Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Malware andSpware Stays After Reboot


  • Please log in to reply

#1
Bonjovicrzy41

Bonjovicrzy41

    Member

  • Member
  • PipPip
  • 12 posts
I have something and when I clean delete it with my malware,spyware antivirus it keeps coming back after reboot and my friends say I am sending spam to theme even if I am not sending emails through yahoo so I need this fixed any help would be appreciated

I did everything the guide told me and I am posting the logs with the OTL log when I ran the different spyware & antivirus programs I did not have them installed or running at the same time so there would not be conflict

I have Windows 7


Antivirus Scans .. my Avast and Online Armour AV says I am clean but I did a online scan at to 2 different Online Scans places one Online says I am clean but Panda says I have 7 files infected

Panda Log

;***********************************************************************************************************************
************************************************************
ANALYSIS: 2010-02-17 03:53:12
PROTECTIONS: 1
MALWARE: 3
SUSPECTS: 0
;***********************************************************************************************************************
************************************************************
PROTECTIONS
Description Version Active Updated
;=======================================================================================================================
============================================================
avast! Antivirus Yes Yes
;=======================================================================================================================
============================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;=======================================================================================================================
============================================================
00051983 adware/sbsoft Adware No 0 Yes No hkey_local_machine\software\classes\toolband.toolbandobj
00051983 adware/sbsoft Adware No 0 Yes No hkey_classes_root\toolband.toolbandobj
00051983 adware/sbsoft Adware No 0 Yes No hkey_classes_root\toolband.toolbandobj.1
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No c:\users\user\appdata\roaming\microsoft\windows\cookies\low\[email protected][2].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No c:\users\user\appdata\roaming\microsoft\windows\cookies\low\[email protected][3].txt
00155988 adware/fastlook Adware No 0 Yes No hkey_local_machine\software\classes\toolband.toolbandobj.1
00155988 adware/fastlook Adware No 0 Yes No hkey_current_user\software\toolband
;=======================================================================================================================
============================================================
SUSPECTS
Sent Location
;=======================================================================================================================
============================================================
;=======================================================================================================================
============================================================
VULNERABILITIES
Id Severity Description
;=======================================================================================================================
============================================================
;=======================================================================================================================
============================================================

Malwarebytes' Anti-Malware & Dr Web CureIt says I am clean but SuperAntispware ( the Pro version ) keeps picking up a Atdmst cookie

Malwarebytes' Anti-Malware Log

Malwarebytes' Anti-Malware 1.44
Database version: 3749
Windows 6.1.7600
Internet Explorer 8.0.7600.16385

2/17/2010 1:10:07 AM
mbam-log-2010-02-17 (01-10-07).txt

Scan type: Quick Scan
Objects scanned: 98820
Time elapsed: 2 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


SuperAntispware Log

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 02/17/2010 at 03:12 AM

Application Version : 4.33.1000

Core Rules Database Version : 4595
Trace Rules Database Version: 2407

Scan type : Quick Scan
Total Scan Time : 00:07:11

Memory items scanned : 639
Memory threats detected : 0
Registry items scanned : 478
Registry threats detected : 0
File items scanned : 16650
File threats detected : 1

Adware.Tracking Cookie
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt


GMER Rootkit Log

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-02-17 12:23:15
Windows 6.1.7600
Running: gmer.exe; Driver: C:\Users\user\AppData\Local\Temp\kxldapob.sys


---- System - GMER 1.0.15 ----

INT 0x1F \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C35AF8
INT 0x37 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C35104
INT 0xC1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C353F4
INT 0xD1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C1E2D8
INT 0xD2 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C1D898
INT 0xDF \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C351DC
INT 0xE1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C35958
INT 0xE3 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C356F8
INT 0xFD \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C35F2C
INT 0xFE \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C361A8

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateProcessEx [0x90D494FE]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateSection [0x90D49322]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwLoadDriver [0x90D4945C]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) NtCreateSection
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObMakeTemporaryObject

---- Devices - GMER 1.0.15 ----

Device \Driver\ACPI_HAL \Device\00000047 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice \Driver\tdx \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\tdx \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Edited by Bonjovicrzy41, 17 February 2010 - 01:32 PM.

  • 0

Advertisements


#2
Bonjovicrzy41

Bonjovicrzy41

    Member

  • Topic Starter
  • Member
  • PipPip
  • 12 posts
my OTL Log

OTL logfile created on: 2/17/2010 12:27:52 PM - Run 1
OTL by OldTimer - Version 3.1.28.0 Folder = C:\Users\user\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 76.00% Memory free
6.00 Gb Paging File | 6.00 Gb Available in Paging File | 87.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 465.66 Gb Total Space | 414.27 Gb Free Space | 88.96% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Unable to calculate disk information.
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: USER-PC
Current User Name: user
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/02/16 10:49:27 | 000,549,376 | ---- | M] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe
PRC - [2010/02/11 13:53:42 | 002,756,488 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2010/02/11 13:53:39 | 000,040,384 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2010/02/02 12:23:52 | 000,713,544 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
PRC - [2010/02/02 12:21:56 | 001,043,784 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
PRC - [2010/01/26 22:21:59 | 001,101,824 | ---- | M] (Zhorn Software) -- C:\Program Files\stickies\stickies.exe
PRC - [2010/01/05 07:56:02 | 002,002,160 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
PRC - [2009/10/31 00:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/08/18 02:36:36 | 000,348,160 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2009/08/18 02:36:08 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2009/07/13 20:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009/05/19 11:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2008/12/12 11:17:38 | 000,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2003/08/29 19:05:35 | 000,360,448 | ---- | M] () -- C:\Program Files\SpywareGuard\sgmain.exe
PRC - [2003/08/29 11:14:56 | 000,233,472 | ---- | M] () -- C:\Program Files\SpywareGuard\sgbhp.exe


========== Modules (SafeList) ==========

MOD - [2010/02/16 10:49:27 | 000,549,376 | ---- | M] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe
MOD - [2009/07/13 20:16:15 | 000,099,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sspicli.dll
MOD - [2009/07/13 20:16:13 | 000,092,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sechost.dll
MOD - [2009/07/13 20:16:12 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\profapi.dll
MOD - [2009/07/13 20:15:35 | 000,288,256 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\KernelBase.dll
MOD - [2009/07/13 20:15:13 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dwmapi.dll
MOD - [2009/07/13 20:15:11 | 000,064,512 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\devobj.dll
MOD - [2009/07/13 20:15:07 | 000,036,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cryptbase.dll
MOD - [2009/07/13 20:15:02 | 000,145,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cfgmgr32.dll
MOD - [2009/07/13 20:03:50 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2010/02/15 09:10:13 | 000,435,016 | ---- | M] (TuneUp Software) [On_Demand | Stopped] -- C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe -- (TuneUp.Defrag)
SRV - [2010/02/11 13:53:39 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010/02/11 13:53:39 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010/02/11 13:53:39 | 000,040,384 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010/02/02 12:21:56 | 001,043,784 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2010/02/02 12:18:22 | 000,030,024 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV - [2010/01/27 02:24:07 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009/08/18 02:36:08 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2009/07/13 20:16:21 | 000,185,856 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\wwansvc.dll -- (WwanSvc)
SRV - [2009/07/13 20:16:17 | 000,151,552 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\wbiosrvc.dll -- (WbioSrvc)
SRV - [2009/07/13 20:16:17 | 000,119,808 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\umpo.dll -- (Power)
SRV - [2009/07/13 20:16:16 | 000,037,376 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\themeservice.dll -- (Themes)
SRV - [2009/07/13 20:16:15 | 000,053,760 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sppuinotify.dll -- (sppuinotify)
SRV - [2009/07/13 20:16:13 | 000,043,520 | ---- | M] (Microsoft Corporation) [Unknown | Running] -- C:\Windows\System32\RpcEpMap.dll -- (RpcEptMapper)
SRV - [2009/07/13 20:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 20:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/13 20:16:12 | 000,269,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\pnrpsvc.dll -- (PNRPsvc)
SRV - [2009/07/13 20:16:12 | 000,269,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\pnrpsvc.dll -- (p2pimsvc)
SRV - [2009/07/13 20:16:12 | 000,165,376 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\provsvc.dll -- (HomeGroupProvider)
SRV - [2009/07/13 20:16:12 | 000,020,480 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\pnrpauto.dll -- (PNRPAutoReg)
SRV - [2009/07/13 20:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009/07/13 20:15:36 | 000,194,560 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\ListSvc.dll -- (HomeGroupListener)
SRV - [2009/07/13 20:15:21 | 000,797,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2009/07/13 20:15:11 | 000,253,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\dhcpcore.dll -- (Dhcp)
SRV - [2009/07/13 20:15:10 | 000,218,624 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\defragsvc.dll -- (defragsvc)
SRV - [2009/07/13 20:14:59 | 000,076,800 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\bdesvc.dll -- (BDESVC)
SRV - [2009/07/13 20:14:58 | 000,088,064 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\AxInstSv.dll -- (AxInstSV) ActiveX Installer (AxInstSV)
SRV - [2009/07/13 20:14:53 | 000,027,648 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\appidsvc.dll -- (AppIDSvc)
SRV - [2009/07/13 20:14:29 | 003,179,520 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\System32\sppsvc.exe -- (sppsvc)
SRV - [2009/05/19 11:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2008/12/12 11:17:38 | 000,238,888 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ca.msn.com/iat/us_ca.aspx
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 80 56 9D E3 2E 9E CA 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.2
FF - prefs.js..extensions.enabledItems: {53A03D43-5363-4669-8190-99061B2DEBA5}:1.3.6
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7
FF - prefs.js..extensions.enabledItems: [email protected]:3.0.10
FF - prefs.js..extensions.enabledItems: [email protected]:3.4.11
FF - prefs.js..extensions.enabledItems: {66E978CD-981F-47DF-AC42-E3CF417C1467}:0.4.2
FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:4.2
FF - prefs.js..extensions.enabledItems: {6e84150a-d526-41f1-a480-a67d3fed910d}:1.4.5.1
FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.7
FF - prefs.js..extensions.enabledItems: {FBF6D7FB-F305-4445-BB3D-FEF66579A033}:4.6
FF - prefs.js..extensions.enabledItems: {EDA7B1D7-F793-4e03-B074-E6F303317FB0}:1.2.6
FF - prefs.js..extensions.enabledItems: {64161300-e22b-11db-8314-0800200c9a66}:0.9.5
FF - prefs.js..extensions.enabledItems: {03B08592-E5B4-45ff-A0BE-C1D975458688}:0.6.0.8
FF - prefs.js..extensions.enabledItems: {d33c2f7c-b1e6-4d46-ab0e-be1f6d05c904}:2.0.2
FF - prefs.js..extensions.enabledItems: [email protected]:4.2.1
FF - prefs.js..extensions.enabledItems: [email protected]:0.0.4.6
FF - prefs.js..extensions.enabledItems: [email protected]:2.0.3
FF - prefs.js..extensions.enabledItems: [email protected]:3.1.2
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.1.13


FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/02/07 22:26:18 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/02/14 02:43:30 | 000,000,000 | ---D | M]

[2010/01/26 15:46:16 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\mozilla\Extensions
[2010/02/16 18:31:52 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions
[2010/01/26 21:05:26 | 000,000,000 | ---D | M] (Toolbar Buttons) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{03B08592-E5B4-45ff-A0BE-C1D975458688}
[2010/02/01 22:07:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
[2010/02/15 05:25:03 | 000,000,000 | ---D | M] (FlashGot) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2010/01/26 19:45:57 | 000,000,000 | ---D | M] (Stylish) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
[2010/01/27 05:34:51 | 000,000,000 | ---D | M] (FEBE) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2010/01/26 19:43:25 | 000,000,000 | ---D | M] (ScrapBook) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{53A03D43-5363-4669-8190-99061B2DEBA5}
[2010/02/07 17:29:15 | 000,000,000 | ---D | M] (Speed Dial) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}
[2010/01/26 19:38:30 | 000,000,000 | ---D | M] (New Tab Homepage) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{66E978CD-981F-47DF-AC42-E3CF417C1467}
[2010/01/26 19:42:48 | 000,000,000 | ---D | M] (IE View) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{6e84150a-d526-41f1-a480-a67d3fed910d}
[2010/01/26 18:28:38 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010/01/26 18:27:54 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/01/30 20:13:02 | 000,000,000 | ---D | M] (Tiny Menu) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{d33c2f7c-b1e6-4d46-ab0e-be1f6d05c904}
[2010/01/26 19:51:58 | 000,000,000 | ---D | M] (Menu Editor) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{EDA7B1D7-F793-4e03-B074-E6F303317FB0}
[2010/02/07 17:29:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{FBF6D7FB-F305-4445-BB3D-FEF66579A033}
[2010/02/09 22:12:52 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\[email protected]
[2010/01/30 20:15:32 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\[email protected]hao
[2010/01/30 20:37:11 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\[email protected]
[2010/01/30 17:17:23 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\[email protected]
[2010/01/31 02:33:17 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\[email protected]
[2010/02/04 20:59:06 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\[email protected]
[2010/01/26 18:29:51 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\[email protected]
[2010/02/13 15:49:03 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/02/13 15:49:04 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

O1 HOSTS File: ([2009/06/10 16:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (SpywareGuardDLBLOCK.CBrowserHelper) - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll ()
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (MP3Bar) - {F6BD6330-76F8-44d9-B775-87614E2D8374} - C:\Program Files\Fiesta Download Manager\mp3bar.dll ()
O3 - HKCU\..\Toolbar\ShellBrowser: (MP3Bar) - {F6BD6330-76F8-44D9-B775-87614E2D8374} - C:\Program Files\Fiesta Download Manager\mp3bar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (MP3Bar) - {F6BD6330-76F8-44D9-B775-87614E2D8374} - C:\Program Files\Fiesta Download Manager\mp3bar.dll ()
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (ALWIL Software)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O4 - Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe ()
O4 - Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stickies.lnk = C:\Program Files\stickies\stickies.exe (Zhorn Software)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EnableShellExecuteHooks = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &MP3Bar - C:\Program Files\Fiesta Download Manager\mp3bar.dll ()
O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe ()
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: 25 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitd...can8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} http://acs.pandasoft...s/as2stubie.cab (ActiveScan 2.0 Installer Class)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {E6BB2089-163F-466B-812A-748096614DFD} http://cainternetsec...r/cascanner.cab (CAScanner Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 66.76.227.40 208.180.42.68
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O22 - SharedTaskScheduler: {1984DD45-52CF-49cd-AB77-18F378FEA264} - FencesShellExt - C:\Program Files\Stardock\Fences\FencesMenu.dll (Stardock)
O28 - HKLM ShellExecuteHooks: {4F07DA45-8170-4859-9B5F-037EF2970034} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {81559C35-8464-49F7-BB0E-07A383BEF910} - C:\Program Files\SpywareGuard\spywareguard.dll ()
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 16:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{83d11dc8-0fa0-11df-ade1-001ec9353439}\Shell - "" = AutoRun
O33 - MountPoints2\{83d11dc8-0fa0-11df-ade1-001ec9353439}\Shell\AutoRun\command - "" = H:\HPLauncher.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias [2009/07/13 21:37:08 | 000,000,000 | ---D | M]
NetSvcs: Irmon - C:\Windows\System32\irmon.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: UxTuneUp - C:\Windows\System32\uxtuneup.dll (TuneUp Software)
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
NetSvcs: Themes - C:\Windows\System32\themeservice.dll (Microsoft Corporation)
NetSvcs: BDESVC - C:\Windows\System32\bdesvc.dll (Microsoft Corporation)

========== Files/Folders - Created Within 14 Days ==========

[2010/02/17 12:17:48 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\gmer
[2010/02/17 03:24:49 | 000,028,552 | ---- | C] (Panda Security, S.L.) -- C:\Windows\System32\drivers\pavboot.sys
[2010/02/17 03:24:47 | 000,000,000 | ---D | C] -- C:\Program Files\Panda Security
[2010/02/17 02:56:43 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2010/02/17 02:56:36 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\SUPERAntiSpyware.com
[2010/02/17 02:56:36 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2010/02/17 02:55:46 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard
[2010/02/17 01:24:36 | 000,000,000 | ---D | C] -- C:\Users\user\DoctorWeb
[2010/02/17 01:19:57 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2010/02/17 01:07:00 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Malwarebytes
[2010/02/17 01:06:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010/02/17 01:05:26 | 005,115,824 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\user\Desktop\mbam-setup.exe
[2010/02/16 23:53:29 | 000,162,512 | ---- | C] (ALWIL Software) -- C:\Windows\System32\drivers\aswSP.sys
[2010/02/16 23:53:29 | 000,023,376 | ---- | C] (ALWIL Software) -- C:\Windows\System32\drivers\aswRdr.sys
[2010/02/16 23:53:29 | 000,019,024 | ---- | C] (ALWIL Software) -- C:\Windows\System32\drivers\aswFsBlk.sys
[2010/02/16 23:53:27 | 000,046,672 | ---- | C] (ALWIL Software) -- C:\Windows\System32\drivers\aswTdi.sys
[2010/02/16 23:53:26 | 000,051,792 | ---- | C] (ALWIL Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
[2010/02/16 23:53:17 | 000,153,184 | ---- | C] (ALWIL Software) -- C:\Windows\System32\aswBoot.exe
[2010/02/16 23:53:17 | 000,038,848 | ---- | C] (ALWIL Software) -- C:\Windows\System32\avastSS.scr
[2010/02/16 23:53:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Alwil Software
[2010/02/16 23:53:15 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software
[2010/02/16 22:59:52 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\Dr Web Cure It
[2010/02/16 20:06:12 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\Virus Logs
[2010/02/16 15:42:41 | 000,000,000 | ---D | C] -- C:\Windows\BDOSCAN8
[2010/02/16 12:54:16 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\ERunt
[2010/02/16 12:03:38 | 000,000,000 | ---D | C] -- C:\Program Files\SpywareGuard
[2010/02/16 11:49:36 | 000,157,232 | ---- | C] (Alwil Software) -- C:\Users\user\Desktop\aswclear5.exe
[2010/02/16 10:48:51 | 000,549,376 | ---- | C] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe
[2010/02/16 05:12:58 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\Diagnostics
[2010/02/16 03:24:33 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2010/02/16 03:11:26 | 000,439,808 | ---- | C] (OldTimer Tools) -- C:\Users\user\Desktop\TFC.exe
[2010/02/15 09:10:26 | 000,030,536 | ---- | C] (TuneUp Software) -- C:\Windows\System32\TURegOpt.exe
[2010/02/15 09:10:20 | 000,030,024 | ---- | C] (TuneUp Software) -- C:\Windows\System32\uxtuneup.dll
[2010/02/15 09:10:20 | 000,021,320 | ---- | C] (TuneUp Software) -- C:\Windows\System32\authuitu.dll
[2010/02/15 09:10:04 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\TuneUp Software
[2010/02/15 09:10:00 | 000,000,000 | ---D | C] -- C:\Program Files\TuneUp Utilities 2010
[2010/02/15 09:09:43 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software
[2010/02/15 09:09:40 | 000,000,000 | -HSD | C] -- C:\ProgramData\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2010/02/15 08:56:25 | 020,770,632 | ---- | C] (TuneUp Software) -- C:\Users\user\Desktop\TU2010TrialEN-US.exe
[2010/02/15 08:55:35 | 020,770,632 | ---- | C] (TuneUp Software) -- C:\Users\user\Desktop\TU2010TrialEN-US.exe.part
[2010/02/15 08:28:45 | 000,000,000 | -HSD | C] -- C:\ProgramData\{55A29068-F2CE-456C-9148-C869879E2357}
[2010/02/15 07:58:38 | 000,000,000 | ---D | C] -- C:\Program Files\K-Lite Codec Pack
[2010/02/15 06:14:18 | 000,000,000 | ---D | C] -- C:\Program Files\SpywareBlaster
[2010/02/15 05:02:07 | 000,000,000 | ---D | C] -- C:\Downloads
[2010/02/15 04:51:19 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\FlashGet
[2010/02/14 23:40:54 | 000,000,000 | ---D | C] -- C:\Users\user\Documents\playerprojects
[2010/02/14 21:43:40 | 085,780,680 | ---- | C] (Tall Emu Pty Ltd ) -- C:\Users\user\Desktop\OnlineArmor_Setup_++.exe
[2010/02/14 19:40:12 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\gtk-2.0
[2010/02/14 04:40:10 | 000,000,000 | ---D | C] -- C:\Program Files\eags on!
[2010/02/14 01:52:15 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\FileZilla
[2010/02/14 01:52:12 | 000,000,000 | ---D | C] -- C:\Program Files\FileZilla FTP Client
[2010/02/13 19:02:19 | 000,000,000 | ---D | C] -- C:\Program Files\AviSynth 2.5
[2010/02/13 17:27:58 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\WMTools Downloaded Files
[2010/02/13 15:50:59 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\skypePM
[2010/02/13 15:49:36 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Skype
[2010/02/13 15:48:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2010/02/13 15:48:51 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2010/02/13 15:48:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2010/02/10 17:59:05 | 000,000,000 | ---D | C] -- C:\Users\user\Documents\Backups
[2010/02/10 00:24:17 | 000,898,703 | ---- | C] (Lifehacker) -- C:\Users\user\Desktop\Belvedere-0.4_Installer.exe
[2010/02/09 22:12:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Fiesta Download Manager
[2010/02/09 22:12:35 | 000,000,000 | ---D | C] -- C:\Program Files\Fiesta Download Manager
[2010/02/09 17:18:06 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\ElevatedDiagnostics
[2010/02/09 03:32:49 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2010/02/09 03:32:46 | 000,086,683 | ---- | C] (Open Source Software community project) -- C:\Windows\System32\pthreadGC2.dll
[2010/02/09 03:32:44 | 000,000,000 | ---D | C] -- C:\Program Files\AoA Audio Extractor
[2010/02/08 01:37:20 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2010/02/07 21:58:09 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\Apple Computer
[2010/02/07 21:58:08 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Apple Computer
[2010/02/07 21:57:24 | 000,000,000 | ---D | C] -- C:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2010/02/07 21:56:52 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010/02/07 21:56:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2010/02/07 21:56:29 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\Apple
[2010/02/07 21:56:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple
[2010/02/07 21:56:01 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
[2010/02/07 18:04:10 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Google Chrome Backup
[2010/02/07 16:47:19 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\dvdcss
[2010/02/07 16:22:25 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\vlc
[2010/02/07 14:06:02 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\ChromePlus
[2010/02/04 21:54:52 | 000,000,000 | ---D | C] -- C:\Users\user\Documents\Downloads
[2010/02/04 21:50:44 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\Google

========== Files - Modified Within 14 Days ==========

[2010/02/17 12:28:34 | 003,670,016 | ---- | M] () -- C:\Users\user\ntuser.dat
[2010/02/17 12:20:03 | 000,014,522 | ---- | M] () -- C:\Users\user\Desktop\Gmer_initScan.gif
[2010/02/17 12:17:16 | 000,013,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/02/17 12:17:16 | 000,013,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/02/17 12:14:40 | 000,615,122 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010/02/17 12:14:40 | 000,103,496 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010/02/17 12:14:39 | 000,713,888 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010/02/17 12:12:21 | 000,284,915 | ---- | M] () -- C:\Users\user\Desktop\gmer.zip
[2010/02/17 12:10:05 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010/02/17 12:09:48 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/02/17 12:09:47 | 2615,255,040 | -HS- | M] () -- C:\hiberfil.sys
[2010/02/17 04:12:07 | 001,471,132 | -H-- | M] () -- C:\Users\user\AppData\Local\IconCache.db
[2010/02/17 02:56:38 | 000,000,991 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk
[2010/02/17 01:19:59 | 000,001,074 | ---- | M] () -- C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2010/02/17 01:19:57 | 000,000,894 | ---- | M] () -- C:\Users\user\Desktop\NTREGOPT.lnk
[2010/02/17 01:19:57 | 000,000,875 | ---- | M] () -- C:\Users\user\Desktop\ERUNT.lnk
[2010/02/17 01:05:27 | 005,115,824 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\user\Desktop\mbam-setup.exe
[2010/02/16 23:53:31 | 000,002,005 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2010/02/16 23:53:26 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2010/02/16 23:52:12 | 044,518,776 | ---- | M] () -- C:\Users\user\Desktop\setup_av_free.exe
[2010/02/16 12:31:14 | 000,524,288 | -HS- | M] () -- C:\Users\user\ntuser.dat{1be21144-1b20-11df-a532-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms
[2010/02/16 12:31:14 | 000,524,288 | -HS- | M] () -- C:\Users\user\ntuser.dat{1be21144-1b20-11df-a532-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms
[2010/02/16 12:31:14 | 000,065,536 | -HS- | M] () -- C:\Users\user\ntuser.dat{1be21144-1b20-11df-a532-806e6f6e6963}.TM.blf
[2010/02/16 12:25:02 | 003,670,016 | -HS- | M] () -- C:\Users\user\NTUSER.DAT_tureg_old
[2010/02/16 12:03:39 | 000,000,957 | ---- | M] () -- C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SpywareGuard.lnk
[2010/02/16 12:03:39 | 000,000,953 | ---- | M] () -- C:\Users\user\Desktop\SpywareGuard LiveUpdate.lnk
[2010/02/16 12:03:39 | 000,000,921 | ---- | M] () -- C:\Users\user\Desktop\SpywareGuard.lnk
[2010/02/16 11:49:36 | 000,157,232 | ---- | M] (Alwil Software) -- C:\Users\user\Desktop\aswclear5.exe
[2010/02/16 10:49:27 | 000,549,376 | ---- | M] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe
[2010/02/16 08:46:37 | 000,000,358 | ---- | M] () -- C:\Users\user\Documents\yahoo email new password.sti
[2010/02/16 03:11:27 | 000,439,808 | ---- | M] (OldTimer Tools) -- C:\Users\user\Desktop\TFC.exe
[2010/02/16 02:34:38 | 000,000,000 | ---- | M] () -- C:\lista.m3u
[2010/02/15 22:59:40 | 000,000,037 | ---- | M] () -- C:\Users\user\Documents\kozt.m3u
[2010/02/15 19:58:13 | 000,003,584 | ---- | M] () -- C:\Users\user\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/15 09:10:13 | 000,002,123 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp 1-Click Maintenance.lnk
[2010/02/15 09:10:13 | 000,002,105 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp Utilities.lnk
[2010/02/15 08:56:26 | 020,770,632 | ---- | M] (TuneUp Software) -- C:\Users\user\Desktop\TU2010TrialEN-US.exe
[2010/02/15 08:55:52 | 020,770,632 | ---- | M] (TuneUp Software) -- C:\Users\user\Desktop\TU2010TrialEN-US.exe.part
[2010/02/15 06:14:18 | 000,000,973 | ---- | M] () -- C:\Users\user\Desktop\SpywareBlaster.lnk
[2010/02/14 21:44:42 | 085,780,680 | ---- | M] (Tall Emu Pty Ltd ) -- C:\Users\user\Desktop\OnlineArmor_Setup_++.exe
[2010/02/14 21:30:31 | 000,000,218 | ---- | M] () -- C:\Users\user\.recently-used.xbel
[2010/02/14 05:10:22 | 007,920,777 | ---- | M] () -- C:\Users\user\Documents\Not Recognized-Track2.mp3_converted.mp3
[2010/02/14 05:10:22 | 007,920,777 | ---- | M] () -- C:\Users\user\Documents\Not Recognized-Track2.mp3_converted - Copy.mp3
[2010/02/14 04:40:10 | 000,001,831 | ---- | M] () -- C:\Users\Public\Desktop\eags on!.lnk
[2010/02/14 01:17:45 | 004,124,332 | ---- | M] () -- C:\Users\user\Desktop\FileZilla_3.3.1_win32-setup.exe
[2010/02/13 15:51:00 | 000,000,056 | -H-- | M] () -- C:\ProgramData\ezsidmv.dat
[2010/02/13 15:48:54 | 000,002,503 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2010/02/11 13:53:57 | 000,038,848 | ---- | M] (ALWIL Software) -- C:\Windows\System32\avastSS.scr
[2010/02/11 13:53:36 | 000,153,184 | ---- | M] (ALWIL Software) -- C:\Windows\System32\aswBoot.exe
[2010/02/11 13:42:34 | 000,046,672 | ---- | M] (ALWIL Software) -- C:\Windows\System32\drivers\aswTdi.sys
[2010/02/11 13:42:13 | 000,162,512 | ---- | M] (ALWIL Software) -- C:\Windows\System32\drivers\aswSP.sys
[2010/02/11 13:39:01 | 000,023,376 | ---- | M] (ALWIL Software) -- C:\Windows\System32\drivers\aswRdr.sys
[2010/02/11 13:38:45 | 000,051,792 | ---- | M] (ALWIL Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
[2010/02/11 13:38:23 | 000,019,024 | ---- | M] (ALWIL Software) -- C:\Windows\System32\drivers\aswFsBlk.sys
[2010/02/10 00:30:01 | 001,877,540 | ---- | M] () -- C:\Users\user\Desktop\SyncBack_Setup.zip
[2010/02/10 00:24:17 | 000,898,703 | ---- | M] (Lifehacker) -- C:\Users\user\Desktop\Belvedere-0.4_Installer.exe
[2010/02/09 23:30:44 | 000,000,481 | ---- | M] () -- C:\Users\user\Documents\Living In Sin 1st verse.rtf
[2010/02/09 22:12:36 | 000,001,075 | ---- | M] () -- C:\Users\Public\Desktop\Fiesta Download Manager.lnk
[2010/02/09 03:32:46 | 000,001,028 | ---- | M] () -- C:\Users\Public\Desktop\AoA Audio Extractor.lnk
[2010/02/08 00:52:46 | 007,520,288 | ---- | M] () -- C:\Users\user\Desktop\SUPERAntiSpywarePro.exe
[2010/02/07 22:31:05 | 000,524,288 | -HS- | M] () -- C:\Users\user\ntuser.dat{4f5b3984-145e-11df-ac65-001ec9353439}.TMContainer00000000000000000002.regtrans-ms
[2010/02/07 22:31:05 | 000,524,288 | -HS- | M] () -- C:\Users\user\ntuser.dat{4f5b3984-145e-11df-ac65-001ec9353439}.TMContainer00000000000000000001.regtrans-ms
[2010/02/07 22:31:05 | 000,065,536 | -HS- | M] () -- C:\Users\user\ntuser.dat{4f5b3984-145e-11df-ac65-001ec9353439}.TM.blf
[2010/02/07 16:22:04 | 000,001,024 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2010/02/07 14:06:03 | 000,000,892 | ---- | M] () -- C:\Users\user\Desktop\ChromePlus.lnk
[2010/02/04 17:18:01 | 000,001,877 | ---- | M] () -- C:\Users\user\Documents\mom's show website.rtf
[2010/02/04 17:09:16 | 000,001,831 | ---- | M] () -- C:\Users\user\Desktop\CCleaner.lnk

========== Files Created - No Company Name ==========

[2010/02/17 12:20:02 | 000,014,522 | ---- | C] () -- C:\Users\user\Desktop\Gmer_initScan.gif
[2010/02/17 12:12:20 | 000,284,915 | ---- | C] () -- C:\Users\user\Desktop\gmer.zip
[2010/02/17 02:56:38 | 000,000,991 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk
[2010/02/17 02:55:40 | 007,520,288 | ---- | C] () -- C:\Users\user\Desktop\SUPERAntiSpywarePro.exe
[2010/02/17 01:19:59 | 000,001,074 | ---- | C] () -- C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2010/02/17 01:19:57 | 000,000,894 | ---- | C] () -- C:\Users\user\Desktop\NTREGOPT.lnk
[2010/02/17 01:19:57 | 000,000,875 | ---- | C] () -- C:\Users\user\Desktop\ERUNT.lnk
[2010/02/16 23:53:31 | 000,002,005 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2010/02/16 23:51:46 | 044,518,776 | ---- | C] () -- C:\Users\user\Desktop\setup_av_free.exe
[2010/02/16 12:25:53 | 000,524,288 | -HS- | C] () -- C:\Users\user\ntuser.dat{1be21144-1b20-11df-a532-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms
[2010/02/16 12:25:53 | 000,524,288 | -HS- | C] () -- C:\Users\user\ntuser.dat{1be21144-1b20-11df-a532-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms
[2010/02/16 12:25:53 | 000,065,536 | -HS- | C] () -- C:\Users\user\ntuser.dat{1be21144-1b20-11df-a532-806e6f6e6963}.TM.blf
[2010/02/16 12:03:39 | 000,000,957 | ---- | C] () -- C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SpywareGuard.lnk
[2010/02/16 12:03:39 | 000,000,953 | ---- | C] () -- C:\Users\user\Desktop\SpywareGuard LiveUpdate.lnk
[2010/02/16 12:03:39 | 000,000,921 | ---- | C] () -- C:\Users\user\Desktop\SpywareGuard.lnk
[2010/02/16 08:46:37 | 000,000,358 | ---- | C] () -- C:\Users\user\Documents\yahoo email new password.sti
[2010/02/16 02:34:38 | 000,000,000 | ---- | C] () -- C:\lista.m3u
[2010/02/15 22:59:39 | 000,000,037 | ---- | C] () -- C:\Users\user\Documents\kozt.m3u
[2010/02/15 09:10:13 | 000,002,123 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp 1-Click Maintenance.lnk
[2010/02/15 09:10:13 | 000,002,105 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp Utilities.lnk
[2010/02/15 07:58:39 | 000,178,176 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2010/02/15 06:14:18 | 000,000,973 | ---- | C] () -- C:\Users\user\Desktop\SpywareBlaster.lnk
[2010/02/15 02:25:41 | 007,920,777 | ---- | C] () -- C:\Users\user\Documents\Not Recognized-Track2.mp3_converted - Copy.mp3
[2010/02/14 21:30:31 | 000,000,218 | ---- | C] () -- C:\Users\user\.recently-used.xbel
[2010/02/14 05:10:12 | 007,920,777 | ---- | C] () -- C:\Users\user\Documents\Not Recognized-Track2.mp3_converted.mp3
[2010/02/14 04:40:10 | 000,001,831 | ---- | C] () -- C:\Users\Public\Desktop\eags on!.lnk
[2010/02/14 01:17:44 | 004,124,332 | ---- | C] () -- C:\Users\user\Desktop\FileZilla_3.3.1_win32-setup.exe
[2010/02/13 17:35:25 | 000,003,584 | ---- | C] () -- C:\Users\user\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/13 15:51:00 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010/02/13 15:48:54 | 000,002,503 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2010/02/10 00:30:01 | 001,877,540 | ---- | C] () -- C:\Users\user\Desktop\SyncBack_Setup.zip
[2010/02/09 23:30:44 | 000,000,481 | ---- | C] () -- C:\Users\user\Documents\Living In Sin 1st verse.rtf
[2010/02/09 22:12:36 | 000,001,075 | ---- | C] () -- C:\Users\Public\Desktop\Fiesta Download Manager.lnk
[2010/02/09 03:32:46 | 000,001,028 | ---- | C] () -- C:\Users\Public\Desktop\AoA Audio Extractor.lnk
[2010/02/07 22:22:01 | 000,524,288 | -HS- | C] () -- C:\Users\user\ntuser.dat{4f5b3984-145e-11df-ac65-001ec9353439}.TMContainer00000000000000000002.regtrans-ms
[2010/02/07 22:22:01 | 000,524,288 | -HS- | C] () -- C:\Users\user\ntuser.dat{4f5b3984-145e-11df-ac65-001ec9353439}.TMContainer00000000000000000001.regtrans-ms
[2010/02/07 22:22:00 | 000,065,536 | -HS- | C] () -- C:\Users\user\ntuser.dat{4f5b3984-145e-11df-ac65-001ec9353439}.TM.blf
[2010/02/07 16:22:04 | 000,001,024 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2010/02/07 14:06:03 | 000,000,892 | ---- | C] () -- C:\Users\user\Desktop\ChromePlus.lnk
[2010/01/30 20:26:21 | 000,010,864 | ---- | C] () -- C:\Users\user\AppData\Roaming\ReplayMusicLog.log
[2009/07/13 18:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009/01/05 15:44:10 | 000,000,453 | ---- | C] () -- C:\Windows\bdoscandellang.ini
[2007/06/21 03:52:54 | 000,006,618 | ---- | C] () -- C:\Windows\UN070410.INI
[2002/07/13 09:51:38 | 000,417,792 | ---- | C] () -- C:\Windows\System32\id3com.dll

========== LOP Check ==========

[2010/02/13 19:08:22 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\ChromePlus
[2010/01/28 13:25:39 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\CocoonSoftware
[2010/01/28 13:24:30 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/02/14 02:44:26 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\FileZilla
[2010/02/15 05:24:45 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\FlashGet
[2010/02/14 19:41:33 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\gtk-2.0
[2010/01/27 02:09:38 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Jasc
[2010/01/30 18:28:54 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\OpenOffice.org
[2010/01/26 22:54:59 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Stardock
[2010/02/17 12:10:08 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\stickies
[2010/02/15 09:10:04 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\TuneUp Software
[2009/07/13 23:53:46 | 000,020,390 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2009/07/13 20:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009/07/13 20:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys
[2009/07/13 20:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys

< MD5 for: ATAPI.SYS >
[2009/07/13 20:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009/07/13 20:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys
[2009/07/13 20:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2009/07/13 20:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009/07/13 20:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

< MD5 for: IASTORV.SYS >
[2009/07/13 20:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\drivers\iaStorV.sys
[2009/07/13 20:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009/07/13 20:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2009/07/13 20:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll
[2009/07/13 20:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2009/07/13 20:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\drivers\nvstor.sys
[2009/07/13 20:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009/07/13 20:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys

< MD5 for: SCECLI.DLL >
[2009/07/13 20:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll
[2009/07/13 20:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2009/07/13 20:15:13 | 000,346,112 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\dxtmsft.dll
[2009/07/13 20:15:13 | 000,215,552 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\dxtrans.dll
[2009/07/13 20:15:36 | 000,226,816 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\LocationApi.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >

========== Alternate Data Streams ==========

@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:5C321E34
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:8CE646EE

< End of report >
  • 0

#3
Bonjovicrzy41

Bonjovicrzy41

    Member

  • Topic Starter
  • Member
  • PipPip
  • 12 posts
Update

I tried to clean this today with my Malwarebytes and Super Anti-Virus ( Paid version ) and my Online Armour Firewall and Virus ( Paid version ) I have it cleaned and reboot and nothing shows up tell I get on the internet when I try to scan a online scan and surf the net then I have problems .. I get more tracking cookies and a adware that says I have it in my registry the aware is called adware/fastlook and it is hkey_current_user\software\toolband ( could that be what is causing my cookies to keep popping up after I get on the internet??? the cookies I am getting is from Webtrends, Atdmt, & Atlas DMT ..Malwarebytes and SuperAntiVirus and my antivirus .. is not picking the cookies tell I retry

( I use Firefox and Windows 7 but have been on IE to do the online scans )

I walked through the cleaning guide again ( except for the GMER step when I tried to run it it crashed my computer ) but I have a new OTL log .. thank you


OTL Log

OTL logfile created on: 2/19/2010 7:03:19 AM - Run 2
OTL by OldTimer - Version 3.1.28.0 Folder = C:\Users\user\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 75.00% Memory free
6.00 Gb Paging File | 6.00 Gb Available in Paging File | 86.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 465.66 Gb Total Space | 418.88 Gb Free Space | 89.95% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Unable to calculate disk information.
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: USER-PC
Current User Name: user
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/02/16 10:49:27 | 000,549,376 | ---- | M] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe
PRC - [2010/02/02 12:23:52 | 000,713,544 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
PRC - [2010/02/02 12:21:56 | 001,043,784 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
PRC - [2010/01/26 22:21:59 | 001,101,824 | ---- | M] (Zhorn Software) -- C:\Program Files\stickies\stickies.exe
PRC - [2009/12/08 14:25:28 | 000,093,320 | ---- | M] (McAfee, Inc.) -- c:\Program Files\McAfee\SiteAdvisor\McSACore.exe
PRC - [2009/12/05 07:39:54 | 002,792,136 | ---- | M] (Tall Emu) -- C:\Program Files\Tall Emu\Online Armor\a2\avgate.exe
PRC - [2009/12/05 07:39:48 | 003,044,552 | ---- | M] (Tall Emu) -- C:\Program Files\Tall Emu\Online Armor\oahlp.exe
PRC - [2009/12/05 07:39:46 | 006,722,760 | ---- | M] (Tall Emu) -- C:\Program Files\Tall Emu\Online Armor\oaui.exe
PRC - [2009/12/05 07:39:46 | 003,431,112 | ---- | M] (Tall Emu) -- C:\Program Files\Tall Emu\Online Armor\oasrv.exe
PRC - [2009/12/05 07:39:46 | 001,282,248 | ---- | M] (Tall Emu) -- C:\Program Files\Tall Emu\Online Armor\oacat.exe
PRC - [2009/10/31 00:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/08/18 02:36:36 | 000,348,160 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2009/08/18 02:36:08 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2009/07/13 20:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009/07/13 20:14:29 | 003,179,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sppsvc.exe
PRC - [2009/05/19 11:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2008/12/12 11:17:38 | 000,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2003/08/29 19:05:35 | 000,360,448 | ---- | M] () -- C:\Program Files\SpywareGuard\sgmain.exe
PRC - [2003/08/29 11:14:56 | 000,233,472 | ---- | M] () -- C:\Program Files\SpywareGuard\sgbhp.exe


========== Modules (SafeList) ==========

MOD - [2010/02/16 10:49:27 | 000,549,376 | ---- | M] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe
MOD - [2009/12/08 13:12:24 | 000,014,544 | ---- | M] (McAfee, Inc.) -- c:\Program Files\McAfee\SiteAdvisor\sahook.dll
MOD - [2009/12/05 07:39:46 | 000,997,576 | ---- | M] (Tall Emu) -- C:\Program Files\Tall Emu\Online Armor\oawatch.dll
MOD - [2009/07/13 20:16:20 | 000,039,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wtsapi32.dll
MOD - [2009/07/13 20:16:20 | 000,015,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wsock32.dll
MOD - [2009/07/13 20:16:19 | 000,016,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\winnsi.dll
MOD - [2009/07/13 20:16:15 | 000,099,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sspicli.dll
MOD - [2009/07/13 20:16:13 | 000,092,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sechost.dll
MOD - [2009/07/13 20:16:12 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\profapi.dll
MOD - [2009/07/13 20:15:35 | 000,288,256 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\KernelBase.dll
MOD - [2009/07/13 20:15:33 | 000,103,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\IPHLPAPI.DLL
MOD - [2009/07/13 20:15:13 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dwmapi.dll
MOD - [2009/07/13 20:15:11 | 000,064,512 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\devobj.dll
MOD - [2009/07/13 20:15:07 | 000,036,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cryptbase.dll
MOD - [2009/07/13 20:15:02 | 000,145,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cfgmgr32.dll
MOD - [2009/07/13 20:05:46 | 000,003,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\icmp.dll
MOD - [2009/07/13 20:03:50 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2010/02/15 09:10:13 | 000,435,016 | ---- | M] (TuneUp Software) [On_Demand | Stopped] -- C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe -- (TuneUp.Defrag)
SRV - [2010/02/02 12:21:56 | 001,043,784 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2010/02/02 12:18:22 | 000,030,024 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV - [2010/01/27 02:24:07 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009/12/08 14:25:28 | 000,093,320 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files\McAfee\SiteAdvisor\McSACore.exe -- (McAfee SiteAdvisor Service)
SRV - [2009/12/05 07:39:46 | 003,431,112 | ---- | M] (Tall Emu) [Auto | Running] -- C:\Program Files\Tall Emu\Online Armor\oasrv.exe -- (SvcOnlineArmor)
SRV - [2009/12/05 07:39:46 | 001,282,248 | ---- | M] (Tall Emu) [Auto | Running] -- C:\Program Files\Tall Emu\Online Armor\OAcat.exe -- (OAcat)
SRV - [2009/08/18 02:36:08 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2009/07/13 20:16:21 | 000,185,856 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\wwansvc.dll -- (WwanSvc)
SRV - [2009/07/13 20:16:17 | 000,151,552 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\wbiosrvc.dll -- (WbioSrvc)
SRV - [2009/07/13 20:16:17 | 000,119,808 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\umpo.dll -- (Power)
SRV - [2009/07/13 20:16:16 | 000,037,376 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\themeservice.dll -- (Themes)
SRV - [2009/07/13 20:16:15 | 000,053,760 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sppuinotify.dll -- (sppuinotify)
SRV - [2009/07/13 20:16:13 | 000,043,520 | ---- | M] (Microsoft Corporation) [Unknown | Running] -- C:\Windows\System32\RpcEpMap.dll -- (RpcEptMapper)
SRV - [2009/07/13 20:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 20:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/13 20:16:12 | 000,269,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\pnrpsvc.dll -- (PNRPsvc)
SRV - [2009/07/13 20:16:12 | 000,269,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\pnrpsvc.dll -- (p2pimsvc)
SRV - [2009/07/13 20:16:12 | 000,165,376 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\provsvc.dll -- (HomeGroupProvider)
SRV - [2009/07/13 20:16:12 | 000,020,480 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\pnrpauto.dll -- (PNRPAutoReg)
SRV - [2009/07/13 20:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009/07/13 20:15:36 | 000,194,560 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\ListSvc.dll -- (HomeGroupListener)
SRV - [2009/07/13 20:15:21 | 000,797,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2009/07/13 20:15:11 | 000,253,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\dhcpcore.dll -- (Dhcp)
SRV - [2009/07/13 20:15:10 | 000,218,624 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\defragsvc.dll -- (defragsvc)
SRV - [2009/07/13 20:14:59 | 000,076,800 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\bdesvc.dll -- (BDESVC)
SRV - [2009/07/13 20:14:58 | 000,088,064 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\AxInstSv.dll -- (AxInstSV) ActiveX Installer (AxInstSV)
SRV - [2009/07/13 20:14:53 | 000,027,648 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\appidsvc.dll -- (AppIDSvc)
SRV - [2009/07/13 20:14:29 | 003,179,520 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\sppsvc.exe -- (sppsvc)
SRV - [2009/05/19 11:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2008/12/12 11:17:38 | 000,238,888 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ca.msn.com/iat/us_ca.aspx
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 80 56 9D E3 2E 9E CA 01 [binary data]
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.2
FF - prefs.js..extensions.enabledItems: {53A03D43-5363-4669-8190-99061B2DEBA5}:1.3.6
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7
FF - prefs.js..extensions.enabledItems: [email protected]:3.0.10
FF - prefs.js..extensions.enabledItems: [email protected]:3.4.11
FF - prefs.js..extensions.enabledItems: {66E978CD-981F-47DF-AC42-E3CF417C1467}:0.4.2
FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:4.2
FF - prefs.js..extensions.enabledItems: {6e84150a-d526-41f1-a480-a67d3fed910d}:1.4.5.1
FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.7
FF - prefs.js..extensions.enabledItems: {FBF6D7FB-F305-4445-BB3D-FEF66579A033}:4.6
FF - prefs.js..extensions.enabledItems: {EDA7B1D7-F793-4e03-B074-E6F303317FB0}:1.2.6
FF - prefs.js..extensions.enabledItems: {64161300-e22b-11db-8314-0800200c9a66}:0.9.5
FF - prefs.js..extensions.enabledItems: {03B08592-E5B4-45ff-A0BE-C1D975458688}:0.6.0.8
FF - prefs.js..extensions.enabledItems: {d33c2f7c-b1e6-4d46-ab0e-be1f6d05c904}:2.0.2
FF - prefs.js..extensions.enabledItems: [email protected]:4.2.1
FF - prefs.js..extensions.enabledItems: [email protected]:0.0.4.6
FF - prefs.js..extensions.enabledItems: [email protected]:2.0.3
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.9.47
FF - prefs.js..extensions.enabledItems: {99B98C2C-7274-45a3-A640-D9DF1A1C8460}:1.4
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.0
FF - prefs.js..extensions.enabledItems: {9D23D0AA-D8F5-11DA-B3FC-0928ABF316DD}:3.0.5
FF - prefs.js..extensions.enabledItems: [email protected]:2.0


FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/02/18 20:07:52 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/02/07 22:26:18 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/02/14 02:43:30 | 000,000,000 | ---D | M]

[2010/01/26 15:46:16 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\mozilla\Extensions
[2010/02/19 02:02:28 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions
[2010/01/26 21:05:26 | 000,000,000 | ---D | M] (Toolbar Buttons) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{03B08592-E5B4-45ff-A0BE-C1D975458688}
[2010/02/01 22:07:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
[2010/01/26 19:45:57 | 000,000,000 | ---D | M] (Stylish) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
[2010/01/27 05:34:51 | 000,000,000 | ---D | M] (FEBE) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3}
[2010/01/26 19:43:25 | 000,000,000 | ---D | M] (ScrapBook) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{53A03D43-5363-4669-8190-99061B2DEBA5}
[2010/02/07 17:29:15 | 000,000,000 | ---D | M] (Speed Dial) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}
[2010/01/26 19:38:30 | 000,000,000 | ---D | M] (New Tab Homepage) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{66E978CD-981F-47DF-AC42-E3CF417C1467}
[2010/01/26 19:42:48 | 000,000,000 | ---D | M] (IE View) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{6e84150a-d526-41f1-a480-a67d3fed910d}
[2010/02/18 19:59:38 | 000,000,000 | ---D | M] (NoScript) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010/02/19 00:28:03 | 000,000,000 | ---D | M] (CookieCuller) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{99B98C2C-7274-45a3-A640-D9DF1A1C8460}
[2010/02/19 00:39:41 | 000,000,000 | ---D | M] (CookieSafe) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{9D23D0AA-D8F5-11DA-B3FC-0928ABF316DD}
[2010/01/26 18:28:38 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010/01/26 18:27:54 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/01/30 20:13:02 | 000,000,000 | ---D | M] (Tiny Menu) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{d33c2f7c-b1e6-4d46-ab0e-be1f6d05c904}
[2010/01/26 19:51:58 | 000,000,000 | ---D | M] (Menu Editor) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{EDA7B1D7-F793-4e03-B074-E6F303317FB0}
[2010/02/07 17:29:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\{FBF6D7FB-F305-4445-BB3D-FEF66579A033}
[2010/02/09 22:12:52 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\[email protected]
[2010/01/30 20:15:32 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\[email protected]
[2010/01/30 20:37:11 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\[email protected]
[2010/01/30 17:17:23 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\[email protected]
[2010/01/31 02:33:17 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\isreaditlate[email protected]
[2010/02/19 01:05:44 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\[email protected]
[2010/01/26 18:29:51 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\wmzl0d75.default\extensions\[email protected]
[2010/02/13 15:49:03 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/02/13 15:49:04 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

O1 HOSTS File: ([2009/06/10 16:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (SpywareGuardDLBLOCK.CBrowserHelper) - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll ()
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {F6BD6330-76F8-44D9-B775-87614E2D8374} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {F6BD6330-76F8-44D9-B775-87614E2D8374} - No CLSID value found.
O4 - HKLM..\Run: [@OnlineArmor GUI] C:\Program Files\Tall Emu\Online Armor\oaui.exe (Tall Emu)
O4 - Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O4 - Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe ()
O4 - Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stickies.lnk = C:\Program Files\stickies\stickies.exe (Zhorn Software)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EnableShellExecuteHooks = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe ()
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: 25 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitd...can8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} http://acs.pandasoft...s/as2stubie.cab (ActiveScan 2.0 Installer Class)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {E6BB2089-163F-466B-812A-748096614DFD} http://cainternetsec...r/cascanner.cab (CAScanner Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 66.76.227.40 208.180.42.68
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O22 - SharedTaskScheduler: {1984DD45-52CF-49cd-AB77-18F378FEA264} - FencesShellExt - C:\Program Files\Stardock\Fences\FencesMenu.dll (Stardock)
O28 - HKLM ShellExecuteHooks: {4F07DA45-8170-4859-9B5F-037EF2970034} - C:\Program Files\Tall Emu\Online Armor\oaevent.dll (Tall Emu)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {81559C35-8464-49F7-BB0E-07A383BEF910} - C:\Program Files\SpywareGuard\spywareguard.dll ()
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 16:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{83d11dc8-0fa0-11df-ade1-001ec9353439}\Shell - "" = AutoRun
O33 - MountPoints2\{83d11dc8-0fa0-11df-ade1-001ec9353439}\Shell\AutoRun\command - "" = H:\HPLauncher.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias [2009/07/13 21:37:08 | 000,000,000 | ---D | M]
NetSvcs: Irmon - C:\Windows\System32\irmon.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: UxTuneUp - C:\Windows\System32\uxtuneup.dll (TuneUp Software)
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
NetSvcs: Themes - C:\Windows\System32\themeservice.dll (Microsoft Corporation)
NetSvcs: BDESVC - C:\Windows\System32\bdesvc.dll (Microsoft Corporation)

========== Files/Folders - Created Within 14 Days ==========

[2010/02/19 07:00:46 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\Adobe
[2010/02/19 04:32:05 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2010/02/19 04:31:01 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\ERunt
[2010/02/19 04:15:50 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2010/02/19 04:15:04 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard
[2010/02/19 02:19:25 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\HostsXpert
[2010/02/18 20:40:53 | 001,514,728 | ---- | C] (tzuk) -- C:\Users\user\Desktop\SandboxieInstall.exe
[2010/02/18 20:14:17 | 005,359,048 | ---- | C] (Foxit Software) -- C:\Users\user\Desktop\FoxitReader31_enu_Setup_091125.exe
[2010/02/18 20:02:47 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\McAfee
[2010/02/18 20:02:37 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee
[2010/02/18 20:02:37 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee
[2010/02/18 19:03:31 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/02/18 19:03:29 | 000,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010/02/18 19:03:27 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/02/18 05:03:03 | 001,640,400 | ---- | C] (Threat Expert Ltd.) -- C:\Windows\PCTBDCore.dll.old
[2010/02/18 04:57:20 | 034,868,704 | ---- | C] (PC Tools ) -- C:\Users\user\Desktop\sdsetup.exe
[2010/02/18 04:24:05 | 000,028,552 | ---- | C] (Panda Security, S.L.) -- C:\Windows\System32\drivers\pavboot.sys
[2010/02/18 03:15:13 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\OnlineArmor
[2010/02/18 03:15:13 | 000,000,000 | ---D | C] -- C:\ProgramData\OnlineArmor
[2010/02/18 03:14:32 | 000,223,312 | ---- | C] (Tall Emu) -- C:\Windows\System32\drivers\OADriver.sys
[2010/02/18 03:14:32 | 000,030,800 | ---- | C] (Tall Emu Pty Ltd) -- C:\Windows\System32\drivers\OAnet.sys
[2010/02/18 03:14:32 | 000,024,656 | ---- | C] (Tall Emu) -- C:\Windows\System32\drivers\OAmon.sys
[2010/02/18 03:14:31 | 000,000,000 | ---D | C] -- C:\Program Files\Tall Emu
[2010/02/18 03:13:36 | 085,780,680 | ---- | C] (Tall Emu Pty Ltd ) -- C:\Users\user\Desktop\OnlineArmor_Setup_++.exe
[2010/02/18 03:06:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky SDK
[2010/02/17 22:26:22 | 000,000,000 | R--D | C] -- C:\Users\user\Documents\Scanned Documents
[2010/02/17 22:26:22 | 000,000,000 | ---D | C] -- C:\Users\user\Documents\Fax
[2010/02/17 03:24:47 | 000,000,000 | ---D | C] -- C:\Program Files\Panda Security
[2010/02/17 02:56:43 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2010/02/17 02:56:36 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\SUPERAntiSpyware.com
[2010/02/17 01:24:36 | 000,000,000 | ---D | C] -- C:\Users\user\DoctorWeb
[2010/02/17 01:07:00 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Malwarebytes
[2010/02/17 01:06:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010/02/17 01:05:26 | 005,115,824 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\user\Desktop\mbam-setup.exe
[2010/02/16 23:53:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Alwil Software
[2010/02/16 23:53:15 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software
[2010/02/16 20:06:12 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\Virus Logs
[2010/02/16 15:42:41 | 000,000,000 | ---D | C] -- C:\Windows\BDOSCAN8
[2010/02/16 12:03:38 | 000,000,000 | ---D | C] -- C:\Program Files\SpywareGuard
[2010/02/16 10:48:51 | 000,549,376 | ---- | C] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe
[2010/02/16 05:12:58 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\Diagnostics
[2010/02/16 03:24:33 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2010/02/16 03:11:26 | 000,439,808 | ---- | C] (OldTimer Tools) -- C:\Users\user\Desktop\TFC.exe
[2010/02/15 09:10:26 | 000,030,536 | ---- | C] (TuneUp Software) -- C:\Windows\System32\TURegOpt.exe
[2010/02/15 09:10:20 | 000,030,024 | ---- | C] (TuneUp Software) -- C:\Windows\System32\uxtuneup.dll
[2010/02/15 09:10:20 | 000,021,320 | ---- | C] (TuneUp Software) -- C:\Windows\System32\authuitu.dll
[2010/02/15 09:10:04 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\TuneUp Software
[2010/02/15 09:10:00 | 000,000,000 | ---D | C] -- C:\Program Files\TuneUp Utilities 2010
[2010/02/15 09:09:43 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software
[2010/02/15 09:09:40 | 000,000,000 | -HSD | C] -- C:\ProgramData\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2010/02/15 08:28:45 | 000,000,000 | -HSD | C] -- C:\ProgramData\{55A29068-F2CE-456C-9148-C869879E2357}
[2010/02/15 07:58:38 | 000,000,000 | ---D | C] -- C:\Program Files\K-Lite Codec Pack
[2010/02/15 06:14:18 | 000,000,000 | ---D | C] -- C:\Program Files\SpywareBlaster
[2010/02/15 05:02:07 | 000,000,000 | ---D | C] -- C:\Downloads
[2010/02/15 04:51:19 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\FlashGet
[2010/02/14 23:40:54 | 000,000,000 | ---D | C] -- C:\Users\user\Documents\playerprojects
[2010/02/14 19:40:12 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\gtk-2.0
[2010/02/14 04:40:10 | 000,000,000 | ---D | C] -- C:\Program Files\eags on!
[2010/02/14 01:52:15 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\FileZilla
[2010/02/14 01:52:12 | 000,000,000 | ---D | C] -- C:\Program Files\FileZilla FTP Client
[2010/02/13 19:02:19 | 000,000,000 | ---D | C] -- C:\Program Files\AviSynth 2.5
[2010/02/13 17:27:58 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\WMTools Downloaded Files
[2010/02/13 15:50:59 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\skypePM
[2010/02/13 15:49:36 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Skype
[2010/02/13 15:48:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2010/02/13 15:48:51 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2010/02/13 15:48:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2010/02/10 17:59:05 | 000,000,000 | ---D | C] -- C:\Users\user\Documents\Backups
[2010/02/09 22:12:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Fiesta Download Manager
[2010/02/09 17:18:06 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\ElevatedDiagnostics
[2010/02/09 03:32:49 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2010/02/09 03:32:46 | 000,086,683 | ---- | C] (Open Source Software community project) -- C:\Windows\System32\pthreadGC2.dll
[2010/02/09 03:32:44 | 000,000,000 | ---D | C] -- C:\Program Files\AoA Audio Extractor
[2010/02/08 01:37:20 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2010/02/07 21:58:08 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Apple Computer
[2010/02/07 21:57:24 | 000,000,000 | ---D | C] -- C:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2010/02/07 21:56:52 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010/02/07 21:56:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2010/02/07 21:56:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple
[2010/02/07 21:56:01 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
[2010/02/07 18:04:10 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Google Chrome Backup
[2010/02/07 16:47:19 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\dvdcss
[2010/02/07 16:22:25 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\vlc

========== Files - Modified Within 14 Days ==========

[2010/02/19 07:02:04 | 000,713,888 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010/02/19 07:02:04 | 000,615,122 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010/02/19 07:02:04 | 000,103,496 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010/02/19 06:57:39 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010/02/19 06:57:17 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/02/19 06:57:15 | 201,510,259 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010/02/19 06:57:13 | 2615,255,040 | -HS- | M] () -- C:\hiberfil.sys
[2010/02/19 06:54:37 | 003,670,016 | ---- | M] () -- C:\Users\user\ntuser.dat
[2010/02/19 06:09:22 | 000,013,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/02/19 06:09:22 | 000,013,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/02/19 04:32:08 | 000,001,074 | ---- | M] () -- C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2010/02/19 04:32:06 | 000,000,894 | ---- | M] () -- C:\Users\user\Desktop\NTREGOPT.lnk
[2010/02/19 04:32:06 | 000,000,875 | ---- | M] () -- C:\Users\user\Desktop\ERUNT.lnk
[2010/02/19 04:15:52 | 000,000,991 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk
[2010/02/19 03:58:31 | 000,000,340 | ---- | M] () -- C:\Users\user\Desktop\help registry 1.rtf
[2010/02/19 02:41:43 | 000,230,839 | ---- | M] () -- C:\Users\user\Desktop\ZonedOut.zip
[2010/02/19 02:19:13 | 000,353,485 | ---- | M] () -- C:\Users\user\Desktop\HostsXpert.zip
[2010/02/19 00:09:52 | 000,002,817 | ---- | M] () -- C:\Users\user\Desktop\run in safe mold and scan.rtf
[2010/02/19 00:08:21 | 000,008,425 | ---- | M] () -- C:\Users\user\Desktop\fastlook remove.rtf
[2010/02/18 21:55:43 | 000,024,372 | ---- | M] () -- C:\Users\user\Desktop\unregdll.png
[2010/02/18 20:40:54 | 001,514,728 | ---- | M] (tzuk) -- C:\Users\user\Desktop\SandboxieInstall.exe
[2010/02/18 20:32:36 | 000,159,528 | ---- | M] () -- C:\Users\user\Desktop\FHSetup.exe
[2010/02/18 20:20:32 | 000,014,848 | ---- | M] () -- C:\Users\user\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/18 20:20:08 | 015,148,380 | ---- | M] () -- C:\Users\user\Documents\basic.flv
[2010/02/18 20:14:17 | 005,359,048 | ---- | M] (Foxit Software) -- C:\Users\user\Desktop\FoxitReader31_enu_Setup_091125.exe
[2010/02/18 20:01:31 | 007,361,744 | ---- | M] () -- C:\Users\user\Desktop\saSetup3.0.1.163.exe
[2010/02/18 19:03:36 | 000,000,979 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/02/18 18:09:40 | 000,053,713 | ---- | M] () -- C:\Users\user\Documents\logo-circletour2.jpg
[2010/02/18 18:09:40 | 000,012,207 | ---- | M] () -- C:\Users\user\Documents\header-bonjovi.gif
[2010/02/18 03:15:14 | 000,000,000 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.idx
[2010/02/18 02:58:27 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2010/02/18 01:12:27 | 000,022,314 | ---- | M] () -- C:\Users\user\Documents\spyare doctor.htm
[2010/02/18 00:15:00 | 034,868,704 | ---- | M] (PC Tools ) -- C:\Users\user\Desktop\sdsetup.exe
[2010/02/17 12:12:21 | 000,284,915 | ---- | M] () -- C:\Users\user\Desktop\gmer.zip
[2010/02/17 01:05:27 | 005,115,824 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\user\Desktop\mbam-setup.exe
[2010/02/16 12:31:14 | 000,524,288 | -HS- | M] () -- C:\Users\user\ntuser.dat{1be21144-1b20-11df-a532-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms
[2010/02/16 12:31:14 | 000,524,288 | -HS- | M] () -- C:\Users\user\ntuser.dat{1be21144-1b20-11df-a532-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms
[2010/02/16 12:31:14 | 000,065,536 | -HS- | M] () -- C:\Users\user\ntuser.dat{1be21144-1b20-11df-a532-806e6f6e6963}.TM.blf
[2010/02/16 12:25:02 | 003,670,016 | -HS- | M] () -- C:\Users\user\NTUSER.DAT_tureg_old
[2010/02/16 12:03:39 | 000,000,957 | ---- | M] () -- C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SpywareGuard.lnk
[2010/02/16 12:03:39 | 000,000,953 | ---- | M] () -- C:\Users\user\Desktop\SpywareGuard LiveUpdate.lnk
[2010/02/16 12:03:39 | 000,000,921 | ---- | M] () -- C:\Users\user\Desktop\SpywareGuard.lnk
[2010/02/16 10:49:27 | 000,549,376 | ---- | M] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe
[2010/02/16 08:46:37 | 000,000,358 | ---- | M] () -- C:\Users\user\Documents\yahoo email new password.sti
[2010/02/16 03:11:27 | 000,439,808 | ---- | M] (OldTimer Tools) -- C:\Users\user\Desktop\TFC.exe
[2010/02/16 02:34:38 | 000,000,000 | ---- | M] () -- C:\lista.m3u
[2010/02/15 09:10:13 | 000,002,123 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp 1-Click Maintenance.lnk
[2010/02/15 09:10:13 | 000,002,105 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp Utilities.lnk
[2010/02/15 06:14:18 | 000,000,973 | ---- | M] () -- C:\Users\user\Desktop\SpywareBlaster.lnk
[2010/02/14 21:44:42 | 085,780,680 | ---- | M] (Tall Emu Pty Ltd ) -- C:\Users\user\Desktop\OnlineArmor_Setup_++.exe
[2010/02/14 21:30:31 | 000,000,218 | ---- | M] () -- C:\Users\user\.recently-used.xbel
[2010/02/14 05:10:22 | 007,920,777 | ---- | M] () -- C:\Users\user\Documents\ascoutic_wanteddeadoralive_NYC.mp3
[2010/02/14 04:40:10 | 000,001,831 | ---- | M] () -- C:\Users\Public\Desktop\eags on!.lnk
[2010/02/14 01:17:45 | 004,124,332 | ---- | M] () -- C:\Users\user\Desktop\FileZilla_3.3.1_win32-setup.exe
[2010/02/13 15:51:00 | 000,000,056 | -H-- | M] () -- C:\ProgramData\ezsidmv.dat
[2010/02/13 15:48:54 | 000,002,503 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2010/02/09 23:30:44 | 000,000,481 | ---- | M] () -- C:\Users\user\Documents\Living In Sin 1st verse.rtf
[2010/02/09 03:32:46 | 000,001,028 | ---- | M] () -- C:\Users\Public\Desktop\AoA Audio Extractor.lnk
[2010/02/08 00:52:46 | 007,520,288 | ---- | M] () -- C:\Users\user\Desktop\SUPERAntiSpywarePro.exe
[2010/02/07 22:31:05 | 000,524,288 | -HS- | M] () -- C:\Users\user\ntuser.dat{4f5b3984-145e-11df-ac65-001ec9353439}.TMContainer00000000000000000002.regtrans-ms
[2010/02/07 22:31:05 | 000,524,288 | -HS- | M] () -- C:\Users\user\ntuser.dat{4f5b3984-145e-11df-ac65-001ec9353439}.TMContainer00000000000000000001.regtrans-ms
[2010/02/07 22:31:05 | 000,065,536 | -HS- | M] () -- C:\Users\user\ntuser.dat{4f5b3984-145e-11df-ac65-001ec9353439}.TM.blf
[2010/02/07 16:22:04 | 000,001,024 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk

========== Files Created - No Company Name ==========

[2010/02/19 06:51:42 | 201,510,259 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2010/02/19 04:32:08 | 000,001,074 | ---- | C] () -- C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2010/02/19 04:32:06 | 000,000,894 | ---- | C] () -- C:\Users\user\Desktop\NTREGOPT.lnk
[2010/02/19 04:32:06 | 000,000,875 | ---- | C] () -- C:\Users\user\Desktop\ERUNT.lnk
[2010/02/19 04:15:52 | 000,000,991 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk
[2010/02/19 03:58:31 | 000,000,340 | ---- | C] () -- C:\Users\user\Desktop\help registry 1.rtf
[2010/02/19 02:41:43 | 000,230,839 | ---- | C] () -- C:\Users\user\Desktop\ZonedOut.zip
[2010/02/19 02:19:13 | 000,353,485 | ---- | C] () -- C:\Users\user\Desktop\HostsXpert.zip
[2010/02/19 00:09:52 | 000,002,817 | ---- | C] () -- C:\Users\user\Desktop\run in safe mold and scan.rtf
[2010/02/19 00:08:20 | 000,008,425 | ---- | C] () -- C:\Users\user\Desktop\fastlook remove.rtf
[2010/02/18 21:55:43 | 000,024,372 | ---- | C] () -- C:\Users\user\Desktop\unregdll.png
[2010/02/18 20:32:36 | 000,159,528 | ---- | C] () -- C:\Users\user\Desktop\FHSetup.exe
[2010/02/18 20:20:02 | 015,148,380 | ---- | C] () -- C:\Users\user\Documents\basic.flv
[2010/02/18 20:01:29 | 007,361,744 | ---- | C] () -- C:\Users\user\Desktop\saSetup3.0.1.163.exe
[2010/02/18 19:54:58 | 007,520,288 | ---- | C] () -- C:\Users\user\Desktop\SUPERAntiSpywarePro.exe
[2010/02/18 19:03:36 | 000,000,979 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/02/18 18:19:55 | 000,012,207 | ---- | C] () -- C:\Users\user\Documents\header-bonjovi.gif
[2010/02/18 18:19:09 | 000,053,713 | ---- | C] () -- C:\Users\user\Documents\logo-circletour2.jpg
[2010/02/18 05:03:05 | 000,767,952 | ---- | C] () -- C:\Windows\BDTSupport.dll.old
[2010/02/18 01:12:27 | 000,022,314 | ---- | C] () -- C:\Users\user\Documents\spyare doctor.htm
[2010/02/17 12:12:20 | 000,284,915 | ---- | C] () -- C:\Users\user\Desktop\gmer.zip
[2010/02/16 12:25:53 | 000,524,288 | -HS- | C] () -- C:\Users\user\ntuser.dat{1be21144-1b20-11df-a532-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms
[2010/02/16 12:25:53 | 000,524,288 | -HS- | C] () -- C:\Users\user\ntuser.dat{1be21144-1b20-11df-a532-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms
[2010/02/16 12:25:53 | 000,065,536 | -HS- | C] () -- C:\Users\user\ntuser.dat{1be21144-1b20-11df-a532-806e6f6e6963}.TM.blf
[2010/02/16 12:03:39 | 000,000,957 | ---- | C] () -- C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SpywareGuard.lnk
[2010/02/16 12:03:39 | 000,000,953 | ---- | C] () -- C:\Users\user\Desktop\SpywareGuard LiveUpdate.lnk
[2010/02/16 12:03:39 | 000,000,921 | ---- | C] () -- C:\Users\user\Desktop\SpywareGuard.lnk
[2010/02/16 08:46:37 | 000,000,358 | ---- | C] () -- C:\Users\user\Documents\yahoo email new password.sti
[2010/02/16 02:34:38 | 000,000,000 | ---- | C] () -- C:\lista.m3u
[2010/02/15 09:10:13 | 000,002,123 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp 1-Click Maintenance.lnk
[2010/02/15 09:10:13 | 000,002,105 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp Utilities.lnk
[2010/02/15 07:58:39 | 000,178,176 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2010/02/15 06:14:18 | 000,000,973 | ---- | C] () -- C:\Users\user\Desktop\SpywareBlaster.lnk
[2010/02/14 21:30:31 | 000,000,218 | ---- | C] () -- C:\Users\user\.recently-used.xbel
[2010/02/14 05:10:12 | 007,920,777 | ---- | C] () -- C:\Users\user\Documents\ascoutic_wanteddeadoralive_NYC.mp3
[2010/02/14 04:40:10 | 000,001,831 | ---- | C] () -- C:\Users\Public\Desktop\eags on!.lnk
[2010/02/14 01:17:44 | 004,124,332 | ---- | C] () -- C:\Users\user\Desktop\FileZilla_3.3.1_win32-setup.exe
[2010/02/13 17:35:25 | 000,014,848 | ---- | C] () -- C:\Users\user\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/13 15:51:00 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010/02/13 15:48:54 | 000,002,503 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2010/02/09 23:30:44 | 000,000,481 | ---- | C] () -- C:\Users\user\Documents\Living In Sin 1st verse.rtf
[2010/02/09 03:32:46 | 000,001,028 | ---- | C] () -- C:\Users\Public\Desktop\AoA Audio Extractor.lnk
[2010/02/07 22:22:01 | 000,524,288 | -HS- | C] () -- C:\Users\user\ntuser.dat{4f5b3984-145e-11df-ac65-001ec9353439}.TMContainer00000000000000000002.regtrans-ms
[2010/02/07 22:22:01 | 000,524,288 | -HS- | C] () -- C:\Users\user\ntuser.dat{4f5b3984-145e-11df-ac65-001ec9353439}.TMContainer00000000000000000001.regtrans-ms
[2010/02/07 22:22:00 | 000,065,536 | -HS- | C] () -- C:\Users\user\ntuser.dat{4f5b3984-145e-11df-ac65-001ec9353439}.TM.blf
[2010/02/07 16:22:04 | 000,001,024 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2010/01/30 20:26:21 | 000,010,864 | ---- | C] () -- C:\Users\user\AppData\Roaming\ReplayMusicLog.log
[2009/07/13 18:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009/01/05 15:44:10 | 000,000,453 | ---- | C] () -- C:\Windows\bdoscandellang.ini
[2007/06/21 03:52:54 | 000,006,618 | ---- | C] () -- C:\Windows\UN070410.INI
[2002/07/13 09:51:38 | 000,417,792 | ---- | C] () -- C:\Windows\System32\id3com.dll

========== LOP Check ==========

[2010/01/28 13:25:39 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\CocoonSoftware
[2010/01/28 13:24:30 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/02/17 18:52:19 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\FileZilla
[2010/02/15 05:24:45 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\FlashGet
[2010/02/14 19:41:33 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\gtk-2.0
[2010/01/27 02:09:38 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Jasc
[2010/02/18 03:15:22 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\OnlineArmor
[2010/01/30 18:28:54 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\OpenOffice.org
[2010/01/26 22:54:59 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Stardock
[2010/02/19 06:02:08 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\stickies
[2010/02/15 09:10:04 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\TuneUp Software
[2010/02/19 06:50:10 | 000,029,150 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2009/07/13 20:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009/07/13 20:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys
[2009/07/13 20:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys

< MD5 for: ATAPI.SYS >
[2009/07/13 20:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009/07/13 20:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys
[2009/07/13 20:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2009/07/13 20:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009/07/13 20:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

< MD5 for: IASTORV.SYS >
[2009/07/13 20:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\drivers\iaStorV.sys
[2009/07/13 20:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009/07/13 20:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2009/07/13 20:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll
[2009/07/13 20:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2009/07/13 20:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\drivers\nvstor.sys
[2009/07/13 20:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009/07/13 20:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys

< MD5 for: SCECLI.DLL >
[2009/07/13 20:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll
[2009/07/13 20:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2009/07/13 20:15:13 | 000,346,112 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\dxtmsft.dll
[2009/07/13 20:15:13 | 000,215,552 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\dxtrans.dll
[2009/07/13 20:15:36 | 000,226,816 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\LocationApi.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >

========== Alternate Data Streams ==========

@Alternate Data Stream - 154 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:5C321E34
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:8CE646EE
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:A8ADE5D8

< End of report >

Edited by Bonjovicrzy41, 19 February 2010 - 07:41 AM.

  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP