[cherinacherine]

Hi~
Earlier today the FBI Moneypak scam thing infected my computer, and like others (I checked previous posts!) it completely jammed everything up, and I wasn't able to go into Start Mode. I ran through a couple of things, and nothing worked.
Then by accident I kind of, umn, broke the computer? I haven't the slightest idea what I did, but when tried to restart for the 10th time or so, I got a screen saying my computer couldn't correctly start because of missing files or something, and it offered me the option to restore the system from a previous point. Which I did.

I don't -think- that was another virus, but after I did the restore thing the Moneypak scam didn't pop up, and seems to be gone. I have no idea what happened, and I would love to know if my computer is still infected, and if I just downloaded another virus.
I am pretty clueless with computers, so I need things spelled out for me.

Thank you so much, and I really hope this is the right place for this post.


I have a Gateway laptop with 64 bit Windows Vista.
I use Opera, and Chrome occasionally.
For antivirus all I use is Windows Defender, and I try to run the free ESET Online Virus Scanner a couple times a month.

[Advertisements]

Hi first I will need to have a look at your system

Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• Select All Users
• Under the Custom Scan box paste this in
  netsvcs
  BASESERVICES
  %SYSTEMDRIVE%\*.exe
  /md5start
  services.*
  explorer.exe
  winlogon.exe
  Userinit.exe
  svchost.exe
  qmgr.dll
  /md5stop
  CREATERESTOREPOINT
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Post both logs

THEN

Download aswMBR.exe ( 4.8mb ) to your desktop.
Double click the aswMBR.exe to run it Click the "Scan" button to start scan



On completion of the scan click save log, save it to your desktop and post in your next reply

[Essexboy]

Hi first I will need to have a look at your system

Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• Select All Users
• Under the Custom Scan box paste this in
  netsvcs
  BASESERVICES
  %SYSTEMDRIVE%\*.exe
  /md5start
  services.*
  explorer.exe
  winlogon.exe
  Userinit.exe
  svchost.exe
  qmgr.dll
  /md5stop
  CREATERESTOREPOINT
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Post both logs

THEN

Download aswMBR.exe ( 4.8mb ) to your desktop.
Double click the aswMBR.exe to run it Click the "Scan" button to start scan



On completion of the scan click save log, save it to your desktop and post in your next reply

[cherinacherine]

Hi, thank you for replying so quickly! I will post the aswMBR scan as soon as it's finished!













OTL logfile created on: 9/28/2012 10:52:54 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Gwei\Downloads\Antivirus
64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.99 Gb Total Physical Memory | 2.35 Gb Available Physical Memory | 58.82% Memory free
8.18 Gb Paging File | 6.43 Gb Available in Paging File | 78.63% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 217.16 Gb Total Space | 24.19 Gb Free Space | 11.14% Space Free | Partition Type: NTFS
Drive D: | 15.72 Gb Total Space | 8.03 Gb Free Space | 51.07% Space Free | Partition Type: NTFS

Computer Name: GWEI-PC | User Name: Gwei | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/09/28 10:50:52 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Gwei\Downloads\Antivirus\OTL.exe
PRC - [2012/09/14 03:09:44 | 000,874,896 | ---- | M] (Opera Software) -- C:\Program Files (x86)\Opera\opera.exe
PRC - [2011/01/17 19:37:40 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
PRC - [2011/01/17 19:37:40 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
PRC - [2009/11/06 18:19:57 | 000,323,392 | ---- | M] (BitTorrent, Inc.) -- C:\Users\Gwei\Program Files (x86)\DNA\btdna.exe
PRC - [2007/10/03 18:45:02 | 000,358,936 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2007/10/03 18:44:58 | 000,178,712 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe


========== Modules (No Company Name) ==========

MOD - [2012/09/14 03:10:04 | 000,316,928 | ---- | M] () -- C:\Program Files (x86)\Opera\gstreamer\plugins\gstoggdec.dll
MOD - [2012/09/14 03:10:04 | 000,276,480 | ---- | M] () -- C:\Program Files (x86)\Opera\gstreamer\plugins\gstwebmdec.dll
MOD - [2012/09/14 03:10:04 | 000,078,336 | ---- | M] () -- C:\Program Files (x86)\Opera\gstreamer\plugins\gstwavparse.dll
MOD - [2012/09/14 03:10:04 | 000,064,000 | ---- | M] () -- C:\Program Files (x86)\Opera\gstreamer\plugins\gstautodetect.dll
MOD - [2012/09/14 03:10:04 | 000,046,592 | ---- | M] () -- C:\Program Files (x86)\Opera\gstreamer\plugins\gstwaveform.dll
MOD - [2012/09/14 03:10:04 | 000,045,568 | ---- | M] () -- C:\Program Files (x86)\Opera\gstreamer\plugins\gsttypefindfunctions.dll
MOD - [2012/09/14 03:10:03 | 000,168,448 | ---- | M] () -- C:\Program Files (x86)\Opera\gstreamer\plugins\gstffmpegcolorspace.dll
MOD - [2012/09/14 03:10:03 | 000,076,800 | ---- | M] () -- C:\Program Files (x86)\Opera\gstreamer\plugins\gstdirectsound.dll
MOD - [2012/09/14 03:10:02 | 000,099,840 | ---- | M] () -- C:\Program Files (x86)\Opera\gstreamer\plugins\gstcoreplugins.dll
MOD - [2012/09/14 03:10:02 | 000,068,608 | ---- | M] () -- C:\Program Files (x86)\Opera\gstreamer\plugins\gstdecodebin2.dll
MOD - [2012/09/14 03:10:01 | 000,098,816 | ---- | M] () -- C:\Program Files (x86)\Opera\gstreamer\plugins\gstaudioresample.dll
MOD - [2012/09/14 03:10:00 | 000,783,360 | ---- | M] () -- C:\Program Files (x86)\Opera\gstreamer\gstreamer.dll
MOD - [2012/09/14 03:10:00 | 000,098,816 | ---- | M] () -- C:\Program Files (x86)\Opera\gstreamer\plugins\gstaudioconvert.dll
MOD - [2011/11/28 02:57:16 | 000,985,088 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
MOD - [2010/08/10 00:01:06 | 000,067,872 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2010/03/03 13:32:22 | 000,929,792 | ---- | M] () -- C:\Program Files (x86)\Yahoo!\Messenger\yui.dll


========== Services (SafeList) ==========

SRV:64bit: - [2008/01/20 22:47:32 | 000,383,544 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2007/01/30 00:24:38 | 000,410,624 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\DRIVERS\xaudio64.exe -- (XAudioService)
SRV - [2008/07/27 14:03:13 | 000,069,632 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/01/29 13:09:58 | 000,165,416 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Gateway Games\Gateway Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2007/10/03 18:45:02 | 000,358,936 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON)
SRV - [2007/07/27 13:49:46 | 000,119,296 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Program Files (x86)\IDT\WDM\stacsv64.exe -- (STacSV)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2009/05/18 13:17:08 | 000,034,152 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2008/01/25 21:46:52 | 000,150,016 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys -- (RTL8169)
DRV:64bit: - [2008/01/20 22:51:07 | 000,016,384 | ---- | M] () [Recognizer | System | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2008/01/20 22:47:28 | 000,046,080 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb)
DRV:64bit: - [2008/01/20 22:47:27 | 000,214,016 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2008/01/20 22:46:57 | 000,286,720 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\VSTAZL6.SYS -- (HSFHWAZL)
DRV:64bit: - [2008/01/20 22:46:55 | 000,111,104 | ---- | M] () [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\DRIVERS\sdbus.sys -- (sdbus)
DRV:64bit: - [2008/01/03 23:57:26 | 000,062,464 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RTSTOR64.SYS -- (RTSTOR)
DRV:64bit: - [2008/01/01 20:53:08 | 007,172,608 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\igdkmd64.sys -- (igfx)
DRV:64bit: - [2007/10/31 15:44:38 | 003,197,440 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\NETw4v64.sys -- (NETw4v64)
DRV:64bit: - [2007/09/30 02:03:32 | 000,384,024 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\iaStor.sys -- (iaStor)
DRV:64bit: - [2007/07/27 13:50:24 | 000,391,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:64bit: - [2007/07/26 06:00:00 | 000,053,488 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2007/05/23 20:47:28 | 000,020,784 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\UVCFTR_S.SYS -- (UVCFTR)
DRV:64bit: - [2007/01/30 00:24:06 | 000,009,728 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\xaudio64.sys -- (XAudio)
DRV:64bit: - [2006/12/22 00:33:28 | 001,511,936 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\CAX_DPV.sys -- (HSF_DPV)
DRV:64bit: - [2006/12/22 00:30:50 | 000,300,032 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\CAXHWAZL.sys -- (CAXHWAZL)
DRV:64bit: - [2006/12/22 00:29:48 | 000,731,648 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\CAX_CNXT.sys -- (winachsf)
DRV:64bit: - [2006/11/17 18:22:06 | 000,297,272 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\SynTP.sys -- (SynTP)
DRV:64bit: - [2006/11/02 03:48:50 | 002,488,320 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\atikmdag.sys -- (R300)
DRV:64bit: - [2006/10/06 22:13:22 | 000,550,912 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\bcmwl664.sys -- (BCM43XV)
DRV:64bit: - [2006/06/19 02:27:24 | 000,017,024 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\mdmxsdk.sys -- (mdmxsdk)

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.c...ys=PTB&M=T-6836
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.c...ys=PTB&M=T-6836
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.c...ys=PTB&M=T-6836
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_page_URL = http://www.gateway.c...ys=PTB&M=T-6836
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.c...ys=PTB&M=T-6836
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_page_URL = http://www.gateway.c...ys=PTB&M=T-6836
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.c...ys=PTB&M=T-6836
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1935358621-21101508-4254277831-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.c...ys=PTB&M=T-6836
IE - HKU\S-1-5-21-1935358621-21101508-4254277831-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-1935358621-21101508-4254277831-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.sanriotow...dex.php?lang=us
IE - HKU\S-1-5-21-1935358621-21101508-4254277831-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1935358621-21101508-4254277831-1000\..\SearchScopes,DefaultScope = {DDFA09EE-903F-4255-959C-08D4CF23F436}
IE - HKU\S-1-5-21-1935358621-21101508-4254277831-1000\..\SearchScopes\{DDFA09EE-903F-4255-959C-08D4CF23F436}: "URL" = http://www.google.co...ie7&rlz=1I7GWYE
IE - HKU\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Program Files (x86)\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\3.0.40818.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@oberon-media.com/ONCAdapter: C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.7\npapicomadapter.dll File not found
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Users\Gwei\Program Files (x86)\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Users\Gwei\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll (Move Networks)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Gwei\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Gwei\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)



========== Chrome ==========

CHR - homepage: http://www.facebook.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: http://www.facebook.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Gwei\AppData\Local\Google\Chrome\Application\22.0.1229.79\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Gwei\AppData\Local\Google\Chrome\Application\22.0.1229.79\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Gwei\AppData\Local\Google\Chrome\Application\22.0.1229.79\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Gwei\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.230.5 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U23 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: DNA Plug-in (Enabled) = C:\Program Files (x86)\DNA\plugins\npbtdna.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Gwei\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Move Streaming Media Player (Enabled) = C:\Users\Gwei\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\3.0.40818.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: YouTube = C:\Users\Gwei\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\Gwei\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Candy = C:\Users\Gwei\AppData\Local\Google\Chrome\User Data\Default\Extensions\fiejadjmcgacmocgeegodfhligbpecdg\1.0\
CHR - Extension: Gmail = C:\Users\Gwei\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2006/09/18 17:37:24 | 000,000,761 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Veoh Web Player Video Finder) - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll File not found
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe ()
O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (X86)\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe ()
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe ()
O4:64bit: - HKLM..\Run: [SigmatelSysTrayApp] C:\Windows\sttray64.exe (IDT, Inc.)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Camera Assistant Software] C:\Program Files\Camera Assistant Software for Gateway\traybar.exe (Chicony)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-1935358621-21101508-4254277831-1000..\Run: [AdobeUpdater] C:\Program Files (x86)\Common Files\Adobe\Updater5\AdobeUpdater.exe File not found
O4 - HKU\S-1-5-21-1935358621-21101508-4254277831-1000..\Run: [bisayitis] Rundll32.exe "c:\progra~3\yinerodu\yinerodu.dll",a File not found
O4 - HKU\S-1-5-21-1935358621-21101508-4254277831-1000..\Run: [BitTorrent DNA] C:\Users\Gwei\Program Files (x86)\DNA\btdna.exe (BitTorrent, Inc.)
O4 - HKU\S-1-5-21-1935358621-21101508-4254277831-1000..\Run: [Messenger (Yahoo!)] C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKU\S-1-5-21-1935358621-21101508-4254277831-1000..\Run: [notepad] C:\Users\Gwei\ntload.dll ()
O4 - HKU\S-1-5-21-1935358621-21101508-4254277831-1000..\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe ()
O4 - HKU\S-1-5-21-1935358621-21101508-4254277831-1000..\Run: [Sanriotown email alert] C:\Program Files (x86)\Sanriotown\E-mail Alert\MAClient -auto File not found
O4 - HKLM..\RunOnce: [Launcher] C:\Windows\SMINST\Launcher.exe (soft thinks)
O4 - Startup: C:\Users\Gwei\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-1935358621-21101508-4254277831-1000\..Trusted Domains: real.com ([rhap-app-4-0] https in Trusted sites)
O15 - HKU\S-1-5-21-1935358621-21101508-4254277831-1000\..Trusted Domains: real.com ([rhapreg] https in Trusted sites)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_23)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A8B10F2C-1906-4432-BCE6-D5DCA0184B3C}: DhcpNameServer = 192.168.1.254
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe ()
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll ()
O24 - Desktop WallPaper: C:\Users\Gwei\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Gwei\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/04/30 20:01:00 | 000,000,053 | -HS- | M] () - D:\Autorun.inf -- [ NTFS ]
O33 - MountPoints2\{5e6049a7-8484-11dd-a815-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{5e6049a7-8484-11dd-a815-806e6f6e6963}\Shell\AutoRun\command - "" = F:\sansa-installer.exe
O33 - MountPoints2\{af0e424e-ade2-11dd-bb53-0003254c051a}\Shell\AutoRun\command - "" = E:\setupSNK.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)


CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/09/28 08:51:04 | 000,000,000 | -HSD | C] -- C:\found.004
[2012/09/28 08:30:16 | 000,000,000 | ---D | C] -- C:\Users\Gwei\AppData\Roaming\hellomoto
[2012/09/03 19:06:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2012/09/03 19:05:27 | 000,000,000 | ---D | C] -- C:\Users\Gwei\AppData\Roaming\vlc

========== Files - Modified Within 30 Days ==========

[2012/09/28 10:47:00 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1935358621-21101508-4254277831-1000UA.job
[2012/09/28 09:14:29 | 000,003,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/09/28 09:14:29 | 000,003,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/09/28 09:14:20 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/09/28 09:14:16 | 4284,932,096 | -HS- | M] () -- C:\hiberfil.sys
[2012/09/28 08:57:09 | 000,005,972 | ---- | M] () -- C:\Users\Gwei\AppData\Local\d3d9caps.dat
[2012/09/28 08:30:56 | 000,006,431 | ---- | M] () -- C:\Users\Gwei\AppData\Local\chromeupdate.crx
[2012/09/23 18:47:00 | 000,000,852 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1935358621-21101508-4254277831-1000Core.job
[2012/09/13 08:39:56 | 000,209,920 | ---- | M] () -- C:\Users\Gwei\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/09/12 08:13:09 | 001,047,247 | ---- | M] () -- C:\Users\Gwei\Documents\huggy kitty.gif
[2012/09/07 00:44:41 | 000,039,748 | ---- | M] () -- C:\Users\Gwei\.recently-used.xbel
[2012/09/05 15:53:44 | 000,011,527 | ---- | M] () -- C:\Users\Gwei\Documents\Perfect Foods Meals.odt
[2012/09/03 20:36:10 | 001,096,642 | ---- | M] () -- C:\Users\Gwei\Documents\IMG_0011.jpg
[2012/09/03 19:10:43 | 000,001,794 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012/09/01 08:27:30 | 000,093,855 | ---- | M] () -- C:\Users\Gwei\Documents\megabus 4.JPG
[2012/09/01 08:27:10 | 000,093,888 | ---- | M] () -- C:\Users\Gwei\Documents\megabus 3.JPG
[2012/09/01 08:26:42 | 000,115,279 | ---- | M] () -- C:\Users\Gwei\Documents\megabus 2.JPG
[2012/09/01 08:26:11 | 000,092,187 | ---- | M] () -- C:\Users\Gwei\Documents\megabus 1.JPG
[2012/09/01 06:44:21 | 000,002,010 | ---- | M] () -- C:\Users\Gwei\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

========== Files Created - No Company Name ==========

[2099/01/01 12:00:00 | 000,006,456 | -H-- | C] () -- C:\ProgramData\zagavuti
[2012/09/28 08:30:56 | 000,006,431 | ---- | C] () -- C:\Users\Gwei\AppData\Local\chromeupdate.crx
[2012/09/12 08:13:09 | 001,047,247 | ---- | C] () -- C:\Users\Gwei\Documents\huggy kitty.gif
[2012/09/07 00:44:41 | 000,039,748 | ---- | C] () -- C:\Users\Gwei\.recently-used.xbel
[2012/09/05 15:53:43 | 000,011,527 | ---- | C] () -- C:\Users\Gwei\Documents\Perfect Foods Meals.odt
[2012/09/03 20:36:10 | 001,096,642 | ---- | C] () -- C:\Users\Gwei\Documents\IMG_0011.jpg
[2012/09/03 19:06:58 | 000,001,794 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012/09/01 08:27:28 | 000,093,855 | ---- | C] () -- C:\Users\Gwei\Documents\megabus 4.JPG
[2012/09/01 08:27:08 | 000,093,888 | ---- | C] () -- C:\Users\Gwei\Documents\megabus 3.JPG
[2012/09/01 08:26:40 | 000,115,279 | ---- | C] () -- C:\Users\Gwei\Documents\megabus 2.JPG
[2012/09/01 08:26:09 | 000,092,187 | ---- | C] () -- C:\Users\Gwei\Documents\megabus 1.JPG
[2012/06/25 12:19:53 | 022,444,502 | ---- | C] () -- C:\Users\Gwei\TheVelveteenRabbit-noisereduction.mp3
[2012/06/25 11:40:39 | 022,418,560 | ---- | C] () -- C:\Users\Gwei\VelveteenRabbit.mp3
[2012/06/25 11:38:33 | 000,081,580 | ---- | C] () -- C:\Users\Gwei\Rabbitaudacity.aup
[2012/06/22 13:28:22 | 003,581,519 | ---- | C] () -- C:\Users\Gwei\bloodyjack.mp3
[2010/03/16 01:16:45 | 000,000,745 | ---- | C] () -- C:\Users\Gwei\AppData\Roaming\AtomicAlarmClock.ini
[2009/05/13 01:57:59 | 000,005,972 | ---- | C] () -- C:\Users\Gwei\AppData\Local\d3d9caps.dat
[2009/04/15 19:01:01 | 000,000,000 | -HS- | C] () -- C:\Users\Gwei\ntload.dll
[2008/09/17 04:18:19 | 000,209,920 | ---- | C] () -- C:\Users\Gwei\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2006/11/02 11:30:40 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2008/11/06 09:32:58 | 012,897,792 | ---- | M] ()
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2008/11/06 09:14:25 | 011,580,928 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/03/03 00:53:36 | 000,891,392 | ---- | M] ()
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/03/03 00:36:24 | 000,615,424 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2008/01/20 22:50:58 | 000,513,024 | ---- | M] ()
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2012/07/31 13:46:58 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\Audacity
[2009/12/18 01:53:15 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\BitTorrent
[2012/09/28 10:55:46 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\DNA
[2012/09/07 00:44:41 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\gtk-2.0
[2012/09/28 08:30:23 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\hellomoto
[2011/03/16 06:59:11 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\Oberon Media
[2012/09/28 09:17:54 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\Octoshape
[2011/11/28 02:59:30 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\OpenOffice.org
[2010/08/29 01:08:06 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\Opera
[2012/01/15 08:03:39 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\OverDrive
[2011/03/16 07:00:01 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\Pogo
[2010/06/21 17:26:00 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\SecondLife
[2009/10/04 02:28:05 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\WildTangent

========== Purity Check ==========



========== Custom Scans ==========

========== Base Services ==========
SRV:64bit: - [2006/11/02 07:16:28 | 000,026,624 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\aelupsvc.dll -- (AeLookupSvc)
SRV:64bit: - [2008/01/20 22:48:17 | 000,045,056 | ---- | M] () [On_Demand | Running] -- C:\Windows\SysNative\appinfo.dll -- (Appinfo)
SRV:64bit: - [2008/01/20 22:48:16 | 000,080,896 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysNative\alg.exe -- (ALG)
SRV:64bit: - [2008/01/20 22:50:12 | 001,082,368 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\qmgr.dll -- (BITS)
SRV:64bit: - [2008/01/20 22:50:48 | 000,458,240 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\bfe.dll -- (BFE)
SRV:64bit: - [2009/06/15 09:26:45 | 000,011,264 | ---- | M] () [On_Demand | Running] -- C:\Windows\SysNative\lsass.exe -- (KeyIso)
SRV:64bit: - [2008/04/18 00:42:44 | 000,361,984 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\es.dll -- (EventSystem)
SRV - [2008/04/18 01:48:39 | 000,269,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\es.dll -- (EventSystem)
SRV:64bit: - [2008/01/20 22:49:11 | 000,103,424 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysNative\browser.dll -- (Browser)
SRV:64bit: - [2008/01/20 22:49:08 | 000,165,376 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\cryptsvc.dll -- (CryptSvc)
SRV - [2008/01/20 22:49:56 | 000,128,000 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\cryptsvc.dll -- (CryptSvc)
SRV:64bit: - [2009/03/03 00:57:01 | 000,718,336 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\rpcss.dll -- (DcomLaunch)
SRV:64bit: - [2008/01/20 22:50:57 | 000,268,288 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\dhcpcsvc.dll -- (Dhcp)
SRV - [2008/01/20 22:48:40 | 000,204,288 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\dhcpcsvc.dll -- (Dhcp)
SRV:64bit: - [2008/01/20 22:48:49 | 000,117,760 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\dnsrslvr.dll -- (Dnscache)
SRV:64bit: - [2008/01/20 22:50:17 | 000,074,752 | ---- | M] () [On_Demand | Running] -- C:\Windows\SysNative\eapsvc.dll -- (EapHost)
SRV:64bit: - [2006/11/02 07:17:29 | 000,024,064 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysNative\hidserv.dll -- (hidserv)
SRV - [2006/11/02 05:46:05 | 000,025,600 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\hidserv.dll -- (hidserv)
SRV:64bit: - [2008/01/20 22:48:03 | 000,342,016 | ---- | M] () [Disabled | Stopped] -- C:\Windows\SysNative\ipnathlp.dll -- (SharedAccess)
SRV:64bit: - [2008/06/19 11:38:17 | 000,531,456 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\ipsecsvc.dll -- (PolicyAgent)
No service found with a name of MsMpSvc
No service found with a name of NisSrv
SRV:64bit: - [2008/01/20 22:48:39 | 000,480,768 | ---- | M] () [On_Demand | Running] -- C:\Windows\SysNative\swprv.dll -- (swprv)
SRV:64bit: - [2008/01/20 22:49:56 | 000,037,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\mmcss.dll -- (MMCSS)
SRV:64bit: - [2008/01/20 22:48:10 | 000,348,160 | ---- | M] () [On_Demand | Running] -- C:\Windows\SysNative\netman.dll -- (Netman)
SRV:64bit: - [2008/01/20 22:48:40 | 000,304,128 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\netprofm.dll -- (netprofm)
SRV - [2008/01/20 22:49:21 | 000,237,056 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\netprofm.dll -- (netprofm)
SRV:64bit: - [2008/01/20 22:50:27 | 000,206,336 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\nlasvc.dll -- (NlaSvc)
SRV:64bit: - [2008/01/20 22:49:42 | 000,024,576 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\nsisvc.dll -- (nsi)
SRV:64bit: - [2008/01/20 22:50:56 | 000,311,808 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\umpnpmgr.dll -- (PlugPlay)
SRV:64bit: - [2008/01/20 22:49:35 | 000,267,264 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\spoolsv.exe -- (Spooler)
SRV:64bit: - [2009/06/15 09:26:45 | 000,011,264 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysNative\lsass.exe -- (ProtectedStorage)
SRV:64bit: - [2008/06/25 23:56:13 | 000,399,872 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\emdmgmt.dll -- (EMDMgmt)
SRV:64bit: - [2008/01/20 22:48:24 | 000,098,304 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysNative\rasauto.dll -- (RasAuto)
SRV:64bit: - [2008/01/20 22:49:13 | 000,308,224 | ---- | M] () [On_Demand | Running] -- C:\Windows\SysNative\rasmans.dll -- (RasMan)
SRV:64bit: - [2009/03/03 00:57:01 | 000,718,336 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\rpcss.dll -- (RpcSs)
SRV:64bit: - [2008/01/20 22:49:09 | 000,028,672 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\seclogon.dll -- (seclogon)
SRV:64bit: - [2009/06/15 09:26:45 | 000,011,264 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\lsass.exe -- (SamSs)
SRV:64bit: - [2008/01/20 22:47:43 | 000,074,752 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\wscsvc.dll -- (wscsvc)
SRV:64bit: - [2008/01/20 22:50:01 | 000,176,640 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\srvsvc.dll -- (LanmanServer)
SRV:64bit: - [2008/01/20 22:50:39 | 000,301,568 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\shsvcs.dll -- (ShellHWDetection)
SRV - [2008/01/20 22:48:23 | 000,247,296 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\shsvcs.dll -- (ShellHWDetection)
SRV:64bit: - [2008/01/20 22:50:12 | 002,161,664 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\SLsvc.exe -- (slsvc)
SRV:64bit: - [2008/01/20 22:49:04 | 000,843,776 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\schedsvc.dll -- (Schedule)
SRV:64bit: - [2008/01/20 22:49:57 | 000,318,464 | ---- | M] () [On_Demand | Running] -- C:\Windows\SysNative\tapisrv.dll -- (TapiSrv)
SRV - [2008/01/20 22:50:56 | 000,242,688 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\tapisrv.dll -- (TapiSrv)
SRV:64bit: - [2008/01/20 22:50:39 | 000,301,568 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\shsvcs.dll -- (Themes)
SRV - [2008/01/20 22:48:23 | 000,247,296 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\shsvcs.dll -- (Themes)
SRV:64bit: - [2008/01/20 22:51:00 | 000,178,688 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\profsvc.dll -- (ProfSvc)
SRV:64bit: - [2008/01/20 22:50:36 | 001,432,576 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysNative\vssvc.exe -- (VSS)
SRV:64bit: - [2008/01/20 22:49:57 | 000,444,928 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\Audiosrv.dll -- (AudioSrv)
SRV:64bit: - [2008/01/20 22:49:57 | 000,444,928 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\Audiosrv.dll -- (AudioEndpointBuilder)
SRV:64bit: - [2008/01/20 22:47:28 | 000,128,000 | ---- | M] () [On_Demand | Running] -- C:\Windows\SysNative\SDRSVC.dll -- (SDRSVC)
SRV:64bit: - [2008/01/20 22:47:32 | 000,383,544 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2008/01/20 22:50:31 | 001,486,336 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\wevtsvc.dll -- (Eventlog)
SRV:64bit: - [2008/01/20 22:49:42 | 000,601,088 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\mpssvc.dll -- (MpsSvc)
SRV:64bit: - [2008/01/20 22:47:43 | 000,571,392 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\wiaservc.dll -- (stisvc)
SRV:64bit: - [2008/01/20 22:48:55 | 000,122,368 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysNative\msiexec.exe -- (msiserver)
SRV - [2008/01/20 22:49:45 | 000,071,680 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWow64\msiexec.exe -- (msiserver)
SRV:64bit: - [2008/01/20 22:50:11 | 000,221,696 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\wbem\WMIsvc.dll -- (Winmgmt)
SRV:64bit: - [2009/08/06 22:24:17 | 002,424,024 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\wuaueng.dll -- (wuauserv)
SRV:64bit: - [2008/01/20 22:48:38 | 000,208,384 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysNative\dot3svc.dll -- (dot3svc)
SRV:64bit: - [2009/07/11 15:50:02 | 000,615,936 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\wlansvc.dll -- (Wlansvc)
SRV:64bit: - [2009/06/10 08:25:10 | 000,202,752 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\wkssvc.dll -- (LanmanWorkstation)

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2008/10/29 02:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_b5f700fe698beb14\explorer.exe
[2008/10/29 02:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\SysWOW64\explorer.exe
[2008/10/29 02:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_b7eb106e66a7ac19\explorer.exe
[2008/10/29 02:15:50 | 003,087,360 | ---- | M] (Microsoft Corporation) MD5=50514057C28A74BAC2BD04B7B990D615 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_aba256ac352b2919\explorer.exe
[2008/10/29 23:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_b8583e9d7fda0512\explorer.exe
[2008/10/27 22:30:12 | 003,086,848 | ---- | M] (Microsoft Corporation) MD5=72B9990E45C25AA3C75C4FB50A9D6CE0 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_ac5266dd4e2b0a41\explorer.exe
[2008/10/29 02:49:22 | 003,080,704 | ---- | M] (Microsoft Corporation) MD5=BBD8E74F23D7605CB0CDB57A1B25D826 -- C:\Windows\explorer.exe
[2008/10/29 02:49:22 | 003,080,704 | ---- | M] (Microsoft Corporation) MD5=BBD8E74F23D7605CB0CDB57A1B25D826 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_ad96661c3246ea1e\explorer.exe
[2008/10/30 01:30:07 | 003,081,216 | ---- | M] (Microsoft Corporation) MD5=E404A65EF890140410E9F3D405841C95 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_ae03944b4b794317\explorer.exe
[2008/10/27 22:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_b6a7112f828bcc3c\explorer.exe
[2008/01/20 22:48:44 | 003,080,704 | ---- | M] (Microsoft Corporation) MD5=F6D765FB6B457542D954682F50C26E4F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_add342963219dff5\explorer.exe
[2008/01/20 22:49:23 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_b827ece8667aa1f0\explorer.exe

< MD5 for: QMGR.DLL >
[2008/01/20 22:50:12 | 001,082,368 | ---- | M] () MD5=D896A0D43F8AB81ECB1FC6C24DECFD58 -- C:\Windows\SysNative\qmgr.dll
[2008/01/20 22:50:12 | 001,082,368 | ---- | M] (Microsoft Corporation) MD5=D896A0D43F8AB81ECB1FC6C24DECFD58 -- C:\Windows\winsxs\amd64_microsoft-windows-bits-client_31bf3856ad364e35_6.0.6001.18000_none_7faf6070b1cf7cc2\qmgr.dll

< MD5 for: SERVICES >
[2006/09/18 17:37:24 | 000,017,244 | ---- | M] () MD5=9F534244B7F8F55D5C0BB498D8D481E7 -- C:\Windows\winsxs\amd64_microsoft-windows-w..nfrastructure-other_31bf3856ad364e35_6.0.6001.18000_none_60a39df1afb86c9f\services

< MD5 for: SERVICES.EXE >
[2008/01/20 22:50:34 | 000,279,040 | ---- | M] (Microsoft Corporation) MD5=2B336AB6286D6C81FA02CBAB914E3C6C -- C:\Windows\SysWOW64\services.exe
[2008/01/20 22:50:34 | 000,279,040 | ---- | M] (Microsoft Corporation) MD5=2B336AB6286D6C81FA02CBAB914E3C6C -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_cf5fc067cd49010a\services.exe
[2008/01/20 22:49:44 | 000,384,512 | ---- | M] () MD5=DFAC660F0F139276CC9299812DE42719 -- C:\Windows\SysNative\services.exe
[2008/01/20 22:49:44 | 000,384,512 | ---- | M] (Microsoft Corporation) MD5=DFAC660F0F139276CC9299812DE42719 -- C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_2b7e5beb85a67240\services.exe

< MD5 for: SERVICES.EXE.MUI >
[2006/11/02 11:13:31 | 000,017,920 | ---- | M] (Microsoft Corporation) MD5=1626EACF0E7E59F85C59DDDD27C4169C -- C:\Windows\SysWOW64\en-US\services.exe.mui
[2006/11/02 11:13:31 | 000,017,920 | ---- | M] (Microsoft Corporation) MD5=1626EACF0E7E59F85C59DDDD27C4169C -- C:\Windows\winsxs\x86_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.0.6000.16386_en-us_67c6851b290a1ced\services.exe.mui
[2006/11/02 11:13:56 | 000,017,408 | ---- | M] () MD5=F514B57C09E143F1E14415A9E9ADD695 -- C:\Windows\SysNative\en-US\services.exe.mui
[2006/11/02 11:13:56 | 000,017,408 | ---- | M] (Microsoft Corporation) MD5=F514B57C09E143F1E14415A9E9ADD695 -- C:\Windows\winsxs\amd64_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.0.6000.16386_en-us_c3e5209ee1678e23\services.exe.mui

< MD5 for: SERVICES.KROGER.COM.IDX >
[2011/03/31 20:47:30 | 000,000,765 | ---- | M] () MD5=AEE59F99E066CBF016E1AE4757E213EA -- C:\Users\Gwei\AppData\Local\Opera\Opera\icons\services.kroger.com.idx

< MD5 for: SERVICES.LNK >
[2008/01/20 23:20:59 | 000,001,688 | ---- | M] () MD5=EFDD08F4E5E26430885F26F0C35B8C62 -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2008/01/20 23:20:59 | 000,001,688 | ---- | M] () MD5=EFDD08F4E5E26430885F26F0C35B8C62 -- C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk

< MD5 for: SERVICES.MOCHIADS.COM.SOL >
[2011/09/18 18:35:17 | 000,000,391 | ---- | M] () MD5=206058820337ADF35D491A85494D266A -- C:\Users\Gwei\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AFQFUJV9\mochiads.com\services.mochiads.com.sol

< MD5 for: SERVICES.MOF >
[2006/09/18 17:44:54 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\SysNative\wbem\services.mof
[2006/09/18 17:46:11 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\SysWOW64\wbem\services.mof
[2006/09/18 17:44:54 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_2b7e5beb85a67240\services.mof
[2006/09/18 17:46:11 | 000,002,866 | ---- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_cf5fc067cd49010a\services.mof

< MD5 for: SERVICES.MSC >
[2006/11/02 11:13:51 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\SysNative\en-US\services.msc
[2006/09/18 17:29:41 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\SysNative\services.msc
[2006/11/02 11:14:00 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\SysWOW64\en-US\services.msc
[2006/09/18 17:29:40 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\SysWOW64\services.msc
[2006/11/02 11:13:51 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\amd64_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.0.6000.16386_en-us_fe26f08ab7d12816\services.msc
[2006/09/18 17:29:41 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_6.0.6001.18000_none_2b827e27fe185619\services.msc
[2006/11/02 11:14:00 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\x86_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.0.6000.16386_en-us_a2085506ff73b6e0\services.msc
[2006/09/18 17:29:40 | 000,092,745 | ---- | M] () MD5=7A1D35F59468B8118AF5B8E21DF78AE2 -- C:\Windows\winsxs\x86_microsoft-windows-servicessnapin_31bf3856ad364e35_6.0.6001.18000_none_cf63e2a445bae4e3\services.msc

< MD5 for: SERVICES.POWERREVIEWS.COM.IDX >
[2011/08/01 22:56:38 | 000,000,175 | ---- | M] () MD5=2A66C370F301F804FEA98F0278F61AE9 -- C:\Users\Gwei\AppData\Local\Opera\Opera\icons\services.powerreviews.com.idx

< MD5 for: SERVICES.RDB >
[2011/01/17 19:52:22 | 000,237,568 | ---- | M] () MD5=507957679AE4579C15D57FA741EA6FFA -- C:\Program Files (x86)\OpenOffice.org 3\URE\misc\services.rdb
[2011/01/17 19:51:48 | 005,539,328 | ---- | M] () MD5=F2B666905F7FDAA80C86A101A7DE62F9 -- C:\Program Files (x86)\OpenOffice.org 3\Basis\program\services.rdb

< MD5 for: SVCHOST.EXE >
[2008/01/20 22:48:05 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\SysWOW64\svchost.exe
[2008/01/20 22:48:05 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6001.18000_none_b5bb59a1054dbde5\svchost.exe
[2008/01/20 22:50:24 | 000,027,648 | ---- | M] () MD5=CDA9F1373805AF88F6FA4F2064BBA24D -- C:\Windows\SysNative\svchost.exe
[2008/01/20 22:50:24 | 000,027,648 | ---- | M] (Microsoft Corporation) MD5=CDA9F1373805AF88F6FA4F2064BBA24D -- C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6001.18000_none_11d9f524bdab2f1b\svchost.exe

< MD5 for: USERINIT.EXE >
[2008/01/20 22:50:36 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\SysWOW64\userinit.exe
[2008/01/20 22:50:36 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2008/01/20 22:49:46 | 000,028,160 | ---- | M] () MD5=A0AB2BB9A92293D9CE66E252719AB5FE -- C:\Windows\SysNative\userinit.exe
[2008/01/20 22:49:46 | 000,028,160 | ---- | M] (Microsoft Corporation) MD5=A0AB2BB9A92293D9CE66E252719AB5FE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_384755998a0d6941\userinit.exe

< MD5 for: WINLOGON.EXE >
[2008/01/20 22:49:47 | 000,406,016 | ---- | M] () MD5=856491FCED98093D824B9EB2892F564A -- C:\Windows\SysNative\winlogon.exe
[2008/01/20 22:49:47 | 000,406,016 | ---- | M] (Microsoft Corporation) MD5=856491FCED98093D824B9EB2892F564A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_cbe19c9a8d4eed2b\winlogon.exe
[2008/01/20 22:50:38 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\SysWOW64\winlogon.exe
[2008/01/20 22:50:38 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

========== Alternate Data Streams ==========

@Alternate Data Stream - 64 bytes -> C:\Users\Gwei\Documents\[TV] arashi ni shiyagare 20111015 - kame part (11m)(1280x720)(KAL)..avi:TOC.WMV
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:F3AB0B43

< End of report >

























OTL Extras logfile created on: 9/28/2012 10:52:54 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Gwei\Downloads\Antivirus
64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.99 Gb Total Physical Memory | 2.35 Gb Available Physical Memory | 58.82% Memory free
8.18 Gb Paging File | 6.43 Gb Available in Paging File | 78.63% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 217.16 Gb Total Space | 24.19 Gb Free Space | 11.14% Space Free | Partition Type: NTFS
Drive D: | 15.72 Gb Total Space | 8.03 Gb Free Space | 51.07% Space Free | Partition Type: NTFS

Computer Name: GWEI-PC | User Name: Gwei | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" ()
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
InternetShortcut [print] -- rundll32.exe C:\Windows\system32\mshtml.dll,PrintHTML "%1" ()
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = 9F 9E 16 8C DC 5B C8 01 [binary data]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\BitTorrent\bittorrent.exe" = C:\Program Files (x86)\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent -- (BitTorrent, Inc.)
"C:\Program Files (x86)\iCall\iCall.exe" = C:\Program Files (x86)\iCall\iCall.exe:*:Enabled:iCall
"C:\Program Files (x86)\BitTorrent\bittorrent.exe" = C:\Program Files (x86)\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent -- (BitTorrent, Inc.)
"C:\Program Files (x86)\iCall\iCall.exe" = C:\Program Files (x86)\iCall\iCall.exe:*:Enabled:iCall


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1DF1815C-D6FB-477D-BCB5-4664763A1AF4}" = lport=139 | protocol=6 | dir=in | app=system |
"{2BD737CD-5474-48C7-9746-4DC1BC0627F7}" = rport=445 | protocol=6 | dir=out | app=system |
"{2E352AEA-3DA3-4ACE-9983-4F53B4A7375B}" = rport=138 | protocol=17 | dir=out | app=system |
"{5C3A84CE-0EC3-4FBB-A5C6-AA55F4E56246}" = rport=139 | protocol=6 | dir=out | app=system |
"{66F3FE2A-FF18-488F-B5B6-153213F9E8D5}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 |
"{726C2244-6B6C-4942-A9B2-1FB5187DAF52}" = lport=137 | protocol=17 | dir=in | app=system |
"{9F7C872E-CDDC-4FDB-9D50-A24FC1C3D917}" = rport=137 | protocol=17 | dir=out | app=system |
"{AA302C9F-CD55-4B14-9642-62AA17776734}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{AFCDD002-EC5F-4456-B94C-CC189F64904C}" = lport=445 | protocol=6 | dir=in | app=system |
"{B8416E2B-CBFA-456A-BCAB-9887F687A77F}" = lport=138 | protocol=17 | dir=in | app=system |
"{C5084C7F-FAE3-4CE8-8C4C-63FE4D54D800}" = lport=2869 | protocol=6 | dir=in | app=system |
"{C86278CA-40DB-4362-A5F7-0927A2C087F4}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{CD524373-3001-4C4E-8579-0E7988B46594}" = lport=49161 | protocol=6 | dir=in | name=akamai netsession interface |
"{DC032142-54BC-4D53-9E76-85CF14761CDF}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06F21F4A-881F-460A-BC00-4F76A1E7F2FF}" = protocol=58 | dir=out | [email protected],-28546 |
"{0E2E0F13-FA95-4418-859D-38B09810AC4E}" = protocol=6 | dir=in | app=c:\aeriagames\edeneternal\launcher.exe |
"{0F3EAA25-015F-4C97-AD4D-EC3A781F1E61}" = protocol=17 | dir=in | app=c:\users\gwei\documents\mplayerc.exe |
"{1316F876-177D-4351-B743-3E3626E041D7}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{1991FA9E-9965-47C7-B053-4E2BDEF1BA19}" = protocol=6 | dir=in | app=c:\program files (x86)\veoh networks\veohwebplayer\veohwebplayer.exe |
"{258A3A12-ED05-4C5A-9DDD-A31098770B0E}" = protocol=1 | dir=out | [email protected],-28544 |
"{28DB5B89-B1A3-44DF-B360-D4F34F44BAC4}" = protocol=17 | dir=in | app=c:\program files (x86)\yahoo!\messenger\yahoomessenger.exe |
"{2D6ABE82-C34F-4C65-BEFB-A2C1CCCC46D7}" = protocol=17 | dir=in | app=c:\program files (x86)\windows media player\wmplayer.exe |
"{2FB3677C-A609-4676-9EB8-E1B8F180F8E5}" = protocol=6 | dir=in | app=c:\users\gwei\documents\mplayerc.exe |
"{417FB329-5377-4FD4-BDE7-E29E30841808}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmplayer.exe |
"{41E68033-E37C-4E0B-BEAD-B75EA15703AF}" = protocol=17 | dir=in | app=c:\program files (x86)\veoh networks\veohwebplayer\veohwebplayer.exe |
"{57BE16D3-2FD8-43BD-A701-C29289FC33BC}" = protocol=17 | dir=out | app=c:\program files (x86)\windows media player\wmplayer.exe |
"{59F7DAA2-9C82-4B65-ADC4-B4C0A8CA286D}" = protocol=17 | dir=in | app=c:\program files (x86)\dna\btdna.exe |
"{5E63A34B-26AA-4D95-8326-A0C04ED38FE7}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{61CAFC38-A83D-47D8-8E2C-8B82D36216CD}" = protocol=1 | dir=in | [email protected],-28543 |
"{62028980-1DC3-43C8-84FC-D368350A5B1B}" = protocol=6 | dir=out | app=c:\program files (x86)\windows media player\wmplayer.exe |
"{6F3818CF-C4C5-4C0A-ABA3-5EF79DFF089B}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{70DB63D6-8AC8-487A-9D7D-B1C41AFC4EF8}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{737CEAA6-CB6D-4D9B-9437-16B6101C8B08}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{75456ED1-88A2-4222-B544-3A3269620FAF}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{7BBB7461-ECFC-4976-97F1-F3B6FD3ED6D9}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{80C872B8-CB3F-48C3-B49A-07E81CB0352E}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{8FFC8ED8-687E-4B4F-BA15-4DC2E80EB6A3}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{9A315569-88A1-460D-B3B3-78B71E642874}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{9FE4C7AF-C25E-4BDA-AC52-54FE8B7AB30F}" = protocol=58 | dir=in | [email protected],-28545 |
"{A0C88969-B631-4EEA-9631-B4D1D63EA5EA}" = protocol=17 | dir=in | app=c:\aeriagames\edeneternal\launcher.exe |
"{ADDD2A4F-AD04-41B5-96B6-519F91331F12}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{AEB48A62-80B5-4D07-B17A-0AD5D0D16708}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe |
"{B4E3CA9E-DC47-42CF-BF09-EB175C7B4813}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{CEBC30B6-E34E-4F15-B14C-29B090E2701C}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{D00C9C71-B921-405F-990D-A0A603E52DE0}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{DD3A7E10-21C7-45D1-A29E-A99280DC1470}" = protocol=17 | dir=in | app=c:\aeriagames\edeneternal\_launcher.exe |
"{E1B21746-7CB0-4D6E-90F0-B70AA45B0D03}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{E8C7D72A-D4D2-41FE-9026-32C748798C86}" = protocol=6 | dir=in | app=c:\program files (x86)\dna\btdna.exe |
"{F7A9651C-5D0F-4387-A093-636E46C85924}" = protocol=6 | dir=in | app=c:\aeriagames\edeneternal\_launcher.exe |
"{FF46A58F-E6DB-49C5-ADB1-8DC04AFE0446}" = protocol=6 | dir=in | app=c:\program files (x86)\yahoo!\messenger\yahoomessenger.exe |
"TCP Query User{059F7E6D-D462-4963-90E7-8633EC5259C9}C:\windows\syswow64\solidstatenetworks\solidstateion\solidnm.exe" = protocol=6 | dir=in | app=c:\windows\syswow64\solidstatenetworks\solidstateion\solidnm.exe |
"TCP Query User{0B1C81A9-B983-437E-B027-5079EDC0A12B}C:\program files (x86)\icall\icall.exe" = protocol=6 | dir=in | app=c:\program files (x86)\icall\icall.exe |
"TCP Query User{14738CDA-0DDC-41C2-BB4A-C4033567E963}C:\program files (x86)\yahoo!\messenger\yahoomessenger.exe" = protocol=6 | dir=in | app=c:\program files (x86)\yahoo!\messenger\yahoomessenger.exe |
"TCP Query User{37BCD0CD-DD84-4948-B020-226CE1354252}C:\users\gwei\program files (x86)\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\gwei\program files (x86)\dna\btdna.exe |
"TCP Query User{4F140C00-1E2E-4F0A-8F9F-57975ABE9582}C:\program files (x86)\veoh networks\veoh\veohclient.exe" = protocol=6 | dir=in | app=c:\program files (x86)\veoh networks\veoh\veohclient.exe |
"TCP Query User{5BC30583-9CD8-470D-A9A7-B3312951459D}C:\program files (x86)\bittorrent\bittorrent.exe" = protocol=6 | dir=in | app=c:\program files (x86)\bittorrent\bittorrent.exe |
"TCP Query User{73084ECA-A3F4-41E0-A2AE-0096AD1AAEA8}C:\program files (x86)\rhapsody\rhapsody.exe" = protocol=6 | dir=in | app=c:\program files (x86)\rhapsody\rhapsody.exe |
"TCP Query User{7A7762AC-EA1C-49EE-A763-EECE875539D2}C:\program files (x86)\keyholetv\keyholetv.exe" = protocol=6 | dir=in | app=c:\program files (x86)\keyholetv\keyholetv.exe |
"TCP Query User{809636D8-DC6A-4636-823B-684A94FA4166}C:\program files (x86)\bittorrent\bittorrent.exe" = protocol=6 | dir=in | app=c:\program files (x86)\bittorrent\bittorrent.exe |
"TCP Query User{9A275DC8-1E1F-4541-8E39-1640123E4CBF}C:\users\gwei\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe" = protocol=6 | dir=in | app=c:\users\gwei\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe |
"TCP Query User{9BB61387-2579-4AF2-BAC5-A9959983F5F7}C:\program files (x86)\secondlifeviewer2\slvoice.exe" = protocol=6 | dir=in | app=c:\program files (x86)\secondlifeviewer2\slvoice.exe |
"TCP Query User{A9626628-B85A-444E-9047-D651DB409D40}C:\program files (x86)\veoh networks\veohwebplayer\veohwebplayer.exe" = protocol=6 | dir=in | app=c:\program files (x86)\veoh networks\veohwebplayer\veohwebplayer.exe |
"TCP Query User{B0BE7B33-F299-4A32-B3FF-5BBAC62214A7}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe |
"TCP Query User{C0370B82-4E0C-44B2-BC85-9FB8171D0A20}C:\program files (x86)\veoh networks\veoh\veohclient.exe" = protocol=6 | dir=in | app=c:\program files (x86)\veoh networks\veoh\veohclient.exe |
"TCP Query User{C0590873-3BA6-453E-B4BF-FC03D35AD9F3}C:\program files (x86)\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"TCP Query User{F8EFB4B1-846A-4A31-996B-BC9306F22737}C:\users\gwei\program files (x86)\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\gwei\program files (x86)\dna\btdna.exe |
"TCP Query User{FB372EC2-0C58-4AE7-A285-5D1D2927E6EF}C:\program files (x86)\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"UDP Query User{2F0E1CDD-0208-43DF-9576-C0E1B1242795}C:\windows\syswow64\solidstatenetworks\solidstateion\solidnm.exe" = protocol=17 | dir=in | app=c:\windows\syswow64\solidstatenetworks\solidstateion\solidnm.exe |
"UDP Query User{5FB62287-582A-4C2C-8D8B-814B1E7FD22A}C:\program files (x86)\veoh networks\veoh\veohclient.exe" = protocol=17 | dir=in | app=c:\program files (x86)\veoh networks\veoh\veohclient.exe |
"UDP Query User{618525A6-76E2-47AB-9BB3-41395313C528}C:\program files (x86)\veoh networks\veoh\veohclient.exe" = protocol=17 | dir=in | app=c:\program files (x86)\veoh networks\veoh\veohclient.exe |
"UDP Query User{61A892E5-0D5A-423A-855B-3E6F65385EC7}C:\program files (x86)\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"UDP Query User{684628AF-B022-4C36-A863-EAA506933A50}C:\program files (x86)\veoh networks\veohwebplayer\veohwebplayer.exe" = protocol=17 | dir=in | app=c:\program files (x86)\veoh networks\veohwebplayer\veohwebplayer.exe |
"UDP Query User{7FB1E0FB-18CF-4281-822E-DFD07D223714}C:\program files (x86)\secondlifeviewer2\slvoice.exe" = protocol=17 | dir=in | app=c:\program files (x86)\secondlifeviewer2\slvoice.exe |
"UDP Query User{911B7491-9D29-43BD-BF10-75F21318E151}C:\program files (x86)\bittorrent\bittorrent.exe" = protocol=17 | dir=in | app=c:\program files (x86)\bittorrent\bittorrent.exe |
"UDP Query User{9CE0A034-135D-4220-9A7F-BED2573098D2}C:\users\gwei\program files (x86)\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\gwei\program files (x86)\dna\btdna.exe |
"UDP Query User{B204CDAF-B453-4A67-AD18-59C155514C8A}C:\program files (x86)\yahoo!\messenger\yahoomessenger.exe" = protocol=17 | dir=in | app=c:\program files (x86)\yahoo!\messenger\yahoomessenger.exe |
"UDP Query User{C023CE68-3B6E-4146-BE8B-D82EE16839D7}C:\program files (x86)\rhapsody\rhapsody.exe" = protocol=17 | dir=in | app=c:\program files (x86)\rhapsody\rhapsody.exe |
"UDP Query User{C5C39E64-7201-4F7B-A426-641B87BC2AC8}C:\program files (x86)\icall\icall.exe" = protocol=17 | dir=in | app=c:\program files (x86)\icall\icall.exe |
"UDP Query User{C6FBB1DA-2932-4BD5-B079-3A07089DDE49}C:\program files (x86)\keyholetv\keyholetv.exe" = protocol=17 | dir=in | app=c:\program files (x86)\keyholetv\keyholetv.exe |
"UDP Query User{DC133300-19DC-4EF6-A06C-B67D0B1A1E4B}C:\program files (x86)\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe |
"UDP Query User{E4DC194C-BC65-434D-BC7A-B044C647A92A}C:\users\gwei\program files (x86)\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\gwei\program files (x86)\dna\btdna.exe |
"UDP Query User{EC0D6DDC-F0C2-4323-B189-98CA0A5BD3DF}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe |
"UDP Query User{F20E3DC6-BD87-4502-8020-677A6CF31FCC}C:\program files (x86)\bittorrent\bittorrent.exe" = protocol=17 | dir=in | app=c:\program files (x86)\bittorrent\bittorrent.exe |
"UDP Query User{F744FA78-D7CC-4C0D-A07A-484C48905710}C:\users\gwei\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe" = protocol=17 | dir=in | app=c:\users\gwei\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{104FB32A-7CE3-4C4B-B2AA-70C613FF9DFA}" = iTunes
"{33EB1061-ABF1-4470-A540-32E97A610536}" = Apple Mobile Device Support
"{41BF0DE4-5BAE-4B88-AFD3-86A30B222186}" = Bonjour
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"CNXT_MODEM_PCI_VEN_14F1&DEV_2C06&SUBSYS_14F10000" = HDAUDIO Soft Data Fax Modem with SmartCP
"HDMI" = Intel® Graphics Media Accelerator Driver
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"SynTPDeinstKey" = Synaptics Pointing Device Driver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{07D8511D-C9FE-4A93-933F-EAA5C8F20095}" = IDT Audio
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java™ 6 Update 23
"{26A24AE4-039D-4CA4-87B4-2F83216022F0}" = Java™ 6 Update 22
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{34FF0741-EC67-4C05-AC2A-6D257123DF2E}" = BigFix
"{39098402-3F7A-4257-A4AE-FC1181D1B40B}" = Camera Assistant Software for Gateway
"{3E171899-0175-47CC-84C4-562ACDD4C021}" = OpenOffice.org 3.3
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5F00DF7E-418B-4CD9-8EC5-781156BCC49E}" = Microsoft Money Shared Libraries
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7A5AE924-83A4-47AB-BDB6-6BF534BC9E12}_is1" = Nidesoft Video Converter v2.3
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7F3BCF8A-8E02-4659-AF25-F9AB66BD6718}" = Gateway Recovery Center Installer
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169, 8168, 8101E and 8102E Ethernet Network Card Driver for Windows Vista
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8DCE550C-CA43-4E82-92DF-FFC4A48F5BE1}" = Napster Burn Engine
"{8E9DB7EF-5DD3-499E-BA2A-A1F3153A4DF8}" = Adobe Flash Player 9 ActiveX
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{3EC77D26-799B-4CD8-914F-C1565E796173}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)soft Office Proof (English) 2007

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{430971B1-C31E-45DA-81E0-72C095BAB72C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)soft Office Proof (French) 2007

"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{F7A31780-33C4-4E39-951A-5EC9B91D7BF1}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)soft Office Proof (Spanish) 2007

"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{00C5525B-3CB3-467D-8100-2E6FB306CD86}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{FAD8A83E-9BAC-4179-9268-A35948034D85}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{FAD8A83E-9BAC-4179-9268-A35948034D85}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0116-0409-1000-0000000FF1CE}_HOMESTUDENTR_{FAD8A83E-9BAC-4179-9268-A35948034D85}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{BEE75E01-DD3F-4D5F-B96C-609E6538D419}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9F479685-180E-4C05-9400-D59292A1B29C}" = Windows Live Movie Maker
"{AC76BA86-7AD7-1033-7B44-A90000000001}" = Adobe Reader 9
"{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B57EAFF2-D6EE-4C6C-9175-ED9F17BFC1BC}" = Windows Live Messenger
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BBBCAE4B-B416-4182-A6F2-438180894A81}" = Napster
"{CB84F0F2-927B-458D-9DC5-87832E3DC653}" = GearDrvs
"{D647F06F-2908-487E-9CDA-DE52148CBF49}" = OverDrive Media Console
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{E6158D07-2637-4ECF-B576-37C489669174}" = Windows Live Call
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{EE39FFBD-544E-49E4-A999-6819828EAE91}" = Windows Live Photo Gallery
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"AC3Filter" = AC3Filter (remove only)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"ALUpdate_is1" = ALTools Update
"ALZip_is1" = ALZip
"Audacity_is1" = Audacity 2.0
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.3
"AVS4YOU Video Converter 6_is1" = AVS Video Converter 6
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Digital Editions" = Adobe Digital Editions
"DVDStyler_is1" = DVDStyler v1.7.1
"ERUNT_is1" = ERUNT 1.1j
"ESET Online Scanner" = ESET Online Scanner v3
"Hello Kitty® Online Downloader" = Hello Kitty® Online Downloader
"Hello Kitty® Online North America" = Hello Kitty® Online North America
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"KeyHoleTV" = KeyHoleTV
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Money2007b" = Microsoft Money Essentials
"Opera 12.02.1578" = Opera 12.02
"Rhapsody" = Rhapsody
"VLC media player" = VLC media player 2.0.3
"WildTangent gateway Master Uninstall" = Gateway Games
"WinGimp-2.0_is1" = GIMP 2.6.8
"WinLiveSuite_Wave3" = Windows Live Essentials
"Yahoo! Messenger" = Yahoo! Messenger

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Amazon Kindle" = Amazon Kindle
"BitTorrent" = BitTorrent
"BitTorrent DNA" = DNA
"dotoo" = dotoo
"Google Chrome" = Google Chrome
"Hiragana" = Hiragana
"Move Media Player" = Move Media Player
"Pandora _ Opera Widget" = Pandora : Opera Widget

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 11/24/2011 8:33:08 AM | Computer Name = Gwei-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2262

Error - 11/24/2011 8:33:08 AM | Computer Name = Gwei-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 2262

Error - 11/24/2011 8:33:09 AM | Computer Name = Gwei-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 11/24/2011 8:33:09 AM | Computer Name = Gwei-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 3557

Error - 11/24/2011 8:33:09 AM | Computer Name = Gwei-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 3557

Error - 11/24/2011 8:33:10 AM | Computer Name = Gwei-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 11/24/2011 8:33:10 AM | Computer Name = Gwei-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 4587

Error - 11/24/2011 8:33:10 AM | Computer Name = Gwei-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 4587

Error - 11/24/2011 8:33:11 AM | Computer Name = Gwei-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 11/24/2011 8:33:11 AM | Computer Name = Gwei-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 5585

Error - 11/24/2011 8:33:11 AM | Computer Name = Gwei-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 5585

Error - 11/24/2011 8:33:59 AM | Computer Name = Gwei-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 11/24/2011 8:33:59 AM | Computer Name = Gwei-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 53961

Error - 11/24/2011 8:33:59 AM | Computer Name = Gwei-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 53961

[ System Events ]
Error - 9/14/2012 3:03:18 AM | Computer Name = Gwei-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 1:52:06 PM on 9/13/2012 was unexpected.

Error - 9/14/2012 3:03:10 AM | Computer Name = Gwei-PC | Source = Application Popup | ID = 877
Description = There was error [DATABASE OPEN FAILED] processing the driver database.

Error - 9/28/2012 8:35:42 AM | Computer Name = Gwei-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 8:30:28 AM on 9/28/2012 was unexpected.

Error - 9/28/2012 8:35:44 AM | Computer Name = Gwei-PC | Source = HTTP | ID = 15016
Description =

Error - 9/28/2012 8:42:54 AM | Computer Name = Gwei-PC | Source = HTTP | ID = 15016
Description =

Error - 9/28/2012 8:54:03 AM | Computer Name = Gwei-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 8:43:44 AM on 9/28/2012 was unexpected.

Error - 9/28/2012 8:54:05 AM | Computer Name = Gwei-PC | Source = HTTP | ID = 15016
Description =

Error - 9/28/2012 9:04:26 AM | Computer Name = Gwei-PC | Source = HTTP | ID = 15016
Description =

Error - 9/28/2012 9:14:30 AM | Computer Name = Gwei-PC | Source = HTTP | ID = 15016
Description =

Error - 9/28/2012 9:17:26 AM | Computer Name = Gwei-PC | Source = WinDefend | ID = 2004
Description =


< End of report >

[cherinacherine]

Here is the aswMBR scan. After I opened it, it offered a free avast! antivirus download. I declined. I assume it's not a virus, but I thought I'd mention it just in case.








aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-09-28 11:08:03
-----------------------------
11:08:03.095 OS Version: Windows x64 6.0.6001 Service Pack 1
11:08:03.095 Number of processors: 2 586 0xF0D
11:08:03.095 ComputerName: GWEI-PC UserName: Gwei
11:08:05.575 Initialize success
11:08:26.030 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
11:08:26.030 Disk 0 Vendor: WDC_WD25 01.0 Size: 238475MB BusType: 3
11:08:26.061 Disk 0 MBR read successfully
11:08:26.061 Disk 0 MBR scan
11:08:26.061 Disk 0 Windows VISTA default MBR code
11:08:26.077 Disk 0 Partition 1 00 07 HPFS/NTFS NTFS 16096 MB offset 63
11:08:26.092 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 222376 MB offset 32965380
11:08:26.155 Disk 0 scanning C:\Windows\system32\drivers
11:08:32.460 Service scanning
11:08:45.664 Modules scanning
11:08:45.664 Disk 0 trace - called modules:
11:08:45.695 ntoskrnl.exe CLASSPNP.SYS disk.sys acpi.sys iaStor.sys hal.dll
11:08:45.695 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004ef9790]
11:08:45.711 3 CLASSPNP.SYS[fffffa6000fc5b3a] -> nt!IofCallDriver -> [0xfffffa8004b86e40]
11:08:46.183 5 acpi.sys[fffffa60008f5ff6] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0xfffffa8004b87050]
11:08:46.183 Scan finished successfully
11:11:06.394 Disk 0 MBR has been saved successfully to "C:\Users\Gwei\Downloads\Antivirus\MBR.dat"
11:11:06.394 The log file has been saved successfully to "C:\Users\Gwei\Downloads\Antivirus\aswMBR.txt"

[Essexboy]

Yes Avast will offer a full AV scan along with the MBR scan

I am not overly happy about one file so I will check that out after we have cleared the remnants

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  
  

  :OTL
  O4 - HKU\S-1-5-21-1935358621-21101508-4254277831-1000..\Run: [bisayitis] Rundll32.exe "c:\progra~3\yinerodu\yinerodu.dll",a File not found
  O4 - HKU\S-1-5-21-1935358621-21101508-4254277831-1000..\Run: [notepad] C:\Users\Gwei\ntload.dll ()
  [2099/01/01 12:00:00 | 000,006,456 | -H-- | C] () -- C:\ProgramData\zagavuti
  [2012/09/28 08:30:56 | 000,006,431 | ---- | C] () -- C:\Users\Gwei\AppData\Local\chromeupdate.crx
  [2009/04/15 19:01:01 | 000,000,000 | -HS- | C] () -- C:\Users\Gwei\ntload.dll
  
  :Files 
  c:\progra~3\yinerodu
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [CREATERESTOREPOINT]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
• Accept the disclaimer and allow to update if it asks
  
  
  
  
  
• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

[cherinacherine]

When I try to run OTL the program freezes up. I've tried twice, and I can't tell if it finishes scanning before it freezes or not. I close out OTL, and when I reopen it I get this message:


Files\Folders moved on Reboot...
File move failed. C:\Windows\System32\drivers\etc\Hosts scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...



----

The name of the notepad is different both times. Here they are:


09282012_112220

09282012_112516


----

I haven't done anything else besides that.

[Essexboy]

Continue with Combofix please , OTL did the main part of its job

[cherinacherine]

Oops, okay! Sorry about that. I'm not sure if you want the OTL log from after the reboot, so I'm including it too (I -really- don't want to leave out something vital by mistake...!)
And so far, my computer seems to be running the same as usual.
Thank you~





OTL


OTL logfile created on: 9/28/2012 1:36:14 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Gwei\Downloads\Antivirus
64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.99 Gb Total Physical Memory | 2.65 Gb Available Physical Memory | 66.32% Memory free
8.15 Gb Paging File | 6.74 Gb Available in Paging File | 82.69% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 217.16 Gb Total Space | 24.34 Gb Free Space | 11.21% Space Free | Partition Type: NTFS
Drive D: | 15.72 Gb Total Space | 8.03 Gb Free Space | 51.07% Space Free | Partition Type: NTFS

Computer Name: GWEI-PC | User Name: Gwei | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/09/28 10:50:52 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Gwei\Downloads\Antivirus\OTL.exe
PRC - [2012/09/14 03:09:44 | 000,874,896 | ---- | M] (Opera Software) -- C:\Program Files (x86)\Opera\opera.exe
PRC - [2011/01/17 19:37:40 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
PRC - [2011/01/17 19:37:40 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
PRC - [2010/09/22 18:35:29 | 002,969,496 | ---- | M] () -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
PRC - [2009/11/06 18:19:57 | 000,323,392 | ---- | M] (BitTorrent, Inc.) -- C:\Users\Gwei\Program Files (x86)\DNA\btdna.exe
PRC - [2007/10/03 18:45:02 | 000,358,936 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2007/10/03 18:44:58 | 000,178,712 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2007/09/27 19:27:02 | 004,839,936 | ---- | M] () -- C:\Program Files\Camera Assistant Software for Gateway\CEC_MAIN.exe
PRC - [2007/08/16 20:17:56 | 002,342,912 | ---- | M] (BigFix Inc.) -- C:\Program Files\BigFix\bigfix.exe


========== Modules (No Company Name) ==========

MOD - [2012/01/04 16:21:30 | 008,527,008 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
MOD - [2011/11/28 02:57:16 | 000,985,088 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
MOD - [2010/09/22 18:35:29 | 002,969,496 | ---- | M] () -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
MOD - [2010/08/10 00:01:06 | 000,067,872 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2010/03/03 13:32:22 | 000,929,792 | ---- | M] () -- C:\Program Files (x86)\Yahoo!\Messenger\yui.dll
MOD - [2007/09/27 19:27:02 | 004,839,936 | ---- | M] () -- C:\Program Files\Camera Assistant Software for Gateway\CEC_MAIN.exe


========== Services (SafeList) ==========

SRV:64bit: - [2008/01/20 22:47:32 | 000,383,544 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2007/01/30 00:24:38 | 000,410,624 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\DRIVERS\xaudio64.exe -- (XAudioService)
SRV - [2008/07/27 14:03:13 | 000,069,632 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/01/29 13:09:58 | 000,165,416 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Gateway Games\Gateway Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2007/10/03 18:45:02 | 000,358,936 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON)
SRV - [2007/07/27 13:49:46 | 000,119,296 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Program Files (x86)\IDT\WDM\stacsv64.exe -- (STacSV)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2009/05/18 13:17:08 | 000,034,152 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2008/01/25 21:46:52 | 000,150,016 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys -- (RTL8169)
DRV:64bit: - [2008/01/20 22:51:07 | 000,016,384 | ---- | M] () [Recognizer | System | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2008/01/20 22:47:28 | 000,046,080 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb)
DRV:64bit: - [2008/01/20 22:47:27 | 000,214,016 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2008/01/20 22:46:57 | 000,286,720 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\VSTAZL6.SYS -- (HSFHWAZL)
DRV:64bit: - [2008/01/20 22:46:55 | 000,111,104 | ---- | M] () [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\DRIVERS\sdbus.sys -- (sdbus)
DRV:64bit: - [2008/01/03 23:57:26 | 000,062,464 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RTSTOR64.SYS -- (RTSTOR)
DRV:64bit: - [2008/01/01 20:53:08 | 007,172,608 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\igdkmd64.sys -- (igfx)
DRV:64bit: - [2007/10/31 15:44:38 | 003,197,440 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\NETw4v64.sys -- (NETw4v64)
DRV:64bit: - [2007/09/30 02:03:32 | 000,384,024 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\iaStor.sys -- (iaStor)
DRV:64bit: - [2007/07/27 13:50:24 | 000,391,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:64bit: - [2007/07/26 06:00:00 | 000,053,488 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2007/05/23 20:47:28 | 000,020,784 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\UVCFTR_S.SYS -- (UVCFTR)
DRV:64bit: - [2007/01/30 00:24:06 | 000,009,728 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\xaudio64.sys -- (XAudio)
DRV:64bit: - [2006/12/22 00:33:28 | 001,511,936 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\CAX_DPV.sys -- (HSF_DPV)
DRV:64bit: - [2006/12/22 00:30:50 | 000,300,032 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\CAXHWAZL.sys -- (CAXHWAZL)
DRV:64bit: - [2006/12/22 00:29:48 | 000,731,648 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\CAX_CNXT.sys -- (winachsf)
DRV:64bit: - [2006/11/17 18:22:06 | 000,297,272 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\SynTP.sys -- (SynTP)
DRV:64bit: - [2006/11/02 03:48:50 | 002,488,320 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\atikmdag.sys -- (R300)
DRV:64bit: - [2006/10/06 22:13:22 | 000,550,912 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\bcmwl664.sys -- (BCM43XV)
DRV:64bit: - [2006/06/19 02:27:24 | 000,017,024 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\mdmxsdk.sys -- (mdmxsdk)

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.c...ys=PTB&M=T-6836
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.c...ys=PTB&M=T-6836
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.c...ys=PTB&M=T-6836
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.c...ys=PTB&M=T-6836
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.sanriotow...dex.php?lang=us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {DDFA09EE-903F-4255-959C-08D4CF23F436}
IE - HKCU\..\SearchScopes\{DDFA09EE-903F-4255-959C-08D4CF23F436}: "URL" = http://www.google.co...ie7&rlz=1I7GWYE
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Program Files (x86)\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\3.0.40818.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@oberon-media.com/ONCAdapter: C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.7\npapicomadapter.dll File not found
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Users\Gwei\Program Files (x86)\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Users\Gwei\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll (Move Networks)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Gwei\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Gwei\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)



========== Chrome ==========

CHR - homepage: http://www.facebook.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: http://www.facebook.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Gwei\AppData\Local\Google\Chrome\Application\22.0.1229.79\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Gwei\AppData\Local\Google\Chrome\Application\22.0.1229.79\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Gwei\AppData\Local\Google\Chrome\Application\22.0.1229.79\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Gwei\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.230.5 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U23 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: DNA Plug-in (Enabled) = C:\Program Files (x86)\DNA\plugins\npbtdna.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Gwei\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Move Streaming Media Player (Enabled) = C:\Users\Gwei\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\3.0.40818.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: YouTube = C:\Users\Gwei\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\Gwei\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Candy = C:\Users\Gwei\AppData\Local\Google\Chrome\User Data\Default\Extensions\fiejadjmcgacmocgeegodfhligbpecdg\1.0\
CHR - Extension: Gmail = C:\Users\Gwei\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012/09/28 11:25:16 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Veoh Web Player Video Finder) - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll File not found
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe ()
O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (X86)\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe ()
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe ()
O4:64bit: - HKLM..\Run: [SigmatelSysTrayApp] C:\Windows\sttray64.exe (IDT, Inc.)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Camera Assistant Software] C:\Program Files\Camera Assistant Software for Gateway\traybar.exe (Chicony)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKCU..\Run: [AdobeUpdater] C:\Program Files (x86)\Common Files\Adobe\Updater5\AdobeUpdater.exe File not found
O4 - HKCU..\Run: [BitTorrent DNA] C:\Users\Gwei\Program Files (x86)\DNA\btdna.exe (BitTorrent, Inc.)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe ()
O4 - HKCU..\Run: [Sanriotown email alert] C:\Program Files (x86)\Sanriotown\E-mail Alert\MAClient -auto File not found
O4 - HKLM..\RunOnce: [Launcher] C:\Windows\SMINST\Launcher.exe (soft thinks)
O4 - Startup: C:\Users\Gwei\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: real.com ([rhap-app-4-0] https in Trusted sites)
O15 - HKCU\..Trusted Domains: real.com ([rhapreg] https in Trusted sites)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_23)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A8B10F2C-1906-4432-BCE6-D5DCA0184B3C}: DhcpNameServer = 192.168.1.254
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe ()
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll ()
O24 - Desktop WallPaper: C:\Users\Gwei\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Gwei\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/04/30 20:01:00 | 000,000,053 | -HS- | M] () - D:\Autorun.inf -- [ NTFS ]
O33 - MountPoints2\{5e6049a7-8484-11dd-a815-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{5e6049a7-8484-11dd-a815-806e6f6e6963}\Shell\AutoRun\command - "" = F:\sansa-installer.exe
O33 - MountPoints2\{af0e424e-ade2-11dd-bb53-0003254c051a}\Shell\AutoRun\command - "" = E:\setupSNK.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/09/28 13:37:33 | 004,757,745 | ---- | C] (Swearware) -- C:\Users\Gwei\Desktop\ComboFix.exe
[2012/09/28 11:22:20 | 000,000,000 | ---D | C] -- C:\_OTL
[2012/09/28 08:51:04 | 000,000,000 | -HSD | C] -- C:\found.004
[2012/09/28 08:30:16 | 000,000,000 | ---D | C] -- C:\Users\Gwei\AppData\Roaming\hellomoto
[2012/09/03 19:06:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2012/09/03 19:05:27 | 000,000,000 | ---D | C] -- C:\Users\Gwei\AppData\Roaming\vlc

========== Files - Modified Within 30 Days ==========

[2012/09/28 13:37:33 | 004,757,745 | ---- | M] (Swearware) -- C:\Users\Gwei\Desktop\ComboFix.exe
[2012/09/28 13:32:53 | 000,003,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/09/28 13:32:53 | 000,003,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/09/28 13:32:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/09/28 13:32:39 | 4284,932,096 | -HS- | M] () -- C:\hiberfil.sys
[2012/09/28 12:47:00 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1935358621-21101508-4254277831-1000UA.job
[2012/09/28 08:57:09 | 000,005,972 | ---- | M] () -- C:\Users\Gwei\AppData\Local\d3d9caps.dat
[2012/09/23 18:47:00 | 000,000,852 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1935358621-21101508-4254277831-1000Core.job
[2012/09/13 08:39:56 | 000,209,920 | ---- | M] () -- C:\Users\Gwei\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/09/12 08:13:09 | 001,047,247 | ---- | M] () -- C:\Users\Gwei\Documents\huggy kitty.gif
[2012/09/07 00:44:41 | 000,039,748 | ---- | M] () -- C:\Users\Gwei\.recently-used.xbel
[2012/09/05 15:53:44 | 000,011,527 | ---- | M] () -- C:\Users\Gwei\Documents\Perfect Foods Meals.odt
[2012/09/03 20:36:10 | 001,096,642 | ---- | M] () -- C:\Users\Gwei\Documents\IMG_0011.jpg
[2012/09/03 19:10:43 | 000,001,794 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012/09/01 08:27:30 | 000,093,855 | ---- | M] () -- C:\Users\Gwei\Documents\megabus 4.JPG
[2012/09/01 08:27:10 | 000,093,888 | ---- | M] () -- C:\Users\Gwei\Documents\megabus 3.JPG
[2012/09/01 08:26:42 | 000,115,279 | ---- | M] () -- C:\Users\Gwei\Documents\megabus 2.JPG
[2012/09/01 08:26:11 | 000,092,187 | ---- | M] () -- C:\Users\Gwei\Documents\megabus 1.JPG
[2012/09/01 06:44:21 | 000,002,010 | ---- | M] () -- C:\Users\Gwei\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

========== Files Created - No Company Name ==========

[2012/09/12 08:13:09 | 001,047,247 | ---- | C] () -- C:\Users\Gwei\Documents\huggy kitty.gif
[2012/09/07 00:44:41 | 000,039,748 | ---- | C] () -- C:\Users\Gwei\.recently-used.xbel
[2012/09/05 15:53:43 | 000,011,527 | ---- | C] () -- C:\Users\Gwei\Documents\Perfect Foods Meals.odt
[2012/09/03 20:36:10 | 001,096,642 | ---- | C] () -- C:\Users\Gwei\Documents\IMG_0011.jpg
[2012/09/03 19:06:58 | 000,001,794 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012/09/01 08:27:28 | 000,093,855 | ---- | C] () -- C:\Users\Gwei\Documents\megabus 4.JPG
[2012/09/01 08:27:08 | 000,093,888 | ---- | C] () -- C:\Users\Gwei\Documents\megabus 3.JPG
[2012/09/01 08:26:40 | 000,115,279 | ---- | C] () -- C:\Users\Gwei\Documents\megabus 2.JPG
[2012/09/01 08:26:09 | 000,092,187 | ---- | C] () -- C:\Users\Gwei\Documents\megabus 1.JPG
[2012/06/25 12:19:53 | 022,444,502 | ---- | C] () -- C:\Users\Gwei\TheVelveteenRabbit-noisereduction.mp3
[2012/06/25 11:40:39 | 022,418,560 | ---- | C] () -- C:\Users\Gwei\VelveteenRabbit.mp3
[2012/06/25 11:38:33 | 000,081,580 | ---- | C] () -- C:\Users\Gwei\Rabbitaudacity.aup
[2012/06/22 13:28:22 | 003,581,519 | ---- | C] () -- C:\Users\Gwei\bloodyjack.mp3
[2010/03/16 01:16:45 | 000,000,745 | ---- | C] () -- C:\Users\Gwei\AppData\Roaming\AtomicAlarmClock.ini
[2009/05/13 01:57:59 | 000,005,972 | ---- | C] () -- C:\Users\Gwei\AppData\Local\d3d9caps.dat
[2008/09/17 04:18:19 | 000,209,920 | ---- | C] () -- C:\Users\Gwei\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2006/11/02 11:30:40 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2008/11/06 09:32:58 | 012,897,792 | ---- | M] ()
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2008/11/06 09:14:25 | 011,580,928 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/03/03 00:53:36 | 000,891,392 | ---- | M] ()
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/03/03 00:36:24 | 000,615,424 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2008/01/20 22:50:58 | 000,513,024 | ---- | M] ()
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2012/07/31 13:46:58 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\Audacity
[2009/12/18 01:53:15 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\BitTorrent
[2012/09/28 13:43:22 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\DNA
[2012/09/07 00:44:41 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\gtk-2.0
[2012/09/28 08:30:23 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\hellomoto
[2011/03/16 06:59:11 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\Oberon Media
[2012/09/28 09:17:54 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\Octoshape
[2011/11/28 02:59:30 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\OpenOffice.org
[2010/08/29 01:08:06 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\Opera
[2012/01/15 08:03:39 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\OverDrive
[2011/03/16 07:00:01 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\Pogo
[2010/06/21 17:26:00 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\SecondLife
[2009/10/04 02:28:05 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\WildTangent

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 64 bytes -> C:\Users\Gwei\Documents\[TV] arashi ni shiyagare 20111015 - kame part (11m)(1280x720)(KAL)..avi:TOC.WMV
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:F3AB0B43

< End of report >








C:\ComboFix.txt



ComboFix 12-09-27.03 - Gwei 09/28/2012 13:54:40.1.2 - x64
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.4086.2346 [GMT -4:00]
Running from: c:\users\Gwei\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Gwei\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scandisk.lnk
c:\windows\Tasks\lfyjdcrg.job
D:\Autorun.inf
.
c:\windows\SysWow64\user32.dll . . . is infected!!
.
.
((((((((((((((((((((((((( Files Created from 2012-08-28 to 2012-09-28 )))))))))))))))))))))))))))))))
.
.
2012-09-28 18:37 . 2012-09-28 18:37 -------- d-----w- c:\users\Gwei\AppData\Local\temp
2012-09-28 18:37 . 2012-09-28 18:37 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-09-28 15:22 . 2012-09-28 15:22 -------- d-----w- C:\_OTL
2012-09-28 13:17 . 2012-08-23 08:26 9310152 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{178152B4-9048-4E02-81E5-912F72681CD1}\mpengine.dll
2012-09-28 12:51 . 2012-09-28 12:51 -------- d-----w- C:\found.004
2012-09-28 12:30 . 2012-09-28 12:30 -------- d-----w- c:\users\Gwei\AppData\Roaming\hellomoto
2012-09-03 23:05 . 2012-09-25 16:14 -------- d-----w- c:\users\Gwei\AppData\Roaming\vlc
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sanriotown email alert"="c:\program files (x86)\Sanriotown\E-mail Alert\MAClient -auto" [X]
"BitTorrent DNA"="c:\users\Gwei\Program Files (x86)\DNA\btdna.exe" [2009-11-06 323392]
"Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2010-09-22 2969496]
"Messenger (Yahoo!)"="c:\program files (x86)\Yahoo!\Messenger\YahooMessenger.exe" [2010-03-03 5244216]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Gateway\traybar.exe" [2007-09-13 638976]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Malwarebytes Anti-Malware (reboot)"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-09-24 421160]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2008-01-19 40072]
.
c:\users\Gwei\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BigFix.lnk - c:\program files\BigFix\bigfix.exe [2008-9-17 2342912]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Themes
.
Contents of the 'Scheduled Tasks' folder
.
2012-09-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1935358621-21101508-4254277831-1000Core.job
- c:\users\Gwei\AppData\Local\Google\Update\GoogleUpdate.exe [2010-05-22 20:28]
.
2012-09-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1935358621-21101508-4254277831-1000UA.job
- c:\users\Gwei\AppData\Local\Google\Update\GoogleUpdate.exe [2010-05-22 20:28]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-02 137240]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-02 202264]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-02 165400]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712]
"SigmatelSysTrayApp"="sttray64.exe" [2007-07-27 425984]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-17 963584]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.sanriotown.com/main/index.php?lang=us
mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=BB&Br=GTW&Loc=ENG_US&Sys=PTB&M=T-6836
mDefault_Page_URL = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=BB&Br=GTW&Loc=ENG_US&Sys=PTB&M=T-6836
mLocal Page = %SystemRoot%\system32\blank.htm
uInternet Settings,ProxyOverride = *.local
mSearchAssistant = hxxp://www.gateway.com/g/sidepanel.html?Ch=Retail&SubCH=BB&Br=GTW&Loc=ENG_US&Sys=PTB&M=T-6836
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: real.com\rhap-app-4-0
Trusted Zone: real.com\rhapreg
TCP: DhcpNameServer = 192.168.1.254
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*c*i*r*c*l*Ü#d\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*c*o*u*p*o*n*i*n*Æ„Ù?\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*D*i*x*i*¶¶N\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*D*i*x*i*U�ÙF\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*D*i*x*i*š.+\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*H*D*T*^:.\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*M*e*n*t*a*l*i*s*wiu\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*M*e*n*t*a*l*i*s*–›K@\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*0*1*E*0*7*+…|\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*0*1*E*0*7*å²¢U\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*0*1*E*0*7*éò[\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\. S 0 1
1A\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*0*1*Më@y\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*g
V*]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*g
V*\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*ý
V*]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*ý
V*\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*’ÁRg]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*’ÁRg\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*T*h*e*_*C*o*m*i*n*g*?�*\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*U*S*Š+·B\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*W*i*f*‘±8\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*W*i*f*¤iu\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*W*i*f*Îiu\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*W*i*f*8¶N\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*W*i*f*É>@Z\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*W*i*f*iœ¤S\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*W*i*f*®®±`\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*­!…|]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*­!…|\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*¤:­t]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*¤:­t\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*ïl¥|]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*ïl¥|\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*¤y;~]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*¤y;~\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*Úz$XC*€Š*]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*Úz$XC*€Š*\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*œ.+]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*œ.+\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*ýÁRg]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*ýÁRg\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*S*g
V*]
"0"=hex:54,00,65,00,72,00,72,00,61,00,2e,00,4e,00,6f,00,76,00,61,00,2e,00,53,
00,67,01,56,2a,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,54,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*S*ý
V*]
"0"=hex:54,00,65,00,72,00,72,00,61,00,2e,00,4e,00,6f,00,76,00,61,00,2e,00,53,
00,fd,01,56,2a,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,54,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*S*’ÁRg]
"0"=hex:54,00,65,00,72,00,72,00,61,00,2e,00,4e,00,6f,00,76,00,61,00,2e,00,53,
00,92,c1,52,67,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,54,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*­!…|]
"0"=hex:4d,00,65,00,72,00,6c,00,69,00,6e,00,2e,00,32,00,30,00,30,00,38,00,2e,
00,ad,21,85,7c,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,4d,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*¤:­t]
"0"=hex:4d,00,65,00,72,00,6c,00,69,00,6e,00,2e,00,32,00,30,00,30,00,38,00,2e,
00,a4,3a,ad,74,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,4d,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*ïl¥|]
"0"=hex:4d,00,65,00,72,00,6c,00,69,00,6e,00,2e,00,32,00,30,00,30,00,38,00,2e,
00,ef,6c,a5,7c,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,4d,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*¤y;~]
"0"=hex:6d,00,65,00,72,00,6c,00,69,00,6e,00,2e,00,32,00,30,00,30,00,38,00,2e,
00,a4,79,3b,7e,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,6d,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*Úz$XC*€Š*]
"0"=hex:4d,00,65,00,72,00,6c,00,69,00,6e,00,2e,00,32,00,30,00,30,00,38,00,2e,
00,da,7a,24,7f,58,43,00,80,8a,00,00,00,8e,00,36,00,00,00,00,00,00,00,00,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*œ.+]
"0"=hex:4d,00,65,00,72,00,6c,00,69,00,6e,00,2e,00,32,00,30,00,30,00,38,00,2e,
00,04,9c,2e,2b,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,4d,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*ýÁRg]
"0"=hex:4d,00,65,00,72,00,6c,00,69,00,6e,00,2e,00,32,00,30,00,30,00,38,00,2e,
00,fd,c1,52,67,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,4d,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10b.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10b.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil9e.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil9e.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}]
@Denied: (A 2) (Everyone)
@="IFlashBroker"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]
@Denied: (A 2) (Everyone)
@="IFlashBroker2"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2012-09-28 14:39:51
ComboFix-quarantined-files.txt 2012-09-28 18:39
.
Pre-Run: 25,976,184,832 bytes free
Post-Run: 26,190,950,400 bytes free
.
- - End Of File - - 9054CC16CA34D79F321B729F1E59CC39





Combofix log




ComboFix 12-09-27.03 - Gwei 09/28/2012 13:54:40.1.2 - x64
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.4086.2346 [GMT -4:00]
Running from: c:\users\Gwei\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Gwei\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scandisk.lnk
c:\windows\Tasks\lfyjdcrg.job
D:\Autorun.inf
.
c:\windows\SysWow64\user32.dll . . . is infected!!
.
.
((((((((((((((((((((((((( Files Created from 2012-08-28 to 2012-09-28 )))))))))))))))))))))))))))))))
.
.
2012-09-28 18:37 . 2012-09-28 18:37 -------- d-----w- c:\users\Gwei\AppData\Local\temp
2012-09-28 18:37 . 2012-09-28 18:37 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-09-28 15:22 . 2012-09-28 15:22 -------- d-----w- C:\_OTL
2012-09-28 13:17 . 2012-08-23 08:26 9310152 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{178152B4-9048-4E02-81E5-912F72681CD1}\mpengine.dll
2012-09-28 12:51 . 2012-09-28 12:51 -------- d-----w- C:\found.004
2012-09-28 12:30 . 2012-09-28 12:30 -------- d-----w- c:\users\Gwei\AppData\Roaming\hellomoto
2012-09-03 23:05 . 2012-09-25 16:14 -------- d-----w- c:\users\Gwei\AppData\Roaming\vlc
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sanriotown email alert"="c:\program files (x86)\Sanriotown\E-mail Alert\MAClient -auto" [X]
"BitTorrent DNA"="c:\users\Gwei\Program Files (x86)\DNA\btdna.exe" [2009-11-06 323392]
"Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2010-09-22 2969496]
"Messenger (Yahoo!)"="c:\program files (x86)\Yahoo!\Messenger\YahooMessenger.exe" [2010-03-03 5244216]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Gateway\traybar.exe" [2007-09-13 638976]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Malwarebytes Anti-Malware (reboot)"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-09-24 421160]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2008-01-19 40072]
.
c:\users\Gwei\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BigFix.lnk - c:\program files\BigFix\bigfix.exe [2008-9-17 2342912]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Themes
.
Contents of the 'Scheduled Tasks' folder
.
2012-09-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1935358621-21101508-4254277831-1000Core.job
- c:\users\Gwei\AppData\Local\Google\Update\GoogleUpdate.exe [2010-05-22 20:28]
.
2012-09-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1935358621-21101508-4254277831-1000UA.job
- c:\users\Gwei\AppData\Local\Google\Update\GoogleUpdate.exe [2010-05-22 20:28]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-02 137240]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-02 202264]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-02 165400]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712]
"SigmatelSysTrayApp"="sttray64.exe" [2007-07-27 425984]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-17 963584]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.sanriotown.com/main/index.php?lang=us
mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=BB&Br=GTW&Loc=ENG_US&Sys=PTB&M=T-6836
mDefault_Page_URL = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=BB&Br=GTW&Loc=ENG_US&Sys=PTB&M=T-6836
mLocal Page = %SystemRoot%\system32\blank.htm
uInternet Settings,ProxyOverride = *.local
mSearchAssistant = hxxp://www.gateway.com/g/sidepanel.html?Ch=Retail&SubCH=BB&Br=GTW&Loc=ENG_US&Sys=PTB&M=T-6836
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: real.com\rhap-app-4-0
Trusted Zone: real.com\rhapreg
TCP: DhcpNameServer = 192.168.1.254
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*c*i*r*c*l*Ü#d\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*c*o*u*p*o*n*i*n*Æ„Ù?\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*D*i*x*i*¶¶N\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*D*i*x*i*U�ÙF\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*D*i*x*i*š.+\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*H*D*T*^:.\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*M*e*n*t*a*l*i*s*wiu\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*M*e*n*t*a*l*i*s*–›K@\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*0*1*E*0*7*+…|\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*0*1*E*0*7*å²¢U\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*0*1*E*0*7*éò[\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\. S 0 1
1A\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*0*1*Më@y\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*g
V*]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*g
V*\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*ý
V*]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*ý
V*\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*’ÁRg]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*’ÁRg\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*T*h*e*_*C*o*m*i*n*g*?�*\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*U*S*Š+·B\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*W*i*f*‘±8\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*W*i*f*¤iu\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*W*i*f*Îiu\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*W*i*f*8¶N\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*W*i*f*É>@Z\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*W*i*f*iœ¤S\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*W*i*f*®®±`\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*­!…|]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*­!…|\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*¤:­t]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*¤:­t\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*ïl¥|]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*ïl¥|\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*¤y;~]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*¤y;~\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*Úz$XC*€Š*]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*Úz$XC*€Š*\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*œ.+]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*œ.+\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*ýÁRg]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*ýÁRg\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*S*g
V*]
"0"=hex:54,00,65,00,72,00,72,00,61,00,2e,00,4e,00,6f,00,76,00,61,00,2e,00,53,
00,67,01,56,2a,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,54,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*S*ý
V*]
"0"=hex:54,00,65,00,72,00,72,00,61,00,2e,00,4e,00,6f,00,76,00,61,00,2e,00,53,
00,fd,01,56,2a,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,54,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*S*’ÁRg]
"0"=hex:54,00,65,00,72,00,72,00,61,00,2e,00,4e,00,6f,00,76,00,61,00,2e,00,53,
00,92,c1,52,67,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,54,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*­!…|]
"0"=hex:4d,00,65,00,72,00,6c,00,69,00,6e,00,2e,00,32,00,30,00,30,00,38,00,2e,
00,ad,21,85,7c,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,4d,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*¤:­t]
"0"=hex:4d,00,65,00,72,00,6c,00,69,00,6e,00,2e,00,32,00,30,00,30,00,38,00,2e,
00,a4,3a,ad,74,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,4d,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*ïl¥|]
"0"=hex:4d,00,65,00,72,00,6c,00,69,00,6e,00,2e,00,32,00,30,00,30,00,38,00,2e,
00,ef,6c,a5,7c,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,4d,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*¤y;~]
"0"=hex:6d,00,65,00,72,00,6c,00,69,00,6e,00,2e,00,32,00,30,00,30,00,38,00,2e,
00,a4,79,3b,7e,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,6d,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*Úz$XC*€Š*]
"0"=hex:4d,00,65,00,72,00,6c,00,69,00,6e,00,2e,00,32,00,30,00,30,00,38,00,2e,
00,da,7a,24,7f,58,43,00,80,8a,00,00,00,8e,00,36,00,00,00,00,00,00,00,00,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*œ.+]
"0"=hex:4d,00,65,00,72,00,6c,00,69,00,6e,00,2e,00,32,00,30,00,30,00,38,00,2e,
00,04,9c,2e,2b,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,4d,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*ýÁRg]
"0"=hex:4d,00,65,00,72,00,6c,00,69,00,6e,00,2e,00,32,00,30,00,30,00,38,00,2e,
00,fd,c1,52,67,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,4d,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10b.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10b.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil9e.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil9e.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}]
@Denied: (A 2) (Everyone)
@="IFlashBroker"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]
@Denied: (A 2) (Everyone)
@="IFlashBroker2"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2012-09-28 14:39:51
ComboFix-quarantined-files.txt 2012-09-28 18:39
.
Pre-Run: 25,976,184,832 bytes free
Post-Run: 26,190,950,400 bytes free
.
- - End Of File - - 9054CC16CA34D79F321B729F1E59CC39

[Essexboy]

OK we need to find a replacement system file
Please run an OTL scan with the following script :

[list][*]Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

[*]Select All Users
[*]Under the Custom Scan box paste this in
netsvcs
BASESERVICES
%SYSTEMDRIVE%\*.exe
/md5start
user32.*
/md5stop
CREATERESTOREPOINT
[*]Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

[cherinacherine]

I ran the scan, here's the log:


OTL logfile created on: 9/29/2012 4:39:26 AM - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Gwei\Downloads\Antivirus
64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.99 Gb Total Physical Memory | 2.09 Gb Available Physical Memory | 52.39% Memory free
8.17 Gb Paging File | 6.56 Gb Available in Paging File | 80.30% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 217.16 Gb Total Space | 24.45 Gb Free Space | 11.26% Space Free | Partition Type: NTFS
Drive D: | 15.72 Gb Total Space | 8.03 Gb Free Space | 51.07% Space Free | Partition Type: NTFS

Computer Name: GWEI-PC | User Name: Gwei | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/09/28 10:50:52 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Gwei\Downloads\Antivirus\OTL.exe
PRC - [2011/01/17 19:37:40 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
PRC - [2011/01/17 19:37:40 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
PRC - [2007/10/03 18:45:02 | 000,358,936 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2007/10/03 18:44:58 | 000,178,712 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2007/09/27 19:27:02 | 004,839,936 | ---- | M] () -- C:\Program Files\Camera Assistant Software for Gateway\CEC_MAIN.exe


========== Modules (No Company Name) ==========

MOD - [2011/11/28 02:57:16 | 000,985,088 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
MOD - [2010/08/10 00:01:06 | 000,067,872 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2010/03/03 13:32:22 | 000,929,792 | ---- | M] () -- C:\Program Files (x86)\Yahoo!\Messenger\yui.dll
MOD - [2007/09/27 19:27:02 | 004,839,936 | ---- | M] () -- C:\Program Files\Camera Assistant Software for Gateway\CEC_MAIN.exe


========== Services (SafeList) ==========

SRV:64bit: - [2008/01/20 22:47:32 | 000,383,544 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2007/01/30 00:24:38 | 000,410,624 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\DRIVERS\xaudio64.exe -- (XAudioService)
SRV - [2008/07/27 14:03:13 | 000,069,632 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/01/29 13:09:58 | 000,165,416 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Gateway Games\Gateway Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2007/10/03 18:45:02 | 000,358,936 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON)
SRV - [2007/07/27 13:49:46 | 000,119,296 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Program Files (x86)\IDT\WDM\stacsv64.exe -- (STacSV)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2009/05/18 13:17:08 | 000,034,152 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2008/01/25 21:46:52 | 000,150,016 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys -- (RTL8169)
DRV:64bit: - [2008/01/20 22:51:07 | 000,016,384 | ---- | M] () [Recognizer | System | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2008/01/20 22:47:28 | 000,046,080 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb)
DRV:64bit: - [2008/01/20 22:47:27 | 000,214,016 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2008/01/20 22:46:57 | 000,286,720 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\VSTAZL6.SYS -- (HSFHWAZL)
DRV:64bit: - [2008/01/20 22:46:55 | 000,111,104 | ---- | M] () [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\DRIVERS\sdbus.sys -- (sdbus)
DRV:64bit: - [2008/01/03 23:57:26 | 000,062,464 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RTSTOR64.SYS -- (RTSTOR)
DRV:64bit: - [2008/01/01 20:53:08 | 007,172,608 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\igdkmd64.sys -- (igfx)
DRV:64bit: - [2007/10/31 15:44:38 | 003,197,440 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\NETw4v64.sys -- (NETw4v64)
DRV:64bit: - [2007/09/30 02:03:32 | 000,384,024 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\iaStor.sys -- (iaStor)
DRV:64bit: - [2007/07/27 13:50:24 | 000,391,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:64bit: - [2007/07/26 06:00:00 | 000,053,488 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2007/05/23 20:47:28 | 000,020,784 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\UVCFTR_S.SYS -- (UVCFTR)
DRV:64bit: - [2007/01/30 00:24:06 | 000,009,728 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\xaudio64.sys -- (XAudio)
DRV:64bit: - [2006/12/22 00:33:28 | 001,511,936 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\CAX_DPV.sys -- (HSF_DPV)
DRV:64bit: - [2006/12/22 00:30:50 | 000,300,032 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\CAXHWAZL.sys -- (CAXHWAZL)
DRV:64bit: - [2006/12/22 00:29:48 | 000,731,648 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\CAX_CNXT.sys -- (winachsf)
DRV:64bit: - [2006/11/17 18:22:06 | 000,297,272 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\SynTP.sys -- (SynTP)
DRV:64bit: - [2006/11/02 03:48:50 | 002,488,320 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\atikmdag.sys -- (R300)
DRV:64bit: - [2006/10/06 22:13:22 | 000,550,912 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\bcmwl664.sys -- (BCM43XV)
DRV:64bit: - [2006/06/19 02:27:24 | 000,017,024 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\mdmxsdk.sys -- (mdmxsdk)

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.c...ys=PTB&M=T-6836
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.c...ys=PTB&M=T-6836
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.c...ys=PTB&M=T-6836
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_page_URL = http://www.gateway.c...ys=PTB&M=T-6836
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_page_URL = http://www.gateway.c...ys=PTB&M=T-6836
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1935358621-21101508-4254277831-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-1935358621-21101508-4254277831-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.sanriotow...dex.php?lang=us
IE - HKU\S-1-5-21-1935358621-21101508-4254277831-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1935358621-21101508-4254277831-1000\..\SearchScopes,DefaultScope = {DDFA09EE-903F-4255-959C-08D4CF23F436}
IE - HKU\S-1-5-21-1935358621-21101508-4254277831-1000\..\SearchScopes\{DDFA09EE-903F-4255-959C-08D4CF23F436}: "URL" = http://www.google.co...ie7&rlz=1I7GWYE
IE - HKU\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Program Files (x86)\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\3.0.40818.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@oberon-media.com/ONCAdapter: C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.7\npapicomadapter.dll File not found
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Users\Gwei\Program Files (x86)\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Users\Gwei\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll (Move Networks)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Gwei\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Gwei\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)



========== Chrome ==========

CHR - homepage: http://www.facebook.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: http://www.facebook.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Gwei\AppData\Local\Google\Chrome\Application\22.0.1229.79\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Gwei\AppData\Local\Google\Chrome\Application\22.0.1229.79\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Gwei\AppData\Local\Google\Chrome\Application\22.0.1229.79\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Gwei\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.230.5 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U23 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: DNA Plug-in (Enabled) = C:\Program Files (x86)\DNA\plugins\npbtdna.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Gwei\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Move Streaming Media Player (Enabled) = C:\Users\Gwei\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\3.0.40818.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: YouTube = C:\Users\Gwei\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Users\Gwei\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Candy = C:\Users\Gwei\AppData\Local\Google\Chrome\User Data\Default\Extensions\fiejadjmcgacmocgeegodfhligbpecdg\1.0\
CHR - Extension: Gmail = C:\Users\Gwei\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012/09/28 14:37:34 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Veoh Web Player Video Finder) - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll File not found
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe ()
O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (X86)\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe ()
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe ()
O4:64bit: - HKLM..\Run: [SigmatelSysTrayApp] C:\Windows\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: [Camera Assistant Software] C:\Program Files\Camera Assistant Software for Gateway\traybar.exe (Chicony)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-21-1935358621-21101508-4254277831-1000..\Run: [BitTorrent DNA] C:\Users\Gwei\Program Files (x86)\DNA\btdna.exe (BitTorrent, Inc.)
O4 - HKU\S-1-5-21-1935358621-21101508-4254277831-1000..\Run: [Messenger (Yahoo!)] C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKU\S-1-5-21-1935358621-21101508-4254277831-1000..\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe ()
O4 - HKU\S-1-5-21-1935358621-21101508-4254277831-1000..\Run: [Sanriotown email alert] C:\Program Files (x86)\Sanriotown\E-mail Alert\MAClient -auto File not found
O4 - HKLM..\RunOnce: [Launcher] C:\Windows\SMINST\Launcher.exe (soft thinks)
O4 - Startup: C:\Users\Gwei\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1935358621-21101508-4254277831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-1935358621-21101508-4254277831-1000\..Trusted Domains: real.com ([rhap-app-4-0] https in Trusted sites)
O15 - HKU\S-1-5-21-1935358621-21101508-4254277831-1000\..Trusted Domains: real.com ([rhapreg] https in Trusted sites)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_23)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A8B10F2C-1906-4432-BCE6-D5DCA0184B3C}: DhcpNameServer = 192.168.1.254
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe ()
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll ()
O24 - Desktop WallPaper: C:\Users\Gwei\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Gwei\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)


CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/09/28 14:39:53 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012/09/28 14:39:53 | 000,000,000 | ---D | C] -- C:\Users\Gwei\AppData\Local\temp
[2012/09/28 13:51:13 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/09/28 13:51:13 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/09/28 13:51:13 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/09/28 13:51:10 | 000,000,000 | ---D | C] -- C:\ComboFix
[2012/09/28 13:51:07 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/09/28 13:37:33 | 004,757,745 | R--- | C] (Swearware) -- C:\Users\Gwei\Desktop\ComboFix.exe
[2012/09/28 11:22:20 | 000,000,000 | ---D | C] -- C:\_OTL
[2012/09/28 08:51:04 | 000,000,000 | ---D | C] -- C:\found.004
[2012/09/28 08:30:16 | 000,000,000 | ---D | C] -- C:\Users\Gwei\AppData\Roaming\hellomoto
[2012/09/03 19:06:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2012/09/03 19:05:27 | 000,000,000 | ---D | C] -- C:\Users\Gwei\AppData\Roaming\vlc

========== Files - Modified Within 30 Days ==========

[2012/09/29 04:36:00 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/09/28 14:47:01 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1935358621-21101508-4254277831-1000UA.job
[2012/09/28 14:37:34 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012/09/28 13:37:33 | 004,757,745 | R--- | M] (Swearware) -- C:\Users\Gwei\Desktop\ComboFix.exe
[2012/09/28 13:32:53 | 000,003,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/09/28 13:32:53 | 000,003,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/09/28 13:32:39 | 4284,932,096 | -HS- | M] () -- C:\hiberfil.sys
[2012/09/28 08:57:09 | 000,005,972 | ---- | M] () -- C:\Users\Gwei\AppData\Local\d3d9caps.dat
[2012/09/23 18:47:00 | 000,000,852 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1935358621-21101508-4254277831-1000Core.job
[2012/09/13 08:39:56 | 000,209,920 | ---- | M] () -- C:\Users\Gwei\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/09/12 08:13:09 | 001,047,247 | ---- | M] () -- C:\Users\Gwei\Documents\huggy kitty.gif
[2012/09/07 00:44:41 | 000,039,748 | ---- | M] () -- C:\Users\Gwei\.recently-used.xbel
[2012/09/05 15:53:44 | 000,011,527 | ---- | M] () -- C:\Users\Gwei\Documents\Perfect Foods Meals.odt
[2012/09/03 20:36:10 | 001,096,642 | ---- | M] () -- C:\Users\Gwei\Documents\IMG_0011.jpg
[2012/09/03 19:10:43 | 000,001,794 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012/09/01 08:27:30 | 000,093,855 | ---- | M] () -- C:\Users\Gwei\Documents\megabus 4.JPG
[2012/09/01 08:27:10 | 000,093,888 | ---- | M] () -- C:\Users\Gwei\Documents\megabus 3.JPG
[2012/09/01 08:26:42 | 000,115,279 | ---- | M] () -- C:\Users\Gwei\Documents\megabus 2.JPG
[2012/09/01 08:26:11 | 000,092,187 | ---- | M] () -- C:\Users\Gwei\Documents\megabus 1.JPG
[2012/09/01 06:44:21 | 000,002,010 | ---- | M] () -- C:\Users\Gwei\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

========== Files Created - No Company Name ==========

[2012/09/28 13:51:13 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/09/28 13:51:13 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/09/28 13:51:13 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/09/28 13:51:13 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/09/28 13:51:13 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/09/12 08:13:09 | 001,047,247 | ---- | C] () -- C:\Users\Gwei\Documents\huggy kitty.gif
[2012/09/07 00:44:41 | 000,039,748 | ---- | C] () -- C:\Users\Gwei\.recently-used.xbel
[2012/09/05 15:53:43 | 000,011,527 | ---- | C] () -- C:\Users\Gwei\Documents\Perfect Foods Meals.odt
[2012/09/03 20:36:10 | 001,096,642 | ---- | C] () -- C:\Users\Gwei\Documents\IMG_0011.jpg
[2012/09/03 19:06:58 | 000,001,794 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012/09/01 08:27:28 | 000,093,855 | ---- | C] () -- C:\Users\Gwei\Documents\megabus 4.JPG
[2012/09/01 08:27:08 | 000,093,888 | ---- | C] () -- C:\Users\Gwei\Documents\megabus 3.JPG
[2012/09/01 08:26:40 | 000,115,279 | ---- | C] () -- C:\Users\Gwei\Documents\megabus 2.JPG
[2012/09/01 08:26:09 | 000,092,187 | ---- | C] () -- C:\Users\Gwei\Documents\megabus 1.JPG
[2012/06/25 12:19:53 | 022,444,502 | ---- | C] () -- C:\Users\Gwei\TheVelveteenRabbit-noisereduction.mp3
[2012/06/25 11:40:39 | 022,418,560 | ---- | C] () -- C:\Users\Gwei\VelveteenRabbit.mp3
[2012/06/25 11:38:33 | 000,081,580 | ---- | C] () -- C:\Users\Gwei\Rabbitaudacity.aup
[2012/06/22 13:28:22 | 003,581,519 | ---- | C] () -- C:\Users\Gwei\bloodyjack.mp3
[2010/03/16 01:16:45 | 000,000,745 | ---- | C] () -- C:\Users\Gwei\AppData\Roaming\AtomicAlarmClock.ini
[2009/05/13 01:57:59 | 000,005,972 | ---- | C] () -- C:\Users\Gwei\AppData\Local\d3d9caps.dat
[2008/09/17 04:18:19 | 000,209,920 | ---- | C] () -- C:\Users\Gwei\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== ZeroAccess Check ==========

[2006/11/02 11:30:40 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2008/11/06 09:32:58 | 012,897,792 | ---- | M] ()
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2008/11/06 09:14:25 | 011,580,928 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/03/03 00:53:36 | 000,891,392 | ---- | M] ()
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\SysWow64\wbem\fastprox.dll -- [2009/03/03 00:36:24 | 000,615,424 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2008/01/20 22:50:58 | 000,513,024 | ---- | M] ()
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\SysWow64\wbem\wbemess.dll

========== LOP Check ==========

[2012/07/31 13:46:58 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\Audacity
[2009/12/18 01:53:15 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\BitTorrent
[2012/09/28 13:43:22 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\DNA
[2012/09/07 00:44:41 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\gtk-2.0
[2012/09/28 08:30:23 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\hellomoto
[2011/03/16 06:59:11 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\Oberon Media
[2012/09/28 09:17:54 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\Octoshape
[2011/11/28 02:59:30 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\OpenOffice.org
[2010/08/29 01:08:06 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\Opera
[2012/01/15 08:03:39 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\OverDrive
[2011/03/16 07:00:01 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\Pogo
[2010/06/21 17:26:00 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\SecondLife
[2009/10/04 02:28:05 | 000,000,000 | ---D | M] -- C:\Users\Gwei\AppData\Roaming\WildTangent

========== Purity Check ==========



========== Custom Scans ==========

========== Base Services ==========
SRV:64bit: - [2006/11/02 07:16:28 | 000,026,624 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\aelupsvc.dll -- (AeLookupSvc)
SRV:64bit: - [2008/01/20 22:48:17 | 000,045,056 | ---- | M] () [On_Demand | Running] -- C:\Windows\SysNative\appinfo.dll -- (Appinfo)
SRV:64bit: - [2008/01/20 22:48:16 | 000,080,896 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysNative\alg.exe -- (ALG)
SRV:64bit: - [2008/01/20 22:50:12 | 001,082,368 | ---- | M] () [On_Demand | Running] -- C:\Windows\SysNative\qmgr.dll -- (BITS)
SRV:64bit: - [2008/01/20 22:50:48 | 000,458,240 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\bfe.dll -- (BFE)
SRV:64bit: - [2009/06/15 09:26:45 | 000,011,264 | ---- | M] () [On_Demand | Running] -- C:\Windows\SysNative\lsass.exe -- (KeyIso)
SRV:64bit: - [2008/04/18 00:42:44 | 000,361,984 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\es.dll -- (EventSystem)
SRV - [2008/04/18 01:48:39 | 000,269,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\es.dll -- (EventSystem)
SRV:64bit: - [2008/01/20 22:49:11 | 000,103,424 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysNative\browser.dll -- (Browser)
SRV:64bit: - [2008/01/20 22:49:08 | 000,165,376 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\cryptsvc.dll -- (CryptSvc)
SRV - [2008/01/20 22:49:56 | 000,128,000 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\cryptsvc.dll -- (CryptSvc)
SRV:64bit: - [2009/03/03 00:57:01 | 000,718,336 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\rpcss.dll -- (DcomLaunch)
SRV:64bit: - [2008/01/20 22:50:57 | 000,268,288 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\dhcpcsvc.dll -- (Dhcp)
SRV - [2008/01/20 22:48:40 | 000,204,288 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\dhcpcsvc.dll -- (Dhcp)
SRV:64bit: - [2008/01/20 22:48:49 | 000,117,760 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\dnsrslvr.dll -- (Dnscache)
SRV:64bit: - [2008/01/20 22:50:17 | 000,074,752 | ---- | M] () [On_Demand | Running] -- C:\Windows\SysNative\eapsvc.dll -- (EapHost)
SRV:64bit: - [2006/11/02 07:17:29 | 000,024,064 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysNative\hidserv.dll -- (hidserv)
SRV - [2006/11/02 05:46:05 | 000,025,600 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\hidserv.dll -- (hidserv)
SRV:64bit: - [2008/01/20 22:48:03 | 000,342,016 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysNative\ipnathlp.dll -- (SharedAccess)
SRV:64bit: - [2008/06/19 11:38:17 | 000,531,456 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\ipsecsvc.dll -- (PolicyAgent)
No service found with a name of MsMpSvc
No service found with a name of NisSrv
SRV:64bit: - [2008/01/20 22:48:39 | 000,480,768 | ---- | M] () [On_Demand | Running] -- C:\Windows\SysNative\swprv.dll -- (swprv)
SRV:64bit: - [2008/01/20 22:49:56 | 000,037,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\mmcss.dll -- (MMCSS)
SRV:64bit: - [2008/01/20 22:48:10 | 000,348,160 | ---- | M] () [On_Demand | Running] -- C:\Windows\SysNative\netman.dll -- (Netman)
SRV:64bit: - [2008/01/20 22:48:40 | 000,304,128 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\netprofm.dll -- (netprofm)
SRV - [2008/01/20 22:49:21 | 000,237,056 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\netprofm.dll -- (netprofm)
SRV:64bit: - [2008/01/20 22:50:27 | 000,206,336 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\nlasvc.dll -- (NlaSvc)
SRV:64bit: - [2008/01/20 22:49:42 | 000,024,576 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\nsisvc.dll -- (nsi)
SRV:64bit: - [2008/01/20 22:50:56 | 000,311,808 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\umpnpmgr.dll -- (PlugPlay)
SRV:64bit: - [2008/01/20 22:49:35 | 000,267,264 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\spoolsv.exe -- (Spooler)
SRV:64bit: - [2009/06/15 09:26:45 | 000,011,264 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysNative\lsass.exe -- (ProtectedStorage)
SRV:64bit: - [2008/06/25 23:56:13 | 000,399,872 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\emdmgmt.dll -- (EMDMgmt)
SRV:64bit: - [2008/01/20 22:48:24 | 000,098,304 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysNative\rasauto.dll -- (RasAuto)
SRV:64bit: - [2008/01/20 22:49:13 | 000,308,224 | ---- | M] () [On_Demand | Running] -- C:\Windows\SysNative\rasmans.dll -- (RasMan)
SRV:64bit: - [2009/03/03 00:57:01 | 000,718,336 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\rpcss.dll -- (RpcSs)
SRV:64bit: - [2008/01/20 22:49:09 | 000,028,672 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\seclogon.dll -- (seclogon)
SRV:64bit: - [2009/06/15 09:26:45 | 000,011,264 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\lsass.exe -- (SamSs)
SRV:64bit: - [2008/01/20 22:47:43 | 000,074,752 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\wscsvc.dll -- (wscsvc)
SRV:64bit: - [2008/01/20 22:50:01 | 000,176,640 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\srvsvc.dll -- (LanmanServer)
SRV:64bit: - [2008/01/20 22:50:39 | 000,301,568 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\shsvcs.dll -- (ShellHWDetection)
SRV - [2008/01/20 22:48:23 | 000,247,296 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\shsvcs.dll -- (ShellHWDetection)
SRV:64bit: - [2008/01/20 22:50:12 | 002,161,664 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\SLsvc.exe -- (slsvc)
SRV:64bit: - [2008/01/20 22:49:04 | 000,843,776 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\schedsvc.dll -- (Schedule)
SRV:64bit: - [2008/01/20 22:49:57 | 000,318,464 | ---- | M] () [On_Demand | Running] -- C:\Windows\SysNative\tapisrv.dll -- (TapiSrv)
SRV - [2008/01/20 22:50:56 | 000,242,688 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\tapisrv.dll -- (TapiSrv)
SRV:64bit: - [2008/01/20 22:50:39 | 000,301,568 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\shsvcs.dll -- (Themes)
SRV - [2008/01/20 22:48:23 | 000,247,296 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\shsvcs.dll -- (Themes)
SRV:64bit: - [2008/01/20 22:51:00 | 000,178,688 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\profsvc.dll -- (ProfSvc)
SRV:64bit: - [2008/01/20 22:50:36 | 001,432,576 | ---- | M] () [On_Demand | Running] -- C:\Windows\SysNative\vssvc.exe -- (VSS)
SRV:64bit: - [2008/01/20 22:49:57 | 000,444,928 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\Audiosrv.dll -- (AudioSrv)
SRV:64bit: - [2008/01/20 22:49:57 | 000,444,928 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\Audiosrv.dll -- (AudioEndpointBuilder)
SRV:64bit: - [2008/01/20 22:47:28 | 000,128,000 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysNative\SDRSVC.dll -- (SDRSVC)
SRV:64bit: - [2008/01/20 22:47:32 | 000,383,544 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2008/01/20 22:50:31 | 001,486,336 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\wevtsvc.dll -- (Eventlog)
SRV:64bit: - [2008/01/20 22:49:42 | 000,601,088 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\mpssvc.dll -- (MpsSvc)
SRV:64bit: - [2008/01/20 22:47:43 | 000,571,392 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\wiaservc.dll -- (stisvc)
SRV:64bit: - [2008/01/20 22:48:55 | 000,122,368 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysNative\msiexec.exe -- (msiserver)
SRV - [2008/01/20 22:49:45 | 000,071,680 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWow64\msiexec.exe -- (msiserver)
SRV:64bit: - [2008/01/20 22:50:11 | 000,221,696 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\wbem\WMIsvc.dll -- (Winmgmt)
SRV:64bit: - [2009/08/06 22:24:17 | 002,424,024 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\wuaueng.dll -- (wuauserv)
SRV:64bit: - [2008/01/20 22:48:38 | 000,208,384 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysNative\dot3svc.dll -- (dot3svc)
SRV:64bit: - [2009/07/11 15:50:02 | 000,615,936 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\wlansvc.dll -- (Wlansvc)
SRV:64bit: - [2009/06/10 08:25:10 | 000,202,752 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\wkssvc.dll -- (LanmanWorkstation)

< %SYSTEMDRIVE%\*.exe >

< MD5 for: USER32.AMX >
[2008/01/20 22:50:35 | 000,349,804 | ---- | M] () MD5=0B281BA13837FA70CC7DC73A91D0CEEC -- C:\Windows\winsxs\wow64_microsoft-windows-a..lity-infrastructure_31bf3856ad364e35_6.0.6001.18000_none_e14b7c57cdeb8a18\user32.amx
[2009/03/16 21:32:36 | 000,310,510 | ---- | M] () MD5=0C501E9A59F1BB7CBE45E50EC8A6B7E0 -- C:\Windows\SysNative\manifeststore\user32.amx
[2009/03/16 21:32:36 | 000,310,510 | ---- | M] () MD5=0C501E9A59F1BB7CBE45E50EC8A6B7E0 -- C:\Windows\winsxs\amd64_microsoft-windows-a..lity-infrastructure_31bf3856ad364e35_6.0.6001.18230_none_d6d6660d99a3163e\user32.amx
[2009/03/16 20:55:34 | 000,350,528 | ---- | M] () MD5=0C89DCBF33A2A9D7F74E0C795D203D08 -- C:\Windows\winsxs\wow64_microsoft-windows-a..lity-infrastructure_31bf3856ad364e35_6.0.6000.21029_none_dfe2192ce9eae272\user32.amx
[2009/03/20 21:28:34 | 000,310,510 | ---- | M] () MD5=1092A3BA31CF10652A01FFD739C0998B -- C:\Windows\winsxs\amd64_microsoft-windows-a..lity-infrastructure_31bf3856ad364e35_6.0.6001.22399_none_d72825eab2e941bd\user32.amx
[2009/03/20 20:57:30 | 000,330,376 | ---- | M] () MD5=297BD98473316F85C7D990E2D48B9117 -- C:\Windows\winsxs\wow64_microsoft-windows-a..lity-infrastructure_31bf3856ad364e35_6.0.6001.22399_none_e17cd03ce74a03b8\user32.amx
[2009/03/16 21:14:09 | 000,330,376 | ---- | M] () MD5=69B4D4EC68E1AE37BEC9B56FCC9FF081 -- C:\Windows\SysWOW64\manifeststore\user32.amx
[2009/03/16 21:14:09 | 000,330,376 | ---- | M] () MD5=69B4D4EC68E1AE37BEC9B56FCC9FF081 -- C:\Windows\winsxs\wow64_microsoft-windows-a..lity-infrastructure_31bf3856ad364e35_6.0.6001.18230_none_e12b105fce03d839\user32.amx
[2009/03/16 20:55:47 | 000,350,528 | ---- | M] () MD5=7C088CC1BC4A55B15DAD462A0A3B08E1 -- C:\Windows\winsxs\wow64_microsoft-windows-a..lity-infrastructure_31bf3856ad364e35_6.0.6000.16834_none_df48d2e1d0d9aca4\user32.amx
[2008/01/20 22:49:55 | 000,336,752 | ---- | M] () MD5=89246ED945E2AE256B886A6C239D3092 -- C:\Windows\winsxs\amd64_microsoft-windows-a..lity-infrastructure_31bf3856ad364e35_6.0.6001.18000_none_d6f6d205998ac81d\user32.amx
[2009/03/16 21:16:15 | 000,337,596 | ---- | M] () MD5=9F7D70E12E5741C1392447DD3772F75B -- C:\Windows\winsxs\amd64_microsoft-windows-a..lity-infrastructure_31bf3856ad364e35_6.0.6000.21029_none_d58d6edab58a2077\user32.amx
[2009/03/16 21:19:01 | 000,337,770 | ---- | M] () MD5=B836AC5378C4B538F1A98FDCB4EC04FE -- C:\Windows\winsxs\amd64_microsoft-windows-a..lity-infrastructure_31bf3856ad364e35_6.0.6000.16834_none_d4f4288f9c78eaa9\user32.amx

< MD5 for: USER32.DLL >
[2008/01/20 22:48:29 | 000,820,224 | ---- | M] (Microsoft Corporation) MD5=32B87D215905F648EBE36A621978442C -- C:\Windows\ERDNT\cache64\user32.dll
[2008/01/20 22:48:29 | 000,820,224 | ---- | M] () MD5=32B87D215905F648EBE36A621978442C -- C:\Windows\SysNative\user32.dll
[2008/01/20 22:48:29 | 000,820,224 | ---- | M] (Microsoft Corporation) MD5=32B87D215905F648EBE36A621978442C -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_295707c525b9f068\user32.dll
[2008/01/20 22:49:14 | 000,648,192 | ---- | M] (Microsoft Corporation) MD5=3D691030DBD3BD75DE1501BE54F0D425 -- C:\Windows\ERDNT\cache86\user32.dll
[2008/01/20 22:49:14 | 000,648,192 | ---- | M] (Microsoft Corporation) MD5=3D691030DBD3BD75DE1501BE54F0D425 -- C:\Windows\SysWOW64\user32.dll
[2008/01/20 22:49:14 | 000,648,192 | ---- | M] (Microsoft Corporation) MD5=3D691030DBD3BD75DE1501BE54F0D425 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_33abb2175a1ab263\user32.dll

< MD5 for: USER32.DLL.MUI >
[2006/11/02 11:13:57 | 000,017,408 | ---- | M] (Microsoft Corporation) MD5=30E0BC625C9BDBF0E9F9170B077ECC80 -- C:\Windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_6.0.6000.16386_en-us_97e5d151e68f9a6f\user32.dll.mui
[2006/11/02 11:13:29 | 000,017,920 | ---- | M] (Microsoft Corporation) MD5=471A456189A927507F69DB9518C680AC -- C:\Windows\winsxs\wow64_microsoft-windows-user32.resources_31bf3856ad364e35_6.0.6000.16386_en-us_a23a7ba41af05c6a\user32.dll.mui
[2008/01/20 22:52:41 | 000,017,408 | ---- | M] () MD5=577A5CBA92CD837427517D3152DE0C96 -- C:\Windows\SysNative\en-US\user32.dll.mui
[2008/01/20 22:52:41 | 000,017,408 | ---- | M] (Microsoft Corporation) MD5=577A5CBA92CD837427517D3152DE0C96 -- C:\Windows\winsxs\amd64_microsoft-windows-user32.resources_31bf3856ad364e35_6.0.6001.18000_en-us_9a1c934de37aab43\user32.dll.mui
[2008/01/20 22:52:28 | 000,017,920 | ---- | M] (Microsoft Corporation) MD5=A194808A2D7726151CAA835D69605BD2 -- C:\Windows\SysWOW64\en-US\user32.dll.mui
[2008/01/20 22:52:28 | 000,017,920 | ---- | M] (Microsoft Corporation) MD5=A194808A2D7726151CAA835D69605BD2 -- C:\Windows\winsxs\wow64_microsoft-windows-user32.resources_31bf3856ad364e35_6.0.6001.18000_en-us_a4713da017db6d3e\user32.dll.mui

========== Alternate Data Streams ==========

@Alternate Data Stream - 64 bytes -> C:\Users\Gwei\Documents\[TV] arashi ni shiyagare 20111015 - kame part (11m)(1280x720)(KAL)..avi:TOC.WMV
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:F3AB0B43

< End of report >

[Essexboy]

OK lets now replace that file, once done can you let me know what problems remain

1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
3. Open notepad and copy/paste the text in the quotebox below into it:

FCopy::
C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_33abb2175a1ab263\user32.dll|C:\Windows\System32\user32.dll

Save this as CFScript.txt, in the same location as ComboFix.exe


Refering to the picture above, drag CFScript into ComboFix.exeWhen finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

[cherinacherine]

Everything went smoothly. My computer is running about the same as before, maybe slightly slower, but nothing bad. Everything seems to be working well!






ComboFix 12-09-27.03 - Gwei 09/29/2012 7:37.2.2 - x64
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.4086.1950 [GMT -4:00]
Running from: c:\users\Gwei\Desktop\ComboFix.exe
Command switches used :: c:\users\Gwei\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
--------------- FCopy ---------------
.
c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_33abb2175a1ab263\user32.dll --> c:\windows\System32\user32.dll
.
((((((((((((((((((((((((( Files Created from 2012-08-28 to 2012-09-29 )))))))))))))))))))))))))))))))
.
.
2012-09-29 11:43 . 2012-09-29 11:45 -------- d-----w- c:\users\Gwei\AppData\Local\temp
2012-09-29 11:43 . 2012-09-29 11:43 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-09-28 15:22 . 2012-09-28 15:22 -------- d-----w- C:\_OTL
2012-09-28 13:17 . 2012-08-23 08:26 9310152 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{178152B4-9048-4E02-81E5-912F72681CD1}\mpengine.dll
2012-09-28 12:51 . 2012-09-28 12:51 -------- d-----w- C:\found.004
2012-09-28 12:30 . 2012-09-28 12:30 -------- d-----w- c:\users\Gwei\AppData\Roaming\hellomoto
2012-09-03 23:05 . 2012-09-25 16:14 -------- d-----w- c:\users\Gwei\AppData\Roaming\vlc
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sanriotown email alert"="c:\program files (x86)\Sanriotown\E-mail Alert\MAClient -auto" [X]
"BitTorrent DNA"="c:\users\Gwei\Program Files (x86)\DNA\btdna.exe" [2009-11-06 323392]
"Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2010-09-22 2969496]
"Messenger (Yahoo!)"="c:\program files (x86)\Yahoo!\Messenger\YahooMessenger.exe" [2010-03-03 5244216]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Gateway\traybar.exe" [2007-09-13 638976]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Malwarebytes Anti-Malware (reboot)"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-09-24 421160]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2008-01-19 40072]
.
c:\users\Gwei\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BigFix.lnk - c:\program files\BigFix\bigfix.exe [2008-9-17 2342912]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Themes
.
Contents of the 'Scheduled Tasks' folder
.
2012-09-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1935358621-21101508-4254277831-1000Core.job
- c:\users\Gwei\AppData\Local\Google\Update\GoogleUpdate.exe [2010-05-22 20:28]
.
2012-09-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1935358621-21101508-4254277831-1000UA.job
- c:\users\Gwei\AppData\Local\Google\Update\GoogleUpdate.exe [2010-05-22 20:28]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-02 137240]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-02 202264]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-02 165400]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712]
"SigmatelSysTrayApp"="sttray64.exe" [2007-07-27 425984]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-17 963584]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.sanriotown.com/main/index.php?lang=us
mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=BB&Br=GTW&Loc=ENG_US&Sys=PTB&M=T-6836
mDefault_Page_URL = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=BB&Br=GTW&Loc=ENG_US&Sys=PTB&M=T-6836
mLocal Page = %SystemRoot%\system32\blank.htm
uInternet Settings,ProxyOverride = *.local
mSearchAssistant = hxxp://www.gateway.com/g/sidepanel.html?Ch=Retail&SubCH=BB&Br=GTW&Loc=ENG_US&Sys=PTB&M=T-6836
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: real.com\rhap-app-4-0
Trusted Zone: real.com\rhapreg
TCP: DhcpNameServer = 192.168.1.254
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*c*i*r*c*l*Ü#d\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*c*o*u*p*o*n*i*n*Æ„Ù?\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*D*i*x*i*¶¶N\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*D*i*x*i*U�ÙF\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*D*i*x*i*š.+\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*H*D*T*^:.\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*M*e*n*t*a*l*i*s*wiu\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*M*e*n*t*a*l*i*s*–›K@\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*0*1*E*0*7*+…|\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*0*1*E*0*7*å²¢U\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*0*1*E*0*7*éò[\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\. S 0 1
1A\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*0*1*Më@y\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*g
V*]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*g
V*\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*ý
V*]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*ý
V*\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*’ÁRg]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*S*’ÁRg\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*T*h*e*_*C*o*m*i*n*g*?�*\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*U*S*Š+·B\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*W*i*f*‘±8\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*W*i*f*¤iu\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*W*i*f*Îiu\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*W*i*f*8¶N\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*W*i*f*É>@Z\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*W*i*f*iœ¤S\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*W*i*f*®®±`\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*­!…|]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*­!…|\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*¤:­t]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*¤:­t\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*ïl¥|]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*ïl¥|\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*¤y;~]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*¤y;~\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*Úz$XC*€Š*]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*Úz$XC*€Š*\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*œ.+]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*œ.+\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*ýÁRg]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*ýÁRg\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*S*g
V*]
"0"=hex:54,00,65,00,72,00,72,00,61,00,2e,00,4e,00,6f,00,76,00,61,00,2e,00,53,
00,67,01,56,2a,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,54,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*S*ý
V*]
"0"=hex:54,00,65,00,72,00,72,00,61,00,2e,00,4e,00,6f,00,76,00,61,00,2e,00,53,
00,fd,01,56,2a,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,54,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*S*’ÁRg]
"0"=hex:54,00,65,00,72,00,72,00,61,00,2e,00,4e,00,6f,00,76,00,61,00,2e,00,53,
00,92,c1,52,67,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,54,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*­!…|]
"0"=hex:4d,00,65,00,72,00,6c,00,69,00,6e,00,2e,00,32,00,30,00,30,00,38,00,2e,
00,ad,21,85,7c,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,4d,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*¤:­t]
"0"=hex:4d,00,65,00,72,00,6c,00,69,00,6e,00,2e,00,32,00,30,00,30,00,38,00,2e,
00,a4,3a,ad,74,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,4d,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*ïl¥|]
"0"=hex:4d,00,65,00,72,00,6c,00,69,00,6e,00,2e,00,32,00,30,00,30,00,38,00,2e,
00,ef,6c,a5,7c,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,4d,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*¤y;~]
"0"=hex:6d,00,65,00,72,00,6c,00,69,00,6e,00,2e,00,32,00,30,00,30,00,38,00,2e,
00,a4,79,3b,7e,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,6d,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*Úz$XC*€Š*]
"0"=hex:4d,00,65,00,72,00,6c,00,69,00,6e,00,2e,00,32,00,30,00,30,00,38,00,2e,
00,da,7a,24,7f,58,43,00,80,8a,00,00,00,8e,00,36,00,00,00,00,00,00,00,00,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*œ.+]
"0"=hex:4d,00,65,00,72,00,6c,00,69,00,6e,00,2e,00,32,00,30,00,30,00,38,00,2e,
00,04,9c,2e,2b,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,4d,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-1935358621-21101508-4254277831-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*ýÁRg]
"0"=hex:4d,00,65,00,72,00,6c,00,69,00,6e,00,2e,00,32,00,30,00,30,00,38,00,2e,
00,fd,c1,52,67,00,00,82,00,36,00,00,00,00,00,00,00,00,00,00,00,4d,00,65,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10b.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10b.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil9e.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil9e.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}]
@Denied: (A 2) (Everyone)
@="IFlashBroker"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]
@Denied: (A 2) (Everyone)
@="IFlashBroker2"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\program files (x86)\OpenOffice.org 3\program\soffice.exe
c:\program files (x86)\OpenOffice.org 3\program\soffice.bin
c:\program files\Camera Assistant Software for Gateway\CEC_MAIN.exe
c:\program files (x86)\Yahoo!\Messenger\ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 2012-09-29 07:51:18 - machine was rebooted
ComboFix-quarantined-files.txt 2012-09-29 11:51
ComboFix2.txt 2012-09-28 18:39
.
Pre-Run: 25,963,843,584 bytes free
Post-Run: 25,838,551,040 bytes free
.
- - End Of File - - B04B4B8CC1A40E599C8E795AC73D1E61

[Essexboy]

Subject to no further problems

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

  :Commands
  [resethosts]
  [emptytemp]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done

Remove ComboFix

• Hold down the Windows key + R on your keyboard. This will display the Run dialogue box
• In the Run box, type in ComboFix /Uninstall (Notice the space between the "x" and "/") then click OK
  
  
  
• Follow the prompts on the screen
• A message should appear confirming that ComboFix was uninstalled

Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

• Go to control panel
• Select folder options (Appearance > Folder options in category view)
• Select the View Tab.
• Under the Hidden files and folders heading select Do not show hidden files and folders.
• Click Yes to confirm.
• Click OK.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version of Java components and upgrade the application.

Upgrading Java:

• Go to this site and click Do I have Java
• It will check your current version and then offer to update to the latest version

SPRING CLEAN

To manually create a new Restore Point

• Go to Control Panel and select System
• Select System
• On the left select System Protection and accept the warning if you get one
• Select System Protection Tab
• Select Create at the bottom
• Type in a name i.e. Clean
• Select Create

Now we can purge the infected ones

• GoStart > All programs > Accessories > system tools
• Right click Disc cleanup and select run as administrator
• Select Your main drive and accept the warning if you get one
• For a few moments the system will make some calculations
• Select the More Options tab
• In the System Restore and Shadow Backups select Clean up
• Select Delete on the pop up
• Select OK
• Select Delete

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Malwarebytes. Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit

• Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?

Keep safe

[cherinacherine]

Thank you for all your help! I followed your instructions, and I'll let you know how everything is running in 24 hours.

[Essexboy]

My pleasure