:17 | 000,036,864 | R--- | C] () -- C:\WINDOWS\System32\xmlparse.dll[2006/11/25 03:41:15 | 000,136,704 | ---- | C] () -- C:\Documents and Settings\Smegma Fondue\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini[2006/11/24 21:43:31 | 000,027,513 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini[2006/11/24 21:34:11 | 000,000,804 | R--- | C] () -- C:\WINDOWS\System32\AsusSetup.ini[2006/11/24 21:34:11 | 000,000,402 | R--- | C] () -- C:\WINDOWS\System32\raidmgmt.ini[2006/11/24 21:33:20 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys[2006/11/24 21:33:04 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS[2006/11/24 21:23:07 | 000,000,558 | ---- | C] () -- C:\WINDOWS\DFC.INI[2006/11/24 21:17:06 | 000,032,768 | ---- | C] () -- C:\WINDOWS\TBPanelExt.dll[2006/11/24 21:17:06 | 000,005,120 | ---- | C] () -- C:\WINDOWS\TBManage.dll[2006/11/24 20:39:24 | 000,000,022 | ---- | C] () -- C:\WINDOWS\exchng.ini[2006/11/24 20:39:23 | 000,000,611 | ---- | C] () -- C:\WINDOWS\ODBC.INI[2006/11/24 20:23:38 | 000,000,305 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\addr_file.html[2006/11/24 19:55:20 | 000,006,592 | ---- | C] () -- C:\WINDOWS\gwpreset.ini[2006/11/24 19:55:20 | 000,001,261 | ---- | C] () -- C:\WINDOWS\goldwave.ini[2006/08/31 20:17:00 | 001,724,416 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll[2006/08/31 20:17:00 | 001,507,328 | ---- | C] () -- C:\WINDOWS\System32\nview.dll[2006/08/31 20:17:00 | 001,101,824 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll[2006/08/31 20:17:00 | 000,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll[2006/08/31 20:17:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll[2006/08/31 20:17:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll[1997/08/01 00:00:00 | 000,031,232 | ---- | C] () -- C:\WINDOWS\System32\XLREC.DLL[1997/08/01 00:00:00 | 000,025,600 | ---- | C] () -- C:\WINDOWS\System32\RECNCL.DLL[1997/08/01 00:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\ODBCSTF.DLL[1997/08/01 00:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\DOCOBJ.DLL[1997/08/01 00:00:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\HLINKPRX.DLL ========== LOP Check ========== [2008/12/19 18:47:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\2DBoy[2006/11/24 19:41:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BigPond[2008/06/10 00:14:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BVRP Software[2008/03/13 23:37:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CCP[2009/12/01 13:32:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Gamerizon[2009/11/30 23:20:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LucasArts[2006/11/24 21:20:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\muvee Technologies[2007/12/15 02:36:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SpinTop Games[2009/03/24 04:27:11 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\Smegma Fondue\Application Data\.#[2009/12/03 13:38:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Smegma Fondue\Application Data\Audacity[2006/11/24 19:41:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Smegma Fondue\Application Data\BigPond[2009/10/09 21:12:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Smegma Fondue\Application Data\Bioshock[2009/07/20 03:12:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Smegma Fondue\Application Data\Braid[2007/02/03 15:30:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Smegma Fondue\Application Data\Canon[2009/05/11 22:51:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Smegma Fondue\Application Data\Crayon Physics Deluxe[2009/10/10 01:29:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Smegma Fondue\Application Data\GetRightToGo[2006/11/24 21:19:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Smegma Fondue\Application Data\InterTrust[2008/01/22 18:08:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Smegma Fondue\Application Data\Kio[2009/03/22 15:05:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Smegma Fondue\Application Data\Larva Mortus Demo[2006/11/27 23:00:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Smegma Fondue\Application Data\Leadertech[2009/01/26 16:08:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Smegma Fondue\Application Data\MayhemIntergalactic[2009/10/28 15:15:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Smegma Fondue\Application Data\runic games[2009/01/16 14:36:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Smegma Fondue\Application Data\Screaming Bee[2009/04/19 05:39:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Smegma Fondue\Application Data\Slam Dunk Studios, LLC[2007/10/24 21:51:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Smegma Fondue\Application Data\SystemRequirementsLab[2006/12/20 01:15:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Smegma Fondue\Application Data\Teleca[2010/02/03 02:14:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Smegma Fondue\Application Data\uniblue ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.exe >[2008/04/11 08:03:48 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe < MD5 for: AGP440.SYS >[2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys[2008/05/11 19:04:34 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys[2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys[2008/05/11 19:04:34 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys[2008/04/14 05:06:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys[2008/04/14 05:06:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys[2004/08/03 23:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys < MD5 for: ATAPI.SYS >[2003/03/31 22:30:00 | 010,158,890 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp1.cab:atapi.sys[2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys[2008/05/11 19:04:34 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys[2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys[2008/05/11 19:04:34 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys[2008/04/14 05:10:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys[2008/04/14 05:10:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys[2004/08/03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys[2004/08/03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\i386\atapi.sys < MD5 for: EVENTLOG.DLL >[2008/04/14 10:41:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll[2008/04/14 10:41:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll[2004/08/04 00:56:44 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll < MD5 for: NETLOGON.DLL >[2008/04/14 10:42:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll[2008/04/14 10:42:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll[2004/08/04 00:56:46 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll < MD5 for: NVATA.SYS >[2006/04/24 20:22:28 | 000,100,736 | R--- | M] (NVIDIA Corporation) MD5=C03E15101F6D9E82CD9B0E7D715F5DE3 -- C:\WINDOWS\system32\drivers\nvata.sys < MD5 for: SCECLI.DLL >[2004/08/04 00:56:46 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll[2008/04/14 10:42:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll[2008/04/14 10:42:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > < %systemroot%\Tasks\*.job /lockedfiles > < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav >[2006/11/25 01:32:25 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav[2006/11/25 01:32:25 | 000,602,112 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav[2006/11/25 01:32:25 | 000,417,792 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav< End of report >
The extras.txt is from a different scan because I had some technical issues with black furry creatures jumping on my keyboard. Shouldn't matter though. Here are the extras:
OTL Extras logfile created on: 3/02/2010 7:32:34 PM - Run 1OTL by OldTimer - Version 3.1.27.1 Folder = C:\Documents and Settings\Smegma Fondue\My Documents\DownloadsWindows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstationInternet Explorer (Version = 8.0.6001.18702)Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy 1,022.00 Mb Total Physical Memory | 261.00 Mb Available Physical Memory | 26.00% Memory free2.00 Gb Paging File | 2.00 Gb Available in Paging File | 68.00% Paging File freePaging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program FilesDrive C: | 149.04 Gb Total Space | 37.30 Gb Free Space | 25.02% Space Free | Partition Type: NTFSD: Drive not present or media not loadedDrive E: | 127.99 Gb Total Space | 2.75 Gb Free Space | 2.15% Space Free | Partition Type: NTFSF: Drive not present or media not loadedDrive G: | 37.26 Gb Total Space | 9.07 Gb Free Space | 24.36% Space Free | Partition Type: FAT32H: Drive not present or media not loadedI: Drive not present or media not loaded Computer Name: [bleep]2Current User Name: Smegma FondueLogged in as Administrator. Current Boot Mode: NormalScan Mode: Current userCompany Name Whitelist: OnSkip Microsoft Files: OnFile Age = 14 DaysOutput = StandardQuick Scan ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>].html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*exefile [open] -- "%1" %*htmlfile [edit] -- Reg Error: Key error.htmlfile [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)htmlfile [opennew] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)scrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]"AntiVirusDisableNotify" = 0"FirewallDisableNotify" = 0"UpdatesDisableNotify" = 0"AntiVirusOverride" = 0"FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]"65533:TCP" = 65533:TCP:*:Enabled:Services"52344:TCP" = 52344:TCP:*:Enabled:Services"2479:TCP" = 2479:TCP:*:Enabled:Services"7195:TCP" = 7195:TCP:*:Enabled:Services"3389:TCP" = 3389:TCP:*:Enabled:Remote Desktop"3246:TCP" = 3246:TCP:*:Enabled:Services [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]"EnableFirewall" = 1"DoNotAllowExceptions" = 0"DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]"6112:UDP" = 6112:UDP:*:Enabled:Starcraft"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008"65533:TCP" = 65533:TCP:*:Enabled:Services"52344:TCP" = 52344:TCP:*:Enabled:Services"2479:TCP" = 2479:TCP:*:Enabled:Services"7195:TCP" = 7195:TCP:*:Enabled:Services"3389:TCP" = 3389:TCP:*:Enabled:Remote Desktop"3246:TCP" = 3246:TCP:*:Enabled:Services ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]"C:\Program Files\The All-Seeing Eye\eye.exe" = C:\Program Files\The All-Seeing Eye\eye.exe:*:Enabled:Yahoo! All-Seeing Eye -- (Yahoo! Inc.)"C:\Program Files\Sierra\FEAR\fpupdate.exe" = C:\Program Files\Sierra\FEAR\fpupdate.exe:*:Enabled:fpupdate -- File not found"C:\Program Files\Atari\Neverwinter Nights 2\nwn2main.exe" = C:\Program Files\Atari\Neverwinter Nights 2\nwn2main.exe:*:Enabled:Neverwinter Nights 2 Main -- File not found"C:\Program Files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe" = C:\Program Files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:*:Enabled:Neverwinter Nights 2 AMD -- File not found"C:\Program Files\Atari\Neverwinter Nights 2\nwupdate.exe" = C:\Program Files\Atari\Neverwinter Nights 2\nwupdate.exe:*:Enabled:Neverwinter Nights 2 Updater -- File not found"C:\Program Files\Atari\Neverwinter Nights 2\nwn2server.exe" = C:\Program Files\Atari\Neverwinter Nights 2\nwn2server.exe:*:Enabled:Neverwinter Nights 2 Server -- File not found"C:\Program Files\Steam\SteamApps\bonsaikitten\counter-strike source\hl2.exe" = C:\Program Files\Steam\SteamApps\bonsaikitten\counter-strike source\hl2.exe:*:Enabled:hl2 -- ()"C:\Program Files\Atari\BOILING POINT\Xenus.exe" = C:\Program Files\Atari\BOILING POINT\Xenus.exe:*:Disabled:Xenus -- File not found"C:\Program Files\Red Storm Entertainment\RavenShield\system\RavenShield.exe" = C:\Program Files\Red Storm Entertainment\RavenShield\system\RavenShield.exe:*:Enabled:RavenShield -- File not found"C:\DeusEx\System\DeusEx.exe" = C:\DeusEx\System\DeusEx.exe:*:Enabled:DeusEx -- ()"C:\Program Files\Steam\SteamApps\bonsaikitten\half-life 2\hl2.exe" = C:\Program Files\Steam\SteamApps\bonsaikitten\half-life 2\hl2.exe:*:Enabled:hl2 -- ()"C:\Program Files\Steam\SteamApps\bonsaikitten\half-life 2 deathmatch\hl2.exe" = C:\Program Files\Steam\SteamApps\bonsaikitten\half-life 2 deathmatch\hl2.exe:*:Enabled:hl2 -- ()"C:\Program Files\Electronic Arts\Battlefield 2142\BF2142.exe" = C:\Program Files\Electronic Arts\Battlefield 2142\BF2142.exe:*:Enabled:Battlefield 2 -- ()"C:\Program Files\THQ\Gas Powered Games\GPGNet\GPG.Multiplayer.Client.exe" = C:\Program Files\THQ\Gas Powered Games\GPGNet\GPG.Multiplayer.Client.exe:*:Enabled:GPGNet - Supreme Commander -- File not found"E:\Program Files\CCP\EVE\bin\ExeFile.exe" = E:\Program Files\CCP\EVE\bin\ExeFile.exe:*:Enabled:CCP Blue Framework -- (CCP hf.)"C:\Program Files\Nexuiz\nexuiz.exe" = C:\Program Files\Nexuiz\nexuiz.exe:*:Enabled:Nexuiz -- ()"C:\Program Files\Bohemia Interactive\ArmA Demo\ArmADemo.exe" = C:\Program Files\Bohemia Interactive\ArmA Demo\ArmADemo.exe:*:Enabled:ArmA -- File not found"C:\Program Files\RndLabs\BaboViolent 2\bv2.exe" = C:\Program Files\RndLabs\BaboViolent 2\bv2.exe:*:Enabled:bv2 -- ()"C:\Program Files\Sierra\FEARCombat\fpupdate.exe" = C:\Program Files\Sierra\FEARCombat\fpupdate.exe:*:Enabled:fpupdate -- File not found"C:\Program Files\Quake III Arena\quake3.exe" = C:\Program Files\Quake III Arena\quake3.exe:*:Enabled:quake3 -- File not found"C:\Program Files\Steam\SteamApps\bonsaikitten\source sdk base\hl2.exe" = C:\Program Files\Steam\SteamApps\bonsaikitten\source sdk base\hl2.exe:*:Enabled:hl2 -- ()"C:\Unreal Anthology\UT2004\System\UT2004.exe" = C:\Unreal Anthology\UT2004\System\UT2004.exe:*:Enabled:UT2004 -- File not found"E:\Program Files\Call of Duty Game of the Year Edition\CoDMP.exe" = E:\Program Files\Call of Duty Game of the Year Edition\CoDMP.exe:*:Enabled:CoDMP -- ()"C:\Alien Arena 2007\crx.exe" = C:\Alien Arena 2007\crx.exe:*:Enabled:crx -- File not found"C:\Program Files\Steam\steam.exe" = C:\Program Files\Steam\steam.exe:*:Enabled:Steam -- (Valve Corporation)"C:\Program Files\Steam\SteamApps\bonsaikitten\team fortress 2\hl2.exe" = C:\Program Files\Steam\SteamApps\bonsaikitten\team fortress 2\hl2.exe:*:Enabled:hl2 -- ()"C:\Program Files\Steam\SteamApps\common\defcon\defcon.exe" = C:\Program Files\Steam\SteamApps\common\defcon\defcon.exe:*:Enabled:Defcon -- File not found"C:\Program Files\Steam\SteamApps\bonsaikitten\condition zero\hl.exe" = C:\Program Files\Steam\SteamApps\bonsaikitten\condition zero\hl.exe:*:Enabled:Half-Life Launcher -- (Valve)"C:\Program Files\Steam\SteamApps\bonsaikitten\condition zero deleted scenes\hl.exe" = C:\Program Files\Steam\SteamApps\bonsaikitten\condition zero deleted scenes\hl.exe:*:Enabled:Half-Life Launcher -- (Valve)"C:\Unreal Anthology\UnrealTournament\System\UnrealTournament.exe" = C:\Unreal Anthology\UnrealTournament\System\UnrealTournament.exe:*:Enabled:UnrealTournament -- File not found"C:\Program Files\Steam\SteamApps\common\puzzle quest\Puzzle Quest.exe" = C:\Program Files\Steam\SteamApps\common\puzzle quest\Puzzle Quest.exe:*:Enabled:Puzzle Quest -- ()"C:\WINDOWS\system32\dpnsvr.exe" = C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server -- (Microsoft Corporation)"C:\WINDOWS\system32\PnkBstrA.exe" = C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA -- ()"C:\WINDOWS\system32\PnkBstrB.exe" = C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB -- ()"C:\Program Files\Tale of Tales\The Endless Forest 3\ForestViewer.exe" = C:\Program Files\Tale of Tales\The Endless Forest 3\ForestViewer.exe:*:Enabled:ForestViewer -- File not found"C:\Program Files\Steam\SteamApps\bonsaikitten\garrysmod\hl2.exe" = C:\Program Files\Steam\SteamApps\bonsaikitten\garrysmod\hl2.exe:*:Enabled:hl2 -- ()"C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour -- (Apple Inc.)"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)"C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe" = C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:*:Enabled:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI) -- File not found"C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe" = C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:*:Enabled:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV) -- File not found"C:\Program Files\Deep Silver\S.T.A.L.K.E.R. - Clear Sky\bin\xrEngine.exe" = C:\Program Files\Deep Silver\S.T.A.L.K.E.R. - Clear Sky\bin\xrEngine.exe:*:Enabled:S.T.A.L.K.E.R. - Clear Sky (CLI) -- File not found"C:\Program Files\Deep Silver\S.T.A.L.K.E.R. - Clear Sky\bin\dedicated\xrEngine.exe" = C:\Program Files\Deep Silver\S.T.A.L.K.E.R. - Clear Sky\bin\dedicated\xrEngine.exe:*:Enabled:S.T.A.L.K.E.R. - Clear Sky (SRV) -- File not found"C:\Program Files\Starcraft\StarCraft.exe" = C:\Program Files\Starcraft\StarCraft.exe:*:Enabled:Starcraft - Brood War -- (Blizzard Entertainment)"C:\Program Files\Ventrilo\Ventrilo.exe" = C:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe -- ()"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)"C:\Program Files\Steam\SteamApps\common\peggle extreme\PeggleExtreme.exe" = C:\Program Files\Steam\SteamApps\common\peggle extreme\PeggleExtreme.exe:*:Enabled:Peggle Extreme -- ()"C:\Program Files\Steam\SteamApps\common\geometry wars\GeometryWars.exe" = C:\Program Files\Steam\SteamApps\common\geometry wars\GeometryWars.exe:*:Enabled:Geometry Wars -- (Bizarre Creations Ltd.)"C:\Program Files\Steam\SteamApps\common\world of goo\WorldOfGoo.exe" = C:\Program Files\Steam\SteamApps\common\world of goo\WorldOfGoo.exe:*:Enabled:World of Goo -- ()"C:\Program Files\Steam\SteamApps\common\peggle nights\PeggleNights.exe" = C:\Program Files\Steam\SteamApps\common\peggle nights\PeggleNights.exe:*:Enabled:Peggle Nights -- ()"C:\Program Files\Steam\SteamApps\common\osmos igf demo\OsmosDemo.exe" = C:\Program Files\Steam\SteamApps\common\osmos igf demo\OsmosDemo.exe:*:Enabled:Osmos IGF Demo -- ()"C:\Program Files\Steam\SteamApps\common\coil\coil.exe" = C:\Program Files\Steam\SteamApps\common\coil\coil.exe:*:Enabled:Coil -- (The Design Assembly GmbH)"C:\Program Files\Steam\SteamApps\bonsaikitten\counter-strike\hl.exe" = C:\Program Files\Steam\SteamApps\bonsaikitten\counter-strike\hl.exe:*:Enabled:Half-Life Launcher -- (Valve)"C:\Program Files\Steam\SteamApps\common\plants vs zombies\PlantsVsZombies.exe" = C:\Program Files\Steam\SteamApps\common\plants vs zombies\PlantsVsZombies.exe:*:Enabled:Plants Vs Zombies -- ()"C:\Program Files\Steam\SteamApps\common\red orchestra\System\RedOrchestra.exe" = C:\Program Files\Steam\SteamApps\common\red orchestra\System\RedOrchestra.exe:*:Enabled:Red Orchestra -- ()"C:\Program Files\Steam\SteamApps\common\dangerous high school girls in trouble\prog\brigiton.exe" = C:\Program Files\Steam\SteamApps\common\dangerous high school girls in trouble\prog\brigiton.exe:*:Enabled:Dangerous High School Girls in Trouble -- ()"C:\Program Files\Steam\SteamApps\common\bookworm adventures volume 2\BookwormAdventuresVol2.exe" = C:\Program Files\Steam\SteamApps\common\bookworm adventures volume 2\BookwormAdventuresVol2.exe:*:Enabled:Bookworm Adventures Volume 2 Demo -- (PopCap Games, Inc.)"C:\Program Files\Steam\SteamApps\common\bookworm adventures deluxe\BookwormAdventures.exe" = C:\Program Files\Steam\SteamApps\common\bookworm adventures deluxe\BookwormAdventures.exe:*:Enabled:Bookworm Adventures Deluxe Demo -- (PopCap Games, Inc.)"C:\Program Files\Steam\SteamApps\common\peggle deluxe\Peggle.exe" = C:\Program Files\Steam\SteamApps\common\peggle deluxe\Peggle.exe:*:Enabled:Peggle Deluxe Demo -- ()"C:\Program Files\Steam\SteamApps\common\altitude\altitude.exe" = C:\Program Files\Steam\SteamApps\common\altitude\altitude.exe:*:Enabled:altitude -- File not found"C:\Program Files\Steam\SteamApps\common\killingfloor\System\KillingFloor.exe" = C:\Program Files\Steam\SteamApps\common\killingfloor\System\KillingFloor.exe:*:Enabled:Killing Floor -- ()"C:\Program Files\Java\jre6\bin\java.exe" = C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(tm) Platform SE binary -- (Sun Microsystems, Inc.)"C:\Program Files\Steam\SteamApps\common\torchlight\Torchlight.exe" = C:\Program Files\Steam\SteamApps\common\torchlight\Torchlight.exe:*:Enabled:Torchlight -- (Runic Games, Inc.)"C:\Program Files\Steam\SteamApps\common\loom\Loom.exe" = C:\Program Files\Steam\SteamApps\common\loom\Loom.exe:*:Enabled:LOOM -- (LucasArts Entertainment Company)"C:\Program Files\Steam\SteamApps\common\osmos\osmos.exe" = C:\Program Files\Steam\SteamApps\common\osmos\osmos.exe:*:Enabled:Osmos -- (Hemisphere Games, Inc.)"C:\Program Files\Steam\SteamApps\common\ai war fleet command\AIWar.exe" = C:\Program Files\Steam\SteamApps\common\ai war fleet command\AIWar.exe:*:Enabled:AI War: Fleet Command -- (Arcen Games, LLC)"C:\Program Files\World of Warcraft\WoW-3.2.0-enUS-downloader.exe" = C:\Program Files\World of Warcraft\WoW-3.2.0-enUS-downloader.exe:*:Enabled:Blizzard Downloader -- File not found"C:\Program Files\World of Warcraft\Launcher.exe" = C:\Program Files\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher -- File not found ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam"{0B6A9773-F8F8-4D3F-BCF0-029D2B87DB8A}" = Deus Ex - Invisible War"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter"{1632FD86-1BA4-4FC4-8B25-A8C655D63F68}" = Sid Meier's Pirates!"{18A5DFF2-8A95-49F3-873F-743CB5549F3D}" = Canon ScanGear Starter"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate"{19934FC9-A54C-4DEF-ADAD-D3D361C2A595}" = DVD-WMV"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1"{1B4AA674-F5CA-4BB5-831A-CD37B4021959}" = ImageMixer for Sony"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = Multimedia Launcher"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime"{2333C615-F5B2-4D44-95A5-D7839FAC302B}" = Comic Life"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java(tm) 6 Update 14"{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 4.010.00"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Roxio Activation Module"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = JRAID"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker"{44734179-8A79-4DEE-BB08-73037F065543}" = Apple Mobile Device Support"{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}" = Bonjour"{5C29CB8B-AC1E-4114-8D68-9CD080140D4A}" = Sony USB Driver"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053"{66039B36-96AE-40D1-8A32-071F7A61B738}" = Microsoft LifeChat"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD"{68AD6F25-07A0-4CFE-9555-A30633329B08}" = muvee autoProducer 3.5 magicMoments"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update"{698D7E61-E4BF-4CA6-8A09-CF6BDBFDEF65}" = Battlefield 1942"{6F845B05-8B76-4302-A808-7FB21E2BC5E6}" = Sony DVD Handycam USB Driver"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client"{78CC3BAB-DE2A-4FB4-8FBB-E4DADDC26747}" = Ad-Aware SE Personal"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec"{80FD852F-5AAC-4129-B931-06AAFFA43138}" = iTunes"{838BC0FB-4F8F-47B9-847F-06AE4CCE4181}" = Manual CanoScan LiDE 25"{85309D89-7BE9-4094-BB17-24999C6118FC}" = ArcSoft PhotoStudio 5.5"{86EAA5D0-3445-4945-993A-98F128C9299E}" = BigPond Broadband ADSL FAQ"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2"{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}" = Windows Live installer"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer"{B83FC356-B7C0-441F-8A4D-D71E088E7974}" = NVIDIA PhysX"{B97CF5C3-0487-11D8-A36E-0050BAE317E1}" = DVD Solution"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2"{C151CE54-E7EA-4804-854B-F515368B0798}" = Athlon 64 Processor Driver"{C4E2A4A7-B623-40CB-8EEA-72F577E49D56}" = Vampire - The Masquerade Bloodlines"{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}" = Canon CanoScan Toolbox 4.9"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1"{D417C96A-FCC7-4590-A1BB-FAF73F5BC98E}" = GTA San Andreas"{D45EC259-4A19-4656-B588-C2C360DD18EA}" = Half-Life® 2"{D5395E5F-4D45-4665-8F00-234FA33678AF}" = SlimDX Redistributable (March 2009)"{DC4605F3-2896-11D7-A220-0000E884021F}" = ALi RAID Driver"{E280923D-C5D9-4728-8C79-AC9A0DC75875}" = BioShock"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series"{ED50ECE9-EC54-4C05-B5ED-EE4741A9F2EC}" = Battlefield 2142"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX"{FC123EEA-330A-4685-911C-95B8F5E9DE68}" = Thief - Deadly Shadows"AC3Filter" = AC3Filter (remove only)"Acoustica Effects Pack" = Acoustica Effects Pack"Adobe Acrobat 5.0" = Adobe Acrobat 5.0"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin"Adobe Photoshop 7.0" = Adobe Photoshop 7.0"Alarm_is1" = Alarm 2.0.1"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.2 (Unicode)"Audacity_is1" = Audacity 1.2.6"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus"AviSynth" = AviSynth 2.5"BaboViolent 2_is1" = BaboViolent 2.11"camcodec" = CamStudio Lossless Codec"CamStudio" = CamStudio"CCleaner" = CCleaner (remove only)"Deus Ex" = Deus Ex"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters"Doom II for Windows 95" = Doom II for Windows 95"DVD Shrink_is1" = DVD Shrink 3.2"ERUNT_is1" = ERUNT 1.1j"FreeRIP_is1" = FreeRIP v2.60"Glitch_is1" = Glitch 1.3"GoldWave v4.26" = GoldWave v4.26"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs"ie7" = Windows Internet Explorer 7"ie8" = Windows Internet Explorer 8"InCD!UninstallKey" = InCD"Indeo® XP Software" = Indeo® XP Software"InstallShield_{1632FD86-1BA4-4FC4-8B25-A8C655D63F68}" = Sid Meier's Pirates!"InstallShield_{C4E2A4A7-B623-40CB-8EEA-72F577E49D56}" = Vampire - The Masquerade Bloodlines"LADSPA_plugins-win_is1" = LADSPA_plugins-win-0.4.15"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1"MIKSOFT Mobile 3GP converter_is1" = MIKSOFT Mobile 3GP converter"MIKSOFT Mobile AMR converter_is1" = MIKSOFT Mobile AMR converter"Mozilla Firefox (3.5.7)" = Mozilla Firefox (3.5.7)"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP"MWASPI" = MicroStaff WINASPI"Nero - Burning Rom!UninstallKey" = Nero OEM"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs"NVIDIA Drivers" = NVIDIA Drivers"Office8.0" = Microsoft Office 97, Professional Edition"OpenAL" = OpenAL"Ping Plotter Freeware" = Ping Plotter Freeware"Shockwave" = Shockwave"Starcraft" = Starcraft"Steam App 11360" = Chains"Steam App 1200" = Red Orchestra"Steam App 1230" = Mare Nostrum"Steam App 1250" = Killing Floor"Steam App 12500" = Puzzle Quest"Steam App 1280" = Darkest Hour"Steam App 12900" = Audiosurf"Steam App 13010" = Ninja Reflex: Steamworks Edition Demo"Steam App 220" = Half-Life 2"Steam App 22000" = World of Goo"Steam App 26810" = Braid Demo"Steam App 27400" = Dangerous High School Girls in Trouble"Steam App 280" = Half-Life: Source"Steam App 29100" = Osmos IGF Demo"Steam App 29180" = Osmos"Steam App 31500" = Coil"Steam App 32340" = LOOM"Steam App 32410" = Lucidity"Steam App 3470" = Bookworm Adventures Deluxe"Steam App 3480" = Peggle Deluxe"Steam App 3483" = Peggle Extreme"Steam App 3540" = Peggle Nights"Steam App 3592" = Plants Vs Zombies Demo"Steam App 36000" = Foreign Legion: Buckets of Blood"Steam App 3632" = Bookworm Adventures Volume 2 Demo"Steam App 380" = Half-Life 2: Episode One"Steam App 400" = Portal"Steam App 40400" = AI War: Fleet Command"Steam App 41510" = Torchlight - Demo"Steam App 420" = Half-Life 2: Episode Two"Steam App 440" = Team Fortress 2"Steam App 8400" = Geometry Wars"Thief2DeinstallKey" = Thief 2"ThiefGoldDeinstallKey" = Thief Gold"Ultimate Doom for Windows 95" = Ultimate Doom for Windows 95"Windows Media Encoder 9" = Windows Media Encoder 9 Series"Windows Media Format Runtime" = Windows Media Format 11 runtime"Windows Media Player" = Windows Media Player 11"Windows XP Service Pack" = Windows XP Service Pack 3"WinRAR archiver" = WinRAR archiver"WMFDist11" = Windows Media Format 11 runtime"wmp11" = Windows Media Player 11"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0"Yahoo! Companion" = Yahoo! Toolbar"Yahoo! Toolbar" = Yahoo! Toolbar"YInstHelper" = Yahoo! Install Manager ========== Last 10 Event Log Errors ========== [ Application Events ]Error - 19/12/2009 9:56:19 AM | Computer Name = [bleep]2 | Source = Application Error | ID = 1000Description = Faulting application torchlight.exe, version 1.0.68.184, faulting module torchlight.exe, version 1.0.68.184, fault address 0x00026430. Error - 19/12/2009 9:56:40 AM | Computer Name = [bleep]2 | Source = Application Error | ID = 1001Description = Fault bucket 1615492081. Error - 25/12/2009 11:06:19 AM | Computer Name = [bleep]2 | Source = Application Error | ID = 1000Description = Faulting application hl2.exe, version 0.0.0.0, faulting module unknown, version 0.0.0.0, fault address 0x0d7b4ce1. Error - 25/12/2009 11:12:22 AM | Computer Name = [bleep]2 | Source = Application Hang | ID = 1002Description = Hanging application Steam.exe, version 1.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 25/12/2009 11:12:58 AM | Computer Name = [bleep]2 | Source = Application Hang | ID = 1001Description = Fault bucket 07601534. Error - 25/12/2009 12:35:14 PM | Computer Name = [bleep]2 | Source = Application Error | ID = 1000Description = Faulting application torchlight.exe, version 1.0.68.200, faulting module torchlight.exe, version 1.0.68.200, fault address 0x00026430. Error - 25/01/2010 11:56:21 AM | Computer Name = [bleep]2 | Source = Application Hang | ID = 1002Description = Hanging application Steam.exe, version 1.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 1/02/2010 10:51:50 AM | Computer Name = [bleep]2 | Source = crypt32 | ID = 131083Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file. Error - 1/02/2010 10:51:50 AM | Computer Name = [bleep]2 | Source = crypt32 | ID = 131083Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file. Error - 3/02/2010 1:09:58 AM | Computer Name = [bleep]2 | Source = ESENT | ID = 490Description = svchost (1320) An attempt to open the file "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb" for read / write access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ". The open file operation will fail with error -1032 (0xfffffbf8). [ System Events ]Error - 18/12/2009 9:37:54 AM | Computer Name = [bleep]2 | Source = m5228 | ID = 262153Description = The device, \Device\Scsi\m52281, did not respond within the timeout period. Error - 18/12/2009 9:38:02 AM | Computer Name = [bleep]2 | Source = m5228 | ID = 262153Description = The device, \Device\Scsi\m52281, did not respond within the timeout period. Error - 18/12/2009 9:38:10 AM | Computer Name = [bleep]2 | Source = m5228 | ID = 262153Description = The device, \Device\Scsi\m52281, did not respond within the timeout period. Error - 18/12/2009 9:38:18 AM | Computer Name = [bleep]2 | Source = m5228 | ID = 262153Description = The device, \Device\Scsi\m52281, did not respond within the timeout period. Error - 18/12/2009 9:38:26 AM | Computer Name = [bleep]2 | Source = m5228 | ID = 262153Description = The device, \Device\Scsi\m52281, did not respond within the timeout period. Error - 18/12/2009 9:38:34 AM | Computer Name = [bleep]2 | Source = m5228 | ID = 262153Description = The device, \Device\Scsi\m52281, did not respond within the timeout period. Error - 18/12/2009 9:38:42 AM | Computer Name = [bleep]2 | Source = m5228 | ID = 262153Description = The device, \Device\Scsi\m52281, did not respond within the timeout period. Error - 18/12/2009 9:38:50 AM | Computer Name = [bleep]2 | Source = m5228 | ID = 262153Description = The device, \Device\Scsi\m52281, did not respond within the timeout period. Error - 18/12/2009 9:38:58 AM | Computer Name = [bleep]2 | Source = m5228 | ID = 262153Description = The device, \Device\Scsi\m52281, did not respond within the timeout period. Error - 18/12/2009 9:39:06 AM | Computer Name = [bleep]2 | Source = m5228 | ID = 262153Description = The device, \Device\Scsi\m52281, did not respond within the timeout period. < End of report >
And this one is the GMER log. This took forever. Note that it came up with some files in the second half of the log from computer games that I was partway through deleting while the scan was going just to speed up the bloody scan, because the scan was crawling like a snail through all these endless cache files. These files are all gone from my hard drive now anyway so I removed that part of the log so this post was small enough to actually fit in the forum's character limit.
GMER 1.0.15.15281 - [url="http://www.gmer.net"]http://www.gmer.net[/url]Rootkit scan 2010-02-03 19:31:39Windows 5.1.2600 Service Pack 3Running: gmer.exe; Driver: C:\DOCUME~1\SMEGMA~1\LOCALS~1\Temp\kxtdqpow.sys---- System - GMER 1.0.15 ----SSDT B11CAFC6 ZwCreateKeySSDT B11CAFBC ZwCreateThreadSSDT B11CAFCB ZwDeleteKeySSDT B11CAFD5 ZwDeleteValueKeySSDT B11CAFDA ZwLoadKeySSDT B11CAFA8 ZwOpenProcessSSDT B11CAFAD ZwOpenThreadSSDT B11CAFE4 ZwReplaceKeySSDT B11CAFDF ZwRestoreKeySSDT B11CAFD0 ZwSetValueKeySSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xB24B60B0]---- Devices - GMER 1.0.15 ----Device \Driver\ACPI \Device\00000053 86FEC318Device \Driver\ACPI \Device\00000047 86FEC318Device \Driver\ACPI \Device\00000056 86FEC318Device \Driver\ACPI \Device\00000057 86FEC318Device \Driver\ACPI \Device\00000058 86FEC318Device \Driver\ACPI \Device\00000059 86FEC318Device \Driver\ACPI \Device\00000072 86FEC318Device \Driver\ACPI \Device\00000073 86FEC318Device \Driver\ACPI \Device\00000075 86FEC318Device \Driver\ACPI \Device\00000076 86FEC318Device \Driver\ACPI \Device\0000004a 86FEC318Device \Driver\ACPI \Device\00000078 86FEC318Device \Driver\ACPI \Device\0000004b 86FEC318Device \Driver\ACPI \Device\0000004c 86FEC318Device \Driver\ACPI \Device\0000004e 86FEC318Device \Driver\ACPI \Device\0000005c 86FEC318Device \Driver\ACPI \Device\0000005d 86FEC318Device \Driver\ACPI \Device\0000006a 86FEC318Device \Driver\ACPI \Device\0000005e 86FEC318Device \Driver\ACPI \Device\0000006b 86FEC318Device \Driver\ACPI \Device\0000006c 86FEC318Device \Driver\ACPI \Device\0000006d 86FEC318Device \Driver\ACPI \Device\0000006e 86FEC318Device \Driver\ACPI \Device\0000006f 86FEC318Device \Driver\m5228 \Device\Scsi\m52281Port7Path0Target2Lun0 86FEC318Device \Driver\m5228 \Device\Scsi\m52281 86FEC318Device \Driver\m5228 \Device\Scsi\m52281Port7Path0Target3Lun0 86FEC318AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)AttachedDevice \FileSystem\Fastfat \Fat InCDrec.SYS (InCD File System Recognizer/Nero AG)---- Files - GMER 1.0.15 ----File C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\CCP\EVE\e_program_files_ccp_eve_tranquility\cache\MachoNet\87.237.38.200\206\CachedMethodCalls 0 bytesFile C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\CCP\EVE\e_program_files_ccp_eve_tranquility\cache\MachoNet\87.237.38.200\206\CachedMethodCalls\1001.cache 8171 bytesFile C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\CCP\EVE\e_program_files_ccp_eve_tranquility\cache\MachoNet\87.237.38.200\206\CachedMethodCalls\118.cache 785 bytesFile C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\CCP\EVE\e_program_files_ccp_eve_tranquility\cache\MachoNet\87.237.38.200\206\CachedMethodCalls\11b1.cache 783 bytesFile C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\CCP\EVE\e_program_files_ccp_eve_tranquility\cache\MachoNet\87.237.38.200\206\CachedMethodCalls\11ba.cache 441 bytesFile C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\CCP\EVE\e_program_files_ccp_eve_tranquility\cache\MachoNet\87.237.38.200\206\CachedMethodCalls\11ee.cache 439 bytesFile C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\CCP\EVE\e_program_files_ccp_eve_tranquility\cache\MachoNet\87.237.38.200\206\CachedMethodCalls\1212.cache 8317 bytesFile C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\CCP\EVE\e_program_files_ccp_eve_tranquility\cache\MachoNet\87.237.38.200\206\CachedMethodCalls\129d.cache 445 bytes
...etc!
I hope that's helpful, but if you said it wasn't, that wouldn't surprise me.
After following all these steps the problem is still occuring, with services.exe giving my hard disk about an hour's worth of solid workout every time I boot my machine. EDIT: correction! Thrashing was only about 30 minutes this time. That's still a lot though. Would be sweet to get it down to, like, none...
Edited by BKitten, 03 February 2010 - 04:15 AM.
Sign In
Create Account
