[Vladimir90]

Lately(past month) my internet was really slow, so I downloaded TCPView and I noticed that svchost.exe is sending tones of packs and using lot of connection. So I got my self AVG (free version) and Spybot Search and Destroy they both found something but they didn't fix the svchost.exe spam. Plus I have RUBotted and it isn't detecting anything.

thx! for your help.

OTL logfile created on: 5/4/2012 7:35:22 PM - Run 1
OTL by OldTimer - Version 3.2.42.2 Folder = C:\Documents and Settings\EndBringer\Desktop\SVC
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1023.48 Mb Total Physical Memory | 373.43 Mb Available Physical Memory | 36.49% Memory free
2.40 Gb Paging File | 1.59 Gb Available in Paging File | 66.42% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 41.06 Gb Total Space | 14.23 Gb Free Space | 34.66% Space Free | Partition Type: NTFS
Drive D: | 35.27 Gb Total Space | 4.66 Gb Free Space | 13.21% Space Free | Partition Type: NTFS

Computer Name: HARRY | User Name: EndBringer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/05/04 19:33:45 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\EndBringer\Desktop\SVC\OTL.exe
PRC - [2012/04/30 09:44:38 | 005,106,744 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgidsagent.exe
PRC - [2012/04/19 04:51:54 | 001,254,992 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgnsx.exe
PRC - [2012/04/05 05:12:34 | 002,587,008 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgtray.exe
PRC - [2012/03/19 05:18:12 | 000,979,840 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgemcx.exe
PRC - [2012/03/13 06:39:04 | 000,924,600 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2012/02/14 04:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgwdsvc.exe
PRC - [2012/02/14 04:53:14 | 000,758,112 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgrsx.exe
PRC - [2012/02/14 04:52:38 | 000,338,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgcsrvx.exe
PRC - [2011/11/03 17:20:58 | 000,803,144 | ---- | M] (AVG) -- C:\Program Files\AVG\AVG PC Tuneup\BoostSpeed.exe
PRC - [2010/12/17 09:33:10 | 000,439,632 | ---- | M] (Trend Micro Inc.) -- C:\Program Files\Trend Micro\RUBotted\RUBotSrv.exe
PRC - [2010/12/17 09:33:06 | 001,103,184 | ---- | M] (Trend Micro Inc.) -- C:\Program Files\Trend Micro\RUBotted\RUBottedGUI.exe
PRC - [2009/12/23 23:34:20 | 000,370,688 | ---- | M] (StarWind Software) -- C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
PRC - [2009/02/12 17:25:40 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/09/02 14:58:52 | 000,495,616 | ---- | M] () -- C:\Program Files\RocketDock\RocketDock.exe


========== Modules (No Company Name) ==========

MOD - [2012/04/16 23:51:59 | 008,797,344 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll
MOD - [2012/03/13 06:39:07 | 001,969,080 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2011/11/03 17:21:06 | 000,350,024 | ---- | M] () -- C:\Program Files\AVG\AVG PC Tuneup\madExcept_.bpl
MOD - [2011/11/03 17:21:06 | 000,184,136 | ---- | M] () -- C:\Program Files\AVG\AVG PC Tuneup\madBasic_.bpl
MOD - [2011/11/03 17:21:06 | 000,050,504 | ---- | M] () -- C:\Program Files\AVG\AVG PC Tuneup\madDisAsm_.bpl
MOD - [2010/08/24 19:06:46 | 000,085,840 | ---- | M] () -- C:\Program Files\Trend Micro\RUBotted\hc_help.dll
MOD - [2010/03/15 12:28:22 | 000,141,824 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll
MOD - [2009/02/12 17:17:56 | 000,190,464 | ---- | M] () -- C:\WINDOWS\system32\WgaLogon.dll
MOD - [2008/05/16 15:01:00 | 000,466,944 | ---- | M] () -- C:\WINDOWS\system32\nvshell.dll
MOD - [2007/12/24 02:08:44 | 000,391,680 | ---- | M] () -- C:\Program Files\RocketDock\Docklets\StackDocklet\StackDocklet.dll
MOD - [2007/09/02 14:58:52 | 000,495,616 | ---- | M] () -- C:\Program Files\RocketDock\RocketDock.exe
MOD - [2007/09/02 14:57:36 | 000,069,632 | ---- | M] () -- C:\Program Files\RocketDock\RocketDock.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- %systemroot%\system32\umxfwhlp.dll -- (zdeviceservice)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\symmpi.dll -- (wlancig)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\SWNC5E00.dll -- (vproeventmonitor)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\sffdisk.dll -- (VCAM)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\CDRPDACC.dll -- (vaiomediaplatform-mobile-gateway)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\protectionservice.dll -- (teefer2)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\prohlp02.dll -- (srescan)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\enodpl.dll -- (sonypvu1)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\ELacpi.dll -- (SndTDriverV32)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\oracleformsserver-forms60server-oraform.dll -- (ser2pl)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\dlcq_device.dll -- (sentinel)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\e1000.dll -- (se58mdm)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\mcp.dll -- (se44mgmt)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\UMAXPCLS.dll -- (SE2Dobex)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\pvservice.dll -- (rtl8139)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\lxcc_device.dll -- (rimsptsk)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\mrxdav.dll -- (racsvc)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\nbf.dll -- (qbreminderflash)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\epson_pm_rpcv2_02.dll -- (PSI_SVC_2)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\vmparport.dll -- (pelmouse)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\afd.dll -- (OEM02Afx)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\vgasave.dll -- (nv4)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\symantecantibotdriver.dll -- (npfmntor)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\avgmfx86.dll -- (NetwareWorkstation)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\hidusb.dll -- (msfwsvc)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\DgiVecp.dll -- (Maplom)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\proxyhostservice.dll -- (lvusbsta)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\VAIOMediaPlatform-VideoServer-HTTP.dll -- (LoopBeMidi1)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\vtserver.dll -- (k750mdfl)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\macformatservice.dll -- (iolodmv)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\pxhelp20.dll -- (HSFHWICH)
SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\tunmp.dll -- (GT890x)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\usbvideo.dll -- (db2ntsecserver)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\W8100PCI.dll -- (cpqrcmc)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\ageremodemaudio.dll -- (bufserv)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\vzfw.dll -- (btnhnd)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\LHidUsbK.dll -- (BrPar)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\ssrtln.dll -- (ATSWPDRV)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\el90xbc.dll -- (asusgsb)
SRV - File not found [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - File not found [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\pdreli.dll -- (alim1541)
SRV - [2012/04/30 09:44:38 | 005,106,744 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2012\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2012/04/16 23:52:00 | 000,253,088 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/02/15 14:30:18 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/02/14 04:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2012\avgwdsvc.exe -- (avgwd)
SRV - [2011/03/16 10:42:06 | 000,407,336 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2010/12/17 09:33:10 | 000,439,632 | ---- | M] (Trend Micro Inc.) [Auto | Running] -- C:\Program Files\Trend Micro\RUBotted\RUBotSrv.exe -- (RUBotSrv)
SRV - [2010/08/29 21:55:06 | 003,739,080 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\WINDOWS\system32\GameMon.des -- (npggsvc)
SRV - [2009/12/23 23:34:20 | 000,370,688 | ---- | M] (StarWind Software) [Auto | Running] -- C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)
SRV - [2009/10/20 20:19:48 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - [2007/05/16 14:48:56 | 000,228,208 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Windows Live\installer\WLSetupSvc.exe -- (WLSetupSvc)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\XDva370.sys -- (XDva370)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\XDva365.sys -- (XDva365)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\XDva344.sys -- (XDva344)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\EagleNT.sys -- (EagleNT)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | System | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (a03q8yz4)
DRV - [2012/04/19 04:50:26 | 000,024,896 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\avgidshx.sys -- (AVGIDSHX)
DRV - [2012/03/22 04:11:36 | 000,215,168 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\ndis.sys -- (NDIS)
DRV - [2012/03/19 05:17:28 | 000,301,248 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2012/02/22 05:25:32 | 000,235,216 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2012/01/31 04:46:50 | 000,031,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\avgrkx86.sys -- (Avgrkx86)
DRV - [2012/01/04 23:50:27 | 000,010,872 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\apf001.sys -- (apf001)
DRV - [2011/12/23 13:32:14 | 000,041,040 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2011/12/23 13:32:08 | 000,017,232 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avgidsshimx.sys -- (AVGIDSShim)
DRV - [2011/12/23 13:32:06 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avgidsfilterx.sys -- (AVGIDSFilter)
DRV - [2011/12/23 13:32:00 | 000,139,856 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avgidsdriverx.sys -- (AVGIDSDriver)
DRV - [2011/07/26 17:45:01 | 000,475,736 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\klif.sys -- (KLIF)
DRV - [2011/06/17 12:37:08 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/06/17 12:37:08 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010/11/09 16:35:30 | 000,021,992 | ---- | M] (CPUID) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\cpuz135_x32.sys -- (cpuz135)
DRV - [2010/09/17 13:27:32 | 000,023,696 | ---- | M] (Steinberg Media Technologies GmbH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\synasusb.sys -- (SynasUSB)
DRV - [2010/06/30 15:59:35 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2010/06/09 16:43:52 | 000,011,352 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\kl2.sys -- (kl2)
DRV - [2010/06/09 16:43:50 | 000,132,184 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\kl1.sys -- (KL1)
DRV - [2010/05/07 11:06:26 | 000,032,856 | ---- | M] (Kaspersky Lab ZAO) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\klim5.sys -- (klim5)
DRV - [2009/12/30 11:20:56 | 000,027,064 | ---- | M] (VS Revo Group) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\revoflt.sys -- (Revoflt)
DRV - [2009/11/02 19:27:24 | 000,019,472 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\klmouflt.sys -- (klmouflt)
DRV - [2009/10/20 20:19:44 | 000,050,704 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\npf.sys -- (NPF)
DRV - [2009/05/11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2007/05/11 03:10:50 | 000,034,704 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\blueletaudio.sys -- (BlueletAudio)
DRV - [2007/05/09 01:59:40 | 000,036,496 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btcusb.sys -- (Btcsrusb)
DRV - [2007/03/05 06:00:04 | 000,027,792 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BlueletSCOAudio.sys -- (BlueletSCOAudio)
DRV - [2007/03/05 05:59:04 | 000,018,320 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btnetdrv.sys -- (BT)
DRV - [2007/03/05 05:56:18 | 000,035,600 | ---- | M] (IVT Corporation.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\BTHidMgr.sys -- (BTHidMgr)
DRV - [2007/03/05 05:55:12 | 000,020,880 | ---- | M] (IVT Corporation.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\vbtenum.sys -- (BTHidEnum)
DRV - [2007/03/05 05:53:18 | 000,044,304 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\VcommMgr.sys -- (VcommMgr)
DRV - [2007/03/05 05:52:18 | 000,034,448 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\VComm.sys -- (VComm)
DRV - [2006/11/21 22:41:18 | 000,022,416 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Stopped] -- C:\Program Files\IVT Corporation\BlueSoleil\device\Win2k\BTNetFilter.sys -- (BTNetFilter)
DRV - [2006/10/13 18:31:00 | 004,022,528 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\alcxwdm.sys -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2005/04/05 21:22:30 | 000,012,928 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2005/04/05 21:22:28 | 000,033,536 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2005/03/16 08:23:54 | 000,013,696 | R--- | M] (BIOSTAR Group) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\BIOS.sys -- (BIOS)
DRV - [2004/06/29 10:07:18 | 001,268,204 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2003/11/01 22:19:38 | 000,017,920 | ---- | M] (CEntrance, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ceusbaud.sys -- (CEUSBAUD)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\..\SearchScopes,DefaultScope = {9D46D053-D9AF-4BE0-AFAE-DB3A9FCFD002}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...Box&Form=IE8SRC
IE - HKCU\..\SearchScopes\{9D46D053-D9AF-4BE0-AFAE-DB3A9FCFD002}: "URL" = http://flvdirect.iam...h={SearchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;<local>

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search"
FF - prefs.js..browser.search.defaulturl: "http://flvdirect.iam...c=tops&search="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://en-US.start3....en-US:official"
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.8.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {35379F86-8CCB-4724-AE33-4278DE266C70}:1.0.7
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: [email protected]:3.2.5.2
FF - prefs.js..extensions.enabledItems: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}:3.6.0.10
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20110704


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll File not found
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Documents and Settings\EndBringer\Application Data\Facebook\npfbplugin_1_0_3.dll File not found
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012/05/03 18:59:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F53C93F1-07D5-430c-86D4-C9531B27DFAF}: C:\Program Files\AVG\AVG2012\Firefox\DoNotTrack\ [2012/05/03 18:58:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/03/22 16:39:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/04/11 20:10:21 | 000,000,000 | ---D | M]

[2010/03/24 20:53:27 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\EndBringer\Application Data\Mozilla\Extensions
[2012/03/04 19:31:02 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\EndBringer\Application Data\Mozilla\Firefox\Profiles\ltkujnvj.default\extensions
[2012/03/04 19:31:02 | 000,000,000 | ---D | M] (WOT) -- C:\Documents and Settings\EndBringer\Application Data\Mozilla\Firefox\Profiles\ltkujnvj.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012/04/25 15:00:19 | 000,002,023 | ---- | M] () -- C:\Documents and Settings\EndBringer\Application Data\Mozilla\Firefox\Profiles\ltkujnvj.default\searchplugins\google-translate.xml
[2012/05/02 15:38:50 | 000,004,873 | ---- | M] () -- C:\Documents and Settings\EndBringer\Application Data\Mozilla\Firefox\Profiles\ltkujnvj.default\searchplugins\isohunt--bt-search.xml
[2011/04/28 17:00:06 | 000,001,959 | ---- | M] () -- C:\Documents and Settings\EndBringer\Application Data\Mozilla\Firefox\Profiles\ltkujnvj.default\searchplugins\lastfm.xml
[2011/04/23 14:40:58 | 000,005,245 | ---- | M] () -- C:\Documents and Settings\EndBringer\Application Data\Mozilla\Firefox\Profiles\ltkujnvj.default\searchplugins\magiccardsinfo.xml
[2010/05/05 15:47:26 | 000,000,266 | ---- | M] () -- C:\Documents and Settings\EndBringer\Application Data\Mozilla\Firefox\Profiles\ltkujnvj.default\searchplugins\Search.xml
[2011/04/21 19:36:54 | 000,002,043 | ---- | M] () -- C:\Documents and Settings\EndBringer\Application Data\Mozilla\Firefox\Profiles\ltkujnvj.default\searchplugins\the-free-dictionary.xml
[2010/05/23 15:25:37 | 000,002,057 | ---- | M] () -- C:\Documents and Settings\EndBringer\Application Data\Mozilla\Firefox\Profiles\ltkujnvj.default\searchplugins\youtube-video-search.xml
[2012/04/04 17:24:09 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/09/11 22:58:16 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2012/04/04 17:24:10 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
[2010/05/05 15:47:58 | 000,000,000 | ---D | M] (LoudMo Contextual Ad Assistant) -- C:\Program Files\Mozilla Firefox\extensions\{cceafe57-b9c6-a56f-455a-438db22009c4}
[2012/05/03 18:58:50 | 000,000,000 | ---D | M] (AVG Do Not Track) -- C:\PROGRAM FILES\AVG\AVG2012\FIREFOX\DONOTTRACK
[2012/03/13 06:39:39 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/04/04 17:23:49 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012/03/13 06:38:32 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/03/13 06:38:32 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012/05/03 17:31:28 | 000,442,026 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 123fporn.info
O1 - Hosts: 15214 more lines...
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - Reg Error: Value error. File not found
O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll ()
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [Trend Micro RUBotted V2.0 Beta] C:\Program Files\Trend Micro\RUBotted\RUBottedGUI.exe (Trend Micro Inc.)
O4 - HKCU..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 52\AxAutoMntSrv.exe (Alcohol Soft Development Team)
O4 - HKCU..\Run: [RocketDock] C:\Program Files\RocketDock\RocketDock.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe (IVT Corporation.)
O4 - Startup: C:\Documents and Settings\EndBringer\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Download by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O9 - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - mswsock.dll File not found
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: kuaiche.com ([software] http in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{82A7CAD2-F3DB-4B48-840C-C44FBC971412}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\klogon: DllName - (C:\WINDOWS\system32\klogon.dll) - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab ZAO)
O20 - Winlogon\Notify\WgaLogon: DllName - (WgaLogon.dll) - C:\WINDOWS\System32\WgaLogon.dll ()
O24 - Desktop WallPaper: C:\Documents and Settings\EndBringer\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\EndBringer\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/03/24 20:28:17 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/05/04 19:34:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\EndBringer\Desktop\SVC
[2012/05/04 19:25:20 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\EndBringer\Recent
[2012/05/04 17:14:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Trend Micro
[2012/05/04 17:10:33 | 000,000,000 | ---D | C] -- C:\svchost
[2012/05/04 17:02:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\WinPcap
[2012/05/04 17:01:59 | 000,000,000 | ---D | C] -- C:\Program Files\WinPcap
[2012/05/04 17:01:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Trend Micro RUBotted
[2012/05/04 17:01:22 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2012/05/04 17:01:03 | 006,018,568 | ---- | C] (Trend Micro, Inc. ) -- C:\Documents and Settings\EndBringer\Desktop\RUBottedSetup.exe
[2012/05/04 17:00:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\EndBringer\Desktop\TCPView
[2012/05/03 19:54:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\EndBringer\Application Data\AVG
[2012/05/03 19:53:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\AVG PC Tuneup 2011
[2012/05/03 19:05:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\EndBringer\Application Data\AVG2012
[2012/05/03 18:59:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\AVG
[2012/05/03 18:58:44 | 000,000,000 | -H-D | C] -- C:\$AVG
[2012/05/03 18:58:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVG2012
[2012/05/03 18:58:44 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\AVG
[2012/05/03 18:58:06 | 000,000,000 | ---D | C] -- C:\Program Files\AVG
[2012/05/03 17:26:38 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2012/05/03 16:34:11 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2012/05/03 16:33:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2012/04/19 04:50:26 | 000,024,896 | ---- | C] (AVG Technologies CZ, s.r.o. ) -- C:\WINDOWS\System32\drivers\avgidshx.sys
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/05/04 19:39:15 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/05/04 19:09:38 | 000,186,097 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2012/05/04 19:09:22 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/05/04 19:09:09 | 1073,270,784 | -HS- | M] () -- C:\hiberfil.sys
[2012/05/04 19:07:07 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\EndBringer\updateall.cfg
[2012/05/04 17:32:09 | 000,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb
[2012/05/04 17:32:09 | 000,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb
[2012/05/04 17:02:01 | 000,000,073 | ---- | M] () -- C:\WINDOWS\System32\-1
[2012/05/04 16:53:32 | 006,018,568 | ---- | M] (Trend Micro, Inc. ) -- C:\Documents and Settings\EndBringer\Desktop\RUBottedSetup.exe
[2012/05/04 16:21:59 | 097,104,481 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2012/05/03 19:53:25 | 000,000,795 | ---- | M] () -- C:\Documents and Settings\EndBringer\Desktop\AVG PC Tuneup 2011.lnk
[2012/05/03 17:31:28 | 000,442,026 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2012/05/03 17:26:40 | 000,000,933 | ---- | M] () -- C:\Documents and Settings\EndBringer\Desktop\Spybot - Search & Destroy.lnk
[2012/05/02 15:34:22 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/04/26 20:15:50 | 008,031,642 | ---- | M] () -- C:\Documents and Settings\EndBringer\Desktop\new-6.jpg
[2012/04/26 18:14:07 | 000,343,750 | ---- | M] () -- C:\Documents and Settings\EndBringer\Desktop\FB 2.jpg
[2012/04/26 18:13:34 | 000,463,423 | ---- | M] () -- C:\Documents and Settings\EndBringer\Desktop\FB.jpg
[2012/04/26 17:59:25 | 086,557,041 | ---- | M] () -- C:\Documents and Settings\EndBringer\Desktop\new-6.cpt
[2012/04/26 01:11:22 | 000,000,582 | ---- | M] () -- C:\Documents and Settings\EndBringer\My Documents\My Sharing Folders.lnk
[2012/04/20 21:37:45 | 000,124,711 | ---- | M] () -- C:\Documents and Settings\EndBringer\Desktop\Carach Angren.jpg
[2012/04/19 04:50:26 | 000,024,896 | ---- | M] (AVG Technologies CZ, s.r.o. ) -- C:\WINDOWS\System32\drivers\avgidshx.sys
[2012/04/17 20:15:50 | 084,015,848 | ---- | M] () -- C:\Documents and Settings\EndBringer\Desktop\LGOS.wav
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/05/04 19:07:07 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\EndBringer\updateall.cfg
[2012/05/04 17:36:04 | 1073,270,784 | -HS- | C] () -- C:\hiberfil.sys
[2012/05/04 17:02:00 | 000,000,073 | ---- | C] () -- C:\WINDOWS\System32\-1
[2012/05/04 16:21:59 | 097,104,481 | ---- | C] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2012/05/03 19:53:25 | 000,000,795 | ---- | C] () -- C:\Documents and Settings\EndBringer\Desktop\AVG PC Tuneup 2011.lnk
[2012/05/03 17:26:40 | 000,000,933 | ---- | C] () -- C:\Documents and Settings\EndBringer\Desktop\Spybot - Search & Destroy.lnk
[2012/04/26 18:14:07 | 000,343,750 | ---- | C] () -- C:\Documents and Settings\EndBringer\Desktop\FB 2.jpg
[2012/04/26 18:12:39 | 000,463,423 | ---- | C] () -- C:\Documents and Settings\EndBringer\Desktop\FB.jpg
[2012/04/26 18:03:54 | 008,031,642 | ---- | C] () -- C:\Documents and Settings\EndBringer\Desktop\new-6.jpg
[2012/04/26 17:59:14 | 086,557,041 | ---- | C] () -- C:\Documents and Settings\EndBringer\Desktop\new-6.cpt
[2012/04/20 21:34:26 | 000,124,711 | ---- | C] () -- C:\Documents and Settings\EndBringer\Desktop\Carach Angren.jpg
[2012/04/17 20:15:23 | 084,015,848 | ---- | C] () -- C:\Documents and Settings\EndBringer\Desktop\LGOS.wav
[2012/04/10 16:24:57 | 000,000,830 | ---- | C] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/03/22 15:15:35 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012/03/08 01:32:38 | 000,002,304 | ---- | C] () -- C:\WINDOWS\System32\HtsysmNT.sys
[2012/01/12 01:01:44 | 000,002,892 | ---- | C] () -- C:\WINDOWS\System32\audcon.sys
[2012/01/12 00:45:40 | 000,000,045 | ---- | C] () -- C:\WINDOWS\System32\SYNSOPOS.exe.cfg
[2012/01/04 23:50:30 | 000,012,920 | ---- | C] () -- C:\WINDOWS\System32\apl001.sys
[2012/01/04 23:50:27 | 000,010,872 | ---- | C] () -- C:\WINDOWS\System32\apf001.sys
[2011/08/06 14:07:04 | 000,000,380 | ---- | C] () -- C:\WINDOWS\System32\secustat.dat
[2011/08/06 14:01:31 | 000,001,184 | ---- | C] () -- C:\WINDOWS\System32\secushr.dat
[2011/08/06 14:00:53 | 000,000,025 | ---- | C] () -- C:\WINDOWS\libem.INI
[2011/07/26 17:46:43 | 000,113,933 | ---- | C] () -- C:\WINDOWS\System32\drivers\klin.dat
[2011/07/26 17:46:43 | 000,097,549 | ---- | C] () -- C:\WINDOWS\System32\drivers\klick.dat
[2011/07/26 14:01:03 | 000,246,272 | ---- | C] () -- C:\WINDOWS\unrar.exe
[2011/07/26 13:57:31 | 000,000,000 | ---- | C] () -- C:\WINDOWS\loader2.exe_ok
[2011/06/10 13:32:23 | 000,000,096 | -H-- | C] () -- C:\WINDOWS\System32\HsInfo.dat
[2011/05/13 20:41:25 | 000,000,056 | RHS- | C] () -- C:\WINDOWS\System32\402EDC7190.sys
[2011/05/13 20:41:23 | 000,001,890 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2011/01/21 03:16:39 | 000,165,376 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2011/01/21 03:16:38 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini
[2011/01/21 03:16:36 | 000,810,496 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2011/01/21 03:16:36 | 000,183,808 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2011/01/21 03:16:35 | 000,080,896 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2010/12/29 22:29:13 | 000,000,008 | ---- | C] () -- C:\Documents and Settings\EndBringer\Application Data\DofusAppId0_3
[2010/12/29 17:38:05 | 000,000,008 | ---- | C] () -- C:\Documents and Settings\EndBringer\Application Data\DofusAppId0_1
[2010/12/29 17:37:11 | 000,000,205 | ---- | C] () -- C:\Documents and Settings\EndBringer\Application Data\D2Info0
[2010/12/29 17:37:11 | 000,000,008 | ---- | C] () -- C:\Documents and Settings\EndBringer\Application Data\DofusAppId0_2
[2010/10/09 17:47:05 | 000,230,752 | ---- | C] () -- C:\WINDOWS\patchw32.dll
[2010/10/09 17:47:04 | 000,118,176 | ---- | C] () -- C:\WINDOWS\patchw.dll
[2010/06/05 17:45:48 | 000,000,049 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

========== LOP Check ==========

[2012/03/22 16:01:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\529C544A000435DB0000657CD151FC4E
[2012/02/14 16:19:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2012/05/03 19:10:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG2012
[2010/08/07 16:45:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Bluetooth
[2012/05/03 16:34:11 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2011/08/18 23:47:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Easybits GO
[2012/01/12 00:54:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\eLicenser
[2010/08/30 16:57:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Guitar Pro 6
[2011/04/23 19:28:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\InterAction studios
[2010/04/16 14:49:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Last.fm
[2012/05/04 16:22:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2012/05/03 16:49:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NexonUS
[2011/03/30 14:50:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nitro PDF
[2011/07/26 14:37:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ParetoLogic
[2012/04/30 04:47:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PMB Files
[2012/03/22 04:09:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RELOADED
[2012/01/12 01:03:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Steinberg
[2012/01/12 01:01:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Syncrosoft
[2011/05/26 22:37:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Tarma Installer
[2012/05/04 19:42:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2011/01/04 19:37:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WindowsLiveInstaller
[2011/02/07 17:13:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2012/04/02 19:46:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\YouTube Downloader
[2011/07/26 14:50:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}
[2012/01/03 16:50:32 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{83715500-D3AC-4C3B-845D-FF6AAB70A56E}
[2012/01/02 19:01:08 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{C5EE6DA0-A057-4009-BADC-FB7523A5715F}
[2012/03/04 23:48:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\.minecraft
[2010/12/29 17:37:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\app
[2012/05/03 19:59:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\AVG
[2012/05/03 19:05:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\AVG2012
[2011/09/05 05:33:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\BITS
[2011/03/28 20:45:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\BugTrap Console Test108
[2012/04/26 17:47:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Canon
[2010/12/29 19:09:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Dofus 2
[2010/12/29 17:37:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Dofus-2.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
[2010/12/29 22:29:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Dofus-3.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
[2010/12/29 17:38:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Dofus.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
[2011/07/26 14:15:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\DriverCure
[2011/11/07 17:00:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\ESET
[2012/03/22 04:09:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\FALCOM
[2011/08/06 14:00:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\FlashGet
[2011/08/06 14:00:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\FlashGetBHO
[2011/08/18 23:47:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\go
[2010/03/25 23:34:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\GrabPro
[2011/04/07 17:08:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Guitar Pro 6
[2010/10/13 18:13:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\ICQ
[2011/07/24 20:32:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Laconic Software
[2011/03/30 16:48:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\LolClient
[2010/04/03 15:50:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\NetMedia Providers
[2012/04/12 20:10:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Nitro PDF
[2011/04/05 17:28:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\OpenCandy
[2012/05/03 16:13:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Orbit
[2011/07/26 14:15:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\ParetoLogic
[2011/08/19 00:06:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\PriceGong
[2011/03/30 14:48:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\ProgSense
[2011/05/21 17:49:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Publish Providers
[2011/07/26 18:08:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\QuickScan
[2010/12/29 17:37:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Reg.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
[2011/04/05 17:29:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Reviversoft
[2012/02/22 00:32:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\RotMG.Production
[2012/03/22 16:25:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\runic games
[2010/08/21 16:31:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Sony
[2012/02/22 23:57:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\spiral
[2011/10/11 22:11:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\spiral_preview
[2012/01/12 01:11:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Steinberg
[2012/02/27 21:18:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\To the Moon - Freebird Games
[2011/05/18 18:28:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Unity
[2012/05/03 16:13:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\uTorrent
[2010/03/24 20:39:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Windows Desktop Search
[2010/03/27 22:57:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Windows Search
[2012/04/20 21:38:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\XnView
[2011/09/03 19:23:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\yoclient

========== Purity Check ==========



========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========
[C:\WINDOWS\$NtUninstallKB8467$] -> Error: Cannot create file handle -> Unknown point type

========== Alternate Data Streams ==========

@Alternate Data Stream - 139 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0B4227B4
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F63A059B

< End of report >

[Advertisements]

Hi we will kill the main bad boy first and then look for remnants

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
• Accept the disclaimer and allow to update if it asks
• Allow the installation of the recovery console
  
  
  
  
  
• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.



Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

[Essexboy]

Hi we will kill the main bad boy first and then look for remnants

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
• Accept the disclaimer and allow to update if it asks
• Allow the installation of the recovery console
  
  
  
  
  
• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.



Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

[Vladimir90]

svchost.exe is still spaming packets like crazy

here is log:


ComboFix 12-05-04.03 - EndBringer 05/04/2012 21:58:20.1.1 - x86
Running from: c:\documents and settings\EndBringer\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Kaspersky Anti-Virus *Disabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\All Users\Application Data\TEMP\0B4227B4.TMP
c:\documents and settings\EndBringer\Application Data\app
c:\documents and settings\EndBringer\Application Data\app\Jerakine_lang.dat
c:\documents and settings\EndBringer\Application Data\app\Jerakine_lang_vesrion.dat
c:\documents and settings\EndBringer\Application Data\PriceGong
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\1.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\a.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\b.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\c.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\d.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\e.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\f.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\g.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\h.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\i.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\J.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\k.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\l.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\m.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\n.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\o.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\p.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\q.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\r.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\s.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\t.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\u.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\v.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\w.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\x.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\y.xml
c:\documents and settings\EndBringer\Application Data\PriceGong\Data\z.xml
C:\install.exe
C:\svchost
c:\svchost\fix_svchost.bat
c:\svchost\windowsupdateagent30-x86.exe
c:\svchost\WindowsXP-KB927891-v3-x86-ENU.exe
C:\Win
c:\windows\$NtUninstallKB8467$
c:\windows\$NtUninstallKB8467$\3429192089
c:\windows\$NtUninstallKB8467$\3857171700\@
c:\windows\$NtUninstallKB8467$\3857171700\cfg.ini
c:\windows\$NtUninstallKB8467$\3857171700\Desktop.ini
c:\windows\$NtUninstallKB8467$\3857171700\L\ilxdoxkr
c:\windows\$NtUninstallKB8467$\3857171700\twl.dll
c:\windows\$NtUninstallKB8467$\3857171700\U\00000001.@
c:\windows\$NtUninstallKB8467$\3857171700\U\00000002.@
c:\windows\$NtUninstallKB8467$\3857171700\U\00000004.@
c:\windows\$NtUninstallKB8467$\3857171700\U\80000000.@
c:\windows\$NtUninstallKB8467$\3857171700\U\80000004.@
c:\windows\$NtUninstallKB8467$\3857171700\U\80000032.@
c:\windows\$NtUninstallKB8467$\3857171700\version
c:\windows\av_ico
c:\windows\av_ico\ico_KAV_START.ico
c:\windows\av_ico\ico_KAV_TXT.ico
c:\windows\av_ico\ico_KAV_UNINSTALL.ico
c:\windows\av_ico\ico_KAV_URL.ico
c:\windows\av_ico\ico_NOD_AV_START.ico
c:\windows\av_ico\ico_NOD_SYSINSP.ico
c:\windows\av_ico\ico_NOD_SYSRESC.ico
c:\windows\av_ico\ico_NOD_TXT.ico
c:\windows\av_ico\ico_NOD_UNINSTALL.ico
c:\windows\loader2.exe_ok
c:\windows\phoenix
c:\windows\phoenix\kernels\phatk\__init__.py
c:\windows\phoenix\kernels\phatk\__init__.pyc
c:\windows\phoenix\kernels\phatk\BFIPatcher.py
c:\windows\phoenix\kernels\phatk\kernel.cl
c:\windows\phoenix\kernels\poclbm\__init__.py
c:\windows\phoenix\kernels\poclbm\__init__.pyc
c:\windows\phoenix\kernels\poclbm\BFIPatcher.py
c:\windows\phoenix\kernels\poclbm\kernel.cl
c:\windows\phoenix\phoenix.exe
c:\windows\system32\dds_trash_log.cmd
c:\windows\system32\SET9BF4.tmp
c:\windows\update.1
c:\windows\update.2
c:\windows\update.5.0
c:\windows\update.tray-8-0-lnk
c:\windows\update.tray-8-0
.
c:\windows\system32\drivers\ndis.sys . . . is infected!!
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_SRVBTCCLIENT
-------\Legacy_SRVIECHECK
-------\Legacy_USNJSVC
-------\Legacy_WXPDRIVERS
-------\Service_usnjsvc
.
.
((((((((((((((((((((((((( Files Created from 2012-04-04 to 2012-05-04 )))))))))))))))))))))))))))))))
.
.
2012-05-04 18:22 . 2012-05-04 18:22 -------- d-----w- c:\program files\ESET
2012-05-04 15:14 . 2012-05-04 15:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Trend Micro
2012-05-04 15:01 . 2012-05-04 15:02 -------- d-----w- c:\program files\WinPcap
2012-05-04 15:01 . 2012-05-04 15:01 -------- d-----w- c:\program files\Trend Micro
2012-05-03 17:54 . 2012-05-03 17:59 -------- d-----w- c:\documents and settings\EndBringer\Application Data\AVG
2012-05-03 16:58 . 2012-05-04 14:22 -------- d-----w- c:\windows\system32\drivers\AVG
2012-05-03 16:58 . 2012-05-03 17:10 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG2012
2012-05-03 16:58 . 2012-05-03 16:58 -------- d-----w- C:\$AVG
2012-05-03 16:58 . 2012-05-03 17:53 -------- d-----w- c:\program files\AVG
2012-05-03 15:26 . 2012-05-03 15:30 -------- d-----w- c:\program files\Spybot - Search & Destroy
2012-05-03 14:34 . 2012-05-03 14:34 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files
2012-05-03 14:33 . 2012-05-04 14:22 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
2012-04-19 02:50 . 2012-04-19 02:50 24896 ----a-w- c:\windows\system32\drivers\avgidshx.sys
2012-04-18 17:10 . 2012-04-18 17:10 -------- d-----w- c:\documents and settings\Administrator
2012-04-10 14:24 . 2012-04-16 21:52 418464 ----a-w- c:\windows\system32\FlashPlayerApp.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-16 21:51 . 2011-05-18 12:54 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-04 15:23 . 2012-04-04 15:24 73728 ----a-w- c:\windows\system32\javacpl.cpl
2012-04-04 15:23 . 2010-04-22 18:05 472808 ----a-w- c:\windows\system32\deployJava1.dll
2012-03-19 03:17 . 2012-03-19 03:17 301248 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2012-03-07 19:53 . 2012-03-07 23:32 2304 ----a-w- c:\windows\system32\HtsysmNT.sys
2012-02-22 03:25 . 2012-02-22 03:25 235216 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2012-03-13 04:39 . 2012-03-22 14:39 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 1601-01-01 00:00 . !HASH: COULD NOT OPEN FILE !!!!! . 0 . . [------] . . c:\windows\system32\dllcache\ndis.sys
[-] 1601-01-01 00:00 . !HASH: COULD NOT OPEN FILE !!!!! . 0 . . [------] . . c:\windows\system32\drivers\ndis.sys
.
[-] 2009-02-12 . 25A740D70E8007814A48D3FA1B34FA34 . 361600 . . [5.1.2600.5649] . . c:\windows\system32\drivers\tcpip.sys
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
.
[-] 2009-02-12 . F2DF0FDBD41B34112EE05ED04258F052 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 52\AxAutoMntSrv.exe" [2009-11-15 33120]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"nwiz"="nwiz.exe" [2008-05-16 1630208]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-04-05 2587008]
"Trend Micro RUBotted V2.0 Beta"="c:\program files\Trend Micro\RUBotted\RUBottedGUI.exe" [2010-12-17 1103184]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2006-10-26 434528]
.
c:\documents and settings\EndBringer\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-5-17 661776]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableSecureUIAPaths"= 0 (0x0)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"Shell"= explorer.exe,RunDll32 "c:\program files\Common Files\mslsaet.dll",Init
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"idsvc"=3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"DisableThumbnailCache"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Riot Games\\League of Legends\\lol.launcher.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\spiral knights\\java_vm\\bin\\javaw.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\Spiral Knights Announcement Trailer\\smp.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"58638:TCP"= 58638:TCP:Pando Media Booster
"58638:UDP"= 58638:UDP:Pando Media Booster
"8381:TCP"= 8381:TCP:League of Legends Launcher
"8381:UDP"= 8381:UDP:League of Legends Launcher
"8396:TCP"= 8396:TCP:League of Legends Launcher
"8396:UDP"= 8396:UDP:League of Legends Launcher
"6976:TCP"= 6976:TCP:League of Legends Launcher
"6976:UDP"= 6976:UDP:League of Legends Launcher
"6913:TCP"= 6913:TCP:League of Legends Launcher
"6913:UDP"= 6913:UDP:League of Legends Launcher
"6963:TCP"= 6963:TCP:League of Legends Launcher
"6963:UDP"= 6963:UDP:League of Legends Launcher
"8397:TCP"= 8397:TCP:League of Legends Launcher
"8397:UDP"= 8397:UDP:League of Legends Launcher
"6941:TCP"= 6941:TCP:League of Legends Launcher
"6941:UDP"= 6941:UDP:League of Legends Launcher
"6964:TCP"= 6964:TCP:League of Legends Launcher
"6964:UDP"= 6964:UDP:League of Legends Launcher
"6943:TCP"= 6943:TCP:League of Legends Launcher
"6943:UDP"= 6943:UDP:League of Legends Launcher
"6960:TCP"= 6960:TCP:League of Legends Launcher
"6960:UDP"= 6960:UDP:League of Legends Launcher
"8398:TCP"= 8398:TCP:League of Legends Launcher
"8398:UDP"= 8398:UDP:League of Legends Launcher
"8393:TCP"= 8393:TCP:League of Legends Lobby
"8393:UDP"= 8393:UDP:League of Legends Lobby
"8390:TCP"= 8390:TCP:League of Legends Game Client
"8390:UDP"= 8390:UDP:League of Legends Game Client
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [4/19/2012 4:50 AM 24896]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [1/31/2012 4:46 AM 31952]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6/30/2010 3:59 PM 691696]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2/22/2012 5:25 AM 235216]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [3/19/2012 5:17 AM 301248]
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [3/24/2010 8:43 PM 13696]
R1 kl2;kl2;c:\windows\system32\drivers\kl2.sys [6/9/2010 4:43 PM 11352]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\avgidsagent.exe [4/30/2012 9:44 AM 5106744]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [2/14/2012 4:53 AM 193288]
R2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [12/8/2011 3:56 PM 21992]
R2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [10/20/2009 8:19 PM 50704]
R2 RUBotSrv;Trend Micro RUBotted Service;c:\program files\Trend Micro\RUBotted\RUBotSrv.exe [5/4/2012 5:01 PM 439632]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [12/23/2011 1:32 PM 139856]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\avgidsfilterx.sys [12/23/2011 1:32 PM 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [12/23/2011 1:32 PM 17232]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [5/7/2010 11:06 AM 32856]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [11/2/2009 7:27 PM 19472]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;"c:\program files\Avira\AntiVir Desktop\sched.exe" --> c:\program files\Avira\AntiVir Desktop\sched.exe [?]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2/15/2012 2:30 PM 158856]
S3 1394hub;1394 Enabled Hub;c:\windows\system32\svchost.exe -k netsvcs [4/14/2008 4:42 AM 14336]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [4/10/2012 4:24 PM 253088]
S3 apf001;apf001;c:\windows\system32\apf001.sys [1/4/2012 11:50 PM 10872]
S3 CEUSBAUD;DigiTech RP355 USB MIDI Driver;c:\windows\system32\drivers\ceusbaud.sys [1/3/2012 4:49 PM 17920]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [11/9/2011 5:01 PM 27064]
S3 SynasUSB;eLicenser;c:\windows\system32\drivers\synasusb.sys [1/2/2012 6:12 PM 23696]
S3 XDva344;XDva344;\??\c:\windows\system32\XDva344.sys --> c:\windows\system32\XDva344.sys [?]
S3 XDva365;XDva365;\??\c:\windows\system32\XDva365.sys --> c:\windows\system32\XDva365.sys [?]
S3 XDva370;XDva370;\??\c:\windows\system32\XDva370.sys --> c:\windows\system32\XDva370.sys [?]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
sonypvu1
vproeventmonitor
ser2pl
LoopBeMidi1
msfwsvc
ghostsec
screadspool
Maplom
asusgsb
HSFHWICH
wlancig
se44mgmt
vxd
zdeviceservice
ATSWPDRV
PSI_SVC_2
VCAM
anio
npfmntor
iolodmv
db2ntsecserver
se58mdm
nv4
rimsptsk
alim1541
btnhnd
racsvc
SE2Dobex
srescan
UNDPX2A
bufserv
sentinel
BrPar
cpqrcmc
SndTDriverV32
rtl8139
lvusbsta
NetwareWorkstation
k750mdfl
OEM02Afx
teefer2
SNP2STD
tosrfnds
vaiomediaplatform-mobile-gateway
pelmouse
GT890x
qbreminderflash
.
Contents of the 'Scheduled Tasks' folder
.
2012-05-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-10 21:52]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = 127.0.0.1:9421;<local>
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - c:\program files\AVG\AVG2012\avgdtiex.dll
Trusted Zone: kuaiche.com\software
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\documents and settings\EndBringer\Application Data\Mozilla\Firefox\Profiles\ltkujnvj.default\
FF - prefs.js: browser.search.defaulturl - hxxp://flvdirect.iamwired.net/websearch.php?src=tops&search=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://en-US.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
.
- - - - ORPHANS REMOVED - - - -
.
HKU-Default-Run-LClock - c:\program files\LClock\LClock.exe
HKU-Default-Run-System Intrusive - c:\program files\Common Files\Akamai\Languages\perfsvc.dll
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-04 22:10
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(5844)
c:\windows\system32\WININET.dll
c:\program files\RocketDock\RocketDock.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\program files\AVG\AVG2012\avgnsx.exe
c:\program files\AVG\AVG2012\avgemcx.exe
c:\program files\AVG\AVG2012\avgrsx.exe
c:\program files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\AVG\AVG2012\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2012-05-04 22:13:43 - machine was rebooted
ComboFix-quarantined-files.txt 2012-05-04 20:13
.
Pre-Run: 15,161,683,968 bytes free
Post-Run: 15,081,836,544 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=AlwaysOff /fastdetect
.
- - End Of File - - 8DEA5D1BA42525F0D9E0DE8E44F09E38

[Essexboy]

• Double click OTL.
• Select All Users
• Under the Custom Scan box paste this in
  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  ndis.*
  consrv.dll
  explorer.exe
  winlogon.exe
  Userinit.exe
  svchost.exe
  /md5stop
  C:\Windows\assembly\tmp\U\*.* /s
  %Temp%\smtmp\1\*.*
  %Temp%\smtmp\2\*.*
  %Temp%\smtmp\3\*.*
  %Temp%\smtmp\4\*.*
  >C:\commands.txt echo list vol /raw /hide /c
  /wait
  >C:\DiskReport.txt diskpart /s C:\commands.txt /raw /hide /c
  /wait
  type c:\diskreport.txt /c
  /wait
  erase c:\commands.txt /hide /c
  /wait
  erase c:\diskreport.txt /hide /c
  CREATERESTOREPOINT
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Post both logs

[Essexboy]

Ooops forgot this

Download aswMBR.exe ( 4.8mb ) to your desktop.
Double click the aswMBR.exe to run it Click the "Scan" button to start scan



On completion of the scan click save log, save it to your desktop and post in your next reply

[Vladimir90]

OTL made only one log this time, Extras is from 1st scan.

OTL logfile created on: 5/5/2012 3:50:58 PM - Run 2
OTL by OldTimer - Version 3.2.42.2 Folder = C:\Documents and Settings\EndBringer\Desktop\SVC
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1023.48 Mb Total Physical Memory | 472.79 Mb Available Physical Memory | 46.19% Memory free
2.40 Gb Paging File | 1.75 Gb Available in Paging File | 72.79% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 41.06 Gb Total Space | 14.07 Gb Free Space | 34.27% Space Free | Partition Type: NTFS
Drive D: | 35.27 Gb Total Space | 4.66 Gb Free Space | 13.21% Space Free | Partition Type: NTFS

Computer Name: HARRY | User Name: EndBringer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/05/04 19:33:45 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\EndBringer\Desktop\SVC\OTL.exe
PRC - [2012/04/30 09:44:38 | 005,106,744 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgidsagent.exe
PRC - [2012/04/19 04:51:54 | 001,254,992 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgnsx.exe
PRC - [2012/04/05 05:12:34 | 002,587,008 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgtray.exe
PRC - [2012/03/19 05:18:12 | 000,979,840 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgemcx.exe
PRC - [2012/03/13 06:39:04 | 000,924,600 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2012/02/14 04:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgwdsvc.exe
PRC - [2012/02/14 04:53:14 | 000,758,112 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgrsx.exe
PRC - [2012/02/14 04:52:38 | 000,338,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgcsrvx.exe
PRC - [2010/12/17 09:33:10 | 000,439,632 | ---- | M] (Trend Micro Inc.) -- C:\Program Files\Trend Micro\RUBotted\RUBotSrv.exe
PRC - [2010/12/17 09:33:06 | 001,103,184 | ---- | M] (Trend Micro Inc.) -- C:\Program Files\Trend Micro\RUBotted\RUBottedGUI.exe
PRC - [2009/12/23 23:34:20 | 000,370,688 | ---- | M] (StarWind Software) -- C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
PRC - [2009/02/12 17:25:40 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/09/02 14:58:52 | 000,495,616 | ---- | M] () -- C:\Program Files\RocketDock\RocketDock.exe
PRC - [2007/05/17 17:08:14 | 000,661,776 | ---- | M] (IVT Corporation.) -- C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe


========== Modules (No Company Name) ==========

MOD - [2012/04/16 23:51:59 | 008,797,344 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll
MOD - [2012/03/13 06:39:07 | 001,969,080 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2010/08/24 19:06:46 | 000,085,840 | ---- | M] () -- C:\Program Files\Trend Micro\RUBotted\hc_help.dll
MOD - [2009/02/12 17:17:56 | 000,190,464 | ---- | M] () -- C:\WINDOWS\system32\WgaLogon.dll
MOD - [2007/12/24 02:08:44 | 000,391,680 | ---- | M] () -- C:\Program Files\RocketDock\Docklets\StackDocklet\StackDocklet.dll
MOD - [2007/09/02 14:58:52 | 000,495,616 | ---- | M] () -- C:\Program Files\RocketDock\RocketDock.exe
MOD - [2007/09/02 14:57:36 | 000,069,632 | ---- | M] () -- C:\Program Files\RocketDock\RocketDock.dll
MOD - [2001/08/23 13:00:00 | 000,015,360 | ---- | M] () -- C:\WINDOWS\system32\tsd32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- %systemroot%\system32\umxfwhlp.dll -- (zdeviceservice)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\symmpi.dll -- (wlancig)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\SWNC5E00.dll -- (vproeventmonitor)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\sffdisk.dll -- (VCAM)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\CDRPDACC.dll -- (vaiomediaplatform-mobile-gateway)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\protectionservice.dll -- (teefer2)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\prohlp02.dll -- (srescan)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\enodpl.dll -- (sonypvu1)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\ELacpi.dll -- (SndTDriverV32)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\oracleformsserver-forms60server-oraform.dll -- (ser2pl)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\dlcq_device.dll -- (sentinel)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\e1000.dll -- (se58mdm)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\mcp.dll -- (se44mgmt)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\UMAXPCLS.dll -- (SE2Dobex)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\pvservice.dll -- (rtl8139)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\lxcc_device.dll -- (rimsptsk)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\mrxdav.dll -- (racsvc)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\nbf.dll -- (qbreminderflash)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\epson_pm_rpcv2_02.dll -- (PSI_SVC_2)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\vmparport.dll -- (pelmouse)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\afd.dll -- (OEM02Afx)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\vgasave.dll -- (nv4)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\symantecantibotdriver.dll -- (npfmntor)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\avgmfx86.dll -- (NetwareWorkstation)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\hidusb.dll -- (msfwsvc)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\DgiVecp.dll -- (Maplom)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\proxyhostservice.dll -- (lvusbsta)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\VAIOMediaPlatform-VideoServer-HTTP.dll -- (LoopBeMidi1)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\vtserver.dll -- (k750mdfl)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\macformatservice.dll -- (iolodmv)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\pxhelp20.dll -- (HSFHWICH)
SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\tunmp.dll -- (GT890x)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\usbvideo.dll -- (db2ntsecserver)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\W8100PCI.dll -- (cpqrcmc)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\ageremodemaudio.dll -- (bufserv)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\vzfw.dll -- (btnhnd)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\LHidUsbK.dll -- (BrPar)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\ssrtln.dll -- (ATSWPDRV)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\el90xbc.dll -- (asusgsb)
SRV - File not found [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - File not found [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - File not found [Auto | Stopped] -- %systemroot%\system32\pdreli.dll -- (alim1541)
SRV - [2012/04/30 09:44:38 | 005,106,744 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2012\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2012/04/16 23:52:00 | 000,253,088 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/02/15 14:30:18 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/02/14 04:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2012\avgwdsvc.exe -- (avgwd)
SRV - [2011/03/16 10:42:06 | 000,407,336 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2010/12/17 09:33:10 | 000,439,632 | ---- | M] (Trend Micro Inc.) [Auto | Running] -- C:\Program Files\Trend Micro\RUBotted\RUBotSrv.exe -- (RUBotSrv)
SRV - [2010/08/29 21:55:06 | 003,739,080 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\WINDOWS\system32\GameMon.des -- (npggsvc)
SRV - [2009/12/23 23:34:20 | 000,370,688 | ---- | M] (StarWind Software) [Auto | Running] -- C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)
SRV - [2009/10/20 20:19:48 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - [2007/05/16 14:48:56 | 000,228,208 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Windows Live\installer\WLSetupSvc.exe -- (WLSetupSvc)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\XDva370.sys -- (XDva370)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\XDva365.sys -- (XDva365)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\XDva344.sys -- (XDva344)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\EagleNT.sys -- (EagleNT)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - File not found [Kernel | System | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (augifxiy)
DRV - [2012/04/19 04:50:26 | 000,024,896 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\avgidshx.sys -- (AVGIDSHX)
DRV - [2012/03/22 04:11:36 | 000,215,168 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\ndis.sys -- (NDIS)
DRV - [2012/03/19 05:17:28 | 000,301,248 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2012/02/22 05:25:32 | 000,235,216 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2012/01/31 04:46:50 | 000,031,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\avgrkx86.sys -- (Avgrkx86)
DRV - [2012/01/04 23:50:27 | 000,010,872 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\apf001.sys -- (apf001)
DRV - [2011/12/23 13:32:14 | 000,041,040 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2011/12/23 13:32:08 | 000,017,232 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avgidsshimx.sys -- (AVGIDSShim)
DRV - [2011/12/23 13:32:06 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avgidsfilterx.sys -- (AVGIDSFilter)
DRV - [2011/12/23 13:32:00 | 000,139,856 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\avgidsdriverx.sys -- (AVGIDSDriver)
DRV - [2011/07/26 17:45:01 | 000,475,736 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\klif.sys -- (KLIF)
DRV - [2011/06/17 12:37:08 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/06/17 12:37:08 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010/11/09 16:35:30 | 000,021,992 | ---- | M] (CPUID) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\cpuz135_x32.sys -- (cpuz135)
DRV - [2010/09/17 13:27:32 | 000,023,696 | ---- | M] (Steinberg Media Technologies GmbH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\synasusb.sys -- (SynasUSB)
DRV - [2010/06/30 15:59:35 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2010/06/09 16:43:52 | 000,011,352 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\kl2.sys -- (kl2)
DRV - [2010/06/09 16:43:50 | 000,132,184 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\kl1.sys -- (KL1)
DRV - [2010/05/07 11:06:26 | 000,032,856 | ---- | M] (Kaspersky Lab ZAO) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\klim5.sys -- (klim5)
DRV - [2009/12/30 11:20:56 | 000,027,064 | ---- | M] (VS Revo Group) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\revoflt.sys -- (Revoflt)
DRV - [2009/11/02 19:27:24 | 000,019,472 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\klmouflt.sys -- (klmouflt)
DRV - [2009/10/20 20:19:44 | 000,050,704 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\npf.sys -- (NPF)
DRV - [2009/05/11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2007/05/11 03:10:50 | 000,034,704 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\blueletaudio.sys -- (BlueletAudio)
DRV - [2007/05/09 01:59:40 | 000,036,496 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btcusb.sys -- (Btcsrusb)
DRV - [2007/03/05 06:00:04 | 000,027,792 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BlueletSCOAudio.sys -- (BlueletSCOAudio)
DRV - [2007/03/05 05:59:04 | 000,018,320 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btnetdrv.sys -- (BT)
DRV - [2007/03/05 05:56:18 | 000,035,600 | ---- | M] (IVT Corporation.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\BTHidMgr.sys -- (BTHidMgr)
DRV - [2007/03/05 05:55:12 | 000,020,880 | ---- | M] (IVT Corporation.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\vbtenum.sys -- (BTHidEnum)
DRV - [2007/03/05 05:53:18 | 000,044,304 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\VcommMgr.sys -- (VcommMgr)
DRV - [2007/03/05 05:52:18 | 000,034,448 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\VComm.sys -- (VComm)
DRV - [2006/11/21 22:41:18 | 000,022,416 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Stopped] -- C:\Program Files\IVT Corporation\BlueSoleil\device\Win2k\BTNetFilter.sys -- (BTNetFilter)
DRV - [2006/10/13 18:31:00 | 004,022,528 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\alcxwdm.sys -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2005/04/05 21:22:30 | 000,012,928 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2005/04/05 21:22:28 | 000,033,536 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2005/03/16 08:23:54 | 000,013,696 | R--- | M] (BIOSTAR Group) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\BIOS.sys -- (BIOS)
DRV - [2004/06/29 10:07:18 | 001,268,204 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2003/11/01 22:19:38 | 000,017,920 | ---- | M] (CEntrance, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ceusbaud.sys -- (CEUSBAUD)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>



IE - HKU\S-1-5-21-854245398-343818398-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-21-854245398-343818398-682003330-1004\..\SearchScopes,DefaultScope = {9D46D053-D9AF-4BE0-AFAE-DB3A9FCFD002}
IE - HKU\S-1-5-21-854245398-343818398-682003330-1004\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...Box&Form=IE8SRC
IE - HKU\S-1-5-21-854245398-343818398-682003330-1004\..\SearchScopes\{9D46D053-D9AF-4BE0-AFAE-DB3A9FCFD002}: "URL" = http://flvdirect.iam...h={SearchTerms}
IE - HKU\S-1-5-21-854245398-343818398-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-854245398-343818398-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;<local>

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search"
FF - prefs.js..browser.search.defaulturl: "http://flvdirect.iam...c=tops&search="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://en-US.start3....en-US:official"
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.8.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {35379F86-8CCB-4724-AE33-4278DE266C70}:1.0.7
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: [email protected]:3.2.5.2
FF - prefs.js..extensions.enabledItems: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}:3.6.0.10
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20110704


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll File not found
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Documents and Settings\EndBringer\Application Data\Facebook\npfbplugin_1_0_3.dll File not found
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012/05/03 18:59:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F53C93F1-07D5-430c-86D4-C9531B27DFAF}: C:\Program Files\AVG\AVG2012\Firefox\DoNotTrack\ [2012/05/03 18:58:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/03/22 16:39:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/04/11 20:10:21 | 000,000,000 | ---D | M]

[2010/03/24 20:53:27 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\EndBringer\Application Data\Mozilla\Extensions
[2012/03/04 19:31:02 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\EndBringer\Application Data\Mozilla\Firefox\Profiles\ltkujnvj.default\extensions
[2012/03/04 19:31:02 | 000,000,000 | ---D | M] (WOT) -- C:\Documents and Settings\EndBringer\Application Data\Mozilla\Firefox\Profiles\ltkujnvj.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012/04/25 15:00:19 | 000,002,023 | ---- | M] () -- C:\Documents and Settings\EndBringer\Application Data\Mozilla\Firefox\Profiles\ltkujnvj.default\searchplugins\google-translate.xml
[2012/05/02 15:38:50 | 000,004,873 | ---- | M] () -- C:\Documents and Settings\EndBringer\Application Data\Mozilla\Firefox\Profiles\ltkujnvj.default\searchplugins\isohunt--bt-search.xml
[2011/04/28 17:00:06 | 000,001,959 | ---- | M] () -- C:\Documents and Settings\EndBringer\Application Data\Mozilla\Firefox\Profiles\ltkujnvj.default\searchplugins\lastfm.xml
[2011/04/23 14:40:58 | 000,005,245 | ---- | M] () -- C:\Documents and Settings\EndBringer\Application Data\Mozilla\Firefox\Profiles\ltkujnvj.default\searchplugins\magiccardsinfo.xml
[2010/05/05 15:47:26 | 000,000,266 | ---- | M] () -- C:\Documents and Settings\EndBringer\Application Data\Mozilla\Firefox\Profiles\ltkujnvj.default\searchplugins\Search.xml
[2011/04/21 19:36:54 | 000,002,043 | ---- | M] () -- C:\Documents and Settings\EndBringer\Application Data\Mozilla\Firefox\Profiles\ltkujnvj.default\searchplugins\the-free-dictionary.xml
[2010/05/23 15:25:37 | 000,002,057 | ---- | M] () -- C:\Documents and Settings\EndBringer\Application Data\Mozilla\Firefox\Profiles\ltkujnvj.default\searchplugins\youtube-video-search.xml
[2012/04/04 17:24:09 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/09/11 22:58:16 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2012/04/04 17:24:10 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
[2010/05/05 15:47:58 | 000,000,000 | ---D | M] (LoudMo Contextual Ad Assistant) -- C:\Program Files\Mozilla Firefox\extensions\{cceafe57-b9c6-a56f-455a-438db22009c4}
[2012/05/03 18:58:50 | 000,000,000 | ---D | M] (AVG Do Not Track) -- C:\PROGRAM FILES\AVG\AVG2012\FIREFOX\DONOTTRACK
[2012/03/13 06:39:39 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/04/04 17:23:49 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012/03/13 06:38:32 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/03/13 06:38:32 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012/05/04 22:09:19 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll ()
O3 - HKU\S-1-5-21-854245398-343818398-682003330-1004\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll ()
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [Trend Micro RUBotted V2.0 Beta] C:\Program Files\Trend Micro\RUBotted\RUBottedGUI.exe (Trend Micro Inc.)
O4 - HKU\S-1-5-21-854245398-343818398-682003330-1004..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 52\AxAutoMntSrv.exe (Alcohol Soft Development Team)
O4 - HKU\S-1-5-21-854245398-343818398-682003330-1004..\Run: [RocketDock] C:\Program Files\RocketDock\RocketDock.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe (IVT Corporation.)
O4 - Startup: C:\Documents and Settings\EndBringer\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: Shell = explorer.exe,RunDll32 "C:\Program Files\Common Files\mslsaet.dll",Init (Microsoft Corporation)
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: Shell = explorer.exe,RunDll32 "C:\Program Files\Common Files\mslsaet.dll",Init (Microsoft Corporation)
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-854245398-343818398-682003330-1004\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-854245398-343818398-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-854245398-343818398-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-854245398-343818398-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Download by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O9 - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O15 - HKU\S-1-5-21-854245398-343818398-682003330-1004\..Trusted Domains: kuaiche.com ([software] http in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{82A7CAD2-F3DB-4B48-840C-C44FBC971412}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\klogon: DllName - (C:\WINDOWS\system32\klogon.dll) - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab ZAO)
O20 - Winlogon\Notify\WgaLogon: DllName - (WgaLogon.dll) - C:\WINDOWS\System32\WgaLogon.dll ()
O24 - Desktop WallPaper: C:\Documents and Settings\EndBringer\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\EndBringer\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/03/24 20:28:17 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: sonypvu1 - %systemroot%\system32\enodpl.dll File not found
NetSvcs: vproeventmonitor - %systemroot%\system32\SWNC5E00.dll File not found
NetSvcs: ser2pl - %systemroot%\system32\oracleformsserver-forms60server-oraform.dll File not found
NetSvcs: LoopBeMidi1 - %systemroot%\system32\VAIOMediaPlatform-VideoServer-HTTP.dll File not found
NetSvcs: msfwsvc - %systemroot%\system32\hidusb.dll File not found
NetSvcs: ghostsec - File not found
NetSvcs: screadspool - File not found
NetSvcs: Maplom - %systemroot%\system32\DgiVecp.dll File not found
NetSvcs: asusgsb - %systemroot%\system32\el90xbc.dll File not found
NetSvcs: HSFHWICH - %systemroot%\system32\pxhelp20.dll File not found
NetSvcs: wlancig - %systemroot%\system32\symmpi.dll File not found
NetSvcs: se44mgmt - %systemroot%\system32\mcp.dll File not found
NetSvcs: vxd - File not found
NetSvcs: zdeviceservice - %systemroot%\system32\umxfwhlp.dll File not found
NetSvcs: ATSWPDRV - %systemroot%\system32\ssrtln.dll File not found
NetSvcs: PSI_SVC_2 - %systemroot%\system32\epson_pm_rpcv2_02.dll File not found
NetSvcs: VCAM - %systemroot%\system32\sffdisk.dll File not found
NetSvcs: anio - File not found
NetSvcs: npfmntor - %systemroot%\system32\symantecantibotdriver.dll File not found
NetSvcs: iolodmv - %systemroot%\system32\macformatservice.dll File not found
NetSvcs: db2ntsecserver - %systemroot%\system32\usbvideo.dll File not found
NetSvcs: se58mdm - %systemroot%\system32\e1000.dll File not found
NetSvcs: nv4 - %systemroot%\system32\vgasave.dll File not found
NetSvcs: rimsptsk - %systemroot%\system32\lxcc_device.dll File not found
NetSvcs: alim1541 - %systemroot%\system32\pdreli.dll File not found
NetSvcs: btnhnd - %systemroot%\system32\vzfw.dll File not found
NetSvcs: racsvc - %systemroot%\system32\mrxdav.dll File not found
NetSvcs: SE2Dobex - %systemroot%\system32\UMAXPCLS.dll File not found
NetSvcs: srescan - %systemroot%\system32\prohlp02.dll File not found
NetSvcs: UNDPX2A - File not found
NetSvcs: bufserv - %systemroot%\system32\ageremodemaudio.dll File not found
NetSvcs: sentinel - %systemroot%\system32\dlcq_device.dll File not found
NetSvcs: BrPar - %systemroot%\system32\LHidUsbK.dll File not found
NetSvcs: cpqrcmc - %systemroot%\system32\W8100PCI.dll File not found
NetSvcs: SndTDriverV32 - %systemroot%\system32\ELacpi.dll File not found
NetSvcs: rtl8139 - %systemroot%\system32\pvservice.dll File not found
NetSvcs: lvusbsta - %systemroot%\system32\proxyhostservice.dll File not found
NetSvcs: NetwareWorkstation - %systemroot%\system32\avgmfx86.dll File not found
NetSvcs: k750mdfl - %systemroot%\system32\vtserver.dll File not found
NetSvcs: OEM02Afx - %systemroot%\system32\afd.dll File not found
NetSvcs: teefer2 - %systemroot%\system32\protectionservice.dll File not found
NetSvcs: SNP2STD - File not found
NetSvcs: tosrfnds - File not found
NetSvcs: vaiomediaplatform-mobile-gateway - %systemroot%\system32\CDRPDACC.dll File not found
NetSvcs: pelmouse - %systemroot%\system32\vmparport.dll File not found
NetSvcs: GT890x - %systemroot%\system32\tunmp.dll File not found
NetSvcs: qbreminderflash - %systemroot%\system32\nbf.dll File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Unable to start System Restore Service. Error code 1056

========== Files/Folders - Created Within 30 Days ==========

[2012/05/04 21:51:02 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2012/05/04 21:49:23 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2012/05/04 21:49:23 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2012/05/04 21:49:23 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2012/05/04 21:49:23 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2012/05/04 21:49:18 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2012/05/04 21:49:14 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/05/04 21:49:12 | 000,000,000 | R--D | C] -- C:\Documents and Settings\EndBringer\Start Menu\Programs\Administrative Tools
[2012/05/04 21:44:58 | 004,484,016 | R--- | C] (Swearware) -- C:\Documents and Settings\EndBringer\Desktop\ComboFix.exe
[2012/05/04 20:22:19 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012/05/04 19:34:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\EndBringer\Desktop\SVC
[2012/05/04 19:25:20 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\EndBringer\Recent
[2012/05/04 17:14:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Trend Micro
[2012/05/04 17:02:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\WinPcap
[2012/05/04 17:01:59 | 000,000,000 | ---D | C] -- C:\Program Files\WinPcap
[2012/05/04 17:01:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Trend Micro RUBotted
[2012/05/04 17:01:22 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2012/05/04 17:01:03 | 006,018,568 | ---- | C] (Trend Micro, Inc. ) -- C:\Documents and Settings\EndBringer\Desktop\RUBottedSetup.exe
[2012/05/04 17:00:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\EndBringer\Desktop\TCPView
[2012/05/03 19:54:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\EndBringer\Application Data\AVG
[2012/05/03 19:53:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\AVG PC Tuneup 2011
[2012/05/03 19:05:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\EndBringer\Application Data\AVG2012
[2012/05/03 18:59:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\AVG
[2012/05/03 18:58:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVG2012
[2012/05/03 18:58:44 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\AVG
[2012/05/03 18:58:44 | 000,000,000 | ---D | C] -- C:\$AVG
[2012/05/03 18:58:06 | 000,000,000 | ---D | C] -- C:\Program Files\AVG
[2012/05/03 17:26:38 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2012/05/03 16:34:11 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2012/05/03 16:33:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2012/04/19 04:50:26 | 000,024,896 | ---- | C] (AVG Technologies CZ, s.r.o. ) -- C:\WINDOWS\System32\drivers\avgidshx.sys
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/05/05 15:39:15 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/05/05 15:33:38 | 000,186,097 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2012/05/05 15:33:10 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/05/05 15:32:57 | 1073,270,784 | -HS- | M] () -- C:\hiberfil.sys
[2012/05/04 22:09:19 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2012/05/04 21:51:08 | 000,000,331 | RHS- | M] () -- C:\boot.ini
[2012/05/04 21:45:28 | 004,484,016 | R--- | M] (Swearware) -- C:\Documents and Settings\EndBringer\Desktop\ComboFix.exe
[2012/05/04 19:07:07 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\EndBringer\updateall.cfg
[2012/05/04 17:32:09 | 000,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb
[2012/05/04 17:32:09 | 000,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb
[2012/05/04 17:02:01 | 000,000,073 | ---- | M] () -- C:\WINDOWS\System32\-1
[2012/05/04 16:53:32 | 006,018,568 | ---- | M] (Trend Micro, Inc. ) -- C:\Documents and Settings\EndBringer\Desktop\RUBottedSetup.exe
[2012/05/04 16:21:59 | 097,104,481 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2012/05/03 19:53:25 | 000,000,795 | ---- | M] () -- C:\Documents and Settings\EndBringer\Desktop\AVG PC Tuneup 2011.lnk
[2012/05/03 17:26:40 | 000,000,933 | ---- | M] () -- C:\Documents and Settings\EndBringer\Desktop\Spybot - Search & Destroy.lnk
[2012/05/02 15:34:22 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/04/26 20:15:50 | 008,031,642 | ---- | M] () -- C:\Documents and Settings\EndBringer\Desktop\new-6.jpg
[2012/04/26 18:14:07 | 000,343,750 | ---- | M] () -- C:\Documents and Settings\EndBringer\Desktop\FB 2.jpg
[2012/04/26 18:13:34 | 000,463,423 | ---- | M] () -- C:\Documents and Settings\EndBringer\Desktop\FB.jpg
[2012/04/26 17:59:25 | 086,557,041 | ---- | M] () -- C:\Documents and Settings\EndBringer\Desktop\new-6.cpt
[2012/04/26 01:11:22 | 000,000,582 | ---- | M] () -- C:\Documents and Settings\EndBringer\My Documents\My Sharing Folders.lnk
[2012/04/20 21:37:45 | 000,124,711 | ---- | M] () -- C:\Documents and Settings\EndBringer\Desktop\Carach Angren.jpg
[2012/04/19 04:50:26 | 000,024,896 | ---- | M] (AVG Technologies CZ, s.r.o. ) -- C:\WINDOWS\System32\drivers\avgidshx.sys
[2012/04/17 20:15:50 | 084,015,848 | ---- | M] () -- C:\Documents and Settings\EndBringer\Desktop\LGOS.wav
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/05/04 21:51:08 | 000,000,215 | ---- | C] () -- C:\Boot.bak
[2012/05/04 21:51:03 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2012/05/04 21:49:23 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012/05/04 21:49:23 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012/05/04 21:49:23 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012/05/04 21:49:23 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012/05/04 21:49:23 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012/05/04 21:33:28 | 1073,270,784 | -HS- | C] () -- C:\hiberfil.sys
[2012/05/04 19:07:07 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\EndBringer\updateall.cfg
[2012/05/04 17:02:00 | 000,000,073 | ---- | C] () -- C:\WINDOWS\System32\-1
[2012/05/04 16:21:59 | 097,104,481 | ---- | C] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2012/05/03 19:53:25 | 000,000,795 | ---- | C] () -- C:\Documents and Settings\EndBringer\Desktop\AVG PC Tuneup 2011.lnk
[2012/05/03 17:26:40 | 000,000,933 | ---- | C] () -- C:\Documents and Settings\EndBringer\Desktop\Spybot - Search & Destroy.lnk
[2012/04/26 18:14:07 | 000,343,750 | ---- | C] () -- C:\Documents and Settings\EndBringer\Desktop\FB 2.jpg
[2012/04/26 18:12:39 | 000,463,423 | ---- | C] () -- C:\Documents and Settings\EndBringer\Desktop\FB.jpg
[2012/04/26 18:03:54 | 008,031,642 | ---- | C] () -- C:\Documents and Settings\EndBringer\Desktop\new-6.jpg
[2012/04/26 17:59:14 | 086,557,041 | ---- | C] () -- C:\Documents and Settings\EndBringer\Desktop\new-6.cpt
[2012/04/20 21:34:26 | 000,124,711 | ---- | C] () -- C:\Documents and Settings\EndBringer\Desktop\Carach Angren.jpg
[2012/04/17 20:15:23 | 084,015,848 | ---- | C] () -- C:\Documents and Settings\EndBringer\Desktop\LGOS.wav
[2012/04/10 16:24:57 | 000,000,830 | ---- | C] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/03/22 15:15:35 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012/03/08 01:32:38 | 000,002,304 | ---- | C] () -- C:\WINDOWS\System32\HtsysmNT.sys
[2012/01/12 01:01:44 | 000,002,892 | ---- | C] () -- C:\WINDOWS\System32\audcon.sys
[2012/01/12 00:45:40 | 000,000,045 | ---- | C] () -- C:\WINDOWS\System32\SYNSOPOS.exe.cfg
[2012/01/04 23:50:30 | 000,012,920 | ---- | C] () -- C:\WINDOWS\System32\apl001.sys
[2012/01/04 23:50:27 | 000,010,872 | ---- | C] () -- C:\WINDOWS\System32\apf001.sys
[2011/08/06 14:07:04 | 000,000,380 | ---- | C] () -- C:\WINDOWS\System32\secustat.dat
[2011/08/06 14:01:31 | 000,001,184 | ---- | C] () -- C:\WINDOWS\System32\secushr.dat
[2011/08/06 14:00:53 | 000,000,025 | ---- | C] () -- C:\WINDOWS\libem.INI
[2011/07/26 17:46:43 | 000,113,933 | ---- | C] () -- C:\WINDOWS\System32\drivers\klin.dat
[2011/07/26 17:46:43 | 000,097,549 | ---- | C] () -- C:\WINDOWS\System32\drivers\klick.dat
[2011/07/26 14:01:03 | 000,246,272 | ---- | C] () -- C:\WINDOWS\unrar.exe
[2011/06/10 13:32:23 | 000,000,096 | -H-- | C] () -- C:\WINDOWS\System32\HsInfo.dat
[2011/05/13 20:41:25 | 000,000,056 | RHS- | C] () -- C:\WINDOWS\System32\402EDC7190.sys
[2011/05/13 20:41:23 | 000,001,890 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2011/01/21 03:16:39 | 000,165,376 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2011/01/21 03:16:38 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini
[2011/01/21 03:16:36 | 000,810,496 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2011/01/21 03:16:36 | 000,183,808 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2011/01/21 03:16:35 | 000,080,896 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2010/12/29 22:29:13 | 000,000,008 | ---- | C] () -- C:\Documents and Settings\EndBringer\Application Data\DofusAppId0_3
[2010/12/29 17:38:05 | 000,000,008 | ---- | C] () -- C:\Documents and Settings\EndBringer\Application Data\DofusAppId0_1
[2010/12/29 17:37:11 | 000,000,205 | ---- | C] () -- C:\Documents and Settings\EndBringer\Application Data\D2Info0
[2010/12/29 17:37:11 | 000,000,008 | ---- | C] () -- C:\Documents and Settings\EndBringer\Application Data\DofusAppId0_2
[2010/10/09 17:47:05 | 000,230,752 | ---- | C] () -- C:\WINDOWS\patchw32.dll
[2010/10/09 17:47:04 | 000,118,176 | ---- | C] () -- C:\WINDOWS\patchw.dll
[2010/06/05 17:45:48 | 000,000,049 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

========== LOP Check ==========

[2012/03/22 16:01:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\529C544A000435DB0000657CD151FC4E
[2012/02/14 16:19:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2012/05/03 19:10:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG2012
[2010/08/07 16:45:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Bluetooth
[2012/05/03 16:34:11 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2011/08/18 23:47:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Easybits GO
[2012/01/12 00:54:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\eLicenser
[2010/08/30 16:57:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Guitar Pro 6
[2011/04/23 19:28:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\InterAction studios
[2010/04/16 14:49:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Last.fm
[2012/05/04 16:22:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2012/05/03 16:49:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NexonUS
[2011/03/30 14:50:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nitro PDF
[2011/07/26 14:37:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ParetoLogic
[2012/04/30 04:47:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PMB Files
[2012/03/22 04:09:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RELOADED
[2012/01/12 01:03:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Steinberg
[2012/01/12 01:01:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Syncrosoft
[2011/05/26 22:37:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Tarma Installer
[2011/01/04 19:37:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WindowsLiveInstaller
[2011/02/07 17:13:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2012/04/02 19:46:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\YouTube Downloader
[2011/07/26 14:50:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}
[2012/01/03 16:50:32 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{83715500-D3AC-4C3B-845D-FF6AAB70A56E}
[2012/01/02 19:01:08 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{C5EE6DA0-A057-4009-BADC-FB7523A5715F}
[2012/03/04 23:48:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\.minecraft
[2012/05/03 19:59:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\AVG
[2012/05/03 19:05:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\AVG2012
[2011/09/05 05:33:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\BITS
[2011/03/28 20:45:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\BugTrap Console Test108
[2012/04/26 17:47:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Canon
[2010/12/29 19:09:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Dofus 2
[2010/12/29 17:37:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Dofus-2.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
[2010/12/29 22:29:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Dofus-3.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
[2010/12/29 17:38:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Dofus.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
[2011/07/26 14:15:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\DriverCure
[2011/11/07 17:00:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\ESET
[2012/03/22 04:09:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\FALCOM
[2011/08/06 14:00:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\FlashGet
[2011/08/06 14:00:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\FlashGetBHO
[2011/08/18 23:47:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\go
[2010/03/25 23:34:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\GrabPro
[2011/04/07 17:08:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Guitar Pro 6
[2010/10/13 18:13:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\ICQ
[2011/07/24 20:32:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Laconic Software
[2011/03/30 16:48:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\LolClient
[2010/04/03 15:50:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\NetMedia Providers
[2012/04/12 20:10:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Nitro PDF
[2011/04/05 17:28:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\OpenCandy
[2012/05/03 16:13:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Orbit
[2011/07/26 14:15:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\ParetoLogic
[2011/03/30 14:48:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\ProgSense
[2011/05/21 17:49:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Publish Providers
[2011/07/26 18:08:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\QuickScan
[2010/12/29 17:37:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Reg.C9ECCBDBA4E09304DEEFB106465BC17F6D6749B9.1
[2011/04/05 17:29:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Reviversoft
[2012/02/22 00:32:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\RotMG.Production
[2012/03/22 16:25:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\runic games
[2010/08/21 16:31:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Sony
[2012/02/22 23:57:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\spiral
[2011/10/11 22:11:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\spiral_preview
[2012/01/12 01:11:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Steinberg
[2012/02/27 21:18:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\To the Moon - Freebird Games
[2011/05/18 18:28:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Unity
[2012/05/03 16:13:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\uTorrent
[2010/03/24 20:39:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Windows Desktop Search
[2010/03/27 22:57:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\Windows Search
[2012/04/20 21:38:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\XnView
[2011/09/03 19:23:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\EndBringer\Application Data\yoclient

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2009/02/12 17:25:40 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=2BB75B7F548D82A099125D0C5971DE7D -- C:\WINDOWS\ERDNT\cache\explorer.exe
[2009/02/12 17:25:40 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=2BB75B7F548D82A099125D0C5971DE7D -- C:\WINDOWS\explorer.exe
[2009/02/12 17:25:40 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=2BB75B7F548D82A099125D0C5971DE7D -- C:\WINDOWS\system32\dllcache\explorer.exe

< MD5 for: NDIS.SYS >
[2012/03/22 04:11:36 | 000,215,168 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\dllcache\ndis.sys
[2012/03/22 04:11:36 | 000,215,168 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\ndis.sys

< MD5 for: SVCHOST.EXE >
[2008/04/14 04:42:38 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\ERDNT\cache\svchost.exe
[2008/04/14 04:42:38 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\system32\dllcache\svchost.exe
[2008/04/14 04:42:38 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\system32\svchost.exe
[2012/01/13 15:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Documents and Settings\EndBringer\Desktop\Programi\Chameleon\svchost.exe

< MD5 for: USERINIT.EXE >
[2008/04/14 04:42:40 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\ERDNT\cache\userinit.exe
[2008/04/14 04:42:40 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2008/04/14 04:42:40 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2009/02/12 17:33:24 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=4F51EED832531FCEAB1F19B220ECCC56 -- C:\WINDOWS\ERDNT\cache\winlogon.exe
[2009/02/12 17:33:24 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=4F51EED832531FCEAB1F19B220ECCC56 -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2009/02/12 17:33:24 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=4F51EED832531FCEAB1F19B220ECCC56 -- C:\WINDOWS\system32\winlogon.exe
[2012/01/13 15:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Documents and Settings\EndBringer\Desktop\Programi\Chameleon\winlogon.exe

< C:\Windows\assembly\tmp\U\*.* /s >

< %Temp%\smtmp\1\*.* >

< %Temp%\smtmp\2\*.* >

< %Temp%\smtmp\3\*.* >

< %Temp%\smtmp\4\*.* >

< type c:\diskreport.txt /c >
Microsoft DiskPart version 5.1.3565
Copyright © 1999-2003 Microsoft Corporation.
On computer: HARRY
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
Volume 0 E DVD-ROM 0 B
Volume 1 F DVD-ROM 0 B
Volume 2 C NTFS Partition 41 GB Healthy System
Volume 3 D NTFS Partition 35 GB Healthy

< End of report >

Extras:

OTL Extras logfile created on: 5/4/2012 7:35:22 PM - Run 1
OTL by OldTimer - Version 3.2.42.2 Folder = C:\Documents and Settings\EndBringer\Desktop\SVC
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1023.48 Mb Total Physical Memory | 373.43 Mb Available Physical Memory | 36.49% Memory free
2.40 Gb Paging File | 1.59 Gb Available in Paging File | 66.42% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 41.06 Gb Total Space | 14.23 Gb Free Space | 34.66% Space Free | Partition Type: NTFS
Drive D: | 35.27 Gb Total Space | 4.66 Gb Free Space | 13.21% Space Free | Partition Type: NTFS

Computer Name: HARRY | User Name: EndBringer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Browse with XnView] -- "C:\Program Files\XnView\xnview.exe" "%1" (XnView, http://www.xnview.com)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0
"DisableThumbnailCache" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"58638:TCP" = 58638:TCP:*:Enabled:Pando Media Booster
"58638:UDP" = 58638:UDP:*:Enabled:Pando Media Booster

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"58638:TCP" = 58638:TCP:*:Enabled:Pando Media Booster
"58638:UDP" = 58638:UDP:*:Enabled:Pando Media Booster
"8381:TCP" = 8381:TCP:*:Enabled:League of Legends Launcher
"8381:UDP" = 8381:UDP:*:Enabled:League of Legends Launcher
"8396:TCP" = 8396:TCP:*:Enabled:League of Legends Launcher
"8396:UDP" = 8396:UDP:*:Enabled:League of Legends Launcher
"6976:TCP" = 6976:TCP:*:Enabled:League of Legends Launcher
"6976:UDP" = 6976:UDP:*:Enabled:League of Legends Launcher
"6913:TCP" = 6913:TCP:*:Enabled:League of Legends Launcher
"6913:UDP" = 6913:UDP:*:Enabled:League of Legends Launcher
"6963:TCP" = 6963:TCP:*:Enabled:League of Legends Launcher
"6963:UDP" = 6963:UDP:*:Enabled:League of Legends Launcher
"8397:TCP" = 8397:TCP:*:Enabled:League of Legends Launcher
"8397:UDP" = 8397:UDP:*:Enabled:League of Legends Launcher
"6941:TCP" = 6941:TCP:*:Enabled:League of Legends Launcher
"6941:UDP" = 6941:UDP:*:Enabled:League of Legends Launcher
"6964:TCP" = 6964:TCP:*:Enabled:League of Legends Launcher
"6964:UDP" = 6964:UDP:*:Enabled:League of Legends Launcher
"6943:TCP" = 6943:TCP:*:Enabled:League of Legends Launcher
"6943:UDP" = 6943:UDP:*:Enabled:League of Legends Launcher
"6960:TCP" = 6960:TCP:*:Enabled:League of Legends Launcher
"6960:UDP" = 6960:UDP:*:Enabled:League of Legends Launcher
"8398:TCP" = 8398:TCP:*:Enabled:League of Legends Launcher
"8398:UDP" = 8398:UDP:*:Enabled:League of Legends Launcher
"8393:TCP" = 8393:TCP:*:Enabled:League of Legends Lobby
"8393:UDP" = 8393:UDP:*:Enabled:League of Legends Lobby
"8390:TCP" = 8390:TCP:*:Enabled:League of Legends Game Client
"8390:UDP" = 8390:UDP:*:Enabled:League of Legends Game Client

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe" = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:*:Enabled:BlueSoleil -- (IVT Corporation.)
"C:\Riot Games\League of Legends\lol.launcher.exe" = C:\Riot Games\League of Legends\lol.launcher.exe:*:Enabled:League of Legends Launcher -- ()
"C:\Program Files\Steam\Steam.exe" = C:\Program Files\Steam\Steam.exe:*:Enabled:Steam -- (Valve Corporation)
"C:\Program Files\Pando Networks\Media Booster\PMB.exe" = C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster -- ()
"C:\Program Files\Steam\steamapps\common\spiral knights\java_vm\bin\javaw.exe" = C:\Program Files\Steam\steamapps\common\spiral knights\java_vm\bin\javaw.exe:*:Enabled:Spiral Knights -- (Sun Microsystems, Inc.)
"C:\Program Files\Orbitdownloader\orbitdm.exe" = C:\Program Files\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
"C:\Program Files\Orbitdownloader\orbitnet.exe" = C:\Program Files\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
"C:\Program Files\Steam\steamapps\common\Spiral Knights Announcement Trailer\smp.exe" = C:\Program Files\Steam\steamapps\common\Spiral Knights Announcement Trailer\smp.exe:*:Enabled:Spiral Knights Announcement Trailer -- (Valve)
"C:\Program Files\AVG\AVG2012\avgnsx.exe" = C:\Program Files\AVG\AVG2012\avgnsx.exe:*:Enabled:Online Shield -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG2012\avgdiagex.exe" = C:\Program Files\AVG\AVG2012\avgdiagex.exe:*:Enabled:AVG Diagnostics 2012 -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG2012\avgmfapx.exe" = C:\Program Files\AVG\AVG2012\avgmfapx.exe:*:Enabled:AVG Installer -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG2012\avgemcx.exe" = C:\Program Files\AVG\AVG2012\avgemcx.exe:*:Enabled:Personal E-mail Scanner -- (AVG Technologies CZ, s.r.o.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{111DB3F0-0C58-4475-9954-1BD5B7B28618}" = League of Legends
"{14A487F2-1259-4E6C-AE3C-3C888DDBCB60}_is1" = Guitar Pro 6
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 3.3
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java™ 6 Update 31
"{33F8EAD4-B6EC-498B-B487-696B973D1C0C}" = Windows Live Messenger
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{411949AB-6EE8-4C62-9C72-EBC93B6A7935}" = AVG 2012
"{438BB9B4-65FE-4626-91D9-A8F57B18001D}" = Bluesoleil2.6.0.8 Release 070517
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{47107F5F-FDEC-4A01-896C-E76245743F1A}" = X-Edit
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{50316C0A-CC2A-460A-9EA5-F486E54AC17D}_is1" = AVG PC Tuneup
"{505AFDC0-5E72-4928-8368-5DEA385E3647}" = CorelDRAW Graphics Suite 12
"{54D4EAF5-4C80-4878-B4AC-5AE454A02E3C}_is1" = Trend Micro RUBotted 2.0 Beta
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{621AF8B2-75D2-4074-BA44-79178A617255}" = Windows Live installer
"{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1" = Revo Uninstaller Pro 2.5.7
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{786C5747-1033-0000-B58E-000000000001}" = Adobe Stock Photos 1.0
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7F1C5D75-E232-4C2B-A394-E5FB7FBB3D66}" = Sonic Foundry Sound Forge 6.0d
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8EDBA74D-0686-4C99-BFDD-F894678E5B39}" = Adobe Common File Installer
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{918A9082-6287-4D25-9002-5E5D5E4971CB}" = League of Legends
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A7836FF5-7293-40A4-B86E-E2038F82E8F3}" = AVG 2012
"{AB3C4AC6-C401-4132-A8B5-265899A9C0E8}" = Steinberg Cubase LE 4
"{AC76BA86-7AD7-1033-7B44-A95000000001}" = Adobe Reader 9.5.1
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars
"{B74D4E10-1033-0000-0000-000000000001}" = Adobe Bridge 1.0
"{BDCF27CA-BFC4-4F49-8D24-A925C9505AB8}" = Windows Rights Management Client with Service Pack 2
"{C04D5974-F528-4347-A494-EAF56124CC1A}" = Steinberg HALionOne Essential Set
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C9B26742-06BE-3B75-B1DE-7B91B5956A04}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30304
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240C0}" = WinZip 15.0
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D22002ED-EE2A-4CB1-A63D-430E62A2E8D8}" = Google SketchUp 8
"{DF9D4063-BAB1-4857-8CE9-C60D2E2D815D}" = DigiTech RP355 Drivers
"{E10DB5DA-E576-40EA-A7FC-1CB2A7B283A6}" = NVIDIA PhysX
"{E70E7159-93B1-470D-9FBD-D8E9EF34B538}" = Steinberg HALionOne
"{E9787678-1033-0000-8E67-000000000001}" = Adobe Help Center 1.0
"{EC905264-BCFE-423B-9C42-C3A106266790}" = Windows Rights Management Client Backwards Compatibility SP2
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FBCED1D8-E731-42B7-AD49-A291175BAA1B}" = ACID Pro 7.0
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"7-Zip" = 7-Zip 9.20
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Agere Systems Soft Modem" = Agere Systems PCI Soft Modem
"AVG" = AVG 2012
"CCleaner" = CCleaner
"CPUID HWMonitor_is1" = CPUID HWMonitor 1.18
"DigiTech RP355 Drivers" = DigiTech RP355 Drivers
"eLicenser Control" = eLicenser Control
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Guitar Pro 5_is1" = Guitar Pro 5.2
"ie8" = Windows Internet Explorer 8
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 6.8.0
"LastFM_is1" = Last.fm 1.5.4.27091
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Silverlight" = Microsoft Silverlight
"Mozilla Firefox 11.0 (x86 en-US)" = Mozilla Firefox 11.0 (x86 en-US)
"Native XDS-x86" = Native XDS-x86 2.51
"Nero - Burning Rom!UninstallKey" = Nero OEM
"NeroMultiInstaller!UninstallKey" = Nero Suite
"NVIDIA Drivers" = NVIDIA Drivers
"Orbit_is1" = Orbit Downloader
"RocketDock_is1" = RocketDock 1.3.5
"Steam App 99900" = Spiral Knights
"Syncrosoft License Control" = Syncrosoft License Control
"uTorrent" = µTorrent
"Winamp" = Winamp
"Windows Rights Management Client" = Windows Rights Management Client with Service Pack 2
"Windows Rights Management Client Backwards" = Windows Rights Management Client Backwards Compatibility SP2
"WinPcapInst" = WinPcap 4.1.1
"WinRAR archiver" = WinRAR archiver
"X-Edit" = X-Edit
"Xfire" = Xfire (remove only)
"XnView_is1" = XnView 1.97.2
"Ys the oath in felghana © XSEED_is1" = Ys the oath in felghana © XSEED version 1

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 4/25/2012 7:10:57 PM | Computer Name = HARRY | Source = Windows Live Messenger 8.5 BETA | ID = 5000
Description =

Error - 5/2/2012 11:23:40 AM | Computer Name = HARRY | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 11.0.0.4454, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 5/3/2012 10:49:19 AM | Computer Name = HARRY | Source = MsiInstaller | ID = 10005
Description = Product: Skype Toolbars -- The installer has encountered an unexpected
error installing this package. This may indicate a problem with this package. The
error code is 2738. The arguments are: , ,

[ System Events ]
Error - 5/4/2012 1:10:39 PM | Computer Name = HARRY | Source = Service Control Manager | ID = 7023
Description = The Atinevxx service terminated with the following error: %%126

Error - 5/4/2012 1:10:39 PM | Computer Name = HARRY | Source = Service Control Manager | ID = 7023
Description = The Pmem service terminated with the following error: %%126

Error - 5/4/2012 1:10:39 PM | Computer Name = HARRY | Source = Service Control Manager | ID = 7023
Description = The Purendis service terminated with the following error: %%126

Error - 5/4/2012 1:10:39 PM | Computer Name = HARRY | Source = Service Control Manager | ID = 7023
Description = The WindrvNT service terminated with the following error: %%126

Error - 5/4/2012 1:10:39 PM | Computer Name = HARRY | Source = Service Control Manager | ID = 7023
Description = The Prtg4service service terminated with the following error: %%126

Error - 5/4/2012 1:10:39 PM | Computer Name = HARRY | Source = Service Control Manager | ID = 7023
Description = The Jobserver_report service terminated with the following error:
%%126

Error - 5/4/2012 1:10:39 PM | Computer Name = HARRY | Source = Service Control Manager | ID = 7023
Description = The Axsnmsvc service terminated with the following error: %%126

Error - 5/4/2012 1:10:39 PM | Computer Name = HARRY | Source = Service Control Manager | ID = 7023
Description = The PEVSystemStart service terminated with the following error: %%126

Error - 5/4/2012 1:10:39 PM | Computer Name = HARRY | Source = Service Control Manager | ID = 7023
Description = The Cmuda service terminated with the following error: %%126

Error - 5/4/2012 1:10:39 PM | Computer Name = HARRY | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
avgio


< End of report >


aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-05-05 16:06:05
-----------------------------
16:06:05.968 OS Version: Windows 5.1.2600 Service Pack 3
16:06:05.968 Number of processors: 1 586 0x5F03
16:06:05.968 ComputerName: HARRY UserName:
16:06:06.312 Initialize success
16:06:39.921 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
16:06:39.921 Disk 0 Vendor: Maxtor_6Y080P0 YAR41BW0 Size: 78167MB BusType: 3
16:06:39.937 Disk 0 MBR read successfully
16:06:39.937 Disk 0 MBR scan
16:06:39.937 Disk 0 Windows XP default MBR code
16:06:39.937 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 42045 MB offset 63
16:06:39.937 Disk 0 Partition - 00 0F Extended LBA 36114 MB offset 86108400
16:06:39.953 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 36114 MB offset 86108463
16:06:39.953 Disk 0 scanning sectors +160071660
16:06:40.015 Disk 0 scanning C:\WINDOWS\system32\drivers
16:06:47.296 Service scanning
16:06:52.562 Service sptd C:\WINDOWS\System32\Drivers\sptd.sys **LOCKED** 32
16:06:54.531 Modules scanning
16:06:56.609 Module: C:\WINDOWS\System32\Drivers\NDIS.sys **SUSPICIOUS**
16:07:00.062 Disk 0 trace - called modules:
16:07:00.093 ntoskrnl.exe >>UNKNOWN [0x86f370e0]<<
16:07:00.093 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86f3eab8]
16:07:00.093 Scan finished successfully
16:07:23.890 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\EndBringer\Desktop\MBR.dat"
16:07:23.890 The log file has been saved successfully to "C:\Documents and Settings\EndBringer\Desktop\aswMBR.txt"


also AVG found this and it can't remove it:

"";"C:\WINDOWS\system32\services.exe (1324):\memory_09500000";"Trojan horse BackDoor.Generic14.CGUJ";"Object is inaccessible."

[Essexboy]

You do not appear to have a clean replacement file

However, I have a copy on my XPSP3
Download the attached zip file to your desktop
Extract ndis.sys to your root c drive i.e. C:\ndis.sys
[attachment=57622:ndis.zip]

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run
To disable MBAM
Open the scanner and select the protection tab
Remove the tick from "Start with Windows"
Reboot and then run OTL


Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

  :OTL
  DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\XDva370.sys -- (XDva370)
  DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\XDva365.sys -- (XDva365)
  DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\XDva344.sys -- (XDva344)
  DRV - File not found [Kernel | On_Demand | Unknown] -- -- (augifxiy)
  IE - HKU\S-1-5-21-854245398-343818398-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;<local>
  
  :Files
  ipconfig /flushdns /c
  C:\WINDOWS\system32\dllcache\ndis.sys|C:\ndis.sys /replace
  C:\WINDOWS\system32\drivers\ndis.sys|C:\ndis.sys /replace
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [CREATERESTOREPOINT]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Re-run Combofix to ensure that the switch has taken

[Vladimir90]

I can't extract ndis.zip. This is what it says:

Extracting to "C:\"
Use Path: yes Overlay Files: no
Error: Access is denied.
Cannot create C:\ndis.sys.
Administrative privileges may be required.
The archive file cannot be opened for output.

I tired even in safe mode, still I couldn't do anything.

[Essexboy]

Are you able to extract it to your desktop ?

[Vladimir90]

Nope, can't extract it anywhere at all.

[Essexboy]

OK download ndis.sys from here The files are alphabetically arranged

To your desktop
Then copy and paste to your root c drive

[Vladimir90]

I can't download it(anywhere), it only let me download it if I rename it, but then after download I can't rename it back to ndis

[Essexboy]

Hmm ok download it you computer renamed as fix.sys

Put that on your c drive

Then run OTL with this fix - if it fails go to step 2

:OTL
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\XDva370.sys -- (XDva370)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\XDva365.sys -- (XDva365)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\XDva344.sys -- (XDva344)
DRV - File not found [Kernel | On_Demand | Unknown] -- -- (augifxiy)
IE - HKU\S-1-5-21-854245398-343818398-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;<local>

:Files
ipconfig /flushdns /c
C:\WINDOWS\system32\dllcache\ndis.sys|C:\fix.sys /replace
C:\WINDOWS\system32\drivers\ndis.sys|C:\fix.sys /replace

:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

STEP 2

Download the latest version of TDSSKiller from here and save it to your Desktop.

• Doubleclick on TDSSKiller.exe to run the application
  
  
• Then click on Change parameters.
  
  
  
• Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.
  
• Click the Start Scan button.
  
  
• If a suspicious object is detected, the default action will be Skip, click on Continue.
  
  
  
• If malicious objects are found, they will show in the Scan results and offer three (3) options.
• Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
  
• Get the report by selecting Reports
  
  
  
• Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

Please copy and paste its contents on your next reply.

[Vladimir90]

I finished OTL part, after reboot svchost still spams packets. Should I do Step 2 now?

All processes killed
========== OTL ==========
Service XDva370 stopped successfully!
Service XDva370 deleted successfully!
File C:\WINDOWS\system32\XDva370.sys not found.
Service XDva365 stopped successfully!
Service XDva365 deleted successfully!
File C:\WINDOWS\system32\XDva365.sys not found.
Service XDva344 stopped successfully!
Service XDva344 deleted successfully!
File C:\WINDOWS\system32\XDva344.sys not found.
Error: No service named augifxiy was found to stop!
Service\Driver key augifxiy not found.
HKU\S-1-5-21-854245398-343818398-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\EndBringer\Desktop\SVC\cmd.bat deleted successfully.
C:\Documents and Settings\EndBringer\Desktop\SVC\cmd.txt deleted successfully.
Unable to replace file: C:\WINDOWS\system32\dllcache\ndis.sys with C:\fix.sys without a reboot.
Unable to replace file: C:\WINDOWS\system32\drivers\ndis.sys with C:\fix.sys without a reboot.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56502 bytes

User: Administrator.HARRY
->Temp folder emptied: 913280 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->FireFox cache emptied: 16334774 bytes
->Flash cache emptied: 57088 bytes

User: All Users
->Temp folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 56502 bytes

User: EndBringer
->Temp folder emptied: 5255657 bytes
->Temporary Internet Files folder emptied: 65670 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 49611785 bytes
->Flash cache emptied: 470 bytes

User: LocalService
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2402797 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 255 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 71.00 mb

Unable to start System Restore Service. Error code 1056

OTL by OldTimer - Version 3.2.42.2 log created on 05052012_184144

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Edited by Vladimir90, 05 May 2012 - 10:51 AM.

[Essexboy]

Yes please