Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Babylon search.

Started by Ste , Oct 27 2011 11:54 AM

  • Please log in to reply

#1
Ste
Posted 27 October 2011 - 11:54 AM

Ste

    Member

  • Member
  • PipPipPip
  • 240 posts
Hi, I have gone through all the procedures for removing the Babylon search but it is still here. I uninstalled the program disabled the add-on, found some entries in the registry and deleted those. I don't know where else to look. My original posts and responses are here-

http://www.geekstogo...view=getnewpost

I also downloaded OTL and noticed one mention-

O9 - Extra 'Tools' menuitem : Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - res://C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm File not found

Didn't think this would be so difficult hope you can help. Thanks.

Steve.
  • 0

Advertisements

#2
RKinner
Posted 27 October 2011 - 01:04 PM

RKinner

    Malware Expert

  • Expert
  • 24,624 posts
  • MVP
Please post your OTL log (and the Extras log if you got one).

Ron
  • 0

#3
Ste
Posted 27 October 2011 - 01:13 PM

Ste

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 240 posts
OTL logfile created on: 27/10/2011 11:02:05 - Run 3
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Administrator\Desktop\OTL
64bit-Windows Server 2003 Service Pack 2 (Version = 5.2.3790) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

8.00 Gb Total Physical Memory | 6.89 Gb Available Physical Memory | 86.18% Memory free
11.57 Gb Paging File | 10.67 Gb Available in Paging File | 92.19% Paging File free
Paging file location(s): c:\pagefile.sys 4090 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 149.04 Gb Total Space | 89.58 Gb Free Space | 60.10% Space Free | Partition Type: NTFS
Drive E: | 677.60 Gb Total Space | 521.25 Gb Free Space | 76.93% Space Free | Partition Type: NTFS
Drive G: | 97.66 Gb Total Space | 45.66 Gb Free Space | 46.75% Space Free | Partition Type: NTFS
Drive H: | 97.65 Gb Total Space | 11.04 Gb Free Space | 11.30% Space Free | Partition Type: NTFS
Drive I: | 58.59 Gb Total Space | 18.91 Gb Free Space | 32.28% Space Free | Partition Type: NTFS

Computer Name: CELLARPOWER | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/10/26 23:20:37 | 000,201,816 | ---- | M] () -- C:\WINDOWS\SysWOW64\PnkBstrB.exe
PRC - [2011/10/26 17:56:03 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL\OTL.com
PRC - [2011/10/19 00:05:05 | 000,075,136 | ---- | M] () -- C:\WINDOWS\SysWOW64\PnkBstrA.exe
PRC - [2011/09/25 18:59:56 | 001,636,152 | ---- | M] (Trusteer Ltd.) -- C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe
PRC - [2011/09/25 18:59:56 | 000,919,352 | ---- | M] (Trusteer Ltd.) -- C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe
PRC - [2011/05/21 06:01:00 | 002,214,504 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2011/05/17 10:40:26 | 000,066,560 | ---- | M] (Nalpeiron Ltd.) -- C:\WINDOWS\SysWOW64\nlssrv32.exe
PRC - [2011/04/19 11:09:28 | 000,185,896 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe
PRC - [2011/04/18 20:30:39 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
PRC - [2011/01/22 15:58:30 | 000,069,000 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) -- C:\Program Files (x86)\EASEUS\Todo Backup 2.0\bin\EuWatch.exe
PRC - [2011/01/22 15:58:30 | 000,055,688 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) -- C:\Program Files (x86)\EASEUS\Todo Backup 2.0\bin\Agent.exe
PRC - [2010/07/22 22:10:47 | 000,402,432 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
PRC - [2009/08/27 17:09:10 | 001,253,376 | ---- | M] (MAGIX AG) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
PRC - [2009/02/05 13:43:26 | 000,068,136 | ---- | M] () -- C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE
PRC - [2008/10/14 21:38:56 | 000,623,992 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe


========== Modules (No Company Name) ==========

MOD - [2011/10/26 23:20:37 | 000,201,816 | ---- | M] () -- C:\WINDOWS\SysWOW64\PnkBstrB.exe
MOD - [2011/10/19 00:05:05 | 000,075,136 | ---- | M] () -- C:\WINDOWS\SysWOW64\PnkBstrA.exe
MOD - [2011/09/19 20:38:08 | 000,557,056 | ---- | M] () -- C:\Program Files (x86)\Trusteer\Rapport\bin\js32.dll
MOD - [2011/07/19 10:03:02 | 000,516,368 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportMS\28896\RapportMS.dll
MOD - [2011/01/22 15:57:54 | 000,050,056 | ---- | M] () -- C:\Program Files (x86)\EASEUS\Todo Backup 2.0\bin\CodeLog.dll
MOD - [2010/02/22 04:50:20 | 000,060,416 | ---- | M] () -- C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\zlib1.dll
MOD - [2009/02/05 13:43:26 | 000,068,136 | ---- | M] () -- C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE
MOD - [2008/12/05 17:03:52 | 000,098,304 | ---- | M] () -- C:\Program Files (x86)\Gigabyte\EasySaver\ycc.dll
MOD - [2008/11/25 17:18:00 | 001,291,264 | ---- | M] () -- C:\Program Files (x86)\EASEUS\Todo Backup 2.0\bin\libxml2.dll
MOD - [2004/10/05 03:08:00 | 000,055,808 | ---- | M] () -- C:\Program Files (x86)\EASEUS\Todo Backup 2.0\bin\zlib1.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011/10/07 18:47:14 | 002,663,568 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe -- (cmdAgent)
SRV:64bit: - [2010/12/09 13:08:14 | 000,371,648 | ---- | M] () [Auto | Running] -- C:\Program Files\COMODO\COMODO System-Cleaner\Cleaner_Validator.exe -- (Cleaner_Validator)
SRV:64bit: - [2010/11/15 11:08:10 | 005,716,848 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe -- (TabletServiceWacom)
SRV - [2011/10/26 23:20:37 | 000,201,816 | ---- | M] () [Auto | Running] -- C:\WINDOWS\SysWow64\PnkBstrB.exe -- (PnkBstrB)
SRV - [2011/10/19 00:05:05 | 000,075,136 | ---- | M] () [Auto | Running] -- C:\WINDOWS\SysWow64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2011/09/25 18:59:56 | 000,919,352 | ---- | M] (Trusteer Ltd.) [Auto | Running] -- C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe -- (RapportMgmtService)
SRV - [2011/05/21 06:01:00 | 002,214,504 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011/05/17 10:40:26 | 000,066,560 | ---- | M] (Nalpeiron Ltd.) [Auto | Running] -- C:\WINDOWS\SysWOW64\nlssrv32.exe -- (nlsX86cc)
SRV - [2011/04/18 20:30:39 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Running] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011/01/22 15:58:30 | 000,055,688 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) [Auto | Running] -- C:\Program Files (x86)\EASEUS\Todo Backup 2.0\bin\Agent.exe -- (EASEUS Agent)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/02/19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009/08/27 17:09:10 | 001,253,376 | ---- | M] (MAGIX AG) [Unknown | Running] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe -- (Fabs)
SRV - [2009/02/05 13:43:26 | 000,068,136 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE -- (ES lite Service)
SRV - [2008/08/07 11:10:02 | 003,276,800 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)
SRV - [2008/07/25 11:17:02 | 000,069,632 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2007/02/17 00:44:20 | 000,077,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\pchsvc.dll -- (helpsvc)
SRV - [2006/12/14 20:01:00 | 000,126,464 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RPB.EXE -- (EPSON_PM_RPCV4_01) EPSON V3 Service4(01)
SRV - [2006/10/18 20:05:24 | 000,913,408 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc)


========== Driver Services (SafeList) ==========

DRV - [2011/10/27 10:40:03 | 000,023,080 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\gdrv.sys -- (gdrv)
DRV - [2011/09/25 19:00:08 | 000,055,056 | ---- | M] (Trusteer Ltd.) [Kernel | System | Running] -- C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys -- (RapportEI64)
DRV - [2011/05/03 14:59:07 | 000,005,248 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysWow64\giveio.sys -- (giveio)
DRV - [2010/10/03 23:54:04 | 000,012,544 | ---- | M] (Trusteer Ltd.) [Kernel | On_Demand | Stopped] -- C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportMS\19514\RapportIaso.sys -- (RapportIaso)
DRV - [2005/03/25 13:00:00 | 000,033,792 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\SysWow64\mnmdd.dll -- (mnmdd)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ephotozine.com/
IE - HKCU\..\URLSearchHook: {0063BF63-BFFF-4B8F-9D26-4267DF7F17DD} - C:\WINDOWS\SysWOW64\dvmurl.dll (DeviceVM Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.3088: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.3146: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.11.3006: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.5: C:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files (x86)\Real\RealPlayer\browserrecord [2011/04/19 11:09:44 | 000,000,000 | ---D | M]


Hosts file not found
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\Update\1.3.21.53\%ProgramW6432%\Google\GoogleToolbarNotifier\5.7.6406.1642\swg64.dll File not found
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files (x86)\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3:64bit: - HKCU\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - %SystemRoot%\system32\browseui.dll File not found
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - %SystemRoot%\system32\browseui.dll File not found
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - %SystemRoot%\system32\SHELL32.dll File not found
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4:64bit: - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4:64bit: - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4:64bit: - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup File not found
O4:64bit: - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit File not found
O4:64bit: - HKLM..\Run: [nwiz] nwiz.exe /installquiet File not found
O4:64bit: - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [EaseUs Watch] C:\Program Files (x86)\EASEUS\Todo Backup 2.0\bin\EuWatch.exe (CHENGDU YIWO Tech Development Co., Ltd)
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\SysWOW64\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [TrayServer] C:\Program Files (x86)\MAGIX\Movie_Edit_Pro_16_Plus_Download_Version\TrayServer.exe (MAGIX AG)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk = File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O8:64bit: - Extra context menu item: &WordWeb... - res://C:\WINDOWS\system32\wweb32.dll/lookup.html File not found
O8:64bit: - Extra context menu item: Append to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert link target to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selected links to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selection to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll (Google Inc.)
O8 - Extra context menu item: &WordWeb... - C:\WINDOWS\SysWow64\wweb32.dll (Antony Lewis)
O8 - Extra context menu item: Append to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll (Google Inc.)
O9:64bit: - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra Button: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - res://C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm File not found
O9 - Extra 'Tools' menuitem : Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - res://C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm File not found
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000001 [] - %SystemRoot%\System32\mswsock.dll File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000002 [] - %SystemRoot%\System32\winrnr.dll File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000003 [] - %SystemRoot%\System32\mswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - %SystemRoot%\system32\mswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - %SystemRoot%\system32\mswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - %SystemRoot%\system32\mswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - %SystemRoot%\system32\mswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - %SystemRoot%\system32\mswsock.dll File not found
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.appl...ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.micros...b?1302444191359 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.mi...b?1302445274968 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CF423631-186A-4595-AD77-BAF62329AC46}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CF423631-186A-4595-AD77-BAF62329AC46}: NameServer = 156.154.70.22,156.154.71.22
O18:64bit: - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll File not found
O18:64bit: - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll File not found
O18:64bit: - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll File not found
O18:64bit: - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll File not found
O18:64bit: - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll File not found
O18:64bit: - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll File not found
O18:64bit: - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll File not found
O18:64bit: - Protocol\Handler\http\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\http\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll File not found
O18:64bit: - Protocol\Handler\https\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\https\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll File not found
O18:64bit: - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll File not found
O18:64bit: - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll File not found
O18:64bit: - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll File not found
O18:64bit: - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - %SystemRoot%\system32\inetcomm.dll File not found
O18:64bit: - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll File not found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll File not found
O18:64bit: - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll File not found
O18:64bit: - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - %SystemRoot%\system32\mshtml.dll File not found
O18:64bit: - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll File not found
O18:64bit: - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll File not found
O18:64bit: - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll File not found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18:64bit: - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found
O18:64bit: - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found
O18:64bit: - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found
O18:64bit: - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll File not found
O18:64bit: - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll File not found
O18:64bit: - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll File not found
O18:64bit: - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll File not found
O18:64bit: - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - %SystemRoot%\system32\SHELL32.dll File not found
O20:64bit: - AppInit_DLLs: (C:\WINDOWS\system32\guard64.dll) - File not found
O20 - AppInit_DLLs: (C:\WINDOWS\SysWOW64\guard32.dll) -C:\WINDOWS\SysWOW64\guard32.dll (COMODO)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - File not found
O20:64bit: - HKLM Winlogon: UIHost - (%SystemRoot%\system32\logonui.exe) - File not found
O20:64bit: - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: System - (lsass.exe) - File not found
O20 - HKLM Winlogon: UserInit - (userinit) -C:\WINDOWS\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\crypt32chain: DllName - (crypt32.dll) - File not found
O20:64bit: - Winlogon\Notify\cryptnet: DllName - (cryptnet.dll) - File not found
O20:64bit: - Winlogon\Notify\cscdll: DllName - (cscdll.dll) - File not found
O20:64bit: - Winlogon\Notify\dimsntfy: DllName - (dimsntfy.dll) - File not found
O20:64bit: - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) - File not found
O20:64bit: - Winlogon\Notify\Schedule: DllName - (wlnotify.dll) - File not found
O20:64bit: - Winlogon\Notify\sclgntfy: DllName - (sclgntfy.dll) - File not found
O20:64bit: - Winlogon\Notify\SensLogn: DllName - (WlNotify.dll) - File not found
O20:64bit: - Winlogon\Notify\termsrv: DllName - (wlnotify.dll) - File not found
O20:64bit: - Winlogon\Notify\wlballoon: DllName - (wlnotify.dll) - File not found
O20 - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) - File not found
O20 - Winlogon\Notify\Schedule: DllName - (wlnotify.dll) - File not found
O20 - Winlogon\Notify\SensLogn: DllName - (WlNotify.dll) - File not found
O20 - Winlogon\Notify\wlballoon: DllName - (wlnotify.dll) - File not found
O21:64bit: - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll File not found
O21:64bit: - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - %SystemRoot%\system32\SHELL32.dll File not found
O21:64bit: - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll File not found
O21:64bit: - SSODL: UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll File not found
O21:64bit: - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll File not found
O22:64bit: - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - %SystemRoot%\system32\browseui.dll File not found
O22:64bit: - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - %SystemRoot%\system32\browseui.dll File not found
O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28:64bit: - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28:64bit: - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/04/19 11:02:17 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ]
O32 - AutoRun File - [2011/04/10 15:34:52 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/10/27 10:43:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\OTL
[2011/10/27 10:35:29 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator\Recent
[2011/10/25 23:16:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VS Revo Group
[2011/10/23 18:43:02 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\SysWow64\javaws.exe
[2011/10/23 18:43:02 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\SysWow64\javaw.exe
[2011/10/23 18:43:02 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\SysWow64\java.exe
[2011/10/18 23:42:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Ubisoft
[2011/10/12 20:16:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\solcache
[2011/10/12 20:02:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sierra On-Line
[2011/10/12 16:56:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\FoxTab Video To MP3
[2011/10/12 16:56:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FoxTabVideoToMP3
[2011/10/12 16:52:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\JockerSoft
[2011/10/12 16:52:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\JockerSoft
[2011/10/12 16:52:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\CodecInstaller
[2011/10/12 16:36:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\AVS4YOU
[2011/10/12 16:35:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVS4YOU
[2011/10/12 16:33:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\AVS4YOU
[2011/10/12 16:31:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\AVS4YOU
[2011/10/12 16:31:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\AVSMedia
[2011/10/12 16:31:09 | 000,974,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\SysWow64\mfc70.dll
[2011/10/12 16:31:09 | 000,487,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\SysWow64\msvcp70.dll
[2011/10/12 16:31:09 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\SysWow64\msxml3a.dll
[2011/10/12 16:31:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVS4YOU
[2011/10/12 16:00:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2011/10/12 15:58:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NCH Swift Sound
[2011/10/10 20:41:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Get from YouTube
[2011/10/10 19:37:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Import Audio from Video
[2011/10/09 17:12:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\LEGO Creations
[2011/10/09 16:55:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Chromium
[2011/10/09 12:18:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\FoxTab Audio Converter
[2011/10/09 12:18:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FoxTabAudioConverter
[2011/10/06 10:45:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Paragon 500 Manual. copy
[2011/10/03 19:00:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\MagicISO
[2011/10/03 18:59:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MagicISO
[2011/10/03 09:37:02 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\SysWow64\url.dll
[2011/10/01 11:59:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\SynthMaker
[2011/10/01 11:58:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\My Documents\My Recordings
[2011/10/01 11:37:49 | 000,057,344 | ---- | C] (NexiTech, Inc.) -- C:\WINDOWS\SysWow64\Wnaspint.dll
[2011/10/01 11:37:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Acoustica
[2011/10/01 11:37:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Acoustica Shared Effects
[2011/10/01 11:35:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Acoustica
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\SysWow64\*.tmp files -> C:\WINDOWS\SysWow64\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/10/27 10:42:58 | 000,000,912 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/10/27 10:40:37 | 000,000,908 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/10/27 10:40:03 | 000,023,080 | ---- | M] (Windows ® Server 2003 DDK provider) -- C:\WINDOWS\gdrv.sys
[2011/10/27 10:39:29 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/10/27 10:38:36 | 000,020,966 | ---- | M] () -- C:\WINDOWS\cscmondump.bin
[2011/10/27 10:38:14 | 007,079,710 | ---- | M] () -- C:\WINDOWS\CSC_ActiveCleanLog.dat
[2011/10/27 10:38:14 | 000,763,688 | ---- | M] () -- C:\WINDOWS\CSC_ServiceDump.dat
[2011/10/27 10:30:55 | 000,000,251 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Setting.dat
[2011/10/27 10:21:46 | 000,000,022 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\UserFlag.ini
[2011/10/26 23:20:37 | 000,201,816 | ---- | M] () -- C:\WINDOWS\SysWow64\PnkBstrB.exe
[2011/10/26 23:20:37 | 000,201,816 | ---- | M] () -- C:\WINDOWS\SysWow64\PnkBstrB.ex0
[2011/10/26 23:18:12 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\SysWow64\FlashPlayerCPLApp.cpl
[2011/10/26 17:17:57 | 000,002,545 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Microsoft Office Outlook 2007.lnk
[2011/10/26 16:23:14 | 008,623,580 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\guitar left hand.tif
[2011/10/26 15:46:10 | 000,000,466 | ---- | M] () -- C:\WINDOWS\tasks\COMODO Updater.job
[2011/10/26 13:41:26 | 000,000,450 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{FD05BF6F-7FF7-43A5-AC6E-54A8B757702E}.job
[2011/10/26 11:19:03 | 005,434,009 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Toshiba C660 Review at D.I.D Electrical - YouTube.flv
[2011/10/25 22:31:00 | 000,000,296 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/10/25 13:38:40 | 000,000,288 | ---- | M] () -- C:\WINDOWS\tasks\meoShakeIcon.job
[2011/10/20 12:51:14 | 000,050,176 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/10/19 00:05:05 | 000,075,136 | ---- | M] () -- C:\WINDOWS\SysWow64\PnkBstrA.exe
[2011/10/18 23:49:54 | 000,001,816 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Far Cry® 2.lnk
[2011/10/16 13:48:05 | 000,001,908 | ---- | M] () -- C:\WINDOWS\diagwrn.xml
[2011/10/16 13:48:05 | 000,001,908 | ---- | M] () -- C:\WINDOWS\diagerr.xml
[2011/10/15 13:06:23 | 000,001,510 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Sound Recorder.lnk
[2011/10/13 14:03:16 | 000,626,688 | ---- | M] () -- C:\WINDOWS\SysWow64\PerfStringBackup.INI
[2011/10/12 16:56:55 | 000,000,810 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\FoxTab Video To MP3.lnk
[2011/10/12 16:01:58 | 000,009,728 | ---- | M] () -- C:\WINDOWS\SysWow64\BASSMOD.dll
[2011/10/07 18:47:10 | 000,300,200 | ---- | M] (COMODO) -- C:\WINDOWS\SysWow64\guard32.dll
[2011/10/05 20:01:07 | 000,109,130 | ---- | M] () -- C:\Documents and Settings\Administrator\My Documents\C7Voicings.pdf
[2011/10/03 09:37:02 | 001,469,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SysWow64\inetcpl.cpl
[2011/10/03 09:37:02 | 000,385,024 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SysWow64\html.iec
[2011/10/03 09:37:02 | 000,206,848 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SysWow64\occache.dll
[2011/10/03 09:37:02 | 000,184,320 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SysWow64\iepeers.dll
[2011/10/03 09:37:02 | 000,174,080 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SysWow64\ie4uinit.exe
[2011/10/03 09:37:02 | 000,105,984 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SysWow64\url.dll
[2011/10/03 09:37:02 | 000,066,560 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SysWow64\mshtmled.dll
[2011/10/03 09:37:02 | 000,043,520 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SysWow64\licmgr10.dll
[2011/10/03 05:06:16 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\SysWow64\javaws.exe
[2011/10/03 05:06:15 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\SysWow64\javaw.exe
[2011/10/03 05:06:14 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\SysWow64\java.exe
[2011/10/03 05:06:03 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\SysWow64\deployJava1.dll
[2011/10/01 21:34:33 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011/09/29 19:06:04 | 000,002,539 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Microsoft Office Word 2007.lnk
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\SysWow64\*.tmp files -> C:\WINDOWS\SysWow64\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/10/27 10:21:46 | 000,000,251 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\Setting.dat
[2011/10/27 10:21:46 | 000,000,022 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\UserFlag.ini
[2011/10/26 15:09:14 | 008,623,580 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\guitar left hand.tif
[2011/10/26 11:18:17 | 005,434,009 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Toshiba C660 Review at D.I.D Electrical - YouTube.flv
[2011/10/25 13:38:40 | 000,000,288 | ---- | C] () -- C:\WINDOWS\tasks\meoShakeIcon.job
[2011/10/18 23:49:54 | 000,001,816 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Far Cry® 2.lnk
[2011/10/16 13:39:10 | 000,001,908 | ---- | C] () -- C:\WINDOWS\diagwrn.xml
[2011/10/16 13:39:10 | 000,001,908 | ---- | C] () -- C:\WINDOWS\diagerr.xml
[2011/10/12 16:56:55 | 000,000,810 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\FoxTab Video To MP3.lnk
[2011/10/12 16:01:58 | 000,009,728 | ---- | C] () -- C:\WINDOWS\SysWow64\BASSMOD.dll
[2011/10/05 20:01:07 | 000,109,130 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\C7Voicings.pdf
[2011/09/19 11:26:07 | 000,004,096 | ---- | C] () -- C:\WINDOWS\SysWow64\HDREfexProFC64.dll
[2011/09/12 19:06:41 | 000,120,200 | ---- | C] () -- C:\WINDOWS\SysWow64\DLLDEV32i.dll
[2011/09/10 23:20:55 | 007,079,710 | ---- | C] () -- C:\WINDOWS\CSC_ActiveCleanLog.dat
[2011/09/10 23:20:55 | 000,763,688 | ---- | C] () -- C:\WINDOWS\CSC_ServiceDump.dat
[2011/09/10 13:49:19 | 000,020,966 | ---- | C] () -- C:\WINDOWS\cscmondump.bin
[2011/09/07 10:23:26 | 000,000,029 | ---- | C] () -- C:\WINDOWS\DEBUGSM.INI
[2011/07/31 19:31:38 | 003,854,848 | ---- | C] () -- C:\WINDOWS\SysWow64\ffmpeg.dll
[2011/07/19 20:08:04 | 000,074,752 | ---- | C] () -- C:\WINDOWS\SysWow64\ff_vfw.dll
[2011/07/19 20:06:48 | 000,259,584 | ---- | C] () -- C:\WINDOWS\SysWow64\TomsMoComp_ff.dll
[2011/07/19 20:06:36 | 000,158,208 | ---- | C] () -- C:\WINDOWS\SysWow64\ff_unrar.dll
[2011/07/19 20:06:34 | 001,524,224 | ---- | C] () -- C:\WINDOWS\SysWow64\ff_samplerate.dll
[2011/07/19 20:06:34 | 000,096,768 | ---- | C] () -- C:\WINDOWS\SysWow64\ff_wmv9.dll
[2011/07/19 20:06:32 | 000,145,920 | ---- | C] () -- C:\WINDOWS\SysWow64\ff_libmad.dll
[2011/07/19 20:06:30 | 000,136,704 | ---- | C] () -- C:\WINDOWS\SysWow64\libmpeg2_ff.dll
[2011/07/19 20:06:30 | 000,113,664 | ---- | C] () -- C:\WINDOWS\SysWow64\ff_liba52.dll
[2011/07/19 20:06:28 | 000,327,680 | ---- | C] () -- C:\WINDOWS\SysWow64\ff_libfaad2.dll
[2011/07/19 20:06:28 | 000,211,456 | ---- | C] () -- C:\WINDOWS\SysWow64\ff_libdts.dll
[2011/07/12 15:52:47 | 000,000,132 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Adobe PNG Format CS5 Prefs
[2011/07/12 15:51:32 | 000,000,132 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Adobe GIF Format CS5 Prefs
[2011/07/08 15:23:16 | 000,050,176 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/06/09 10:34:51 | 000,001,759 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2011/05/30 14:42:50 | 000,240,640 | ---- | C] () -- C:\WINDOWS\SysWow64\xvidvfw.dll
[2011/05/23 08:46:30 | 000,645,632 | ---- | C] () -- C:\WINDOWS\SysWow64\xvidcore.dll
[2011/05/09 13:55:12 | 000,000,132 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Adobe BMP Format CS5 Prefs
[2011/05/03 14:59:07 | 000,005,248 | ---- | C] () -- C:\WINDOWS\SysWow64\giveio.sys
[2011/04/26 17:24:35 | 000,111,932 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPrinterDB.dat
[2011/04/26 17:24:35 | 000,031,053 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPattern131.dat
[2011/04/26 17:24:35 | 000,027,417 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPattern121.dat
[2011/04/26 17:24:35 | 000,026,154 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPattern1.dat
[2011/04/26 17:24:35 | 000,024,903 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPattern3.dat
[2011/04/26 17:24:35 | 000,021,390 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPattern5.dat
[2011/04/26 17:24:35 | 000,020,148 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPattern2.dat
[2011/04/26 17:24:35 | 000,011,811 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPattern4.dat
[2011/04/26 17:24:35 | 000,004,943 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPattern6.dat
[2011/04/26 17:24:35 | 000,001,146 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPresetData_DU.dat
[2011/04/26 17:24:35 | 000,001,139 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPresetData_PT.dat
[2011/04/26 17:24:35 | 000,001,139 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPresetData_BP.dat
[2011/04/26 17:24:35 | 000,001,136 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPresetData_ES.dat
[2011/04/26 17:24:35 | 000,001,129 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPresetData_FR.dat
[2011/04/26 17:24:35 | 000,001,129 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPresetData_CF.dat
[2011/04/26 17:24:35 | 000,001,120 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPresetData_IT.dat
[2011/04/26 17:24:35 | 000,001,107 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPresetData_GE.dat
[2011/04/26 17:24:35 | 000,001,104 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPresetData_EN.dat
[2011/04/26 17:24:35 | 000,000,097 | ---- | C] () -- C:\WINDOWS\SysWow64\PICSDK.ini
[2011/04/26 17:18:08 | 000,000,025 | ---- | C] () -- C:\WINDOWS\CDER2400.ini
[2011/04/23 22:26:04 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2011/04/22 11:20:53 | 000,000,032 | ---- | C] () -- C:\WINDOWS\SysWow64\EUOD.DAT
[2011/04/19 11:18:45 | 000,201,816 | ---- | C] () -- C:\WINDOWS\SysWow64\PnkBstrB.exe
[2011/04/19 11:18:44 | 000,837,192 | ---- | C] () -- C:\WINDOWS\SysWow64\pbsvc.exe
[2011/04/19 11:18:44 | 000,075,136 | ---- | C] () -- C:\WINDOWS\SysWow64\PnkBstrA.exe
[2011/04/19 10:51:42 | 000,002,623 | ---- | C] () -- C:\WINDOWS\Irremote.ini
[2011/04/10 16:40:02 | 000,626,688 | ---- | C] () -- C:\WINDOWS\SysWow64\PerfStringBackup.INI
[2011/04/10 16:19:25 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2011/04/10 15:38:20 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2011/04/10 14:58:01 | 000,037,376 | R--- | C] () -- C:\WINDOWS\CPLUTL64.EXE
[2011/03/03 12:40:08 | 000,150,528 | ---- | C] () -- C:\WINDOWS\SysWow64\mkx.dll
[2011/03/03 12:39:56 | 000,109,568 | ---- | C] () -- C:\WINDOWS\SysWow64\avi.dll
[2011/03/03 12:39:46 | 000,141,824 | ---- | C] () -- C:\WINDOWS\SysWow64\mp4.dll
[2011/03/03 12:39:34 | 000,123,392 | ---- | C] () -- C:\WINDOWS\SysWow64\ogm.dll
[2011/03/03 12:39:02 | 000,113,152 | ---- | C] () -- C:\WINDOWS\SysWow64\dsmux.exe
[2011/03/03 12:38:54 | 000,154,112 | ---- | C] () -- C:\WINDOWS\SysWow64\ts.dll
[2011/03/03 12:38:40 | 000,249,856 | ---- | C] () -- C:\WINDOWS\SysWow64\dxr.dll
[2011/03/03 12:38:10 | 000,097,792 | ---- | C] () -- C:\WINDOWS\SysWow64\avs.dll
[2011/03/03 12:38:04 | 000,137,728 | ---- | C] () -- C:\WINDOWS\SysWow64\mkv2vfr.exe
[2011/03/03 12:37:50 | 000,093,184 | ---- | C] () -- C:\WINDOWS\SysWow64\avss.dll
[2011/03/03 12:37:40 | 000,358,400 | ---- | C] () -- C:\WINDOWS\SysWow64\gdsmux.exe
[2011/03/03 12:35:32 | 000,080,384 | ---- | C] () -- C:\WINDOWS\SysWow64\mkzlib.dll
[2011/03/03 12:35:26 | 000,024,576 | ---- | C] () -- C:\WINDOWS\SysWow64\mkunicode.dll
[2010/10/03 23:16:26 | 000,302,592 | ---- | C] () -- C:\WINDOWS\SysWow64\HDREfexProFC32.dll
[2010/08/18 20:56:38 | 000,000,151 | ---- | C] () -- C:\WINDOWS\SysWow64\Registration.ini
[2009/08/11 22:21:26 | 000,087,552 | ---- | C] () -- C:\WINDOWS\SysWow64\ac3config.exe
[2009/08/11 22:21:20 | 001,021,440 | ---- | C] () -- C:\WINDOWS\SysWow64\ac3filter_intl.dll
[2009/03/21 09:47:30 | 000,001,024 | ---- | C] () -- C:\WINDOWS\SysWow64\r0vdmyq.dll
[2009/03/21 09:47:30 | 000,001,024 | ---- | C] () -- C:\WINDOWS\SysWow64\grcauth2.dll
[2009/03/21 09:47:30 | 000,001,024 | ---- | C] () -- C:\WINDOWS\SysWow64\grcauth1.dll
[2009/03/21 09:47:30 | 000,001,024 | ---- | C] () -- C:\WINDOWS\SysWow64\clauth2.dll
[2009/03/21 09:47:30 | 000,001,024 | ---- | C] () -- C:\WINDOWS\SysWow64\clauth1.dll
[2009/03/21 09:47:30 | 000,000,334 | ---- | C] () -- C:\WINDOWS\SysWow64\pp76706.dll
[2009/03/21 09:47:30 | 000,000,100 | ---- | C] () -- C:\WINDOWS\SysWow64\prsgrc.dll
[2009/03/21 09:47:30 | 000,000,072 | ---- | C] () -- C:\WINDOWS\SysWow64\ssprs.dll
[2009/03/21 09:47:30 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\SysWow64\f7d1p74.dll
[2008/11/06 16:37:32 | 003,596,288 | ---- | C] () -- C:\WINDOWS\SysWow64\qt-dx331.dll
[2006/03/04 05:52:00 | 000,088,576 | ---- | C] () -- C:\WINDOWS\SysWow64\OptimFROG.dll
[2005/03/25 13:00:00 | 001,278,464 | ---- | C] () -- C:\WINDOWS\SysWow64\quartz.dll
[2005/03/25 13:00:00 | 000,733,696 | ---- | C] () -- C:\WINDOWS\SysWow64\qedwipes.dll
[2005/03/25 13:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\SysWow64\mlang.dat
[2005/03/25 13:00:00 | 000,512,512 | ---- | C] () -- C:\WINDOWS\SysWow64\qedit.dll
[2005/03/25 13:00:00 | 000,498,742 | ---- | C] () -- C:\WINDOWS\SysWow64\dxmasf.dll
[2005/03/25 13:00:00 | 000,396,288 | ---- | C] () -- C:\WINDOWS\SysWow64\encdec.dll
[2005/03/25 13:00:00 | 000,385,536 | ---- | C] () -- C:\WINDOWS\SysWow64\qdvd.dll
[2005/03/25 13:00:00 | 000,355,112 | ---- | C] () -- C:\WINDOWS\SysWow64\msjetoledb40.dll
[2005/03/25 13:00:00 | 000,279,040 | ---- | C] () -- C:\WINDOWS\SysWow64\qdv.dll
[2005/03/25 13:00:00 | 000,276,992 | ---- | C] () -- C:\WINDOWS\SysWow64\sbe.dll
[2005/03/25 13:00:00 | 000,199,168 | ---- | C] () -- C:\WINDOWS\SysWow64\ir32_32.dll
[2005/03/25 13:00:00 | 000,192,512 | ---- | C] () -- C:\WINDOWS\SysWow64\qcap.dll
[2005/03/25 13:00:00 | 000,114,688 | ---- | C] () -- C:\WINDOWS\SysWow64\msencode.dll
[2005/03/25 13:00:00 | 000,072,704 | ---- | C] () -- C:\WINDOWS\SysWow64\amstream.dll
[2005/03/25 13:00:00 | 000,062,464 | ---- | C] () -- C:\WINDOWS\SysWow64\mciqtz32.dll
[2005/03/25 13:00:00 | 000,061,440 | ---- | C] () -- C:\WINDOWS\SysWow64\devenum.dll
[2005/03/25 13:00:00 | 000,055,808 | ---- | C] () -- C:\WINDOWS\SysWow64\dvdplay.exe
[2005/03/25 13:00:00 | 000,046,907 | ---- | C] () -- C:\WINDOWS\mib.bin
[2005/03/25 13:00:00 | 000,016,896 | ---- | C] () -- C:\WINDOWS\SysWow64\tsd32.dll
[2005/03/25 13:00:00 | 000,014,336 | ---- | C] () -- C:\WINDOWS\SysWow64\msdmo.dll
[2005/03/25 13:00:00 | 000,012,498 | ---- | C] () -- C:\WINDOWS\SysWow64\append.exe
[2005/03/25 13:00:00 | 000,004,126 | ---- | C] () -- C:\WINDOWS\SysWow64\msdxmlc.dll
[2005/03/25 13:00:00 | 000,001,129 | ---- | C] () -- C:\WINDOWS\SysWow64\vwipxspx.exe

< End of report >

Attached Files

  • Attached File  OTL.Txt   103.12KB   158 downloads

  • 0

#4
RKinner
Posted 27 October 2011 - 01:27 PM

RKinner

    Malware Expert

  • Expert
  • 24,624 posts
  • MVP
It looks like the ZeroAcess Rootkit to me.


ComboFix

:!: It must be saved to your desktop, do not run it from your browser:!:

:!: Disable your Antivirus software when downloading or running Combofix. If it has Script Blocking features, please disable these as well. See: http://www.bleepingc...opic114351.html


Download and Save this file -- to your Desktop -- from either of these two sources:
http://download.blee...Bs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

Rightclick on ComboFix and select Run As Administrator to start the program.



* :!: Important: Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.


* A window may open with a series of Disclaimers. Accept the Disclaimers to start the fix.

A caution - Do not run Combofix more than once. Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.

A file will be created at => C:\Combofix.txt. I'll need to see that in your reply.


Download TDSSKiller:
http://support.kaspe.../tdsskiller.exe
Save it to your desktop then right click and Run as Administrator

If TDSSKiller alerts you that the system needs to reboot, please consent.
When done, a log file should be created on your C: drive named "TDSSKiller.txt" please copy and paste the contents in your next reply.


Download aswMBR.exe ( 511KB ) to your desktop.
Right click aswMBR.exe and Run as Administrator

change the a-v scan to None.
uncheck trace disk IO calls
Click the "Scan" button to start scan
On completion of the scan (Note if the Fix button is enabled (not the FixMBR button) and tell me) click save log, save it to your desktop and post in your next reply


Malwarebytes' Anti-Malware
:!: If you have a previous version of MalwareBytes', remove it via Add or Remove Programs and download a fresh copy. :!:

http://www.malwarebytes.org/mbam.php

SAVE Malwarebytes' Anti-Malware to your desktop.

Rightclick on Malwarebytes' Anti-Malware and select Run As Administrator and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.

* Once the program has loaded, select Perform Quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.

* Be sure that everything is checked, and click Remove Selected.

* When completed, a log will open in Notepad. Please save it to a convenient location.
* The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
* Post that log back here.


Run OTL (Vista or Win 7 => right click and Run As Administrator)

select the All option in the Extra Registry group then Run Scan.

You should get two logs. Please copy and paste both of them.

Ron
  • 0

#5
Ste
Posted 28 October 2011 - 03:26 AM

Ste

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 240 posts
Hi Ron, thanks for all the info/instructions but I have hit a problem in that Combofix says that 'This system is not supported'. I am running XP64bit and it lists XP32bit?

Steve
  • 0

#6
Ste
Posted 01 November 2011 - 04:00 AM

Ste

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 240 posts
Hi, as there has been no reply should I presume that this is the end of the road as 'Combofix' will not run on my system? :)

Steve.
  • 0

#7
RKinner
Posted 01 November 2011 - 11:51 AM

RKinner

    Malware Expert

  • Expert
  • 24,624 posts
  • MVP
I guess I lost your reply. We can try but we may wind up with a boat anchor. Do you have the Operating System CD in case it won't boot again? Is there another computer available in case you lose Internet Access?

Can you download and burn Hiren's Boot CD? http://www.hirensbootcd.org/download/ The download is where it says: Filename: Hirens.BootCD.15.0.zip

Save the file then right click on it and Extract All. The .iso file inside is what you need. Then burn the .iso to the CD per the instructions:
http://www.hirensbootcd.org/burning/

(Don't just copy the .iso to a CD - it won't work that way. )

Make sure you can boot off it when you are done.

Ron
  • 0

#8
Ste
Posted 02 November 2011 - 03:56 AM

Ste

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 240 posts
Hi Ron, Thanks for the response.Yes I have the OS CD, another computer and also a clone of the drive.

I downloaded Hirens Boot CD and burned it to disk and I can boot from it.

Steve.
  • 0

#9
RKinner
Posted 02 November 2011 - 09:55 AM

RKinner

    Malware Expert

  • Expert
  • 24,624 posts
  • MVP
Great. First let's try the easy way.

Go to
http://support.kaspe...s?qid=208280684
Download: TDSSKiller.exe
http://support.kaspe.../tdsskiller.exe
and save it and see if it will run by right clicking and Run As Admin or just by doubleclicking. (I'm not familiar with your OS).

Kaspersky claims their product can remove it so you might try downloading the trial version
http://usa.kaspersky.com/downloads

and installing and running a scan with it.

If that doesn't work then:

This bug has two major components on a 64 bit system:

C:\Windows\System32\consrv.dll and/or the folder and files in c:\windows\System64 <=this folder does not normally exist on real 64bit systems. Windows uses c:\windows\SysWow64 instead.)

And

a bunch of files in C:\Windows\Assembly\tmp (Example:

c:\windows\assembly\tmp\U
c:\windows\assembly\tmp\U\00000001.@
c:\windows\assembly\tmp\U\00000002.@
c:\windows\assembly\tmp\U\000000c0.@
c:\windows\assembly\tmp\U\000000cb.@
c:\windows\assembly\tmp\U\000000cf.@
c:\windows\assembly\tmp\U\80000000.@
c:\windows\assembly\tmp\U\80000032.@
c:\windows\assembly\tmp\U\80000064.@
c:\windows\assembly\tmp\U\800000c0.@
c:\windows\assembly\tmp\U\800000cb.@
c:\windows\assembly\tmp\U\800000cf.@


Windows Explorer cannot see the files in c:\windows\assembly\tmp. You need to use Command Prompt:
cd  c:\windows\assembly
rmdir  /s  tmp
mkdir  tmp

(We can also try removing the other components)

cd  \windows\system32
del  /a  consrv.dll
mkdir  consrv.dll

cd  \windows
rmdir  /s  system64


The files are supposedly called via

“HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems”

So we need to go into Regedit and navigate to that key and remove any reference to the files we just removed.

Other files are often infected. I'm not sure if yours keeps an sfc log or not. If it does we can do:

Start, All Programs, Accessories, right click on Command Prompt and Run as Administrator, Continue. Type with an Enter after each line:


cd  \windows\logs\cbs

copy  cbs.log  cbs.old

del  cbs.log

sfc  /scannow

findstr  /c:"[SR]"  cbs.log  >  junk.txt

If it doesn't keep a log we just have to

sfc /scannow

The winsock stack is usually messed up so needs to be reset:


netsh  winsock  reset catalog

attach the file \windows\logs\cbs\junk.txt to your next reply.
  • 0

#10
Ste
Posted 07 November 2011 - 02:45 PM

Ste

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 240 posts
Hi Ron, Sorry I didn’t get back so fast with this.
No threats were found from Kapersky TDSSKiller
The Kapersky Antivirus gave me the message that it was not compatible with my ‘Comodo Security Suite’. This would mean uninstalling it in order to install Kapersky so I left that at least for now.
No consrv.dll & System 64 folder
No consrv.dll in Windows\SysWow 64
Regarding the files you listed and instructions to search for them with command prompt. Am I right in thinking I should copy and paste each of the first three separate paragraphs into command promt?
If I am, each said ‘The system cannot find the file specified’, ‘cannot find file path’ or ‘are you sure’ I hit ‘y’ but nothing showed.
At the registry address you give ; clicking on ‘SubSystems opens CSRSS folder and clicking on that shows two entries in the right window- ab(default) REG_SZ (value not set) and another icon with blue writing 011 110 (first number on top of the other CsrSrvShaedSec... REG_DWORD (invalid DWORD value)
The last part to ‘Type with an Enter after each line’ asked for the OS disk at ‘scannow’ and did the file verification check after I installed the disk. It finished but with no message at the end.
When I added the ‘findstr /c:"[SR]" cbs.log > junk.txt’ line it said ‘cannot open cbs.log’.

I reset the winsoc stack and restarted. The \windows\logs\cbs\junk folder is empty.

I don’t know if I have carried out the instructions properly but it seems like a marathon. I’ve actually started using the ‘Comodo Dragon’ browser out of spite for Babylon and though it’s no great detriment in IE it is annoying that they are allowed to do this.
Anyway if you think I should do something correctly that I have done wrong or try something else I’m game. ??

Steve
  • 0

Advertisements

#11
RKinner
Posted 07 November 2011 - 04:09 PM

RKinner

    Malware Expert

  • Expert
  • 24,624 posts
  • MVP
Kaspersky has its own firewall so removing Comodo should not be a big deal.

Each line is is to be typed or copied and pasted separately.


Run OTL, Quickscan and post the log. Let's see what it looks like now.
  • 0

#12
Ste
Posted 10 November 2011 - 06:02 AM

Ste

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 240 posts
Hi Ron, I tried again with the command prompt searches and just got 'cannot find the file specified'. I installed Kapersky and did a scan. It just came up with some files left over in the Quarantined folder from Comodo, I have now re-installed Comodo.
I am attaching the new OTL file and I see reference to Babylon. I think it is the disabled add-on?
I think I am close to giving up now, it's time for a clean install in a few weeks when I get round to it. Thanks.

Steve
  • 0

#13
RKinner
Posted 10 November 2011 - 09:49 AM

RKinner

    Malware Expert

  • Expert
  • 24,624 posts
  • MVP
no otl log.
  • 0

#14
Ste
Posted 10 November 2011 - 10:20 AM

Ste

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 240 posts
Don't know what happened there...OTL logfile created on: 10/11/2011 11:39:00 - Run 4
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Administrator\Desktop
64bit-Windows Server 2003 Service Pack 2 (Version = 5.2.3790) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

8.00 Gb Total Physical Memory | 6.94 Gb Available Physical Memory | 86.83% Memory free
11.57 Gb Paging File | 10.73 Gb Available in Paging File | 92.71% Paging File free
Paging file location(s): c:\pagefile.sys 4090 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 149.04 Gb Total Space | 96.91 Gb Free Space | 65.02% Space Free | Partition Type: NTFS

Computer Name: CELLARPOWER | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/11/09 23:16:15 | 000,201,816 | ---- | M] () -- C:\WINDOWS\SysWOW64\PnkBstrB.exe
PRC - [2011/11/08 11:13:35 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
PRC - [2011/11/01 17:34:44 | 001,652,536 | ---- | M] (Trusteer Ltd.) -- C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe
PRC - [2011/11/01 17:34:44 | 000,931,640 | ---- | M] (Trusteer Ltd.) -- C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe
PRC - [2011/10/18 23:05:05 | 000,075,136 | ---- | M] () -- C:\WINDOWS\SysWOW64\PnkBstrA.exe
PRC - [2011/05/21 05:01:00 | 002,214,504 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2011/05/17 09:40:26 | 000,066,560 | ---- | M] (Nalpeiron Ltd.) -- C:\WINDOWS\SysWOW64\nlssrv32.exe
PRC - [2011/04/19 10:09:28 | 000,185,896 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe
PRC - [2011/04/18 19:30:39 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
PRC - [2011/01/22 14:58:30 | 000,069,000 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) -- C:\Program Files (x86)\EASEUS\Todo Backup 2.0\bin\EuWatch.exe
PRC - [2011/01/22 14:58:30 | 000,055,688 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) -- C:\Program Files (x86)\EASEUS\Todo Backup 2.0\bin\Agent.exe
PRC - [2009/08/27 16:09:10 | 001,253,376 | ---- | M] (MAGIX AG) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
PRC - [2009/02/05 12:43:26 | 000,068,136 | ---- | M] () -- C:\Program Files (x86)\Gigabyte\EasySaver\essvr.exe
PRC - [2008/10/14 20:38:56 | 000,623,992 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe


========== Modules (No Company Name) ==========

MOD - [2011/11/09 23:16:15 | 000,201,816 | ---- | M] () -- C:\WINDOWS\SysWOW64\PnkBstrB.exe
MOD - [2011/10/30 20:57:06 | 000,557,056 | ---- | M] () -- C:\Program Files (x86)\Trusteer\Rapport\bin\js32.dll
MOD - [2011/10/18 23:05:05 | 000,075,136 | ---- | M] () -- C:\WINDOWS\SysWOW64\PnkBstrA.exe
MOD - [2011/07/19 09:03:02 | 000,516,368 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportMS\28896\RapportMS.dll
MOD - [2011/01/22 14:57:54 | 000,050,056 | ---- | M] () -- C:\Program Files (x86)\EASEUS\Todo Backup 2.0\bin\CodeLog.dll
MOD - [2009/02/05 12:43:26 | 000,068,136 | ---- | M] () -- C:\Program Files (x86)\Gigabyte\EasySaver\essvr.exe
MOD - [2008/12/05 16:03:52 | 000,098,304 | ---- | M] () -- C:\Program Files (x86)\Gigabyte\EasySaver\ycc.dll
MOD - [2008/11/25 16:18:00 | 001,291,264 | ---- | M] () -- C:\Program Files (x86)\EASEUS\Todo Backup 2.0\bin\libxml2.dll
MOD - [2004/10/05 02:08:00 | 000,055,808 | ---- | M] () -- C:\Program Files (x86)\EASEUS\Todo Backup 2.0\bin\zlib1.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011/10/07 18:47:16 | 002,663,568 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe -- (cmdAgent)
SRV:64bit: - [2010/12/09 12:08:14 | 000,371,648 | ---- | M] () [Auto | Running] -- C:\Program Files\COMODO\COMODO System-Cleaner\Cleaner_Validator.exe -- (Cleaner_Validator)
SRV:64bit: - [2010/11/15 10:08:10 | 005,716,848 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe -- (TabletServiceWacom)
SRV - [2011/11/09 23:16:15 | 000,201,816 | ---- | M] () [Auto | Running] -- C:\WINDOWS\SysWOW64\PnkBstrB.exe -- (PnkBstrB)
SRV - [2011/11/01 17:34:44 | 000,931,640 | ---- | M] (Trusteer Ltd.) [Auto | Running] -- C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe -- (RapportMgmtService)
SRV - [2011/10/18 23:05:05 | 000,075,136 | ---- | M] () [Auto | Running] -- C:\WINDOWS\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2011/05/21 05:01:00 | 002,214,504 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011/05/17 09:40:26 | 000,066,560 | ---- | M] (Nalpeiron Ltd.) [Auto | Running] -- C:\WINDOWS\SysWOW64\nlssrv32.exe -- (nlsX86cc)
SRV - [2011/04/18 19:30:39 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Running] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011/01/22 14:58:30 | 000,055,688 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) [Auto | Running] -- C:\Program Files (x86)\EASEUS\Todo Backup 2.0\bin\Agent.exe -- (EASEUS Agent)
SRV - [2010/03/18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/02/19 12:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009/08/27 16:09:10 | 001,253,376 | ---- | M] (MAGIX AG) [Unknown | Running] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe -- (Fabs)
SRV - [2009/02/05 12:43:26 | 000,068,136 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE -- (ES lite Service)
SRV - [2008/08/07 10:10:02 | 003,276,800 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)
SRV - [2008/07/25 10:17:02 | 000,069,632 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2007/02/16 23:44:20 | 000,077,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\pchsvc.dll -- (helpsvc)
SRV - [2006/10/18 19:05:24 | 000,913,408 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc)


========== Driver Services (SafeList) ==========

DRV - [2011/11/10 11:28:03 | 000,023,080 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\gdrv.sys -- (gdrv)
DRV - [2011/11/01 17:34:58 | 000,055,056 | ---- | M] (Trusteer Ltd.) [Kernel | System | Running] -- C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys -- (RapportEI64)
DRV - [2011/05/03 13:59:07 | 000,005,248 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysWOW64\giveio.sys -- (giveio)
DRV - [2010/10/03 22:54:04 | 000,012,544 | ---- | M] (Trusteer Ltd.) [Kernel | On_Demand | Stopped] -- C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportMS\19514\RapportIaso.sys -- (RapportIaso)
DRV - [2005/03/25 12:00:00 | 000,033,792 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\SysWow64\mnmdd.dll -- (mnmdd)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ephotozine.com/
IE - HKCU\..\URLSearchHook: {0063BF63-BFFF-4B8F-9D26-4267DF7F17DD} - C:\WINDOWS\SysWOW64\dvmurl.dll (DeviceVM Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=;ftp=;https=;

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.3088: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.3146: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.11.3006: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.5: C:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files (x86)\Real\RealPlayer\browserrecord [2011/04/19 10:09:44 | 000,000,000 | ---D | M]


Hosts file not found
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\Update\1.3.21.53\%ProgramW6432%\Google\GoogleToolbarNotifier\5.7.6406.1642\swg64.dll File not found
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files (x86)\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3:64bit: - HKCU\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - %SystemRoot%\system32\browseui.dll File not found
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - %SystemRoot%\system32\browseui.dll File not found
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - %SystemRoot%\system32\SHELL32.dll File not found
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4:64bit: - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4:64bit: - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4:64bit: - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup File not found
O4:64bit: - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit File not found
O4:64bit: - HKLM..\Run: [nwiz] nwiz.exe /installquiet File not found
O4:64bit: - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin File not found
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [EaseUs Watch] C:\Program Files (x86)\EASEUS\Todo Backup 2.0\bin\EuWatch.exe (CHENGDU YIWO Tech Development Co., Ltd)
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\SysWOW64\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [TrayServer] C:\Program Files (x86)\MAGIX\Movie_Edit_Pro_16_Plus_Download_Version\TrayServer.exe (MAGIX AG)
O4 - HKCU..\Run: [EPSON Stylus Photo R2400] C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IATI9SE.EXE /FU "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_S9.tmp" /EF "HKCU" File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk = File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O8:64bit: - Extra context menu item: &WordWeb... - res://C:\WINDOWS\system32\wweb32.dll/lookup.html File not found
O8:64bit: - Extra context menu item: Append to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert link target to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selected links to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selection to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll (Google Inc.)
O8 - Extra context menu item: &WordWeb... - C:\WINDOWS\SysWow64\wweb32.dll (Antony Lewis)
O8 - Extra context menu item: Append to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll (Google Inc.)
O9:64bit: - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra Button: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - res://C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm File not found
O9 - Extra 'Tools' menuitem : Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - res://C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm File not found
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000001 [] - %SystemRoot%\System32\mswsock.dll File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000002 [] - %SystemRoot%\System32\winrnr.dll File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000003 [] - %SystemRoot%\System32\mswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - %SystemRoot%\system32\mswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - %SystemRoot%\system32\mswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - %SystemRoot%\system32\mswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - %SystemRoot%\system32\mswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - %SystemRoot%\system32\mswsock.dll File not found
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.appl...ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.micr...heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.micros...b?1302444191359 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.mi...b?1302445274968 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CF423631-186A-4595-AD77-BAF62329AC46}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CF423631-186A-4595-AD77-BAF62329AC46}: NameServer = 8.26.56.26,156.154.70.22
O18:64bit: - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll File not found
O18:64bit: - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll File not found
O18:64bit: - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll File not found
O18:64bit: - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll File not found
O18:64bit: - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll File not found
O18:64bit: - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll File not found
O18:64bit: - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll File not found
O18:64bit: - Protocol\Handler\http\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\http\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll File not found
O18:64bit: - Protocol\Handler\https\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\https\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll File not found
O18:64bit: - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll File not found
O18:64bit: - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll File not found
O18:64bit: - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll File not found
O18:64bit: - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - %SystemRoot%\system32\inetcomm.dll File not found
O18:64bit: - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll File not found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll File not found
O18:64bit: - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll File not found
O18:64bit: - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - %SystemRoot%\system32\mshtml.dll File not found
O18:64bit: - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll File not found
O18:64bit: - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll File not found
O18:64bit: - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll File not found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18:64bit: - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found
O18:64bit: - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found
O18:64bit: - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll File not found
O18:64bit: - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll File not found
O18:64bit: - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll File not found
O18:64bit: - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll File not found
O18:64bit: - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll File not found
O18:64bit: - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - %SystemRoot%\system32\SHELL32.dll File not found
O20:64bit: - AppInit_DLLs: (C:\WINDOWS\system32\guard64.dll) - File not found
O20 - AppInit_DLLs: (C:\WINDOWS\SysWOW64\guard32.dll) -C:\WINDOWS\SysWOW64\guard32.dll (COMODO)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - File not found
O20:64bit: - HKLM Winlogon: UIHost - (%SystemRoot%\system32\logonui.exe) - File not found
O20:64bit: - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: System - (lsass.exe) - File not found
O20 - HKLM Winlogon: UserInit - (userinit) -C:\WINDOWS\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\crypt32chain: DllName - (crypt32.dll) - File not found
O20:64bit: - Winlogon\Notify\cryptnet: DllName - (cryptnet.dll) - File not found
O20:64bit: - Winlogon\Notify\cscdll: DllName - (cscdll.dll) - File not found
O20:64bit: - Winlogon\Notify\dimsntfy: DllName - (dimsntfy.dll) - File not found
O20:64bit: - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) - File not found
O20:64bit: - Winlogon\Notify\Schedule: DllName - (wlnotify.dll) - File not found
O20:64bit: - Winlogon\Notify\sclgntfy: DllName - (sclgntfy.dll) - File not found
O20:64bit: - Winlogon\Notify\SensLogn: DllName - (WlNotify.dll) - File not found
O20:64bit: - Winlogon\Notify\termsrv: DllName - (wlnotify.dll) - File not found
O20:64bit: - Winlogon\Notify\wlballoon: DllName - (wlnotify.dll) - File not found
O20 - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) - File not found
O20 - Winlogon\Notify\Schedule: DllName - (wlnotify.dll) - File not found
O20 - Winlogon\Notify\SensLogn: DllName - (WlNotify.dll) - File not found
O20 - Winlogon\Notify\wlballoon: DllName - (wlnotify.dll) - File not found
O21:64bit: - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll File not found
O21:64bit: - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - %SystemRoot%\system32\SHELL32.dll File not found
O21:64bit: - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll File not found
O21:64bit: - SSODL: UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll File not found
O21:64bit: - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll File not found
O22:64bit: - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - %SystemRoot%\system32\browseui.dll File not found
O22:64bit: - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - %SystemRoot%\system32\browseui.dll File not found
O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28:64bit: - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28:64bit: - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/04/19 10:02:17 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ]
O32 - AutoRun File - [2011/04/10 14:34:52 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/11/10 10:10:49 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator\Recent
[2011/11/09 19:04:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Epson profiles I think
[2011/11/09 10:17:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\COMODO
[2011/11/08 11:14:06 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2011/11/08 10:33:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\SDL International
[2011/11/06 14:44:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\New Folder (2)
[2011/11/06 11:56:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\6th Nov 11
[2011/11/06 11:48:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Aftermath
[2011/11/03 13:31:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Driver Manager
[2011/11/02 16:44:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\New Folder
[2011/11/02 16:32:54 | 001,564,464 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Administrator\Desktop\tdsskiller.exe
[2011/11/01 09:56:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Comodo
[2011/10/28 11:29:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\A3 printers
[2011/10/28 09:10:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Desktop\Malwarebytes
[2011/10/25 22:16:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VS Revo Group
[2011/10/24 14:29:02 | 000,094,208 | ---- | C] (Apple Inc.) -- C:\WINDOWS\SysWow64\QuickTimeVR.qtx
[2011/10/24 14:29:02 | 000,069,632 | ---- | C] (Apple Inc.) -- C:\WINDOWS\SysWow64\QuickTime.qts
[2011/10/23 17:43:02 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\SysWow64\javaws.exe
[2011/10/23 17:43:02 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\SysWow64\javaw.exe
[2011/10/23 17:43:02 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\SysWow64\java.exe
[2011/10/18 22:42:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Ubisoft
[2011/10/17 22:32:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\HideIPEasy
[2011/10/17 10:30:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\HideIPEasy
[2011/10/12 19:16:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\solcache
[2011/10/12 19:02:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sierra On-Line
[2011/10/12 15:56:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\FoxTab Video To MP3
[2011/10/12 15:56:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FoxTabVideoToMP3
[2011/10/12 15:52:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\JockerSoft
[2011/10/12 15:52:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\JockerSoft
[2011/10/12 15:52:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\CodecInstaller
[2011/10/12 15:36:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\AVS4YOU
[2011/10/12 15:35:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVS4YOU
[2011/10/12 15:33:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\AVS4YOU
[2011/10/12 15:31:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\AVS4YOU
[2011/10/12 15:31:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\AVSMedia
[2011/10/12 15:31:09 | 000,974,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\SysWow64\mfc70.dll
[2011/10/12 15:31:09 | 000,487,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\SysWow64\msvcp70.dll
[2011/10/12 15:31:09 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\SysWow64\msxml3a.dll
[2011/10/12 15:31:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVS4YOU
[2011/10/12 15:00:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2011/10/12 14:58:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NCH Swift Sound
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\SysWow64\*.tmp files -> C:\WINDOWS\SysWow64\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/11/10 11:28:22 | 000,000,908 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/11/10 11:28:03 | 000,023,080 | ---- | M] (Windows ® Server 2003 DDK provider) -- C:\WINDOWS\gdrv.sys
[2011/11/10 11:27:28 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/11/10 11:23:47 | 000,024,536 | ---- | M] () -- C:\WINDOWS\cscmondump.bin
[2011/11/10 10:13:58 | 009,870,068 | ---- | M] () -- C:\WINDOWS\CSC_ActiveCleanLog.dat
[2011/11/10 10:13:58 | 000,440,478 | ---- | M] () -- C:\WINDOWS\CSC_ServiceDump.dat
[2011/11/10 09:42:07 | 000,000,912 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/11/09 23:16:15 | 000,201,816 | ---- | M] () -- C:\WINDOWS\SysWow64\PnkBstrB.exe
[2011/11/09 23:16:15 | 000,201,816 | ---- | M] () -- C:\WINDOWS\SysWow64\PnkBstrB.ex0
[2011/11/09 20:59:50 | 000,000,288 | ---- | M] () -- C:\WINDOWS\tasks\meoShakeIcon.job
[2011/11/09 20:18:27 | 000,000,830 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/11/09 20:13:00 | 000,016,832 | ---- | M] () -- C:\WINDOWS\SysWow64\amcompat.tlb
[2011/11/09 20:12:59 | 000,023,392 | ---- | M] () -- C:\WINDOWS\SysWow64\nscompat.tlb
[2011/11/09 15:46:08 | 000,000,466 | ---- | M] () -- C:\WINDOWS\tasks\COMODO Updater.job
[2011/11/09 11:24:44 | 000,000,450 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{FD05BF6F-7FF7-43A5-AC6E-54A8B757702E}.job
[2011/11/09 10:12:56 | 000,001,653 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\COMODO Internet Security.lnk
[2011/11/08 22:31:01 | 000,000,296 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/11/08 16:45:09 | 000,017,408 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\WebpageIcons.db
[2011/11/08 16:11:51 | 000,002,545 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Microsoft Office Outlook 2007.lnk
[2011/11/08 11:13:35 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2011/11/07 10:29:36 | 003,155,647 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\r2400_ug.pdf
[2011/11/06 20:16:51 | 000,051,712 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/11/05 20:15:13 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011/11/03 11:01:28 | 000,016,711 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Talktalk webspace.htm
[2011/11/03 10:48:45 | 000,310,457 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Webspace.pdf
[2011/11/02 16:32:56 | 001,564,464 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Administrator\Desktop\tdsskiller.exe
[2011/11/02 09:57:55 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\SysWow64\FlashPlayerCPLApp.cpl
[2011/11/01 09:57:16 | 000,000,805 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Comodo Dragon.lnk
[2011/10/31 18:06:09 | 000,000,936 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Adobe Dreamweaver CS5.5.lnk
[2011/10/31 02:00:00 | 000,000,370 | ---- | M] () -- C:\WINDOWS\tasks\AdobeAAMUpdater-1.0-CELLARPOWER-Administrator.job
[2011/10/27 09:30:55 | 000,000,251 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Setting.dat
[2011/10/27 09:21:46 | 000,000,022 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\UserFlag.ini
[2011/10/26 10:19:03 | 005,434,009 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Toshiba C660 Review at D.I.D Electrical - YouTube.flv
[2011/10/24 14:29:02 | 000,094,208 | ---- | M] (Apple Inc.) -- C:\WINDOWS\SysWow64\QuickTimeVR.qtx
[2011/10/24 14:29:02 | 000,069,632 | ---- | M] (Apple Inc.) -- C:\WINDOWS\SysWow64\QuickTime.qts
[2011/10/18 23:05:05 | 000,075,136 | ---- | M] () -- C:\WINDOWS\SysWow64\PnkBstrA.exe
[2011/10/18 22:49:54 | 000,001,816 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Far Cry® 2.lnk
[2011/10/16 12:48:05 | 000,001,908 | ---- | M] () -- C:\WINDOWS\diagwrn.xml
[2011/10/16 12:48:05 | 000,001,908 | ---- | M] () -- C:\WINDOWS\diagerr.xml
[2011/10/15 12:06:23 | 000,001,510 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Sound Recorder.lnk
[2011/10/13 13:03:16 | 000,626,688 | ---- | M] () -- C:\WINDOWS\SysWow64\PerfStringBackup.INI
[2011/10/12 15:56:55 | 000,000,810 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\FoxTab Video To MP3.lnk
[2011/10/12 15:01:58 | 000,009,728 | ---- | M] () -- C:\WINDOWS\SysWow64\BASSMOD.dll
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\SysWow64\*.tmp files -> C:\WINDOWS\SysWow64\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/11/09 20:59:49 | 000,000,288 | ---- | C] () -- C:\WINDOWS\tasks\meoShakeIcon.job
[2011/11/09 10:12:56 | 000,001,653 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\COMODO Internet Security.lnk
[2011/11/08 16:45:04 | 000,017,408 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\WebpageIcons.db
[2011/11/07 10:19:40 | 003,155,647 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\r2400_ug.pdf
[2011/11/03 11:01:28 | 000,016,711 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Talktalk webspace.htm
[2011/11/03 10:50:19 | 000,310,457 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Webspace.pdf
[2011/11/01 09:57:16 | 000,000,805 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Comodo Dragon.lnk
[2011/10/31 18:06:09 | 000,000,936 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Adobe Dreamweaver CS5.5.lnk
[2011/10/31 16:54:51 | 000,000,936 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Dreamweaver CS5.5.lnk
[2011/10/31 16:51:35 | 000,001,068 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Extension Manager CS5.5.lnk
[2011/10/31 16:51:23 | 000,001,218 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe ExtendScript Toolkit CS5.5.lnk
[2011/10/31 16:51:10 | 000,000,967 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Device Central CS5.5.lnk
[2011/10/31 16:49:57 | 000,000,858 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Widget Browser.lnk
[2011/10/31 16:49:19 | 000,000,758 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Help.lnk
[2011/10/27 09:21:46 | 000,000,251 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\Setting.dat
[2011/10/27 09:21:46 | 000,000,022 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\UserFlag.ini
[2011/10/26 10:18:17 | 005,434,009 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Toshiba C660 Review at D.I.D Electrical - YouTube.flv
[2011/10/18 22:49:54 | 000,001,816 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Far Cry® 2.lnk
[2011/10/16 12:39:10 | 000,001,908 | ---- | C] () -- C:\WINDOWS\diagwrn.xml
[2011/10/16 12:39:10 | 000,001,908 | ---- | C] () -- C:\WINDOWS\diagerr.xml
[2011/10/12 15:56:55 | 000,000,810 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\FoxTab Video To MP3.lnk
[2011/10/12 15:01:58 | 000,009,728 | ---- | C] () -- C:\WINDOWS\SysWow64\BASSMOD.dll
[2011/09/19 10:26:07 | 000,004,096 | ---- | C] () -- C:\WINDOWS\SysWow64\HDREfexProFC64.dll
[2011/09/12 18:06:41 | 000,120,200 | ---- | C] () -- C:\WINDOWS\SysWow64\DLLDEV32i.dll
[2011/09/10 22:20:55 | 009,870,068 | ---- | C] () -- C:\WINDOWS\CSC_ActiveCleanLog.dat
[2011/09/10 22:20:55 | 000,440,478 | ---- | C] () -- C:\WINDOWS\CSC_ServiceDump.dat
[2011/09/10 12:49:19 | 000,024,536 | ---- | C] () -- C:\WINDOWS\cscmondump.bin
[2011/09/07 09:23:26 | 000,000,029 | ---- | C] () -- C:\WINDOWS\DEBUGSM.INI
[2011/07/31 18:31:38 | 003,854,848 | ---- | C] () -- C:\WINDOWS\SysWow64\ffmpeg.dll
[2011/07/19 19:08:04 | 000,074,752 | ---- | C] () -- C:\WINDOWS\SysWow64\ff_vfw.dll
[2011/07/19 19:06:48 | 000,259,584 | ---- | C] () -- C:\WINDOWS\SysWow64\TomsMoComp_ff.dll
[2011/07/19 19:06:36 | 000,158,208 | ---- | C] () -- C:\WINDOWS\SysWow64\ff_unrar.dll
[2011/07/19 19:06:34 | 001,524,224 | ---- | C] () -- C:\WINDOWS\SysWow64\ff_samplerate.dll
[2011/07/19 19:06:34 | 000,096,768 | ---- | C] () -- C:\WINDOWS\SysWow64\ff_wmv9.dll
[2011/07/19 19:06:32 | 000,145,920 | ---- | C] () -- C:\WINDOWS\SysWow64\ff_libmad.dll
[2011/07/19 19:06:30 | 000,136,704 | ---- | C] () -- C:\WINDOWS\SysWow64\libmpeg2_ff.dll
[2011/07/19 19:06:30 | 000,113,664 | ---- | C] () -- C:\WINDOWS\SysWow64\ff_liba52.dll
[2011/07/19 19:06:28 | 000,327,680 | ---- | C] () -- C:\WINDOWS\SysWow64\ff_libfaad2.dll
[2011/07/19 19:06:28 | 000,211,456 | ---- | C] () -- C:\WINDOWS\SysWow64\ff_libdts.dll
[2011/07/12 14:52:47 | 000,000,132 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Adobe PNG Format CS5 Prefs
[2011/07/12 14:51:32 | 000,000,132 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Adobe GIF Format CS5 Prefs
[2011/07/08 14:23:16 | 000,051,712 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/06/09 09:34:51 | 000,001,759 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2011/05/30 13:42:50 | 000,240,640 | ---- | C] () -- C:\WINDOWS\SysWow64\xvidvfw.dll
[2011/05/23 07:46:30 | 000,645,632 | ---- | C] () -- C:\WINDOWS\SysWow64\xvidcore.dll
[2011/05/09 12:55:12 | 000,000,132 | ---- | C] () -- C:\Documents and Settings\Administrator\Application Data\Adobe BMP Format CS5 Prefs
[2011/05/03 13:59:07 | 000,005,248 | ---- | C] () -- C:\WINDOWS\SysWow64\giveio.sys
[2011/04/26 16:24:35 | 000,111,932 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPrinterDB.dat
[2011/04/26 16:24:35 | 000,031,053 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPattern131.dat
[2011/04/26 16:24:35 | 000,027,417 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPattern121.dat
[2011/04/26 16:24:35 | 000,026,154 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPattern1.dat
[2011/04/26 16:24:35 | 000,024,903 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPattern3.dat
[2011/04/26 16:24:35 | 000,021,390 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPattern5.dat
[2011/04/26 16:24:35 | 000,020,148 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPattern2.dat
[2011/04/26 16:24:35 | 000,011,811 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPattern4.dat
[2011/04/26 16:24:35 | 000,004,943 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPattern6.dat
[2011/04/26 16:24:35 | 000,001,146 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPresetData_DU.dat
[2011/04/26 16:24:35 | 000,001,139 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPresetData_PT.dat
[2011/04/26 16:24:35 | 000,001,139 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPresetData_BP.dat
[2011/04/26 16:24:35 | 000,001,136 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPresetData_ES.dat
[2011/04/26 16:24:35 | 000,001,129 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPresetData_FR.dat
[2011/04/26 16:24:35 | 000,001,129 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPresetData_CF.dat
[2011/04/26 16:24:35 | 000,001,120 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPresetData_IT.dat
[2011/04/26 16:24:35 | 000,001,107 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPresetData_GE.dat
[2011/04/26 16:24:35 | 000,001,104 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPresetData_EN.dat
[2011/04/26 16:24:35 | 000,000,097 | ---- | C] () -- C:\WINDOWS\SysWow64\PICSDK.ini
[2011/04/26 16:18:08 | 000,000,025 | ---- | C] () -- C:\WINDOWS\CDER2400.ini
[2011/04/23 21:26:04 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2011/04/22 10:20:53 | 000,000,032 | ---- | C] () -- C:\WINDOWS\SysWow64\EUOD.DAT
[2011/04/19 10:18:45 | 000,201,816 | ---- | C] () -- C:\WINDOWS\SysWow64\PnkBstrB.exe
[2011/04/19 10:18:44 | 000,837,192 | ---- | C] () -- C:\WINDOWS\SysWow64\pbsvc.exe
[2011/04/19 10:18:44 | 000,075,136 | ---- | C] () -- C:\WINDOWS\SysWow64\PnkBstrA.exe
[2011/04/19 09:51:42 | 000,002,623 | ---- | C] () -- C:\WINDOWS\Irremote.ini
[2011/04/10 15:40:02 | 000,626,688 | ---- | C] () -- C:\WINDOWS\SysWow64\PerfStringBackup.INI
[2011/04/10 15:19:25 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2011/04/10 14:38:20 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2011/04/10 13:58:01 | 000,037,376 | R--- | C] () -- C:\WINDOWS\CPLUTL64.EXE
[2011/03/03 11:40:08 | 000,150,528 | ---- | C] () -- C:\WINDOWS\SysWow64\mkx.dll
[2011/03/03 11:39:56 | 000,109,568 | ---- | C] () -- C:\WINDOWS\SysWow64\avi.dll
[2011/03/03 11:39:46 | 000,141,824 | ---- | C] () -- C:\WINDOWS\SysWow64\mp4.dll
[2011/03/03 11:39:34 | 000,123,392 | ---- | C] () -- C:\WINDOWS\SysWow64\ogm.dll
[2011/03/03 11:39:02 | 000,113,152 | ---- | C] () -- C:\WINDOWS\SysWow64\dsmux.exe
[2011/03/03 11:38:54 | 000,154,112 | ---- | C] () -- C:\WINDOWS\SysWow64\ts.dll
[2011/03/03 11:38:40 | 000,249,856 | ---- | C] () -- C:\WINDOWS\SysWow64\dxr.dll
[2011/03/03 11:38:10 | 000,097,792 | ---- | C] () -- C:\WINDOWS\SysWow64\avs.dll
[2011/03/03 11:38:04 | 000,137,728 | ---- | C] () -- C:\WINDOWS\SysWow64\mkv2vfr.exe
[2011/03/03 11:37:50 | 000,093,184 | ---- | C] () -- C:\WINDOWS\SysWow64\avss.dll
[2011/03/03 11:37:40 | 000,358,400 | ---- | C] () -- C:\WINDOWS\SysWow64\gdsmux.exe
[2011/03/03 11:35:32 | 000,080,384 | ---- | C] () -- C:\WINDOWS\SysWow64\mkzlib.dll
[2011/03/03 11:35:26 | 000,024,576 | ---- | C] () -- C:\WINDOWS\SysWow64\mkunicode.dll
[2010/10/03 22:16:26 | 000,302,592 | ---- | C] () -- C:\WINDOWS\SysWow64\HDREfexProFC32.dll
[2010/08/18 19:56:38 | 000,000,151 | ---- | C] () -- C:\WINDOWS\SysWow64\Registration.ini
[2009/08/11 21:21:26 | 000,087,552 | ---- | C] () -- C:\WINDOWS\SysWow64\ac3config.exe
[2009/08/11 21:21:20 | 001,021,440 | ---- | C] () -- C:\WINDOWS\SysWow64\ac3filter_intl.dll
[2009/03/21 08:47:30 | 000,001,024 | ---- | C] () -- C:\WINDOWS\SysWow64\r0vdmyq.dll
[2009/03/21 08:47:30 | 000,001,024 | ---- | C] () -- C:\WINDOWS\SysWow64\grcauth2.dll
[2009/03/21 08:47:30 | 000,001,024 | ---- | C] () -- C:\WINDOWS\SysWow64\grcauth1.dll
[2009/03/21 08:47:30 | 000,001,024 | ---- | C] () -- C:\WINDOWS\SysWow64\clauth2.dll
[2009/03/21 08:47:30 | 000,001,024 | ---- | C] () -- C:\WINDOWS\SysWow64\clauth1.dll
[2009/03/21 08:47:30 | 000,000,334 | ---- | C] () -- C:\WINDOWS\SysWow64\pp76706.dll
[2009/03/21 08:47:30 | 000,000,100 | ---- | C] () -- C:\WINDOWS\SysWow64\prsgrc.dll
[2009/03/21 08:47:30 | 000,000,072 | ---- | C] () -- C:\WINDOWS\SysWow64\ssprs.dll
[2009/03/21 08:47:30 | 000,000,016 | -H-- | C] () -- C:\WINDOWS\SysWow64\f7d1p74.dll
[2008/11/06 15:37:32 | 003,596,288 | ---- | C] () -- C:\WINDOWS\SysWow64\qt-dx331.dll
[2006/03/04 04:52:00 | 000,088,576 | ---- | C] () -- C:\WINDOWS\SysWow64\OptimFROG.dll
[2005/03/25 12:00:00 | 001,278,464 | ---- | C] () -- C:\WINDOWS\SysWow64\quartz.dll
[2005/03/25 12:00:00 | 000,733,696 | ---- | C] () -- C:\WINDOWS\SysWow64\qedwipes.dll
[2005/03/25 12:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\SysWow64\mlang.dat
[2005/03/25 12:00:00 | 000,512,512 | ---- | C] () -- C:\WINDOWS\SysWow64\qedit.dll
[2005/03/25 12:00:00 | 000,498,742 | ---- | C] () -- C:\WINDOWS\SysWow64\dxmasf.dll
[2005/03/25 12:00:00 | 000,396,288 | ---- | C] () -- C:\WINDOWS\SysWow64\encdec.dll
[2005/03/25 12:00:00 | 000,385,536 | ---- | C] () -- C:\WINDOWS\SysWow64\qdvd.dll
[2005/03/25 12:00:00 | 000,355,112 | ---- | C] () -- C:\WINDOWS\SysWow64\msjetoledb40.dll
[2005/03/25 12:00:00 | 000,279,040 | ---- | C] () -- C:\WINDOWS\SysWow64\qdv.dll
[2005/03/25 12:00:00 | 000,276,992 | ---- | C] () -- C:\WINDOWS\SysWow64\sbe.dll
[2005/03/25 12:00:00 | 000,199,168 | ---- | C] () -- C:\WINDOWS\SysWow64\ir32_32.dll
[2005/03/25 12:00:00 | 000,192,512 | ---- | C] () -- C:\WINDOWS\SysWow64\qcap.dll
[2005/03/25 12:00:00 | 000,114,688 | ---- | C] () -- C:\WINDOWS\SysWow64\msencode.dll
[2005/03/25 12:00:00 | 000,072,704 | ---- | C] () -- C:\WINDOWS\SysWow64\amstream.dll
[2005/03/25 12:00:00 | 000,062,464 | ---- | C] () -- C:\WINDOWS\SysWow64\mciqtz32.dll
[2005/03/25 12:00:00 | 000,061,440 | ---- | C] () -- C:\WINDOWS\SysWow64\devenum.dll
[2005/03/25 12:00:00 | 000,055,808 | ---- | C] () -- C:\WINDOWS\SysWow64\dvdplay.exe
[2005/03/25 12:00:00 | 000,046,907 | ---- | C] () -- C:\WINDOWS\mib.bin
[2005/03/25 12:00:00 | 000,016,896 | ---- | C] () -- C:\WINDOWS\SysWow64\tsd32.dll
[2005/03/25 12:00:00 | 000,014,336 | ---- | C] () -- C:\WINDOWS\SysWow64\msdmo.dll
[2005/03/25 12:00:00 | 000,012,498 | ---- | C] () -- C:\WINDOWS\SysWow64\append.exe
[2005/03/25 12:00:00 | 000,004,126 | ---- | C] () -- C:\WINDOWS\SysWow64\msdxmlc.dll
[2005/03/25 12:00:00 | 000,001,129 | ---- | C] () -- C:\WINDOWS\SysWow64\vwipxspx.exe

< End of report >

Attached Files

  • Attached File  OTL.Txt   105.49KB   139 downloads

  • 0

#15
RKinner
Posted 10 November 2011 - 11:47 AM

RKinner

    Malware Expert

  • Expert
  • 24,624 posts
  • MVP
The two babylon entries are dead buttons in IE.

If this doesn't fly you may need to use System Restore to get back on line so make sure it is running.

Copy the text in the code box by highlighting and Ctrl + c 


:processes
killallprocesses

:OTL
O9 - Extra Button: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - res://C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm File not found
O9 - Extra 'Tools' menuitem : Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - res://C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000001 [] - %SystemRoot%\System32\mswsock.dll File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000002 [] - %SystemRoot%\System32\winrnr.dll File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000003 [] - %SystemRoot%\System32\mswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - %SystemRoot%\system32\mswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - %SystemRoot%\system32\mswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - %SystemRoot%\system32\mswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - %SystemRoot%\system32\mswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - %SystemRoot%\system32\mswsock.dll File not found

:files
C:\Windows\System32\consrv.dll
mkdir \Windows\System32\consrv.dll /c
dir /a /s \windows\assembly\temp /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems" /s /c
     
:Commands
[EMPTYTEMP]
[purity]
[Reboot]

Pause Comodo's anti-virus and then Rightclick on OTL and select Run As Administrator to start. Under the Custom Scans/Fixes box at the bottom, paste (ctrl +v) the text. Verify that you got it all and Then click the RUN FIX button (NOT THE QUICK SCAN button!) at the top
Let the program run unhindered, OTL will reboot the PC when it is done. Copy and Paste the log into a reply.

Run OTL again, quickscan and post the log.

Ron
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP