Browser hijack

Every time I do a search in Google (win xp sp3, firefox(my desktop pc)) when I click what I want I get redirected to some totally different random website. Also my pc has been slower then usual. Here's some logs:


DDS (Ver_10-03-17.01) - NTFSx86
Run by Dan at 11:49:13.78 on Sat 03/20/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_18
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.593 [GMT -4:00]

AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msfeedssync.exe
C:\Documents and Settings\Dan\Desktop\Pc repair stuff\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
BHO: GAddons - Find what you need faster!: {0286a85d-cd62-43bb-b7a9-a87d1d027160} - c:\progra~1\supers~1\12SUPE~1.DLL
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
TB: {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Google Update] "c:\documents and settings\dan\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [cdloader] "c:\documents and settings\dan\application data\mjusbsp\cdloader2.exe" MAGICJACK
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [mmtask] "c:\program files\musicmatch\musicmatch jukebox\mmtask.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [avast5] c:\progra~1\alwils~1\avast5\avastUI.exe /nogui
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partygaming\partypoker\RunApp.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {0B195D55-0AB4-48C7-828F-34BE10BA4266} - hxxp://www.worldwinner.com/games/v53/dealornodeal/dealornodeal.cab
DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - hxxp://activex.camfrogweb.com/advanced/2.0.2.3/cfweb_activex.camfrogweb.com-advanced-2.0.2.3_instmodule.exe
DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/Default/uno1/GAME_UNO1.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1256872840765
DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} - hxxp://zone.msn.com/bingame/zpagames/GAME_UNO1.cab60096.cab
DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} - hxxp://www.worldwinner.com/games/shared/wwlaunch.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} - hxxp://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZPAFramework.cab102118.cab
DPF: {BA35B9B8-DE9E-47C9-AFA7-3C77E3DDFD39} - hxxp://www.worldwinner.com/games/v46/monopoly/monopoly.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
TCP: {55EC9538-3815-45A8-B1AF-D99B783385A2} = 192.168.0.1,192.168.0.1
TCP: {D0BCFE29-2625-4065-9C44-9F66FA744D74} = 24.247.24.53,24.247.15.53
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
LSA: Notification Packages = scecli mnwusfe1.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\dan\applic~1\mozilla\firefox\profiles\xw19c4l2.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.com
FF - plugin: c:\documents and settings\dan\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\dan\local settings\application data\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npijjiautoinstallpluginff.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npijjiFFPlugin1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: XULRunner: {0A36F6B3-A26F-4764-A43A-8022823B6FEC} - c:\documents and settings\dan\local settings\application data\{0A36F6B3-A26F-4764-A43A-8022823B6FEC}
FF - HiddenExtension: XULRunner: {7B44E188-2FB9-44FA-BAC6-CA1A7189DC67} - c:\documents and settings\administrator\local settings\application data\{7b44e188-2fb9-44fa-bac6-ca1a7189dc67}\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-3-9 162640]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-3-9 19024]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-3-9 40384]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2009-10-17 10384]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-3-9 40384]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-3-9 40384]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [2008-1-14 21632]
S2 StarWindServiceAE;StarWind AE Service;c:\program files\alcohol soft\alcohol 120\starwind\StarWindServiceAE.exe [2007-5-28 275968]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\drivers\VBoxNetAdp.sys [2009-10-18 94992]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\drivers\vboxnetflt.sys --> c:\windows\system32\drivers\VBoxNetFlt.sys [?]

=============== Created Last 30 ================

2010-03-20 15:48:00 170 ----a-w- c:\documents and settings\dan\defogger_reenable
2010-03-18 18:21:31 36224 -c--a-w- c:\windows\system32\dllcache\an983.sys
2010-03-18 18:21:31 36224 ----a-w- c:\windows\system32\drivers\an983.sys
2010-03-17 18:06:41 0 d-----w- c:\documents and settings\dan\.kbotpro
2010-03-12 02:12:40 0 d-----w- c:\windows\system32\wbem\Repository
2010-03-10 02:53:59 0 d-----w- c:\docume~1\alluse~1\applic~1\Alwil Software

==================== Find3M ====================

2010-03-18 02:49:48 69 ----a-w- c:\documents and settings\dan\jagex_runescape_preferences2.dat
2010-03-18 02:28:37 41 ----a-w- c:\documents and settings\dan\jagex_runescape_preferences.dat
2010-02-13 20:51:36 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-02-07 03:54:00 135168 ----a-w- c:\documents and settings\dan\PatchUpdate.exe
2010-02-07 03:53:59 16896 ----a-w- c:\documents and settings\dan\Network.dll
2010-02-07 03:53:59 107008 ----a-w- c:\documents and settings\dan\Language.dll
2010-02-07 03:53:58 23552 ----a-w- c:\documents and settings\dan\LobbyShared.dll
2010-02-07 03:53:58 19456 ----a-w- c:\documents and settings\dan\CustomPanels.dll
2010-02-07 03:53:57 616448 ----a-w- c:\documents and settings\dan\LobbyClient.exe
2010-02-07 03:53:52 1068 ----a-w- c:\documents and settings\dan\updateinfo.dat
2010-02-07 00:54:31 21840 ----atw- c:\windows\system32\SIntfNT.dll
2010-02-07 00:54:31 17212 ----atw- c:\windows\system32\SIntf32.dll
2010-02-07 00:54:31 12067 ----atw- c:\windows\system32\SIntf16.dll
2010-02-03 08:40:02 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-01-19 06:40:00 41472 ----a-w- c:\windows\xkkxd8283.exe
2009-12-21 19:14:05 916480 ----a-w- c:\windows\system32\wininet.dll
2009-11-11 05:03:19 1080560 ----a-w- c:\program files\pfsetup.exe
2009-11-10 16:37:36 245760 --sha-w- c:\windows\system32\config\systemprofile\ietldcache\index.dat

============= FINISH: 11:49:47.09 ===============


GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-03-20 14:05:48
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Dan\LOCALS~1\Temp\pwldipoc.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xEB423C56]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xEB423B12]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteKey [0xEB4240C6]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xEB423FF0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xEB4236E8]
SSDT spml.sys ZwEnumerateKey [0xF738CDA4]
SSDT spml.sys ZwEnumerateValueKey [0xF738D132]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xEB423BEC]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xEB423628]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xEB42368C]
SSDT spml.sys ZwQueryKey [0xF738D20A]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xEB423D0C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRenameKey [0xEB424194]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xEB423CCC]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xEB423E4C]

INT 0x62 ? 863DEBF8
INT 0x63 ? 85FC8BF8
INT 0x73 ? 85FC8BF8
INT 0x82 ? 863DEBF8
INT 0x83 ? 85FC8BF8
INT 0xB1 ? 863E1BF8
INT 0xB1 ? 863E1BF8

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateProcessEx [0xEB4304FE]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateSection [0xEB430322]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwLoadDriver [0xEB43045C]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) NtCreateSection
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObMakeTemporaryObject

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/ALWIL Software)
Device \FileSystem\Ntfs \Ntfs 863DD1F8

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\usbohci \Device\USBPDO-0 8619D1F8
Device \Driver\PCI_PNP2816 \Device\00000051 spml.sys
Device \Driver\dmio \Device\DmControl\DmIoDaemon 863DF1F8
Device \Driver\dmio \Device\DmControl\DmConfig 863DF1F8
Device \Driver\dmio \Device\DmControl\DmPnP 863DF1F8
Device \Driver\dmio \Device\DmControl\DmInfo 863DF1F8
Device \Driver\usbohci \Device\USBPDO-1 8619D1F8
Device \Driver\PCI_PNP2816 \Device\00000052 spml.sys
Device \Driver\usbehci \Device\USBPDO-2 861911F8

AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\Ftdisk \Device\HarddiskVolume1 863741F8
Device \Driver\Cdrom \Device\CdRom0 85E831F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 863741F8
Device \Driver\Cdrom \Device\CdRom1 85E831F8
Device \Driver\Cdrom \Device\CdRom2 85E831F8
Device \Driver\sptd \Device\1447810316 spml.sys
Device \Driver\NetBT \Device\NetBt_Wins_Export 85FB0500
Device \Driver\NetBT \Device\NetbiosSmb 85FB0500

AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\usbohci \Device\USBFDO-0 8619D1F8
Device \Driver\usbohci \Device\USBFDO-1 8619D1F8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 85E9F1F8
Device \Driver\usbehci \Device\USBFDO-2 861911F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 85E9F1F8
Device \Driver\Ftdisk \Device\FtControl 863741F8
Device \Driver\sptd \Device\1447966566 spml.sys
Device \Driver\NetBT \Device\NetBT_Tcpip_{D0BCFE29-2625-4065-9C44-9F66FA744D74} 85FB0500
Device \Driver\aeqgebal \Device\Scsi\aeqgebal1 85E7B1F8
Device \Driver\aeqgebal \Device\Scsi\aeqgebal1Port2Path0Target0Lun0 85E7B1F8
Device \Driver\a73gs8gm \Device\Scsi\a73gs8gm1 85E6E500
Device \FileSystem\Cdfs \Cdfs 85EE7500

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x14 0x4A 0xFD 0x8B ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xB7 0xAB 0x1A 0xF0 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xE8 0x90 0x73 0xB2 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x17 0xEF 0x41 0x40 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x14 0x4A 0xFD 0x8B ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xB7 0xAB 0x1A 0xF0 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xE8 0x90 0x73 0xB2 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x17 0xEF 0x41 0x40 ...

---- EOF - GMER 1.0.15 ----

Edited by snouk, 20 March 2010 - 01:11 PM.

Hello and welcome to Bleeping Computer!

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.

Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:

• Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.scr
  • DDS.pif
• Double click on the DDS icon, allow it to run.
• A small box will open, with an explaination about the tool. No input is needed, the scan is running.
• Notepad will open with the results.
• Follow the instructions that pop up for posting the results.
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

We also need a new log from the GMER anti-rootkit scanner. Please first disable any CD emulation programs using the steps found in this topic:

Why we request you disable CD Emulation when receiving Malware Removal Advice

Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:

How to create a GMER log

Elle

Nothing has changed the pc has been off scenes the last post, logs should still be the same. Still same browser redirect hijack/slow system.

Hello, snouk
Welcome to the Bleeping Computer Forums. My name is Thomas (Tom is fine), and I will be helping you fixing your problems.

If you do not make a reply in 5 days, we will have to close your topic.

You may want to keep the link to this topic in your favourites. Alternatively, you can click the button at the top bar of this topic and Track this Topic. The topics you are tracking can be found here.

Please take note of some guidelines for this fix:

• Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
• If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
• Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
• Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
• Old topics are closed after 3 days with no reply, and working topics are closed after 5 days. If for any reason you cannot complete instructions within that time, that's fine, just post back here so that we know you're still here.
• Please set your system to show all files.
  Click Start, open My Computer, select the Tools menu and click Folder Options.
  Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
  Uncheck: Hide file extensions for known file types
  Uncheck the Hide protected operating system files (recommended) option.
  Click Yes to confirm.

Please go here and have a look how you can disable your security software.

Download Combofix from any of the links below but rename it to before saving it to your desktop.

Link 1
Link 2



--------------------------------------------------------------------

Double click on the renamed Combofix.exe & follow the prompts.

When finished, it will produce a report for you.
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.

This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

If you need help, see this link:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Here is the log.

ComboFix 10-03-28.01 - Dan 03/28/2010 17:10:59.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.770 [GMT -4:00]
Running from: c:\documents and settings\Dan\My Documents\Downloads\schrauber.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Administrator\Local Settings\Application Data\{7B44E188-2FB9-44FA-BAC6-CA1A7189DC67}
c:\documents and settings\Administrator\Local Settings\Application Data\{7B44E188-2FB9-44FA-BAC6-CA1A7189DC67}\chrome.manifest
c:\documents and settings\Administrator\Local Settings\Application Data\{7B44E188-2FB9-44FA-BAC6-CA1A7189DC67}\chrome\content\_cfg.js
c:\documents and settings\Administrator\Local Settings\Application Data\{7B44E188-2FB9-44FA-BAC6-CA1A7189DC67}\chrome\content\overlay.xul
c:\documents and settings\Administrator\Local Settings\Application Data\{7B44E188-2FB9-44FA-BAC6-CA1A7189DC67}\install.rdf
c:\documents and settings\Dan\Application Data\Desktopicon
c:\documents and settings\Dan\Application Data\Desktopicon\eBayShortcuts.exe
c:\documents and settings\Dan\Application Data\EurekaLog
c:\documents and settings\Dan\Local Settings\Application Data\{0A36F6B3-A26F-4764-A43A-8022823B6FEC}
c:\documents and settings\Dan\Local Settings\Application Data\{0A36F6B3-A26F-4764-A43A-8022823B6FEC}\chrome.manifest
c:\documents and settings\Dan\Local Settings\Application Data\{0A36F6B3-A26F-4764-A43A-8022823B6FEC}\chrome\content\_cfg.js
c:\documents and settings\Dan\Local Settings\Application Data\{0A36F6B3-A26F-4764-A43A-8022823B6FEC}\chrome\content\overlay.xul
c:\documents and settings\Dan\Local Settings\Application Data\{0A36F6B3-A26F-4764-A43A-8022823B6FEC}\install.rdf
c:\progra~1\SUPERS~1\13SUpe~1.dll
c:\program files\PlaySushi\PSTExt.dll
c:\windows\a3kebook.ini
c:\windows\akebook.ini
c:\windows\ANS2000.INI
c:\windows\system32\Install.bat
c:\windows\system32\SIntf16.dll
c:\windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SSHNAS


((((((((((((((((((((((((( Files Created from 2010-02-28 to 2010-03-28 )))))))))))))))))))))))))))))))
.

2010-03-28 19:18 . 2010-03-28 19:18 -------- d-----w- c:\documents and settings\Dan\Application Data\acccore
2010-03-28 19:18 . 2010-03-28 20:01 -------- d-----w- c:\documents and settings\Dan\Local Settings\Application Data\AIM
2010-03-28 19:18 . 2010-03-28 19:18 -------- d-----w- c:\documents and settings\Dan\Local Settings\Application Data\AOL
2010-03-28 19:18 . 2010-03-28 19:18 -------- d-----w- c:\documents and settings\All Users\Application Data\AIM
2010-03-28 19:18 . 2010-03-28 19:18 -------- d-----w- c:\program files\AIM
2010-03-28 19:18 . 2010-03-28 19:18 -------- d-----w- c:\program files\Common Files\AOL
2010-03-28 18:29 . 2010-03-28 21:15 -------- d-----w- c:\program files\PlaySushi
2010-03-27 01:05 . 2010-03-27 01:05 -------- d-----w- c:\program files\Synergy
2010-03-26 00:46 . 2010-03-26 00:58 -------- d-----w- c:\documents and settings\Dan\Application Data\Web Page Maker
2010-03-26 00:46 . 2010-03-26 00:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Web Page Maker
2010-03-26 00:45 . 2010-03-26 00:45 -------- d-----w- c:\program files\Web Page Maker
2010-03-25 02:37 . 2010-03-25 02:37 -------- d-----w- c:\program files\Secunia
2010-03-25 02:04 . 2010-03-25 02:04 -------- d-----w- c:\documents and settings\Dan\Application Data\Yahoo!
2010-03-25 00:41 . 2010-03-25 00:41 -------- d-----w- C:\rei
2010-03-25 00:41 . 2010-03-25 00:41 -------- d-----w- c:\program files\Reimage
2010-03-23 18:28 . 2010-03-23 18:28 -------- d-----w- c:\documents and settings\All Users\Application Data\EPSON
2010-03-23 18:28 . 2007-12-07 01:08 86528 ----a-w- c:\windows\system32\E_FLBEJA.DLL
2010-03-23 18:28 . 2007-12-07 01:01 78848 ----a-w- c:\windows\system32\E_FD4BEJA.DLL
2010-03-23 17:56 . 2008-04-14 02:17 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2010-03-23 17:56 . 2008-04-14 02:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2010-03-21 23:20 . 2010-03-21 23:20 148816 ----a-w- c:\windows\system32\unzip32.dll
2010-03-21 23:20 . 2010-03-21 23:20 53248 ----a-w- c:\windows\system32\quick32.dll
2010-03-18 18:21 . 2008-04-14 00:05 36224 -c--a-w- c:\windows\system32\dllcache\an983.sys
2010-03-18 18:21 . 2008-04-14 00:05 36224 ----a-w- c:\windows\system32\drivers\an983.sys
2010-03-18 17:54 . 2010-03-18 17:54 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2010-03-17 18:06 . 2010-03-17 18:06 -------- d-----w- c:\documents and settings\Dan\.kbotpro
2010-03-12 02:12 . 2010-03-12 02:12 -------- d-----w- c:\windows\system32\wbem\Repository
2010-03-10 02:54 . 2010-03-09 11:12 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-03-10 02:54 . 2010-03-09 11:12 162640 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-03-10 02:54 . 2010-03-09 11:09 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-03-10 02:54 . 2010-03-09 11:08 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-03-10 02:54 . 2010-03-09 11:08 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-03-10 02:54 . 2010-03-09 11:08 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-03-10 02:54 . 2010-03-09 11:08 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-03-10 02:54 . 2010-03-09 11:24 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-03-10 02:54 . 2010-03-09 11:24 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-03-10 02:53 . 2010-03-10 02:53 -------- d-----w- c:\program files\Alwil Software
2010-03-10 02:53 . 2010-03-10 02:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-28 21:15 . 2009-11-24 19:32 -------- d-----w- c:\program files\SuperSearch
2010-03-28 17:06 . 2009-10-18 04:53 -------- d-----w- c:\documents and settings\Dan\Application Data\Camfrog
2010-03-28 06:21 . 2009-11-12 19:49 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-03-28 06:12 . 2009-07-14 19:37 361600 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-03-27 18:12 . 2010-02-12 15:01 -------- d-----w- c:\documents and settings\Dan\Application Data\vlc
2010-03-27 03:42 . 2009-10-17 23:20 -------- d-----w- c:\documents and settings\Dan\Application Data\Azureus
2010-03-25 05:30 . 2009-11-03 04:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-03-25 02:32 . 2009-11-07 15:08 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-03-25 02:23 . 2009-11-07 15:12 -------- d-----w- c:\program files\Common Files\Adobe
2010-03-25 02:22 . 2010-02-07 03:07 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-03-25 02:21 . 2010-03-25 02:21 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-03-25 02:03 . 2009-10-18 05:01 -------- d-----w- c:\program files\Yahoo!
2010-03-24 22:28 . 2009-10-22 02:22 -------- d-----w- c:\documents and settings\Dan\Application Data\DAoC Portal
2010-03-24 22:28 . 2009-10-22 08:59 -------- d-----w- c:\program files\Full Tilt Poker
2010-03-24 19:58 . 2009-10-21 22:35 -------- d-----w- c:\documents and settings\Dan\Application Data\TeamViewer
2010-03-24 18:44 . 2010-01-29 21:33 -------- d-----w- c:\documents and settings\Dan\Application Data\skypePM
2010-03-24 05:17 . 2009-10-23 00:14 -------- d-----w- c:\program files\ClubWPT
2010-03-24 05:17 . 2009-10-23 00:17 -------- d-----w- c:\program files\PokerStars
2010-03-23 03:22 . 2009-12-23 04:18 -------- d-----w- c:\program files\YEpic
2010-03-18 17:41 . 2010-02-01 22:52 -------- d-----w- c:\program files\OUGOMessenger
2010-03-18 17:40 . 2010-02-10 14:53 -------- d-----w- c:\program files\InstaTrader
2010-03-18 17:38 . 2009-10-17 22:47 -------- d-----w- c:\program files\HWiNFO32
2010-03-18 17:37 . 2009-10-31 03:34 -------- d-----w- c:\program files\FarmVilleBot
2010-03-18 17:36 . 2009-11-21 11:38 -------- d-----w- c:\program files\DriftCity
2010-03-18 17:35 . 2010-02-13 20:51 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2010-03-18 02:49 . 2009-10-18 18:38 69 ----a-w- c:\documents and settings\Dan\jagex_runescape_preferences2.dat
2010-03-18 02:28 . 2009-10-18 18:36 41 ----a-w- c:\documents and settings\Dan\jagex_runescape_preferences.dat
2010-03-14 04:42 . 2010-02-13 07:47 -------- d-----w- c:\program files\Simple Port Forwarding
2010-03-14 03:57 . 2009-10-24 06:34 -------- d-----w- c:\documents and settings\Dan\Application Data\FrostWire
2010-03-12 17:07 . 2009-10-22 00:11 -------- d-----w- c:\documents and settings\Dan\Application Data\Tor
2010-03-12 17:07 . 2009-10-22 00:11 -------- d-----w- c:\documents and settings\Dan\Application Data\Vidalia
2010-03-12 17:04 . 2009-10-23 04:02 -------- d-----w- c:\program files\ProxyFirewall
2010-03-12 16:57 . 2010-01-21 04:11 -------- d-----w- c:\program files\CCleaner
2010-02-22 15:10 . 2010-02-22 15:10 188928 ----a-w- c:\documents and settings\Dan\Application Data\Mozilla\Firefox\Profiles\xw19c4l2.default\extensions\textlinks@playsushi.com\components\PlaySushiFF.dll
2010-02-22 15:10 . 2010-02-22 15:10 188928 ----a-w- c:\documents and settings\Dan\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\components\PlaySushiFF.dll
2010-02-16 03:14 . 2010-02-04 00:32 -------- d-----w- c:\documents and settings\Dan\Application Data\FileZilla
2010-02-14 05:47 . 2009-10-17 22:59 -------- d-----w- c:\program files\Carambis
2010-02-14 05:35 . 2009-10-18 03:16 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-13 20:58 . 2010-02-13 20:58 -------- d-----w- c:\program files\Activision
2010-02-13 20:55 . 2010-02-13 20:50 -------- d-----w- c:\documents and settings\Dan\Application Data\DAEMON Tools Lite
2010-02-13 20:52 . 2010-02-13 20:51 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-02-13 20:51 . 2009-11-10 16:38 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-02-13 20:51 . 2010-02-13 20:50 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2010-02-13 20:38 . 2010-02-13 20:38 -------- d-----w- c:\program files\Alcohol Soft
2010-02-13 07:45 . 2010-02-13 07:41 -------- d-----w- c:\program files\PFConfig
2010-02-13 07:22 . 2010-02-13 07:22 -------- d-----w- c:\program files\PFPortChecker
2010-02-07 21:23 . 2010-01-19 06:43 120 ----a-w- c:\windows\Qlurowacehezu.dat
2010-02-07 20:12 . 2010-02-07 02:37 -------- d-----w- c:\documents and settings\Dan\Application Data\uTorrent
2010-02-07 18:57 . 2010-01-19 06:43 0 ----a-w- c:\windows\Xvovuyepebehami.bin
2010-02-07 03:54 . 2010-02-07 03:53 135168 ----a-w- c:\documents and settings\Dan\PatchUpdate.exe
2010-02-07 03:53 . 2010-02-07 03:53 16896 ----a-w- c:\documents and settings\Dan\Network.dll
2010-02-07 03:53 . 2010-02-07 03:53 107008 ----a-w- c:\documents and settings\Dan\Language.dll
2010-02-07 03:53 . 2010-02-07 03:53 23552 ----a-w- c:\documents and settings\Dan\LobbyShared.dll
2010-02-07 03:53 . 2010-02-07 03:53 19456 ----a-w- c:\documents and settings\Dan\CustomPanels.dll
2010-02-07 03:53 . 2010-02-07 03:53 616448 ----a-w- c:\documents and settings\Dan\LobbyClient.exe
2010-02-07 03:53 . 2010-02-07 03:53 1068 ----a-w- c:\documents and settings\Dan\updateinfo.dat
2010-02-07 02:37 . 2010-02-07 02:37 -------- d-----w- c:\program files\uTorrent
2010-02-07 00:54 . 2010-02-06 23:39 21840 ----atw- c:\windows\system32\SIntfNT.dll
2010-02-07 00:54 . 2010-02-06 23:39 17212 ----atw- c:\windows\system32\SIntf32.dll
2010-02-05 15:39 . 2010-02-05 15:39 251376 ----a-w- c:\documents and settings\Dan\Application Data\Mozilla\plugins\npgoogletalk.dll
2010-02-04 23:15 . 2010-02-04 23:15 -------- d-----w- c:\program files\SCAR 3.22
2010-02-04 23:08 . 2009-10-18 04:42 -------- d-sh--r- c:\program files\Microsoft
2010-02-04 00:32 . 2010-02-04 00:32 -------- d-----w- c:\program files\FileZilla FTP Client
2010-02-03 23:21 . 2010-02-03 23:21 1842688 ----a-w- c:\documents and settings\All Users\Application Data\GlobalSCAPE\CuteFTP 8 Professional\ftpte.exe
2010-02-03 23:21 . 2010-02-03 23:21 2830336 ----a-w- c:\documents and settings\All Users\Application Data\GlobalSCAPE\CuteFTP 8 Professional\cuteftppro.exe
2010-02-03 23:11 . 2010-02-03 23:11 -------- d-----w- c:\program files\GlobalSCAPE
2010-02-03 21:04 . 2010-02-03 21:02 -------- d-----w- c:\documents and settings\Dan\Application Data\Inspyder Web2Disk
2010-02-03 20:58 . 2010-02-03 20:58 -------- d-----w- c:\program files\Inspyder Software Inc
2010-02-03 08:40 . 2010-02-03 08:40 -------- d-----w- c:\program files\Common Files\Java
2010-02-03 08:40 . 2009-10-18 05:12 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-02-03 08:39 . 2010-02-03 08:39 -------- d-----w- c:\program files\Java
2010-02-03 00:15 . 2009-10-30 12:10 -------- d-----w- c:\program files\PartyGaming
2010-02-01 01:45 . 2010-02-07 03:08 38784 ----a-w- c:\documents and settings\Dan\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-02-01 01:45 . 2010-02-07 03:07 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-31 00:46 . 2010-01-31 00:46 348160 ----a-w- c:\documents and settings\Dan\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2d8bc946-n\msvcr71.dll
2010-01-31 00:46 . 2010-01-31 00:46 503808 ----a-w- c:\documents and settings\Dan\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2d8bc946-n\msvcp71.dll
2010-01-31 00:46 . 2010-01-31 00:46 499712 ----a-w- c:\documents and settings\Dan\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2d8bc946-n\jmc.dll
2010-01-31 00:46 . 2010-01-31 00:46 61440 ----a-w- c:\documents and settings\Dan\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-79da30bc-n\decora-sse.dll
2010-01-31 00:46 . 2010-01-31 00:46 12800 ----a-w- c:\documents and settings\Dan\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-79da30bc-n\decora-d3d.dll
2010-01-26 22:35 . 2010-01-26 22:35 1078 ----a-r- c:\documents and settings\Dan\Application Data\Microsoft\Installer\{30BA50ED-0F32-421B-BC6A-132A03EFF299}\ARPPRODUCTICON.exe
2010-01-26 03:18 . 2010-01-26 03:18 4141117 ----a-w- c:\documents and settings\Dan\Application Data\Azureus\plugins\vuzexcode\mediainfo.exe
2010-01-26 03:18 . 2010-01-26 03:18 6516755 ----a-w- c:\documents and settings\Dan\Application Data\Azureus\plugins\vuzexcode\ffmpeg.exe
2010-01-26 01:52 . 2009-12-11 16:54 0 ----a-w- c:\documents and settings\Dan\Local Settings\Application Data\prvlcl.dat
2010-01-19 06:40 . 2010-01-19 06:40 41472 ----a-w- c:\windows\xkkxd8283.exe
2009-12-31 16:50 . 2009-07-14 19:37 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-11-11 05:03 . 2009-11-11 05:02 1080560 ----a-w- c:\program files\pfsetup.exe
2009-08-18 21:42 . 2009-08-18 21:42 49152 ----a-w- c:\program files\mozilla firefox\components\SuperSearchXPCOM.dll
.

------- Sigcheck -------

[-] 2010-03-28 . FABB60CBF5E1E374B99DE989E6B0F44B . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
[7] 2009-07-14 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Dan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-12-10 135664]
"cdloader"="c:\documents and settings\Dan\Application Data\mjusbsp\cdloader2.exe" [2009-12-24 50520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
"mmtask"="c:\program files\Musicmatch\Musicmatch Jukebox\mmtask.exe" [2005-05-09 53248]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-03-09 2769336]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-10-17 813584]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-07-20 16:28 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Privoxy.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Privoxy.lnk
backup=c:\windows\pss\Privoxy.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Dan^Start Menu^Programs^Startup^GomezPEER.lnk]
path=c:\documents and settings\Dan\Start Menu\Programs\Startup\GomezPEER.lnk
backup=c:\windows\pss\GomezPEER.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 12:00 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
2009-06-17 16:55 55824 ----a-w- c:\windows\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
2007-07-25 20:02 563984 ----a-w- c:\program files\Common Files\Logishrd\LComMgr\Communications_Helper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
2007-07-25 20:06 2027792 ----a-w- c:\program files\Logitech\QuickCam\Quickcam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2008-05-16 18:01 13529088 ----a-w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2008-05-16 18:01 86016 ----a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVMixerTray]
2004-06-04 00:51 131072 ----a-w- c:\program files\NVIDIA Corporation\NvMixer\NvMixerTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2008-05-16 18:01 1630208 ----a-w- c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WZCSVC"=2 (0x2)
"WmiApSrv"=3 (0x3)
"WmdmPmSN"=3 (0x3)
"TermService"=3 (0x3)
"TapiSrv"=3 (0x3)
"SysmonLog"=3 (0x3)
"seclogon"=2 (0x2)
"RemoteRegistry"=2 (0x2)
"RDSessMgr"=3 (0x3)
"RasMan"=3 (0x3)
"RasAuto"=3 (0x3)
"Netlogon"=3 (0x3)
"mnmsrvc"=3 (0x3)
"LBTServ"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"helpsvc"=2 (0x2)
"FontCache3.0.0.0"=3 (0x3)
"BITS"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Camfrog\\Camfrog Video Chat\\Camfrog Video Chat.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\ijji\\ijji REACTOR\\REACTOR.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
"c:\\Documents and Settings\\Dan\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\Dan\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Documents and Settings\\Dan\\Application Data\\mjusbsp\\magicJack.exe"=
"c:\\Documents and Settings\\Dan\\My Documents\\Downloads\\SoftVox v11_cracked_by_kracker-gg-packed\\SoftVox v11_cracked_by_kracker-gg\\SoftVox v11_cracked_by_kracker-gg.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\eeaoc\\Empire Earth - The Art of Conquest\\EE-AOC.exe"=
"c:\\Program Files\\Activision\\Modern Warfare 2\\iw4mp.exe"=
"c:\\Program Files\\AIM\\aim.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"33334:UDP"= 33334:UDP:SPF Port 33334 UDP
"33335:TCP"= 33335:TCP:SPF Port 33335 TCP
"33336:TCP"= 33336:TCP:SPF Port 33336 TCP

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [11/10/2009 12:38 PM 691696]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [3/9/2010 10:54 PM 162640]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [3/9/2010 10:54 PM 19024]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [10/17/2009 11:21 PM 10384]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [1/14/2008 6:06 AM 21632]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [6/17/2009 8:20 AM 12648]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\drivers\VBoxNetAdp.sys [10/18/2009 5:25 PM 94992]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys --> c:\windows\system32\DRIVERS\VBoxNetFlt.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2010-03-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-1935655697-1547161642-1003Core.job
- c:\documents and settings\Dan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-12-10 22:28]

2010-03-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-1935655697-1547161642-1003UA.job
- c:\documents and settings\Dan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-12-10 22:28]

2010-03-28 c:\windows\Tasks\User_Feed_Synchronization-{E65DB39B-9B4F-44ED-8CBC-AD64A0F41542}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 08:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
TCP: {55EC9538-3815-45A8-B1AF-D99B783385A2} = 192.168.0.1,192.168.0.1
TCP: {D0BCFE29-2625-4065-9C44-9F66FA744D74} = 24.247.24.53,24.247.15.53
DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - hxxp://activex.camfrogweb.com/advanced/2.0.2.3/cfweb_activex.camfrogweb.com-advanced-2.0.2.3_instmodule.exe
FF - ProfilePath - c:\documents and settings\Dan\Application Data\Mozilla\Firefox\Profiles\xw19c4l2.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.com
FF - component: c:\documents and settings\Dan\Application Data\Mozilla\Firefox\Profiles\xw19c4l2.default\extensions\textlinks@playsushi.com\components\PlaySushiFF.dll
FF - plugin: c:\documents and settings\Dan\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\Dan\Local Settings\Application Data\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npijjiautoinstallpluginff.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npijjiFFPlugin1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - falsec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
AddRemove-ijji.com - c:\ijji\ENGLISH\ijjiUninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-28 17:20
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll nvatabus.sys splt.sys >>UNKNOWN [0x86393938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf74cbf28
\Driver\ACPI -> ACPI.sys @ 0xf7333cb8
\Driver\atapi -> atapi.sys @ 0xf72c8b40
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
NDIS: Linksys LNE100TX Fast Ethernet Adapter(LNE100TX v4) -> SendCompleteHandler -> NDIS.sys @ 0xf71bfb0a
PacketIndicateHandler -> NDIS.sys @ 0xf71caa21
SendHandler -> NDIS.sys @ 0xf71bf949
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(788)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll

- - - - - - - > 'explorer.exe'(4688)
c:\windows\system32\WININET.dll
c:\program files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
c:\program files\TortoiseSVN\bin\TortoiseStub.dll
c:\program files\TortoiseSVN\bin\TortoiseSVN.dll
c:\program files\TortoiseSVN\bin\intl3_tsvn.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Microsoft Virtual PC\VPCShExH.DLL
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\devldr32.exe
c:\program files\TortoiseSVN\bin\TSVNCache.exe
c:\windows\SOUNDMAN.EXE
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\documents and settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE
c:\documents and settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\windows\system32\nvsvc32.exe
.
**************************************************************************
.
Completion time: 2010-03-28 17:24:32 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-28 21:24

Pre-Run: 78,544,080,896 bytes free
Post-Run: 78,710,530,048 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - FB186489E7CE57DBB80CFF71272FE0F5

Hi,


Open notepad and copy/paste the text in the quotebox below into it:



Save this as CFScript.txt





Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you. Post that log in your next reply.

**Note**

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

• Ensure you are connected to the internet and click OK on the message box.

Here u go,

ComboFix 10-03-29.02 - Dan 03/29/2010 18:58:47.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.723 [GMT -4:00]
Running from: c:\documents and settings\Dan\Desktop\schrauber.exe
Command switches used :: c:\documents and settings\Dan\Desktop\CFScript.txt
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

file zipped: c:\windows\Qlurowacehezu.dat
file zipped: c:\windows\xkkxd8283.exe
file zipped: c:\windows\Xvovuyepebehami.bin
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Qlurowacehezu.dat
c:\windows\xkkxd8283.exe
c:\windows\Xvovuyepebehami.bin

.
((((((((((((((((((((((((( Files Created from 2010-02-28 to 2010-03-29 )))))))))))))))))))))))))))))))
.

2010-03-29 22:55 . 2010-03-29 22:57 -------- d-----w- C:\schrauber
2010-03-29 03:30 . 2010-03-29 03:30 -------- d-----w- c:\documents and settings\Dan\Local Settings\Application Data\Club Bing Toolbar
2010-03-29 03:29 . 2010-03-29 03:29 -------- d-----w- c:\program files\Club Bing Toolbar Helper
2010-03-29 03:23 . 2010-03-29 03:29 -------- d-----w- c:\program files\Club Bing Toolbar
2010-03-28 23:57 . 2010-03-28 23:57 -------- d-----w- c:\program files\Web Increaser
2010-03-28 23:05 . 2010-03-28 23:05 658432 ----a-w- c:\program files\Web Increaser V1.0.exe
2010-03-28 19:18 . 2010-03-28 19:18 -------- d-----w- c:\documents and settings\Dan\Application Data\acccore
2010-03-28 19:18 . 2010-03-28 20:01 -------- d-----w- c:\documents and settings\Dan\Local Settings\Application Data\AIM
2010-03-28 19:18 . 2010-03-28 19:18 -------- d-----w- c:\documents and settings\Dan\Local Settings\Application Data\AOL
2010-03-28 19:18 . 2010-03-28 19:18 -------- d-----w- c:\documents and settings\All Users\Application Data\AIM
2010-03-28 19:18 . 2010-03-28 19:18 -------- d-----w- c:\program files\AIM
2010-03-28 19:18 . 2010-03-28 19:18 -------- d-----w- c:\program files\Common Files\AOL
2010-03-28 18:29 . 2010-03-28 21:15 -------- d-----w- c:\program files\PlaySushi
2010-03-27 01:05 . 2010-03-27 01:05 -------- d-----w- c:\program files\Synergy
2010-03-26 00:46 . 2010-03-26 00:58 -------- d-----w- c:\documents and settings\Dan\Application Data\Web Page Maker
2010-03-26 00:46 . 2010-03-26 00:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Web Page Maker
2010-03-26 00:45 . 2010-03-26 00:45 -------- d-----w- c:\program files\Web Page Maker
2010-03-25 02:37 . 2010-03-25 02:37 -------- d-----w- c:\program files\Secunia
2010-03-25 02:04 . 2010-03-25 02:04 -------- d-----w- c:\documents and settings\Dan\Application Data\Yahoo!
2010-03-25 00:41 . 2010-03-25 00:41 -------- d-----w- C:\rei
2010-03-25 00:41 . 2010-03-25 00:41 -------- d-----w- c:\program files\Reimage
2010-03-23 18:28 . 2010-03-23 18:28 -------- d-----w- c:\documents and settings\All Users\Application Data\EPSON
2010-03-23 18:28 . 2007-12-07 01:08 86528 ----a-w- c:\windows\system32\E_FLBEJA.DLL
2010-03-23 18:28 . 2007-12-07 01:01 78848 ----a-w- c:\windows\system32\E_FD4BEJA.DLL
2010-03-23 17:56 . 2008-04-14 02:17 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2010-03-23 17:56 . 2008-04-14 02:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2010-03-21 23:20 . 2010-03-21 23:20 148816 ----a-w- c:\windows\system32\unzip32.dll
2010-03-21 23:20 . 2010-03-21 23:20 53248 ----a-w- c:\windows\system32\quick32.dll
2010-03-18 18:21 . 2008-04-14 00:05 36224 -c--a-w- c:\windows\system32\dllcache\an983.sys
2010-03-18 18:21 . 2008-04-14 00:05 36224 ----a-w- c:\windows\system32\drivers\an983.sys
2010-03-18 17:54 . 2010-03-18 17:54 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2010-03-17 18:06 . 2010-03-17 18:06 -------- d-----w- c:\documents and settings\Dan\.kbotpro
2010-03-12 02:12 . 2010-03-12 02:12 -------- d-----w- c:\windows\system32\wbem\Repository
2010-03-10 02:54 . 2010-03-09 11:12 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-03-10 02:54 . 2010-03-09 11:12 162640 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-03-10 02:54 . 2010-03-09 11:09 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-03-10 02:54 . 2010-03-09 11:08 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-03-10 02:54 . 2010-03-09 11:08 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-03-10 02:54 . 2010-03-09 11:08 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-03-10 02:54 . 2010-03-09 11:08 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-03-10 02:54 . 2010-03-09 11:24 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-03-10 02:54 . 2010-03-09 11:24 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-03-10 02:53 . 2010-03-10 02:53 -------- d-----w- c:\program files\Alwil Software
2010-03-10 02:53 . 2010-03-10 02:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-29 22:06 . 2009-10-18 04:53 -------- d-----w- c:\documents and settings\Dan\Application Data\Camfrog
2010-03-28 21:15 . 2009-11-24 19:32 -------- d-----w- c:\program files\SuperSearch
2010-03-28 06:21 . 2009-11-12 19:49 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-03-28 06:12 . 2009-07-14 19:37 361600 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-03-27 18:12 . 2010-02-12 15:01 -------- d-----w- c:\documents and settings\Dan\Application Data\vlc
2010-03-27 03:42 . 2009-10-17 23:20 -------- d-----w- c:\documents and settings\Dan\Application Data\Azureus
2010-03-25 05:30 . 2009-11-03 04:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-03-25 02:32 . 2009-11-07 15:08 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-03-25 02:23 . 2009-11-07 15:12 -------- d-----w- c:\program files\Common Files\Adobe
2010-03-25 02:22 . 2010-02-07 03:07 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-03-25 02:21 . 2010-03-25 02:21 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-03-25 02:03 . 2009-10-18 05:01 -------- d-----w- c:\program files\Yahoo!
2010-03-24 22:28 . 2009-10-22 02:22 -------- d-----w- c:\documents and settings\Dan\Application Data\DAoC Portal
2010-03-24 22:28 . 2009-10-22 08:59 -------- d-----w- c:\program files\Full Tilt Poker
2010-03-24 19:58 . 2009-10-21 22:35 -------- d-----w- c:\documents and settings\Dan\Application Data\TeamViewer
2010-03-24 18:44 . 2010-01-29 21:33 -------- d-----w- c:\documents and settings\Dan\Application Data\skypePM
2010-03-24 05:17 . 2009-10-23 00:14 -------- d-----w- c:\program files\ClubWPT
2010-03-24 05:17 . 2009-10-23 00:17 -------- d-----w- c:\program files\PokerStars
2010-03-23 03:22 . 2009-12-23 04:18 -------- d-----w- c:\program files\YEpic
2010-03-18 17:41 . 2010-02-01 22:52 -------- d-----w- c:\program files\OUGOMessenger
2010-03-18 17:40 . 2010-02-10 14:53 -------- d-----w- c:\program files\InstaTrader
2010-03-18 17:38 . 2009-10-17 22:47 -------- d-----w- c:\program files\HWiNFO32
2010-03-18 17:37 . 2009-10-31 03:34 -------- d-----w- c:\program files\FarmVilleBot
2010-03-18 17:36 . 2009-11-21 11:38 -------- d-----w- c:\program files\DriftCity
2010-03-18 17:35 . 2010-02-13 20:51 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2010-03-18 02:49 . 2009-10-18 18:38 69 ----a-w- c:\documents and settings\Dan\jagex_runescape_preferences2.dat
2010-03-18 02:28 . 2009-10-18 18:36 41 ----a-w- c:\documents and settings\Dan\jagex_runescape_preferences.dat
2010-03-14 04:42 . 2010-02-13 07:47 -------- d-----w- c:\program files\Simple Port Forwarding
2010-03-14 03:57 . 2009-10-24 06:34 -------- d-----w- c:\documents and settings\Dan\Application Data\FrostWire
2010-03-12 17:07 . 2009-10-22 00:11 -------- d-----w- c:\documents and settings\Dan\Application Data\Tor
2010-03-12 17:07 . 2009-10-22 00:11 -------- d-----w- c:\documents and settings\Dan\Application Data\Vidalia
2010-03-12 17:04 . 2009-10-23 04:02 -------- d-----w- c:\program files\ProxyFirewall
2010-03-12 16:57 . 2010-01-21 04:11 -------- d-----w- c:\program files\CCleaner
2010-02-22 15:10 . 2010-02-22 15:10 188928 ----a-w- c:\documents and settings\Dan\Application Data\Mozilla\Firefox\Profiles\xw19c4l2.default\extensions\textlinks@playsushi.com\components\PlaySushiFF.dll
2010-02-22 15:10 . 2010-02-22 15:10 188928 ----a-w- c:\documents and settings\Dan\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@playsushi.com\components\PlaySushiFF.dll
2010-02-16 03:14 . 2010-02-04 00:32 -------- d-----w- c:\documents and settings\Dan\Application Data\FileZilla
2010-02-14 05:47 . 2009-10-17 22:59 -------- d-----w- c:\program files\Carambis
2010-02-14 05:35 . 2009-10-18 03:16 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-13 20:58 . 2010-02-13 20:58 -------- d-----w- c:\program files\Activision
2010-02-13 20:55 . 2010-02-13 20:50 -------- d-----w- c:\documents and settings\Dan\Application Data\DAEMON Tools Lite
2010-02-13 20:52 . 2010-02-13 20:51 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-02-13 20:51 . 2009-11-10 16:38 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-02-13 20:51 . 2010-02-13 20:50 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2010-02-13 20:38 . 2010-02-13 20:38 -------- d-----w- c:\program files\Alcohol Soft
2010-02-13 07:45 . 2010-02-13 07:41 -------- d-----w- c:\program files\PFConfig
2010-02-13 07:22 . 2010-02-13 07:22 -------- d-----w- c:\program files\PFPortChecker
2010-02-07 20:12 . 2010-02-07 02:37 -------- d-----w- c:\documents and settings\Dan\Application Data\uTorrent
2010-02-07 03:54 . 2010-02-07 03:53 135168 ----a-w- c:\documents and settings\Dan\PatchUpdate.exe
2010-02-07 03:53 . 2010-02-07 03:53 16896 ----a-w- c:\documents and settings\Dan\Network.dll
2010-02-07 03:53 . 2010-02-07 03:53 107008 ----a-w- c:\documents and settings\Dan\Language.dll
2010-02-07 03:53 . 2010-02-07 03:53 23552 ----a-w- c:\documents and settings\Dan\LobbyShared.dll
2010-02-07 03:53 . 2010-02-07 03:53 19456 ----a-w- c:\documents and settings\Dan\CustomPanels.dll
2010-02-07 03:53 . 2010-02-07 03:53 616448 ----a-w- c:\documents and settings\Dan\LobbyClient.exe
2010-02-07 03:53 . 2010-02-07 03:53 1068 ----a-w- c:\documents and settings\Dan\updateinfo.dat
2010-02-07 02:37 . 2010-02-07 02:37 -------- d-----w- c:\program files\uTorrent
2010-02-07 00:54 . 2010-02-06 23:39 21840 ----atw- c:\windows\system32\SIntfNT.dll
2010-02-07 00:54 . 2010-02-06 23:39 17212 ----atw- c:\windows\system32\SIntf32.dll
2010-02-05 15:39 . 2010-02-05 15:39 251376 ----a-w- c:\documents and settings\Dan\Application Data\Mozilla\plugins\npgoogletalk.dll
2010-02-04 23:15 . 2010-02-04 23:15 -------- d-----w- c:\program files\SCAR 3.22
2010-02-04 23:08 . 2009-10-18 04:42 -------- d-sh--r- c:\program files\Microsoft
2010-02-04 00:32 . 2010-02-04 00:32 -------- d-----w- c:\program files\FileZilla FTP Client
2010-02-03 23:21 . 2010-02-03 23:21 1842688 ----a-w- c:\documents and settings\All Users\Application Data\GlobalSCAPE\CuteFTP 8 Professional\ftpte.exe
2010-02-03 23:21 . 2010-02-03 23:21 2830336 ----a-w- c:\documents and settings\All Users\Application Data\GlobalSCAPE\CuteFTP 8 Professional\cuteftppro.exe
2010-02-03 23:11 . 2010-02-03 23:11 -------- d-----w- c:\program files\GlobalSCAPE
2010-02-03 21:04 . 2010-02-03 21:02 -------- d-----w- c:\documents and settings\Dan\Application Data\Inspyder Web2Disk
2010-02-03 20:58 . 2010-02-03 20:58 -------- d-----w- c:\program files\Inspyder Software Inc
2010-02-03 08:40 . 2010-02-03 08:40 -------- d-----w- c:\program files\Common Files\Java
2010-02-03 08:40 . 2009-10-18 05:12 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-02-03 08:39 . 2010-02-03 08:39 -------- d-----w- c:\program files\Java
2010-02-03 00:15 . 2009-10-30 12:10 -------- d-----w- c:\program files\PartyGaming
2010-02-01 01:45 . 2010-02-07 03:08 38784 ----a-w- c:\documents and settings\Dan\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-02-01 01:45 . 2010-02-07 03:07 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-31 00:46 . 2010-01-31 00:46 348160 ----a-w- c:\documents and settings\Dan\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2d8bc946-n\msvcr71.dll
2010-01-31 00:46 . 2010-01-31 00:46 503808 ----a-w- c:\documents and settings\Dan\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2d8bc946-n\msvcp71.dll
2010-01-31 00:46 . 2010-01-31 00:46 499712 ----a-w- c:\documents and settings\Dan\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-2d8bc946-n\jmc.dll
2010-01-31 00:46 . 2010-01-31 00:46 61440 ----a-w- c:\documents and settings\Dan\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-79da30bc-n\decora-sse.dll
2010-01-31 00:46 . 2010-01-31 00:46 12800 ----a-w- c:\documents and settings\Dan\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-79da30bc-n\decora-d3d.dll
2010-01-26 22:35 . 2010-01-26 22:35 1078 ----a-r- c:\documents and settings\Dan\Application Data\Microsoft\Installer\{30BA50ED-0F32-421B-BC6A-132A03EFF299}\ARPPRODUCTICON.exe
2010-01-26 03:18 . 2010-01-26 03:18 4141117 ----a-w- c:\documents and settings\Dan\Application Data\Azureus\plugins\vuzexcode\mediainfo.exe
2010-01-26 03:18 . 2010-01-26 03:18 6516755 ----a-w- c:\documents and settings\Dan\Application Data\Azureus\plugins\vuzexcode\ffmpeg.exe
2010-01-26 01:52 . 2009-12-11 16:54 0 ----a-w- c:\documents and settings\Dan\Local Settings\Application Data\prvlcl.dat
2009-12-31 16:50 . 2009-07-14 19:37 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-11-11 05:03 . 2009-11-11 05:02 1080560 ----a-w- c:\program files\pfsetup.exe
2009-08-18 21:42 . 2009-08-18 21:42 49152 ----a-w- c:\program files\mozilla firefox\components\SuperSearchXPCOM.dll
.

------- Sigcheck -------

[-] 2010-03-28 . FABB60CBF5E1E374B99DE989E6B0F44B . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
[7] 2009-07-14 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
.
((((((((((((((((((((((((((((( SnapShot@2010-03-28_21.19.37 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-29 03:23 . 2010-03-29 03:23 29926 c:\windows\Installer\{A35B36EA-39FE-4AA8-8119-D66B060C9E72}\BingClub.exe
+ 2010-03-29 03:29 . 2010-03-29 03:29 441344 c:\windows\Installer\14f0626.msi
+ 2010-03-29 03:23 . 2010-03-29 03:23 843776 c:\windows\Installer\14f0620.msi
+ 2007-08-27 19:41 . 2007-08-27 19:41 1089440 c:\windows\system32\msidcrl40.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 22:55 85768 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Dan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-12-10 135664]
"cdloader"="c:\documents and settings\Dan\Application Data\mjusbsp\cdloader2.exe" [2009-12-24 50520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
"mmtask"="c:\program files\Musicmatch\Musicmatch Jukebox\mmtask.exe" [2005-05-09 53248]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-03-09 2769336]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

c:\documents and settings\Dan\Start Menu\Programs\Startup\windows
error.txt [2010-3-28 15]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-10-17 813584]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-07-20 16:28 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Privoxy.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Privoxy.lnk
backup=c:\windows\pss\Privoxy.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Dan^Start Menu^Programs^Startup^GomezPEER.lnk]
path=c:\documents and settings\Dan\Start Menu\Programs\Startup\GomezPEER.lnk
backup=c:\windows\pss\GomezPEER.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 12:00 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
2009-06-17 16:55 55824 ----a-w- c:\windows\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
2007-07-25 20:02 563984 ----a-w- c:\program files\Common Files\Logishrd\LComMgr\Communications_Helper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
2007-07-25 20:06 2027792 ----a-w- c:\program files\Logitech\QuickCam\Quickcam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2008-05-16 18:01 13529088 ----a-w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2008-05-16 18:01 86016 ----a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVMixerTray]
2004-06-04 00:51 131072 ----a-w- c:\program files\NVIDIA Corporation\NvMixer\NvMixerTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2008-05-16 18:01 1630208 ----a-w- c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WZCSVC"=2 (0x2)
"WmiApSrv"=3 (0x3)
"WmdmPmSN"=3 (0x3)
"TermService"=3 (0x3)
"TapiSrv"=3 (0x3)
"SysmonLog"=3 (0x3)
"seclogon"=2 (0x2)
"RemoteRegistry"=2 (0x2)
"RDSessMgr"=3 (0x3)
"RasMan"=3 (0x3)
"RasAuto"=3 (0x3)
"Netlogon"=3 (0x3)
"mnmsrvc"=3 (0x3)
"LBTServ"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"helpsvc"=2 (0x2)
"FontCache3.0.0.0"=3 (0x3)
"BITS"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Camfrog\\Camfrog Video Chat\\Camfrog Video Chat.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\ijji\\ijji REACTOR\\REACTOR.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
"c:\\Documents and Settings\\Dan\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\Dan\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Documents and Settings\\Dan\\Application Data\\mjusbsp\\magicJack.exe"=
"c:\\Documents and Settings\\Dan\\My Documents\\Downloads\\SoftVox v11_cracked_by_kracker-gg-packed\\SoftVox v11_cracked_by_kracker-gg\\SoftVox v11_cracked_by_kracker-gg.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\eeaoc\\Empire Earth - The Art of Conquest\\EE-AOC.exe"=
"c:\\Program Files\\Activision\\Modern Warfare 2\\iw4mp.exe"=
"c:\\Program Files\\AIM\\aim.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"33334:UDP"= 33334:UDP:SPF Port 33334 UDP
"33335:TCP"= 33335:TCP:SPF Port 33335 TCP
"33336:TCP"= 33336:TCP:SPF Port 33336 TCP

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [11/10/2009 12:38 PM 691696]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [3/9/2010 10:54 PM 162640]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [3/9/2010 10:54 PM 19024]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [10/17/2009 11:21 PM 10384]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [1/14/2008 6:06 AM 21632]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [6/17/2009 8:20 AM 12648]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\drivers\VBoxNetAdp.sys [10/18/2009 5:25 PM 94992]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys --> c:\windows\system32\DRIVERS\VBoxNetFlt.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2010-03-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-1935655697-1547161642-1003Core.job
- c:\documents and settings\Dan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-12-10 22:28]

2010-03-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-1935655697-1547161642-1003UA.job
- c:\documents and settings\Dan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-12-10 22:28]

2010-03-29 c:\windows\Tasks\User_Feed_Synchronization-{E65DB39B-9B4F-44ED-8CBC-AD64A0F41542}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 08:31]
.
.
------- Supplementary Scan -------
.
TCP: {55EC9538-3815-45A8-B1AF-D99B783385A2} = 192.168.0.1,192.168.0.1
TCP: {D0BCFE29-2625-4065-9C44-9F66FA744D74} = 24.247.24.53,24.247.15.53
DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - hxxp://activex.camfrogweb.com/advanced/2.0.2.3/cfweb_activex.camfrogweb.com-advanced-2.0.2.3_instmodule.exe
FF - ProfilePath - c:\documents and settings\Dan\Application Data\Mozilla\Firefox\Profiles\xw19c4l2.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.com
FF - component: c:\documents and settings\Dan\Application Data\Mozilla\Firefox\Profiles\xw19c4l2.default\extensions\textlinks@playsushi.com\components\PlaySushiFF.dll
FF - plugin: c:\documents and settings\Dan\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\Dan\Local Settings\Application Data\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npijjiautoinstallpluginff.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npijjiFFPlugin1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - falsec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-29 19:08
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll nvatabus.sys spjv.sys >>UNKNOWN [0x86393938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf74cbf28
\Driver\ACPI -> ACPI.sys @ 0xf7333cb8
\Driver\atapi -> atapi.sys @ 0xf72c8b40
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a05a9
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
NDIS: Linksys LNE100TX Fast Ethernet Adapter(LNE100TX v4) -> SendCompleteHandler -> NDIS.sys @ 0xf71bfb0a
PacketIndicateHandler -> NDIS.sys @ 0xf71caa21
SendHandler -> NDIS.sys @ 0xf71bf949
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(788)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll

- - - - - - - > 'explorer.exe'(4444)
c:\windows\system32\WININET.dll
c:\program files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
c:\program files\TortoiseSVN\bin\TortoiseStub.dll
c:\program files\TortoiseSVN\bin\TortoiseSVN.dll
c:\program files\TortoiseSVN\bin\intl3_tsvn.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Microsoft Virtual PC\VPCShExH.DLL
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\devldr32.exe
c:\program files\TortoiseSVN\bin\TSVNCache.exe
c:\windows\SOUNDMAN.EXE
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\documents and settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE
c:\documents and settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\windows\system32\nvsvc32.exe
.
**************************************************************************
.
Completion time: 2010-03-29 19:13:49 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-29 23:13
ComboFix2.txt 2010-03-28 21:24

Pre-Run: 78,605,205,504 bytes free
Post-Run: 78,615,142,400 bytes free

- - End Of File - - A2926C1C8C98E2D606C2C7CCB446F71A

Hi,

Please navigate to C:\Qoobox and post back with the content of

ComboFix-quarantined-files.txt






Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
• If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
• Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
• Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

1. Please download OTL from one of the following mirrors:
   • This is THE Mirror
2. Save it to your desktop.
3. Double click on the icon on your desktop.
4. Under the Custom Scan box paste this in
   netsvcs
   %SYSTEMDRIVE%\*.exe
   safebootminimal
   safebootnetwork
   /md5start
   eventlog.dll
   scecli.dll
   netlogon.dll
   cngaudit.dll
   sceclt.dll
   ntelogon.dll
   logevent.dll
   iaStor.sys
   nvstor.sys
   atapi.sys
   IdeChnDr.sys
   viasraid.sys
   AGP440.sys
   vaxscsi.sys
   nvatabus.sys
   viamraid.sys
   nvata.sys
   nvgts.sys
   iastorv.sys
   ViPrt.sys
   eNetHook.dll
   ahcix86.sys
   KR10N.sys
   /md5stop
   %systemroot%\*. /mp /s
   CREATERESTOREPOINT
5. Push the Quick Scan button.
6. Two reports will open, copy and paste them in a reply here:
   • OTL.txt <-- Will be opened
   • Extra.txt <-- Will be minimized

2010-03-29 22:58:43 . 2010-03-29 22:58:43 33,143 ----a-w- C:\Qoobox\Quarantine\[4]-Submit_2010-03-29_18.58.37.zip
2010-03-28 21:23:48 . 2010-03-28 21:23:48 518 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-ijji.com.reg.dat
2010-03-28 21:23:27 . 2010-03-28 21:23:27 622 ----a-w- C:\Qoobox\Quarantine\Registry_backups\MSConfigStartUp-SunJavaUpdateSched.reg.dat
2010-03-28 21:23:06 . 2010-03-28 21:23:07 171 ----a-w- C:\Qoobox\Quarantine\Registry_backups\WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440}.reg.dat
2010-03-28 21:14:39 . 2010-03-28 21:14:39 790 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_SSHNAS.reg.dat
2010-03-28 21:14:20 . 2010-03-29 23:04:35 7,206 ----a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg
2010-03-28 21:03:21 . 2010-03-29 22:57:24 204 ----a-w- C:\Qoobox\Quarantine\catchme.log
2010-03-28 18:29:59 . 2010-03-28 18:29:59 292,864 ----a-w- C:\Qoobox\Quarantine\C\Program Files\PlaySushi\PSText.dll.vir
2010-03-25 05:39:13 . 2010-03-25 05:39:13 315,392 ----a-w- C:\Qoobox\Quarantine\C\PROGRA~1\SUPERS~1\13SUPE~1.DLL.vir
2010-02-14 21:05:02 . 2010-02-14 21:05:02 4 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\a3kebook.ini.vir
2010-02-14 21:05:02 . 2010-02-14 21:05:02 20 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\akebook.ini.vir
2010-02-14 21:05:02 . 2010-02-14 21:05:10 62 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\ANS2000.INI.vir
2010-02-06 23:39:42 . 2010-02-07 00:54:31 12,067 ----atw- C:\Qoobox\Quarantine\C\WINDOWS\system32\SIntf16.dll.vir
2010-02-06 23:27:27 . 2010-02-06 23:27:27 6,778 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Local Settings\Application Data\{7B44E188-2FB9-44FA-BAC6-CA1A7189DC67}\chrome\content\overlay.xul.vir
2010-02-06 23:27:27 . 2010-02-06 23:27:27 2,028 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Local Settings\Application Data\{7B44E188-2FB9-44FA-BAC6-CA1A7189DC67}\chrome\content\_cfg.js.vir
2010-02-06 23:27:27 . 2010-02-06 23:27:27 764 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Local Settings\Application Data\{7B44E188-2FB9-44FA-BAC6-CA1A7189DC67}\install.rdf.vir
2010-02-06 23:27:27 . 2010-02-06 23:27:27 122 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Administrator\Local Settings\Application Data\{7B44E188-2FB9-44FA-BAC6-CA1A7189DC67}\chrome.manifest.vir
2010-01-19 06:43:57 . 2010-02-07 18:57:46 0 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\Xvovuyepebehami.bin.vir
2010-01-19 06:43:56 . 2010-02-07 21:23:32 120 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\Qlurowacehezu.dat.vir
2010-01-19 06:43:54 . 2010-01-19 06:43:54 6,778 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Dan\Local Settings\Application Data\{0A36F6B3-A26F-4764-A43A-8022823B6FEC}\chrome\content\overlay.xul.vir
2010-01-19 06:43:54 . 2010-01-19 06:43:55 2,028 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Dan\Local Settings\Application Data\{0A36F6B3-A26F-4764-A43A-8022823B6FEC}\chrome\content\_cfg.js.vir
2010-01-19 06:43:54 . 2010-01-19 06:43:54 764 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Dan\Local Settings\Application Data\{0A36F6B3-A26F-4764-A43A-8022823B6FEC}\install.rdf.vir
2010-01-19 06:43:53 . 2010-01-19 06:43:53 122 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Dan\Local Settings\Application Data\{0A36F6B3-A26F-4764-A43A-8022823B6FEC}\chrome.manifest.vir
2010-01-19 06:41:24 . 2010-03-28 21:03:07 274 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job.vir
2010-01-19 06:40:00 . 2010-01-19 06:40:00 41,472 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\xkkxd8283.exe.vir
2009-11-21 14:04:59 . 2009-10-07 20:15:53 92 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\install.bat.vir
2009-04-09 11:32:40 . 2009-04-09 11:32:40 89,088 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Dan\Application Data\Desktopicon\eBayShortcuts.exe.vir



Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Database version: 3944

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

4/1/2010 4:10:39 PM
mbam-log-2010-04-01 (16-10-39).txt

Scan type: Quick scan
Objects scanned: 107260
Time elapsed: 11 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 13
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 5
Files Infected: 8

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{26o57584-2k5t-71b7-b177-rmg86517djqh} (Generic.Bot.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0ed403e8-470a-4a8a-85a4-d7688cfe39a3} (Adware.Gamevance) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{0ed403e8-470a-4a8a-85a4-d7688cfe39a3} (Adware.Gamevance) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Noobs (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Installr (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Installr\1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Installr\Cache (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Installr\setups (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\Dan\My Documents\downloads\SmartDownload(2).exe (Adware.Casino) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dan\My Documents\downloads\SmartDownload.exe (Adware.Casino) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dan\My Documents\downloads\WebfettiSetup2.3.50.57.ZKfox000.exe (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Installr\1.bin\F3EZSETP.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Installr\1.bin\F3PLUGIN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Installr\1.bin\NPFUNWEB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Installr\Cache\0118BBFB.exe (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Installr\Cache\files.ini (Adware.MyWebSearch) -> Quarantined and deleted successfully.


Rebooting and getting OTL next.


OTL logfile created on: 4/1/2010 4:18:36 PM - Run 1
OTL by OldTimer - Version 3.1.37.3 Folder = C:\Documents and Settings\Dan\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,023.00 Mb Total Physical Memory | 648.00 Mb Available Physical Memory | 63.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 90.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 72.46 Gb Free Space | 31.12% Space Free | Partition Type: NTFS
Drive D: | 74.52 Gb Total Space | 5.85 Gb Free Space | 7.85% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DANSDESKTOP
Current User Name: Dan
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/04/01 16:17:29 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Dan\My Documents\Downloads\OTL.exe
PRC - [2010/03/24 01:21:57 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/03/09 07:24:10 | 002,769,336 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2010/03/09 07:24:08 | 000,040,384 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2009/08/20 12:44:38 | 000,615,688 | ---- | M] (http://tortoisesvn.net) -- C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
PRC - [2009/07/20 12:30:50 | 000,813,584 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPoint\SetPoint.exe
PRC - [2009/07/10 12:42:32 | 000,055,824 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
PRC - [2008/04/14 08:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/12/16 23:00:00 | 000,143,872 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE
PRC - [2007/07/20 00:40:48 | 000,137,752 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
PRC - [2007/07/20 00:38:54 | 000,186,904 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\Logishrd\LVCOMSER\LVComSer.exe
PRC - [2007/04/16 15:28:22 | 000,577,536 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\soundman.exe
PRC - [2007/01/10 23:02:00 | 000,113,664 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
PRC - [2001/08/31 13:44:30 | 000,025,600 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\system32\devldr32.exe


========== Modules (SafeList) ==========

MOD - [2010/04/01 16:17:29 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Dan\My Documents\Downloads\OTL.exe
MOD - [2009/07/20 12:29:06 | 000,045,584 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPoint\lgscroll.dll
MOD - [2009/07/12 02:12:06 | 000,632,656 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll
MOD - [2007/07/20 00:40:36 | 000,113,176 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll


========== Win32 Services (SafeList) ==========

SRV - [2010/03/09 07:24:08 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010/03/09 07:24:08 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010/03/09 07:24:08 | 000,040,384 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2009/09/19 14:46:00 | 003,474,384 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\WINDOWS\System32\GameMon.des -- (npggsvc)
SRV - [2009/07/20 12:28:10 | 000,121,360 | ---- | M] (Logitech, Inc.) [Disabled | Stopped] -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2007/12/16 23:00:00 | 000,143,872 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE -- (EPSON_EB_RPCV4_01) EPSON V5 Service4(01)
SRV - [2007/07/20 00:42:30 | 000,141,848 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\Logishrd\SrvLnch\SrvLnch.exe -- (LVSrvLauncher)
SRV - [2007/07/20 00:40:48 | 000,137,752 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2007/07/20 00:38:54 | 000,186,904 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe -- (LVCOMSer)
SRV - [2007/05/28 12:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) [Auto | Stopped] -- C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)
SRV - [2007/01/10 23:02:00 | 000,113,664 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE -- (EPSON_PM_RPCV4_01) EPSON V3 Service4(01)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://google.com"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0


FF - HKLM\software\mozilla\Mozilla Firefox 3.6.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/03/24 01:22:02 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/03/28 15:30:01 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird

[2010/03/11 23:00:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\Mozilla\Extensions
[2010/03/31 23:44:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\xw19c4l2.default\extensions
[2010/03/11 23:01:58 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\xw19c4l2.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/03/31 23:44:13 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009/08/18 17:42:10 | 000,049,152 | ---- | M] () -- C:\Program Files\Mozilla Firefox\components\SuperSearchXPCOM.dll
[2009/07/03 01:34:44 | 000,083,376 | ---- | M] (NHN USA Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npijjiautoinstallpluginff.dll
[2009/08/17 08:42:14 | 000,073,728 | ---- | M] (NHN USA Inc. ) -- C:\Program Files\Mozilla Firefox\plugins\npijjiFFPlugin1.dll
[2010/03/14 01:40:39 | 000,002,643 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\SiteVacuum.xml

O1 HOSTS File: ([2010/03/29 19:07:43 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Club Bing Toolbar Helper) - {B771FEA3-2A05-4c21-B1E2-55551A97D520} - C:\Program Files\Club Bing Toolbar Helper\Bmbho.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Club Bing Toolbar) - {719D74AB-1AF9-43A1-8C62-D8750628D93E} - C:\Program Files\Club Bing Toolbar\Toolbar.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Club Bing Toolbar Helper) - {B771FEA3-2A05-4c21-B1E2-55551A97D520} - C:\Program Files\Club Bing Toolbar Helper\Bmbho.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Club Bing Toolbar) - {719D74AB-1AF9-43A1-8C62-D8750628D93E} - C:\Program Files\Club Bing Toolbar\Toolbar.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Club Bing Toolbar Helper) - {B771FEA3-2A05-4C21-B1E2-55551A97D520} - C:\Program Files\Club Bing Toolbar Helper\Bmbho.dll (Microsoft Corporation)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ALWIL Software)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)
O4 - HKCU..\Run: [cdloader] C:\Documents and Settings\Dan\Application Data\mjusbsp\cdloader2.exe (magicJack L.P.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
O4 - Startup: C:\Documents and Settings\Dan\Start Menu\Programs\Startup\windows [2010/03/28 19:58:26 | 000,000,000 | RHSD | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found
O15 - HKCU\..Trusted Ranges: Range1979 ([http] in Trusted sites)
O16 - DPF: {0B195D55-0AB4-48C7-828F-34BE10BA4266} http://www.worldwinner.com/games/v53/dealo...ealornodeal.cab (DealOrNoDeal Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} http://activex.camfrogweb.com/advanced/2.0..._instmodule.exe (CamfrogWEB Advanced Unicode Control)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/MessengerGam...1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu...b?1256872840765 (MUWebControl Class)
O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} http://zone.msn.com/bingame/zpagames/GAME_UNO1.cab60096.cab (UnoCtrl Class)
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} http://www.worldwinner.com/games/shared/wwlaunch.cab (Wwlaunch Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} http://appdirectory.messenger.msn.com/AppD...ap/PhtPkMSN.cab (PhotoPickConvert Class)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/...k.cab102118.cab (MSN Games - Installer)
O16 - DPF: {BA35B9B8-DE9E-47C9-AFA7-3C77E3DDFD39} http://www.worldwinner.com/games/v46/monopoly/monopoly.cab (Monopoly Control)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx1.hotmail.com/mail/w4/pr01/photo...ol/MSNPUpld.cab (Windows Live Hotmail Photo Upload Tool)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/10/17 07:25:32 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2009/10/17 07:24:44 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vga.sys - Driver
SafeBootMin: WdfLoadGroup -
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: WdfLoadGroup -
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (13795611048411136)

========== Files/Folders - Created Within 14 Days ==========

[2010/04/01 15:57:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Application Data\Malwarebytes
[2010/04/01 15:57:33 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/04/01 15:57:31 | 000,020,824 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/04/01 15:57:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/04/01 15:57:30 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/03/31 23:44:29 | 000,000,000 | ---D | C] -- C:\7a218fe861a1861a0de5ff
[2010/03/31 23:06:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Application Data\EyeballChatAvatars
[2010/03/31 22:29:18 | 000,000,000 | ---D | C] -- C:\dbcbf27d75784b9827fde2b3
[2010/03/31 22:20:07 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/03/31 21:25:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\My Documents\EyeballMessageArchive
[2010/03/31 21:17:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Application Data\EyeballChatUserData
[2010/03/31 21:14:09 | 000,000,000 | ---D | C] -- C:\Program Files\Eyeball Networks
[2010/03/31 17:21:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Desktop\Swagbucks Autosearch
[2010/03/31 17:15:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Desktop\MultiSpeed 2.3.1
[2010/03/30 16:40:54 | 000,000,000 | ---D | C] -- C:\Program Files\AdCalls
[2010/03/29 19:13:53 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2010/03/29 18:55:05 | 000,000,000 | ---D | C] -- C:\schrauber
[2010/03/28 23:30:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Local Settings\Application Data\Club Bing Toolbar
[2010/03/28 23:29:38 | 000,000,000 | ---D | C] -- C:\Program Files\Club Bing Toolbar Helper
[2010/03/28 23:23:30 | 000,000,000 | ---D | C] -- C:\Program Files\Club Bing Toolbar
[2010/03/28 19:57:08 | 000,000,000 | RHSD | C] -- C:\Documents and Settings\Dan\Start Menu\Programs\Startup\windows
[2010/03/28 19:57:05 | 000,000,000 | ---D | C] -- C:\Program Files\Web Increaser
[2010/03/28 17:04:27 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/03/28 17:03:32 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/03/28 17:03:32 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/03/28 17:03:32 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/03/28 17:03:32 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/03/28 17:03:21 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/03/28 17:00:54 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/03/28 15:56:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\My Documents\AIMLogger
[2010/03/28 15:18:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Application Data\acccore
[2010/03/28 15:18:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Local Settings\Application Data\AIM
[2010/03/28 15:18:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Local Settings\Application Data\AOL
[2010/03/28 15:18:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AIM
[2010/03/28 15:18:11 | 000,000,000 | ---D | C] -- C:\Program Files\AIM
[2010/03/28 15:18:08 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\AOL
[2010/03/26 21:05:52 | 000,000,000 | ---D | C] -- C:\Program Files\Synergy
[2010/03/26 19:36:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\synergy
[2010/03/25 20:46:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\My Documents\Web Page Maker
[2010/03/25 20:46:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Application Data\Web Page Maker
[2010/03/25 20:46:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Web Page Maker
[2010/03/25 20:45:33 | 000,000,000 | ---D | C] -- C:\Program Files\Web Page Maker
[2010/03/24 22:37:17 | 000,000,000 | ---D | C] -- C:\Program Files\Secunia
[2010/03/24 22:22:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9 Installer
[2010/03/24 22:04:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Application Data\Yahoo!
[2010/03/24 20:41:56 | 000,000,000 | ---D | C] -- C:\rei
[2010/03/24 20:41:52 | 000,000,000 | ---D | C] -- C:\Program Files\Reimage
[2010/03/23 14:28:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\EPSON
[2010/03/23 14:28:25 | 000,086,528 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\System32\E_FLBEJA.DLL
[2010/03/23 14:28:25 | 000,078,848 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\System32\E_FD4BEJA.DLL
[2010/03/21 19:20:28 | 000,148,816 | ---- | C] (Info-ZIP) -- C:\WINDOWS\System32\unzip32.dll
[2010/03/21 02:18:50 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Dan\Recent
[2010/01/25 22:35:53 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2010/01/25 22:35:53 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2010/01/25 22:35:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2010/01/25 22:35:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2009/11/11 01:02:54 | 001,080,560 | ---- | C] (Unique Internet Services ) -- C:\Program Files\pfsetup.exe
[2009/10/25 04:38:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ESET
[1998/10/14 16:03:00 | 000,059,392 | ---- | C] ( ) -- C:\WINDOWS\System32\a3d.dll
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 14 Days ==========

[2010/04/01 16:13:29 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/04/01 16:13:12 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/04/01 16:13:03 | 000,186,097 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2010/04/01 16:12:53 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/04/01 16:12:50 | 1073,274,880 | -HS- | M] () -- C:\hiberfil.sys
[2010/04/01 16:12:25 | 007,602,176 | ---- | M] () -- C:\Documents and Settings\Dan\ntuser.dat
[2010/04/01 16:12:17 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Dan\ntuser.ini
[2010/04/01 15:57:36 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/04/01 15:35:04 | 000,000,418 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{E65DB39B-9B4F-44ED-8CBC-AD64A0F41542}.job
[2010/04/01 15:27:05 | 000,000,970 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-1935655697-1547161642-1003UA.job
[2010/04/01 13:01:49 | 000,097,456 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/03/31 23:44:00 | 000,490,040 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/03/31 23:44:00 | 000,433,718 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/03/31 23:44:00 | 000,067,714 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/03/31 23:22:31 | 000,006,524 | ---- | M] () -- C:\Documents and Settings\Dan\My Documents\sc_config_eyeballchat.xml
[2010/03/31 23:22:27 | 000,002,423 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Eyeball Chat.lnk
[2010/03/31 17:27:01 | 000,000,918 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-1935655697-1547161642-1003Core.job
[2010/03/31 14:27:13 | 000,000,041 | ---- | M] () -- C:\Documents and Settings\Dan\jagex_runescape_preferences.dat
[2010/03/31 14:27:11 | 000,000,069 | ---- | M] () -- C:\Documents and Settings\Dan\jagex_runescape_preferences2.dat
[2010/03/31 14:12:22 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Dan\jagex__preferences3.dat
[2010/03/30 16:41:34 | 000,001,521 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AdCalls.lnk
[2010/03/29 19:50:11 | 000,001,086 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Shortcut to Voice Controller 17_cracked_by_kracker-gg.exe.lnk
[2010/03/29 19:08:05 | 000,000,318 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/03/29 19:07:43 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/03/29 18:56:40 | 003,905,917 | R--- | M] () -- C:\Documents and Settings\Dan\Desktop\schrauber.exe
[2010/03/29 15:24:58 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/03/29 15:24:46 | 000,020,824 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/03/28 19:57:05 | 000,000,623 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Web Increaser.lnk
[2010/03/28 19:05:32 | 000,658,432 | ---- | M] () -- C:\Program Files\Web Increaser V1.0.exe
[2010/03/28 17:04:37 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2010/03/28 15:18:25 | 000,000,458 | -H-- | M] () -- C:\IPH.PH
[2010/03/28 15:18:18 | 000,001,574 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AIM.lnk
[2010/03/27 22:08:56 | 000,000,250 | ---- | M] () -- C:\Documents and Settings\Dan\My Documents\synergy.sgc
[2010/03/26 23:46:44 | 000,020,480 | ---- | M] () -- C:\Documents and Settings\Dan\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/03/26 21:05:53 | 000,001,542 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Synergy.lnk
[2010/03/26 19:19:53 | 000,135,168 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\darkvcdom.exe
[2010/03/26 12:32:01 | 000,000,805 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Shortcut to ProxyGrabber.exe.lnk
[2010/03/25 20:45:36 | 000,000,710 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Web Page Maker.lnk
[2010/03/25 14:03:48 | 000,001,058 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Shortcut to Room Domination 13 Cracked by Diablo1337.exe.lnk
[2010/03/25 01:30:07 | 000,001,537 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/03/24 22:37:19 | 000,000,716 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Secunia PSI.lnk
[2010/03/24 22:03:25 | 000,000,802 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Yahoo! Messenger.lnk
[2010/03/24 20:41:57 | 000,001,715 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Reimage Repair.lnk
[2010/03/24 01:17:25 | 000,001,478 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\ClubWPT.lnk
[2010/03/23 23:35:49 | 000,001,516 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Shortcut to The Voice Domination 4.5.exe.lnk
[2010/03/23 14:24:06 | 000,000,601 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/03/23 14:24:06 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010/03/23 11:25:19 | 000,001,824 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Camfrog Video Chat 5.5.lnk
[2010/03/22 16:47:48 | 000,000,942 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Shortcut to CLDL.exe.lnk
[2010/03/21 19:20:29 | 000,148,816 | ---- | M] (Info-ZIP) -- C:\WINDOWS\System32\unzip32.dll
[2010/03/21 19:20:28 | 000,053,248 | ---- | M] () -- C:\WINDOWS\System32\quick32.dll
[2010/03/21 11:43:34 | 000,000,494 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Shortcut to Empire Earth.exe.lnk
[2010/03/20 11:48:02 | 000,000,170 | ---- | M] () -- C:\Documents and Settings\Dan\defogger_reenable
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/04/01 15:57:36 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/03/31 22:32:50 | 000,066,416 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/03/31 21:16:31 | 000,006,524 | ---- | C] () -- C:\Documents and Settings\Dan\My Documents\sc_config_eyeballchat.xml
[2010/03/31 21:14:16 | 000,002,423 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Eyeball Chat.lnk
[2010/03/31 14:12:22 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Dan\jagex__preferences3.dat
[2010/03/30 16:41:34 | 000,001,521 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\AdCalls.lnk
[2010/03/30 16:41:34 | 000,000,026 | ---- | C] () -- C:\WINDOWS\System32\contacts.csv
[2010/03/29 19:50:11 | 000,001,086 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Shortcut to Voice Controller 17_cracked_by_kracker-gg.exe.lnk
[2010/03/28 19:57:05 | 000,000,623 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Web Increaser.lnk
[2010/03/28 19:05:32 | 000,658,432 | ---- | C] () -- C:\Program Files\Web Increaser V1.0.exe
[2010/03/28 17:04:37 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/03/28 17:04:31 | 000,260,272 | ---- | C] () -- C:\cmldr
[2010/03/28 17:03:32 | 000,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/03/28 17:03:32 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/03/28 17:03:32 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/03/28 17:03:32 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/03/28 17:03:32 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/03/28 16:57:33 | 003,905,917 | R--- | C] () -- C:\Documents and Settings\Dan\Desktop\schrauber.exe
[2010/03/28 15:18:18 | 000,001,574 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\AIM.lnk
[2010/03/28 15:17:43 | 000,000,458 | -H-- | C] () -- C:\IPH.PH
[2010/03/27 21:38:18 | 000,000,250 | ---- | C] () -- C:\Documents and Settings\Dan\My Documents\synergy.sgc
[2010/03/26 21:05:53 | 000,001,542 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Synergy.lnk
[2010/03/26 19:19:47 | 000,135,168 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\darkvcdom.exe
[2010/03/26 12:32:01 | 000,000,805 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Shortcut to ProxyGrabber.exe.lnk
[2010/03/25 20:45:36 | 000,000,710 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Web Page Maker.lnk
[2010/03/25 14:03:48 | 000,001,058 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Shortcut to Room Domination 13 Cracked by Diablo1337.exe.lnk
[2010/03/24 22:37:19 | 000,000,716 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Secunia PSI.lnk
[2010/03/24 22:23:38 | 000,001,537 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/03/24 22:03:25 | 000,000,802 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Yahoo! Messenger.lnk
[2010/03/24 20:41:57 | 000,001,715 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Reimage Repair.lnk
[2010/03/23 23:35:49 | 000,001,516 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Shortcut to The Voice Domination 4.5.exe.lnk
[2010/03/23 11:25:19 | 000,001,824 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Camfrog Video Chat 5.5.lnk
[2010/03/22 16:47:48 | 000,000,942 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Shortcut to CLDL.exe.lnk
[2010/03/21 19:20:28 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\quick32.dll
[2010/03/21 11:43:34 | 000,000,494 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Shortcut to Empire Earth.exe.lnk
[2010/03/20 11:48:00 | 000,000,170 | ---- | C] () -- C:\Documents and Settings\Dan\defogger_reenable
[2010/02/06 19:42:49 | 000,000,479 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2010/02/06 19:39:42 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll
[2010/02/06 19:39:42 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll
[2010/02/04 19:15:17 | 000,688,128 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
[2010/02/04 19:15:17 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll
[2010/01/19 02:59:52 | 000,002,554 | ---- | C] () -- C:\WINDOWS\WAVEMIX.INI
[2010/01/19 00:43:45 | 000,000,836 | ---- | C] () -- C:\WINDOWS\cdPlayer.ini
[2009/12/14 10:35:08 | 001,380,403 | ---- | C] () -- C:\WINDOWS\System32\avgsdk.dll
[2009/12/11 12:54:46 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Dan\Local Settings\Application Data\prvlcl.dat
[2009/11/21 10:04:59 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\aesma.dll
[2009/11/21 09:29:15 | 000,000,033 | ---- | C] () -- C:\WINDOWS\GunzLauncher.INI
[2009/11/14 16:52:34 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\Dan\Local Settings\Application Data\PUTTY.RND
[2009/11/10 12:38:05 | 000,691,696 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2009/10/20 05:18:53 | 000,020,480 | ---- | C] () -- C:\Documents and Settings\Dan\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/10/18 16:50:22 | 000,034,308 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
[2009/10/18 15:32:26 | 000,941,784 | ---- | C] () -- C:\WINDOWS\System32\drivers\CAMTHWDM.sys
[2009/10/18 14:42:44 | 000,000,075 | ---- | C] () -- C:\Documents and Settings\Dan\Application Data\RSBot Accounts.ini
[2009/10/18 03:11:03 | 000,058,163 | R--- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2009/10/18 00:04:20 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2009/10/17 23:07:42 | 000,000,069 | ---- | C] () -- C:\WINDOWS\SBWIN.INI
[2009/10/17 19:00:06 | 000,004,940 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\mtbjfghn.xbe
[2008/08/14 19:08:50 | 000,209,001 | ---- | C] () -- C:\WINDOWS\System32\malauA07_07.dll
[2008/06/05 00:50:18 | 000,208,997 | ---- | C] () -- C:\WINDOWS\System32\MyCfHook8.dll
[2008/06/03 08:08:48 | 000,208,996 | ---- | C] () -- C:\WINDOWS\System32\MuteHook5.dll
[2008/05/16 14:01:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2008/05/16 14:01:00 | 001,486,848 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2008/05/16 14:01:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2008/05/16 14:01:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2008/05/16 14:01:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2008/05/05 14:22:44 | 000,209,007 | ---- | C] () -- C:\WINDOWS\System32\SlickMix5.dll
[2007/07/18 17:42:42 | 000,025,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2007/03/01 17:50:22 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\yacsui.dll

========== LOP Check ==========

[2010/03/28 15:18:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AIM
[2010/03/09 22:53:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2009/10/17 19:20:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Azureus
[2010/02/13 16:51:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
[2009/11/10 12:41:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Pro
[2009/10/17 21:05:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DriverScanner
[2010/03/23 14:28:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EPSON
[2009/10/17 21:56:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ESET
[2009/10/26 08:32:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GlobalSCAPE
[2009/11/20 08:34:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ijjigame
[2009/10/17 19:56:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Innovative Solutions
[2009/10/29 22:22:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sony
[2009/10/18 17:08:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TechSmith
[2010/03/28 02:21:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/03/25 20:46:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Web Page Maker
[2009/12/22 23:34:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\.purple
[2010/03/28 15:18:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\acccore
[2010/03/26 23:42:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\Azureus
[2010/03/31 11:51:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\Camfrog
[2009/12/18 00:51:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\CamfrogWEB
[2010/02/13 16:55:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\DAEMON Tools Lite
[2009/11/10 12:52:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\DAEMON Tools Pro
[2010/03/24 18:28:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\DAoC Portal
[2009/10/21 22:41:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\Electronic Arts
[2009/10/17 21:58:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\ESET
[2010/03/31 23:06:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\EyeballChatAvatars
[2010/03/31 21:24:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\EyeballChatUserData
[2010/02/15 23:14:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\FileZilla
[2010/03/13 23:57:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\FrostWire
[2009/10/26 08:32:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\GlobalSCAPE
[2009/11/21 10:04:45 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\Dan\Application Data\ijjigame
[2009/10/18 18:25:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\ImgBurn
[2010/02/03 17:04:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\Inspyder Web2Disk
[2009/10/17 23:21:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\Leadertech
[2010/01/21 00:22:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\ManyCam
[2010/01/25 00:06:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\mjusbsp
[2010/01/19 00:11:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\Musicmatch
[2009/10/29 22:37:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\Publish Providers
[2009/10/29 23:09:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\Sony
[2009/10/18 12:43:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\Subversion
[2010/03/29 22:55:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\TeamViewer
[2009/10/17 08:10:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\Uniblue
[2010/02/07 16:12:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\uTorrent
[2010/03/25 20:58:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\Web Page Maker
[2009/10/18 15:44:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\Webcammax
[2010/04/01 15:35:04 | 000,000,418 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{E65DB39B-9B4F-44ED-8CBC-AD64A0F41542}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >
[2002/10/01 13:05:16 | 006,251,008 | R--- | M] () -- C:\EE-AOC.exe


< MD5 for: AGP440.SYS >
[2009/07/14 15:54:37 | 017,778,242 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys

< MD5 for: ATAPI.SYS >
[2009/07/14 15:54:37 | 017,778,242 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\Documents and Settings\Dan\Desktop\Pc repair stuff\laptop\Copy of mydrivers\hdc\primary_ide_channel\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\Documents and Settings\Dan\Desktop\Pc repair stuff\laptop\Copy of mydrivers\hdc\secondary_ide_channel\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\Documents and Settings\Dan\Desktop\Pc repair stuff\laptop\Dans Installers on Laptop (Danslaptop)\mydrivers\hdc\primary_ide_channel\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\Documents and Settings\Dan\Desktop\Pc repair stuff\laptop\Dans Installers on Laptop (Danslaptop)\mydrivers\hdc\secondary_ide_channel\atapi.sys
[2008/04/14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\Documents and Settings\Dan\Desktop\Pc repair stuff\laptop\Dans Installers on Laptop (Danslaptop)\Toshiba Drivers\hdc\primary_ide_channel\atapi.sys
[2008/04/14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\Documents and Settings\Dan\Desktop\Pc repair stuff\laptop\Dans Installers on Laptop (Danslaptop)\Toshiba Drivers\hdc\secondary_ide_channel\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\Documents and Settings\Dan\Desktop\Pc repair stuff\tools\saved drivers\hdc\primary_ide_channel\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\Documents and Settings\Dan\Desktop\Pc repair stuff\tools\saved drivers\hdc\secondary_ide_channel\atapi.sys
[2008/04/13 22:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ERDNT\cache\atapi.sys
[2008/04/13 22:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2008/04/13 22:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 08:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008/04/14 08:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2008/04/14 08:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/14 08:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008/04/14 08:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2008/04/14 08:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll

< MD5 for: NVATA.SYS >
[2006/04/24 17:52:28 | 000,100,736 | ---- | M] (NVIDIA Corporation) MD5=C03E15101F6D9E82CD9B0E7D715F5DE3 -- C:\NVIDIA\nForceWin2KXP\6.86\IDE\Win2K\sata_ide\nvata.sys
[2006/04/24 17:52:28 | 000,100,736 | ---- | M] (NVIDIA Corporation) MD5=C03E15101F6D9E82CD9B0E7D715F5DE3 -- C:\NVIDIA\nForceWin2KXP\6.86\IDE\WinXP\sata_ide\nvata.sys

< MD5 for: NVATABUS.SYS >
[2004/06/03 10:40:46 | 000,079,360 | ---- | M] (NVIDIA Corporation) MD5=46DEED4C6C5FA765F9A2C723BE60348D -- C:\NVIDIA\nForceWin2KXP\5.10\IDE\Win2K\NvAtaBus.sys
[2004/06/03 10:40:46 | 000,079,360 | ---- | M] (NVIDIA Corporation) MD5=46DEED4C6C5FA765F9A2C723BE60348D -- C:\NVIDIA\nForceWin2KXP\5.10\IDE\WinXP\NvAtaBus.sys
[2004/06/03 10:40:46 | 000,079,360 | ---- | M] (NVIDIA Corporation) MD5=46DEED4C6C5FA765F9A2C723BE60348D -- C:\WINDOWS\system32\drivers\nvatabus.sys
[2006/04/24 17:52:28 | 000,100,736 | ---- | M] (NVIDIA Corporation) MD5=C03E15101F6D9E82CD9B0E7D715F5DE3 -- C:\NVIDIA\nForceWin2KXP\6.86\IDE\Win2K\legacy\nvatabus.sys
[2006/04/24 17:52:28 | 000,100,736 | ---- | M] (NVIDIA Corporation) MD5=C03E15101F6D9E82CD9B0E7D715F5DE3 -- C:\NVIDIA\nForceWin2KXP\6.86\IDE\Win2K\sataraid\nvatabus.sys
[2006/04/24 17:52:28 | 000,100,736 | ---- | M] (NVIDIA Corporation) MD5=C03E15101F6D9E82CD9B0E7D715F5DE3 -- C:\NVIDIA\nForceWin2KXP\6.86\IDE\WinXP\legacy\nvatabus.sys
[2006/04/24 17:52:28 | 000,100,736 | ---- | M] (NVIDIA Corporation) MD5=C03E15101F6D9E82CD9B0E7D715F5DE3 -- C:\NVIDIA\nForceWin2KXP\6.86\IDE\WinXP\sataraid\nvatabus.sys
[2006/04/24 17:52:28 | 000,100,736 | ---- | M] (NVIDIA Corporation) MD5=C03E15101F6D9E82CD9B0E7D715F5DE3 -- C:\WINDOWS\system32\ReinstallBackups\0026\DriverFiles\nvatabus.sys

< MD5 for: NVGTS.SYS >
[2008/11/12 16:58:38 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=75E2E77C5497F34E60491D27BF03F1CB -- C:\NVIDIA\nForceWinXPInt\15.26\IDE\WinXP\sata_ide\nvgts.sys
[2008/11/12 16:59:06 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=8EB82606FCD8C5D039ADA33BD46FE7F8 -- C:\NVIDIA\nForceWinXPInt\15.26\IDE\WinXP\sataraid\nvgts.sys

< MD5 for: SCECLI.DLL >
[2008/04/14 08:00:00 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ERDNT\cache\scecli.dll
[2008/04/14 08:00:00 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\dllcache\scecli.dll
[2008/04/14 08:00:00 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

========== Alternate Data Streams ==========

@Alternate Data Stream - 149 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 137 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8A58D29C
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C31F31E6
< End of report >


OTL Extras logfile created on: 4/1/2010 4:18:36 PM - Run 1
OTL by OldTimer - Version 3.1.37.3 Folder = C:\Documents and Settings\Dan\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,023.00 Mb Total Physical Memory | 648.00 Mb Available Physical Memory | 63.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 90.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 72.46 Gb Free Space | 31.12% Space Free | Partition Type: NTFS
Drive D: | 74.52 Gb Total Space | 5.85 Gb Free Space | 7.85% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DANSDESKTOP
Current User Name: Dan
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"33334:UDP" = 33334:UDP:*:Enabled:SPF Port 33334 UDP
"33335:TCP" = 33335:TCP:*:Enabled:SPF Port 33335 TCP
"33336:TCP" = 33336:TCP:*:Enabled:SPF Port 33336 TCP

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Camfrog\Camfrog Video Chat\Camfrog Video Chat.exe" = C:\Program Files\Camfrog\Camfrog Video Chat\Camfrog Video Chat.exe:*:Enabled:Camfrog Client Module -- (Camshare LC)
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)
"C:\Program Files\Vuze\Azureus.exe" = C:\Program Files\Vuze\Azureus.exe:*:Enabled:Azureus -- (Vuze Inc.)
"C:\Program Files\ijji\ijji REACTOR\REACTOR.exe" = C:\Program Files\ijji\ijji REACTOR\REACTOR.exe:*:Enabled:Reactor Application -- (NHN Corporation)
"C:\Program Files\TeamViewer\Version5\TeamViewer.exe" = C:\Program Files\TeamViewer\Version5\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH)
"C:\Documents and Settings\Dan\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.dll" = C:\Documents and Settings\Dan\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.dll:*:Enabled:Google Talk Plugin -- (Google)
"C:\Documents and Settings\Dan\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe" = C:\Documents and Settings\Dan\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin -- (Google)
"C:\Documents and Settings\Dan\Application Data\mjusbsp\magicJack.exe" = C:\Documents and Settings\Dan\Application Data\mjusbsp\magicJack.exe:*:Enabled:magicJack -- (magicJack L.P.)
"C:\Documents and Settings\Dan\My Documents\Downloads\SoftVox v11_cracked_by_kracker-gg-packed\SoftVox v11_cracked_by_kracker-gg\SoftVox v11_cracked_by_kracker-gg.exe" = C:\Documents and Settings\Dan\My Documents\Downloads\SoftVox v11_cracked_by_kracker-gg-packed\SoftVox v11_cracked_by_kracker-gg\SoftVox v11_cracked_by_kracker-gg.exe:*:Enabled:Soft Vox 11 By Killer Anas -- (www.killer-anas.com)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\eeaoc\Empire Earth - The Art of Conquest\EE-AOC.exe" = C:\eeaoc\Empire Earth - The Art of Conquest\EE-AOC.exe:*:Enabled:EE-AOC -- ()
"C:\Program Files\Activision\Modern Warfare 2\iw4mp.exe" = C:\Program Files\Activision\Modern Warfare 2\iw4mp.exe:*:Enabled:iw4mp -- ()
"C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AIM -- (AOL Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2258EB2F-185C-43A0-BD05-F8717375A70B}" = Vegas Pro 9.0
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2447500B-22D7-47BD-9B13-1A927F43A267}" = Empire Earth
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java™ 6 Update 18
"{30BA50ED-0F32-421B-BC6A-132A03EFF299}" = VBRunALL
"{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper
"{33BBE45C-6296-488A-B7D5-37E692E71B3F}" = TortoiseSVN 1.6.5.16974 (32 bit)
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35725FBC-A136-4A46-9F29-091759D9BB93}" = MVision
"{364EC092-93CF-4DDC-9D7A-7278452028E0}" = Logitech QuickCam
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D777040-B426-44F8-8AA5-4EA26C38ECAE}" = Club Bing Toolbar Helper
"{6421F085-1FAA-DE13-D02A-CFB412C522A4}" = Acrobat.com
"{6D333CCA-44AD-40EA-8FB1-A2B4D981735F}" = AdCalls
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7F7111A6-6688-4740-B3FA-35D05DCFA73E}" = Kermit
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8EF1122E-E90C-4EE9-AB0C-7FDE2BA42C26}" = Musicmatch® Jukebox
"{901DC58A-5C1B-4315-BA40-5AD3D3A463B9}" = ijji REACTOR
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A35B36EA-39FE-4AA8-8119-D66B060C9E72}" = Club Bing Toolbar
"{A498D9EB-927B-459B-85D6-DD6EF8C2C564}" = erLT
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.1
"{B440D659-FECA-4BDD-A12B-5C9F05790FF3}" = Snagit 9.1.2
"{B49C924C-A651-4378-94F6-5D9BF44A959F}" = Empire Earth - The Art of Conquest
"{BBF6D0CD-A081-369F-B0B8-F168594CBB6B}" = Google Talk Plugin
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CCCAFDDE-ECEC-4AE4-BD97-047076BBD4A9}" = Microsoft Virtual PC 2004
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{D7A6C517-11F2-419F-B5BB-27772B939698}" = NvMixer
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FDE9FAF8-E1EA-4EBC-A10C-A730F45C7258}" = Eyeball Chat
"8461-7759-5462-8226" = Vuze
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AIM_7" = AIM 7
"Aspell English Dictionary_is1" = Aspell English Dictionary-0.50-2
"avast5" = avast! Free Antivirus
"Call of Duty Modern Warfare 2_is1" = Call of Duty Modern Warfare 2
"Camfrog 5.5" = Camfrog Video Chat 5.5
"CCleaner" = CCleaner
"CFWebAdvancedU" = CamfrogWEB Advanced ActiveX Plugin (remove only)
"ClubBingToolbar" = Club Bing Toolbar
"ClubWPT" = ClubWPT
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Creative Surround Mixer" = Creative Surround Mixer
"Drug Lord 2" = Drug Lord 2
"EPSON NX300 Series" = EPSON NX300 Series Printer Uninstall
"FileZilla Client" = FileZilla Client 3.3.1
"Fish Tycoon_is1" = Fish Tycoon
"FrostWire" = FrostWire 4.18.6
"gatesofandaron_is1" = Gates of Andaron
"GNU Aspell_is1" = GNU Aspell 0.50-3
"GomezPEER" = GomezPEER
"GTK 2.0" = GTK+ Runtime 2.14.7 rev a (remove only)
"Gunz" = ijji - Gunz
"HijackThis" = HijackThis 2.0.2
"ie8" = Windows Internet Explorer 8
"ImgBurn" = ImgBurn
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"ManyCam" = ManyCam 2.4 (remove only)
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.2)" = Mozilla Firefox (3.6.2)
"PartyPoker" = PartyPoker
"PFConfig" = PFConfig 1.0.278
"PFPortChecker" = PFPortChecker 1.0.32
"PokerStars" = PokerStars
"Privoxy" = Privoxy 3.0.6
"ProxyFirewall_is1" = ProxyFirewall 1.0.4 Beta
"QcDrv" = Logitech® Camera Driver
"Reimage Repair" = Reimage Repair
"SCAR Divi 3.22_is1" = SCAR Divi CDE 3.22
"Secunia PSI" = Secunia PSI
"Simple Port Forwarding" = Simple Port Forwarding
"Synergy" = Synergy
"TeamViewer 5" = TeamViewer 5
"Tor" = Tor 0.2.1.19
"Unlocker" = Unlocker 1.8.7
"uTorrent" = µTorrent
"Vidalia" = Vidalia 0.1.15
"VLC media player" = VLC media player 1.0.5
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Web Increaser" = Web Increaser V1.0
"Web Page Maker_is1" = Web Page Maker V3.21
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahoo! Messenger" = Yahoo! Messenger
"YEpic_is1" = YEpic

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"GoToMeeting" = GoToMeeting 4.0.0.320
"Sim Tower" = Sim Tower

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 3/18/2010 1:38:04 PM | Computer Name = DANSDESKTOP | Source = Application Error | ID = 1000
Description = Faulting application au_.exe, version 3.1.1.0, faulting module gomezutils.dll,
version 0.0.0.0, fault address 0x00005998.

Error - 3/18/2010 1:38:10 PM | Computer Name = DANSDESKTOP | Source = Application Error | ID = 1000
Description = Faulting application au_.exe, version 3.1.1.0, faulting module gomezutils.dll,
version 0.0.0.0, fault address 0x00005998.

Error - 3/18/2010 1:51:38 PM | Computer Name = DANSDESKTOP | Source = pctsSvc.exe | ID = 0
Description =

Error - 3/20/2010 12:17:50 AM | Computer Name = DANSDESKTOP | Source = Application Error | ID = 1000
Description = Faulting application camfrog video chat.exe, version 5.4.0.231, faulting
module browseui.dll, version 6.0.2900.5512, fault address 0x00003ba6.

Error - 3/20/2010 1:28:38 PM | Computer Name = DANSDESKTOP | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 3/22/2010 2:53:15 PM | Computer Name = DANSDESKTOP | Source = Application Error | ID = 1000
Description = Faulting application cldl.exe, version 1.0.48.3, faulting module unknown,
version 0.0.0.0, fault address 0x3db897b5.

Error - 3/22/2010 3:01:13 PM | Computer Name = DANSDESKTOP | Source = Application Error | ID = 1000
Description = Faulting application cldl.exe, version 1.0.48.3, faulting module unknown,
version 0.0.0.0, fault address 0x3db897b5.

Error - 3/23/2010 12:27:29 PM | Computer Name = DANSDESKTOP | Source = Application Error | ID = 1000
Description = Faulting application camfrog video chat.exe, version 5.5.0.236, faulting
module browseui.dll, version 6.0.2900.5512, fault address 0x00003ba6.

Error - 3/23/2010 12:56:59 PM | Computer Name = DANSDESKTOP | Source = Application Error | ID = 1000
Description = Faulting application camfrog video chat.exe, version 5.5.0.236, faulting
module browseui.dll, version 6.0.2900.5512, fault address 0x00003ba6.

Error - 3/24/2010 6:28:03 PM | Computer Name = DANSDESKTOP | Source = .NET Runtime 2.0 Error Reporting | ID = 5000
Description = EventType clr20r3, P1 portal.exe, P2 2.4.0.22763, P3 49fd8255, P4
system, P5 2.0.0.0, P6 4889de7a, P7 2f45, P8 32, P9 ehuv40bmnnyos3mgfcghjz0fliblbasq,
P10 NIL.

[ System Events ]
Error - 3/31/2010 1:43:36 AM | Computer Name = DANSDESKTOP | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service BITS with arguments
"" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}

Error - 3/31/2010 1:43:36 AM | Computer Name = DANSDESKTOP | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service BITS with arguments
"" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}

Error - 3/31/2010 2:35:04 AM | Computer Name = DANSDESKTOP | Source = Service Control Manager | ID = 7034
Description = The EPSON V3 Service4(01) service terminated unexpectedly. It has
done this 1 time(s).

Error - 3/31/2010 2:35:08 AM | Computer Name = DANSDESKTOP | Source = Service Control Manager | ID = 7034
Description = The EPSON V5 Service4(01) service terminated unexpectedly. It has
done this 1 time(s).

Error - 3/31/2010 10:47:03 AM | Computer Name = DANSDESKTOP | Source = Service Control Manager | ID = 7023
Description = The Help and Support service terminated with the following error:
%%126

Error - 3/31/2010 11:04:03 PM | Computer Name = DANSDESKTOP | Source = Service Control Manager | ID = 7023
Description = The Help and Support service terminated with the following error:
%%126

Error - 3/31/2010 11:21:54 PM | Computer Name = DANSDESKTOP | Source = Service Control Manager | ID = 7023
Description = The Help and Support service terminated with the following error:
%%126

Error - 4/1/2010 1:02:23 PM | Computer Name = DANSDESKTOP | Source = Service Control Manager | ID = 7023
Description = The Help and Support service terminated with the following error:
%%126

Error - 4/1/2010 4:13:22 PM | Computer Name = DANSDESKTOP | Source = Service Control Manager | ID = 7023
Description = The Help and Support service terminated with the following error:
%%126

Error - 4/1/2010 4:13:26 PM | Computer Name = DANSDESKTOP | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
atapi PCIIde


< End of report >
Thanks.

Edited by snouk, 01 April 2010 - 03:30 PM.

Hi,


Please visit this site and follow the instructions for uploading the C:\Qoobox\Quarantine\[4]-Submit_2010-03-29_18.58.37.zip file.




Your log(s) show that you are using so called peer-to-peer or file-sharing programmes (in your case Utorrent). These programmes allow to share files between users as the name(s) suggest. In today's world the cyber crime has come to an enormous dimension and any means is used to infect personal computers to make use of their stored data or machine power for further propagation of the malware files. A popular means is the use of file-sharing tools as a tremendous amount of prospective victims can be reached through it.

It is therefore possible to be infected by downloading manipulated files via peer-to-peer tools and thus suggested to be used with intense care. Some further readings on this subject, along the included links, are as follows: "File-Sharing, otherwise known as Peer To Peer" and "Risks of File-Sharing Technology."

It is also important to note that sharing entertainment files and proprietary software infringes the copyright laws in many countries over the world and you are putting yourself at risk of being indicted through organisations watching over the rights of the authors of such files (i.e. the RIAA for music files, or the MPAA for movie files in the USA) or the authors of the files themselves.

Naturally there are also legal ways to use these services, such as downloading Linux distributions or office suites such as "Open Office."





I'd like us to scan your machine with ESET OnlineScan

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
• Click the button.
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the icon on your desktop.
• Check
• Click the button.
• Accept any security warnings from your browser.
• Check
• Push the Start button.
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• When the scan completes, push
• Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
• Push the button.
• Push

A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

File uploaded.

I started the eset scan about 7 hours ago and its only on 12%. It has found 8 (5 trojans) infected files so far. Should it take this long to scan normal?

Edited by snouk, 03 April 2010 - 07:14 PM.

Hm, a bit too long. Please write down the threats found and post it here, skip the scan and try this one:


Please run a BitDefender Online Scan

• Click I Agree to agree to the EULA.
• Allow the ActiveX control to install when prompted.
• Click Click here to scan to begin the scan.
• Please refrain from using the computer until the scan is finished. This might take a while to run, but it is important that nothing else is running while you scan.
• When the scan is finished, click on Click here to export the scan results.
• Save the report to your desktop so you can post it in your next reply.

The trojans that eset found are false positives. I looked into them. I know what they are.

Bit defender came back as no infection found.

QuickScan Beta 32-bit v0.9.9.16
-------------------------------

Scan date: Tue Apr 06 17:20:53 2010
Machine ID: 34F2815F



No infection found.
-------------------



Processes
---------
<unsigned> Musicmatch Jukebox 1888 C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
<unsigned> Realtek Sound Manager 1864 C:\WINDOWS\SOUNDMAN.EXE

<verified> AOL Instant Messenger 2200 C:\Program Files\AIM\aim.exe
<verified> avast! Antivirus 1508 C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
<verified> avast! Antivirus 1896 C:\Program Files\Alwil Software\Avast5\AvastUI.exe
<verified> Creative Ring3 NT Inteface 1664 C:\WINDOWS\system32\devldr32.exe
<verified> EPSON Status Monitor 3 2132 C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
<verified> EPSON Status Monitor 3 2116 C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE
<verified> Firefox 1320 C:\Program Files\Mozilla Firefox\firefox.exe
<verified> Java™ Platform SE 6 U19 2168 C:\Program Files\Java\jre6\bin\jqs.exe
<verified> Java™ Platform SE Auto Updater 2 0 1936 C:\Program Files\Common Files\Java\Java Update\jusched.exe
<verified> Logitech QuickCam 2184 C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
<verified> Logitech QuickCam 1384 C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
<verified> Logitech SetPoint 400 C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
<verified> Logitech SetPoint 216 C:\Program Files\Logitech\SetPoint\SetPoint.exe
<verified> Microsoft® Windows® Operating System 1680 C:\WINDOWS\Explorer.EXE
<verified> Microsoft® Windows® Operating System 3320 C:\WINDOWS\System32\alg.exe
<verified> Microsoft® Windows® Operating System 760 C:\WINDOWS\system32\csrss.exe
<verified> Microsoft® Windows® Operating System 1984 C:\WINDOWS\system32\ctfmon.exe
<verified> Microsoft® Windows® Operating System 844 C:\WINDOWS\system32\lsass.exe
<verified> Microsoft® Windows® Operating System 832 C:\WINDOWS\system32\services.exe
<verified> Microsoft® Windows® Operating System 660 C:\WINDOWS\System32\smss.exe
<verified> Microsoft® Windows® Operating System 1208 C:\WINDOWS\system32\spoolsv.exe
<verified> Microsoft® Windows® Operating System 1296 C:\WINDOWS\system32\svchost.exe
<verified> Microsoft® Windows® Operating System 1228 C:\WINDOWS\system32\svchost.exe
<verified> Microsoft® Windows® Operating System 1180 C:\WINDOWS\System32\svchost.exe
<verified> Microsoft® Windows® Operating System 2068 C:\WINDOWS\system32\svchost.exe
<verified> Microsoft® Windows® Operating System 1084 C:\WINDOWS\system32\svchost.exe
<verified> Microsoft® Windows® Operating System 1012 C:\WINDOWS\system32\svchost.exe
<verified> Microsoft® Windows® Operating System 2372 C:\WINDOWS\system32\svchost.exe
<verified> Microsoft® Windows® Operating System 3868 C:\WINDOWS\System32\svchost.exe
<verified> Microsoft® Windows® Operating System 540 C:\WINDOWS\system32\wbem\wmiprvse.exe
<verified> Microsoft® Windows® Operating System 788 C:\WINDOWS\system32\winlogon.exe
<verified> NVIDIA Driver Helper Service, Version 1 2268 C:\WINDOWS\system32\nvsvc32.exe
<verified> TortoiseSVN 1784 C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
<verified> Yahoo! Messenger 3856 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe


Network activity
----------------
Process AvastSvc.exe (1508) connected on port 80 (HTTP) --> 67.135.105.128
Process AvastSvc.exe (1508) connected on port 80 (HTTP) --> 67.135.105.128
Process AvastSvc.exe (1508) connected on port 80 (HTTP) --> 67.135.105.128
Process AvastSvc.exe (1508) connected on port 80 (HTTP) --> 69.63.189.11
Process AvastSvc.exe (1508) connected on port 80 (HTTP) --> 69.63.189.11
Process AvastSvc.exe (1508) connected on port 80 (HTTP) --> 75.126.76.195
Process AvastSvc.exe (1508) connected on port 80 (HTTP) --> 8.12.47.49
Process AvastSvc.exe (1508) connected on port 80 (HTTP) --> 209.85.225.166
Process AvastSvc.exe (1508) connected on port 80 (HTTP) --> 67.135.105.128
Process AvastSvc.exe (1508) connected on port 80 (HTTP) --> 69.63.180.47
Process AvastSvc.exe (1508) connected on port 80 (HTTP) --> 213.222.193.191
Process AvastSvc.exe (1508) connected on port 80 (HTTP) --> 72.247.25.115
Process AvastSvc.exe (1508) connected on port 80 (HTTP) --> 205.177.95.61
Process AvastSvc.exe (1508) connected on port 80 (HTTP) --> 67.135.105.128
Process AvastSvc.exe (1508) connected on port 80 (HTTP) --> 67.135.105.136
Process AvastSvc.exe (1508) connected on port 80 (HTTP) --> 67.135.105.128
Process AvastSvc.exe (1508) connected on port 80 (HTTP) --> 69.63.180.47
Process AvastSvc.exe (1508) connected on port 80 (HTTP) --> 75.126.76.20
Process AvastSvc.exe (1508) connected on port 80 (HTTP) --> 8.12.47.49
Process AvastSvc.exe (1508) connected on port 80 (HTTP) --> 69.63.180.47
Process AvastSvc.exe (1508) connected on port 80 (HTTP) --> 69.63.189.11
Process AvastSvc.exe (1508) connected on port 80 (HTTP) --> 69.63.189.11
Process AvastSvc.exe (1508) connected on port 80 (HTTP) --> 8.12.47.49
Process aim.exe (2200) connected on port 443 (HTTP over SSL) --> bos-m090a-sdr4.blue.aol.com
Process aim.exe (2200) connected on port 80 (HTTP) --> jawsvip-dtc01.evip.aol.com
Process aim.exe (2200) connected on port 443 (HTTP over SSL) --> oam-m05c.blue.aol.com
Process YahooMessenger.exe (3856) connected on port 5050 (Yahoo Messenger) --> cs120.msg.ac4.yahoo.com
Process YahooMessenger.exe (3856) connected on port 443 (HTTP over SSL) --> sip28.voice.re2.yahoo.com

Process svchost.exe (1084) listens on ports: 135 (RPC)
Process svchost.exe (1296) listens on ports: 2869 (SSDP event notification, UPNP)
Process YahooMessenger.exe (3856) listens on ports: 5101 (Yahoo Messenger)


Autoruns and critical files
---------------------------
<unsigned> Musicmatch Jukebox C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
<unsigned> Realtek Sound Manager C:\WINDOWS\SOUNDMAN.EXE

<verified> Adobe Acrobat C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
<verified> Adobe Reader and Acrobat Manager C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
<verified> avast! Antivirus C:\PROGRA~1\ALWILS~1\Avast5\AvastUI.exe
<verified> cdloader2 C:\Documents and Settings\Dan\Application Data\mjusbsp\cdloader2.exe
<verified> Google Update C:\Documents and Settings\Dan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
<verified> Java™ Platform SE Auto Updater 2 0 C:\Program Files\Common Files\Java\Java Update\jusched.exe
<verified> Logitech SetPoint C:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
<verified> Logitech SetPoint C:\WINDOWS\KHALMNPR.EXE
<verified> Microsoft Genuine Advantage C:\WINDOWS\system32\WgaLogon.dll
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\browseui.dll
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\crypt32.dll
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\cryptnet.dll
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\cscdll.dll
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\ctfmon.exe
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\dimsntfy.dll
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\dumprep.exe
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\logonui.exe
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\sclgntfy.dll
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\shell32.dll
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\stobject.dll
<verified> Microsoft® Windows® Operating System c:\windows\system32\userinit.exe
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\wlnotify.dll
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\WPDShServiceObj.dll
<verified> NVIDIA Compatible Windows 2000 Display C:\WINDOWS\system32\NvCpl.dll
<verified> Windows® Internet Explorer C:\WINDOWS\system32\msfeedssync.exe
<verified> Windows® Internet Explorer C:\WINDOWS\system32\webcheck.dll


Browser plugins
---------------
<unsigned> ijji Optimizer Application C:\WINDOWS\Downloaded Program Files\ijjiOptimizer.exe
<unsigned> ChannelingPluginforReactor Dynamic Link C:\WINDOWS\Downloaded Program Files\ChannelingPluginforReactor.dll
<unsigned> ijjiPCPlugin C:\WINDOWS\Downloaded Program Files\ijjiPCPlugin.dll
<unsigned> npijjiFFPlugin1 for Mozilla C:\Program Files\Mozilla Firefox\plugins\npijjiFFPlugin1.dll
<unsigned> RunApp Application C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
<unsigned> Shockwave for Director C:\WINDOWS\system32\Adobe\Director\np32dsw.dll

<verified> AcroIEHelperShim Library c:\program files\common files\adobe\acrobat\activex\acroiehelpershim.dll
<verified> Adobe Acrobat C:\Program Files\Internet Explorer\plugins\nppdf32.dll
<verified> Adobe Acrobat C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll
<verified> BitDefender QuickScan C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\xw19c4l2.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
<verified> BitDefender QuickScan C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\xw19c4l2.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
<verified> Club Bing Toolbar c:\program files\club bing toolbar\toolbar.dll
<verified> Club Bing Toolbar Helper c:\program files\club bing toolbar helper\bmbho.dll
<verified> Deal or No Deal C:\WINDOWS\Downloaded Program Files\dealornodeal.ocx
<verified> Games C:\WINDOWS\Downloaded Program Files\wwlaunch.ocx
<verified> ijji Auto Install Plugin for Mozilla C:\Program Files\Mozilla Firefox\plugins\npijjiautoinstallpluginff.dll
<verified> ijjiNotify2 C:\WINDOWS\Downloaded Program Files\ijjiNotify2.exe
<verified> ijjiPreNotify C:\WINDOWS\Downloaded Program Files\ijjiPreNotify2.exe
<verified> ijjiPreStarter C:\WINDOWS\Downloaded Program Files\ijjiPreStarter2.exe
<verified> ijjiSetup Module C:\WINDOWS\Downloaded Program Files\ijjiSetup1010.dll
<verified> ijjistarter C:\WINDOWS\Downloaded Program Files\ijjistarter2.exe
<verified> Java Deployment Toolkit 6.0.190.4 C:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll
<verified> Java™ Platform SE 6 U19 c:\program files\java\jre6\bin\jp2ssv.dll
<verified> Java™ Platform SE 6 U19 c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
<verified> Microsoft® Windows® Operating System C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\mswsock.dll
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\rsvpsp.dll
<verified> Microsoft® Windows® Operating System C:\WINDOWS\system32\winrnr.dll
<verified> Monopoly Downtown C:\WINDOWS\Downloaded Program Files\monopoly.ocx
<verified> Mozilla Default Plug-in C:\Program Files\Mozilla Firefox\plugins\npnul32.dll
<verified> MSN Photo Upload Control C:\WINDOWS\Downloaded Program Files\PURen-us.dll
<verified> MSN® Games by Zone.com C:\WINDOWS\Downloaded Program Files\MessengerStatsPAClient.dll
<verified> MSN® Games by Zone.com C:\WINDOWS\Downloaded Program Files\StagingUI.ocx
<verified> MSN® Games by Zone.com C:\WINDOWS\Downloaded Program Files\Stproxy.dll
<verified> MSN® Games by Zone.com C:\WINDOWS\Downloaded Program Files\ZBuddy.ocx
<verified> MSN® Games by Zone.com C:\WINDOWS\Downloaded Program Files\Zintro.ocx
<verified> MSN® Games by Zone.com C:\WINDOWS\Downloaded Program Files\ZPAChat.ocx
<verified> npsoe.dll C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\xw19c4l2.default\extensions\{38AB6A6C-CC4C-4f9e-A3DD-3C5681EF18A1}\plugins\npsoe.dll
<verified> NPSWF32.dll C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
<verified> Purple Launcher C:\WINDOWS\Downloaded Program Files\PLauncher.exe
<verified> UNO Messenger C:\WINDOWS\Downloaded Program Files\CONFLICT.1\game_uno1.dll
<verified> UNO Messenger C:\WINDOWS\Downloaded Program Files\GAME_UNO1.dll
<verified> Windows Live Photo Gallery C:\WINDOWS\Downloaded Program Files\PhtPkMSN.dll
<verified> Windows Live Photo Upload Control C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll
<verified> Windows Presentation Foundation C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
<verified> Windows® Internet Explorer C:\WINDOWS\system32\ieframe.dll
<verified> Yahoo Application State Plugin C:\Program Files\Yahoo!\Shared\npYState.dll


Missing files
-------------
File not found: C:\Program Files\Messenger\msmsgs.exe
referenced in: HKLM\Software\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}\"Exec"

File not found: C:\Program Files\VideoLAN\VLC\npvlc.dll
referenced in: HLKM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.2\"Path"

File not found: C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dlles\pchsvc.dll
referenced in: HKLM\System\ControlSet001\services\helpsvc\Parameters\"ServiceDll"


Scan
----
<unsigned> MD5: 2c80c2e95e244ef7012cd73155ba8480 C:\Program Files\AIM\acccore.dll
<unsigned> MD5: 54def38d41092658064c83783c55a90e C:\Program Files\AIM\AOLSvcMgr.dll
<unsigned> MD5: c2fa40688f9df9fdb8ad1c7dc9846541 C:\Program Files\AIM\coolcore59.dll
<unsigned> MD5: f4e0946911e54a8c9716cfbedab0d072 C:\Program Files\AIM\jgtktlk.dll
<unsigned> MD5: 537dba28451a112efeccbd850b8c961f C:\Program Files\AIM\nspr4.dll
<unsigned> MD5: f96e7e2f6e0fa294b4c117f53c8115d4 C:\Program Files\AIM\nss3.dll
<unsigned> MD5: 93deb816c6985dd75d5a84ad5d266cac C:\Program Files\AIM\nssckbi.dll
<unsigned> MD5: 60b8974fa964f568c25a55c19d59883a C:\Program Files\AIM\plc4.dll
<unsigned> MD5: 3bb617ef942280b0be09d844bde4af56 C:\Program Files\AIM\plds4.dll
<unsigned> MD5: b1ddf206a4b97c1ed89c3abe2ecbe3ef C:\Program Files\AIM\smime3.dll
<unsigned> MD5: 0efb3626c2899955bc22c050842c1db1 C:\Program Files\AIM\softokn3.dll
<unsigned> MD5: 31c79e69aab3f66f84853b6a78de8239 C:\Program Files\AIM\ssl3.dll
<unsigned> MD5: bdd3a598432ce6688d3e6b1968ec908a C:\Program Files\AIM\xprt6.dll
<unsigned> MD5: b1691af4a072cb674d600db16dd7308e C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
<unsigned> MD5: 0fd13fe4b334f5429258369503b70c46 C:\Program Files\Alwil Software\Avast5\1033\Base.dll
<unsigned> MD5: d20f51f5abc3c00ef55e9813f9c3d941 C:\Program Files\Alwil Software\Avast5\Aavm4h.dll
<unsigned> MD5: 8a91d6a325a59e3f1b242c3fa5ec3ca8 C:\Program Files\Alwil Software\Avast5\AavmRpch.dll
<unsigned> MD5: d7e4faa6c8ad182f160408b5ab477bdd C:\Program Files\Alwil Software\Avast5\AhResBhv.dll
<unsigned> MD5: 59f4ba71d6a5a3a6a92c2bbb0f80ffb5 C:\Program Files\Alwil Software\Avast5\AhResMai.dll
<unsigned> MD5: 932214335d2c48e31409f8c3ec7e63e7 C:\Program Files\Alwil Software\Avast5\ahResMes.dll
<unsigned> MD5: a9b387f9f52a2991fe3bd11dd1a3ca89 C:\Program Files\Alwil Software\Avast5\AhResNS.dll
<unsigned> MD5: f4c3d9d9f7d9e17458a3559f00f39d33 C:\Program Files\Alwil Software\Avast5\ahResP2P.dll
<unsigned> MD5: 6de65976170447bf0275433c69b3f4ab C:\Program Files\Alwil Software\Avast5\AhResStd.dll
<unsigned> MD5: 21c9992bae66d3aed013fc5a261ec191 C:\Program Files\Alwil Software\Avast5\AhResWS.dll
<unsigned> MD5: 97f70a103ad885017d38018aa9e3a5fc C:\Program Files\Alwil Software\Avast5\ashBase.dll
<unsigned> MD5: 80bb0ce896bb3b7bbb0a83d65daf715b C:\Program Files\Alwil Software\Avast5\ashMaiSv.dll
<unsigned> MD5: 3486852eeb1b9987f3ce8f7710ec3f97 C:\Program Files\Alwil Software\Avast5\ashServ.dll
<unsigned> MD5: a79a5057ac0cc7bf0f5ee1ff0074bd43 C:\Program Files\Alwil Software\Avast5\ashTask.dll
<unsigned> MD5: 956c22acf554b3c8b2beebb355abfa2e C:\Program Files\Alwil Software\Avast5\ashTaskEx.dll
<unsigned> MD5: 0cd48892a7686ab8b7122da110023e44 C:\Program Files\Alwil Software\Avast5\ashWebSv.dll
<unsigned> MD5: f34ee08fc85eb4b2de18072deab4dedd C:\Program Files\Alwil Software\Avast5\aswAux.dll
<unsigned> MD5: cfebcf374887a4234278b0f9401b2d86 C:\Program Files\Alwil Software\Avast5\aswCmnBS.dll
<unsigned> MD5: 6a71080712b8dbbfe80e5b90ec9230b0 C:\Program Files\Alwil Software\Avast5\aswCmnIS.dll
<unsigned> MD5: 8829c11d031ba372d47a16223a659ec2 C:\Program Files\Alwil Software\Avast5\aswCmnOS.dll
<unsigned> MD5: ff4785f643c101e6539d82f0deabf23d C:\Program Files\Alwil Software\Avast5\aswEngLdr.dll
<unsigned> MD5: de57564c0461c26ffb9a50d961b663f7 C:\Program Files\Alwil Software\Avast5\aswIdle.dll
<unsigned> MD5: fffd9149c4c751c955fcd36e3e1fa77f C:\Program Files\Alwil Software\Avast5\aswLog.dll
<unsigned> MD5: 30f700767027edbfef661f7c3ccf3320 C:\Program Files\Alwil Software\Avast5\aswProperty.dll
<unsigned> MD5: 237aa0cf9938f6a463ac3e065bf02e27 C:\Program Files\Alwil Software\Avast5\aswSqLt.dll
<unsigned> MD5: 72fdfc90d940a0ed45db1fe993ea3c9e C:\Program Files\Alwil Software\Avast5\defs\10040601\algo.dll
<unsigned> MD5: e3b39858004c10d0b4a211f0c0e5cb76 C:\Program Files\Alwil Software\Avast5\defs\10040601\aswCmnBS.dll
<unsigned> MD5: 7e1569e4a8624ceaa0c231cc6dd83dbf C:\Program Files\Alwil Software\Avast5\defs\10040601\aswCmnIS.dll
<unsigned> MD5: ad379a174f4d1849d4993c9727fcafdf C:\Program Files\Alwil Software\Avast5\defs\10040601\aswCmnOS.dll
<unsigned> MD5: fced963d84659b1ad9a4468b0e3b6c82 C:\Program Files\Alwil Software\Avast5\defs\10040601\aswEngin.dll
<unsigned> MD5: 7b8044d521fa9e8e3aa563f40c64e3ad C:\Program Files\Alwil Software\Avast5\defs\10040601\aswScan.dll
<unsigned> MD5: 628c28f3b0f227266573efd19faa9eb6 C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
<unsigned> MD5: fc3dcb8a8aacf64e8dac0854cd0adb56 C:\Program Files\FileZilla FTP Client\fzshellext.dll
<unsigned> MD5: 86f1895ae8c5e8b17d99ece768a70732 C:\Program Files\Java\jre6\bin\msvcr71.dll
<unsigned> MD5: 26b018758226a5dc06de45496c394d40 C:\Program Files\Mozilla Firefox\freebl3.dll
<unsigned> MD5: 9dfb30f203999a3ae0f258a33fa598f9 C:\Program Files\Mozilla Firefox\nssdbm3.dll
<unsigned> MD5: 5f0c367673e05df52468c74924d87825 C:\Program Files\Mozilla Firefox\plugins\npijjiFFPlugin1.dll
<unsigned> MD5: 1fd6c03c0001a5e1eaf61596c2502f0c C:\Program Files\Mozilla Firefox\softokn3.dll
<unsigned> MD5: f66e8acfc6c8c8be0bc8390f580cd853 C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
<unsigned> MD5: 0071d1d75c776d124eb0505e11933cdf C:\Program Files\Musicmatch\Musicmatch Jukebox\MMVCP70.dll
<unsigned> MD5: 80ef6653710a2a53e8183981badd582f C:\Program Files\Musicmatch\Musicmatch Jukebox\MMVCR70.dll
<unsigned> MD5: ac3ed9f87d8753783a0ecaf9c0d77069 C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
<unsigned> MD5: d8f2cb87da1f28d1a9943859dce654b2 C:\Program Files\Yahoo!\Messenger\ConnectionWizard.dll
<unsigned> MD5: 90da4796b323101adaa8de3b9113f5b7 C:\Program Files\Yahoo!\Messenger\core_video.dll
<unsigned> MD5: 52d69880147475ea632d258f87aa96eb C:\Program Files\Yahoo!\Messenger\ft60.dll
<unsigned> MD5: 6c76a30314ca25262c36d1adc54dd63b C:\Program Files\Yahoo!\Messenger\nspr4.dll
<unsigned> MD5: dc179fa7cd7d1791376276f67db197fe C:\Program Files\Yahoo!\Messenger\resources\en-US\res_msgr.dll
<unsigned> MD5: c52fd95a322071b076ea2e61a99d758e C:\Program Files\Yahoo!\Messenger\RGX.dll
<unsigned> MD5: 70e7b79cec4ab54442988f037b961fdf C:\Program Files\Yahoo!\Messenger\rmc_audio.dll
<unsigned> MD5: 0f1a2b7bf2e87b33bc75bd0bab7f3501 C:\Program Files\Yahoo!\Messenger\rmc_video.dll
<unsigned> MD5: 1e697e513bbdcd869f95ea1600a2077e C:\Program Files\Yahoo!\Messenger\yalertcenterM.dll
<unsigned> MD5: 2e948f2619893ec6b5864f5ac0ab6b4a C:\Program Files\Yahoo!\Messenger\YCPFoundation.dll
<unsigned> MD5: 5e5572d6503847df6389893404491b11 C:\Program Files\Yahoo!\Messenger\YCPSSL.dll
<unsigned> MD5: 429dc923808181fd09d2b16498fea1d1 C:\Program Files\Yahoo!\Messenger\YHTTP.dll
<unsigned> MD5: fe629428d0c4486b0d03af0550bb332d C:\Program Files\Yahoo!\Messenger\YImage.dll
<unsigned> MD5: f39b3ebe6de578cf09401c6e4eab42c0 C:\Program Files\Yahoo!\Messenger\YIniDom.dll
<unsigned> MD5: 0a1fccdf904c014b469eb2945ffad852 C:\Program Files\Yahoo!\Messenger\ylog.dll
<unsigned> MD5: 935a830ea4a39a50fb04c9791cc46591 C:\Program Files\Yahoo!\Messenger\ymdm_audio.dll
<unsigned> MD5: 3a48b6f5b844bb1ce0eadf32cad1bc16 C:\Program Files\Yahoo!\Messenger\ymdm_video.dll
<unsigned> MD5: e2ce0f76c90fa1fca00d72d956d22298 C:\Program Files\Yahoo!\Messenger\Yml.dll
<unsigned> MD5: ee2b777b54990a05e25ad7e68c9ccab1 C:\Program Files\Yahoo!\Messenger\ymsdk.dll
<unsigned> MD5: 38d603338d3cbb3a68f2a4de0a7ce229 C:\Program Files\Yahoo!\Messenger\ymsglite.dll
<unsigned> MD5: 39c82c071289c119c622fe85e0223d62 C:\Program Files\Yahoo!\Messenger\ypagerps.dll
<unsigned> MD5: 0c69333d6549596d470cc28688b7b02b C:\Program Files\Yahoo!\Messenger\YPluginRegistry.dll
<unsigned> MD5: 8e4b87a87e3a2f7a162864df1afff4e0 C:\Program Files\Yahoo!\Messenger\yui.dll
<unsigned> MD5: a228bc112f35a09c74626f33ffad43f4 C:\PROGRA~1\ALWILS~1\Avast5\1033\uiLangRes.dll
<unsigned> MD5: 0183e3068d743b5afacb55675a4fd037 C:\PROGRA~1\ALWILS~1\Avast5\aswData.dll
<unsigned> MD5: ba0c9762a21fa8f1f015acb81d7b8b83 C:\PROGRA~1\ALWILS~1\Avast5\aswUtil.dll
<unsigned> MD5: f1a6bcd6906dec09f2bd70ca7053c8d0 C:\PROGRA~1\ALWILS~1\Avast5\CommonRes.dll
<unsigned> MD5: e802baf0b20ccca90ec32d1d7d0ba05a C:\WINDOWS\Downloaded Program Files\ChannelingPluginforReactor.dll
<unsigned> MD5: 9956cb0a1a1c8886a956efaa3bbd6ff0 C:\WINDOWS\Downloaded Program Files\ijjiOptimizer.exe
<unsigned> MD5: e16b129afb492be9733cae06ed8c8a03 C:\WINDOWS\Downloaded Program Files\ijjiPCPlugin.dll
<unsigned> MD5: 80fd4d46b0e9b620cf757a9a5c789329 C:\WINDOWS\SOUNDMAN.EXE
<unsigned> MD5: e2cca1b3ba59949ae16ec587e89a09ba C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
<unsigned> MD5: dd8520280304b6145a6be31008748c7c C:\WINDOWS\system32\drivers\ALCXWDM.SYS
<unsigned> MD5: 093913a016845fe257ed9b7fc8e28ed8 C:\WINDOWS\system32\drivers\FILEDISK.sys
<unsigned> MD5: fb548ff809634bfa866312b37d8a18ae C:\WINDOWS\system32\DRIVERS\LVcKap.sys
<unsigned> MD5: fe3fb994f8702d9e37648927819b74b8 C:\WINDOWS\system32\DRIVERS\LVMVDrv.sys
<unsigned> MD5: db3b30c3a4cdcf07e164c14584d9d0f2 C:\WINDOWS\System32\Drivers\PxHelp20.sys
<unsigned> MD5: cdddec541bc3c96f91ecb48759673505 C:\WINDOWS\system32\drivers\SPTD.sys
<unsigned> MD5: fabb60cbf5e1e374b99de989e6b0f44b C:\WINDOWS\system32\drivers\TCPIP.sys
<unsigned> MD5: 5fe459e744ab07565bce96addf98ef54 C:\WINDOWS\system32\drivers\VMM.sys
<unsigned> MD5: 8a22502803767b36664090e63deda50f C:\WINDOWS\system32\GameMon.des
<unsigned> MD5: 9131fe60adfab595c8da53ad6a06aa31 C:\WINDOWS\system32\npptNT2.sys
<unsigned> MD5: 2f5532f9b0f903b26847da674b4f55b2 C:\WINDOWS\system32\PfModNT.sys
<unsigned> MD5: 3e9a33113d663d8bd5ed38858e669652 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd\ATL80.dll
<unsigned> MD5: 686b224b4987c22b153fbb545fee9657 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e\mfc80u.dll
<unsigned> MD5: d8584c7fb9a1ba8480f9000c1ca1b415 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80ENU.dll


No file uploaded.

Scan finished - communication took 4 sec
Total traffic - 0.08 MB sent, 2.96 KB recvd
Scanned 1179 files and modules - 263 seconds

Edited by snouk, 06 April 2010 - 07:06 PM.

Ok

Please post back with a fresh OTL logfile and tell me how your system is running.

Its seems better. Thanks.

OTL logfile created on: 4/9/2010 4:30:46 AM - Run 2
OTL by OldTimer - Version 3.1.37.3 Folder = C:\Documents and Settings\Dan\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,023.00 Mb Total Physical Memory | 512.00 Mb Available Physical Memory | 50.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 78.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 69.63 Gb Free Space | 29.90% Space Free | Partition Type: NTFS
Drive D: | 74.52 Gb Total Space | 5.85 Gb Free Space | 7.85% Space Free | Partition Type: NTFS
Unable to calculate disk information.
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 980.73 Mb Total Space | 552.47 Mb Free Space | 56.33% Space Free | Partition Type: FAT
I: Drive not present or media not loaded

Computer Name: DANSDESKTOP
Current User Name: Dan
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/04/02 02:22:31 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/04/01 16:17:29 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Dan\My Documents\Downloads\OTL.exe
PRC - [2010/03/29 15:24:54 | 000,303,952 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2010/03/29 15:24:52 | 000,437,584 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2010/03/11 06:04:16 | 001,488,264 | ---- | M] (Camshare LC) -- C:\Program Files\Camfrog\Camfrog Video Chat\Camfrog Video Chat.exe
PRC - [2010/03/09 07:24:10 | 002,769,336 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2010/03/09 07:24:08 | 000,040,384 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2009/08/20 12:44:38 | 000,615,688 | ---- | M] (http://tortoisesvn.net) -- C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
PRC - [2009/07/20 12:30:50 | 000,813,584 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPoint\SetPoint.exe
PRC - [2009/07/10 12:42:32 | 000,055,824 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
PRC - [2008/04/14 08:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/12/16 23:00:00 | 000,143,872 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE
PRC - [2007/07/20 00:40:48 | 000,137,752 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
PRC - [2007/07/20 00:38:54 | 000,186,904 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\Logishrd\LVCOMSER\LVComSer.exe
PRC - [2007/04/16 15:28:22 | 000,577,536 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\soundman.exe
PRC - [2007/01/10 23:02:00 | 000,113,664 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
PRC - [2001/08/31 13:44:30 | 000,025,600 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\system32\devldr32.exe


========== Modules (SafeList) ==========

MOD - [2010/04/01 16:17:29 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Dan\My Documents\Downloads\OTL.exe
MOD - [2009/07/20 12:29:06 | 000,045,584 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPoint\lgscroll.dll
MOD - [2009/07/12 02:12:06 | 000,632,656 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll
MOD - [2007/07/20 00:40:36 | 000,113,176 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll


========== Win32 Services (SafeList) ==========

SRV - [2010/03/29 15:24:54 | 000,303,952 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2010/03/09 07:24:08 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010/03/09 07:24:08 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010/03/09 07:24:08 | 000,040,384 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2009/09/19 14:46:00 | 003,474,384 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\WINDOWS\System32\GameMon.des -- (npggsvc)
SRV - [2009/07/20 12:28:10 | 000,121,360 | ---- | M] (Logitech, Inc.) [Disabled | Stopped] -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2007/12/16 23:00:00 | 000,143,872 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE -- (EPSON_EB_RPCV4_01) EPSON V5 Service4(01)
SRV - [2007/07/20 00:42:30 | 000,141,848 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\Logishrd\SrvLnch\SrvLnch.exe -- (LVSrvLauncher)
SRV - [2007/07/20 00:40:48 | 000,137,752 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2007/07/20 00:38:54 | 000,186,904 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe -- (LVCOMSer)
SRV - [2007/05/28 12:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) [Auto | Stopped] -- C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)
SRV - [2007/01/10 23:02:00 | 000,113,664 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE -- (EPSON_PM_RPCV4_01) EPSON V3 Service4(01)


========== Driver Services (SafeList) ==========

DRV - [2010/03/29 15:24:46 | 000,020,824 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2010/03/09 07:12:54 | 000,046,672 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2010/03/09 07:12:33 | 000,162,640 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswSP.sys -- (aswSP)
DRV - [2010/03/09 07:09:08 | 000,023,376 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2010/03/09 07:08:41 | 000,100,432 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2010/03/09 07:08:30 | 000,019,024 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010/03/09 07:08:15 | 000,028,880 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2010/02/13 16:51:36 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2009/10/26 17:48:54 | 000,145,408 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\VMM.sys -- (vmm)
DRV - [2009/10/07 10:03:04 | 000,094,992 | ---- | M] (Sun Microsystems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV - [2009/06/17 12:56:16 | 000,037,392 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2009/06/17 12:56:06 | 000,035,472 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2009/06/17 12:55:34 | 000,010,384 | ---- | M] (Logitech, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\LBeepKE.sys -- (LBeepKE)
DRV - [2009/06/17 12:55:18 | 000,020,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2009/06/17 08:20:34 | 000,012,648 | ---- | M] (Secunia) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\psi_mf.sys -- (PSI)
DRV - [2008/09/24 10:40:22 | 004,122,368 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\alcxwdm.sys -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2008/05/16 14:01:00 | 006,557,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2008/04/13 22:15:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2008/04/13 22:15:14 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2008/04/13 20:05:30 | 000,036,224 | ---- | M] (ADMtek Incorporated.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\an983.sys -- (AN983)
DRV - [2008/01/14 06:06:32 | 000,021,632 | ---- | M] (ManyCam LLC.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ManyCam.sys -- (ManyCam)
DRV - [2007/07/20 00:39:50 | 002,142,488 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LVMVdrv.sys -- (LVMVDrv)
DRV - [2007/07/20 00:37:56 | 002,109,592 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Lvckap.sys -- (LVcKap)
DRV - [2007/07/18 20:44:00 | 000,041,752 | R--- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2007/07/18 20:39:15 | 001,278,104 | R--- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2007/07/18 20:39:15 | 000,013,848 | R--- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lv302af.sys -- (pepifilter)
DRV - [2007/07/18 17:42:42 | 000,025,624 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2005/10/16 08:00:00 | 000,012,928 | ---- | M] (Bo Brantén) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\filedisk.sys -- (FileDisk)
DRV - [2004/12/31 11:43:08 | 000,004,682 | ---- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\npptNT2.sys -- (NPPTNT2)
DRV - [2004/07/14 10:23:00 | 000,045,568 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\VMNetSrv.sys -- (VPCNetS2)
DRV - [2004/06/03 10:40:46 | 000,079,360 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\nvatabus.sys -- (nvatabus)
DRV - [2004/05/25 15:58:04 | 000,396,032 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nvapu.sys -- (nvnforce) Service for NVIDIA® nForce™
DRV - [2004/05/25 15:58:02 | 000,048,640 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nvax.sys -- (nvax) Service for NVIDIA® nForce™
DRV - [2004/04/02 15:40:00 | 000,021,760 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\nv_agp.sys -- (nv_agp)
DRV - [2002/11/27 21:52:00 | 000,080,896 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\NVENET.sys -- (NVENET)
DRV - [2001/08/31 13:37:58 | 000,036,992 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sfman.sys -- (sfman) Creative SoundFont Manager Driver (WDM)
DRV - [2001/08/17 06:19:20 | 000,003,712 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctljystk.sys -- (ctljystk)
DRV - [2001/08/14 15:17:52 | 000,775,296 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\emu10k1f.sys -- (emu10k) Creative SB Live! Value (WDM)
DRV - [2001/07/11 11:34:52 | 000,006,912 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctlface.sys -- (emu10k1) Creative Interface Manager Driver (WDM)
DRV - [1999/12/17 01:00:00 | 000,006,752 | ---- | M] (Creative Technology Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\PfModNT.sys -- (PfModNT)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://google.com"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {38AB6A6C-CC4C-4f9e-A3DD-3C5681EF18A1}:1.0.3.110


FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/02 02:22:36 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/02 02:22:36 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird

[2010/03/11 23:00:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\Mozilla\Extensions
[2010/04/09 01:25:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\xw19c4l2.default\extensions
[2010/03/11 23:01:58 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\xw19c4l2.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/04/04 18:10:24 | 000,000,000 | ---D | M] () -- C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\xw19c4l2.default\extensions\{38AB6A6C-CC4C-4f9e-A3DD-3C5681EF18A1}
[2010/04/09 01:25:39 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009/08/18 17:42:10 | 000,049,152 | ---- | M] () -- C:\Program Files\Mozilla Firefox\components\SuperSearchXPCOM.dll
[2009/07/03 01:34:44 | 000,083,376 | ---- | M] (NHN USA Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npijjiautoinstallpluginff.dll
[2009/08/17 08:42:14 | 000,073,728 | ---- | M] (NHN USA Inc. ) -- C:\Program Files\Mozilla Firefox\plugins\npijjiFFPlugin1.dll
[2010/03/14 01:40:39 | 000,002,643 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\SiteVacuum.xml

O1 HOSTS File: ([2010/03/29 19:07:43 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Club Bing Toolbar Helper) - {B771FEA3-2A05-4c21-B1E2-55551A97D520} - C:\Program Files\Club Bing Toolbar Helper\Bmbho.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Club Bing Toolbar) - {719D74AB-1AF9-43A1-8C62-D8750628D93E} - C:\Program Files\Club Bing Toolbar\Toolbar.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Club Bing Toolbar Helper) - {B771FEA3-2A05-4c21-B1E2-55551A97D520} - C:\Program Files\Club Bing Toolbar Helper\Bmbho.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Club Bing Toolbar) - {719D74AB-1AF9-43A1-8C62-D8750628D93E} - C:\Program Files\Club Bing Toolbar\Toolbar.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Club Bing Toolbar Helper) - {B771FEA3-2A05-4C21-B1E2-55551A97D520} - C:\Program Files\Club Bing Toolbar Helper\Bmbho.dll (Microsoft Corporation)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ALWIL Software)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)
O4 - HKCU..\Run: [cdloader] C:\Documents and Settings\Dan\Application Data\mjusbsp\cdloader2.exe (magicJack L.P.)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
O4 - Startup: C:\Documents and Settings\Dan\Start Menu\Programs\Startup\windows [2010/03/28 19:58:26 | 000,000,000 | RHSD | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found
O15 - HKCU\..Trusted Ranges: Range1979 ([http] in Trusted sites)
O16 - DPF: {0B195D55-0AB4-48C7-828F-34BE10BA4266} http://www.worldwinner.com/games/v53/dealo...ealornodeal.cab (DealOrNoDeal Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} http://activex.camfrogweb.com/advanced/2.0..._instmodule.exe (CamfrogWEB Advanced Unicode Control)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/MessengerGam...1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu...b?1256872840765 (MUWebControl Class)
O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} http://zone.msn.com/bingame/zpagames/GAME_UNO1.cab60096.cab (UnoCtrl Class)
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} http://www.worldwinner.com/games/shared/wwlaunch.cab (Wwlaunch Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} http://appdirectory.messenger.msn.com/AppD...ap/PhtPkMSN.cab (PhotoPickConvert Class)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/...k.cab102118.cab (MSN Games - Installer)
O16 - DPF: {BA35B9B8-DE9E-47C9-AFA7-3C77E3DDFD39} http://www.worldwinner.com/games/v46/monopoly/monopoly.cab (Monopoly Control)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx1.hotmail.com/mail/w4/pr01/photo...ol/MSNPUpld.cab (Windows Live Hotmail Photo Upload Tool)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/10/17 07:25:32 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/04/08 02:05:58 | 001,118,208 | ---- | C] (www.killer-anas.com) -- C:\Documents and Settings\Dan\Desktop\Room Domination 13 Cracked by Diablo1337.exe
[2010/04/06 17:20:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Application Data\QuickScan
[2010/04/04 18:15:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Local Settings\Application Data\SCE
[2010/04/04 18:10:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Application Data\Sony Online Entertainment
[2010/04/04 00:11:39 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Dan\Recent
[2010/04/03 18:58:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Local Settings\Application Data\Unity
[2010/04/03 14:22:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\My Documents\Graboid
[2010/04/03 14:09:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Local Settings\Application Data\Graboid_Inc
[2010/04/03 14:08:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Application Data\MozillaControl
[2010/04/03 14:08:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Local Settings\Application Data\Graboid
[2010/04/03 14:06:59 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla ActiveX Control v1.7.12
[2010/04/03 14:03:10 | 000,000,000 | ---D | C] -- C:\Program Files\Graboid
[2010/04/03 13:24:46 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2010/04/01 18:19:19 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010/04/01 18:18:41 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/04/01 18:18:41 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/04/01 18:18:41 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/04/01 18:18:41 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010/04/01 18:18:23 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2010/04/01 15:57:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Application Data\Malwarebytes
[2010/04/01 15:57:33 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/04/01 15:57:31 | 000,020,824 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/04/01 15:57:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/04/01 15:57:30 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/03/31 23:44:29 | 000,000,000 | ---D | C] -- C:\7a218fe861a1861a0de5ff
[2010/03/31 23:06:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Application Data\EyeballChatAvatars
[2010/03/31 22:29:18 | 000,000,000 | ---D | C] -- C:\dbcbf27d75784b9827fde2b3
[2010/03/31 22:20:07 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/03/31 21:25:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\My Documents\EyeballMessageArchive
[2010/03/31 21:17:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Application Data\EyeballChatUserData
[2010/03/31 21:14:09 | 000,000,000 | ---D | C] -- C:\Program Files\Eyeball Networks
[2010/03/31 17:21:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Desktop\Swagbucks Autosearch
[2010/03/31 17:15:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Desktop\MultiSpeed 2.3.1
[2010/03/30 16:40:54 | 000,000,000 | ---D | C] -- C:\Program Files\AdCalls
[2010/03/29 19:13:53 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2010/03/29 18:55:05 | 000,000,000 | ---D | C] -- C:\schrauber
[2010/03/28 23:30:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Local Settings\Application Data\Club Bing Toolbar
[2010/03/28 23:29:38 | 000,000,000 | ---D | C] -- C:\Program Files\Club Bing Toolbar Helper
[2010/03/28 23:23:30 | 000,000,000 | ---D | C] -- C:\Program Files\Club Bing Toolbar
[2010/03/28 19:57:08 | 000,000,000 | RHSD | C] -- C:\Documents and Settings\Dan\Start Menu\Programs\Startup\windows
[2010/03/28 19:57:05 | 000,000,000 | ---D | C] -- C:\Program Files\Web Increaser
[2010/03/28 17:04:27 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/03/28 17:03:32 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/03/28 17:03:32 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/03/28 17:03:32 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/03/28 17:03:32 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/03/28 17:03:21 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/03/28 17:00:54 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/03/28 15:56:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\My Documents\AIMLogger
[2010/03/28 15:18:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Application Data\acccore
[2010/03/28 15:18:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Local Settings\Application Data\AIM
[2010/03/28 15:18:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Local Settings\Application Data\AOL
[2010/03/28 15:18:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AIM
[2010/03/28 15:18:11 | 000,000,000 | ---D | C] -- C:\Program Files\AIM
[2010/03/28 15:18:08 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\AOL
[2010/03/28 02:11:57 | 000,361,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\tcpip.copy
[2010/03/26 21:05:52 | 000,000,000 | ---D | C] -- C:\Program Files\Synergy
[2010/03/26 19:36:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\synergy
[2010/03/25 20:46:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\My Documents\Web Page Maker
[2010/03/25 20:46:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Application Data\Web Page Maker
[2010/03/25 20:46:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Web Page Maker
[2010/03/25 20:45:33 | 000,000,000 | ---D | C] -- C:\Program Files\Web Page Maker
[2010/03/24 22:37:17 | 000,000,000 | ---D | C] -- C:\Program Files\Secunia
[2010/03/24 22:22:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9 Installer
[2010/03/24 22:04:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Application Data\Yahoo!
[2010/03/24 20:41:56 | 000,000,000 | ---D | C] -- C:\rei
[2010/03/24 20:41:52 | 000,000,000 | ---D | C] -- C:\Program Files\Reimage
[2010/03/23 14:28:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\EPSON
[2010/03/23 14:28:25 | 000,086,528 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\System32\E_FLBEJA.DLL
[2010/03/23 14:28:25 | 000,078,848 | ---- | C] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\System32\E_FD4BEJA.DLL
[2010/03/23 13:56:34 | 000,025,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbprint.sys
[2010/03/21 19:20:28 | 000,148,816 | ---- | C] (Info-ZIP) -- C:\WINDOWS\System32\unzip32.dll
[2010/03/18 14:21:31 | 000,036,224 | ---- | C] (ADMtek Incorporated.) -- C:\WINDOWS\System32\drivers\an983.sys
[2010/03/18 14:21:31 | 000,036,224 | ---- | C] (ADMtek Incorporated.) -- C:\WINDOWS\System32\dllcache\an983.sys
[2010/03/17 14:06:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\.kbotpro
[2010/03/12 12:54:51 | 001,080,560 | ---- | C] (Unique Internet Services ) -- C:\Documents and Settings\Dan\Desktop\pfsetup.exe
[2010/03/11 22:20:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Desktop\bookmarks
[2010/01/25 22:35:53 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2010/01/25 22:35:53 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2010/01/25 22:35:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2010/01/25 22:35:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2009/11/11 01:02:54 | 001,080,560 | ---- | C] (Unique Internet Services ) -- C:\Program Files\pfsetup.exe
[2009/10/25 04:38:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ESET
[1998/10/14 16:03:00 | 000,059,392 | ---- | C] ( ) -- C:\WINDOWS\System32\a3d.dll
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/04/09 04:54:31 | 000,000,418 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{E65DB39B-9B4F-44ED-8CBC-AD64A0F41542}.job
[2010/04/09 04:27:01 | 000,000,970 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-1935655697-1547161642-1003UA.job
[2010/04/08 21:32:42 | 007,864,320 | ---- | M] () -- C:\Documents and Settings\Dan\ntuser.dat
[2010/04/08 17:27:01 | 000,000,918 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-1935655697-1547161642-1003Core.job
[2010/04/08 16:04:10 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/04/08 16:03:48 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/04/08 16:03:39 | 000,186,097 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2010/04/08 16:03:28 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/04/08 16:03:25 | 1073,274,880 | -HS- | M] () -- C:\hiberfil.sys
[2010/04/08 07:04:52 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Dan\ntuser.ini
[2010/04/06 19:31:30 | 000,021,504 | ---- | M] () -- C:\Documents and Settings\Dan\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/06 03:44:06 | 000,000,913 | -H-- | M] () -- C:\IPH.PH
[2010/04/06 03:43:49 | 000,001,618 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Retry AIM Installation.lnk
[2010/04/05 14:58:56 | 000,001,663 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\FileZilla Client.lnk
[2010/04/05 14:58:37 | 004,169,301 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\FileZilla_3.3.2.1_win32-setup.exe
[2010/04/05 00:07:09 | 000,000,069 | ---- | M] () -- C:\Documents and Settings\Dan\jagex_runescape_preferences2.dat
[2010/04/04 23:32:14 | 000,000,041 | ---- | M] () -- C:\Documents and Settings\Dan\jagex_runescape_preferences.dat
[2010/04/04 23:25:47 | 002,943,578 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\KbotObf-B625.jar
[2010/04/04 18:12:40 | 000,001,440 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Free Realms.lnk
[2010/04/04 04:53:45 | 002,654,986 | -H-- | M] () -- C:\Documents and Settings\Dan\Local Settings\Application Data\IconCache.db
[2010/04/03 14:06:59 | 000,000,935 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Graboid Video.lnk
[2010/04/03 14:06:36 | 000,000,719 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2010/04/01 18:19:58 | 000,013,320 | ---- | M] () -- C:\Documents and Settings\Dan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/04/01 18:18:27 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010/04/01 18:18:27 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010/04/01 18:18:27 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010/04/01 18:18:27 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010/04/01 18:18:26 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deploytk.dll
[2010/04/01 15:57:36 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/04/01 13:01:49 | 000,097,456 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/03/31 23:44:00 | 000,490,040 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/03/31 23:44:00 | 000,433,718 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/03/31 23:44:00 | 000,067,714 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/03/31 23:22:31 | 000,006,524 | ---- | M] () -- C:\Documents and Settings\Dan\My Documents\sc_config_eyeballchat.xml
[2010/03/31 23:22:27 | 000,002,423 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Eyeball Chat.lnk
[2010/03/31 14:12:22 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Dan\jagex__preferences3.dat
[2010/03/30 16:41:34 | 000,001,521 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AdCalls.lnk
[2010/03/29 19:50:11 | 000,001,086 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Shortcut to Voice Controller 17_cracked_by_kracker-gg.exe.lnk
[2010/03/29 19:08:05 | 000,000,318 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/03/29 19:07:43 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/03/29 18:56:40 | 003,905,917 | R--- | M] () -- C:\Documents and Settings\Dan\Desktop\schrauber.exe
[2010/03/29 15:24:58 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/03/29 15:24:46 | 000,020,824 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/03/28 19:57:05 | 000,000,623 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Web Increaser.lnk
[2010/03/28 19:05:32 | 000,658,432 | ---- | M] () -- C:\Program Files\Web Increaser V1.0.exe
[2010/03/28 17:04:37 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2010/03/28 15:18:18 | 000,001,574 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AIM.lnk
[2010/03/27 22:08:56 | 000,000,250 | ---- | M] () -- C:\Documents and Settings\Dan\My Documents\synergy.sgc
[2010/03/26 21:05:53 | 000,001,542 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Synergy.lnk
[2010/03/26 19:19:53 | 000,135,168 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\darkvcdom.exe
[2010/03/26 12:32:01 | 000,000,805 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Shortcut to ProxyGrabber.exe.lnk
[2010/03/25 20:45:36 | 000,000,710 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Web Page Maker.lnk
[2010/03/25 14:03:48 | 000,001,058 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Shortcut to Room Domination 13 Cracked by Diablo1337.exe.lnk
[2010/03/25 01:30:07 | 000,001,537 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/03/24 22:37:19 | 000,000,716 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Secunia PSI.lnk
[2010/03/24 22:03:25 | 000,000,802 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Yahoo! Messenger.lnk
[2010/03/24 20:41:57 | 000,001,715 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Reimage Repair.lnk
[2010/03/24 01:17:25 | 000,001,478 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\ClubWPT.lnk
[2010/03/23 23:35:49 | 000,001,516 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Shortcut to The Voice Domination 4.5.exe.lnk
[2010/03/23 14:24:06 | 000,000,601 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/03/23 14:24:06 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010/03/23 11:25:19 | 000,001,824 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Camfrog Video Chat 5.5.lnk
[2010/03/22 16:47:48 | 000,000,942 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Shortcut to CLDL.exe.lnk
[2010/03/21 19:20:29 | 000,148,816 | ---- | M] (Info-ZIP) -- C:\WINDOWS\System32\unzip32.dll
[2010/03/21 19:20:28 | 000,053,248 | ---- | M] () -- C:\WINDOWS\System32\quick32.dll
[2010/03/21 11:43:34 | 000,000,494 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\Shortcut to Empire Earth.exe.lnk
[2010/03/20 11:48:02 | 000,000,170 | ---- | M] () -- C:\Documents and Settings\Dan\defogger_reenable
[2010/03/14 15:54:32 | 000,000,879 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\TeamViewer 5.lnk
[2010/03/12 18:02:38 | 000,261,632 | ---- | M] () -- C:\WINDOWS\PEV.exe
[2010/03/12 13:02:47 | 000,000,680 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\ProxyFirewall.lnk
[2010/03/12 12:57:31 | 000,001,548 | ---- | M] () -- C:\Documents and Settings\Dan\Desktop\CCleaner.lnk
[2010/03/12 12:54:53 | 001,080,560 | ---- | M] (Unique Internet Services ) -- C:\Documents and Settings\Dan\Desktop\pfsetup.exe
[2010/03/11 23:04:04 | 000,001,602 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/04/06 03:43:49 | 000,001,618 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Retry AIM Installation.lnk
[2010/04/05 14:58:30 | 004,169,301 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\FileZilla_3.3.2.1_win32-setup.exe
[2010/04/04 23:25:42 | 002,943,578 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\KbotObf-B625.jar
[2010/04/04 18:12:40 | 000,001,440 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Free Realms.lnk
[2010/04/03 14:06:59 | 000,000,935 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Graboid Video.lnk
[2010/04/03 14:06:36 | 000,000,719 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2010/04/01 15:57:36 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/03/31 22:32:50 | 000,066,416 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/03/31 21:16:31 | 000,006,524 | ---- | C] () -- C:\Documents and Settings\Dan\My Documents\sc_config_eyeballchat.xml
[2010/03/31 21:14:16 | 000,002,423 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Eyeball Chat.lnk
[2010/03/31 14:12:22 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Dan\jagex__preferences3.dat
[2010/03/30 16:41:34 | 000,001,521 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\AdCalls.lnk
[2010/03/30 16:41:34 | 000,000,026 | ---- | C] () -- C:\WINDOWS\System32\contacts.csv
[2010/03/29 19:50:11 | 000,001,086 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Shortcut to Voice Controller 17_cracked_by_kracker-gg.exe.lnk
[2010/03/28 19:57:05 | 000,000,623 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Web Increaser.lnk
[2010/03/28 19:05:32 | 000,658,432 | ---- | C] () -- C:\Program Files\Web Increaser V1.0.exe
[2010/03/28 17:04:37 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/03/28 17:04:31 | 000,260,272 | ---- | C] () -- C:\cmldr
[2010/03/28 17:03:32 | 000,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/03/28 17:03:32 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/03/28 17:03:32 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/03/28 17:03:32 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/03/28 17:03:32 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/03/28 16:57:33 | 003,905,917 | R--- | C] () -- C:\Documents and Settings\Dan\Desktop\schrauber.exe
[2010/03/28 15:18:18 | 000,001,574 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\AIM.lnk
[2010/03/28 15:17:43 | 000,000,913 | -H-- | C] () -- C:\IPH.PH
[2010/03/27 21:38:18 | 000,000,250 | ---- | C] () -- C:\Documents and Settings\Dan\My Documents\synergy.sgc
[2010/03/26 21:05:53 | 000,001,542 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Synergy.lnk
[2010/03/26 19:19:47 | 000,135,168 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\darkvcdom.exe
[2010/03/26 12:32:01 | 000,000,805 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Shortcut to ProxyGrabber.exe.lnk
[2010/03/25 20:45:36 | 000,000,710 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Web Page Maker.lnk
[2010/03/25 14:03:48 | 000,001,058 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Shortcut to Room Domination 13 Cracked by Diablo1337.exe.lnk
[2010/03/24 22:37:19 | 000,000,716 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Secunia PSI.lnk
[2010/03/24 22:23:38 | 000,001,537 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/03/24 22:03:25 | 000,000,802 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Yahoo! Messenger.lnk
[2010/03/24 20:41:57 | 000,001,715 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Reimage Repair.lnk
[2010/03/23 23:35:49 | 000,001,516 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Shortcut to The Voice Domination 4.5.exe.lnk
[2010/03/23 11:25:19 | 000,001,824 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Camfrog Video Chat 5.5.lnk
[2010/03/22 16:47:48 | 000,000,942 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Shortcut to CLDL.exe.lnk
[2010/03/21 19:20:28 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\quick32.dll
[2010/03/21 11:43:34 | 000,000,494 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\Shortcut to Empire Earth.exe.lnk
[2010/03/20 11:48:00 | 000,000,170 | ---- | C] () -- C:\Documents and Settings\Dan\defogger_reenable
[2010/03/18 14:20:57 | 1073,274,880 | -HS- | C] () -- C:\hiberfil.sys
[2010/03/12 13:02:47 | 000,000,680 | ---- | C] () -- C:\Documents and Settings\Dan\Desktop\ProxyFirewall.lnk
[2010/03/11 23:00:11 | 000,001,602 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/03/10 23:59:31 | 007,864,320 | ---- | C] () -- C:\Documents and Settings\Dan\ntuser.dat
[2010/02/06 19:42:49 | 000,000,479 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2010/02/06 19:39:42 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll
[2010/02/06 19:39:42 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll
[2010/02/04 19:15:17 | 000,688,128 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
[2010/02/04 19:15:17 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll
[2010/01/19 02:59:52 | 000,002,554 | ---- | C] () -- C:\WINDOWS\WAVEMIX.INI
[2010/01/19 00:43:45 | 000,000,836 | ---- | C] () -- C:\WINDOWS\cdPlayer.ini
[2009/12/14 10:35:08 | 001,380,403 | ---- | C] () -- C:\WINDOWS\System32\avgsdk.dll
[2009/12/11 12:54:46 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Dan\Local Settings\Application Data\prvlcl.dat
[2009/11/21 10:04:59 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\aesma.dll
[2009/11/21 09:29:15 | 000,000,033 | ---- | C] () -- C:\WINDOWS\GunzLauncher.INI
[2009/11/14 16:52:34 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\Dan\Local Settings\Application Data\PUTTY.RND
[2009/11/10 12:38:05 | 000,691,696 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2009/10/20 05:18:53 | 000,021,504 | ---- | C] () -- C:\Documents and Settings\Dan\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/10/18 16:50:22 | 000,034,308 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
[2009/10/18 15:32:26 | 000,941,784 | ---- | C] () -- C:\WINDOWS\System32\drivers\CAMTHWDM.sys
[2009/10/18 14:42:44 | 000,000,075 | ---- | C] () -- C:\Documents and Settings\Dan\Application Data\RSBot Accounts.ini
[2009/10/18 03:11:03 | 000,058,163 | R--- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2009/10/18 00:04:20 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2009/10/17 23:07:42 | 000,000,069 | ---- | C] () -- C:\WINDOWS\SBWIN.INI
[2009/10/17 19:00:06 | 000,004,940 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\mtbjfghn.xbe
[2008/08/14 19:08:50 | 000,209,001 | ---- | C] () -- C:\WINDOWS\System32\malauA07_07.dll
[2008/06/05 00:50:18 | 000,208,997 | ---- | C] () -- C:\WINDOWS\System32\MyCfHook8.dll
[2008/06/03 08:08:48 | 000,208,996 | ---- | C] () -- C:\WINDOWS\System32\MuteHook5.dll
[2008/05/16 14:01:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2008/05/16 14:01:00 | 001,486,848 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2008/05/16 14:01:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2008/05/16 14:01:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2008/05/16 14:01:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2008/05/05 14:22:44 | 000,209,007 | ---- | C] () -- C:\WINDOWS\System32\SlickMix5.dll
[2007/07/18 17:42:42 | 000,025,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2007/03/01 17:50:22 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\yacsui.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 149 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 137 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8A58D29C
@Alternate Data Stream - 100 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C31F31E6
< End of report >