[Henry1st]

Hi,

I have the same problems as norsecode, wuauclt.exe file is infected. I was following this topic but it was terminated before it was concluded.
I have contacted mitch8 and he told me to post my scan results on a new topic.

So far I have run OTL and Scan.txt, in safe mode, and I am now logging the results on my work PC.

I hope this is what is required.

OTL logfile created on: 08/11/2010 10:46:15 - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Hiromi\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

503.00 Mb Total Physical Memory | 362.00 Mb Available Physical Memory | 72.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 94.00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 34.31 Gb Total Space | 14.99 Gb Free Space | 43.68% Space Free | Partition Type: NTFS

Computer Name: HENRY | User Name: Hiromi | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/11/07 21:51:17 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Hiromi\Desktop\OTL.scr
PRC - [2010/11/07 21:50:55 | 000,258,560 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Hiromi\Desktop\OTH.scr


========== Modules (SafeList) ==========

MOD - [2010/11/07 21:51:17 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Hiromi\Desktop\OTL.scr
MOD - [2010/08/23 16:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010/11/02 20:18:50 | 000,251,216 | ---- | M] (CA, Inc.) [On_Demand | Stopped] -- C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe -- (CaCCProvSP)
SRV - [2010/11/02 20:18:48 | 000,206,160 | ---- | M] (Computer Associates International, Inc.) [Auto | Stopped] -- C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe -- (ccSchedulerSVC)
SRV - [2010/11/02 20:18:41 | 000,212,992 | ---- | M] (Computer Associates International, Inc.) [Auto | Stopped] -- C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus Plus\isafe.exe -- (CAISafe)
SRV - [2010/11/02 20:18:32 | 000,206,152 | ---- | M] (CA) [Auto | Stopped] -- C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus Plus\CAAMSvc.exe -- (CAAMSvc)
SRV - [2010/09/17 12:21:00 | 000,301,648 | ---- | M] (CA) [Auto | Stopped] -- C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe -- (UmxPol)
SRV - [2010/08/24 12:07:34 | 000,740,160 | ---- | M] (CA) [Auto | Stopped] -- C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe -- (UmxCfg)
SRV - [2010/08/13 11:58:56 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009/12/14 10:26:02 | 000,668,912 | ---- | M] (Radialpoint Inc.) [Auto | Stopped] -- C:\Program Files\Virgin Media\HUB\ServicepointService.exe -- (ServicepointService)
SRV - [2009/08/04 09:42:18 | 000,887,288 | ---- | M] (CA) [Auto | Stopped] -- C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe -- (UmxAgent)
SRV - [2007/03/07 14:47:46 | 000,076,848 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)
SRV - [2005/11/14 00:06:04 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2004/09/07 15:12:32 | 000,225,353 | ---- | M] (Intel® Corporation) [Auto | Stopped] -- C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe -- (WLANKEEPER)
SRV - [2004/09/07 15:05:10 | 000,360,521 | ---- | M] (Intel Corporation ) [Auto | Stopped] -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe -- (S24EventMonitor)
SRV - [2004/09/07 15:02:40 | 000,086,016 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe -- (EvtEng)
SRV - [2004/09/07 15:02:04 | 000,139,264 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe -- (RegSrvc)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\agp440.sys -- (agp440)
DRV - [2010/09/17 12:21:00 | 000,135,248 | ---- | M] (CA) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\KmxAMRT.sys -- (KmxAMRT)
DRV - [2010/06/09 06:54:38 | 000,244,304 | ---- | M] (CA) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\KmxCfg.sys -- (KmxCfg)
DRV - [2010/05/10 18:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Stopped] -- C:\Documents and Settings\Hiromi\Local Settings\Temp\SAS_SelfExtract\saskutil.sys -- (SASKUTIL)
DRV - [2010/05/03 02:12:02 | 000,108,112 | ---- | M] (CA) [Kernel | Boot | Stopped] -- C:\WINDOWS\System32\DRIVERS\kmxstart.sys -- (KmxStart)
DRV - [2010/04/29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2010/03/22 13:58:42 | 000,079,864 | ---- | M] (CA) [File_System | System | Stopped] -- C:\WINDOWS\system32\drivers\KmxAgent.sys -- (KmxAgent)
DRV - [2010/02/17 18:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Stopped] -- C:\Documents and Settings\Hiromi\Local Settings\Temp\SAS_SelfExtract\sasdifsv.sys -- (SASDIFSV)
DRV - [2009/03/27 14:27:04 | 000,598,656 | ---- | M] (Computer Associates International, Inc.) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\KmxAMVet.sys -- (KmxAMVet)
DRV - [2008/04/13 18:36:39 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)
DRV - [2008/04/13 18:36:39 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)
DRV - [2007/02/25 11:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\dsunidrv.sys -- (dsunidrv)
DRV - [2007/01/04 11:01:08 | 000,061,536 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sea1bus.sys -- (sea1bus) Sony Ericsson Device 0A1 driver (WDM)
DRV - [2006/10/05 15:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
DRV - [2006/07/15 23:25:52 | 000,094,064 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k510mdm.sys -- (k510mdm)
DRV - [2006/07/15 23:25:52 | 000,085,408 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k510mgmt.sys -- (k510mgmt) Sony Ericsson K510 USB WMC Device Management Drivers (WDM)
DRV - [2006/07/15 23:25:52 | 000,083,344 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k510obex.sys -- (k510obex)
DRV - [2006/07/15 23:25:52 | 000,008,336 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k510mdfl.sys -- (k510mdfl)
DRV - [2006/02/17 19:34:10 | 000,058,288 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k510bus.sys -- (k510bus) Sony Ericsson K510 Driver driver (WDM)
DRV - [2005/05/31 04:33:00 | 000,100,605 | ---- | M] (Sonic Solutions) [File_System | Auto | Stopped] -- C:\WINDOWS\system32\dla\tfsnudfa.sys -- (tfsnudfa)
DRV - [2005/05/31 04:33:00 | 000,098,716 | ---- | M] (Sonic Solutions) [File_System | Auto | Stopped] -- C:\WINDOWS\system32\dla\tfsnudf.sys -- (tfsnudf)
DRV - [2005/05/31 04:33:00 | 000,086,876 | ---- | M] (Sonic Solutions) [File_System | Auto | Stopped] -- C:\WINDOWS\system32\dla\tfsnifs.sys -- (tfsnifs)
DRV - [2005/05/31 04:33:00 | 000,034,845 | ---- | M] (Sonic Solutions) [File_System | Auto | Stopped] -- C:\WINDOWS\system32\dla\tfsncofs.sys -- (tfsncofs)
DRV - [2005/05/31 04:33:00 | 000,025,725 | ---- | M] (Sonic Solutions) [File_System | Auto | Stopped] -- C:\WINDOWS\system32\dla\tfsnboio.sys -- (tfsnboio)
DRV - [2005/05/31 04:33:00 | 000,015,069 | ---- | M] (Sonic Solutions) [File_System | Auto | Stopped] -- C:\WINDOWS\system32\dla\tfsnopio.sys -- (tfsnopio)
DRV - [2005/05/31 04:33:00 | 000,006,365 | ---- | M] (Sonic Solutions) [File_System | Auto | Stopped] -- C:\WINDOWS\system32\dla\tfsnpool.sys -- (tfsnpool)
DRV - [2005/05/31 04:33:00 | 000,004,125 | ---- | M] (Sonic Solutions) [File_System | Auto | Stopped] -- C:\WINDOWS\system32\dla\tfsndrct.sys -- (tfsndrct)
DRV - [2005/05/31 04:33:00 | 000,002,241 | ---- | M] (Sonic Solutions) [File_System | Auto | Stopped] -- C:\WINDOWS\system32\dla\tfsndres.sys -- (tfsndres)
DRV - [2005/05/13 09:37:28 | 000,005,627 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\sscdbhk5.sys -- (sscdbhk5)
DRV - [2005/05/13 09:37:20 | 000,023,545 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\ssrtln.sys -- (ssrtln)
DRV - [2005/04/22 02:22:00 | 000,088,352 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\drvmcdb.sys -- (drvmcdb)
DRV - [2005/04/21 01:56:00 | 000,040,544 | ---- | M] (Sonic Solutions) [File_System | Auto | Stopped] -- C:\WINDOWS\system32\drivers\drvnddm.sys -- (drvnddm)
DRV - [2004/11/16 15:03:52 | 000,108,791 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2004/10/21 19:56:04 | 003,210,496 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51) Intel®
DRV - [2004/09/15 23:53:12 | 000,271,704 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\STAC97.sys -- (STAC97)
DRV - [2004/08/31 07:53:04 | 000,011,354 | ---- | M] (Intel Corporation) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
DRV - [2004/08/18 13:53:54 | 000,016,128 | ---- | M] (Dell Inc) [Kernel | System | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS -- (APPDRV)
DRV - [2004/08/12 07:44:04 | 000,234,496 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\iwca.sys -- (IWCA)
DRV - [2004/08/04 04:00:00 | 000,012,160 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\fsvga.sys -- (FsVga)
DRV - [2004/08/03 21:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2004/06/17 19:57:02 | 000,200,064 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HSFHWICH.sys -- (HSFHWICH)
DRV - [2004/06/17 19:55:38 | 000,685,056 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2004/06/17 19:55:04 | 001,041,536 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
DRV - [2004/05/26 19:18:18 | 000,044,928 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2004/02/13 15:46:00 | 000,017,153 | ---- | M] (Dell Inc) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\omci.sys -- (omci)
DRV - [2001/08/17 13:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)
DRV - [2001/08/17 13:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)
DRV - [2001/08/17 13:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)
DRV - [2001/08/17 13:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)
DRV - [2001/08/17 13:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)
DRV - [2001/08/17 12:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)
DRV - [2001/08/17 12:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)
DRV - [2001/08/17 12:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)
DRV - [2001/08/17 12:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)
DRV - [2001/08/17 12:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)
DRV - [2001/08/17 12:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)
DRV - [2001/08/17 12:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)
DRV - [2001/08/17 12:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)
DRV - [2001/08/17 12:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)
DRV - [2001/08/17 12:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.co.uk/myway
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com
IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:10293

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.co...-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://en-GB.start.m...en-GB:official"

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008/06/27 21:00:28 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{86CE05E1-F2EC-4321-A426-60D1261ED34B}: C:\Documents and Settings\Hiromi\Local Settings\Application Data\{86CE05E1-F2EC-4321-A426-60D1261ED34B} [2009/08/27 20:42:05 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.20\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/09/15 21:32:20 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.20\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/15 21:32:20 | 000,000,000 | ---D | M]

[2006/12/07 00:51:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hiromi\Application Data\Mozilla\Firefox\Profiles\mw246t0a.default\extensions
[2010/11/03 11:28:18 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2006/12/07 00:48:13 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010/05/02 22:23:21 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/10/05 21:03:13 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2007/02/11 17:22:42 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\[email protected]
[2009/10/31 11:55:27 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\[email protected]
[2009/10/31 11:55:06 | 000,067,688 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\jar50.dll
[2009/10/31 11:55:06 | 000,054,368 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\jsd3250.dll
[2009/10/31 11:55:06 | 000,034,944 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\myspell.dll
[2009/10/31 11:55:08 | 000,046,712 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\spellchk.dll
[2009/10/31 11:55:09 | 000,172,136 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\xpinstal.dll
[2010/07/17 04:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2009/10/31 11:55:23 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2009/10/31 11:55:24 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2009/10/31 11:55:24 | 000,001,077 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2009/10/31 11:55:24 | 000,000,831 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2004/08/04 04:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {10134636-E7AF-4AC5-A1DC-C7C44BB97D81} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [cctray] C:\Program Files\CA\CA Internet Security Suite\casc.exe (CA, Inc.)
O4 - HKLM..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe ()
O4 - HKLM..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe ()
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [Etovuheqico] C:\WINDOWS\uwecaguhim.DLL (eEye Digital Security)
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe (ScanSoft, Inc)
O4 - HKLM..\Run: [UserFaultCheck] File not found
O4 - HKLM..\Run: [VirginMediaHUB.exe] C:\Program Files\Virgin Media\HUB\VirginMediaHUB.exe (Virgin Media)
O4 - HKCU..\Run: [accacei] c:\documents and settings\hiromi\local settings\application data\accacei.exe (imprenable)
O4 - HKCU..\Run: [DellSupport] C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.)
O4 - HKCU..\Run: [wojiptda] C:\Documents and Settings\Hiromi\Local Settings\Temp\rpjycltqb\traowabdlta.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe (BVRP Software)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ClassicShell = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (Intertrust Technologies, Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {A9CF3378-D60E-40A8-927D-7EA0D5B0AA98} http://webalbum.bonu...geUploader6.cab (Bonusprint Image Uploader Version 6.x Control)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O20 - Winlogon\Notify\IntelWireless: DllName - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll (Intel Corporation)
O20 - Winlogon\Notify\PFW: DllName - UmxWnp.Dll - C:\WINDOWS\System32\UmxWNP.dll (CA)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O29 - HKLM SecurityProviders - (xlibgfl254.dll) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 12:04:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{d2d38625-bdf1-11df-9563-00123fd6aaef}\Shell\AutoRun\command - "" = E:\Launcher.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)


SafeBootMin: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

CREATERESTOREPOINT
Error starting restore point: The function was called in safe mode.
Error closing restore point: The sequence number is invalid.

========== Files/Folders - Created Within 30 Days ==========

[2010/11/07 22:12:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hiromi\Application Data\Malwarebytes
[2010/11/07 22:10:52 | 006,153,352 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Hiromi\Desktop\mbam-setup-1.46.exe
[2010/11/07 21:51:11 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Hiromi\Desktop\OTL.scr
[2010/11/07 21:50:52 | 000,258,560 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Hiromi\Desktop\OTH.scr
[2010/11/05 08:19:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hiromi\Application Data\SUPERAntiSpyware.com
[2010/11/05 08:19:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2010/11/05 08:18:30 | 000,000,000 | ---D | C] -- C:\stdtsa
[2010/11/03 22:11:45 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2010/11/03 21:51:14 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/11/03 21:51:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/11/03 21:51:12 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/11/03 21:51:12 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/11/03 21:49:31 | 006,153,384 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Hiromi\Desktop\mbam-setup.exe
[2010/11/03 15:12:08 | 000,000,000 | ---D | C] -- C:\1e0e14bc753929262bb0e66ca33db2
[2010/11/03 10:42:47 | 000,628,224 | ---- | C] (SBqmc6jpJRS) -- C:\Documents and Settings\Hiromi\Local Settings\Application Data\syssvc.exe
[2010/10/12 20:22:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hiromi\Local Settings\Application Data\PackageAware
[2010/07/28 21:15:04 | 014,646,912 | ---- | C] (CA ) -- C:\Program Files\uk_pct_ca_en_UKDef2010_trial.exe
[2010/07/28 20:54:03 | 001,341,176 | ---- | C] (CA) -- C:\Program Files\am_ca_en.exe
[2010/05/02 20:52:14 | 003,382,520 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup231.exe
[2010/04/22 21:13:32 | 003,249,328 | ---- | C] (Virgin Media) -- C:\Program Files\VirginMediaHUB-S.exe
[2009/06/11 12:03:16 | 000,281,600 | ---- | C] (imprenable) -- C:\Documents and Settings\Hiromi\Local Settings\Application Data\accacei.exe
[2009/06/02 21:26:15 | 004,909,440 | ---- | C] (Microsoft Corporation) -- C:\Program Files\Silverlight.2.0.exe
[2008/07/27 14:45:00 | 103,893,576 | ---- | C] (CA, Inc. ) -- C:\Program Files\issdm_en_32.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/11/08 10:37:09 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/11/08 10:36:21 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/11/08 10:32:23 | 000,007,501 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k0
[2010/11/08 10:32:23 | 000,000,293 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k1
[2010/11/08 10:32:23 | 000,000,085 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k7
[2010/11/08 10:32:23 | 000,000,085 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k6
[2010/11/08 10:32:23 | 000,000,085 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k5
[2010/11/08 10:32:23 | 000,000,085 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k4
[2010/11/08 10:32:23 | 000,000,085 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k3
[2010/11/08 10:32:23 | 000,000,085 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k2
[2010/11/08 10:32:23 | 000,000,049 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k7
[2010/11/08 10:32:23 | 000,000,049 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k6
[2010/11/08 10:32:23 | 000,000,049 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k5
[2010/11/08 10:32:23 | 000,000,049 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k4
[2010/11/08 10:32:23 | 000,000,049 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k3
[2010/11/08 10:32:23 | 000,000,049 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k2
[2010/11/08 10:32:23 | 000,000,049 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k1
[2010/11/08 10:32:23 | 000,000,049 | ---- | M] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k0
[2010/11/08 10:31:33 | 000,002,205 | ---- | M] () -- C:\Documents and Settings\Hiromi\Local Settings\Application Data\accacei.dat
[2010/11/08 10:28:44 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2010/11/08 10:28:31 | 000,000,292 | ---- | M] () -- C:\WINDOWS\tasks\iMeshNAG.job
[2010/11/08 09:14:03 | 000,003,176 | ---- | M] () -- C:\WINDOWS\Iletucejalafoqi.dat
[2010/11/07 22:10:48 | 006,153,352 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Hiromi\Desktop\mbam-setup-1.46.exe
[2010/11/07 21:51:17 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Hiromi\Desktop\OTL.scr
[2010/11/07 21:50:55 | 000,258,560 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Hiromi\Desktop\OTH.scr
[2010/11/07 21:08:40 | 000,242,328 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/11/03 22:10:12 | 002,672,312 | ---- | M] () -- C:\Documents and Settings\Hiromi\Desktop\esetsmartinstaller_enu.exe
[2010/11/03 22:06:41 | 011,802,408 | ---- | M] () -- C:\Documents and Settings\Hiromi\Desktop\SAS_16832.COM
[2010/11/03 21:58:01 | 011,802,408 | ---- | M] () -- C:\Documents and Settings\Hiromi\Desktop\SAS_631F528.COM
[2010/11/03 21:52:42 | 000,364,032 | ---- | M] () -- C:\Documents and Settings\Hiromi\Desktop\rkill.com
[2010/11/03 21:51:18 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/11/03 21:50:15 | 006,153,384 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Hiromi\Desktop\mbam-setup.exe
[2010/11/03 20:38:43 | 076,859,232 | ---- | M] () -- C:\Documents and Settings\Hiromi\Desktop\std20sasfx.exe
[2010/11/03 10:42:50 | 000,628,224 | ---- | M] (SBqmc6jpJRS) -- C:\Documents and Settings\Hiromi\Local Settings\Application Data\syssvc.exe
[2010/11/02 20:18:41 | 000,128,336 | ---- | M] (Computer Associates International, Inc.) -- C:\WINDOWS\System32\isafeif.dll
[2010/11/02 20:18:41 | 000,095,568 | ---- | M] (Computer Associates International, Inc.) -- C:\WINDOWS\System32\vetredir.dll
[2010/11/01 21:38:30 | 000,384,930 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/11/01 21:38:30 | 000,054,614 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/11/01 21:27:36 | 000,191,586 | ---- | M] () -- C:\Documents and Settings\Hiromi\Local Settings\Application Data\accacei_nav.dat
[2010/10/21 19:09:02 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/10/15 02:15:16 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/10/12 20:26:24 | 000,000,143 | ---- | M] () -- C:\Documents and Settings\Hiromi\Desktop\Continue iMesh installation.url
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/11/03 22:08:53 | 002,672,312 | ---- | C] () -- C:\Documents and Settings\Hiromi\Desktop\esetsmartinstaller_enu.exe
[2010/11/03 22:02:39 | 011,802,408 | ---- | C] () -- C:\Documents and Settings\Hiromi\Desktop\SAS_16832.COM
[2010/11/03 21:53:55 | 011,802,408 | ---- | C] () -- C:\Documents and Settings\Hiromi\Desktop\SAS_631F528.COM
[2010/11/03 21:52:52 | 000,364,032 | ---- | C] () -- C:\Documents and Settings\Hiromi\Desktop\rkill.com
[2010/11/03 21:51:18 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/11/03 20:36:51 | 076,859,232 | ---- | C] () -- C:\Documents and Settings\Hiromi\Desktop\std20sasfx.exe
[2010/11/02 22:08:23 | 000,007,501 | ---- | C] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k0
[2010/11/02 22:08:23 | 000,000,293 | ---- | C] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k1
[2010/11/02 22:08:23 | 000,000,085 | ---- | C] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k7
[2010/11/02 22:08:23 | 000,000,085 | ---- | C] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k6
[2010/11/02 22:08:23 | 000,000,085 | ---- | C] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k5
[2010/11/02 22:08:23 | 000,000,085 | ---- | C] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k4
[2010/11/02 22:08:23 | 000,000,085 | ---- | C] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k3
[2010/11/02 22:08:23 | 000,000,085 | ---- | C] () -- C:\WINDOWS\System32\drivers\kmxcfg.u2k2
[2010/11/02 22:08:23 | 000,000,049 | ---- | C] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k7
[2010/11/02 22:08:23 | 000,000,049 | ---- | C] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k6
[2010/11/02 22:08:23 | 000,000,049 | ---- | C] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k5
[2010/11/02 22:08:23 | 000,000,049 | ---- | C] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k4
[2010/11/02 22:08:23 | 000,000,049 | ---- | C] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k3
[2010/11/02 22:08:23 | 000,000,049 | ---- | C] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k2
[2010/11/02 22:08:23 | 000,000,049 | ---- | C] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k1
[2010/11/02 22:08:23 | 000,000,049 | ---- | C] () -- C:\WINDOWS\System32\drivers\kmxzone.u2k0
[2010/10/12 20:26:24 | 000,000,143 | ---- | C] () -- C:\Documents and Settings\Hiromi\Desktop\Continue iMesh installation.url
[2010/10/12 20:26:23 | 000,000,292 | ---- | C] () -- C:\WINDOWS\tasks\iMeshNAG.job
[2009/10/01 20:33:43 | 000,019,413 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tidib.dll
[2009/10/01 20:33:43 | 000,019,400 | ---- | C] () -- C:\Program Files\Common Files\onoxa.reg
[2009/10/01 20:33:43 | 000,016,147 | ---- | C] () -- C:\Program Files\Common Files\ofyviq.bin
[2009/10/01 20:33:43 | 000,014,259 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\apyl.bat
[2009/10/01 20:33:43 | 000,013,390 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\emoki.exe
[2009/10/01 20:33:43 | 000,012,422 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\tejiqipi.db
[2009/10/01 20:33:43 | 000,011,858 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\gehaw.lib
[2009/10/01 20:33:42 | 000,016,866 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\lojokyr.lib
[2009/10/01 20:33:42 | 000,016,389 | ---- | C] () -- C:\Program Files\Common Files\lotasav.lib
[2009/10/01 20:33:42 | 000,012,920 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\juqapynozi.scr
[2009/10/01 20:33:42 | 000,010,803 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\qubamu.sys
[2009/10/01 20:33:41 | 000,016,221 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\veqybyqy._sy
[2009/10/01 20:33:41 | 000,010,475 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ulev.reg
[2009/09/30 08:19:33 | 000,017,942 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\equxijylu.reg
[2009/09/30 08:19:31 | 000,017,049 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\rubexazuj.sys
[2009/09/30 08:19:31 | 000,014,333 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ovid._sy
[2009/09/30 08:19:30 | 000,019,185 | ---- | C] () -- C:\Program Files\Common Files\ahyz.dll
[2009/09/30 08:19:30 | 000,018,695 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\hifomyso.bat
[2009/09/30 08:19:30 | 000,012,940 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\ahylymog.com
[2009/09/30 08:19:29 | 000,019,096 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\ijecapak.ban
[2009/09/30 08:19:29 | 000,015,012 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\waqe.lib
[2009/09/30 08:19:29 | 000,013,724 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\likevobobo.reg
[2009/09/30 08:19:28 | 000,016,136 | ---- | C] () -- C:\Program Files\Common Files\vumykup.bin
[2009/09/30 08:19:28 | 000,015,302 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\xegabafaxa.lib
[2009/09/30 08:19:28 | 000,010,166 | ---- | C] () -- C:\Program Files\Common Files\etesejycu.ban
[2009/09/30 08:19:26 | 000,016,517 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\ahemukoxo.dat
[2009/09/30 08:19:26 | 000,013,578 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\vucolomuf.reg
[2009/09/30 08:19:26 | 000,010,867 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\riboledeky.dl
[2009/09/30 08:08:32 | 000,018,271 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\inynizy.dat
[2009/09/30 08:08:32 | 000,014,091 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\rygakelil.dat
[2009/09/30 08:08:32 | 000,012,076 | ---- | C] () -- C:\Program Files\Common Files\upibok.sys
[2009/09/30 08:08:31 | 000,019,723 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\uzocozugir.com
[2009/09/30 08:08:31 | 000,016,678 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\mowez.bin
[2009/09/30 08:08:31 | 000,014,389 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\zuwede.ban
[2009/09/30 08:08:31 | 000,013,320 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\acesixu.db
[2009/09/30 08:08:31 | 000,012,240 | ---- | C] () -- C:\Program Files\Common Files\izegy.ban
[2009/09/30 08:08:30 | 000,012,245 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\irocif.dl
[2009/09/30 08:08:28 | 000,019,280 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ucefyjuwa.dl
[2009/09/30 08:08:28 | 000,018,983 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\cijisyq._dl
[2009/09/30 08:08:28 | 000,016,623 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\onukeje.dll
[2009/09/30 08:08:28 | 000,012,733 | ---- | C] () -- C:\Program Files\Common Files\soboke.db
[2009/09/30 08:08:28 | 000,011,699 | ---- | C] () -- C:\Program Files\Common Files\toxaf.pif
[2009/09/30 08:08:28 | 000,010,805 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\xukavipu.lib
[2009/09/30 08:08:27 | 000,012,473 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\pokulumak.bin
[2009/09/30 07:55:12 | 000,018,953 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\vahymora.reg
[2009/09/30 07:55:11 | 000,017,715 | ---- | C] () -- C:\WINDOWS\okura.dll
[2009/09/30 07:55:11 | 000,012,161 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ibicohut.dll
[2009/09/30 07:55:11 | 000,012,130 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\komecolez._sy
[2009/09/30 07:55:11 | 000,012,094 | ---- | C] () -- C:\Program Files\Common Files\furetowupe._sy
[2009/09/30 07:55:10 | 000,013,352 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\cupyf.bin
[2009/09/30 07:55:10 | 000,010,275 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\utevylon.dl
[2009/09/30 07:55:08 | 000,015,536 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\tatitivi.reg
[2009/09/30 07:55:07 | 000,011,983 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\sylijyq.lib
[2009/09/30 07:55:06 | 000,010,867 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\irigo.sys
[2009/09/30 07:55:05 | 000,017,379 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\fafimecod.reg
[2009/09/18 20:02:34 | 000,012,343 | ---- | C] () -- C:\Program Files\Common Files\zecybihehe.sys
[2009/09/18 20:02:31 | 000,014,663 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\usomec.dll
[2009/09/18 20:02:31 | 000,011,843 | ---- | C] () -- C:\Documents and Settings\Hiromi\Application Data\agazucibu.lib
[2009/09/18 20:02:26 | 000,014,260 | ---- | C] () -- C:\Program Files\Common Files\qiwuh.dl
[2009/09/18 20:02:20 | 000,012,940 | ---- | C] () -- C:\Documents and Settings\Hiromi\Application Data\axym.ban
[2009/09/18 20:02:19 | 000,018,967 | ---- | C] () -- C:\Documents and Settings\Hiromi\Application Data\afamic._sy
[2009/09/18 20:02:17 | 000,015,517 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ewemarus._sy
[2009/09/18 20:02:15 | 000,014,188 | ---- | C] () -- C:\Documents and Settings\Hiromi\Local Settings\Application Data\redax.dll
[2009/09/18 20:02:14 | 000,012,780 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\giho.bin
[2009/09/18 20:02:01 | 000,011,004 | ---- | C] () -- C:\Documents and Settings\Hiromi\Application Data\rahyg.com
[2009/09/18 19:57:13 | 000,017,437 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\muwejiwa.bat
[2009/09/18 19:57:13 | 000,017,271 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\tazicymy._dl
[2009/09/18 19:57:13 | 000,017,223 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\nefepylugy.pif
[2009/09/18 19:57:13 | 000,015,340 | ---- | C] () -- C:\Program Files\Common Files\ifyqicozy.dl
[2009/09/18 19:57:13 | 000,015,245 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\amynetyfu.exe
[2009/09/18 19:57:13 | 000,012,255 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ysiq.dl
[2009/09/18 19:57:13 | 000,010,128 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\fypazah.dl
[2009/09/18 19:57:12 | 000,018,745 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\mogyzof.lib
[2009/09/18 19:57:12 | 000,017,261 | ---- | C] () -- C:\Program Files\Common Files\tapunihame.lib
[2009/09/18 19:57:12 | 000,016,389 | ---- | C] () -- C:\Program Files\Common Files\ezoki.bat
[2009/09/18 19:57:12 | 000,015,320 | ---- | C] () -- C:\Program Files\Common Files\oxiwi.sys
[2009/09/18 19:57:12 | 000,013,757 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\enugoku.db
[2009/09/18 19:57:12 | 000,012,873 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\qygusun._dl
[2009/09/18 19:57:11 | 000,017,145 | ---- | C] () -- C:\Program Files\Common Files\pyhyjamypu.lib
[2009/09/18 19:57:11 | 000,014,694 | ---- | C] () -- C:\Program Files\Common Files\hixowucaj.scr
[2009/09/18 19:57:11 | 000,014,571 | ---- | C] () -- C:\Program Files\Common Files\notyva.dl
[2009/09/17 20:04:03 | 000,015,043 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\apuwemygic.dll
[2009/09/17 20:04:03 | 000,010,606 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\yvabag.bin
[2009/09/17 20:04:01 | 000,018,077 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\gaqowudod.scr
[2009/09/17 20:04:00 | 000,017,764 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\gyhy.sys
[2009/09/17 20:04:00 | 000,010,252 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\voqoqepu.vbs
[2009/09/17 20:04:00 | 000,010,247 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\pyfob.scr
[2009/08/22 21:04:53 | 000,003,387 | ---- | C] () -- C:\WINDOWS\DNAPrinters.ini
[2009/08/20 20:46:08 | 000,019,469 | ---- | C] () -- C:\Program Files\Common Files\ewodon.scr
[2009/08/20 20:46:08 | 000,017,599 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\erekonu.bat
[2009/08/20 20:46:08 | 000,017,387 | ---- | C] () -- C:\Program Files\Common Files\akiguhy.db
[2009/08/20 20:46:08 | 000,017,353 | ---- | C] () -- C:\WINDOWS\System32\ulojut.sys
[2009/08/20 20:46:08 | 000,017,080 | ---- | C] () -- C:\Program Files\Common Files\dimenasek.dat
[2009/08/20 20:46:08 | 000,016,243 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\onodivu._dl
[2009/08/20 20:46:08 | 000,016,239 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\bequrymux.dl
[2009/08/20 20:46:08 | 000,015,962 | ---- | C] () -- C:\Program Files\Common Files\ojehip.lib
[2009/08/20 20:46:08 | 000,015,388 | ---- | C] () -- C:\Program Files\Common Files\hiqunamo._dl
[2009/08/20 20:46:08 | 000,015,018 | ---- | C] () -- C:\Program Files\Common Files\amutubiju.com
[2009/08/20 20:46:08 | 000,012,044 | ---- | C] () -- C:\WINDOWS\lygar.sys
[2009/08/20 20:46:08 | 000,011,826 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\asep.reg
[2009/08/20 20:46:08 | 000,011,622 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\qicoqi.db
[2009/08/20 20:46:08 | 000,010,863 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\wejizegeq.reg
[2009/08/20 20:46:08 | 000,010,809 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\omydajuq.scr
[2009/08/20 20:46:08 | 000,010,438 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\ulamixak.reg
[2009/08/17 20:14:17 | 000,000,024 | ---- | C] () -- C:\Documents and Settings\Hiromi\Application Data\wiaserva.log
[2009/06/11 12:03:50 | 000,191,586 | ---- | C] () -- C:\Documents and Settings\Hiromi\Local Settings\Application Data\accacei_nav.dat
[2009/06/11 12:03:50 | 000,000,687 | ---- | C] () -- C:\Documents and Settings\Hiromi\Local Settings\Application Data\accacei_navps.dat
[2009/06/11 12:03:49 | 000,002,205 | ---- | C] () -- C:\Documents and Settings\Hiromi\Local Settings\Application Data\accacei.dat
[2008/07/27 21:27:58 | 000,000,393 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2008/07/20 20:58:40 | 019,153,264 | ---- | C] () -- C:\Program Files\aaw2008.exe
[2007/12/17 14:46:36 | 000,001,751 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/01/30 19:34:40 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Hiromi\Application Data\Install.dat
[2006/12/10 02:18:00 | 000,000,129 | ---- | C] () -- C:\Documents and Settings\Hiromi\Local Settings\Application Data\fusioncache.dat
[2006/11/26 10:55:20 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2006/07/15 23:46:02 | 000,000,000 | ---- | C] () -- C:\WINDOWS\mngui.INI
[2005/08/20 14:47:03 | 000,000,525 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2005/07/03 11:01:21 | 000,000,432 | ---- | C] () -- C:\WINDOWS\dellstat.ini
[2005/07/03 11:00:48 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\dlbcvs.dll
[2005/07/03 11:00:44 | 000,000,373 | ---- | C] () -- C:\WINDOWS\System32\dlbccoin.ini
[2005/06/14 21:30:02 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/06/10 20:46:52 | 000,037,888 | ---- | C] () -- C:\Documents and Settings\Hiromi\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/06/07 19:06:19 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005/06/07 18:56:38 | 000,000,405 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2005/06/07 18:43:59 | 000,000,004 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare
[2005/06/07 18:17:30 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\stac97co.dll
[2005/06/07 18:16:46 | 000,000,372 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005/05/12 08:25:24 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2004/08/12 07:44:10 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\iwca.dll
[2004/08/10 12:12:05 | 000,000,831 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/08/10 12:01:18 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/08/10 11:57:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2003/01/07 14:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2010/07/28 21:35:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CA
[2010/09/14 20:15:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Radialpoint
[2005/08/20 14:47:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SSScanAppDataDir
[2005/08/20 14:47:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SSScanWizard
[2007/12/31 17:09:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
[2005/06/07 18:50:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2010/04/22 21:19:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Virgin Media
[2010/09/15 21:39:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/07/28 21:11:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hiromi\Application Data\CallingID
[2005/08/24 22:09:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hiromi\Application Data\Canon
[2005/08/20 14:43:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hiromi\Application Data\InterTrust
[2009/06/23 21:30:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hiromi\Application Data\Leadertech
[2005/08/20 14:47:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hiromi\Application Data\ScanSoft
[2006/07/15 23:35:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hiromi\Application Data\Teleca
[2005/06/10 20:36:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hiromi\Application Data\Template
[2005/10/12 17:48:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hiromi\Application Data\unew
[2009/12/31 10:56:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hiromi\Application Data\Uniblue
[2009/06/11 20:15:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hiromi\Application Data\Viewpoint
[2010/04/22 21:19:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hiromi\Application Data\Virgin Media
[2010/11/08 10:28:31 | 000,000,292 | ---- | M] () -- C:\WINDOWS\Tasks\iMeshNAG.job
[2005/06/10 16:09:57 | 000,000,258 | ---- | M] () -- C:\WINDOWS\Tasks\ISP signup reminder 1.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2004/08/10 12:04:08 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2005/06/10 16:09:59 | 000,000,211 | RHS- | M] () -- C:\boot.ini
[2008/07/27 16:09:45 | 000,033,366 | ---- | M] () -- C:\caavsetupLog.txt
[2010/07/28 21:57:04 | 002,430,522 | ---- | M] () -- C:\caisslog.txt
[2010/05/02 21:09:33 | 000,284,862 | ---- | M] () -- C:\cc_20100502_220616.reg
[2010/05/02 21:18:18 | 000,010,800 | ---- | M] () -- C:\cc_20100502_221741.reg
[2004/08/10 12:04:08 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2007/10/16 19:54:40 | 000,000,081 | ---- | M] () -- C:\CTX.DAT
[2005/06/07 18:21:48 | 000,004,611 | RH-- | M] () -- C:\dell.sdr
[2005/06/10 19:58:17 | 000,004,128 | ---- | M] () -- C:\INFCACHE.1
[2004/08/10 12:04:08 | 000,000,000 | -H-- | M] () -- C:\IO.SYS
[2005/06/07 18:50:18 | 000,000,880 | -H-- | M] () -- C:\IPH.PH
[2004/08/10 12:04:08 | 000,000,000 | -H-- | M] () -- C:\MSDOS.SYS
[2004/08/04 04:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/09/23 08:45:42 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2010/11/08 10:36:11 | 792,723,456 | -HS- | M] () -- C:\pagefile.sys

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/08/10 12:03:42 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2003/07/29 13:27:40 | 000,078,336 | ---- | M] () -- C:\WINDOWS\system32\spool\prtprocs\w32x86\DLBCPP5C.DLL
[2007/04/09 12:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2009/09/30 08:19:31 | 000,019,689 | ---- | M] () -- C:\WINDOWS\alyjaj.scr
[2009/09/30 08:19:30 | 000,011,165 | ---- | M] () -- C:\WINDOWS\ecuxym.scr
[2009/10/01 20:33:42 | 000,019,212 | ---- | M] () -- C:\WINDOWS\esyd.scr
[2009/09/30 08:08:32 | 000,013,994 | ---- | M] () -- C:\WINDOWS\mamel.scr
[2009/09/30 07:55:11 | 000,012,812 | ---- | M] () -- C:\WINDOWS\mepogi.scr
[2009/10/01 20:33:42 | 000,018,147 | ---- | M] () -- C:\WINDOWS\unyrowygo.scr
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*._sy >
[2009/10/01 20:33:43 | 000,014,299 | ---- | M] () -- C:\WINDOWS\iwybytop._sy
[2009/09/30 08:19:27 | 000,017,846 | ---- | M] () -- C:\WINDOWS\odejudines._sy
[2009/09/17 20:04:02 | 000,010,133 | ---- | M] () -- C:\WINDOWS\paciko._sy
[2009/09/18 19:57:12 | 000,018,699 | ---- | M] () -- C:\WINDOWS\tinece._sy
[2009/09/17 20:04:02 | 000,019,710 | ---- | M] () -- C:\WINDOWS\zekomepij._sy
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/07/20 21:03:05 | 019,153,264 | ---- | M] () -- C:\Program Files\aaw2008.exe
[2010/07/28 20:54:17 | 001,341,176 | ---- | M] (CA) -- C:\Program Files\am_ca_en.exe
[2010/05/02 20:53:04 | 003,382,520 | ---- | M] (Piriform Ltd) -- C:\Program Files\ccsetup231.exe
[2008/07/27 14:58:48 | 103,893,576 | ---- | M] (CA, Inc. ) -- C:\Program Files\issdm_en_32.exe
[2009/06/02 21:26:50 | 004,909,440 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Silverlight.2.0.exe
[2010/07/28 21:15:04 | 014,646,912 | ---- | M] (CA ) -- C:\Program Files\uk_pct_ca_en_UKDef2010_trial.exe
[2010/04/22 21:15:30 | 003,249,328 | ---- | M] (Virgin Media) -- C:\Program Files\VirginMediaHUB-S.exe

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2004/08/10 11:56:48 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2004/08/10 11:56:46 | 000,634,880 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2004/08/10 11:56:46 | 000,872,448 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2008/09/23 08:59:18 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >
[2009/09/30 07:55:11 | 000,012,053 | ---- | M] () -- C:\WINDOWS\system32\iwenepal.db
[2009/09/18 19:57:13 | 000,016,079 | ---- | M] () -- C:\WINDOWS\system32\kizolaguh.db
[2006/11/28 22:04:13 | 000,000,121 | ---- | M] () -- C:\WINDOWS\system32\SDMonRemoveDB.db
[2006/11/28 22:05:07 | 000,000,139 | ---- | M] () -- C:\WINDOWS\system32\SDRemoveDB.db
[2009/09/18 20:02:23 | 000,016,364 | ---- | M] () -- C:\WINDOWS\system32\usemytox.db
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2005/06/10 16:12:03 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\Hiromi\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2004/08/10 12:08:38 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Hiromi\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2010/11/03 22:10:12 | 002,672,312 | ---- | M] () -- C:\Documents and Settings\Hiromi\Desktop\esetsmartinstaller_enu.exe
[2010/11/07 22:10:48 | 006,153,352 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Hiromi\Desktop\mbam-setup-1.46.exe
[2010/11/03 21:50:15 | 006,153,384 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Hiromi\Desktop\mbam-setup.exe
[2010/11/03 15:10:59 | 013,063,352 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Hiromi\Desktop\mssefullinstall-x86fre-en-us-xp.exe
[2010/11/03 20:38:43 | 076,859,232 | ---- | M] () -- C:\Documents and Settings\Hiromi\Desktop\std20sasfx.exe
[2005/09/15 22:26:59 | 004,077,184 | ---- | M] () -- C:\Documents and Settings\Hiromi\Desktop\winzip90.exe

< %PROGRAMFILES%\Common Files\*.* >
[2009/09/30 08:19:30 | 000,019,185 | ---- | M] () -- C:\Program Files\Common Files\ahyz.dll
[2009/08/20 20:46:08 | 000,017,387 | ---- | M] () -- C:\Program Files\Common Files\akiguhy.db
[2009/08/20 20:46:08 | 000,015,018 | ---- | M] () -- C:\Program Files\Common Files\amutubiju.com
[2009/08/20 20:46:08 | 000,017,080 | ---- | M] () -- C:\Program Files\Common Files\dimenasek.dat
[2009/09/30 08:19:28 | 000,010,166 | ---- | M] () -- C:\Program Files\Common Files\etesejycu.ban
[2009/08/20 20:46:08 | 000,019,469 | ---- | M] () -- C:\Program Files\Common Files\ewodon.scr
[2009/09/18 19:57:12 | 000,016,389 | ---- | M] () -- C:\Program Files\Common Files\ezoki.bat
[2009/09/30 07:55:11 | 000,012,094 | ---- | M] () -- C:\Program Files\Common Files\furetowupe._sy
[2009/08/20 20:46:08 | 000,015,388 | ---- | M] () -- C:\Program Files\Common Files\hiqunamo._dl
[2009/09/18 19:57:11 | 000,014,694 | ---- | M] () -- C:\Program Files\Common Files\hixowucaj.scr
[2009/09/18 19:57:13 | 000,015,340 | ---- | M] () -- C:\Program Files\Common Files\ifyqicozy.dl
[2009/09/30 08:08:31 | 000,012,240 | ---- | M] () -- C:\Program Files\Common Files\izegy.ban
[2009/10/01 20:33:42 | 000,016,389 | ---- | M] () -- C:\Program Files\Common Files\lotasav.lib
[2009/09/18 19:57:11 | 000,014,571 | ---- | M] () -- C:\Program Files\Common Files\notyva.dl
[2009/10/01 20:33:43 | 000,016,147 | ---- | M] () -- C:\Program Files\Common Files\ofyviq.bin
[2009/08/20 20:46:08 | 000,015,962 | ---- | M] () -- C:\Program Files\Common Files\ojehip.lib
[2009/10/01 20:33:43 | 000,019,400 | ---- | M] () -- C:\Program Files\Common Files\onoxa.reg
[2009/09/18 19:57:12 | 000,015,320 | ---- | M] () -- C:\Program Files\Common Files\oxiwi.sys
[2009/09/18 19:57:11 | 000,017,145 | ---- | M] () -- C:\Program Files\Common Files\pyhyjamypu.lib
[2009/09/18 20:02:26 | 000,014,260 | ---- | M] () -- C:\Program Files\Common Files\qiwuh.dl
[2009/09/30 08:08:28 | 000,012,733 | ---- | M] () -- C:\Program Files\Common Files\soboke.db
[2009/09/18 19:57:12 | 000,017,261 | ---- | M] () -- C:\Program Files\Common Files\tapunihame.lib
[2009/09/30 08:08:28 | 000,011,699 | ---- | M] () -- C:\Program Files\Common Files\toxaf.pif
[2009/09/30 08:08:32 | 000,012,076 | ---- | M] () -- C:\Program Files\Common Files\upibok.sys
[2009/09/30 08:19:28 | 000,016,136 | ---- | M] () -- C:\Program Files\Common Files\vumykup.bin
[2009/09/18 20:02:34 | 000,012,343 | ---- | M] () -- C:\Program Files\Common Files\zecybihehe.sys

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2004/08/04 04:00:00 | 000,000,791 | ---- | M] () -- C:\WINDOWS\addins\fxsext.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2005/06/10 16:12:01 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Hiromi\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2010/08/21 21:50:09 | 000,000,067 | -HS- | M] () -- C:\Documents and Settings\Hiromi\Cookies\desktop.ini
[2010/11/08 10:37:07 | 000,180,224 | -HS- | M] () -- C:\Documents and Settings\Hiromi\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2007/06/26 21:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >
[2004/10/29 20:56:50 | 000,466,944 | ---- | M] (Intel Corporation) -- C:\WINDOWS\Installer\iProInst.exe
[8 C:\WINDOWS\Installer\*.tmp files -> C:\WINDOWS\Installer\*.tmp -> ]

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.exe >
[2008/04/14 00:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< %USERPROFILE%\Templates\*.tmp >

< %SYSTEMDRIVE%\explorexxx.exe\*.* >

< %Windir%\Installer\*.tmp >
[8 C:\WINDOWS\Installer\*.tmp files -> C:\WINDOWS\Installer\*.tmp -> ]

< %systemroot%\System32\*.xco >

< %ProgramFiles%\system32\*.* >

< %systemroot%\System32\windos\*.* >

< %SystemRoot%\system32\sandbox\*.* >

< %SystemRoot%\system32\*.amo >

< %SystemRoot%\system32\Windows Live\*.* >

< %ProgramFiles%\logs\*.* >

< %ProgramFiles%\Bifrost\*.* >

< %SystemRoot%\system32\*.goo >

< %systemroot%\system32\IME\*.* >

< %systemroot%\BackUp\*.* >

< %systemroot%\system32\*.ico >
[2004/08/10 09:11:00 | 000,022,486 | ---- | M] () -- C:\WINDOWS\system32\lrnxp.ico
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system\*.dat >

< %systemroot%\system\*.exe >

< %AppData%\Macromedia\Common\*.* >

< %SYSTEMDRIVE%\dir\*.* /s >

< %systemroot%\system32\ras\*.exe >

< %SYSTEMDRIVE%\MFILES\*.* >

< %SYSTEMDRIVE%\mDNSRespon.exe\*.* >

< %systemroot%\system32\services\*.* >

< %systemroot%\Spooler\*.* >

< %ProgramFiles%\system32\*.* >

< %systemroot%\system32\Setup\*.dll /x >

< %systemroot%\system32\*.mine >

< %SYSTEMDRIVE%\cleansweep.exe\*.* >

< %systemroot%\system32\ras\*.dll >

< %systemroot%\system32\ras\*.drv >

< %systemroot%\*.iq >

< %systemroot%\system32\XP\*.* >

< %SYSTEMDRIVE%\Extracted\*.* >

< %systemroot%\system32\windows\*.* >

< %systemroot%\logs\*.* >

< %SYSTEMDRIVE%\Win.Msi\*.* >

< %systemroot%\regedit\*.* >

< %systemroot%\system32\skype\*.* >

< %AppData%\Adobe\dlluplwin25\*.* >

< %UserProfile%\*.dat >
[2010/11/08 10:31:58 | 007,340,032 | -H-- | M] () -- C:\Documents and Settings\Hiromi\NTUSER.DAT

< %UserProfile%\*.dll >

< %systemroot%\system32\*.sxo >

< %SYSTEMDRIVE%\Gazma\*.* /s >

< %systemroot%\system32\spynet\*.* >

< %systemroot%\system32\System\*.* >

< %appdata%\Microsoft\Windows\*.* >

< %systemroot%\system32\WinDir\*.* >

< %systemroot%\_\*.* >

< %systemroot%\system32\windows32\*.* >

< %ProgramFiles%\win\*.* >

< %AppData%\Microsoft\CD Burning\*.* >

< %systemroot%\*.cab >

< %systemroot%\K.Backup\*.* >

< %ProgramFiles%\Massenger\*.* >

< %systemroot%\System32\*.doc >

< %systemroot%\Office12\*.* >

< %systemroot%\System32\Rundl32.exe\*.* >

< %ProgramFiles%\yahoo.net\*.* >

< %systemroot%\system32\*.igo >

< %systemroot%\*.rew >

< %systemroot%\System32\spool\DRIVERS\W32X86\3\*.exe >
[2003/04/30 19:35:14 | 000,073,728 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\DLBCJSWX.EXE
[2004/04/01 14:30:36 | 000,118,784 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\DLBCPSWX.EXE
[2004/05/27 09:24:38 | 000,100,352 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\DLBCUN5C.EXE
[2001/01/19 19:50:20 | 000,040,960 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\INSTMON.EXE
[2004/03/04 15:30:48 | 000,311,296 | ---- | M] (Lexmark International, Inc.) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\LEXBCES.EXE
[2000/02/09 12:35:42 | 000,170,496 | ---- | M] (Lexmark International, Inc.) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\lexdrvin.exe
[2002/05/09 18:25:40 | 000,024,576 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\lexgo.EXE
[2004/03/04 15:26:20 | 000,174,592 | ---- | M] (Lexmark International, Inc.) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\LEXPPS.EXE

< %USERPROFILE%\.COMMgr\*.* >

< %USERPROFILE%\Desktop\*.bat >

< %PROGRAMFILES%\Common Files\Real\visualizations\*.rpv /x >

< %PROGRAMFILES%\Internet Explorer\*.Jmp >

< %PROGRAMFILES%\Windows NT\system\*.dll >

< %systemroot%\system32\*.ext >

< %systemroot%\system32\Com\*.cfg >

< %systemroot%\system32\btz\*.* >

< %systemroot%\system32\EMP\*.* >

< %systemroot%\system32\expo\*.* >

< %systemroot%\system32\inet2\*.* >

< %systemroot%\system32\xrem\*.* >

< %ProgramFiles%\Microsoft\*.* >

< %systemroot%\usgwmt\*.* >

< %ProgramFiles%\B\*.* >

< %SYSTEMDRIVE%\lspp\*.* >

< %systemroot%\Kral\*.* >

< %SYSTEMDRIVE%\windowsdvd.exe\*.* >

< %systemroot%\system32\*.ipo >

< %SYSTEMDRIVE%\usxxxxxxxx.exe\*.* >

< %systemroot%\system32\*.mof >

< %systemroot%\*.atm >

< %systemroot%\system32\svhost\*.* >

< %ProgramFiles%\system32\*.* >

< %ProgramFiles%\Docmentt\*.* >

< %systemroot%\Help\*.vbs >

< %ProgramFiles%\Windows WinSxs\*.* /s >

< %ProgramFiles%\Outlook Express\IDT\*.* /s >

< %ProgramFiles%\Microsoft Office\365\*.* /s >

< %ProgramFiles%\Windows Live\*.* >

< %systemroot%\system32\win32\*.* >

< %SYSTEMDRIVE%\RECYCLER\*.* >

< %systemroot%\Fresh1\*.* >

< %ProgramFiles%\Kekj\*.* /s >

< %systemroot%\GDU\*.* >

< %systemroot%\KA\*.* >

< %systemroot%\R\*.* >

< %systemroot%\system32\*.fyo >

< %USERPROFILE%\System\*.* >

< %systemroot%\Source\*.* >

< %systemroot%\system32\ac\*.* >

< %ProgramFiles%\MSDN\*.* >

< %AppData%\AdobeUM\winvcldll54\*.* /s >

< %ProgramFiles%\Internet Explorer\*.ico >

< %systemroot%\system32\*.ojo >

< %systemroot%\system32\d323s\*.* >

< %systemroot%\system32\re\*.* >

< %UserProfile%\Microsoft\*.dll >

< %UserProfile%\Microsoft\*.log >

< %systemroot%\Bios\*.* >

< %ProgramFiles%\Spool\*.* >

< %ProgramFiles%\promp3\*.* >

< %SYSTEMDRIVE%\Driver\*.* /s >

< %SYSTEMDRIVE%\inetserver.exe\*.* >

< %systemroot%\java\trustlib\*.* >

< %ProgramFiles%\Common Files\designer\*.exe >

< %ProgramFiles%\*. >
[2009/07/09 21:29:58 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
[2005/06/07 18:25:14 | 000,000,000 | ---D | M] -- C:\Program Files\Apoint
[2010/09/15 21:28:30 | 000,000,000 | ---D | M] -- C:\Program Files\Apple Software Update
[2005/08/20 14:45:18 | 000,000,000 | ---D | M] -- C:\Program Files\ArcSoft
[2010/09/15 21:24:30 | 000,000,000 | ---D | M] -- C:\Program Files\Bonjour
[2005/06/07 18:44:42 | 000,000,000 | ---D | M] -- C:\Program Files\Broadcom
[2010/07/28 21:51:10 | 000,000,000 | ---D | M] -- C:\Program Files\CA
[2005/08/20 14:48:05 | 000,000,000 | ---D | M] -- C:\Program Files\Canon
[2010/05/02 20:54:46 | 000,000,000 | ---D | M] -- C:\Program Files\CCleaner
[2010/07/28 21:10:36 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
[2006/11/26 11:04:56 | 000,000,000 | ---D | M] -- C:\Program Files\CONEXANT
[2005/06/07 18:44:56 | 000,000,000 | ---D | M] -- C:\Program Files\CyberLink
[2005/06/07 18:55:30 | 000,000,000 | ---D | M] -- C:\Program Files\Dell
[2005/07/03 11:00:36 | 000,000,000 | ---D | M] -- C:\Program Files\Dell 720
[2005/06/07 18:48:08 | 000,000,000 | ---D | M] -- C:\Program Files\Dell Computer
[2007/12/31 17:08:55 | 000,000,000 | ---D | M] -- C:\Program Files\Dell Support Center
[2007/04/15 21:17:18 | 000,000,000 | ---D | M] -- C:\Program Files\DellSupport
[2005/06/07 18:43:39 | 000,000,000 | ---D | M] -- C:\Program Files\Digital Line Detect
[2010/11/03 22:11:45 | 000,000,000 | ---D | M] -- C:\Program Files\ESET
[2010/05/02 16:12:03 | 000,000,000 | ---D | M] -- C:\Program Files\Google
[2010/07/28 21:12:32 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
[2005/06/07 18:43:16 | 000,000,000 | ---D | M] -- C:\Program Files\Intel
[2010/10/16 07:03:37 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
[2010/09/15 21:37:57 | 000,000,000 | ---D | M] -- C:\Program Files\iPod
[2010/09/15 21:39:25 | 000,000,000 | ---D | M] -- C:\Program Files\iTunes
[2005/07/03 11:03:45 | 000,000,000 | ---D | M] -- C:\Program Files\Jasc Software Inc
[2010/10/05 21:02:58 | 000,000,000 | ---D | M] -- C:\Program Files\Java
[2008/05/03 10:52:07 | 000,000,000 | ---D | M] -- C:\Program Files\Kontiki
[2008/07/27 21:49:53 | 000,000,000 | ---D | M] -- C:\Program Files\Lavasoft
[2010/11/07 22:12:31 | 000,000,000 | ---D | M] -- C:\Program Files\Malwarebytes' Anti-Malware
[2008/09/23 09:31:11 | 000,000,000 | ---D | M] -- C:\Program Files\Messenger
[2005/06/14 21:28:27 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft ActiveSync
[2009/06/10 14:43:44 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2004/08/10 12:04:18 | 000,000,000 | ---D | M] -- C:\Program Files\microsoft frontpage
[2009/08/27 21:03:46 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Office
[2010/09/30 21:11:21 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Silverlight
[2005/06/07 18:46:39 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Works
[2005/06/14 21:26:05 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft.NET
[2006/11/26 10:55:57 | 000,000,000 | ---D | M] -- C:\Program Files\Modem Helper
[2010/08/11 21:11:31 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
[2010/11/07 22:43:48 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
[2009/08/27 21:03:13 | 000,000,000 | ---D | M] -- C:\Program Files\MSECache
[2004/08/10 12:01:16 | 000,000,000 | ---D | M] -- C:\Program Files\MSN
[2004/08/10 12:01:24 | 000,000,000 | ---D | M] -- C:\Program Files\MSN Gaming Zone
[2007/09/04 21:59:20 | 000,000,000 | ---D | M] -- C:\Program Files\MSXML 4.0
[2005/06/07 19:02:31 | 000,000,000 | ---D | M] -- C:\Program Files\MyWaySA
[2008/09/23 08:50:48 | 000,000,000 | ---D | M] -- C:\Program Files\NetMeeting
[2005/06/07 18:43:32 | 000,000,000 | ---D | M] -- C:\Program Files\NetWaiting
[2004/08/10 12:01:34 | 000,000,000 | ---D | M] -- C:\Program Files\Online Services
[2010/05/13 20:20:06 | 000,000,000 | ---D | M] -- C:\Program Files\Outlook Express
[2010/09/15 21:32:19 | 000,000,000 | ---D | M] -- C:\Program Files\QuickTime
[2005/06/07 18:49:27 | 000,000,000 | ---D | M] -- C:\Program Files\Real
[2005/08/20 14:46:41 | 000,000,000 | ---D | M] -- C:\Program Files\ScanSoft
[2005/06/07 18:26:52 | 000,000,000 | ---D | M] -- C:\Program Files\Sigmatel
[2005/09/11 17:19:34 | 000,000,000 | ---D | M] -- C:\Program Files\Sonic
[2006/12/06 23:32:45 | 000,000,000 | ---D | M] -- C:\Program Files\SpywareDetector
[2008/07/27 15:37:43 | 000,000,000 | ---D | M] -- C:\Program Files\Symantec
[2008/10/07 21:00:06 | 000,000,000 | ---D | M] -- C:\Program Files\Tiscali
[2006/12/10 02:00:07 | 000,000,000 | -H-D | M] -- C:\Program Files\Uninstall Information
[2005/06/07 18:50:07 | 000,000,000 | ---D | M] -- C:\Program Files\Viewpoint
[2010/04/22 21:19:00 | 000,000,000 | ---D | M] -- C:\Program Files\Virgin Media
[2010/09/11 22:06:47 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Connect 2
[2010/09/11 22:12:07 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Player
[2008/09/23 08:50:39 | 000,000,000 | ---D | M] -- C:\Program Files\Windows NT
[2005/09/15 22:28:32 | 000,000,000 | ---D | M] -- C:\Program Files\WinZip
[2004/08/10 12:04:18 | 000,000,000 | ---D | M] -- C:\Program Files\xerox

< %systemroot%\system32\*.tso >

< %ALLUSERSPROFILE%\Documents\Server\*.* >

< %systemroot%\*.pif >
[2009/09/30 08:08:29 | 000,019,122 | ---- | M] () -- C:\WINDOWS\ibyxufixu.pif
[2009/09/30 08:08:30 | 000,015,808 | ---- | M] () -- C:\WINDOWS\norejyrez.pif
[2009/09/18 20:02:31 | 000,010,076 | ---- | M] () -- C:\WINDOWS\owidarim.pif
[2009/09/30 08:19:28 | 000,019,454 | ---- | M] () -- C:\WINDOWS\pugimahim.pif
[2009/09/18 20:02:24 | 000,012,842 | ---- | M] () -- C:\WINDOWS\rabe.pif
[2009/08/20 20:46:08 | 000,017,717 | ---- | M] () -- C:\WINDOWS\tedonanac.pif
[2009/09/18 20:02:23 | 000,011,586 | ---- | M] () -- C:\WINDOWS\ytaz.pif
[2004/08/04 04:00:00 | 000,000,707 | ---- | M] () -- C:\WINDOWS\_default.pif
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\system32\n7533\*.* >

< %systemroot%\Us18336\*.* >

< %systemroot%\system32\*.zip >

< %systemroot%\system32\*.wgo >

< %systemroot%\system32\dllcache\*.com >

< %systemroot%\system32\dllchache\*.* >

< %systemroot%\system32\038840\*.* >

< %systemroot%\system32\13E92A\*.* >

< %systemroot%\system32\1CB5AD\*.* >

< %systemroot%\system32\52682A\*.* >

< %USERPROFILE%\My Documents\*.htm >

< %SYSTEMDRIVE%\Mr_CF\*.* >

< %USERPROFILE%\My Documents\*.dll >

< %USERPROFILE%\My Documents\*.ccc >

< %systemroot%\system32\Sis\*.* >

< %systemroot%\Microsft\*.* >

< %SYSTEMDRIVE%\driverwinx.exe\*.* >

< %systemroot%\BifroXx\*.* >

< %SYSTEMDRIVE%\TSTP\*.* >

< %systemroot%\winsn\*.* >

< %ProgramFiles%\windata\*.* >

< %SYSTEMDRIVE%\msixxxxxxx.exe\*.* >

< %systemroot%\system32\*.sao >

< %systemroot%\system32\*.iem >

< %systemroot%\system32\*.mdd >

< %systemroot%\system32\*.wlo >

< %systemroot%\system32\*.skn >

< %SYSTEMDRIVE%\Winup\*.* >

< %SYSTEMDRIVE%\test\*.* >

< %systemroot%\system32\med\*.* >

< %systemroot%\Bifrost\*.* >

< %systemroot%\system32\explorer.exe\*.* >

< %UserProfile%\UserData\*.dat /x >

< %SYSTEMDRIVE%\Arquivo de programas\*.* >

< %ProgramFiles%\tcpview\*.* >

< %systemroot%\system32\*.lyo >

< %ProgramFiles%\huanbang2\*.* >

< %systemroot%\winhuanbang\*.* >

< %systemroot%\minrsv.ini\*.* >

< %systemroot%\assembly\GAC\*.* >

< %AppData%\Adobe\crtmswin91\*.* >

< %ProgramFiles%\Windows NT\Accessories\*.exe >
[2010/07/12 12:55:03 | 000,218,112 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows NT\Accessories\wordpad.exe

< %systemroot%\system32\*.pdo >

< %SYSTEMDRIVE%\APPDATASH\*.* >

< %SYSTEMDRIVE%\sy\*.* >

< %systemroot%\*.cot >

< %systemroot%\system32\*.html >

< %systemroot%\system32\win32.exe\*.* >

< %systemroot%\System32\9283\*.* >

< %systemroot%\System32\hardpol\*.* /s >

< %systemroot%\Fonts\*.dat >

< %ProgramFiles%\WinNTsystem operation\*.* >

< %SYSTEMDRIVE%\moneyxmexx.exe\*.* >

< %USERPROFILE%\Templates\*.exe >

< %SYSTEMDRIVE%\MSOCache\*.* >

< %systemroot%\inf\win\*.* >

< %SYSTEMDRIVE%\users\*.ini /x >

< %systemroot%\Media\*.exe >

< %systemroot%\Media\*.dll >

< %AppData%\AdobeUM\upldrvdrv2\*.* >

< %ProgramFiles%\wiselink\*.* >

< %systemroot%\*.wd >

< %systemroot%\boot\*.* >

< %systemroot%\ime\*.dll /x >

< %systemroot%\system32\GroupPolicy\User\Scripts\*.* /s >

< %systemroot%\system32\*.INS >

< %SYSTEMDRIVE%\Temporary\*.* >

< %AppData%\AdobeUM\vclvclupl66\*.* >

< %SYSTEMDRIVE%\KEY\*.* /s >

< %SYSTEMDRIVE%\INVRSO\*.* >

< %systemroot%\Config\Audit\*.* /s >

< %ProgramFiles%\facebook\*.* >

< %SystemRoot%\system32\___hptmp\*.* >

< %SystemRoot%\system32\Macromedia\*.* >

< %SystemRoot%\system32\Macrocmp\*.* >

< %systemroot%\ap0calypse_00CD1A40\*.* /s >

< %SYSTEMDRIVE%\bbotxxxxxx.exe\*.* >

< %systemroot%\cacher\*.* >

< %systemroot%\down\*.* >

< %systemroot%\up\*.* >

< %SYSTEMDRIVE%\bootstartx.exe\*.* >

< %systemroot%\system32\wbem\grpconv.exe >

< %SYSTEMDRIVE%\Zolander\*.* /s >

< %systemroot%\Media_\*.* >

< HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download >
"CheckExeSignatures" = no
"RunInvalidSignatures" = 1

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Telephony\Providers|ProviderFileName6 /rs >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-10-15 02:15:33

< End of report >

Regards
Rob

[Advertisements]

Hello Henry1st, and welcome to GeeksToGo! My name is Mitch8 and I will be helping you with your problem. Here are a few things I would like to point out:

• Please post your logs, don't attach them unless stated.
• Please read my posts carefully and if you have any questions ask.
• Stay with this topic until I tell you that your system is clean. Malware can still be on your system even if you don't notice it.

I am looking at your logs now and will post back soon.

[mitch8]

Hello Henry1st, and welcome to GeeksToGo! My name is Mitch8 and I will be helping you with your problem. Here are a few things I would like to point out:

• Please post your logs, don't attach them unless stated.
• Please read my posts carefully and if you have any questions ask.
• Stay with this topic until I tell you that your system is clean. Malware can still be on your system even if you don't notice it.

I am looking at your logs now and will post back soon.

[mitch8]

Hi,

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
  IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:10293
  FF - HKLM\software\mozilla\Firefox\Extensions\\{86CE05E1-F2EC-4321-A426-60D1261ED34B}: C:\Documents and Settings\Hiromi\Local Settings\Application Data\{86CE05E1-F2EC-4321-A426-60D1261ED34B} [2009/08/27 20:42:05 | 000,000,000 | ---D | M]
  O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
  O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {10134636-E7AF-4AC5-A1DC-C7C44BB97D81} - No CLSID value found.
  O4 - HKLM..\Run: [Etovuheqico] C:\WINDOWS\uwecaguhim.DLL (eEye Digital Security)
  O4 - HKLM..\Run: [KernelFaultCheck] File not found
  O4 - HKLM..\Run: [UserFaultCheck] File not found
  O4 - HKCU..\Run: [accacei] c:\documents and settings\hiromi\local settings\application data\accacei.exe (imprenable)
  O4 - HKCU..\Run: [wojiptda] C:\Documents and Settings\Hiromi\Local Settings\Temp\rpjycltqb\traowabdlta.exe ()
  O29 - HKLM SecurityProviders - (xlibgfl254.dll) - File not found
  [2010/11/03 10:42:47 | 000,628,224 | ---- | C] (SBqmc6jpJRS) -- C:\Documents and Settings\Hiromi\Local Settings\Application Data\syssvc.exe
  [2010/11/08 10:31:33 | 000,002,205 | ---- | M] () -- C:\Documents and Settings\Hiromi\Local Settings\Application Data\accacei.dat
  [2010/11/08 09:14:03 | 000,003,176 | ---- | M] () -- C:\WINDOWS\Iletucejalafoqi.dat
  [2010/11/01 21:27:36 | 000,191,586 | ---- | M] () -- C:\Documents and Settings\Hiromi\Local Settings\Application Data\accacei_nav.dat
  [2009/10/01 20:33:43 | 000,019,413 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\tidib.dll
  [2009/10/01 20:33:43 | 000,019,400 | ---- | C] () -- C:\Program Files\Common Files\onoxa.reg
  [2009/10/01 20:33:43 | 000,016,147 | ---- | C] () -- C:\Program Files\Common Files\ofyviq.bin
  [2009/10/01 20:33:43 | 000,014,259 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\apyl.bat
  [2009/10/01 20:33:43 | 000,013,390 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\emoki.exe
  [2009/10/01 20:33:43 | 000,012,422 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\tejiqipi.db
  [2009/10/01 20:33:43 | 000,011,858 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\gehaw.lib
  [2009/10/01 20:33:42 | 000,016,866 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\lojokyr.lib
  [2009/10/01 20:33:42 | 000,016,389 | ---- | C] () -- C:\Program Files\Common Files\lotasav.lib
  [2009/10/01 20:33:42 | 000,012,920 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\juqapynozi.scr
  [2009/10/01 20:33:42 | 000,010,803 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\qubamu.sys
  [2009/10/01 20:33:41 | 000,016,221 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\veqybyqy._sy
  [2009/10/01 20:33:41 | 000,010,475 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ulev.reg
  [2009/09/30 08:19:33 | 000,017,942 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\equxijylu.reg
  [2009/09/30 08:19:31 | 000,017,049 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\rubexazuj.sys
  [2009/09/30 08:19:31 | 000,014,333 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ovid._sy
  [2009/09/30 08:19:30 | 000,019,185 | ---- | C] () -- C:\Program Files\Common Files\ahyz.dll
  [2009/09/30 08:19:30 | 000,018,695 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\hifomyso.bat
  [2009/09/30 08:19:30 | 000,012,940 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\ahylymog.com
  [2009/09/30 08:19:29 | 000,019,096 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\ijecapak.ban
  [2009/09/30 08:19:29 | 000,015,012 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\waqe.lib
  [2009/09/30 08:19:29 | 000,013,724 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\likevobobo.reg
  [2009/09/30 08:19:28 | 000,016,136 | ---- | C] () -- C:\Program Files\Common Files\vumykup.bin
  [2009/09/30 08:19:28 | 000,015,302 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\xegabafaxa.lib
  [2009/09/30 08:19:28 | 000,010,166 | ---- | C] () -- C:\Program Files\Common Files\etesejycu.ban
  [2009/09/30 08:19:26 | 000,016,517 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\ahemukoxo.dat
  [2009/09/30 08:19:26 | 000,013,578 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\vucolomuf.reg
  [2009/09/30 08:19:26 | 000,010,867 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\riboledeky.dl
  [2009/09/30 08:08:32 | 000,018,271 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\inynizy.dat
  [2009/09/30 08:08:32 | 000,014,091 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\rygakelil.dat
  [2009/09/30 08:08:32 | 000,012,076 | ---- | C] () -- C:\Program Files\Common Files\upibok.sys
  [2009/09/30 08:08:31 | 000,019,723 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\uzocozugir.com
  [2009/09/30 08:08:31 | 000,016,678 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\mowez.bin
  [2009/09/30 08:08:31 | 000,014,389 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\zuwede.ban
  [2009/09/30 08:08:31 | 000,013,320 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\acesixu.db
  [2009/09/30 08:08:31 | 000,012,240 | ---- | C] () -- C:\Program Files\Common Files\izegy.ban
  [2009/09/30 08:08:30 | 000,012,245 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\irocif.dl
  [2009/09/30 08:08:28 | 000,019,280 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ucefyjuwa.dl
  [2009/09/30 08:08:28 | 000,018,983 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\cijisyq._dl
  [2009/09/30 08:08:28 | 000,016,623 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\onukeje.dll
  [2009/09/30 08:08:28 | 000,012,733 | ---- | C] () -- C:\Program Files\Common Files\soboke.db
  [2009/09/30 08:08:28 | 000,011,699 | ---- | C] () -- C:\Program Files\Common Files\toxaf.pif
  [2009/09/30 08:08:28 | 000,010,805 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\xukavipu.lib
  [2009/09/30 08:08:27 | 000,012,473 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\pokulumak.bin
  [2009/09/30 07:55:12 | 000,018,953 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\vahymora.reg
  [2009/09/30 07:55:11 | 000,017,715 | ---- | C] () -- C:\WINDOWS\okura.dll
  [2009/09/30 07:55:11 | 000,012,161 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ibicohut.dll
  [2009/09/30 07:55:11 | 000,012,130 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\komecolez._sy
  [2009/09/30 07:55:11 | 000,012,094 | ---- | C] () -- C:\Program Files\Common Files\furetowupe._sy
  [2009/09/30 07:55:10 | 000,013,352 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\cupyf.bin
  [2009/09/30 07:55:10 | 000,010,275 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\utevylon.dl
  [2009/09/30 07:55:08 | 000,015,536 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\tatitivi.reg
  [2009/09/30 07:55:07 | 000,011,983 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\sylijyq.lib
  [2009/09/30 07:55:06 | 000,010,867 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\irigo.sys
  [2009/09/30 07:55:05 | 000,017,379 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\fafimecod.reg
  [2009/09/18 20:02:34 | 000,012,343 | ---- | C] () -- C:\Program Files\Common Files\zecybihehe.sys
  [2009/09/18 20:02:31 | 000,014,663 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\usomec.dll
  [2009/09/18 20:02:31 | 000,011,843 | ---- | C] () -- C:\Documents and Settings\Hiromi\Application Data\agazucibu.lib
  [2009/09/18 20:02:26 | 000,014,260 | ---- | C] () -- C:\Program Files\Common Files\qiwuh.dl
  [2009/09/18 20:02:20 | 000,012,940 | ---- | C] () -- C:\Documents and Settings\Hiromi\Application Data\axym.ban
  [2009/09/18 20:02:19 | 000,018,967 | ---- | C] () -- C:\Documents and Settings\Hiromi\Application Data\afamic._sy
  [2009/09/18 20:02:17 | 000,015,517 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ewemarus._sy
  [2009/09/18 20:02:15 | 000,014,188 | ---- | C] () -- C:\Documents and Settings\Hiromi\Local Settings\Application Data\redax.dll
  [2009/09/18 20:02:14 | 000,012,780 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\giho.bin
  [2009/09/18 20:02:01 | 000,011,004 | ---- | C] () -- C:\Documents and Settings\Hiromi\Application Data\rahyg.com
  [2009/09/18 19:57:13 | 000,017,437 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\muwejiwa.bat
  [2009/09/18 19:57:13 | 000,017,271 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\tazicymy._dl
  [2009/09/18 19:57:13 | 000,017,223 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\nefepylugy.pif
  [2009/09/18 19:57:13 | 000,015,340 | ---- | C] () -- C:\Program Files\Common Files\ifyqicozy.dl
  [2009/09/18 19:57:13 | 000,015,245 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\amynetyfu.exe
  [2009/09/18 19:57:13 | 000,012,255 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ysiq.dl
  [2009/09/18 19:57:13 | 000,010,128 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\fypazah.dl
  [2009/09/18 19:57:12 | 000,018,745 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\mogyzof.lib
  [2009/09/18 19:57:12 | 000,017,261 | ---- | C] () -- C:\Program Files\Common Files\tapunihame.lib
  [2009/09/18 19:57:12 | 000,016,389 | ---- | C] () -- C:\Program Files\Common Files\ezoki.bat
  [2009/09/18 19:57:12 | 000,015,320 | ---- | C] () -- C:\Program Files\Common Files\oxiwi.sys
  [2009/09/18 19:57:12 | 000,013,757 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\enugoku.db
  [2009/09/18 19:57:12 | 000,012,873 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\qygusun._dl
  [2009/09/18 19:57:11 | 000,017,145 | ---- | C] () -- C:\Program Files\Common Files\pyhyjamypu.lib
  [2009/09/18 19:57:11 | 000,014,694 | ---- | C] () -- C:\Program Files\Common Files\hixowucaj.scr
  [2009/09/18 19:57:11 | 000,014,571 | ---- | C] () -- C:\Program Files\Common Files\notyva.dl
  [2009/09/17 20:04:03 | 000,015,043 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\apuwemygic.dll
  [2009/09/17 20:04:03 | 000,010,606 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\yvabag.bin
  [2009/09/17 20:04:01 | 000,018,077 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\gaqowudod.scr
  [2009/09/17 20:04:00 | 000,017,764 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\gyhy.sys
  [2009/09/17 20:04:00 | 000,010,252 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\voqoqepu.vbs
  [2009/09/17 20:04:00 | 000,010,247 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\pyfob.scr
  [2009/08/20 20:46:08 | 000,019,469 | ---- | C] () -- C:\Program Files\Common Files\ewodon.scr
  [2009/08/20 20:46:08 | 000,017,599 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\erekonu.bat
  [2009/08/20 20:46:08 | 000,017,387 | ---- | C] () -- C:\Program Files\Common Files\akiguhy.db
  [2009/08/20 20:46:08 | 000,017,353 | ---- | C] () -- C:\WINDOWS\System32\ulojut.sys
  [2009/08/20 20:46:08 | 000,017,080 | ---- | C] () -- C:\Program Files\Common Files\dimenasek.dat
  [2009/08/20 20:46:08 | 000,016,243 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\onodivu._dl
  [2009/08/20 20:46:08 | 000,016,239 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\bequrymux.dl
  [2009/08/20 20:46:08 | 000,015,962 | ---- | C] () -- C:\Program Files\Common Files\ojehip.lib
  [2009/08/20 20:46:08 | 000,015,388 | ---- | C] () -- C:\Program Files\Common Files\hiqunamo._dl
  [2009/08/20 20:46:08 | 000,015,018 | ---- | C] () -- C:\Program Files\Common Files\amutubiju.com
  [2009/08/20 20:46:08 | 000,012,044 | ---- | C] () -- C:\WINDOWS\lygar.sys
  [2009/08/20 20:46:08 | 000,011,826 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\asep.reg
  [2009/08/20 20:46:08 | 000,011,622 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\qicoqi.db
  [2009/08/20 20:46:08 | 000,010,863 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\wejizegeq.reg
  [2009/08/20 20:46:08 | 000,010,809 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\omydajuq.scr
  [2009/08/20 20:46:08 | 000,010,438 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\ulamixak.reg
  [2009/08/17 20:14:17 | 000,000,024 | ---- | C] () -- C:\Documents and Settings\Hiromi\Application Data\wiaserva.log
  [2009/06/11 12:03:50 | 000,191,586 | ---- | C] () -- C:\Documents and Settings\Hiromi\Local Settings\Application Data\accacei_nav.dat
  [2009/06/11 12:03:50 | 000,000,687 | ---- | C] () -- C:\Documents and Settings\Hiromi\Local Settings\Application Data\accacei_navps.dat
  [2009/06/11 12:03:49 | 000,002,205 | ---- | C] () -- C:\Documents and Settings\Hiromi\Local Settings\Application Data\accacei.dat
  
  :Services
  
  :Reg
  
  :Files
  C:\Documents and Settings\Hiromi\Local Settings\Application Data\{86CE05E1-F2EC-4321-A426-60D1261ED34B}
  
  :Commands
  [purity]
  [emptytemp]
  [EMPTYFLASH]
  [Reboot]
  

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done

Next,

Download ComboFix here :

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you don't know how to disable them then just continue on.
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.

[Henry1st]

Hi,

good so far, run fix, rebooted. Downloaded and copied ComboFix across from networked laptop (work) to infecetd laptop (personal).

Got a bit unstuck with Microsoft Windows Recovery Console, the infected laptop is not networked (at work) so my techy colleague who was helping me decided to press no. I was in a meeting so I missed that bit. He saved the log, see below.

We also uninstalled current antivirus software, as disabling didn't seem to work.

Q? should I attempt to obtain XP console disk, or take laptop home get it networked and then run the combofix again?

log from ComboFix

ComboFix 10-11-07.A2 - Hiromi 09/11/2010 11:06:27.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.932.81.1033.18.503.99 [GMT 0:00]
Running from: c:\documents and settings\Hiromi\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Hiromi\Application Data\Install.dat
c:\documents and settings\Hiromi\delself.bat
c:\documents and settings\Hiromi\oashdihasidhasuidhiasdhiashdiuasdhasd
c:\documents and settings\LocalService\Cookies\bogy.sys
c:\documents and settings\LocalService\Cookies\cynivyx.lib
c:\documents and settings\LocalService\Cookies\ebetehyq.exe
c:\documents and settings\LocalService\Cookies\emidopu.dat
c:\documents and settings\LocalService\Cookies\ezyqenify.pif
c:\documents and settings\LocalService\Cookies\heniro.dat
c:\documents and settings\LocalService\Cookies\imomeqybel.dl
c:\documents and settings\LocalService\Cookies\kurubabur.bat
c:\documents and settings\LocalService\Cookies\kynolyvipo.scr
c:\documents and settings\LocalService\Cookies\malenejilo.bat
c:\documents and settings\LocalService\Cookies\ohoqino.sys
c:\documents and settings\LocalService\Cookies\orivobesi.sys
c:\documents and settings\LocalService\Cookies\osegy.db
c:\documents and settings\LocalService\Cookies\pyjanetobo.inf
c:\documents and settings\LocalService\Cookies\tywojy.reg
c:\documents and settings\LocalService\Cookies\ujehyti.scr
c:\documents and settings\LocalService\Cookies\usipiqos.com
c:\documents and settings\LocalService\Cookies\yjuwa.bat
c:\documents and settings\LocalService\Cookies\yvamuwy.dl
c:\documents and settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd
c:\windows\alyjaj.scr
c:\windows\ecuxym.scr
c:\windows\esyd.scr
c:\windows\iwybytop._sy
c:\windows\mamel.scr
c:\windows\mepogi.scr
c:\windows\odejudines._sy
c:\windows\paciko._sy
c:\windows\system32\nvs2.inf
c:\windows\tinece._sy
c:\windows\unyrowygo.scr
c:\windows\zekomepij._sy

.
((((((((((((((((((((((((( Files Created from 2010-10-09 to 2010-11-09 )))))))))))))))))))))))))))))))
.

2010-11-09 10:36 . 2010-11-09 10:36 -------- d-----w- C:\_OTL
2010-11-07 22:12 . 2010-11-07 22:12 -------- d-----w- c:\documents and settings\Hiromi\Application Data\Malwarebytes
2010-11-07 20:40 . 2010-11-07 20:40 -------- d-----w- c:\documents and settings\Administrator
2010-11-05 08:19 . 2010-11-05 08:19 -------- d-----w- c:\documents and settings\Hiromi\Application Data\SUPERAntiSpyware.com
2010-11-05 08:19 . 2010-11-05 08:19 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-11-05 08:18 . 2010-11-07 22:42 -------- d-----w- C:\stdtsa
2010-11-03 22:11 . 2010-11-03 22:11 -------- d-----w- c:\program files\ESET
2010-11-03 21:51 . 2010-04-29 15:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-03 21:51 . 2010-11-03 21:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-11-03 21:51 . 2010-11-07 22:12 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-11-03 21:51 . 2010-04-29 15:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-03 15:12 . 2010-11-03 15:12 -------- d-----w- C:\1e0e14bc753929262bb0e66ca33db2
2010-10-14 10:41 . 2010-09-18 06:53 974848 ------w- c:\windows\system32\dllcache\mfc42.dll
2010-10-14 10:41 . 2010-09-18 06:53 954368 ------w- c:\windows\system32\dllcache\mfc40.dll
2010-10-14 10:41 . 2010-09-18 06:53 953856 ------w- c:\windows\system32\dllcache\mfc40u.dll
2010-10-14 10:40 . 2010-08-23 16:12 617472 ------w- c:\windows\system32\dllcache\comctl32.dll
2010-10-12 20:22 . 2010-10-12 20:22 -------- d-----w- c:\documents and settings\Hiromi\Local Settings\Application Data\PackageAware

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-02 20:18 . 2010-07-28 21:50 95568 ----a-w- c:\windows\system32\vetredir.dll
2010-11-02 20:18 . 2010-07-28 21:50 128336 ----a-w- c:\windows\system32\isafeif.dll
2010-09-18 11:23 . 2004-08-10 11:51 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2004-08-10 11:51 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2004-08-10 11:51 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2004-08-10 11:51 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-15 21:24 . 2010-09-15 21:24 1409 ----a-w- c:\windows\QTFont.for
2010-09-09 13:38 . 2004-08-10 11:51 832512 ----a-w- c:\windows\system32\wininet.dll
2010-09-09 13:38 . 2004-08-10 11:51 1830912 ----a-w- c:\windows\system32\inetcpl.cpl
2010-09-09 13:38 . 2004-08-10 11:51 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-09-09 13:38 . 2004-08-10 11:50 17408 ----a-w- c:\windows\system32\corpol.dll
2010-09-08 15:57 . 2004-08-10 11:51 389120 ----a-w- c:\windows\system32\html.iec
2010-09-01 11:51 . 2004-08-10 11:50 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-08-31 13:42 . 2004-08-10 11:51 1852800 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 08:02 . 2004-08-10 11:51 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:57 . 2004-08-10 11:51 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-26 13:39 . 2004-08-10 11:51 357248 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-26 12:52 . 2009-04-16 20:21 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2010-08-23 16:12 . 2004-08-10 11:50 617472 ----a-w- c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2004-08-10 11:51 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-16 08:45 . 2004-08-10 11:51 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-07-28 21:15 . 2010-07-28 21:15 14646912 -c--a-w- c:\program files\uk_pct_ca_en_UKDef2010_trial.exe
2010-07-28 20:54 . 2010-07-28 20:54 1341176 -c--a-w- c:\program files\am_ca_en.exe
2010-05-02 20:53 . 2010-05-02 20:52 3382520 -c--a-w- c:\program files\ccsetup231.exe
2010-04-22 21:15 . 2010-04-22 21:13 3249328 -c--a-w- c:\program files\VirginMediaHUB-S.exe
2009-06-02 21:26 . 2009-06-02 21:26 4909440 -c--a-w- c:\program files\Silverlight.2.0.exe
2008-07-27 14:58 . 2008-07-27 14:45 103893576 -c--a-w- c:\program files\issdm_en_32.exe
2008-07-20 21:03 . 2008-07-20 20:58 19153264 -c--a-w- c:\program files\aaw2008.exe
2009-10-31 11:55 . 2006-12-07 00:47 67688 -c--a-w- c:\program files\mozilla firefox\components\jar50.dll
2009-10-31 11:55 . 2006-12-07 00:47 54368 -c--a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2009-10-31 11:55 . 2007-02-11 17:22 34944 -c--a-w- c:\program files\mozilla firefox\components\myspell.dll
2009-10-31 11:55 . 2007-02-11 17:22 46712 -c--a-w- c:\program files\mozilla firefox\components\spellchk.dll
2009-10-31 11:55 . 2006-12-07 00:47 172136 -c--a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-09-13 155648]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-02-15 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-02-15 126976]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2005-03-04 606208]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2004-09-15 86016]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"Omnipage"="c:\program files\ScanSoft\OmniPageSE\opware32.exe" [2002-02-20 49152]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-05-31 122941]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
"VirginMediaHUB.exe"="c:\program files\Virgin Media\HUB\VirginMediaHUB.exe" [2009-12-14 4277488]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-08-10 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-01 421160]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-6-7 24576]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-09-07 15:08 110592 ----a-w- c:\program files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiMalware]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Virgin Media\\HUB\\ServicepointService.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 ServicepointService;ServicepointService;c:\program files\Virgin Media\HUB\ServicepointService.exe [22/04/2010 21:19 668912]
S1 SASDIFSV;SASDIFSV;\??\c:\docume~1\Hiromi\LOCALS~1\Temp\SAS_SelfExtract\SASDIFSV.SYS --> c:\docume~1\Hiromi\LOCALS~1\Temp\SAS_SelfExtract\SASDIFSV.SYS [?]
S1 SASKUTIL;SASKUTIL;\??\c:\docume~1\Hiromi\LOCALS~1\Temp\SAS_SelfExtract\SASKUTIL.SYS --> c:\docume~1\Hiromi\LOCALS~1\Temp\SAS_SelfExtract\SASKUTIL.SYS [?]
S3 k510bus;Sony Ericsson K510 Driver driver (WDM);c:\windows\system32\drivers\k510bus.sys [15/07/2006 23:19 58288]
S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;c:\windows\system32\drivers\k510mdfl.sys [15/07/2006 23:25 8336]
S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;c:\windows\system32\drivers\k510mdm.sys [15/07/2006 23:25 94064]
S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\k510mgmt.sys [15/07/2006 23:25 85408]
S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;c:\windows\system32\drivers\k510obex.sys [15/07/2006 23:25 83344]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [03/11/2010 21:51 38224]
S3 sea1bus;Sony Ericsson Device 0A1 driver (WDM);c:\windows\system32\drivers\sea1bus.sys [09/07/2009 21:47 61536]
.
Contents of the 'Scheduled Tasks' folder

2010-10-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 10:50]

2010-11-09 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-29 22:05]

2005-06-10 c:\windows\Tasks\ISP signup reminder 1.job
- c:\windows\system32\OOBE\oobebaln.exe [2004-08-10 00:12]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = <local>
uSearchAssistant = hxxp://www.google.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
DPF: {A9CF3378-D60E-40A8-927D-7EA0D5B0AA98} - hxxp://webalbum.bonusprint.com/ukipc01/downloads//ImageUploader6.cab
FF - ProfilePath - c:\documents and settings\Hiromi\Application Data\Mozilla\Firefox\Profiles\mw246t0a.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://en-GB.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-GB:official
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll
FF - component: c:\program files\Mozilla Firefox\extensions\[email protected]\components\qfaservices.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
.
- - - - ORPHANS REMOVED - - - -

AddRemove-accacei - c:\documents and settings\hiromi\local settings\application data\accacei.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-09 11:16
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(964)
c:\program files\Intel\Wireless\Bin\LgNotify.dll
.
Completion time: 2010-11-09 11:20:10
ComboFix-quarantined-files.txt 2010-11-09 11:20

Pre-Run: 15,899,271,168 bytes free
Post-Run: 15,849,877,504 bytes free

- - End Of File - - AD5EBFBF43E04A06D9ED23C901055A8D

[mitch8]

Hi,

It's fine that you don't have the Microsoft Windows Recovery Console installed. It's in case your computer crashes running ComboFix, which it didn't.

How is your computer running?

Please download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Next,

• Run OTL
• Under the Custom Scan box paste this in:

  
  %systemroot%\*.pif
  %PROGRAMFILES%\Common Files\*.*
  %systemroot%\system32\*.db
  %systemroot%\*._sy
  %systemroot%\*.scr
  C:\stdtsa\*.*
  

• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
• When the scan completes, it will open a notepad windows. Post OTL.Txt here.

[Henry1st]

Hi, my computer is running a bit slow.

I did have MalwareBytes which managed to download from the geekstogo Malware links, I have tried to run it a few times since and it general stops after 8 minutes with this error message.

MBAM has encountered a problem and needs to close.
Please tell MS about this problem
Send Error Report

So I press send error report, it says error report complete, and I press close and then goes back to the orginal error message, so I repeat and it gets stuck. I tried to open IE, but that is still not working, so I am guess it wouldn't reach MS as they done seem to like Firefox.

Latest attempt bombed out after 3 mins 38 secs, showing 1 infected object.

Trying to rerun MBAM, says its still running, but can't see it running in Windows Task Manager, going to restart and try again.

[mitch8]

Hi,

If you can't get it to run, skip to OTL.

[Henry1st]

Rerun MBAM, stopped on 6 mins 32 secs, can't really see what it was scanning. C:\WINDOWS\system32\vdmdl.

This time the dialogue box says DrWatson Postmortem Debugger has encountered a problem and needs to close.
Plesae tell MS etc, pressed don't send this time, returns to dialogue box, press don't send again and the hour glass just hangs :-(.

Restart and try again and see what happens this time.

Rerun MBAM, stopped on 6 mins 32 secs, can't really see what it was scanning. C:\WINDOWS\system32\vdmdl.

This time the dialogue box says DrWatson Postmortem Debugger has encountered a problem and needs to close.
Plesae tell MS etc, pressed don't send this time, returns to dialogue box, press don't send again and the hour glass just hangs :-(.

Restart and try again and see what happens this time.

rerun and can now see gets stuck on C:\WINDOWS\system32\vdmbg.dll.

Going to OTL.

Edited by Henry1st, 10 November 2010 - 04:54 PM.

[Henry1st]

OTL logfile created on: 10/11/2010 23:00:01 - Run 2
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Hiromi\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

503.00 Mb Total Physical Memory | 123.00 Mb Available Physical Memory | 24.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 74.00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 34.31 Gb Total Space | 14.60 Gb Free Space | 42.56% Space Free | Partition Type: NTFS

Computer Name: HENRY | User Name: Hiromi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/11/07 21:51:17 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Hiromi\Desktop\OTL.scr
PRC - [2010/10/27 06:13:43 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/08/13 11:58:56 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2009/12/14 10:26:02 | 000,668,912 | ---- | M] (Radialpoint Inc.) -- C:\Program Files\Virgin Media\HUB\ServicepointService.exe
PRC - [2009/12/14 10:25:56 | 004,277,488 | ---- | M] (Virgin Media) -- C:\Program Files\Virgin Media\HUB\VirginMediaHUB.exe
PRC - [2008/04/14 00:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/04/14 00:12:15 | 000,027,648 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\conime.exe
PRC - [2008/01/11 22:16:38 | 000,039,792 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
PRC - [2007/03/15 10:09:36 | 000,460,784 | ---- | M] (Gteko Ltd.) -- C:\Program Files\DellSupport\DSAgnt.exe
PRC - [2005/06/06 22:46:24 | 000,057,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
PRC - [2005/03/04 10:26:08 | 000,606,208 | ---- | M] () -- C:\Program Files\Dell\QuickSet\quickset.exe
PRC - [2004/10/30 13:59:54 | 000,385,024 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
PRC - [2004/09/15 00:01:00 | 000,086,016 | ---- | M] () -- C:\Program Files\Dell\Media Experience\DMXLauncher.exe
PRC - [2004/09/13 15:33:20 | 000,155,648 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\Apoint.exe
PRC - [2004/09/07 15:12:32 | 000,225,353 | ---- | M] (Intel® Corporation) -- C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe
PRC - [2004/09/07 15:08:02 | 000,389,120 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe
PRC - [2004/09/07 15:05:10 | 000,360,521 | ---- | M] (Intel Corporation ) -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
PRC - [2004/09/07 15:03:40 | 000,245,760 | ---- | M] (Intel) -- C:\Program Files\Intel\Wireless\Bin\1XConfig.exe
PRC - [2004/09/07 15:02:40 | 000,086,016 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
PRC - [2004/09/07 15:02:04 | 000,139,264 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
PRC - [2004/08/19 13:40:08 | 000,045,056 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint\ApntEx.exe
PRC - [2004/07/27 15:50:18 | 000,081,920 | ---- | M] (InstallShield Software Corporation) -- C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
PRC - [2003/10/29 02:06:00 | 000,024,576 | ---- | M] (BVRP Software) -- C:\Program Files\Digital Line Detect\DLG.exe
PRC - [2002/02/20 19:01:32 | 000,049,152 | ---- | M] (ScanSoft, Inc) -- C:\Program Files\ScanSoft\OmniPageSE\opware32.exe


========== Modules (SafeList) ==========

MOD - [2010/11/07 21:51:17 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Hiromi\Desktop\OTL.scr
MOD - [2010/08/23 16:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2004/12/23 14:47:36 | 000,069,632 | ---- | M] () -- C:\Program Files\Dell\QuickSet\dadkeyb.dll
MOD - [2002/02/27 11:16:50 | 000,167,936 | ---- | M] (ScanSoft, Inc) -- C:\Program Files\ScanSoft\OmniPageSE\ophook32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010/08/13 11:58:56 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009/12/14 10:26:02 | 000,668,912 | ---- | M] (Radialpoint Inc.) [Auto | Running] -- C:\Program Files\Virgin Media\HUB\ServicepointService.exe -- (ServicepointService)
SRV - [2007/03/07 14:47:46 | 000,076,848 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)
SRV - [2005/11/14 00:06:04 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2004/09/07 15:12:32 | 000,225,353 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe -- (WLANKEEPER)
SRV - [2004/09/07 15:05:10 | 000,360,521 | ---- | M] (Intel Corporation ) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe -- (S24EventMonitor)
SRV - [2004/09/07 15:02:40 | 000,086,016 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe -- (EvtEng)
SRV - [2004/09/07 15:02:04 | 000,139,264 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe -- (RegSrvc)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\Hiromi\LOCALS~1\Temp\catchme.sys -- (catchme)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\DRIVERS\agp440.sys -- (agp440)
DRV - [2010/05/10 18:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Documents and Settings\Hiromi\Local Settings\temp\SAS_SelfExtract\saskutil.sys -- (SASKUTIL)
DRV - [2010/04/29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2010/02/17 18:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Documents and Settings\Hiromi\Local Settings\temp\SAS_SelfExtract\sasdifsv.sys -- (SASDIFSV)
DRV - [2008/04/13 18:36:39 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)
DRV - [2008/04/13 18:36:39 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)
DRV - [2007/02/25 11:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\dsunidrv.sys -- (dsunidrv)
DRV - [2007/01/04 11:01:08 | 000,061,536 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sea1bus.sys -- (sea1bus) Sony Ericsson Device 0A1 driver (WDM)
DRV - [2006/10/05 15:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Running] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
DRV - [2006/07/15 23:25:52 | 000,094,064 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k510mdm.sys -- (k510mdm)
DRV - [2006/07/15 23:25:52 | 000,085,408 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k510mgmt.sys -- (k510mgmt) Sony Ericsson K510 USB WMC Device Management Drivers (WDM)
DRV - [2006/07/15 23:25:52 | 000,083,344 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k510obex.sys -- (k510obex)
DRV - [2006/07/15 23:25:52 | 000,008,336 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k510mdfl.sys -- (k510mdfl)
DRV - [2006/02/17 19:34:10 | 000,058,288 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k510bus.sys -- (k510bus) Sony Ericsson K510 Driver driver (WDM)
DRV - [2005/05/31 04:33:00 | 000,100,605 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsnudfa.sys -- (tfsnudfa)
DRV - [2005/05/31 04:33:00 | 000,098,716 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsnudf.sys -- (tfsnudf)
DRV - [2005/05/31 04:33:00 | 000,086,876 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsnifs.sys -- (tfsnifs)
DRV - [2005/05/31 04:33:00 | 000,034,845 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsncofs.sys -- (tfsncofs)
DRV - [2005/05/31 04:33:00 | 000,025,725 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsnboio.sys -- (tfsnboio)
DRV - [2005/05/31 04:33:00 | 000,015,069 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsnopio.sys -- (tfsnopio)
DRV - [2005/05/31 04:33:00 | 000,006,365 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsnpool.sys -- (tfsnpool)
DRV - [2005/05/31 04:33:00 | 000,004,125 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsndrct.sys -- (tfsndrct)
DRV - [2005/05/31 04:33:00 | 000,002,241 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\dla\tfsndres.sys -- (tfsndres)
DRV - [2005/05/13 09:37:28 | 000,005,627 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\sscdbhk5.sys -- (sscdbhk5)
DRV - [2005/05/13 09:37:20 | 000,023,545 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\ssrtln.sys -- (ssrtln)
DRV - [2005/04/22 02:22:00 | 000,088,352 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\drvmcdb.sys -- (drvmcdb)
DRV - [2005/04/21 01:56:00 | 000,040,544 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\drvnddm.sys -- (drvnddm)
DRV - [2004/11/16 15:03:52 | 000,108,791 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2004/10/21 19:56:04 | 003,210,496 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51) Intel®
DRV - [2004/09/15 23:53:12 | 000,271,704 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\STAC97.sys -- (STAC97)
DRV - [2004/08/31 07:53:04 | 000,011,354 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
DRV - [2004/08/18 13:53:54 | 000,016,128 | ---- | M] (Dell Inc) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS -- (APPDRV)
DRV - [2004/08/12 07:44:04 | 000,234,496 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\iwca.sys -- (IWCA)
DRV - [2004/08/04 04:00:00 | 000,012,160 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\fsvga.sys -- (FsVga)
DRV - [2004/08/03 21:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2004/06/17 19:57:02 | 000,200,064 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWICH.sys -- (HSFHWICH)
DRV - [2004/06/17 19:55:38 | 000,685,056 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2004/06/17 19:55:04 | 001,041,536 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
DRV - [2004/05/26 19:18:18 | 000,044,928 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2004/02/13 15:46:00 | 000,017,153 | ---- | M] (Dell Inc) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\omci.sys -- (omci)
DRV - [2001/08/17 13:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)
DRV - [2001/08/17 13:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)
DRV - [2001/08/17 13:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)
DRV - [2001/08/17 13:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)
DRV - [2001/08/17 13:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)
DRV - [2001/08/17 12:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)
DRV - [2001/08/17 12:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)
DRV - [2001/08/17 12:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)
DRV - [2001/08/17 12:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)
DRV - [2001/08/17 12:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)
DRV - [2001/08/17 12:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)
DRV - [2001/08/17 12:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)
DRV - [2001/08/17 12:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)
DRV - [2001/08/17 12:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)
DRV - [2001/08/17 12:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com
IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.co...-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://en-GB.start.m...en-GB:official"

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008/06/27 21:00:28 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.20\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/11/09 21:41:40 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.20\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/11/09 21:41:40 | 000,000,000 | ---D | M]

[2010/11/09 21:35:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hiromi\Application Data\Mozilla\Extensions
[2006/12/07 00:51:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hiromi\Application Data\Mozilla\Firefox\Profiles\mw246t0a.default\extensions
[2010/11/10 21:33:32 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2006/12/07 00:48:13 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010/05/02 22:23:21 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/10/05 21:03:13 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/11/09 21:52:54 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\[email protected]
[2010/11/09 21:42:32 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions\[email protected]
[2010/07/17 04:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/10/27 05:24:34 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/10/27 05:24:34 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/10/27 05:24:34 | 000,000,769 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/10/27 05:24:34 | 000,001,135 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2010/11/09 11:15:56 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe ()
O4 - HKLM..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe ()
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe (ScanSoft, Inc)
O4 - HKLM..\Run: [VirginMediaHUB.exe] C:\Program Files\Virgin Media\HUB\VirginMediaHUB.exe (Virgin Media)
O4 - HKCU..\Run: [DellSupport] C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe (BVRP Software)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (Intertrust Technologies, Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {A9CF3378-D60E-40A8-927D-7EA0D5B0AA98} http://webalbum.bonu...geUploader6.cab (Bonusprint Image Uploader Version 6.x Control)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O20 - Winlogon\Notify\IntelWireless: DllName - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 12:04:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/11/10 21:41:13 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/11/10 21:41:11 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/11/10 21:41:11 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/11/10 21:38:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hiromi\My Documents\Downloads
[2010/11/09 21:36:58 | 008,390,880 | ---- | C] (Mozilla) -- C:\Documents and Settings\Hiromi\Desktop\Firefox Setup 3.6.12.exe
[2010/11/09 10:57:27 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/11/09 10:57:27 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/11/09 10:57:27 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/11/09 10:57:27 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/11/09 10:57:03 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/11/09 10:42:59 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/11/09 10:36:04 | 000,000,000 | ---D | C] -- C:\_OTL
[2010/11/07 22:12:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hiromi\Application Data\Malwarebytes
[2010/11/07 22:10:52 | 006,153,352 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Hiromi\Desktop\mbam-setup-1.46.exe
[2010/11/07 21:51:11 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Hiromi\Desktop\OTL.scr
[2010/11/07 21:50:52 | 000,258,560 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Hiromi\Desktop\OTH.scr
[2010/11/05 08:19:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hiromi\Application Data\SUPERAntiSpyware.com
[2010/11/05 08:19:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2010/11/05 08:18:30 | 000,000,000 | ---D | C] -- C:\stdtsa
[2010/11/03 22:11:45 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2010/11/03 21:51:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/11/03 21:49:31 | 006,153,384 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Hiromi\Desktop\mbam-setup.exe
[2010/11/03 15:12:08 | 000,000,000 | ---D | C] -- C:\1e0e14bc753929262bb0e66ca33db2
[2010/11/03 15:11:06 | 013,063,352 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\Hiromi\Desktop\mssefullinstall-x86fre-en-us-xp.exe
[2010/10/14 10:41:26 | 000,974,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mfc42.dll
[2010/10/14 10:41:26 | 000,954,368 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mfc40.dll
[2010/10/14 10:41:26 | 000,953,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mfc40u.dll
[2010/10/14 10:40:35 | 000,617,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\comctl32.dll
[2010/10/12 20:22:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hiromi\Local Settings\Application Data\PackageAware
[2010/07/28 21:15:04 | 014,646,912 | ---- | C] (CA ) -- C:\Program Files\uk_pct_ca_en_UKDef2010_trial.exe
[2010/07/28 20:54:03 | 001,341,176 | ---- | C] (CA) -- C:\Program Files\am_ca_en.exe
[2010/05/02 20:52:14 | 003,382,520 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup231.exe
[2010/04/22 21:13:32 | 003,249,328 | ---- | C] (Virgin Media) -- C:\Program Files\VirginMediaHUB-S.exe
[2009/06/02 21:26:15 | 004,909,440 | ---- | C] (Microsoft Corporation) -- C:\Program Files\Silverlight.2.0.exe
[2008/07/27 14:45:00 | 103,893,576 | ---- | C] (CA, Inc. ) -- C:\Program Files\issdm_en_32.exe

========== Files - Modified Within 30 Days ==========

[2010/11/10 22:56:38 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/11/10 22:56:36 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2010/11/10 22:56:20 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/11/10 22:56:18 | 527,892,480 | -HS- | M] () -- C:\hiberfil.sys
[2010/11/10 21:48:31 | 003,072,054 | ---- | M] () -- C:\Documents and Settings\Hiromi\Desktop\MBAM error.bmp
[2010/11/10 21:41:16 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/11/10 21:39:17 | 006,153,352 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Hiromi\Desktop\mbam-setup-1.46.exe
[2010/11/09 21:41:44 | 000,001,620 | ---- | M] () -- C:\Documents and Settings\Hiromi\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/11/09 21:41:44 | 000,001,602 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/11/09 21:38:48 | 008,390,880 | ---- | M] (Mozilla) -- C:\Documents and Settings\Hiromi\Desktop\Firefox Setup 3.6.12.exe
[2010/11/09 11:15:56 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/11/09 10:40:42 | 003,906,043 | R--- | M] () -- C:\Documents and Settings\Hiromi\Desktop\ComboFix.exe
[2010/11/08 01:20:24 | 000,089,088 | ---- | M] () -- C:\WINDOWS\MBR.exe
[2010/11/07 21:51:17 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Hiromi\Desktop\OTL.scr
[2010/11/07 21:50:55 | 000,258,560 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Hiromi\Desktop\OTH.scr
[2010/11/07 21:08:40 | 000,242,328 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/11/03 22:10:12 | 002,672,312 | ---- | M] () -- C:\Documents and Settings\Hiromi\Desktop\esetsmartinstaller_enu.exe
[2010/11/03 22:06:41 | 011,802,408 | ---- | M] () -- C:\Documents and Settings\Hiromi\Desktop\SAS_16832.COM
[2010/11/03 21:58:01 | 011,802,408 | ---- | M] () -- C:\Documents and Settings\Hiromi\Desktop\SAS_631F528.COM
[2010/11/03 21:52:42 | 000,364,032 | ---- | M] () -- C:\Documents and Settings\Hiromi\Desktop\rkill.com
[2010/11/03 21:50:15 | 006,153,384 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Hiromi\Desktop\mbam-setup.exe
[2010/11/03 20:38:43 | 076,859,232 | ---- | M] () -- C:\Documents and Settings\Hiromi\Desktop\std20sasfx.exe
[2010/11/03 15:10:59 | 013,063,352 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Hiromi\Desktop\mssefullinstall-x86fre-en-us-xp.exe
[2010/11/02 20:18:41 | 000,128,336 | ---- | M] (Computer Associates International, Inc.) -- C:\WINDOWS\System32\isafeif.dll
[2010/11/02 20:18:41 | 000,095,568 | ---- | M] (Computer Associates International, Inc.) -- C:\WINDOWS\System32\vetredir.dll
[2010/11/01 21:38:30 | 000,384,930 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/11/01 21:38:30 | 000,054,614 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/10/21 19:09:02 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/10/15 02:15:16 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/10/12 20:26:24 | 000,000,143 | ---- | M] () -- C:\Documents and Settings\Hiromi\Desktop\Continue iMesh installation.url

========== Files Created - No Company Name ==========

[2010/11/10 21:48:30 | 003,072,054 | ---- | C] () -- C:\Documents and Settings\Hiromi\Desktop\MBAM error.bmp
[2010/11/10 21:41:16 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/11/10 21:21:31 | 527,892,480 | -HS- | C] () -- C:\hiberfil.sys
[2010/11/09 21:41:44 | 000,001,602 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/11/09 10:57:27 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/11/09 10:57:27 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/11/09 10:57:27 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/11/09 10:57:27 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/11/09 10:57:27 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/11/09 10:42:28 | 003,906,043 | R--- | C] () -- C:\Documents and Settings\Hiromi\Desktop\ComboFix.exe
[2010/11/03 22:08:53 | 002,672,312 | ---- | C] () -- C:\Documents and Settings\Hiromi\Desktop\esetsmartinstaller_enu.exe
[2010/11/03 22:02:39 | 011,802,408 | ---- | C] () -- C:\Documents and Settings\Hiromi\Desktop\SAS_16832.COM
[2010/11/03 21:53:55 | 011,802,408 | ---- | C] () -- C:\Documents and Settings\Hiromi\Desktop\SAS_631F528.COM
[2010/11/03 21:52:52 | 000,364,032 | ---- | C] () -- C:\Documents and Settings\Hiromi\Desktop\rkill.com
[2010/11/03 20:36:51 | 076,859,232 | ---- | C] () -- C:\Documents and Settings\Hiromi\Desktop\std20sasfx.exe
[2010/10/12 20:26:24 | 000,000,143 | ---- | C] () -- C:\Documents and Settings\Hiromi\Desktop\Continue iMesh installation.url
[2009/08/22 21:04:53 | 000,003,387 | ---- | C] () -- C:\WINDOWS\DNAPrinters.ini
[2008/07/27 21:27:58 | 000,000,393 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2008/07/20 20:58:40 | 019,153,264 | ---- | C] () -- C:\Program Files\aaw2008.exe
[2007/12/17 14:46:36 | 000,001,751 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/12/10 02:18:00 | 000,000,129 | ---- | C] () -- C:\Documents and Settings\Hiromi\Local Settings\Application Data\fusioncache.dat
[2006/11/26 10:55:20 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2006/07/15 23:46:02 | 000,000,000 | ---- | C] () -- C:\WINDOWS\mngui.INI
[2005/08/20 14:47:03 | 000,000,525 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2005/07/03 11:01:21 | 000,000,432 | ---- | C] () -- C:\WINDOWS\dellstat.ini
[2005/07/03 11:00:48 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\dlbcvs.dll
[2005/07/03 11:00:44 | 000,000,373 | ---- | C] () -- C:\WINDOWS\System32\dlbccoin.ini
[2005/06/14 21:30:02 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/06/10 20:46:52 | 000,037,888 | ---- | C] () -- C:\Documents and Settings\Hiromi\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/06/07 19:06:19 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005/06/07 18:56:38 | 000,000,405 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2005/06/07 18:43:59 | 000,000,004 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare
[2005/06/07 18:17:30 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\stac97co.dll
[2005/06/07 18:16:46 | 000,000,372 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005/05/12 08:25:24 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2004/08/12 07:44:10 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\iwca.dll
[2004/08/10 12:12:05 | 000,000,831 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/08/10 12:01:18 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/08/10 11:57:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2003/01/07 14:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

========== Custom Scans ==========


< %systemroot%\*.pif >
[2009/09/30 08:08:29 | 000,019,122 | ---- | M] () -- C:\WINDOWS\ibyxufixu.pif
[2009/09/30 08:08:30 | 000,015,808 | ---- | M] () -- C:\WINDOWS\norejyrez.pif
[2009/09/18 20:02:31 | 000,010,076 | ---- | M] () -- C:\WINDOWS\owidarim.pif
[2009/09/30 08:19:28 | 000,019,454 | ---- | M] () -- C:\WINDOWS\pugimahim.pif
[2009/09/18 20:02:24 | 000,012,842 | ---- | M] () -- C:\WINDOWS\rabe.pif
[2009/08/20 20:46:08 | 000,017,717 | ---- | M] () -- C:\WINDOWS\tedonanac.pif
[2009/09/18 20:02:23 | 000,011,586 | ---- | M] () -- C:\WINDOWS\ytaz.pif
[2004/08/04 04:00:00 | 000,000,707 | ---- | M] () -- C:\WINDOWS\_default.pif

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\system32\*.db >
[2009/09/30 07:55:11 | 000,012,053 | ---- | M] () -- C:\WINDOWS\system32\iwenepal.db
[2009/09/18 19:57:13 | 000,016,079 | ---- | M] () -- C:\WINDOWS\system32\kizolaguh.db
[2006/11/28 22:04:13 | 000,000,121 | ---- | M] () -- C:\WINDOWS\system32\SDMonRemoveDB.db
[2006/11/28 22:05:07 | 000,000,139 | ---- | M] () -- C:\WINDOWS\system32\SDRemoveDB.db
[2009/09/18 20:02:23 | 000,016,364 | ---- | M] () -- C:\WINDOWS\system32\usemytox.db

< %systemroot%\*._sy >

< %systemroot%\*.scr >

< C:\stdtsa\*.* >
[2004/05/07 13:25:14 | 001,822,520 | ---- | M] (Microsoft Corporation) -- C:\stdtsa\instmsiW.exe
[2007/10/22 20:06:48 | 000,003,189 | ---- | M] () -- C:\stdtsa\readesavxpsa.txt
[2010/08/18 21:26:01 | 000,049,979 | ---- | M] () -- C:\stdtsa\readsavxp_76_eng.html
[2008/11/27 14:16:34 | 000,249,856 | ---- | M] (Sophos Plc) -- C:\stdtsa\SavResChs.dll
[2008/11/27 14:16:33 | 000,327,680 | ---- | M] (Sophos Plc) -- C:\stdtsa\SavResCht.dll
[2008/11/27 14:16:32 | 000,204,800 | ---- | M] (Sophos Plc) -- C:\stdtsa\SavResDeu.dll
[2008/11/27 14:16:35 | 000,155,648 | ---- | M] (Sophos Plc) -- C:\stdtsa\SavResEng.dll
[2008/11/27 14:16:31 | 000,155,648 | ---- | M] (Sophos Plc) -- C:\stdtsa\SavResEsp.dll
[2008/11/27 14:16:30 | 000,188,416 | ---- | M] (Sophos Plc) -- C:\stdtsa\SavResFra.dll
[2008/11/27 14:16:29 | 000,143,360 | ---- | M] (Sophos Plc) -- C:\stdtsa\SavResIt.dll
[2008/11/27 14:16:28 | 000,339,968 | ---- | M] (Sophos Plc) -- C:\stdtsa\SavResJap.dll
[2008/11/27 14:17:02 | 000,252,984 | ---- | M] (Sophos Plc) -- C:\stdtsa\Setup.exe

< End of report >

[mitch8]

Hi,

Did you install Microsoft Security Essentials? If so, can you run a quick scan?

Do you know what iMesh is? Do you know what this file is std20sasfx.exe?

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
  [2009/09/30 08:08:29 | 000,019,122 | ---- | M] () -- C:\WINDOWS\ibyxufixu.pif
  [2009/09/30 08:08:30 | 000,015,808 | ---- | M] () -- C:\WINDOWS\norejyrez.pif
  [2009/09/18 20:02:31 | 000,010,076 | ---- | M] () -- C:\WINDOWS\owidarim.pif
  [2009/09/30 08:19:28 | 000,019,454 | ---- | M] () -- C:\WINDOWS\pugimahim.pif
  [2009/09/18 20:02:24 | 000,012,842 | ---- | M] () -- C:\WINDOWS\rabe.pif
  [2009/08/20 20:46:08 | 000,017,717 | ---- | M] () -- C:\WINDOWS\tedonanac.pif
  [2009/09/18 20:02:23 | 000,011,586 | ---- | M] () -- C:\WINDOWS\ytaz.pif
  [2009/09/30 07:55:11 | 000,012,053 | ---- | M] () -- C:\WINDOWS\system32\iwenepal.db
  [2009/09/18 19:57:13 | 000,016,079 | ---- | M] () -- C:\WINDOWS\system32\kizolaguh.db
  [2009/09/18 20:02:23 | 000,016,364 | ---- | M] () -- C:\WINDOWS\system32\usemytox.db
  
  :Services
  
  :Reg
  
  :Files
  
  :Commands
  [purity]
  [emptytemp]
  [EMPTYFLASH]
  [Reboot]
  

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done

Next,

Download GMER from Here. Note the file's name and save it to your root folder, such as C:\.

• Disconnect from the Internet and close all running programs.
• Temporarily disable any real-time active protection so your security program drivers will not conflict with this file.
• Click on this link to see a list of programs that should be disabled.
• Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator")
• Allow the driver to load if asked.
• You may be prompted to scan immediately if it detects rootkit activity.
• If you are prompted to scan your system click "No", save the log and post back the results.
• If not prompted, click the "Rootkit/Malware" tab.
• On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked.
• Select all drives that are connected to your system to be scanned.
• Click the Scan button to begin. (Please be patient as it can take some time to complete)
• When the scan is finished, click Save to save the scan results to your Desktop.
• Save the file as Results.log and copy/paste the contents in your next reply.
• Exit the program and re-enable all active protection when done.

[Henry1st]

Hi,

downloaded Microsoft Security Essentials, run scan, no threats reported.

iMesh is music & video download site.
std20sasfx.exe - I believe this is Sophos malware scanner / removal software.

I can remove both of these.

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2010-11-12 14:41:14
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 TOSHIBA_MK4026GAX rev.PA102D
Running: p12k7c02.exe; Driver: C:\DOCUME~1\Hiromi\LOCALS~1\Temp\fxtdipob.sys


---- Devices - GMER 1.0.15 ----

Device \FileSystem\Fastfat \Fat F7249D20

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Classes\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\Indeo
Reg HKLM\SOFTWARE\Classes\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\Indeo@FriendlyName Indeo? video 5.10 Compression Filter
Reg HKLM\SOFTWARE\Classes\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\Indeo@CLSID {1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}
Reg HKLM\SOFTWARE\Classes\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\Indeo@FilterData 0x02 0x00 0x00 0x00 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\Indeo@EncoderType 1

---- EOF - GMER 1.0.15 ----

[mitch8]

Hi,

How is your computer running?

Can you try uninstalling Malwarebytes' Anti-Malware and try installing it again? Hopefully you can get a quick scan with it. The download location is here.

Next,

Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:

• Close any open programs
• Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.

3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.

• Once the update is complete, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, adware, dialers, and other riskware
  • Archives
  • E-mail databases
• Click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View report... at the bottom.
• Click the Save report... button.
  
  
  
  
• Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply

[Henry1st]

Hi,

my computer is generally running OK, I did see a dialogue box / error message about some missing files, so wondered if I should run a registry cleanse and fix, what do you think?

Malwarebytes - removed, downloaded, ran for 3-4 mins and failed again, same problem. Tried again, the same.

Kaspersky Online Scanner - first attempt last night was going well, the update appeared to have finished and then returned a fail message, unfortunately I did not report the error mesaage, gave up and went to bed.
Tried again tonight, double checked MSE was turned off, I stopped it as a Java dialogue box came up about updating, left it for a few minutes but nothing appeared to happen. Tried Kaspersky OS again, first issue: Security Warning: the applications Digital Signature has an error. Do you want to run the application.
Name: jReport
Publisher: Kaspersky Lab
From: http//www.kaspersky.com

to which I pressed Run.

Program download and update is successful, but the Database update fails.

Dialogue box: Window EI: Update has failed.
The program could not be started. Please close the window of Kaspersky Online Scanner 7.0 and start the program again from the web site Kaspersky Lab.
Succesful updating of Kaspersky Online Scanner 7.0 and scanning of your computer requires uninterrupted Internet connection. Please make sure that the Internet conection is established [ERROR: License has expired]

I did read on the Kaspersky OS help: starting & updating the program, there were several references to Java, so I wondered if I should try a Java update as a Java update appeared, and then appeared to do nothing ??

I also looked up kaspersky online scanner on google, and wondered if I should try the Ineterent Security 2011 or Antivirus 2011 Free Trial (http://www.kaspersky...uk/virusscanner) ?

I'm in your capable hands, and thank you for your time and effort so far.

R

Edited by Henry1st, 14 November 2010 - 05:22 PM.

[mitch8]

Hi,

I wouldn't download a registry cleaner they do more harm than good, unless you know what your are doing. What does the popup say is missing? Is it always the same?

Try running the offline version of kaspersky below, the online version sometimes doesn't want to run.

Save these instructions so you can have access to them while in Safe Mode.

Please click here to download AVP Tool by Kaspersky.

• Save it to your desktop.
• Reboot your computer into SafeMode.
  

  You can do this by restarting your computer and continually tapping the F8 key until a menu appears.
  Use your up arrow key to highlight SafeMode then hit enter.

• Double click the setup file to run it.
• Click Next to continue.
• Accept the Licence agreement and click on next
• It will by default install it to your desktop folder.Click Next.
• It will then open a box There will be a tab that says Automatic scan.
• Under Automatic scan make sure these are checked.

• Hidden Startup Objects
• System Memory
• Disk Boot Sectors.
• My Computer.
• Also any other drives (Removable that you may have)

Leave the rest of the settings as they appear as default.

• Then click on Scan at the to right hand Corner.
• It will automatically Neutralize any objects found.
• If some objects are left un-neutralized then click the button that says Neutralize all
• If it says it cannot be Neutralized then choose The delete option when prompted.
• After that is done click on the reports button at the bottom and save it to file name it Kas.
• Save it somewhere convenient like your desktop and just post only the detected Virus\malware in the report it will be at the very top under Detected post those results in your next reply.
  
  

  Note: This tool will self uninstall when you close it so please save the log before closing it.

[Henry1st]

Hi,

re pop up, sorry I didn't record what it said and I can't remember, it has occurred this time, but I will let you know if it happens again.

the results look promising.

Autoscan: completed 3 hours ago (events: 8, objects: 356229, time: 11:12:00)
16/11/2010 09:49:25 Task completed
16/11/2010 09:31:33 Deleted: Trojan.Win32.Hrup.ey C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP298\A0085048.exe
16/11/2010 06:57:41 Detected: Trojan.Win32.Hrup.ey C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP298\A0085048.exe
16/11/2010 06:57:26 Detected: HEUR:Trojan.Win32.Generic C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP298\A0085049.exe
16/11/2010 06:23:18 Deleted: Trojan.Win32.Hrup.ey C:\_OTL\MovedFiles\11092010_103604\C_Documents and Settings\Hiromi\Local Settings\Application Data\accacei.exe
15/11/2010 23:47:00 Detected: HEUR:Trojan.Win32.Generic C:\_OTL\MovedFiles\11092010_103604\C_Documents and Settings\Hiromi\Local Settings\Temp\rpjycltqb\traowabdlta.exe
15/11/2010 23:46:56 Detected: Trojan.Win32.Hrup.ey C:\_OTL\MovedFiles\11092010_103604\C_Documents and Settings\Hiromi\Local Settings\Application Data\accacei.exe
15/11/2010 22:37:24 Task started