I have a laptop running Vista that has been very badly infected by what shows up as win32 patched Hn and Win32/Sirefef.CH trojan
It wouldnt allow us to run any exe files, or access any anti virus or malware software.
I created a second user and managed to get eset online scanner running which detected 13 threats listed as Trojan.win32. Patched.mf, win32, jorik.xtoober, trojan.psw.win32., backdoor.win32.zacess.avy
after scanning I rebooted and logged into the main user, tried to install and run MAMB. it failed again.
I found your thread on malware removal and tried first the exehelper, and rkill which seemed to help a little as I was able to install MAMB on the main user, it found 3 threats one listed as a rootkit, after fixing and rebooting however it now crashes MAMB.
Next I tried VIPERresue which gave me a warning - could not enable root kit engine and crashed halfway through scan.
I really have exhausted my knowledge and ability to get rid of this thing now so would very much appreciate any help and advise.
I have also finally managed to run a completed eset online scanner scan and here is the results -
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe Win32/Patched.HN trojan cleaned - quarantined
C:\Windows\System32\drivers\afd.sys Win32/Sirefef.DA trojan unable to clean
C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.18457_none_d99fb42e5bb59d9b\afd.sys Win32/Sirefef.DA trojan cleaned by deleting - quarantined
Operating memory a variant of Win32/Sirefef.CH trojan
the following is the OTL log
OTL logfile created on: 05/01/2012 12:36:38 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = E:\
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19170)
Locale: 00001809 | Country: Ireland | Language: ENI | Date Format: dd/MM/yyyy
1.75 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 57.16% Memory free
3.74 Gb Paging File | 3.02 Gb Available in Paging File | 80.83% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 103.78 Gb Total Space | 23.64 Gb Free Space | 22.78% Space Free | Partition Type: NTFS
Drive E: | 1.85 Gb Total Space | 1.64 Gb Free Space | 88.57% Space Free | Partition Type: FAT32
Computer Name: ELLA-PC | User Name: Ella | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2012/01/05 11:52:26 | 000,584,192 | ---- | M] (OldTimer Tools) -- E:\OTL.exe
PRC - [2011/12/24 17:50:18 | 000,460,872 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2010/06/26 18:09:18 | 000,167,936 | ---- | M] (Applian Technologies, Inc.) -- C:\Program Files\Freecorder\FLVSrvc.exe
PRC - [2009/04/11 06:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/11/20 20:56:07 | 000,185,872 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2007/07/25 17:45:38 | 000,643,072 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Program Files\Realtek Semiconductor Corp\Realtek Card Reader Monitor\CardReaderMonitor.exe
========== Modules (No Company Name) ==========
MOD - [2009/11/03 15:51:42 | 000,067,872 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2009/11/03 15:51:26 | 000,039,712 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\ASL.dll
MOD - [2009/04/11 06:28:22 | 000,223,232 | ---- | M] () -- \\?\globalroot\systemroot\system32\mswsock.dll
========== Win32 Services (SafeList) ==========
SRV - [2012/01/04 15:15:40 | 000,532,480 | ---- | M] () [Auto | Stopped] -- C:\Windows\System32\dlcfcoms.exe -- (dlcf_device)
SRV - [2012/01/04 15:15:12 | 000,049,152 | ---- | M] () [Auto | Stopped] -- C:\Windows\System32\sdpasvc.exe -- (SDPASVC)
SRV - [2012/01/04 14:40:37 | 000,049,152 | ---- | M] () [Auto | Stopped] -- C:\Program Files\CNC\SD-JukeboxV2\sdjbmgr.exe -- (SDJB Manager)
SRV - [2011/12/24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
========== Driver Services (SafeList) ==========
DRV - [2012/01/04 16:33:49 | 000,133,208 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\00961993.sys -- (00961993)
DRV - [2011/12/10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2009/09/10 12:55:58 | 000,102,912 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2009/07/24 13:51:38 | 000,101,248 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbdev.sys -- (hwusbdev)
DRV - [2009/04/11 04:46:08 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usb8023.sys -- (USB_RNDIS)
DRV - [2007/11/14 15:20:08 | 000,020,936 | ---- | M] (MIDIMAN) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usb22ldr.sys -- (USB22LDR)
DRV - [2007/11/14 15:20:04 | 000,031,752 | ---- | M] (M-Audio) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\MA_CMIDI.SYS -- (MA_CMIDI)
DRV - [2007/11/05 11:59:10 | 000,182,272 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CHDART.sys -- (HdAudAddService)
DRV - [2007/10/05 22:59:40 | 000,288,256 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTL8187B.sys -- (RTL8187B)
DRV - [2007/09/19 12:05:00 | 007,626,400 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007/09/07 11:34:38 | 000,943,016 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vm331avs.sys -- (vm331avs)
DRV - [2007/03/06 05:15:58 | 001,059,112 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2007/02/16 00:50:32 | 000,012,032 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2007/01/04 11:15:08 | 000,009,336 | ---- | M] (http://www.internals.com) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\WinIo.sys -- (WINIO)
DRV - [1999/09/10 11:06:00 | 000,025,244 | ---- | M] (Adaptec) [Kernel | System | Running] -- C:\Windows\System32\drivers\ASPI32.SYS -- (ASPI32)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://uk.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.rd.yahoo.c...earch.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.c...earch.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com
IE - HKLM\..\URLSearchHook: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\prxtbFre2.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {32b29df0-2237-4370-9a29-37cebb730e9b} - C:\Program Files\FreeSoundRecorder\prxtbFre0.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {3303e956-2a3a-48e0-be39-2e0ef11a2f44} - C:\Program Files\Power_Karaoke\tbPowe.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {37483b40-c254-4a72-bda4-22ee90182c1e} - C:\Program Files\NCH_EN\prxtbNCH_.dll (Conduit Ltd.)
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.google.co...w.facebook.com/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.condui...&ctid=CT2704262
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\prxtbFre2.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {32b29df0-2237-4370-9a29-37cebb730e9b} - C:\Program Files\FreeSoundRecorder\prxtbFre0.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {3303e956-2a3a-48e0-be39-2e0ef11a2f44} - C:\Program Files\Power_Karaoke\tbPowe.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {37483b40-c254-4a72-bda4-22ee90182c1e} - C:\Program Files\NCH_EN\prxtbNCH_.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Users\Ella\Pictures\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.69: C:\Users\Ella\Pictures\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Users\Ella\Pictures\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
[2010/09/03 18:15:38 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2008/01/16 14:34:09 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010/04/12 13:01:54 | 000,002,476 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\BearShareWebSearch.xml
O1 HOSTS File: ([2006/09/18 21:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Freecorder Toolbar) - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\prxtbFre2.dll (Conduit Ltd.)
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (FreeSoundRecorder Toolbar) - {32b29df0-2237-4370-9a29-37cebb730e9b} - C:\Program Files\FreeSoundRecorder\prxtbFre0.dll (Conduit Ltd.)
O2 - BHO: (Power Karaoke Toolbar) - {3303e956-2a3a-48e0-be39-2e0ef11a2f44} - C:\Program Files\Power_Karaoke\tbPowe.dll (Conduit Ltd.)
O2 - BHO: (NCH EN Toolbar) - {37483b40-c254-4a72-bda4-22ee90182c1e} - C:\Program Files\NCH_EN\prxtbNCH_.dll (Conduit Ltd.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Freecorder Toolbar) - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\prxtbFre2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (FreeSoundRecorder Toolbar) - {32b29df0-2237-4370-9a29-37cebb730e9b} - C:\Program Files\FreeSoundRecorder\prxtbFre0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Power Karaoke Toolbar) - {3303e956-2a3a-48e0-be39-2e0ef11a2f44} - C:\Program Files\Power_Karaoke\tbPowe.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (NCH EN Toolbar) - {37483b40-c254-4a72-bda4-22ee90182c1e} - C:\Program Files\NCH_EN\prxtbNCH_.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Freecorder Toolbar) - {1392B8D2-5C05-419F-A8F6-B9F15A596612} - C:\Program Files\Freecorder\prxtbFre2.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (FreeSoundRecorder Toolbar) - {32B29DF0-2237-4370-9A29-37CEBB730E9B} - C:\Program Files\FreeSoundRecorder\prxtbFre0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Power Karaoke Toolbar) - {3303E956-2A3A-48E0-BE39-2E0EF11A2F44} - C:\Program Files\Power_Karaoke\tbPowe.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (NCH EN Toolbar) - {37483B40-C254-4A72-BDA4-22EE90182C1E} - C:\Program Files\NCH_EN\prxtbNCH_.dll (Conduit Ltd.)
O4 - HKLM..\Run: [CardReaderMonitor] C:\Program Files\Realtek Semiconductor Corp\Realtek Card Reader Monitor\CardReaderMonitor.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [DLCFCATS] C:\Windows\System32\spool\DRIVERS\W32X86\3\DLCFtime.DLL ()
O4 - HKLM..\Run: [Freecorder FLV Service] C:\Program Files\Freecorder\FLVSrvc.exe (Applian Technologies, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe ( )
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000027 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - %SystemRoot%\System32\winrnr.dll File not found
O13 - gopher Prefix: missing
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab (OnlineScanner Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{043BB8E8-70A0-4C66-993B-AFA1BEF1F80D}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CEE08E6A-C23A-4E72-82D6-CF5B8E8034F4}: DhcpNameServer = 192.168.0.1
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) -Explorer.exe ()
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Ella\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Ella\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 21:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{2ea6f88a-4f5e-11dd-9537-0015af6e8533}\Shell - "" = AutoRun
O33 - MountPoints2\{2ea6f88a-4f5e-11dd-9537-0015af6e8533}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{7cc4c3dc-3eb2-11dd-918a-0015af6e8533}\Shell - "" = AutoRun
O33 - MountPoints2\{7cc4c3dc-3eb2-11dd-918a-0015af6e8533}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{852cfb9a-1937-11dd-8bec-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{852cfb9a-1937-11dd-8bec-806e6f6e6963}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{90ada5c8-b797-11df-94ca-0015af6e8533}\Shell - "" = AutoRun
O33 - MountPoints2\{90ada5c8-b797-11df-94ca-0015af6e8533}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{90ada5ee-b797-11df-94ca-0015af6e8533}\Shell - "" = AutoRun
O33 - MountPoints2\{90ada5ee-b797-11df-94ca-0015af6e8533}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{be7efa04-153c-11dd-bd3c-0015af6e8533}\Shell - "" = AutoRun
O33 - MountPoints2\{be7efa04-153c-11dd-bd3c-0015af6e8533}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found
========== Files/Folders - Created Within 30 Days ==========
File not found -- C:\Windows\System32\
[2012/01/05 09:55:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/01/05 09:55:16 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012/01/04 17:08:30 | 000,133,208 | ---- | C] (Kaspersky Lab ZAO) -- C:\Windows\System32\drivers\00961993.sys
[2012/01/04 13:33:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab
[2012/01/04 13:29:37 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012/01/04 13:01:17 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012/01/03 20:27:12 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012/01/03 20:05:24 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2012/01/03 20:00:54 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2012/01/02 22:11:59 | 000,000,000 | -HSD | C] -- C:\Windows\System32\%APPDATA%
[2012/01/02 22:08:08 | 000,000,000 | -HSD | C] -- C:\Users\Ella\AppData\Local\37a96981
[2011/12/20 16:41:03 | 002,043,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2011/12/20 16:40:59 | 003,602,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2011/12/20 16:40:58 | 003,550,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2011/12/20 16:40:55 | 000,429,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll
[2011/12/20 16:40:52 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\csrsrv.dll
[2011/12/20 16:40:21 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2011/12/20 16:39:00 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2011/12/20 16:38:56 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2011/12/20 16:38:46 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2011/12/20 16:38:46 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011/12/20 16:38:45 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2011/12/20 16:38:45 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2011/12/20 16:38:45 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2011/12/20 16:38:44 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2011/12/20 16:38:44 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2011/12/20 16:38:44 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2011/12/20 16:38:43 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2011/12/20 16:38:43 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2011/12/20 16:38:42 | 000,174,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2011/12/20 16:38:42 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2011/12/20 16:38:42 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2011/12/20 16:38:42 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2011/12/20 16:38:41 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2011/12/20 16:38:41 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2008/01/16 14:24:49 | 000,131,072 | ---- | C] ( ) -- C:\Windows\vm331Rmv.exe
[2006/11/01 21:15:50 | 000,385,928 | ---- | C] ( ) -- C:\Windows\System32\dlcfih.exe
[2006/11/01 21:15:48 | 000,381,832 | ---- | C] ( ) -- C:\Windows\System32\dlcfcfg.exe
[2006/10/11 17:01:40 | 000,643,072 | ---- | C] ( ) -- C:\Windows\System32\dlcfpmui.dll
[2006/10/11 16:59:56 | 001,224,704 | ---- | C] ( ) -- C:\Windows\System32\dlcfserv.dll
[2006/10/11 16:54:10 | 000,421,888 | ---- | C] ( ) -- C:\Windows\System32\dlcfcomm.dll
[2006/10/11 16:52:34 | 000,585,728 | ---- | C] ( ) -- C:\Windows\System32\dlcflmpm.dll
[2006/10/11 16:51:16 | 000,397,312 | ---- | C] ( ) -- C:\Windows\System32\dlcfiesc.dll
[2006/10/11 16:48:58 | 000,094,208 | ---- | C] ( ) -- C:\Windows\System32\dlcfpplc.dll
[2006/10/11 16:48:14 | 000,684,032 | ---- | C] ( ) -- C:\Windows\System32\dlcfcomc.dll
[2006/10/11 16:47:42 | 000,163,840 | ---- | C] ( ) -- C:\Windows\System32\dlcfprox.dll
[2006/10/11 16:41:42 | 000,413,696 | ---- | C] ( ) -- C:\Windows\System32\dlcfinpa.dll
[2006/10/11 16:41:04 | 000,991,232 | ---- | C] ( ) -- C:\Windows\System32\dlcfusb1.dll
[2006/10/11 16:37:14 | 000,696,320 | ---- | C] ( ) -- C:\Windows\System32\dlcfhbn3.dll
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
File not found -- C:\Windows\System32\
[2012/01/05 12:35:23 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{8AF5E251-A4AD-44D2-B556-9E8B8E0EDAB4}.job
[2012/01/05 12:34:16 | 000,027,240 | ---- | M] () -- C:\Users\Ella\AppData\Roaming\nvModes.001
[2012/01/05 12:34:06 | 000,000,878 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/01/05 12:33:36 | 000,608,706 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/01/05 12:33:36 | 000,109,542 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/01/05 12:30:00 | 000,000,338 | ---- | M] () -- C:\Windows\tasks\Recovery DVD Creator.job
[2012/01/05 12:21:48 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/01/05 12:21:48 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/01/05 12:21:41 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/01/05 11:49:07 | 000,000,000 | ---- | M] () -- C:\Windows\System32\SBRC.dat
[2012/01/05 11:08:01 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/01/05 09:55:25 | 000,000,909 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/01/04 17:35:03 | 295,024,791 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012/01/04 16:33:49 | 000,133,208 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\System32\drivers\00961993.sys
[2012/01/04 15:15:40 | 000,532,480 | ---- | M] () -- C:\Windows\System32\dlcfcoms.exe
[2012/01/04 15:15:12 | 000,049,152 | ---- | M] () -- C:\Windows\System32\sdpasvc.exe
[2012/01/03 20:27:52 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif
[2012/01/03 19:42:50 | 000,010,874 | -HS- | M] () -- C:\Users\Ella\AppData\Local\72x46sy148rwfnw18g1nu7d4lya5y1ibrwps8w2q1d282
[2012/01/03 19:42:50 | 000,010,874 | -HS- | M] () -- C:\ProgramData\72x46sy148rwfnw18g1nu7d4lya5y1ibrwps8w2q1d282
[2012/01/03 19:39:16 | 000,027,240 | ---- | M] () -- C:\Users\Ella\AppData\Roaming\nvModes.dat
[2012/01/01 20:44:54 | 000,057,856 | ---- | M] () -- C:\Users\Ella\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/25 21:01:14 | 000,002,377 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2011/12/22 16:39:54 | 000,339,816 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011/12/10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011/12/07 21:45:34 | 000,027,648 | ---- | M] () -- C:\Users\Ella\Desktop\Documents\Marys Boy Child.wps
[2011/12/07 21:45:34 | 000,005,612 | ---- | M] () -- C:\Users\Ella\AppData\Roaming\wklnhst.dat
[2011/12/07 21:33:11 | 000,010,240 | ---- | M] () -- C:\Users\Ella\Desktop\Documents\Christmas.wps
[2011/12/07 21:28:20 | 000,010,240 | ---- | M] () -- C:\Users\Ella\Desktop\Documents\Silent Night.wps
[2011/12/07 21:24:37 | 000,009,216 | ---- | M] () -- C:\Users\Ella\Desktop\Documents\White Christmas.wps
[2011/12/07 21:21:10 | 000,009,216 | ---- | M] () -- C:\Users\Ella\Desktop\Documents\Jingle Bells.wps
[2011/12/07 21:17:56 | 000,010,752 | ---- | M] () -- C:\Users\Ella\Desktop\Documents\Winter Wonderland.wps
[2011/12/07 21:14:24 | 000,009,728 | ---- | M] () -- C:\Users\Ella\Desktop\Documents\Rudolph The Red Nosed Reindeer.wps
[2011/12/07 21:06:35 | 000,010,240 | ---- | M] () -- C:\Users\Ella\Desktop\Documents\Santa laus Is Coming To Town.wps
[2011/12/07 21:00:53 | 000,009,728 | ---- | M] () -- C:\Users\Ella\Desktop\Documents\I Saw Mommy Kissing Santa Claus.wps
[2011/12/07 20:54:51 | 000,010,240 | ---- | M] () -- C:\Users\Ella\Desktop\Documents\Rocking Around The Christmas Tree.wps
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012/01/05 11:49:07 | 000,000,000 | ---- | C] () -- C:\Windows\System32\SBRC.dat
[2012/01/05 09:55:25 | 000,000,909 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/01/04 13:29:28 | 295,024,791 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012/01/02 22:08:28 | 000,010,874 | -HS- | C] () -- C:\Users\Ella\AppData\Local\72x46sy148rwfnw18g1nu7d4lya5y1ibrwps8w2q1d282
[2012/01/02 22:08:28 | 000,010,874 | -HS- | C] () -- C:\ProgramData\72x46sy148rwfnw18g1nu7d4lya5y1ibrwps8w2q1d282
[2011/12/07 21:44:32 | 000,027,648 | ---- | C] () -- C:\Users\Ella\Desktop\Documents\Marys Boy Child.wps
[2011/12/07 21:33:07 | 000,010,240 | ---- | C] () -- C:\Users\Ella\Desktop\Documents\Christmas.wps
[2011/12/07 21:28:20 | 000,010,240 | ---- | C] () -- C:\Users\Ella\Desktop\Documents\Silent Night.wps
[2011/12/07 21:24:37 | 000,009,216 | ---- | C] () -- C:\Users\Ella\Desktop\Documents\White Christmas.wps
[2011/12/07 21:21:09 | 000,009,216 | ---- | C] () -- C:\Users\Ella\Desktop\Documents\Jingle Bells.wps
[2011/12/07 21:17:49 | 000,010,752 | ---- | C] () -- C:\Users\Ella\Desktop\Documents\Winter Wonderland.wps
[2011/12/07 21:13:46 | 000,009,728 | ---- | C] () -- C:\Users\Ella\Desktop\Documents\Rudolph The Red Nosed Reindeer.wps
[2011/12/07 21:06:35 | 000,010,240 | ---- | C] () -- C:\Users\Ella\Desktop\Documents\Santa laus Is Coming To Town.wps
[2011/12/07 20:58:49 | 000,009,728 | ---- | C] () -- C:\Users\Ella\Desktop\Documents\I Saw Mommy Kissing Santa Claus.wps
[2011/12/07 20:54:51 | 000,010,240 | ---- | C] () -- C:\Users\Ella\Desktop\Documents\Rocking Around The Christmas Tree.wps
[2011/10/17 20:27:49 | 000,038,629 | ---- | C] () -- C:\Users\Ella\AppData\Roaming\WavePad.dmp
[2010/11/24 22:37:27 | 000,000,128 | ---- | C] () -- C:\Windows\cdplayer.ini
[2010/09/03 20:19:23 | 000,071,262 | ---- | C] () -- C:\Windows\Huawei ModemsUninstall.exe
[2010/09/03 19:27:50 | 000,000,092 | ---- | C] () -- C:\Users\Ella\AppData\Local\fusioncache.dat
[2010/08/27 14:24:48 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010/08/16 15:21:32 | 000,000,045 | ---- | C] () -- C:\Windows\System32\SYNSOPOS.exe.cfg
[2010/08/16 15:05:46 | 000,002,892 | ---- | C] () -- C:\Windows\System32\audcon.sys
[2010/08/16 15:03:38 | 000,086,016 | ---- | C] () -- C:\Windows\System32\SYNSOPOS.exe
[2010/03/06 21:12:34 | 000,000,680 | ---- | C] () -- C:\Users\Ella\AppData\Local\d3d9caps.dat
[2009/09/29 16:00:56 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009/09/29 16:00:55 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/09/29 15:59:39 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009/08/13 19:55:09 | 000,049,152 | ---- | C] () -- C:\Windows\System32\sdpasvc.exe
[2009/08/13 19:55:09 | 000,040,960 | ---- | C] () -- C:\Windows\System32\sdsrvctl.exe
[2009/08/03 14:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/08/03 14:07:42 | 000,230,768 | ---- | C] () -- C:\Windows\System32\OGAEXEC.exe
[2008/04/19 23:08:48 | 000,027,240 | ---- | C] () -- C:\Users\Ella\AppData\Roaming\nvModes.001
[2008/04/19 23:03:50 | 000,027,240 | ---- | C] () -- C:\Users\Ella\AppData\Roaming\nvModes.dat
[2008/04/19 22:35:49 | 000,057,856 | ---- | C] () -- C:\Users\Ella\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/04/19 22:29:07 | 000,005,612 | ---- | C] () -- C:\Users\Ella\AppData\Roaming\wklnhst.dat
[2008/01/16 14:24:49 | 000,001,211 | ---- | C] () -- C:\Windows\vm331Rmv.ini
[2008/01/16 14:22:41 | 000,001,732 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2007/07/16 10:16:32 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2007/02/13 07:48:38 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini
[2006/11/02 12:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 12:47:37 | 000,339,816 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 12:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 10:33:01 | 000,608,706 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 10:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 10:33:01 | 000,109,542 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 10:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 10:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 08:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 08:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 07:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 07:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006/11/01 21:15:50 | 000,532,480 | ---- | C] () -- C:\Windows\System32\dlcfcoms.exe
[2006/10/28 09:31:44 | 000,344,064 | ---- | C] () -- C:\Windows\System32\dlcfcoin.dll
[2006/10/20 12:42:24 | 000,106,496 | ---- | C] () -- C:\Windows\System32\dlcfinsr.dll
[2006/10/20 12:42:18 | 000,036,864 | ---- | C] () -- C:\Windows\System32\dlcfcur.dll
[2006/10/20 12:41:46 | 000,131,072 | ---- | C] () -- C:\Windows\System32\dlcfjswr.dll
[2006/10/20 12:37:22 | 000,221,184 | ---- | C] () -- C:\Windows\System32\dlcfinsb.dll
[2006/10/20 12:37:16 | 000,086,016 | ---- | C] () -- C:\Windows\System32\dlcfcub.dll
[2006/10/20 12:37:00 | 000,073,728 | ---- | C] () -- C:\Windows\System32\dlcfcu.dll
[2006/10/20 12:36:54 | 000,159,744 | ---- | C] () -- C:\Windows\System32\dlcfins.dll
[2006/10/20 12:35:36 | 000,434,176 | ---- | C] () -- C:\Windows\System32\dlcfutil.dll
[2006/09/06 04:27:08 | 000,069,632 | ---- | C] () -- C:\Windows\System32\dlcfcfg.dll
[2005/08/18 05:26:46 | 000,040,960 | ---- | C] () -- C:\Windows\System32\dlcfvs.dll
[1997/06/14 00:56:08 | 000,056,832 | ---- | C] () -- C:\Windows\System32\iyvu9_32.dll
========== Files - Unicode (All) ==========
[2011/08/21 21:41:36 | 000,000,000 | ---- | M] ()(C:\Users\Ella\Desktop\??????????????????????????????????) -- C:\Users\Ella\Desktop\㩃啜敳獲䕜汬屡灁䑰瑡屡潒浡湩屧楍牣獯景屴楗摮睯屳潃歯敩屳〸㕖䑍吱琮瑸
[2011/08/21 21:41:36 | 000,000,000 | ---- | C] ()(C:\Users\Ella\Desktop\??????????????????????????????????) -- C:\Users\Ella\Desktop\㩃啜敳獲䕜汬屡灁䑰瑡屡潒浡湩屧楍牣獯景屴楗摮睯屳潃歯敩屳〸㕖䑍吱琮瑸
========== Alternate Data Streams ==========
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\WHEN IRISH EYES ARE SMILING.wav:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\WHAT WOULD YOU DO {F} 1.wav:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\Welcome to my world instrumental.mp3:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\Unstoppable[2010]DvDrip.avi:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\Unknown [2011] DVDRiP.avi:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\The Adjustment Bureau [2011]Dvdrip.avi:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\Salt (2010)R5.Noir.avi:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\PICT5626.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\PICT5625.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\PICT5624.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\PICT5623.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\Pics:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\New Karaokes Sept 2011:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\Hall Pass (2011) DVDRip.avi:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\Gnomeo and Juliet (2011) DVDRip.avi:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\Downloads:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\Documents\Untitled.wma:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\Documents\Test.wma:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\Documents\Sony:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\Documents\PCDJ Recordcase:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\Documents\OneNote Notebooks:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\Documents\My Google Gadgets:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\Documents\Freecorder 4:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\Documents\Free Sound Recorder:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\Documents\BABY:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\Documents\ACID Pro 7.0 Projects:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\Documents\135_3593.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\Documents:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\Backing Tracks:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Ella\Desktop\Baby2:Roxio EMC Stream
< End of report >
edited to Add: have now also sucessfully ran MAMB and it identifies rootkit.0Access .... but seems unable to delete it
Edited by kilkennycat, 05 January 2012 - 01:26 PM.