OK, lost inet connection at home for a bit, here is the previous topic I was working from which I didn't mean to abandon:
http://www.geekstogo...&st=0#msg173505Managed to get a new bug, which cut off inet service again, but after using combofix was able to restore it. Will post both OTL and the most recent combofix log. Since the previous viral removal attempt, autorun has not worked on anything, my removable hds or programs in general (I'm assuming this is what the last person to help me wanted to address). Windows security essentials recently removed the following:
Exploit:Jave/CVE-2012-0507.D!ldr
Trojan:Win32/Alureon.FK
Trojam:Win32/Orsam!rts
Thank you in advance for all of your help!!!
The following is the OTL log, this was run after combofix:
OTL logfile created on: 4/8/2012 8:01:14 PM - Run 8
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Michele\Desktop\Comp Cleanup
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
2.96 Gb Total Physical Memory | 0.72 Gb Available Physical Memory | 24.31% Memory free
5.77 Gb Paging File | 3.85 Gb Available in Paging File | 66.71% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 188.93 Gb Total Space | 38.84 Gb Free Space | 20.56% Space Free | Partition Type: NTFS
Drive D: | 29.19 Gb Total Space | 24.80 Gb Free Space | 84.96% Space Free | Partition Type: NTFS
Drive E: | 400.44 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive J: | 14.89 Gb Total Space | 0.58 Gb Free Space | 3.90% Space Free | Partition Type: FAT32
Computer Name: MGLAPTOP | User Name: Michele | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ========== PRC - [2012/04/03 21:56:42 | 001,224,176 | ---- | M] (Google Inc.) -- C:\Documents and Settings\Michele\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
PRC - [2012/03/17 20:41:04 | 000,742,264 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\uTorrent\uTorrent.exe
PRC - [2012/02/10 17:40:26 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Michele\Desktop\Comp Cleanup\OTL.exe
PRC - [2011/12/11 01:41:00 | 001,187,072 | ---- | M] (Lavasoft Limited) -- C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2011/12/11 01:40:51 | 002,152,152 | ---- | M] (Lavasoft Limited) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2011/10/27 16:23:10 | 002,743,310 | ---- | M] () -- C:\Program Files\Vidalia Bundle\Tor\tor.exe
PRC - [2011/10/13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE
PRC - [2011/10/12 11:06:14 | 005,407,850 | ---- | M] () -- C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe
PRC - [2011/10/08 22:40:59 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
PRC - [2011/06/15 15:16:48 | 000,997,920 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2011/05/10 12:02:20 | 000,181,248 | ---- | M] () -- C:\Program Files\Vidalia Bundle\Polipo\polipo.exe
PRC - [2011/04/27 15:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2010/11/05 02:29:00 | 000,132,456 | ---- | M] (Lenovo.) -- C:\Program Files\ThinkPad\Utilities\DOZESVC.EXE
PRC - [2010/11/05 02:29:00 | 000,053,248 | ---- | M] () -- C:\Program Files\ThinkPad\Utilities\PWMDBSVC.exe
PRC - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Update\NASvc.exe
PRC - [2010/04/30 10:47:00 | 000,014,088 | ---- | M] (Memeo) -- C:\Program Files\Seagate\Seagate Dashboard\SeagateDashboardService.exe
PRC - [2009/07/20 13:30:50 | 000,813,584 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPoint\SetPoint.exe
PRC - [2009/07/10 13:42:32 | 000,055,824 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
PRC - [2009/06/12 15:59:14 | 004,464,640 | ---- | M] (Lenovo(Beijing)Limited) -- C:\Program Files\Lenovo\Energy Management\utility.exe
PRC - [2009/06/10 18:32:56 | 001,282,048 | ---- | M] (Lenovo (Beijing) Limited) -- C:\Program Files\Lenovo\Energy Management\Energy Management.exe
PRC - [2008/10/14 14:15:08 | 000,032,768 | ---- | M] () -- C:\WINDOWS\BisonC07\BisonM07.exe
PRC - [2008/04/13 17:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/05/28 12:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) -- C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
========== Modules (No Company Name) ========== MOD - [2012/04/03 21:56:41 | 000,444,400 | ---- | M] () -- C:\Documents and Settings\Michele\Local Settings\Application Data\Google\Chrome\Application\18.0.1025.151\ppgooglenaclpluginchrome.dll
MOD - [2012/04/03 21:56:39 | 003,915,248 | ---- | M] () -- C:\Documents and Settings\Michele\Local Settings\Application Data\Google\Chrome\Application\18.0.1025.151\pdf.dll
MOD - [2012/04/03 21:55:14 | 000,122,880 | ---- | M] () -- C:\Documents and Settings\Michele\Local Settings\Application Data\Google\Chrome\Application\18.0.1025.151\avutil-51.dll
MOD - [2012/04/03 21:55:12 | 000,220,672 | ---- | M] () -- C:\Documents and Settings\Michele\Local Settings\Application Data\Google\Chrome\Application\18.0.1025.151\avformat-53.dll
MOD - [2012/04/03 21:55:11 | 001,747,456 | ---- | M] () -- C:\Documents and Settings\Michele\Local Settings\Application Data\Google\Chrome\Application\18.0.1025.151\avcodec-53.dll
MOD - [2012/04/03 21:09:30 | 008,743,584 | ---- | M] () -- C:\Documents and Settings\Michele\Local Settings\Application Data\Google\Chrome\Application\18.0.1025.151\gcswf32.dll
MOD - [2012/02/17 04:14:21 | 000,539,648 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\1552f18ca434c1dca6d082df476d089a\PresentationFramework.Luna.ni.dll
MOD - [2012/02/17 04:14:18 | 000,212,992 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\11dcb806c92f55111f5fa9f1a90e3bdd\System.ServiceProcess.ni.dll
MOD - [2012/02/17 04:13:56 | 000,771,584 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\c14e58265386feb509cc61bb5e8dd296\System.Runtime.Remoting.ni.dll
MOD - [2012/02/17 04:13:19 | 012,430,848 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ad99ac6b5666edb8ee742dd64f9578af\System.Windows.Forms.ni.dll
MOD - [2012/02/17 04:13:10 | 001,587,200 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\9351cf29bb1ba951e45a9b3b0edab937\System.Drawing.ni.dll
MOD - [2012/02/17 04:13:05 | 012,215,808 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\PresentationCore\0665bba8c9962deadc418881eb3a2a2a\PresentationCore.ni.dll
MOD - [2012/02/17 04:12:50 | 003,325,440 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\WindowsBase\174c2f776741812aed02c337bbcd1dae\WindowsBase.ni.dll
MOD - [2012/02/17 04:12:40 | 005,450,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\77e1279cbf4eecfb0284b63316fe43fe\System.Xml.ni.dll
MOD - [2012/02/17 04:12:29 | 000,971,264 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\94a40f415bfa947e251888bbe88bb973\System.Configuration.ni.dll
MOD - [2012/02/17 04:12:19 | 007,953,408 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\9e3803cd2a11f056291862e306a8e2b2\System.ni.dll
MOD - [2012/02/05 13:41:50 | 000,181,616 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libMachoUniv.dll
MOD - [2012/02/05 13:41:48 | 000,210,288 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\Extended\libBase64.dll
MOD - [2011/12/11 01:42:13 | 000,430,568 | ---- | M] () -- C:\Program Files\Lavasoft\Ad-Aware\VipreBridge.dll
MOD - [2011/12/11 01:41:52 | 000,591,232 | ---- | M] () -- C:\Program Files\Lavasoft\Ad-Aware\RPAPI.dll
MOD - [2011/12/11 01:06:02 | 000,508,776 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Defs\thorax.aaw
MOD - [2011/12/02 08:49:14 | 000,308,560 | ---- | M] () -- C:\Program Files\Lavasoft\Ad-Aware\Vipre.dll
MOD - [2011/10/27 16:23:10 | 002,743,310 | ---- | M] () -- C:\Program Files\Vidalia Bundle\Tor\tor.exe
MOD - [2011/10/14 03:16:38 | 000,060,928 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\888b745ca99d39692c2e9af222e5eae8\UIAutomationProvider.ni.dll
MOD - [2011/10/14 03:15:35 | 011,490,816 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\ca87ba84221991839abbe7d4bc9c6721\mscorlib.ni.dll
MOD - [2011/10/12 11:06:14 | 005,407,850 | ---- | M] () -- C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe
MOD - [2011/05/10 12:02:20 | 000,181,248 | ---- | M] () -- C:\Program Files\Vidalia Bundle\Polipo\polipo.exe
MOD - [2011/05/10 12:02:20 | 000,076,800 | ---- | M] () -- C:\Program Files\Vidalia Bundle\Polipo\libgnurx-0.dll
MOD - [2011/02/14 17:02:58 | 002,417,664 | ---- | M] () -- C:\Program Files\Vidalia Bundle\Vidalia\QtCore4.dll
MOD - [2010/11/05 02:29:00 | 000,053,248 | ---- | M] () -- C:\Program Files\ThinkPad\Utilities\US\PWRMGRRO.DLL
MOD - [2010/11/05 02:29:00 | 000,053,248 | ---- | M] () -- C:\Program Files\ThinkPad\Utilities\PWMDBSVC.exe
MOD - [2010/11/05 02:29:00 | 000,036,352 | ---- | M] () -- C:\Program Files\ThinkPad\Utilities\US\PWRMGRRT.DLL
MOD - [2010/06/24 03:02:41 | 005,279,744 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\PresentationFramework.dll
MOD - [2010/03/06 23:31:36 | 000,024,110 | ---- | M] () -- C:\Program Files\Vidalia Bundle\Vidalia\mingwm10.dll
MOD - [2010/02/10 12:36:20 | 009,565,184 | ---- | M] () -- C:\Program Files\Vidalia Bundle\Vidalia\QtGui4.dll
MOD - [2010/02/10 12:11:00 | 001,148,416 | ---- | M] () -- C:\Program Files\Vidalia Bundle\Vidalia\QtNetwork4.dll
MOD - [2010/02/10 12:08:16 | 000,398,336 | ---- | M] () -- C:\Program Files\Vidalia Bundle\Vidalia\QtXml4.dll
MOD - [2009/07/20 13:27:14 | 000,017,936 | ---- | M] () -- C:\Program Files\Logitech\SetPoint\khalwrapper.dll
MOD - [2009/06/22 14:42:42 | 000,043,008 | ---- | M] () -- C:\Program Files\Vidalia Bundle\Vidalia\libgcc_s_dw2-1.dll
MOD - [2008/10/14 14:15:08 | 000,032,768 | ---- | M] () -- C:\WINDOWS\BisonC07\BisonM07.exe
MOD - [2008/05/21 20:33:22 | 000,045,056 | ---- | M] () -- C:\Program Files\Lenovo\Energy Management\KbdHook.dll
MOD - [2005/06/24 06:05:02 | 000,045,056 | ---- | M] () -- C:\Program Files\Lenovo\Energy Management\HookLib.dll
========== Win32 Services (SafeList) ========== SRV - File not found [Auto | Stopped] -- -- (WD_FireWire_HID)
SRV - [2012/04/07 08:59:19 | 000,253,600 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2011/12/11 01:40:51 | 002,152,152 | ---- | M] (Lavasoft Limited) [Auto | Running] -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2011/10/21 16:23:42 | 000,196,176 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Program Files\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011/10/13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate)
SRV - [2011/10/08 22:40:59 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE -- (!SASCORE)
SRV - [2011/04/27 15:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV - [2010/11/16 02:10:14 | 000,267,568 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Fix it Center\Matsvc.exe -- (MatSvc)
SRV - [2010/11/05 02:29:00 | 000,132,456 | ---- | M] (Lenovo.) [Auto | Running] -- C:\Program Files\ThinkPad\Utilities\DOZESVC.EXE -- (DozeSvc)
SRV - [2010/11/05 02:29:00 | 000,053,248 | ---- | M] () [Auto | Running] -- C:\Program Files\ThinkPad\Utilities\PWMDBSVC.exe -- (Power Manager DBC Service)
SRV - [2010/05/04 12:07:22 | 000,503,080 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2010/04/30 10:47:00 | 000,014,088 | ---- | M] (Memeo) [Auto | Running] -- C:\Program Files\Seagate\Seagate Dashboard\SeagateDashboardService.exe -- (SeagateDashboardService)
SRV - [2010/04/22 20:49:38 | 000,025,824 | ---- | M] (Memeo) [Disabled | Stopped] -- C:\Program Files\Memeo\AutoBackupPro\MemeoBackgroundService.exe -- (MemeoBackgroundService)
SRV - [2010/02/17 06:49:35 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009/04/02 16:47:04 | 000,234,888 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe -- (ASKUpgrade)
SRV - [2009/04/02 16:47:02 | 000,464,264 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\AskBarDis\bar\bin\AskService.exe -- (ASKService)
SRV - [2008/01/11 20:50:16 | 000,030,312 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc)
SRV - [2007/05/28 12:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) [Auto | Running] -- C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)
SRV - [2007/01/04 22:48:50 | 000,112,152 | ---- | M] (InterVideo) [Disabled | Stopped] -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)
SRV - [2004/09/29 12:14:36 | 000,069,632 | ---- | M] (HP) [Auto | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
========== Driver Services (SafeList) ========== DRV - [2011/12/02 08:49:14 | 000,064,512 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\Lbd.sys -- (Lbd)
DRV - [2011/12/02 08:49:14 | 000,015,232 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Program Files\Lavasoft\Ad-Aware\kernexplorer.sys -- (Lavasoft Kernexplorer)
DRV - [2011/10/08 22:40:27 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2011/10/08 22:40:26 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS -- (SASDIFSV)
DRV - [2011/06/27 11:54:30 | 000,022,640 | ---- | M] (PC-Doctor, Inc.) [Kernel | On_Demand | Stopped] -- c:\Program Files\PC-Doctor\pcdsrvc.pkms -- (PCDSRVC{3037D694-FD904ACA-06020200}_0)
DRV - [2011/05/17 00:30:35 | 000,025,512 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ggsemc.sys -- (ggsemc)
DRV - [2011/05/17 00:30:35 | 000,013,224 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ggflt.sys -- (ggflt)
DRV - [2010/12/13 16:38:07 | 000,027,632 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\seehcri.sys -- (seehcri)
DRV - [2010/11/05 02:29:00 | 000,024,304 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\DozeHDD.sys -- (DozeHDD)
DRV - [2010/11/05 02:29:00 | 000,004,442 | ---- | M] () [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\TPPWRIF.SYS -- (TPPWRIF)
DRV - [2010/03/22 16:52:59 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt)
DRV - [2010/03/22 16:52:57 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2009/12/30 04:25:26 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2009/12/18 11:58:52 | 000,011,336 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\SystemRequirementsLab\cpudrv.sys -- (cpudrv)
DRV - [2009/11/11 11:14:44 | 000,214,664 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\mfehidk.sys -- (mfehidk)
DRV - [2009/11/11 11:14:44 | 000,079,816 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mfeavfk.sys -- (mfeavfk)
DRV - [2009/11/11 11:14:44 | 000,040,552 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mfesmfk.sys -- (mfesmfk)
DRV - [2009/11/11 11:14:44 | 000,035,272 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mfebopk.sys -- (mfebopk)
DRV - [2009/11/11 11:14:12 | 000,034,248 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mferkdk.sys -- (mferkdk)
DRV - [2009/11/08 23:21:18 | 000,059,388 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\scdemu.sys -- (SCDEmu)
DRV - [2009/06/17 12:56:32 | 000,028,560 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LUsbFilt.sys -- (LUsbFilt)
DRV - [2009/06/17 12:56:16 | 000,037,392 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2009/06/17 12:56:06 | 000,035,472 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2009/06/17 12:55:34 | 000,010,384 | ---- | M] (Logitech, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\LBeepKE.sys -- (LBeepKE)
DRV - [2009/05/22 13:33:10 | 001,273,640 | ---- | M] (Bison Electronics. Inc. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BisonC07.sys -- (Cam5607)
DRV - [2009/04/23 13:54:36 | 000,814,592 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CHDAU32.sys -- (CnxtHdAudService)
DRV - [2009/03/25 16:48:00 | 000,114,728 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s1018mdm.sys -- (s1018mdm)
DRV - [2009/03/25 16:48:00 | 000,109,864 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s1018unic.sys -- (s1018unic) Sony Ericsson Device 1018 USB Ethernet Emulation (WDM)
DRV - [2009/03/25 16:48:00 | 000,106,208 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s1018mgmt.sys -- (s1018mgmt) Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM)
DRV - [2009/03/25 16:48:00 | 000,104,744 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s1018obex.sys -- (s1018obex)
DRV - [2009/03/25 16:48:00 | 000,086,824 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s1018bus.sys -- (s1018bus) Sony Ericsson Device 1018 driver (WDM)
DRV - [2009/03/25 16:48:00 | 000,026,024 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s1018nd5.sys -- (s1018nd5) Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS)
DRV - [2009/03/25 16:48:00 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s1018mdfl.sys -- (s1018mdfl)
DRV - [2008/10/23 16:49:18 | 000,187,392 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2008/09/10 22:14:48 | 001,386,624 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)
DRV - [2008/03/14 09:23:12 | 000,169,008 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2008/01/11 17:58:42 | 000,009,472 | ---- | M] (Lenovo Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AcpiVpc.sys -- (ACPIVPC)
DRV - [2008/01/10 13:59:08 | 000,081,192 | ---- | M] (CyberLink) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WSVD.sys -- (WSVD)
DRV - [2007/07/23 15:04:24 | 000,022,528 | ---- | M] (SoundGenetics) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\aubridge.sys -- (audiobridge)
DRV - [2007/05/23 04:33:58 | 000,128,104 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\WimFltr.sys -- (WimFltr)
DRV - [2007/04/17 23:09:28 | 000,011,032 | ---- | M] (InterVideo) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\regi.sys -- (regi)
DRV - [2004/08/04 02:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)
========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages =
http://www.lenovo.com/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.com/IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = F8 1B F2 94 47 28 CB 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Yahoo-FLVTube"
FF - prefs.js..browser.search.defaultenginename: "Bing"
FF - prefs.js..browser.search.defaultthis.engineName: " "
FF - prefs.js..browser.search.defaulturl: "
http://search.condui...={searchTerms}"FF - prefs.js..browser.search.order.1: "Yahoo-FLVTube"
FF - prefs.js..browser.search.selectedEngine: " "
FF - prefs.js..browser.search.selectedEngineURL: "
http://flvtubesearch...={searchTerms}"FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "
http://www.google.com/"FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.7
FF - prefs.js..extensions.enabledItems:
[email protected]:1.0
FF - prefs.js..extensions.enabledItems:
[email protected]:1.0.0.%(version)s
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {7b13ec3e-999a-4b70-b9cb-2617b8323822}:3.3.5.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}:6.0.25
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..extensions.enabledItems: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.4.4.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}:6.0.30
FF - prefs.js..keyword.URL: "
http://bing.zugotool...s&site=Bing&q="FF - prefs.js..network.proxy.type: 4
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_228.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Documents and Settings\Michele\Application Data\Move Networks\plugins\npqmp071505000011.dll (Move Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Documents and Settings\Michele\Application Data\Move Networks\plugins\npqmp071505000011.dll (Move Networks)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Documents and Settings\Michele\Application Data\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Documents and Settings\Michele\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Michele\Local Settings\Application Data\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Michele\Local Settings\Application Data\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.23\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/10/04 20:47:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.23\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/01/14 20:45:32 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\
[email protected]: C:\Documents and Settings\Michele\Application Data\Move Networks [2010/01/05 02:29:35 | 000,000,000 | ---D | M]
[2010/01/05 02:29:35 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Michele\Application Data\Mozilla\Extensions
[2009/12/26 11:49:12 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Michele\Application Data\Mozilla\Firefox\extensions
[2009/12/26 11:49:13 | 000,000,000 | ---D | M] ("Ask Toolbar for Firefox") -- C:\Documents and Settings\Michele\Application Data\Mozilla\Firefox\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
[2012/03/01 00:51:49 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Michele\Application Data\Mozilla\Firefox\Profiles\zx1479pg.default\extensions
[2010/05/25 20:45:13 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Michele\Application Data\Mozilla\Firefox\Profiles\zx1479pg.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/07/23 03:01:30 | 000,000,000 | ---D | M] (Zynga Community Toolbar) -- C:\Documents and Settings\Michele\Application Data\Mozilla\Firefox\Profiles\zx1479pg.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}
[2011/12/01 23:15:11 | 000,000,000 | ---D | M] (Torbutton) -- C:\Documents and Settings\Michele\Application Data\Mozilla\Firefox\Profiles\zx1479pg.default\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
[2011/07/23 03:01:29 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Documents and Settings\Michele\Application Data\Mozilla\Firefox\Profiles\zx1479pg.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010/10/10 21:14:41 | 000,001,832 | ---- | M] () -- C:\Documents and Settings\Michele\Application Data\Mozilla\Firefox\Profiles\zx1479pg.default\searchplugins\bing.xml
[2010/12/11 20:22:47 | 000,000,863 | ---- | M] () -- C:\Documents and Settings\Michele\Application Data\Mozilla\Firefox\Profiles\zx1479pg.default\searchplugins\conduit.xml
[2012/03/01 00:51:49 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/07/14 13:55:06 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/03 05:31:28 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/12/06 09:43:50 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/05/17 00:29:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
[2011/06/12 02:57:00 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2012/01/19 22:21:35 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}
[2010/01/05 02:29:35 | 000,000,000 | ---D | M] (Move Media Player) -- C:\DOCUMENTS AND SETTINGS\MICHELE\APPLICATION DATA\MOVE NETWORKS
[2011/05/17 00:29:45 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/11/10 06:54:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/10/05 04:16:05 | 000,001,175 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\FLVTube.xml.bak
========== Chrome ========== CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\Michele\Local Settings\Application Data\Google\Chrome\Application\18.0.1025.151\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\Michele\Local Settings\Application Data\Google\Chrome\Application\18.0.1025.151\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\Michele\Local Settings\Application Data\Google\Chrome\Application\18.0.1025.151\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Documents and Settings\Michele\Local Settings\Application Data\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_228.dll
CHR - plugin: Logitech Device Detection (Enabled) = C:\Documents and Settings\Michele\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\elncikmfipkphghakkmemnlnahadedno\1.24.0.9_0\npLogitechDeviceDetection.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Documents and Settings\Michele\Application Data\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Documents and Settings\Michele\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.300.12 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U30 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdivx32.dll
CHR - plugin: downloadUpdater (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdnu.dll
CHR - plugin: downloadUpdater2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Move Streaming Media Player (Enabled) = C:\Documents and Settings\Michele\Application Data\Move Networks\plugins\npqmp071505000011.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\Michele\Local Settings\Application Data\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll
CHR - Extension: YouTube = C:\Documents and Settings\Michele\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Documents and Settings\Michele\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Logitech Device Detection = C:\Documents and Settings\Michele\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\elncikmfipkphghakkmemnlnahadedno\1.24.0.9_0\
CHR - Extension: AdBlock = C:\Documents and Settings\Michele\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.15_0\
CHR - Extension: Gmail = C:\Documents and Settings\Michele\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
O1 HOSTS File: ([2012/04/08 19:12:45 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (TBSB05974 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Search Toolbar\tbcore3.dll File not found
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O4 - HKLM..\Run: [BisonMnt] C:\WINDOWS\BisonC07\BisonM07.exe ()
O4 - HKLM..\Run: [Energy Management] C:\Program Files\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited)
O4 - HKLM..\Run: [EnergyUtility] C:\Program Files\Lenovo\Energy Management\utility.exe (Lenovo(Beijing)Limited)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PWRMGRTR] C:\Program Files\ThinkPad\Utilities\PWRMGRTR.DLL (Lenovo Group Limited)
O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - HKCU..\Run: [Vidalia] C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
O4 - Startup: C:\Documents and Settings\Michele\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O16 - DPF: {2DAD3559-2923-4935-AD49-B673D2539944}
http://www-307.ibm.c...pport/acpir.cab (IASRunner Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C}
http://update.micros...b?1261819129968 (WUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5}
http://download.eset...lineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}
http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD}
http://www.superadbl...ivex/sabspx.cab (SABScanProcesses Class)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}
http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F}
http://content.syste...el_4.4.24.0.cab (SysInfo Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000}
http://fpdownload2.m...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E352C986-9B29-4289-BE9A-FCB761F2C5F3}: DhcpNameServer = 10.0.0.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/08/10 13:41:02 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2011/11/21 13:40:41 | 000,000,122 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (lsdelete)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O35 - HKCU\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ========== [2012/04/08 18:48:15 | 000,000,000 | ---D | C] -- C:\ComboFix
[2012/04/07 12:07:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michele\My Documents\8floor
[2012/04/07 07:35:57 | 000,418,464 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/04/07 06:36:22 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2012/04/07 06:36:22 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2012/04/07 06:36:22 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2012/04/07 06:36:22 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2012/04/07 03:21:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michele\My Documents\DOTC
[2012/04/07 02:37:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2012/04/07 02:37:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2012/04/06 01:53:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michele\Application Data\IronCode
[2012/04/06 00:47:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\ffdshow
[2012/04/06 00:47:30 | 000,000,000 | ---D | C] -- C:\Program Files\ffdshow
[2012/04/06 00:46:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michele\Start Menu\Programs\ef - a fairy tale of the two
[2012/03/29 22:51:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\AIM
[2012/03/29 22:51:30 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Software Update Utility
[2012/03/25 04:59:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michele\Application Data\Anarchy
[2012/03/21 18:52:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michele\Application Data\Adore Games
[2012/03/21 18:52:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michele\Start Menu\Programs\Adore Puzzle
[2012/03/19 10:39:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michele\My Documents\Sinking Island
[2012/03/18 23:51:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Michele\Start Menu\Programs\Fantastic Creations - House of Brass CE
[2010/12/15 18:53:56 | 000,004,096 | ---- | C] ( ) -- C:\WINDOWS\System32\IGFXDEVLib.dll
========== Files - Modified Within 30 Days ========== [2012/04/08 20:02:00 | 000,000,466 | ---- | M] () -- C:\WINDOWS\tasks\SystemToolsDailyTest.job
[2012/04/08 19:59:00 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/04/08 19:47:28 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/04/08 19:36:36 | 000,000,304 | ---- | M] () -- C:\WINDOWS\tasks\PMTask.job
[2012/04/08 19:36:19 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/04/08 19:36:18 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/04/08 19:29:56 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2012/04/08 19:27:10 | 000,000,486 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2012/04/08 19:24:43 | 000,002,048 | ---- | M] () -- C:\WINDOWS\bootstat.dat
[2012/04/08 19:12:45 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2012/04/08 18:19:00 | 000,000,888 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/04/08 18:15:00 | 000,000,986 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-4139560822-1196392724-1434190299-1007UA.job
[2012/04/08 01:15:00 | 000,000,934 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-4139560822-1196392724-1434190299-1007Core.job
[2012/04/07 10:53:00 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2012/04/07 08:59:19 | 000,418,464 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/04/07 08:59:18 | 000,070,304 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/04/07 07:37:31 | 000,000,064 | ---- | M] () -- C:\WINDOWS\System32\rp_stats.dat
[2012/04/07 07:37:31 | 000,000,044 | ---- | M] () -- C:\WINDOWS\System32\rp_rules.dat
[2012/04/07 06:34:47 | 004,452,287 | R--- | M] (Swearware) -- C:\Documents and Settings\Michele\Desktop\ComboFix.exe
[2012/04/07 03:31:31 | 000,001,760 | ---- | M] () -- C:\Documents and Settings\Michele\Desktop\The Pini Society.lnk
[2012/04/07 03:20:18 | 000,000,877 | ---- | M] () -- C:\Documents and Settings\Michele\Desktop\Defender of the Crown - Heroes Live Forever.lnk
[2012/04/06 23:51:34 | 003,608,064 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012/04/06 01:53:47 | 000,001,830 | ---- | M] () -- C:\Documents and Settings\Michele\Desktop\Pahelika Secret Legends.lnk
[2012/04/04 01:29:19 | 000,000,948 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Crazy Machines Complete Collection.lnk
[2012/03/30 04:24:21 | 000,001,864 | ---- | M] () -- C:\Documents and Settings\Michele\Desktop\Aldorlea Tales - Stars of Destiny.lnk
[2012/03/30 04:04:28 | 000,000,104 | ---- | M] () -- C:\Documents and Settings\Michele\Application Data\Microsoft\Internet Explorer\Quick Launch\My Computer.lnk
[2012/03/29 22:51:46 | 000,001,403 | -H-- | M] () -- C:\IPH.PH
[2012/03/29 22:51:38 | 000,001,592 | ---- | M] () -- C:\Documents and Settings\Michele\Application Data\Microsoft\Internet Explorer\Quick Launch\AIM.lnk
[2012/03/29 22:51:38 | 000,001,574 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AIM.lnk
[2012/03/26 23:44:19 | 000,002,533 | ---- | M] () -- C:\Documents and Settings\Michele\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Word 2007.lnk
[2012/03/24 22:15:48 | 000,000,866 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Angry Birds Space.lnk
[2012/03/21 18:52:05 | 000,001,903 | ---- | M] () -- C:\Documents and Settings\Michele\Desktop\Play Over 11.000 Online Games on The Playing Bay.lnk
[2012/03/21 18:52:05 | 000,001,708 | ---- | M] () -- C:\Documents and Settings\Michele\Desktop\Adore Puzzle.lnk
[2012/03/19 10:38:18 | 000,000,838 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Sinking Island.lnk
[2012/03/18 23:51:59 | 000,002,028 | ---- | M] () -- C:\Documents and Settings\Michele\Desktop\Fantastic Creations - House of Brass CE.lnk
[2012/03/17 20:41:06 | 000,000,648 | ---- | M] () -- C:\Documents and Settings\Michele\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2012/03/17 20:41:06 | 000,000,630 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\µTorrent.lnk
[2012/03/16 11:00:07 | 000,000,528 | ---- | M] () -- C:\WINDOWS\tasks\PCDoctorBackgroundMonitorTask.job
[2012/03/14 06:42:47 | 000,532,052 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/03/14 06:42:47 | 000,099,096 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/03/14 03:02:07 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012/03/12 04:23:59 | 000,001,842 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Angry Birds Seasons.lnk
[2012/03/12 04:20:07 | 000,002,479 | ---- | M] () -- C:\Documents and Settings\Michele\Desktop\Angry Birds - Christmas Edition - Seasons HD .lnk
[2012/03/12 04:20:07 | 000,002,269 | ---- | M] () -- C:\Documents and Settings\Michele\Desktop\Read Before Install - Use This Key - Foxy Games.lnk
[2012/03/12 04:20:07 | 000,002,205 | ---- | M] () -- C:\Documents and Settings\Michele\Desktop\Download More Free Full Games from FoxyGames.Info.lnk
[2012/03/12 04:20:07 | 000,002,031 | ---- | M] () -- C:\Documents and Settings\Michele\Desktop\Crack Angry Birds.lnk
[2012/03/11 04:08:30 | 000,046,080 | ---- | M] () -- C:\Documents and Settings\Michele\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
========== Files Created - No Company Name ========== [2012/04/07 07:36:00 | 000,000,830 | ---- | C] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/04/07 06:36:22 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012/04/07 06:36:22 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012/04/07 06:36:22 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012/04/07 06:36:22 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012/04/07 06:36:22 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012/04/07 03:31:31 | 000,001,760 | ---- | C] () -- C:\Documents and Settings\Michele\Desktop\The Pini Society.lnk
[2012/04/07 03:20:18 | 000,000,877 | ---- | C] () -- C:\Documents and Settings\Michele\Desktop\Defender of the Crown - Heroes Live Forever.lnk
[2012/04/06 01:53:47 | 000,001,830 | ---- | C] () -- C:\Documents and Settings\Michele\Desktop\Pahelika Secret Legends.lnk
[2012/04/06 00:47:32 | 000,085,504 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2012/04/04 01:29:19 | 000,000,948 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Crazy Machines Complete Collection.lnk
[2012/03/30 04:24:21 | 000,001,864 | ---- | C] () -- C:\Documents and Settings\Michele\Desktop\Aldorlea Tales - Stars of Destiny.lnk
[2012/03/30 04:04:28 | 000,000,104 | ---- | C] () -- C:\Documents and Settings\Michele\Application Data\Microsoft\Internet Explorer\Quick Launch\My Computer.lnk
[2012/03/24 22:15:48 | 000,000,866 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Angry Birds Space.lnk
[2012/03/21 18:52:05 | 000,001,708 | ---- | C] () -- C:\Documents and Settings\Michele\Desktop\Adore Puzzle.lnk
[2012/03/19 10:38:18 | 000,000,838 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Sinking Island.lnk
[2012/03/18 23:51:59 | 000,002,028 | ---- | C] () -- C:\Documents and Settings\Michele\Desktop\Fantastic Creations - House of Brass CE.lnk
[2012/03/12 04:23:59 | 000,001,842 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Angry Birds Seasons.lnk
[2012/03/12 04:20:07 | 000,002,479 | ---- | C] () -- C:\Documents and Settings\Michele\Desktop\Angry Birds - Christmas Edition - Seasons HD .lnk
[2012/03/12 04:20:07 | 000,002,269 | ---- | C] () -- C:\Documents and Settings\Michele\Desktop\Read Before Install - Use This Key - Foxy Games.lnk
[2012/03/12 04:20:07 | 000,002,205 | ---- | C] () -- C:\Documents and Settings\Michele\Desktop\Download More Free Full Games from FoxyGames.Info.lnk
[2012/03/12 04:20:07 | 000,002,031 | ---- | C] () -- C:\Documents and Settings\Michele\Desktop\Crack Angry Birds.lnk
[2012/02/20 00:31:47 | 000,016,432 | ---- | C] () -- C:\WINDOWS\System32\lsdelete.exe
[2012/02/17 01:02:21 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012/01/11 04:21:16 | 001,492,920 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/09/13 01:20:49 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Captive.INI
[2011/08/14 20:20:09 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/07/11 18:02:27 | 000,113,040 | ---- | C] () -- C:\WINDOWS\hpoins07.dat
[2011/07/11 18:02:27 | 000,021,124 | ---- | C] () -- C:\WINDOWS\hpomdl07.dat
[2011/06/03 23:45:35 | 000,000,064 | ---- | C] () -- C:\WINDOWS\System32\rp_stats.dat
[2011/06/03 23:45:35 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\rp_rules.dat
[2011/06/01 06:06:51 | 000,069,632 | R--- | C] () -- C:\WINDOWS\System32\xmltok.dll
[2011/06/01 06:06:51 | 000,036,864 | R--- | C] () -- C:\WINDOWS\System32\xmlparse.dll
[2011/05/18 18:42:02 | 000,027,136 | ---- | C] () -- C:\WINDOWS\System32\QTUninst.dll
[2011/02/23 07:41:52 | 000,000,346 | ---- | C] () -- C:\WINDOWS\QTW.ini
[2011/01/30 08:11:49 | 000,087,040 | ---- | C] () -- C:\WINDOWS\UnGins.exe
[2011/01/30 08:11:48 | 000,473,600 | ---- | C] () -- C:\WINDOWS\System32\Harmony.dll
[2011/01/30 08:11:48 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\Unlha32.dll
[2011/01/30 06:51:46 | 000,084,360 | ---- | C] () -- C:\WINDOWS\gamedelete.exe
[2010/12/15 18:53:55 | 000,000,151 | ---- | C] () -- C:\WINDOWS\System32\GfxUI.exe.config
[2010/12/10 23:52:47 | 000,196,608 | ---- | C] () -- C:\WINDOWS\PWMBTHLP.EXE
[2010/12/10 23:52:46 | 000,004,442 | ---- | C] () -- C:\WINDOWS\System32\drivers\TPPWRIF.SYS
[2010/12/07 17:58:00 | 000,000,256 | ---- | C] () -- C:\WINDOWS\System32\pool.bin
[2010/12/05 12:22:52 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Shadow.INI
[2010/12/03 08:20:48 | 000,036,734 | ---- | C] () -- C:\WINDOWS\System32\OggDSuninst.exe
[2010/11/24 23:43:22 | 000,000,029 | ---- | C] () -- C:\WINDOWS\JMAN.INI
[2010/11/05 23:42:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\PowerReg.dat
[2010/10/30 11:47:48 | 000,000,534 | ---- | C] () -- C:\WINDOWS\eReg.dat
[2010/10/16 07:20:36 | 000,000,550 | ---- | C] () -- C:\Documents and Settings\Michele\Application Data\prefsdb.dat
[2010/10/05 04:21:39 | 000,000,037 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2010/09/10 01:02:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Twister.INI
[2010/09/07 18:59:47 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Secrets.INI
[2010/08/23 16:45:44 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
[2010/07/24 14:16:09 | 000,003,054 | ---- | C] () -- C:\WINDOWS\CDPlayer.ini
[2010/07/20 14:21:37 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Adojusucamunu.dat
[2010/07/20 14:21:37 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Tcedifohahuroze.bin
[2010/04/22 21:06:16 | 000,000,190 | ---- | C] () -- C:\WINDOWS\settings.ini
[2010/03/24 21:47:11 | 000,004,096 | ---- | C] () -- C:\WINDOWS\d3dx.dat
[2010/03/23 00:44:34 | 000,046,080 | ---- | C] () -- C:\Documents and Settings\Michele\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/01/21 03:29:51 | 000,281,760 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys
[2010/01/21 03:29:47 | 000,025,888 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
[2010/01/15 07:52:09 | 000,000,000 | ---- | C] () -- C:\WINDOWS\game.INI
[2010/01/14 00:01:12 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Curses.INI
[2010/01/13 18:44:05 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Waverly.INI
[2010/01/12 02:47:21 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Ransom.INI
[2010/01/10 09:04:07 | 000,178,176 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2010/01/08 18:45:54 | 000,000,000 | ---- | C] () -- C:\WINDOWS\CastleMalloy.INI
[2010/01/05 02:28:51 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2009/12/30 04:37:55 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI
[2009/09/14 18:26:02 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2009/09/14 18:15:26 | 000,015,190 | ---- | C] () -- C:\WINDOWS\M3000Twn.ini
[2009/09/14 18:14:12 | 000,982,240 | ---- | C] () -- C:\WINDOWS\System32\igkrng500.bin
[2009/09/14 18:14:11 | 000,439,308 | ---- | C] () -- C:\WINDOWS\System32\igcompkrng500.bin
[2009/09/14 18:14:11 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v5002.dll
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | ---- | C] () -- C:\WINDOWS\System32\OGAEXEC.exe
[2009/02/05 16:46:04 | 000,069,632 | ---- | C] () -- C:\WINDOWS\Memeo.ShellExtension.WicIO.dll
[2006/08/10 13:52:50 | 000,002,048 | ---- | C] () -- C:\WINDOWS\bootstat.dat
[2006/08/10 13:37:24 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2006/08/10 13:31:50 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2006/08/10 13:30:34 | 003,608,064 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2005/03/29 16:54:25 | 000,001,322 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2004/08/04 16:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/04 16:00:00 | 000,532,052 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/04 16:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/04 16:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/04 16:00:00 | 000,099,096 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/04 16:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/04 16:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/04 16:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/04 16:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/04 16:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2002/10/06 14:42:57 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\OggDS.dll
[2002/10/04 19:04:25 | 000,921,600 | ---- | C] () -- C:\WINDOWS\System32\vorbisenc.dll
[2002/10/04 19:04:24 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\vorbis.dll
[2002/10/04 19:04:17 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ogg.dll
[2001/10/09 21:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001/10/09 20:59:00 | 000,004,492 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001/07/06 15:30:00 | 000,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini
< End of report >
The following is the combofix log, which was run prior to the OTL:
ComboFix 12-04-07.02 - Michele 04/08/2012 18:51:24.4.2 - x86
Running from: c:\documents and settings\Michele\Desktop\ComboFix.exe
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\windows\system32\drivers\etc\hosts.ics
.
.
((((((((((((((((((((((((( Files Created from 2012-03-08 to 2012-04-08 )))))))))))))))))))))))))))))))
.
.
2012-04-08 22:48 . 2012-04-08 22:48 29904 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{14AFAB49-C7C8-49FF-B39C-9FA8501695CD}\MpKslae3f3734.sys
2012-04-08 12:19 . 2012-03-20 07:53 6582328 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{14AFAB49-C7C8-49FF-B39C-9FA8501695CD}\mpengine.dll
2012-04-07 11:35 . 2012-04-07 12:59 418464 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-04-07 11:29 . 2012-04-07 11:29 -------- d-----w- c:\windows\system32\wbem\Repository
2012-04-06 04:47 . 2009-12-05 23:42 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2012-04-06 04:47 . 2012-04-06 04:47 -------- d-----w- c:\program files\ffdshow
2012-03-30 02:51 . 2012-03-30 02:51 -------- d-----w- c:\program files\Common Files\Software Update Utility
2012-03-12 08:12 . 2012-03-12 08:12 -------- d-----w- c:\documents and settings\M
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-07 12:59 . 2011-06-11 23:59 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-23 14:18 . 2010-11-25 08:17 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-02-17 05:47 . 2004-08-04 20:00 26112 ----a-w- c:\windows\system32\userinit.exe
2012-02-03 09:22 . 2004-08-05 04:00 1860096 ----a-w- c:\windows\system32\win32k.sys
2012-01-11 19:06 . 2012-02-17 05:02 3072 ------w- c:\windows\system32\iacenc.dll
.
<pre>
c:\program files\Games\Westward III Gold Rush\Westward_III .exe
</pre>
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2008-04-13 21:42 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\olepro32.dll
[7] 2004-08-04 20:00 . B48D3193DD1474DCBCC32BF4779AC698 . 83456 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\olepro32.dll
[-] 1999-03-08 06:00 . CE0155405EA902797E88B92A78443AEB . 164112 . . [5.0.4275] . . c:\windows\system32\olepro32.dll
.
((((((((((((((((((((((((((((( SnapShot_2012-02-20_13.28.32 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-04-07 12:06 . 2012-04-07 12:06 16384 c:\windows\TEMP\Perflib_Perfdata_e58.dat
+ 2011-01-20 09:08 . 2009-02-27 07:42 66440 c:\windows\system32\spool\drivers\w32x86\msonpui.dll
+ 2011-01-20 09:08 . 2009-02-27 07:42 66440 c:\windows\system32\spool\drivers\w32x86\3\msonpui.dll
- 2004-08-04 20:00 . 2012-02-17 08:11 99096 c:\windows\system32\perfc009.dat
+ 2004-08-04 20:00 . 2012-03-14 10:42 99096 c:\windows\system32\perfc009.dat
+ 2011-01-20 09:08 . 2009-02-27 07:42 31640 c:\windows\system32\msonpmon.dll
+ 2004-08-04 20:00 . 2010-08-17 13:17 58880 c:\windows\system32\dllcache\spoolsv.exe
- 2010-08-17 13:17 . 2010-08-17 13:17 58880 c:\windows\system32\dllcache\spoolsv.exe
+ 2012-03-21 06:14 . 2012-03-21 06:14 22016 c:\windows\Installer\232704ce.msi
+ 2012-03-12 08:24 . 2012-03-12 08:24 98472 c:\windows\Installer\{CCD3F3D0-C85A-4BB7-ADDA-CA68019631D5}\AngryBirdsSeasons.exe
- 2009-08-19 09:59 . 2012-02-17 08:00 35088 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\oisicon.exe
+ 2009-08-19 09:59 . 2012-03-21 07:07 35088 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\oisicon.exe
+ 2009-08-19 09:59 . 2012-03-21 07:07 18704 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\mspicons.exe
- 2009-08-19 09:59 . 2012-02-17 08:00 18704 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\mspicons.exe
+ 2009-08-19 09:59 . 2012-03-21 07:07 20240 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\cagicon.exe
- 2009-08-19 09:59 . 2012-02-17 08:00 20240 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\cagicon.exe
- 2011-01-20 09:08 . 2011-12-15 08:12 35088 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\oisicon.exe
+ 2011-01-20 09:08 . 2012-03-21 07:04 35088 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\oisicon.exe
- 2011-01-20 09:08 . 2011-12-15 08:12 18704 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\mspicons.exe
+ 2011-01-20 09:08 . 2012-03-21 07:04 18704 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\mspicons.exe
- 2011-01-20 09:08 . 2011-12-15 08:12 20240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\cagicon.exe
+ 2011-01-20 09:08 . 2012-03-21 07:04 20240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\cagicon.exe
+ 2009-02-26 18:09 . 2009-02-26 18:09 10120 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.6612\XLCALL32.DLL
+ 2009-02-26 23:43 . 2009-02-26 23:43 71520 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.6612\XL12CNVP.DLL
+ 2009-02-26 22:45 . 2009-02-26 22:45 20808 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.6612\WRD12EXE.EXE
+ 2006-07-24 17:50 . 2006-07-24 17:50 47920 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.6612\VBAME.DLL
+ 2009-02-26 20:24 . 2009-02-26 20:24 71536 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.6612\ONFILTER.DLL
+ 2009-02-26 20:24 . 2009-02-26 20:24 97680 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.6612\ONENOTEM.EXE
+ 2006-07-24 17:50 . 2006-07-24 17:50 92976 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.6612\MSADDNDR.DLL
+ 2009-04-02 17:01 . 2009-04-02 17:01 56680 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\EXP_XPS.DLL
+ 2009-04-03 23:46 . 2009-04-03 23:46 97640 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\EXP_PDF.DLL
+ 2009-03-06 07:48 . 2009-03-06 07:48 55152 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ACERCLR.DLL
+ 2006-10-27 03:13 . 2006-10-27 03:13 56192 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ACECNFLT.EXE
+ 2009-02-26 18:09 . 2009-02-26 18:09 10120 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\XLCALL32.DLL
+ 2009-02-26 23:43 . 2009-02-26 23:43 71520 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\XL12CNVP.DLL
+ 2009-02-26 22:45 . 2009-02-26 22:45 20808 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\WRD12EXE.EXE
+ 2011-05-31 20:31 . 2011-05-31 20:31 32128 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\VPREVIEW.EXE
+ 2006-07-24 17:50 . 2006-07-24 17:50 47920 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\VBAME.DLL
+ 2011-07-20 09:17 . 2011-07-20 09:17 33152 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\SETLANG.EXE
+ 2011-07-27 08:53 . 2011-07-27 08:53 39464 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\REFIEBAR.DLL
+ 2009-02-26 23:21 . 2009-02-26 23:21 38224 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\REFEDIT.DLL
+ 2009-02-26 17:09 . 2009-02-26 17:09 43352 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\OUTLRPC.DLL
+ 2011-07-27 09:17 . 2011-07-27 09:17 22432 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\OISCTRL.DLL
+ 2011-07-27 09:25 . 2011-07-27 09:25 53728 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\OFFRHD.DLL
+ 2011-07-27 08:53 . 2011-07-27 08:53 64872 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\NAME.DLL
+ 2009-02-26 21:07 . 2009-02-26 21:07 67440 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\MSOHTMED.EXE
+ 2009-02-26 21:07 . 2009-02-26 21:07 75120 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\MSOHEV.DLL
+ 2009-02-26 23:21 . 2009-02-26 23:21 25968 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\MSOEURO.DLL
+ 2011-07-27 08:34 . 2011-07-27 08:34 13712 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\MSOCFU.DLL
+ 2006-07-24 17:50 . 2006-07-24 17:50 92976 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\MSADDNDR.DLL
+ 2009-02-26 17:09 . 2009-02-26 17:09 20352 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\MLSHEXT.DLL
+ 2011-05-31 20:26 . 2011-05-31 20:26 88448 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\METCONV.DLL
+ 2011-07-27 21:49 . 2011-07-27 21:49 56696 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\EXP_XPS.DLL
+ 2011-07-27 21:49 . 2011-07-27 21:49 95608 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\EXP_PDF.DLL
+ 2009-02-26 21:07 . 2009-02-26 21:07 53120 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\AUTHZAX.DLL
+ 2011-07-27 08:41 . 2011-07-27 08:41 55168 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\ACERCLR.DLL
+ 2009-02-26 15:18 . 2009-02-26 15:18 14192 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\ACEODTXT.DLL
+ 2009-02-26 15:18 . 2009-02-26 15:18 14192 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\ACEODPDX.DLL
+ 2009-02-26 15:18 . 2009-02-26 15:18 14192 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\ACEODEXL.DLL
+ 2009-02-26 15:18 . 2009-02-26 15:18 14192 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\ACEODDBS.DLL
+ 2011-07-27 08:41 . 2011-07-27 08:41 47024 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\ACEERR.DLL
+ 2011-07-27 08:41 . 2011-07-27 08:41 55240 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\ACECNFLT.EXE
+ 2006-10-27 03:13 . 2006-10-27 03:13 56192 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.4518\ACECNFLT.EXE
+ 2012-03-21 07:03 . 2012-03-21 07:03 11144 c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Word\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Word.dll
+ 2012-03-21 07:03 . 2012-03-21 07:03 63336 c:\windows\assembly\GAC\Microsoft.Vbe.Interop\12.0.0.0__71e9bce111e9429c\Microsoft.Vbe.Interop.dll
- 2011-01-21 08:02 . 2011-01-21 08:02 63336 c:\windows\assembly\GAC\Microsoft.Vbe.Interop\12.0.0.0__71e9bce111e9429c\Microsoft.Vbe.Interop.dll
+ 2012-02-10 03:59 . 2012-04-07 11:30 7508 c:\windows\system32\Restore\rstrlog.dat
+ 2011-01-20 09:08 . 2009-02-27 07:42 863128 c:\windows\system32\spool\drivers\w32x86\msonpdrv.dll
+ 2011-01-20 09:08 . 2009-02-27 07:42 863128 c:\windows\system32\spool\drivers\w32x86\3\msonpdrv.dll
+ 2004-08-04 20:00 . 2012-03-14 10:42 532052 c:\windows\system32\perfh009.dat
- 2004-08-04 20:00 . 2012-02-17 08:11 532052 c:\windows\system32\perfh009.dat
+ 2012-04-07 12:59 . 2012-04-07 12:59 353440 c:\windows\system32\Macromed\Flash\FlashUtil32_11_2_202_228_Plugin.exe
+ 2012-04-07 11:35 . 2012-04-07 11:35 353440 c:\windows\system32\Macromed\Flash\FlashUtil32_11_2_202_228_ActiveX.exe
+ 2012-04-07 11:35 . 2012-04-07 11:35 424608 c:\windows\system32\Macromed\Flash\FlashUtil32_11_2_202_228_ActiveX.dll
+ 2012-04-07 11:35 . 2012-04-07 12:59 253600 c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
+ 2006-08-10 17:35 . 2012-01-09 16:20 139784 c:\windows\system32\drivers\rdpwd.sys
+ 2011-08-19 04:12 . 2012-01-09 16:20 139784 c:\windows\system32\dllcache\rdpwd.sys
+ 2012-03-05 13:44 . 2012-03-05 13:44 331264 c:\windows\Installer\c5b9892.msi
+ 2012-03-25 02:15 . 2012-03-25 02:15 756224 c:\windows\Installer\b023dcc.msi
+ 2012-04-02 05:33 . 2012-04-02 05:33 341504 c:\windows\Installer\34eeb588.msi
+ 2012-03-12 08:24 . 2012-03-12 08:24 772096 c:\windows\Installer\31e2686.msi
- 2009-08-19 09:59 . 2012-02-17 08:00 888080 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\wordicon.exe
+ 2009-08-19 09:59 . 2012-03-21 07:07 888080 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\wordicon.exe
+ 2009-08-19 09:59 . 2012-03-21 07:07 272648 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\pubs.exe
- 2009-08-19 09:59 . 2012-02-17 08:00 272648 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\pubs.exe
- 2009-08-19 09:59 . 2012-02-17 08:00 922384 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\pptico.exe
+ 2009-08-19 09:59 . 2012-03-21 07:07 922384 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\pptico.exe
- 2009-08-19 09:59 . 2012-02-17 08:00 845584 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\outicon.exe
+ 2009-08-19 09:59 . 2012-03-21 07:07 845584 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\outicon.exe
+ 2009-08-19 09:59 . 2012-03-21 07:07 217864 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\misc.exe
- 2009-08-19 09:59 . 2012-02-17 08:00 217864 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\misc.exe
- 2011-01-20 09:08 . 2011-12-15 08:12 888080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe
+ 2011-01-20 09:08 . 2012-03-21 07:04 888080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe
+ 2011-01-20 09:08 . 2012-03-21 07:04 922384 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\pptico.exe
- 2011-01-20 09:08 . 2011-12-15 08:12 922384 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\pptico.exe
+ 2011-01-20 09:08 . 2012-03-21 07:04 217864 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\misc.exe
- 2011-01-20 09:08 . 2011-12-15 08:12 217864 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\misc.exe
+ 2011-01-20 09:08 . 2012-03-21 07:04 184080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\joticon.exe
- 2011-01-20 09:08 . 2011-12-15 08:12 184080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\joticon.exe
- 2011-06-04 04:09 . 2011-06-04 04:09 217864 c:\windows\Installer\{90120000-006E-0409-0000-0000000FF1CE}\misc.exe
+ 2012-03-21 07:01 . 2012-03-21 07:01 217864 c:\windows\Installer\{90120000-006E-0409-0000-0000000FF1CE}\misc.exe
+ 2012-03-25 02:15 . 2012-03-25 02:15 181638 c:\windows\Installer\{3F2A323E-60C4-41E8-8CCB-9715D1D750C3}\AngryBirdsSpace.exe
+ 2007-06-08 00:51 . 2007-06-08 00:51 465800 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.6612\OUTLFLTR.DLL
+ 2008-03-19 11:27 . 2008-03-19 11:27 661536 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.6612\OGALEGIT.DLL
+ 2006-07-24 17:50 . 2006-07-24 17:50 125744 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.6612\MSSTDFMT.DLL
+ 2008-10-25 11:18 . 2008-10-25 11:18 172880 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.6612\IEAWSDC.DLL
+ 2006-10-27 03:13 . 2006-10-27 03:13 764800 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\ACECNF.DLL
+ 2009-02-26 21:45 . 2009-02-26 21:45 509256 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\WRD12CVR.DLL
+ 2011-09-16 00:41 . 2011-09-16 00:41 408936 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\WINWORD.EXE
+ 2007-06-08 00:51 . 2007-06-08 00:51 125320 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\SSGEN.DLL
+ 2011-07-27 08:58 . 2011-07-27 08:58 439160 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\SETUP.EXE
+ 2011-07-27 08:54 . 2011-07-27 08:54 503184 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\SELFCERT.EXE
+ 2011-05-27 01:13 . 2011-05-27 01:13 368520 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\PPSLAX.DLL
+ 2011-07-27 08:36 . 2011-07-27 08:36 481640 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\PORTCONN.DLL
+ 2007-06-08 00:51 . 2007-06-08 00:51 465800 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\OUTLFLTR.DLL
+ 2011-07-27 09:17 . 2011-07-27 09:17 284560 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\OISGRAPH.DLL
+ 2011-07-27 09:16 . 2011-07-27 09:16 997768 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\OISAPP.DLL
+ 2011-07-27 09:16 . 2011-07-27 09:16 273792 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\OIS.EXE
+ 2008-03-19 11:27 . 2008-03-19 11:27 661536 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\OGALEGIT.DLL
+ 2009-02-26 19:24 . 2009-02-26 19:24 231864 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\ODEPLOY.EXE
+ 2011-07-20 09:22 . 2011-07-20 09:22 538968 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\MSTORES.DLL
+ 2011-07-20 09:22 . 2011-07-20 09:22 144728 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\MSTORE.EXE
+ 2011-07-20 09:22 . 2011-07-20 09:22 832360 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\MSTORDB.EXE
+ 2006-07-24 17:50 . 2006-07-24 17:50 125744 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\MSSTDFMT.DLL
+ 2009-02-26 02:02 . 2009-02-26 02:02 504176 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\MSSOAP30.DLL
+ 2011-07-27 10:10 . 2011-07-27 10:10 670560 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\MSQRY32.EXE
+ 2011-05-31 21:19 . 2011-05-31 21:19 732000 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\MSPROOF6.DLL
+ 2009-02-26 01:46 . 2009-02-26 01:46 435568 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\MSORUN.DLL
+ 2011-07-27 08:53 . 2011-07-27 08:53 427856 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\MSODCW.DLL
+ 2011-07-27 08:34 . 2011-07-27 08:34 160632 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\MSOCF.DLL
+ 2011-06-23 13:54 . 2011-06-23 13:54 119160 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\MSCONV97.DLL
+ 2011-07-20 09:22 . 2011-07-20 09:22 828264 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\MEDCAT.DLL
+ 2011-07-27 21:49 . 2011-07-27 21:49 177536 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\IETAG.DLL
+ 2008-10-25 11:18 . 2008-10-25 11:18 172880 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\IEAWSDC.DLL
+ 2009-02-26 19:24 . 2009-02-26 19:24 970128 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\FPWEC.DLL
+ 2009-02-26 17:09 . 2009-02-26 17:09 154000 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\ENVELOPE.DLL
+ 2011-07-27 09:13 . 2011-07-27 09:13 434080 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\DWTRIG20.EXE
+ 2011-07-27 09:13 . 2011-07-27 09:13 439128 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\DWDCW20.DLL
+ 2011-07-27 08:53 . 2011-07-27 08:53 105872 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\DSSM.EXE
+ 2011-07-27 08:53 . 2011-07-27 08:53 188800 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\CONTACTPICKER.DLL
+ 2011-07-27 10:13 . 2011-07-27 10:13 204664 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\CLVIEW.EXE
+ 2011-07-27 10:20 . 2011-07-27 10:20 400216 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\CDLMSO.DLL
+ 2011-07-27 08:41 . 2011-07-27 08:41 370608 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\ACEXBE.DLL
+ 2011-07-27 08:41 . 2011-07-27 08:41 223152 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\ACETXT.DLL
+ 2011-07-27 08:41 . 2011-07-27 08:41 550840 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\ACEREP.DLL
+ 2011-07-27 08:41 . 2011-07-27 08:41 288688 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\ACER3X.DLL
+ 2011-07-27 08:41 . 2011-07-27 08:41 255920 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\ACER2X.DLL
+ 2011-07-27 08:41 . 2011-07-27 08:41 391096 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\ACEPDE.DLL
+ 2011-07-27 08:41 . 2011-07-27 08:41 378808 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\ACEOLEDB.DLL
+ 2011-07-27 08:41 . 2011-07-27 08:41 278912 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\ACEODBC.DLL
+ 2011-07-27 08:41 . 2011-07-27 08:41 206776 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\ACELTS.DLL
+ 2011-07-27 08:41 . 2011-07-27 08:41 632752 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\ACEEXCL.DLL
+ 2011-07-27 08:41 . 2011-07-27 08:41 337848 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\ACEEXCH.DLL
+ 2011-07-27 08:41 . 2011-07-27 08:41 186304 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\ACEES.DLL
+ 2011-07-27 08:41 . 2011-07-27 08:41 571320 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\ACEDAO.DLL
+ 2011-07-27 08:41 . 2011-07-27 08:41 763848 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\ACECNF.DLL
+ 2006-10-27 22:35 . 2006-10-27 22:35 436512 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.4518\UMOUTLOOKADDIN.DLL
+ 2006-10-27 03:13 . 2006-10-27 03:13 764800 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.4518\ACECNF.DLL
+ 2012-04-07 05:07 . 2012-04-07 05:07 479232 c:\windows\ERDNT\AutoBackup\4-7-2012\Users\00000002\UsrClass.dat
+ 2012-04-07 05:07 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\4-7-2012\ERDNT.EXE
+ 2012-04-07 03:52 . 2012-04-07 03:52 479232 c:\windows\ERDNT\AutoBackup\4-6-2012\Users\00000002\UsrClass.dat
+ 2012-04-07 03:52 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\4-6-2012\ERDNT.EXE
+ 2012-03-22 22:59 . 2012-03-22 22:59 479232 c:\windows\ERDNT\AutoBackup\3-22-2012\Users\00000002\UsrClass.dat
+ 2012-03-22 22:59 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\3-22-2012\ERDNT.EXE
+ 2012-03-21 18:29 . 2012-03-21 18:29 479232 c:\windows\ERDNT\AutoBackup\3-21-2012\Users\00000002\UsrClass.dat
+ 2012-03-21 18:29 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\3-21-2012\ERDNT.EXE
+ 2012-03-03 04:23 . 2012-03-03 04:23 479232 c:\windows\ERDNT\AutoBackup\3-2-2012\Users\00000002\UsrClass.dat
+ 2012-03-03 04:23 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\3-2-2012\ERDNT.EXE
+ 2012-03-14 05:26 . 2012-03-14 05:26 479232 c:\windows\ERDNT\AutoBackup\3-14-2012\Users\00000002\UsrClass.dat
+ 2012-03-14 05:26 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\3-14-2012\ERDNT.EXE
+ 2012-03-11 16:43 . 2012-03-11 16:43 479232 c:\windows\ERDNT\AutoBackup\3-11-2012\Users\00000002\UsrClass.dat
+ 2012-03-11 16:43 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\3-11-2012\ERDNT.EXE
- 2011-01-21 08:02 . 2011-01-21 08:02 870256 c:\windows\assembly\GAC\Microsoft.Office.Interop.Word\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Word.dll
+ 2012-03-21 07:03 . 2012-03-21 07:03 870256 c:\windows\assembly\GAC\Microsoft.Office.Interop.Word\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Word.dll
+ 2012-03-21 07:03 . 2012-03-21 07:03 149368 c:\windows\assembly\GAC\Microsoft.Office.Interop.Graph\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Graph.dll
+ 2012-04-07 12:59 . 2012-04-07 12:59 8797344 c:\windows\system32\Macromed\Flash\NPSWF32_11_2_202_228.dll
+ 2006-08-10 17:30 . 2012-04-07 03:51 3608064 c:\windows\system32\FNTCACHE.DAT
- 2006-08-10 17:30 . 2012-02-19 08:14 3608064 c:\windows\system32\FNTCACHE.DAT
+ 2011-07-07 06:28 . 2011-07-07 06:28 1193320 c:\windows\system32\FM20.DLL
+ 2009-08-14 13:21 . 2012-02-03 09:22 1860096 c:\windows\system32\dllcache\win32k.sys
+ 2012-03-01 03:45 . 2012-03-01 03:45 4989440 c:\windows\Installer\577327.msp
+ 2011-09-15 22:40 . 2011-09-15 22:40 7959552 c:\windows\Installer\2351773a.msp
+ 2011-09-15 22:35 . 2011-09-15 22:35 1411072 c:\windows\Installer\23517542.msp
- 2009-08-19 09:59 . 2012-02-17 08:00 1172240 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\xlicons.exe
+ 2009-08-19 09:59 . 2012-03-21 07:07 1172240 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\xlicons.exe
+ 2009-08-19 09:59 . 2012-03-21 07:07 1165584 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\accicons.exe
- 2009-08-19 09:59 . 2012-02-17 08:00 1165584 c:\windows\Installer\{91120000-0031-0000-0000-0000000FF1CE}\accicons.exe
- 2011-01-20 09:08 . 2011-12-15 08:12 1172240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe
+ 2011-01-20 09:08 . 2012-03-21 07:04 1172240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe
+ 2009-10-10 03:10 . 2009-10-10 03:10 2594632 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.6612\VBE6.DLL
+ 2006-10-27 01:25 . 2006-10-27 01:25 2172688 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.4518\PSRCHFEA.DLL
+ 2011-08-17 13:49 . 2011-08-17 13:49 4683624 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\WRD12CNV.DLL
+ 2011-07-20 12:12 . 2011-07-20 12:12 3750776 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\VVIEWER.DLL
+ 2011-06-29 11:02 . 2011-06-29 11:02 1846656 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\VVIEWDWG.DLL
+ 2009-10-10 03:10 . 2009-10-10 03:10 2594632 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\VBE6.DLL
+ 2011-07-27 22:15 . 2011-07-27 22:15 2335648 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\STSLIST.DLL
+ 2011-07-27 08:59 . 2011-07-27 08:59 6540136 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\OSETUP.DLL
+ 2011-07-07 06:58 . 2011-07-07 06:58 1616240 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\OGL.DLL
+ 2011-07-27 09:51 . 2011-07-27 09:51 7040896 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\OFFOWC.DLL
+ 2011-08-03 04:14 . 2011-08-03 04:14 8579448 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\OARTCONV.DLL
+ 2011-07-20 09:31 . 2011-07-20 09:31 1523632 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\NLSD0000.DLL
+ 2011-05-26 23:28 . 2011-05-26 23:28 6637952 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\MSORES.DLL
+ 2011-07-27 09:09 . 2011-07-27 09:09 5310848 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\IPEDITOR.DLL
+ 2011-06-22 12:16 . 2011-06-22 12:16 1681784 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\FPSRVUTL.DLL
+ 2011-07-07 06:28 . 2011-07-07 06:28 1193320 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\FM20.DLL
+ 2011-08-03 22:27 . 2011-08-03 22:27 1415072 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\ACECORE.DLL
+ 2012-04-07 05:07 . 2012-04-07 05:07 8212480 c:\windows\ERDNT\AutoBackup\4-7-2012\Users\00000001\ntuser.dat
+ 2012-04-07 03:52 . 2012-04-07 03:52 8212480 c:\windows\ERDNT\AutoBackup\4-6-2012\Users\00000001\ntuser.dat
+ 2012-03-22 22:59 . 2012-03-22 22:59 8212480 c:\windows\ERDNT\AutoBackup\3-22-2012\Users\00000001\ntuser.dat
+ 2012-03-21 18:29 . 2012-03-21 18:29 8212480 c:\windows\ERDNT\AutoBackup\3-21-2012\Users\00000001\ntuser.dat
+ 2012-03-03 04:23 . 2012-03-03 04:23 8212480 c:\windows\ERDNT\AutoBackup\3-2-2012\Users\00000001\ntuser.dat
+ 2012-03-14 05:26 . 2012-03-14 05:26 8212480 c:\windows\ERDNT\AutoBackup\3-14-2012\Users\00000001\ntuser.dat
+ 2012-03-11 16:43 . 2012-03-11 16:43 8212480 c:\windows\ERDNT\AutoBackup\3-11-2012\Users\00000001\ntuser.dat
+ 2012-03-21 07:03 . 2012-03-21 07:03 1279864 c:\windows\assembly\GAC\Microsoft.Office.Interop.Excel\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Excel.dll
+ 2006-08-10 17:41 . 2012-03-14 07:02 54215544 c:\windows\system32\MRT.exe
+ 2011-09-15 22:39 . 2011-09-15 22:39 11163136 c:\windows\Installer\23517730.msp
+ 2011-09-15 22:38 . 2011-09-15 22:38 10838528 c:\windows\Installer\23517724.msp
+ 2011-09-15 22:37 . 2011-09-15 22:37 16691712 c:\windows\Installer\2351755e.msp
+ 2011-09-15 22:37 . 2011-09-15 22:37 34428416 c:\windows\Installer\23517543.msp
+ 2011-09-16 00:42 . 2011-09-16 00:42 18115432 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\WWLIB.DLL
+ 2011-08-17 14:01 . 2011-08-17 14:01 16149352 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\OART.DLL
+ 2011-08-03 23:53 . 2011-08-03 23:53 17324928 c:\windows\Installer\$PatchCache$\Managed\00002119130000000000000000F01FEC\12.0.6612\MSO.DLL
+ 2011-09-15 22:34 . 2011-09-15 22:34 428804608 c:\windows\Installer\2351764f.msp
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2009-04-02 20:47 333192 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2009-04-02 333192]
.
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2009-04-02 333192]
.
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Vidalia"="c:\program files\Vidalia Bundle\Vidalia\vidalia.exe" [2011-10-12 5407850]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2012-03-18 742264]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2008-03-26 163840]
"BisonMnt"="c:\windows\BisonC07\BisonM07.exe" [2008-10-14 32768]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
"PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2010-11-05 517480]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2012-01-13 981680]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 49152]
"EnergyUtility"="c:\program files\Lenovo\Energy Management\utility.exe" [2009-06-12 4464640]
"Energy Management"="c:\program files\Lenovo\Energy Management\Energy Management.exe" [2009-06-10 1282048]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-22 129536]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-22 163328]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-22 138752]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2011-07-27 434080]
.
c:\documents and settings\Michele\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2010-12-9 813584]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-10-09 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^Michele^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\documents and settings\Michele\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Michele^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk]
path=c:\documents and settings\Michele\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
backup=c:\windows\pss\OpenOffice.org 3.2.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 07:37 843712 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
2010-03-06 08:44 500208 ------w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
2009-04-24 03:05 203416 ----a-w- c:\program files\Alcohol Soft\Alcohol 52\AxCmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Energy Management]
2009-06-10 22:32 1282048 ----a-w- c:\program files\Lenovo\Energy Management\Energy Management.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EnergyUtility]
2009-06-12 19:59 4464640 ----a-w- c:\program files\Lenovo\Energy Management\utility.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2011-06-01 23:25 136176 ----atw- c:\documents and settings\Michele\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Memeo AutoSync]
2010-04-16 21:43 144608 ----a-w- c:\program files\Memeo\AutoSync\MemeoLauncher2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Memeo Backup Premium]
2010-04-23 00:49 136416 ----a-w- c:\program files\Memeo\AutoBackupPro\MemeoLauncher2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Memeo Send]
2009-11-05 00:29 236816 ----a-w- c:\program files\Memeo\Memeo Send\MemeoLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 21:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Seagate Dashboard]
2010-04-30 14:47 79112 ----a-w- c:\program files\Seagate\Seagate Dashboard\MemeoLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmartAudio]
2009-04-23 09:11 2742840 ----a-w- c:\program files\CONEXANT\SmartAudio\SmAudio.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmAudio]
2009-04-23 09:11 2742840 ----a-w- c:\program files\CONEXANT\SmartAudio\SmAudio.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-06-09 18:06 254696 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SeaPort"=2 (0x2)
"IviRegMgr"=2 (0x2)
"gupdate"=2 (0x2)
"BcmSqlStartupSvc"=2 (0x2)
"ASKUpgrade"=2 (0x2)
"ASKService"=2 (0x2)
"MemeoBackgroundService"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\Rosetta Stone\\Rosetta Stone Version 3\\support\\bin\\win\\RosettaStoneLtdServices.exe"=
"c:\\Program Files\\Rosetta Stone\\Rosetta Stone Version 3\\RosettaStoneVersion3.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Documents and Settings\\Michele\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
.
R2 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-10-21 196176]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-12 135664]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2011-12-11 2152152]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-07 253600]
R3 audiobridge;Virtual Audio Bridge;c:\windows\system32\DRIVERS\aubridge.sys [2007-07-23 22528]
R3 cpudrv;cpudrv;c:\program files\SystemRequirementsLab\cpudrv.sys [2009-12-18 11336]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2011-05-17 13224]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-12 135664]
R3 MatSvc;Microsoft Automated Troubleshooting Service;c:\program files\Microsoft Fix it Center\Matsvc.exe [2010-11-16 267568]
R4 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [2009-04-02 464264]
R4 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [2009-04-02 234888]
R4 MemeoBackgroundService;MemeoBackgroundService;c:\program files\Memeo\AutoBackupPro\MemeoBackgroundService.exe [2010-04-23 25824]
S0 DozeHDD;DozeHDD;c:\windows\System32\DRIVERS\DozeHDD.sys [2010-11-05 24304]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2011-12-02 64512]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2011-10-09 116608]
S2 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\SeaPort.EXE [2011-10-13 249648]
S2 DozeSvc;Lenovo Doze Mode Service;c:\program files\ThinkPad\Utilities\DOZESVC.EXE [2010-11-05 132456]
S2 LBeepKE;LBeepKE;c:\windows\system32\Drivers\LBeepKE.sys [2009-06-17 10384]
S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [2008-01-11 9472]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - ADOBEFLASHPLAYERUPDATESVC
*NewlyCreated* - LAVASOFT_KERNEXPLORER
*NewlyCreated* - MPKSLAE3F3734
*NewlyCreated* - MPKSLE2129611
*Deregistered* - Lavasoft Kernexplorer
*Deregistered* - MpKsle2129611
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
WD_FireWire_HID
.
Contents of the 'Scheduled Tasks' folder
.
2012-04-08 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2011-12-02 05:41]
.
2012-04-08 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-07 12:59]
.
2012-04-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57]
.
2012-04-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-12 20:10]
.
2012-04-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-12 20:10]
.
2012-04-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4139560822-1196392724-1434190299-1007Core.job
- c:\documents and settings\Michele\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-07-03 23:25]
.
2012-04-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4139560822-1196392724-1434190299-1007UA.job
- c:\documents and settings\Michele\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-07-03 23:25]
.
2012-04-07 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 19:39]
.
2012-03-16 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\PC-Doctor\uaclauncher.exe [2011-06-27 15:54]
.
2012-04-08 c:\windows\Tasks\PMTask.job
- c:\progra~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2010-12-11 06:29]
.
2012-04-08 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\PC-Doctor\uaclauncher.exe [2011-06-27 15:54]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
FF - ProfilePath - c:\documents and settings\Michele\Application Data\Mozilla\Firefox\Profiles\zx1479pg.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://bing.zugotoolbar.com/s/?iesrc=IE-Address&site=Bing&q=
FF - prefs.js: network.proxy.type - 4
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - %profile%\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
FF - Ext: Zynga Community Toolbar: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - %profile%\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}
FF - Ext: Torbutton: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca} - %profile%\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter:
[email protected] - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Move Media Player:
[email protected] - c:\documents and settings\Michele\Application Data\Move Networks
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
.
- - - - ORPHANS REMOVED - - - -
.
SafeBoot-Wdf01000.sys
AddRemove-ffdshow - c:\program files\K-Lite Codec Pack\ffdshow\uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2012-04-08 19:12
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
BisonMnt = c:\windows\BisonC07\BisonM07.exe????????????????????????????????????????????????????????????????????????????????H???????????????????????????????????????????????????????`????v?|????????????????????????x????x?|?????`?????????????????|?????????????????X?w???
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PCDSRVC{3037D694-FD904ACA-06020200}_0]
"ImagePath"="\??\c:\program files\pc-doctor\pcdsrvc.pkms"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1112)
c:\windows\system32\WININET.dll
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
- - - - - - - > 'lsass.exe'(1172)
c:\windows\system32\WININET.dll
.
Completion time: 2012-04-08 19:17:18
ComboFix-quarantined-files.txt 2012-04-08 23:17
ComboFix2.txt 2012-04-07 11:13
ComboFix3.txt 2012-02-20 13:36
ComboFix4.txt 2012-02-19 05:27
ComboFix5.txt 2012-04-08 22:48
.
Pre-Run: 41,852,973,056 bytes free
Post-Run: 42,630,815,744 bytes free
.
- - End Of File - - CB36C168DD6D52C0933F416DADDC3D28
This topic is locked
Sign In
Create Account
