- Ran TFC.
- Ran system restore
- Ran ERUNT
- Ran MBAM and posted Log
- Tried to run GMER, but it had an error and wouldn't run.
- Ran OTL and posted logs (there was no extras log).
Windows Live Anti-Virus
Started by
trekkwalls
, Dec 28 2009 10:56 PM
#1
Posted 28 December 2009 - 10:56 PM
trekkwalls
-
- Member
-
- 60 posts
Member
- Ran TFC.
- Ran system restore
- Ran ERUNT
- Ran MBAM and posted Log
- Tried to run GMER, but it had an error and wouldn't run.
- Ran OTL and posted logs (there was no extras log).
#2
Posted 28 December 2009 - 10:58 PM
trekkwalls
- Topic Starter
-
- Member
-
- 60 posts
Member
Malwarebytes' Anti-Malware 1.42
Database version: 3447
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
12/28/2009 8:47:06 PM
mbam-log-2009-12-28 (20-47-06).txt
Scan type: Quick Scan
Objects scanned: 108665
Time elapsed: 4 minute(s), 24 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
Database version: 3447
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
12/28/2009 8:47:06 PM
mbam-log-2009-12-28 (20-47-06).txt
Scan type: Quick Scan
Objects scanned: 108665
Time elapsed: 4 minute(s), 24 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
#3
Posted 28 December 2009 - 11:00 PM
trekkwalls
- Topic Starter
-
- Member
-
- 60 posts
Member
OTL logfile created on: 12/28/2009 9:27:59 PM - Run 2
OTL by OldTimer - Version 3.1.20.1 Folder = C:\Documents and Settings\Walls\Desktop\Spyware Tools
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 77.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 88.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.05 Gb Total Space | 78.16 Gb Free Space | 52.44% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 279.47 Gb Total Space | 119.17 Gb Free Space | 42.64% Space Free | Partition Type: NTFS
Drive I: | 698.64 Gb Total Space | 470.00 Gb Free Space | 67.27% Space Free | Partition Type: NTFS
Computer Name: WALLS-DESKTOP
Current User Name: Walls
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan
========== Processes (SafeList) ==========
PRC - [2009/12/28 20:21:09 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Walls\Desktop\Spyware Tools\OTL.exe
PRC - [2009/12/19 10:57:43 | 02,002,160 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
PRC - [2009/12/13 09:41:23 | 02,033,432 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exe
PRC - [2009/12/13 09:41:21 | 00,503,576 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe
PRC - [2009/12/13 09:41:20 | 00,600,344 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe
PRC - [2009/11/24 17:36:23 | 01,055,000 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe
PRC - [2009/11/24 17:22:46 | 00,702,744 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe
PRC - [2009/11/24 17:22:46 | 00,285,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe
PRC - [2009/11/12 16:33:10 | 00,141,600 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunesHelper.exe
PRC - [2009/11/12 16:33:00 | 00,545,568 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe
PRC - [2009/10/11 04:17:35 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2009/07/09 11:22:18 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2009/06/17 11:21:20 | 00,073,728 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe
PRC - [2009/06/10 03:02:50 | 00,904,840 | ---- | M] (Acronis) -- C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
PRC - [2009/06/10 02:57:40 | 00,136,472 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
PRC - [2009/06/10 02:57:36 | 00,431,384 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
PRC - [2009/06/01 12:51:52 | 01,468,296 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft IntelliPoint\ipoint.exe
PRC - [2009/06/01 12:43:46 | 01,501,064 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft IntelliType Pro\itype.exe
PRC - [2009/03/27 23:03:00 | 00,163,908 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe
PRC - [2009/03/08 13:09:26 | 00,638,816 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe
PRC - [2009/02/15 23:10:22 | 02,402,184 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe
PRC - [2009/02/15 23:10:22 | 00,981,384 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2008/12/12 10:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2008/08/20 15:19:06 | 00,131,072 | ---- | M] () -- C:\Program Files\Multimedia Card Reader\readericon10.exe
PRC - [2008/08/20 09:54:08 | 00,150,016 | ---- | M] (Hewlett-Packard) -- C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe
PRC - [2008/07/21 15:54:34 | 00,169,312 | ---- | M] (Maxtor Corporation) -- C:\Program Files\Maxtor\OneTouch Status\MaxMenuMgr.exe
PRC - [2008/07/21 15:53:04 | 00,193,888 | ---- | M] (Seagate Technology LLC) -- C:\Program Files\Maxtor\Sync\SyncServices.exe
PRC - [2008/06/24 18:56:52 | 00,136,472 | ---- | M] (Seagate) -- C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe
PRC - [2008/06/24 18:56:38 | 00,431,384 | ---- | M] (Seagate) -- C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe
PRC - [2008/06/24 18:52:18 | 01,325,848 | ---- | M] (Seagate) -- C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe
PRC - [2008/04/13 18:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/12/19 09:30:26 | 00,081,920 | ---- | M] (Prolific Technology Inc.) -- C:\WINDOWS\system32\IoctlSvc.exe
PRC - [2005/04/29 17:22:26 | 00,266,240 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
PRC - [2005/04/29 17:21:06 | 00,139,264 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
PRC - [2005/04/29 17:18:24 | 00,131,136 | ---- | M] (NVIDIA) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
PRC - [2005/04/29 17:18:08 | 00,057,412 | ---- | M] (NVIDIA) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
PRC - [2005/04/14 21:01:46 | 00,077,824 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE
PRC - [2005/04/05 17:01:36 | 00,282,624 | ---- | M] (FUJI PHOTO FILM CO., LTD.) -- C:\Program Files\FinePixViewer\QuickDCF.exe
PRC - [2005/01/17 00:43:46 | 00,084,480 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvraidservice.exe
PRC - [2004/11/30 10:08:56 | 00,020,543 | ---- | M] (Apache Software Foundation) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe
PRC - [2004/09/29 11:14:36 | 00,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe
PRC - [2004/08/04 06:00:00 | 00,016,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\unsecapp.exe
========== Modules (SafeList) ==========
MOD - [2009/12/28 20:21:09 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Walls\Desktop\Spyware Tools\OTL.exe
========== Win32 Services (SafeList) ==========
SRV - [2009/11/24 17:22:46 | 00,285,392 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
SRV - [2009/11/12 16:33:00 | 00,545,568 | ---- | M] (Apple Inc.) [On_Demand | Running] -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service)
SRV - [2009/10/11 04:17:35 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) [Auto | Running] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2009/09/23 15:37:30 | 00,051,168 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus®
SRV - [2009/07/09 11:22:18 | 00,144,712 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009/06/17 11:21:20 | 00,073,728 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe -- (LightScribeService)
SRV - [2009/06/10 02:57:36 | 00,431,384 | ---- | M] (Acronis) [Auto | Running] -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc)
SRV - [2009/03/27 23:03:00 | 00,163,908 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc)
SRV - [2009/02/15 23:10:22 | 02,402,184 | ---- | M] (Check Point Software Technologies LTD) [Auto | Running] -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2008/12/12 10:17:38 | 00,238,888 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)
SRV - [2008/11/04 00:06:28 | 00,441,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2008/07/21 15:53:04 | 00,193,888 | ---- | M] (Seagate Technology LLC) [Auto | Running] -- C:\Program Files\Maxtor\Sync\SyncServices.exe -- (Maxtor Sync Service)
SRV - [2008/06/24 18:56:38 | 00,431,384 | ---- | M] (Seagate) [Auto | Running] -- C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe -- (SgtSch2Svc)
SRV - [2008/04/08 08:56:30 | 00,800,040 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe -- (NBService)
SRV - [2008/01/22 10:13:26 | 00,275,752 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2006/12/19 09:30:26 | 00,081,920 | ---- | M] (Prolific Technology Inc.) [Auto | Running] -- C:\WINDOWS\system32\IoctlSvc.exe -- (PLFlash DeviceIoControl Service)
SRV - [2006/10/26 13:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2005/04/29 17:21:06 | 00,139,264 | ---- | M] () [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM)
SRV - [2005/04/29 17:18:24 | 00,131,136 | ---- | M] (NVIDIA) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe -- (nSvcIp)
SRV - [2005/04/29 17:18:08 | 00,057,412 | ---- | M] (NVIDIA) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe -- (nSvcLog)
SRV - [2004/11/30 10:08:56 | 00,020,543 | ---- | M] (Apache Software Foundation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe -- (ForcewareWebInterface)
SRV - [2004/09/29 11:14:36 | 00,069,632 | ---- | M] (HP) [Auto | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555
========== FireFox ==========
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.716
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: [email protected]:7
FF - prefs.js..extensions.enabledItems: {AE93811A-5C9A-4d34-8462-F7B864FC4696}:3.52
FF - prefs.js..extensions.enabledItems: [email protected]:2.0
FF - prefs.js..extensions.enabledItems: [email protected]:1.0.5
FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2009/12/13 09:41:59 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/12/17 20:40:12 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/12/17 20:40:12 | 00,000,000 | ---D | M]
[2009/08/24 20:56:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Walls\Application Data\Mozilla\Extensions
[2009/12/27 13:15:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Walls\Application Data\Mozilla\Firefox\Profiles\ka4a62l5.default\extensions
[2009/12/14 18:33:15 | 00,000,000 | ---D | M] (FlashGot) -- C:\Documents and Settings\Walls\Application Data\Mozilla\Firefox\Profiles\ka4a62l5.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2009/11/10 21:22:49 | 00,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Walls\Application Data\Mozilla\Firefox\Profiles\ka4a62l5.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}
[2009/08/24 20:59:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Walls\Application Data\Mozilla\Firefox\Profiles\ka4a62l5.default\extensions\[email protected]
[2009/11/30 22:43:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Walls\Application Data\Mozilla\Firefox\Profiles\ka4a62l5.default\extensions\[email protected]
[2009/12/27 13:15:20 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
O1 HOSTS File: (25 bytes) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis)
O4 - HKLM..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe (Acronis)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CloneCDTray] C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe (SlySoft, Inc.)
O4 - HKLM..\Run: [DiscWizardMonitor.exe] C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe (Seagate)
O4 - HKLM..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe (Hewlett-Packard)
O4 - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [itype] c:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MoneyStartUp10.0] C:\Program Files\Microsoft Money\System\Activation.exe (Microsoft Corporation)
O4 - HKLM..\Run: [mxomssmenu] C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe (Maxtor Corporation)
O4 - HKLM..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
O4 - HKLM..\Run: [readericon10] C:\Program Files\Multimedia Card Reader\readericon10.exe ()
O4 - HKLM..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE (FUJI PHOTO FILM CO., LTD.)
O4 - HKLM..\Run: [Seagate Scheduler2 Service] C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe (Seagate)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe (FUJI PHOTO FILM CO., LTD.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe ()
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: microsoft.com ([update] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([windowswupdate] http in Trusted sites)
O15 - HKCU\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {2BCDB465-81F9-41CB-832C-8037A4064446} https://fpe.acxiom.c...0,2009,327,1607 (F5 Networks VPN Manager)
O16 - DPF: {41EF3CD2-D8CC-4438-84B1-280BB4E77C8E} https://fpe.acxiom.c...0,2009,327,1558 (F5 Networks Dynamic Application Tunnel Control)
O16 - DPF: {45B69029-F3AB-4204-92DE-D5140C3E8E74} https://fpe.acxiom.c...llerControl.cab (F5 Networks Auto Update)
O16 - DPF: {57C76689-F052-487B-A19F-855AFDDF28EE} https://fpe.acxiom.c...,2009,0327,1547 (F5 Networks Policy Agent Host Class)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitd...can8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.micros...b?1251067026921 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.micros...b?1251067186343 (MUWebControl Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebo...oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {A3256902-51FA-45A0-8A97-FC1143C169D9} http://support.micro...gWebControl.cab (Diagnostics ActiveX WebControl)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CC85ACDF-B277-486F-8C70-2C9B2ED2A4E7} https://fpe.acxiom.c...0,2009,327,1553 (F5 Networks SuperHost Class)
O16 - DPF: {E0FF21FA-B857-45C5-8621-F120A0C17FF2} https://fpe.acxiom.c...0,2009,327,1548 (F5 Networks Host Control)
O16 - DPF: {E615C9EA-AD69-4AE9-83C9-9D906A0ACA6D} https://fpe.acxiom.c...,2009,0327,1557 (F5 Networks OS Policy Agent)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O22 - SharedTaskScheduler: {1984DD45-52CF-49cd-AB77-18F378FEA264} - FencesShellExt - C:\Program Files\Stardock\Fences\FencesMenu.dll (Stardock)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O30 - LSA: Authentication Packages - (relog_ap) - C:\WINDOWS\System32\relog_ap.dll (Acronis)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/08/23 13:55:52 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2009/09/26 08:23:30 | 00,000,055 | ---- | M] () - H:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009/09/24 16:50:30 | 00,000,055 | ---- | M] () - I:\autorun.inf -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*
NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2009/08/23 08:37:29 | 00,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16892003295952896)
========== Files/Folders - Created Within 14 Days ==========
[2009/12/28 20:31:58 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2009/12/28 19:05:33 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Walls\Desktop\Spyware Tools
[2009/12/28 16:19:02 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Walls\Local Settings\Application Data\fdeqfj
[2009/12/22 21:14:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Walls\Desktop\Tabbie Pro 2
[2009/12/22 20:42:07 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Walls\My Documents\HP Photosmart Projects
[2009/12/14 22:10:24 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Walls\Desktop\Sort this stuff
[2009/11/24 17:07:56 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2009/11/24 17:07:56 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2009/11/24 17:07:56 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2009/11/24 17:07:56 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2005/05/11 22:36:48 | 00,012,288 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\Fonts\RandFont.dll
========== Files - Modified Within 14 Days ==========
[2009/12/28 20:26:08 | 00,350,192 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2009/12/28 20:26:07 | 00,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/12/28 20:25:37 | 00,215,715 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2009/12/28 20:25:19 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/12/28 20:24:59 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/12/28 20:23:55 | 05,505,024 | ---- | M] () -- C:\Documents and Settings\Walls\NTUSER.DAT
[2009/12/28 17:15:12 | 47,177,190 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2009/12/28 09:42:29 | 00,128,154 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2009/12/26 21:37:44 | 00,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/12/23 21:54:05 | 00,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
========== Files Created - No Company Name ==========
[2009/12/06 18:06:24 | 00,000,000 | ---- | C] () -- C:\WINDOWS\SETUP32.INI
[2009/12/06 17:52:24 | 00,000,066 | ---- | C] () -- C:\WINDOWS\KA.INI
[2009/12/01 18:05:41 | 00,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini
[2009/12/01 18:05:38 | 00,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2009/11/11 16:41:44 | 00,000,067 | ---- | C] () -- C:\WINDOWS\swf2avi.INI
[2009/11/11 16:41:37 | 00,758,018 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009/11/11 16:41:37 | 00,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2009/09/10 18:15:28 | 00,166,584 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2009/09/10 18:15:05 | 00,721,904 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2009/09/05 02:03:24 | 00,015,360 | ---- | C] () -- C:\Documents and Settings\Walls\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/30 17:14:25 | 00,069,632 | ---- | C] () -- C:\WINDOWS\System32\SoundOut_H264.dll
[2009/08/30 17:14:25 | 00,067,584 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009/08/28 21:58:02 | 00,014,976 | ---- | C] () -- C:\WINDOWS\System32\drivers\SBKUPNT.SYS
[2009/08/28 21:57:42 | 00,002,799 | ---- | C] () -- C:\WINDOWS\SKLANG.INI
[2009/08/26 19:43:59 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009/08/25 20:49:58 | 00,038,464 | ---- | C] () -- C:\Documents and Settings\Walls\Application Data\Comma Separated Values (Windows).ADR
[2009/08/25 15:20:57 | 00,000,128 | ---- | C] () -- C:\Documents and Settings\Walls\Local Settings\Application Data\fusioncache.dat
[2009/08/25 15:08:56 | 00,077,824 | R--- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2009/08/25 15:08:27 | 00,000,165 | ---- | C] () -- C:\WINDOWS\System32\AddPort.ini
[2009/08/25 15:08:11 | 00,000,684 | ---- | C] () -- C:\WINDOWS\hpntwksetup.ini
[2009/08/25 15:00:13 | 00,001,425 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2009/08/24 21:34:46 | 00,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2009/08/24 21:34:15 | 00,000,021 | ---- | C] () -- C:\WINDOWS\CS_setup.ini
[2009/08/23 22:29:05 | 00,040,960 | ---- | C] () -- C:\Program Files\Uninstall_CDS.exe
[2009/08/23 21:58:52 | 00,000,083 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\.zreglib
[2009/08/23 16:36:37 | 00,000,169 | ---- | C] () -- C:\WINDOWS\RtlRack.ini
[2009/08/23 14:20:40 | 00,024,576 | R--- | C] () -- C:\WINDOWS\System32\AsIO.dll
[2009/08/23 14:20:40 | 00,004,962 | R--- | C] () -- C:\WINDOWS\System32\drivers\AsIO.sys
[2009/08/23 14:20:38 | 00,005,120 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsInsHelp64.sys
[2009/08/23 14:20:38 | 00,003,328 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsInsHelp32.sys
[2009/08/23 14:06:06 | 00,000,266 | R--- | C] () -- C:\WINDOWS\System32\raidmgmt.ini
[2009/08/23 14:04:51 | 00,005,733 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2009/08/23 14:04:50 | 00,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2009/08/23 14:04:47 | 00,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2009/08/03 14:07:42 | 00,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/03/27 23:03:00 | 01,724,416 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2009/03/27 23:03:00 | 01,503,232 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2009/03/27 23:03:00 | 01,101,824 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2009/03/27 23:03:00 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2009/01/05 14:44:10 | 00,000,453 | ---- | C] () -- C:\WINDOWS\bdoscandellang.ini
[2001/07/06 14:30:00 | 00,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini
========== LOP Check ==========
[2009/09/27 20:44:59 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Acronis
[2009/11/24 17:22:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2009/08/23 22:02:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Elaborate Bytes
[2009/08/23 22:39:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LightScribe
[2009/08/25 22:27:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Maxtor
[2009/08/26 16:55:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Seagate
[2009/08/23 22:02:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SlySoft
[2009/08/23 21:33:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2009/08/23 21:40:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZipSE
[2009/09/22 19:49:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/08/26 18:00:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2009/11/27 21:31:36 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}
[2009/10/13 21:51:08 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Walls\Application Data\Amazon
[2009/12/01 19:11:56 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Walls\Application Data\ElevatedDiagnostics
[2009/09/28 20:12:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Walls\Application Data\FUJIFILM
[2009/11/10 20:44:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Walls\Application Data\iTunes Agent
[2009/11/27 21:31:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Walls\Application Data\Stardock
[2009/10/21 20:40:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Walls\Application Data\uTorrent
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*.exe >
[2009/12/06 13:20:18 | 00,005,467 | ---- | M] () -- C:\latitude.exe
< MD5 for: AGP440.SYS >
[2008/04/13 12:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ERDNT\cache\agp440.sys
[2008/04/13 12:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 12:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
< MD5 for: ATAPI.SYS >
[2008/04/13 12:40:30 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 12:40:30 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/04 06:00:00 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004/08/04 06:00:00 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\atapi.sys
[2004/08/04 06:00:00 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\atapi.sys
< MD5 for: EVENTLOG.DLL >
[2008/04/13 18:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008/04/13 18:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 18:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll
[2004/08/04 06:00:00 | 00,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
< MD5 for: NETLOGON.DLL >
[2008/04/13 18:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008/04/13 18:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 18:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll
[2004/08/04 06:00:00 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
< MD5 for: NVATA.SYS >
[2005/05/17 03:45:08 | 00,092,800 | R--- | M] (NVIDIA Corporation) MD5=DCE353985C988BFB7E84FD942068151F -- C:\WINDOWS\system32\drivers\nvata.sys
< MD5 for: NVATABUS.SYS >
[2005/05/17 11:45:08 | 00,092,800 | ---- | M] (NVIDIA Corporation) MD5=DCE353985C988BFB7E84FD942068151F -- C:\WINDOWS\OemDir\nvatabus.sys
[2005/05/17 03:45:08 | 00,092,800 | R--- | M] (NVIDIA Corporation) MD5=DCE353985C988BFB7E84FD942068151F -- C:\WINDOWS\system32\drivers\nvatabus.sys
[2005/05/17 11:45:08 | 00,092,800 | ---- | M] (NVIDIA Corporation) MD5=DCE353985C988BFB7E84FD942068151F -- C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\nvatabus.sys
< MD5 for: SCECLI.DLL >
[2004/08/04 06:00:00 | 00,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 18:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ERDNT\cache\scecli.dll
[2008/04/13 18:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 18:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll
< %systemroot%\*. /mp /s >
< %systemroot%\system32\*.dll /lockedfiles >
[2009/03/08 03:31:44 | 00,348,160 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtmsft.dll
[2009/03/08 03:31:38 | 00,216,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtrans.dll
< End of report >
OTL by OldTimer - Version 3.1.20.1 Folder = C:\Documents and Settings\Walls\Desktop\Spyware Tools
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 77.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 88.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.05 Gb Total Space | 78.16 Gb Free Space | 52.44% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 279.47 Gb Total Space | 119.17 Gb Free Space | 42.64% Space Free | Partition Type: NTFS
Drive I: | 698.64 Gb Total Space | 470.00 Gb Free Space | 67.27% Space Free | Partition Type: NTFS
Computer Name: WALLS-DESKTOP
Current User Name: Walls
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan
========== Processes (SafeList) ==========
PRC - [2009/12/28 20:21:09 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Walls\Desktop\Spyware Tools\OTL.exe
PRC - [2009/12/19 10:57:43 | 02,002,160 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
PRC - [2009/12/13 09:41:23 | 02,033,432 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exe
PRC - [2009/12/13 09:41:21 | 00,503,576 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe
PRC - [2009/12/13 09:41:20 | 00,600,344 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe
PRC - [2009/11/24 17:36:23 | 01,055,000 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe
PRC - [2009/11/24 17:22:46 | 00,702,744 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe
PRC - [2009/11/24 17:22:46 | 00,285,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe
PRC - [2009/11/12 16:33:10 | 00,141,600 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunesHelper.exe
PRC - [2009/11/12 16:33:00 | 00,545,568 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe
PRC - [2009/10/11 04:17:35 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2009/07/09 11:22:18 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2009/06/17 11:21:20 | 00,073,728 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe
PRC - [2009/06/10 03:02:50 | 00,904,840 | ---- | M] (Acronis) -- C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
PRC - [2009/06/10 02:57:40 | 00,136,472 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
PRC - [2009/06/10 02:57:36 | 00,431,384 | ---- | M] (Acronis) -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
PRC - [2009/06/01 12:51:52 | 01,468,296 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft IntelliPoint\ipoint.exe
PRC - [2009/06/01 12:43:46 | 01,501,064 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft IntelliType Pro\itype.exe
PRC - [2009/03/27 23:03:00 | 00,163,908 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe
PRC - [2009/03/08 13:09:26 | 00,638,816 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe
PRC - [2009/02/15 23:10:22 | 02,402,184 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe
PRC - [2009/02/15 23:10:22 | 00,981,384 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2008/12/12 10:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2008/08/20 15:19:06 | 00,131,072 | ---- | M] () -- C:\Program Files\Multimedia Card Reader\readericon10.exe
PRC - [2008/08/20 09:54:08 | 00,150,016 | ---- | M] (Hewlett-Packard) -- C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe
PRC - [2008/07/21 15:54:34 | 00,169,312 | ---- | M] (Maxtor Corporation) -- C:\Program Files\Maxtor\OneTouch Status\MaxMenuMgr.exe
PRC - [2008/07/21 15:53:04 | 00,193,888 | ---- | M] (Seagate Technology LLC) -- C:\Program Files\Maxtor\Sync\SyncServices.exe
PRC - [2008/06/24 18:56:52 | 00,136,472 | ---- | M] (Seagate) -- C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe
PRC - [2008/06/24 18:56:38 | 00,431,384 | ---- | M] (Seagate) -- C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe
PRC - [2008/06/24 18:52:18 | 01,325,848 | ---- | M] (Seagate) -- C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe
PRC - [2008/04/13 18:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/12/19 09:30:26 | 00,081,920 | ---- | M] (Prolific Technology Inc.) -- C:\WINDOWS\system32\IoctlSvc.exe
PRC - [2005/04/29 17:22:26 | 00,266,240 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
PRC - [2005/04/29 17:21:06 | 00,139,264 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
PRC - [2005/04/29 17:18:24 | 00,131,136 | ---- | M] (NVIDIA) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
PRC - [2005/04/29 17:18:08 | 00,057,412 | ---- | M] (NVIDIA) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
PRC - [2005/04/14 21:01:46 | 00,077,824 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE
PRC - [2005/04/05 17:01:36 | 00,282,624 | ---- | M] (FUJI PHOTO FILM CO., LTD.) -- C:\Program Files\FinePixViewer\QuickDCF.exe
PRC - [2005/01/17 00:43:46 | 00,084,480 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvraidservice.exe
PRC - [2004/11/30 10:08:56 | 00,020,543 | ---- | M] (Apache Software Foundation) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe
PRC - [2004/09/29 11:14:36 | 00,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe
PRC - [2004/08/04 06:00:00 | 00,016,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\unsecapp.exe
========== Modules (SafeList) ==========
MOD - [2009/12/28 20:21:09 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Walls\Desktop\Spyware Tools\OTL.exe
========== Win32 Services (SafeList) ==========
SRV - [2009/11/24 17:22:46 | 00,285,392 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
SRV - [2009/11/12 16:33:00 | 00,545,568 | ---- | M] (Apple Inc.) [On_Demand | Running] -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service)
SRV - [2009/10/11 04:17:35 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) [Auto | Running] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2009/09/23 15:37:30 | 00,051,168 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus®
SRV - [2009/07/09 11:22:18 | 00,144,712 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009/06/17 11:21:20 | 00,073,728 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe -- (LightScribeService)
SRV - [2009/06/10 02:57:36 | 00,431,384 | ---- | M] (Acronis) [Auto | Running] -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc)
SRV - [2009/03/27 23:03:00 | 00,163,908 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc)
SRV - [2009/02/15 23:10:22 | 02,402,184 | ---- | M] (Check Point Software Technologies LTD) [Auto | Running] -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2008/12/12 10:17:38 | 00,238,888 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)
SRV - [2008/11/04 00:06:28 | 00,441,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2008/07/21 15:53:04 | 00,193,888 | ---- | M] (Seagate Technology LLC) [Auto | Running] -- C:\Program Files\Maxtor\Sync\SyncServices.exe -- (Maxtor Sync Service)
SRV - [2008/06/24 18:56:38 | 00,431,384 | ---- | M] (Seagate) [Auto | Running] -- C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe -- (SgtSch2Svc)
SRV - [2008/04/08 08:56:30 | 00,800,040 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe -- (NBService)
SRV - [2008/01/22 10:13:26 | 00,275,752 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2006/12/19 09:30:26 | 00,081,920 | ---- | M] (Prolific Technology Inc.) [Auto | Running] -- C:\WINDOWS\system32\IoctlSvc.exe -- (PLFlash DeviceIoControl Service)
SRV - [2006/10/26 13:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2005/04/29 17:21:06 | 00,139,264 | ---- | M] () [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM)
SRV - [2005/04/29 17:18:24 | 00,131,136 | ---- | M] (NVIDIA) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe -- (nSvcIp)
SRV - [2005/04/29 17:18:08 | 00,057,412 | ---- | M] (NVIDIA) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe -- (nSvcLog)
SRV - [2004/11/30 10:08:56 | 00,020,543 | ---- | M] (Apache Software Foundation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe -- (ForcewareWebInterface)
SRV - [2004/09/29 11:14:36 | 00,069,632 | ---- | M] (HP) [Auto | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555
========== FireFox ==========
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.716
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: [email protected]:7
FF - prefs.js..extensions.enabledItems: {AE93811A-5C9A-4d34-8462-F7B864FC4696}:3.52
FF - prefs.js..extensions.enabledItems: [email protected]:2.0
FF - prefs.js..extensions.enabledItems: [email protected]:1.0.5
FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2009/12/13 09:41:59 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/12/17 20:40:12 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/12/17 20:40:12 | 00,000,000 | ---D | M]
[2009/08/24 20:56:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Walls\Application Data\Mozilla\Extensions
[2009/12/27 13:15:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Walls\Application Data\Mozilla\Firefox\Profiles\ka4a62l5.default\extensions
[2009/12/14 18:33:15 | 00,000,000 | ---D | M] (FlashGot) -- C:\Documents and Settings\Walls\Application Data\Mozilla\Firefox\Profiles\ka4a62l5.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2009/11/10 21:22:49 | 00,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Walls\Application Data\Mozilla\Firefox\Profiles\ka4a62l5.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}
[2009/08/24 20:59:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Walls\Application Data\Mozilla\Firefox\Profiles\ka4a62l5.default\extensions\[email protected]
[2009/11/30 22:43:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Walls\Application Data\Mozilla\Firefox\Profiles\ka4a62l5.default\extensions\[email protected]
[2009/12/27 13:15:20 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
O1 HOSTS File: (25 bytes) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis)
O4 - HKLM..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe (Acronis)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CloneCDTray] C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe (SlySoft, Inc.)
O4 - HKLM..\Run: [DiscWizardMonitor.exe] C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe (Seagate)
O4 - HKLM..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe (Hewlett-Packard)
O4 - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [itype] c:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MoneyStartUp10.0] C:\Program Files\Microsoft Money\System\Activation.exe (Microsoft Corporation)
O4 - HKLM..\Run: [mxomssmenu] C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe (Maxtor Corporation)
O4 - HKLM..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
O4 - HKLM..\Run: [readericon10] C:\Program Files\Multimedia Card Reader\readericon10.exe ()
O4 - HKLM..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE (FUJI PHOTO FILM CO., LTD.)
O4 - HKLM..\Run: [Seagate Scheduler2 Service] C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe (Seagate)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe (FUJI PHOTO FILM CO., LTD.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe ()
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: microsoft.com ([update] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([windowswupdate] http in Trusted sites)
O15 - HKCU\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {2BCDB465-81F9-41CB-832C-8037A4064446} https://fpe.acxiom.c...0,2009,327,1607 (F5 Networks VPN Manager)
O16 - DPF: {41EF3CD2-D8CC-4438-84B1-280BB4E77C8E} https://fpe.acxiom.c...0,2009,327,1558 (F5 Networks Dynamic Application Tunnel Control)
O16 - DPF: {45B69029-F3AB-4204-92DE-D5140C3E8E74} https://fpe.acxiom.c...llerControl.cab (F5 Networks Auto Update)
O16 - DPF: {57C76689-F052-487B-A19F-855AFDDF28EE} https://fpe.acxiom.c...,2009,0327,1547 (F5 Networks Policy Agent Host Class)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitd...can8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.micros...b?1251067026921 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.micros...b?1251067186343 (MUWebControl Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebo...oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {A3256902-51FA-45A0-8A97-FC1143C169D9} http://support.micro...gWebControl.cab (Diagnostics ActiveX WebControl)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CC85ACDF-B277-486F-8C70-2C9B2ED2A4E7} https://fpe.acxiom.c...0,2009,327,1553 (F5 Networks SuperHost Class)
O16 - DPF: {E0FF21FA-B857-45C5-8621-F120A0C17FF2} https://fpe.acxiom.c...0,2009,327,1548 (F5 Networks Host Control)
O16 - DPF: {E615C9EA-AD69-4AE9-83C9-9D906A0ACA6D} https://fpe.acxiom.c...,2009,0327,1557 (F5 Networks OS Policy Agent)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O22 - SharedTaskScheduler: {1984DD45-52CF-49cd-AB77-18F378FEA264} - FencesShellExt - C:\Program Files\Stardock\Fences\FencesMenu.dll (Stardock)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O30 - LSA: Authentication Packages - (relog_ap) - C:\WINDOWS\System32\relog_ap.dll (Acronis)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/08/23 13:55:52 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2009/09/26 08:23:30 | 00,000,055 | ---- | M] () - H:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009/09/24 16:50:30 | 00,000,055 | ---- | M] () - I:\autorun.inf -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*
NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2009/08/23 08:37:29 | 00,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16892003295952896)
========== Files/Folders - Created Within 14 Days ==========
[2009/12/28 20:31:58 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2009/12/28 19:05:33 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Walls\Desktop\Spyware Tools
[2009/12/28 16:19:02 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Walls\Local Settings\Application Data\fdeqfj
[2009/12/22 21:14:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Walls\Desktop\Tabbie Pro 2
[2009/12/22 20:42:07 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Walls\My Documents\HP Photosmart Projects
[2009/12/14 22:10:24 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Walls\Desktop\Sort this stuff
[2009/11/24 17:07:56 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2009/11/24 17:07:56 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2009/11/24 17:07:56 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2009/11/24 17:07:56 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2005/05/11 22:36:48 | 00,012,288 | ---- | C] (Hewlett-Packard Co.) -- C:\WINDOWS\Fonts\RandFont.dll
========== Files - Modified Within 14 Days ==========
[2009/12/28 20:26:08 | 00,350,192 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2009/12/28 20:26:07 | 00,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/12/28 20:25:37 | 00,215,715 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2009/12/28 20:25:19 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/12/28 20:24:59 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/12/28 20:23:55 | 05,505,024 | ---- | M] () -- C:\Documents and Settings\Walls\NTUSER.DAT
[2009/12/28 17:15:12 | 47,177,190 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2009/12/28 09:42:29 | 00,128,154 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2009/12/26 21:37:44 | 00,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/12/23 21:54:05 | 00,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
========== Files Created - No Company Name ==========
[2009/12/06 18:06:24 | 00,000,000 | ---- | C] () -- C:\WINDOWS\SETUP32.INI
[2009/12/06 17:52:24 | 00,000,066 | ---- | C] () -- C:\WINDOWS\KA.INI
[2009/12/01 18:05:41 | 00,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini
[2009/12/01 18:05:38 | 00,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2009/11/11 16:41:44 | 00,000,067 | ---- | C] () -- C:\WINDOWS\swf2avi.INI
[2009/11/11 16:41:37 | 00,758,018 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009/11/11 16:41:37 | 00,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2009/09/10 18:15:28 | 00,166,584 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2009/09/10 18:15:05 | 00,721,904 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2009/09/05 02:03:24 | 00,015,360 | ---- | C] () -- C:\Documents and Settings\Walls\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/30 17:14:25 | 00,069,632 | ---- | C] () -- C:\WINDOWS\System32\SoundOut_H264.dll
[2009/08/30 17:14:25 | 00,067,584 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009/08/28 21:58:02 | 00,014,976 | ---- | C] () -- C:\WINDOWS\System32\drivers\SBKUPNT.SYS
[2009/08/28 21:57:42 | 00,002,799 | ---- | C] () -- C:\WINDOWS\SKLANG.INI
[2009/08/26 19:43:59 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009/08/25 20:49:58 | 00,038,464 | ---- | C] () -- C:\Documents and Settings\Walls\Application Data\Comma Separated Values (Windows).ADR
[2009/08/25 15:20:57 | 00,000,128 | ---- | C] () -- C:\Documents and Settings\Walls\Local Settings\Application Data\fusioncache.dat
[2009/08/25 15:08:56 | 00,077,824 | R--- | C] () -- C:\WINDOWS\System32\hpzids01.dll
[2009/08/25 15:08:27 | 00,000,165 | ---- | C] () -- C:\WINDOWS\System32\AddPort.ini
[2009/08/25 15:08:11 | 00,000,684 | ---- | C] () -- C:\WINDOWS\hpntwksetup.ini
[2009/08/25 15:00:13 | 00,001,425 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2009/08/24 21:34:46 | 00,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2009/08/24 21:34:15 | 00,000,021 | ---- | C] () -- C:\WINDOWS\CS_setup.ini
[2009/08/23 22:29:05 | 00,040,960 | ---- | C] () -- C:\Program Files\Uninstall_CDS.exe
[2009/08/23 21:58:52 | 00,000,083 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\.zreglib
[2009/08/23 16:36:37 | 00,000,169 | ---- | C] () -- C:\WINDOWS\RtlRack.ini
[2009/08/23 14:20:40 | 00,024,576 | R--- | C] () -- C:\WINDOWS\System32\AsIO.dll
[2009/08/23 14:20:40 | 00,004,962 | R--- | C] () -- C:\WINDOWS\System32\drivers\AsIO.sys
[2009/08/23 14:20:38 | 00,005,120 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsInsHelp64.sys
[2009/08/23 14:20:38 | 00,003,328 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsInsHelp32.sys
[2009/08/23 14:06:06 | 00,000,266 | R--- | C] () -- C:\WINDOWS\System32\raidmgmt.ini
[2009/08/23 14:04:51 | 00,005,733 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2009/08/23 14:04:50 | 00,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2009/08/23 14:04:47 | 00,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2009/08/03 14:07:42 | 00,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/03/27 23:03:00 | 01,724,416 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2009/03/27 23:03:00 | 01,503,232 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2009/03/27 23:03:00 | 01,101,824 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2009/03/27 23:03:00 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2009/01/05 14:44:10 | 00,000,453 | ---- | C] () -- C:\WINDOWS\bdoscandellang.ini
[2001/07/06 14:30:00 | 00,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini
========== LOP Check ==========
[2009/09/27 20:44:59 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Acronis
[2009/11/24 17:22:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2009/08/23 22:02:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Elaborate Bytes
[2009/08/23 22:39:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LightScribe
[2009/08/25 22:27:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Maxtor
[2009/08/26 16:55:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Seagate
[2009/08/23 22:02:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SlySoft
[2009/08/23 21:33:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2009/08/23 21:40:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZipSE
[2009/09/22 19:49:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/08/26 18:00:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2009/11/27 21:31:36 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{A87EB928-0C6C-4071-AEF1-59E32BAEDF1B}
[2009/10/13 21:51:08 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Walls\Application Data\Amazon
[2009/12/01 19:11:56 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Walls\Application Data\ElevatedDiagnostics
[2009/09/28 20:12:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Walls\Application Data\FUJIFILM
[2009/11/10 20:44:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Walls\Application Data\iTunes Agent
[2009/11/27 21:31:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Walls\Application Data\Stardock
[2009/10/21 20:40:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Walls\Application Data\uTorrent
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*.exe >
[2009/12/06 13:20:18 | 00,005,467 | ---- | M] () -- C:\latitude.exe
< MD5 for: AGP440.SYS >
[2008/04/13 12:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ERDNT\cache\agp440.sys
[2008/04/13 12:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 12:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
< MD5 for: ATAPI.SYS >
[2008/04/13 12:40:30 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 12:40:30 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/04 06:00:00 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004/08/04 06:00:00 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\atapi.sys
[2004/08/04 06:00:00 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\atapi.sys
< MD5 for: EVENTLOG.DLL >
[2008/04/13 18:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008/04/13 18:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 18:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll
[2004/08/04 06:00:00 | 00,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
< MD5 for: NETLOGON.DLL >
[2008/04/13 18:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008/04/13 18:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 18:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll
[2004/08/04 06:00:00 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
< MD5 for: NVATA.SYS >
[2005/05/17 03:45:08 | 00,092,800 | R--- | M] (NVIDIA Corporation) MD5=DCE353985C988BFB7E84FD942068151F -- C:\WINDOWS\system32\drivers\nvata.sys
< MD5 for: NVATABUS.SYS >
[2005/05/17 11:45:08 | 00,092,800 | ---- | M] (NVIDIA Corporation) MD5=DCE353985C988BFB7E84FD942068151F -- C:\WINDOWS\OemDir\nvatabus.sys
[2005/05/17 03:45:08 | 00,092,800 | R--- | M] (NVIDIA Corporation) MD5=DCE353985C988BFB7E84FD942068151F -- C:\WINDOWS\system32\drivers\nvatabus.sys
[2005/05/17 11:45:08 | 00,092,800 | ---- | M] (NVIDIA Corporation) MD5=DCE353985C988BFB7E84FD942068151F -- C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\nvatabus.sys
< MD5 for: SCECLI.DLL >
[2004/08/04 06:00:00 | 00,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 18:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ERDNT\cache\scecli.dll
[2008/04/13 18:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 18:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll
< %systemroot%\*. /mp /s >
< %systemroot%\system32\*.dll /lockedfiles >
[2009/03/08 03:31:44 | 00,348,160 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtmsft.dll
[2009/03/08 03:31:38 | 00,216,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtrans.dll
< End of report >
#4
Posted 28 December 2009 - 11:03 PM
trekkwalls
- Topic Starter
-
- Member
-
- 60 posts
Member
I don't know if this will be useful, but here is the original Super Anti-Spyware log. After I ran this I was able to run executables again.
***********************
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 12/28/2009 at 05:23 PM
Application Version : 4.32.1000
Core Rules Database Version : 4417
Trace Rules Database Version: 2244
Scan type : Complete Scan
Total Scan Time : 00:36:37
Memory items scanned : 504
Memory threats detected : 1
Registry items scanned : 6936
Registry threats detected : 39
File items scanned : 24141
File threats detected : 33
Trojan.Agent/Gen-FakeSpy[Broad]
C:\DOCUMENTS AND SETTINGS\WALLS\LOCAL SETTINGS\APPLICATION DATA\FDEQFJ\REBMSYSGUARD.EXE
C:\DOCUMENTS AND SETTINGS\WALLS\LOCAL SETTINGS\APPLICATION DATA\FDEQFJ\REBMSYSGUARD.EXE
C:\WINDOWS\Prefetch\REBMSYSGUARD.EXE-1A4207AE.pf
Trojan.Agent/Gen-FakeSpy[Broad-1]
[tlljdlss] C:\DOCUMENTS AND SETTINGS\WALLS\LOCAL SETTINGS\APPLICATION DATA\FDEQFJ\REBMSYSGUARD.EXE
[tlljdlss] C:\DOCUMENTS AND SETTINGS\WALLS\LOCAL SETTINGS\APPLICATION DATA\FDEQFJ\REBMSYSGUARD.EXE
Adware.Tracking Cookie
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
Rogue.Agent/Gen
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#aazalirt
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#skaaanret
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#jungertab
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#zibaglertz
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#iddqdops
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#ronitfst
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#tobmygers
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#jikglond
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#tobykke
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#klopnidret
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#jiklagka
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#salrtybek
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#seeukluba
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#jrjakdsd
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#krkdkdkee
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#dkewiizkjdks
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#dkekkrkska
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#rkaskssd
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#kuruhccdsdd
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#krujmmwlrra
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#kkwknrbsggeg
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#ktknamwerr
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#iqmcnoeqz
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#ienotas
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#krkmahejdk
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#otpeppggq
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#krtawefg
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#oranerkka
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#kitiiwhaas
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#otowjdseww
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#otnnbektre
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#oropbbsee
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#irprokwks
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#ooorjaas
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#id
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#ready
***********************
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 12/28/2009 at 05:23 PM
Application Version : 4.32.1000
Core Rules Database Version : 4417
Trace Rules Database Version: 2244
Scan type : Complete Scan
Total Scan Time : 00:36:37
Memory items scanned : 504
Memory threats detected : 1
Registry items scanned : 6936
Registry threats detected : 39
File items scanned : 24141
File threats detected : 33
Trojan.Agent/Gen-FakeSpy[Broad]
C:\DOCUMENTS AND SETTINGS\WALLS\LOCAL SETTINGS\APPLICATION DATA\FDEQFJ\REBMSYSGUARD.EXE
C:\DOCUMENTS AND SETTINGS\WALLS\LOCAL SETTINGS\APPLICATION DATA\FDEQFJ\REBMSYSGUARD.EXE
C:\WINDOWS\Prefetch\REBMSYSGUARD.EXE-1A4207AE.pf
Trojan.Agent/Gen-FakeSpy[Broad-1]
[tlljdlss] C:\DOCUMENTS AND SETTINGS\WALLS\LOCAL SETTINGS\APPLICATION DATA\FDEQFJ\REBMSYSGUARD.EXE
[tlljdlss] C:\DOCUMENTS AND SETTINGS\WALLS\LOCAL SETTINGS\APPLICATION DATA\FDEQFJ\REBMSYSGUARD.EXE
Adware.Tracking Cookie
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][1].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
C:\Documents and Settings\Walls\Cookies\[email protected][2].txt
Rogue.Agent/Gen
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#aazalirt
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#skaaanret
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#jungertab
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#zibaglertz
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#iddqdops
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#ronitfst
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#tobmygers
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#jikglond
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#tobykke
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#klopnidret
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#jiklagka
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#salrtybek
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#seeukluba
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#jrjakdsd
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#krkdkdkee
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#dkewiizkjdks
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#dkekkrkska
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#rkaskssd
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#kuruhccdsdd
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#krujmmwlrra
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#kkwknrbsggeg
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#ktknamwerr
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#iqmcnoeqz
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#ienotas
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#krkmahejdk
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#otpeppggq
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#krtawefg
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#oranerkka
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#kitiiwhaas
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#otowjdseww
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#otnnbektre
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#oropbbsee
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#irprokwks
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#ooorjaas
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#id
HKU\S-1-5-21-57989841-1979792683-1801674531-1003\SOFTWARE\AVSCAN#ready
Similar Topics
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users
As Featured On:
Sign In
Create Account
