Hey, I have seen this site before but have usually been able to fix problems without posting. I have recently became
overwhelmed with redirects mostly from clicking google links, but it appears that MALWARE BYTES is blocking attempts when just viewing some pages. I have had fake antivirus messages pop up before but I usually just end the task, delete the start-up entry and do a system restore and that keeps them gone for a while but they always come back. I could really use some help in fixing these problems =] I have done a full scan with Malware Bytes, and Spybot S&D. I would really not like to waste anyones time so I will post as many logs as I can to avoid wasting time. I really hope it doesnt come off as disrecpectfull, im just trying to save time.
Thanks SO much! =]
Index:
1: Malwarebytes PROTECTION Log
2: DDS logfile.
3: GMER logfile
4: Malware Bytes logfile
5: RSIT Logfile
1: Malwarebytes PROTECTION Log
13:14:24 Bobby MESSAGE Protection started successfully
13:14:31 Bobby MESSAGE IP Protection started successfully
13:23:20 Bobby IP-BLOCK 85.12.46.159
13:23:23 Bobby IP-BLOCK 85.12.46.159
13:23:29 Bobby IP-BLOCK 85.12.46.159
13:23:41 Bobby IP-BLOCK 85.12.46.159
13:23:44 Bobby IP-BLOCK 85.12.46.159
13:23:50 Bobby IP-BLOCK 85.12.46.159
13:24:02 Bobby IP-BLOCK 85.12.46.159
13:24:05 Bobby IP-BLOCK 85.12.46.159
13:24:11 Bobby IP-BLOCK 85.12.46.159
13:24:23 Bobby IP-BLOCK 85.12.46.158
13:24:26 Bobby IP-BLOCK 85.12.46.158
13:24:32 Bobby IP-BLOCK 85.12.46.158
13:24:44 Bobby IP-BLOCK 85.12.46.159
13:24:47 Bobby IP-BLOCK 85.12.46.159
13:24:53 Bobby IP-BLOCK 85.12.46.159
13:25:05 Bobby IP-BLOCK 85.12.46.158
13:25:08 Bobby IP-BLOCK 85.12.46.158
13:25:14 Bobby IP-BLOCK 85.12.46.158
13:25:26 Bobby IP-BLOCK 85.12.46.158
13:25:29 Bobby IP-BLOCK 85.12.46.158
13:25:35 Bobby IP-BLOCK 85.12.46.158
13:25:47 Bobby IP-BLOCK 91.212.226.178
13:25:50 Bobby IP-BLOCK 91.212.226.178
13:25:56 Bobby IP-BLOCK 91.212.226.178
13:26:08 Bobby IP-BLOCK 85.12.46.158
13:26:08 Bobby IP-BLOCK 91.212.226.178
13:26:11 Bobby IP-BLOCK 85.12.46.158
13:26:11 Bobby IP-BLOCK 91.212.226.178
13:26:17 Bobby IP-BLOCK 85.12.46.158
13:27:31 Bobby IP-BLOCK 78.26.187.170
13:27:33 Bobby IP-BLOCK 64.111.196.126
13:27:34 Bobby IP-BLOCK 78.26.187.170
13:27:38 Bobby IP-BLOCK 64.111.196.126
13:27:40 Bobby IP-BLOCK 78.26.187.170
13:27:47 Bobby IP-BLOCK 85.12.46.159
13:27:48 Bobby IP-BLOCK 64.111.196.126
13:27:49 Bobby IP-BLOCK 208.87.33.151
13:27:50 Bobby IP-BLOCK 85.12.46.159
13:27:52 Bobby IP-BLOCK 208.87.33.151
13:27:56 Bobby IP-BLOCK 85.12.46.159
13:27:58 Bobby IP-BLOCK 208.87.33.151
13:27:59 Bobby IP-BLOCK 208.87.33.151
13:28:02 Bobby IP-BLOCK 208.87.33.151
13:28:08 Bobby IP-BLOCK 85.12.46.158
13:28:08 Bobby IP-BLOCK 64.111.196.126
13:28:08 Bobby IP-BLOCK 208.87.33.151
13:28:11 Bobby IP-BLOCK 85.12.46.158
13:28:17 Bobby IP-BLOCK 85.12.46.158
13:28:29 Bobby IP-BLOCK 91.212.226.178
13:28:32 Bobby IP-BLOCK 91.212.226.178
13:28:38 Bobby IP-BLOCK 91.212.226.178
13:28:48 Bobby IP-BLOCK 64.111.196.126
13:28:50 Bobby IP-BLOCK 91.212.226.130
13:28:53 Bobby IP-BLOCK 91.212.226.130
13:28:59 Bobby IP-BLOCK 91.212.226.130
13:29:11 Bobby IP-BLOCK 85.12.46.159
13:29:14 Bobby IP-BLOCK 85.12.46.159
13:29:20 Bobby IP-BLOCK 85.12.46.159
13:36:05 Bobby IP-BLOCK 85.12.46.159
13:36:08 Bobby IP-BLOCK 85.12.46.159
13:36:14 Bobby IP-BLOCK 85.12.46.159
13:36:26 Bobby IP-BLOCK 85.12.46.158
13:36:29 Bobby IP-BLOCK 85.12.46.158
13:36:35 Bobby IP-BLOCK 85.12.46.158
13:36:47 Bobby IP-BLOCK 91.212.226.178
13:36:50 Bobby IP-BLOCK 91.212.226.178
13:36:56 Bobby IP-BLOCK 91.212.226.178
13:37:08 Bobby IP-BLOCK 91.212.226.130
13:37:11 Bobby IP-BLOCK 91.212.226.130
13:37:17 Bobby IP-BLOCK 91.212.226.130
13:37:29 Bobby IP-BLOCK 85.12.46.159
13:37:32 Bobby IP-BLOCK 85.12.46.159
13:38:04 Bobby DETECTION C:\WINDOWS\system32\dllcache\beep.sys Fake.Beep.sys QUARANTINE
13:38:04 Bobby DETECTION C:\WINDOWS\system32\dllcache\beep.sys Fake.Beep.sys DENY
13:38:05 Bobby ERROR Quarantine failed: UtilityReadFile failed with error code 2
13:39:21 Bobby DETECTION C:\WINDOWS\system32\dllcache\cdrom.sys Trojan.Patched QUARANTINE
13:39:21 Bobby DETECTION C:\WINDOWS\system32\dllcache\cdrom.sys Trojan.Patched DENY
13:39:22 Bobby ERROR Quarantine failed: UtilityReadFile failed with error code 2
13:39:34 Bobby IP-BLOCK 85.12.46.159
13:39:37 Bobby IP-BLOCK 85.12.46.159
13:39:43 Bobby IP-BLOCK 85.12.46.159
13:39:55 Bobby IP-BLOCK 85.12.46.158
13:39:58 Bobby IP-BLOCK 85.12.46.158
13:40:04 Bobby IP-BLOCK 85.12.46.158
13:40:16 Bobby IP-BLOCK 91.212.226.178
13:40:19 Bobby IP-BLOCK 91.212.226.178
13:40:25 Bobby IP-BLOCK 91.212.226.178
13:40:37 Bobby IP-BLOCK 91.212.226.130
13:40:40 Bobby IP-BLOCK 91.212.226.130
13:40:46 Bobby IP-BLOCK 91.212.226.130
13:40:58 Bobby IP-BLOCK 85.12.46.159
13:41:01 Bobby IP-BLOCK 85.12.46.159
13:41:07 Bobby IP-BLOCK 85.12.46.159
13:41:19 Bobby IP-BLOCK 85.12.46.159
13:41:22 Bobby IP-BLOCK 85.12.46.159
13:41:28 Bobby IP-BLOCK 85.12.46.159
13:41:40 Bobby IP-BLOCK 85.12.46.158
13:41:42 Bobby IP-BLOCK 85.12.46.159
13:41:43 Bobby IP-BLOCK 85.12.46.158
13:41:45 Bobby IP-BLOCK 85.12.46.159
13:41:49 Bobby IP-BLOCK 85.12.46.158
13:41:51 Bobby IP-BLOCK 85.12.46.159
13:42:01 Bobby IP-BLOCK 91.212.226.178
13:42:03 Bobby IP-BLOCK 85.12.46.158
13:42:04 Bobby IP-BLOCK 91.212.226.178
13:42:06 Bobby IP-BLOCK 85.12.46.158
13:42:10 Bobby IP-BLOCK 91.212.226.178
13:42:12 Bobby IP-BLOCK 85.12.46.158
13:42:22 Bobby IP-BLOCK 91.212.226.130
13:42:24 Bobby IP-BLOCK 91.212.226.178
13:42:25 Bobby IP-BLOCK 91.212.226.130
13:42:27 Bobby IP-BLOCK 91.212.226.178
13:42:31 Bobby IP-BLOCK 91.212.226.130
13:42:33 Bobby IP-BLOCK 91.212.226.178
13:42:43 Bobby IP-BLOCK 85.12.46.159
13:42:45 Bobby IP-BLOCK 91.212.226.130
13:42:46 Bobby IP-BLOCK 85.12.46.159
13:42:48 Bobby IP-BLOCK 91.212.226.130
13:42:52 Bobby IP-BLOCK 85.12.46.159
13:42:54 Bobby IP-BLOCK 91.212.226.130
13:43:06 Bobby IP-BLOCK 85.12.46.159
13:43:09 Bobby IP-BLOCK 85.12.46.159
13:43:15 Bobby IP-BLOCK 85.12.46.159
13:45:07 Bobby IP-BLOCK 94.228.209.200
13:45:10 Bobby IP-BLOCK 94.228.209.200
13:45:16 Bobby IP-BLOCK 94.228.209.200
13:51:38 Bobby IP-BLOCK 85.12.46.159
13:51:41 Bobby IP-BLOCK 85.12.46.159
13:51:47 Bobby IP-BLOCK 85.12.46.159
13:51:59 Bobby IP-BLOCK 85.12.46.159
13:52:02 Bobby IP-BLOCK 85.12.46.159
13:52:08 Bobby IP-BLOCK 85.12.46.159
13:52:20 Bobby IP-BLOCK 85.12.46.158
13:52:23 Bobby IP-BLOCK 85.12.46.158
13:52:29 Bobby IP-BLOCK 85.12.46.158
13:52:41 Bobby IP-BLOCK 85.12.46.158
13:52:44 Bobby IP-BLOCK 85.12.46.158
13:52:51 Bobby IP-BLOCK 85.12.46.158
13:53:03 Bobby IP-BLOCK 91.212.226.178
13:53:06 Bobby IP-BLOCK 91.212.226.178
13:53:12 Bobby IP-BLOCK 91.212.226.178
13:53:24 Bobby IP-BLOCK 91.212.226.178
13:53:27 Bobby IP-BLOCK 91.212.226.178
13:53:33 Bobby IP-BLOCK 91.212.226.178
13:53:45 Bobby IP-BLOCK 85.12.46.159
13:53:48 Bobby IP-BLOCK 85.12.46.159
13:53:54 Bobby IP-BLOCK 85.12.46.159
13:54:06 Bobby IP-BLOCK 91.212.226.130
13:54:09 Bobby IP-BLOCK 91.212.226.130
13:54:15 Bobby IP-BLOCK 91.212.226.130
13:54:27 Bobby IP-BLOCK 91.212.226.130
13:54:30 Bobby IP-BLOCK 91.212.226.130
13:54:36 Bobby IP-BLOCK 91.212.226.130
13:54:48 Bobby IP-BLOCK 85.12.46.158
13:54:51 Bobby IP-BLOCK 85.12.46.158
13:54:57 Bobby IP-BLOCK 85.12.46.158
13:55:09 Bobby IP-BLOCK 85.12.46.159
13:55:12 Bobby IP-BLOCK 85.12.46.159
13:55:18 Bobby IP-BLOCK 85.12.46.159
13:55:30 Bobby IP-BLOCK 85.12.46.159
13:55:33 Bobby IP-BLOCK 85.12.46.159
13:55:39 Bobby IP-BLOCK 85.12.46.159
13:55:51 Bobby IP-BLOCK 91.212.226.178
13:55:54 Bobby IP-BLOCK 91.212.226.178
13:56:00 Bobby IP-BLOCK 91.212.226.178
13:56:12 Bobby IP-BLOCK 85.12.46.159
13:56:15 Bobby IP-BLOCK 85.12.46.159
13:56:21 Bobby IP-BLOCK 85.12.46.159
13:56:33 Bobby IP-BLOCK 91.212.226.130
13:56:36 Bobby IP-BLOCK 91.212.226.130
13:56:42 Bobby IP-BLOCK 91.212.226.130
13:56:54 Bobby IP-BLOCK 85.12.46.158
13:56:57 Bobby IP-BLOCK 85.12.46.158
13:57:03 Bobby IP-BLOCK 85.12.46.158
13:57:15 Bobby IP-BLOCK 85.12.46.159
13:57:18 Bobby IP-BLOCK 85.12.46.159
13:57:24 Bobby IP-BLOCK 85.12.46.159
13:57:36 Bobby IP-BLOCK 91.212.226.178
13:57:39 Bobby IP-BLOCK 91.212.226.178
13:57:45 Bobby IP-BLOCK 91.212.226.178
13:57:57 Bobby IP-BLOCK 91.212.226.130
13:58:00 Bobby IP-BLOCK 91.212.226.130
13:58:06 Bobby IP-BLOCK 91.212.226.130
13:58:18 Bobby IP-BLOCK 85.12.46.159
13:58:21 Bobby IP-BLOCK 85.12.46.159
13:58:27 Bobby IP-BLOCK 85.12.46.159
14:01:28 Bobby IP-BLOCK 94.228.209.200
14:01:31 Bobby IP-BLOCK 94.228.209.200
14:01:37 Bobby IP-BLOCK 94.228.209.200
14:01:57 Bobby IP-BLOCK 91.212.226.67
14:02:00 Bobby IP-BLOCK 91.212.226.67
14:02:06 Bobby IP-BLOCK 91.212.226.67
14:06:12 Bobby DETECTION C:\WINDOWS\system32\dllcache\setup.exe Trojan.Dropper QUARANTINE
14:06:12 Bobby DETECTION C:\WINDOWS\system32\dllcache\setup.exe Trojan.Dropper DENY
14:06:13 Bobby ERROR Quarantine failed: UtilityReadFile failed with error code 2
14:06:26 Bobby IP-BLOCK 85.12.46.159
14:06:29 Bobby IP-BLOCK 85.12.46.159
14:06:35 Bobby IP-BLOCK 85.12.46.159
14:06:47 Bobby IP-BLOCK 85.12.46.158
14:06:50 Bobby IP-BLOCK 85.12.46.158
14:06:56 Bobby IP-BLOCK 85.12.46.158
14:07:08 Bobby IP-BLOCK 91.212.226.178
14:07:11 Bobby IP-BLOCK 91.212.226.178
14:07:17 Bobby IP-BLOCK 91.212.226.178
14:07:29 Bobby IP-BLOCK 91.212.226.130
14:07:32 Bobby IP-BLOCK 91.212.226.130
14:07:38 Bobby IP-BLOCK 91.212.226.130
14:07:50 Bobby IP-BLOCK 85.12.46.159
14:07:53 Bobby IP-BLOCK 85.12.46.159
14:07:59 Bobby IP-BLOCK 85.12.46.159
2:DDS logfile
DDS (Ver_10-03-17.01) - NTFSx86
Run by Bobby at 15:08:41.21 on Thu 05/27/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1532 [GMT -4:00]
============== Running Processes ===============
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\No-IP\DUC20.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\TVersity\Media Server\MediaServer.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Bobby\Desktop\dds.EXE
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.myspace.com/
uInternet Settings,ProxyOverride = *.local
mWinlogon: UIHost=c:\windows\system32\logonuiX.exe
BHO: IDMIEHlprObj Class: {0055c089-8582-441b-a0bf-17b458c2a3a8} - c:\program files\internet download manager\IDMIECC.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search &
destroy\SDHelper.dll
BHO: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program
files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No File
uRun: [RoboForm] "c:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [IDMan] c:\program files\internet download manager\IDMan.exe /onboot
uRun: [CursorXP] "c:\program files\cursorxp\CursorXP.exe" -s
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [AlcWzrd] ALCWZRD.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe"
mRun: [VAIO Recovery] c:\windows\sonysys\vaio recovery\PartSeal.exe
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [LogonStudio] "c:\program files\wincustomize\logonstudio\logonstudio.exe" /RANDOM
mRun: [BootSkin Startup Jobs] "c:\program files\stardock\wincustomize\bootskin\BootSkin.exe" /StartupJobs
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
StartupFolder: c:\docume~1\bobby\startm~1\programs\startup\digsby.lnk - c:\documents and settings\bobby\local
settings\application data\digsby\app\digsby.exe
IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
IE: Customize Menu - file://c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html
IE: Download all links with IDM - c:\program files\internet download manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\internet download manager\IEGetVL.htm
IE: Download with IDM - c:\program files\internet download manager\IEExt.htm
IE: Fill Forms - file://c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\bobby\start menu\programs\imvu\Run IMVU.lnk
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search &
destroy\SDHelper.dll
DPF: {33564D57-0000-0010-8000-00AA00389B71} -
hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} -
hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab
DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} -
hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
TCP: {D542AEF8-992B-4FBA-A21A-00C46D344652} = 68.87.74.166,68.87.68.166
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: igfxcui - igfxsrvc.dll
Notify: WBSrv - c:\progra~1\stardock\object~1\window~1\wbsrv.dll
AppInit_DLLs: wbsys.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\bobby\applic~1\mozilla\firefox\profiles\az47jzth.default\
FF - prefs.js: browser.startup.homepage - hxxp://search.orbitdownloader.com
FF - component: c:\documents and settings\bobby\application data\idm\idmmzcc3\components\idmmzcc.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} -
c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js -
pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken",
false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual",
"http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name",
"chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js -
pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
============= SERVICES / DRIVERS ===============
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-2-24 304464]
R2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2009-10-20 50704]
R2 StarWindServiceAE;StarWind AE Service;c:\program files\alcohol soft\alcohol 120\starwind\StarWindServiceAE.exe
[2009-12-23 370688]
R2 WMDrive;WMDrive;c:\windows\system32\drivers\WMDrive.sys [2010-4-21 37376]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-2-24 20952]
S3 cpudrv;cpudrv;c:\program files\systemrequirementslab\cpudrv.sys [2009-12-18 11336]
S4 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-11-13 92008]
============== File Associations ===============
.txt=
=============== Created Last 30 ================
2010-05-27 18:19:24 116224 -c--a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2010-05-27 18:19:18 23040 -c--a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2010-05-27 18:19:17 18944 -c--a-w- c:\windows\system32\dllcache\xrxscnui.dll
2010-05-27 18:19:11 27648 -c--a-w- c:\windows\system32\dllcache\xrxftplt.exe
2010-05-27 18:19:06 4608 -c--a-w- c:\windows\system32\dllcache\xrxflnch.exe
2010-05-27 18:18:57 99865 -c--a-w- c:\windows\system32\dllcache\xlog.exe
2010-05-27 18:18:56 28288 -c--a-w- c:\windows\system32\dllcache\xjis.nls
2010-05-27 18:18:50 16970 -c--a-w- c:\windows\system32\dllcache\xem336n5.sys
2010-05-27 18:18:48 19455 -c--a-w- c:\windows\system32\dllcache\wvchntxx.sys
2010-05-27 18:18:43 19200 -c--a-w- c:\windows\system32\dllcache\wstcodec.sys
2010-05-27 18:18:41 12063 -c--a-w- c:\windows\system32\dllcache\wsiintxx.sys
2010-05-27 18:18:38 8192 -c--a-w- c:\windows\system32\dllcache\wshirda.dll
2010-05-27 18:18:06 8832 -c--a-w- c:\windows\system32\dllcache\wmiacpi.sys
2010-05-27 18:18:01 154624 -c--a-w- c:\windows\system32\dllcache\wlluc48.sys
2010-05-27 18:17:55 34890 -c--a-w- c:\windows\system32\dllcache\wlandrv2.sys
2010-05-27 18:17:41 771581 -c--a-w- c:\windows\system32\dllcache\winacisa.sys
2010-05-27 18:17:29 53760 -c--a-w- c:\windows\system32\dllcache\wiamsmud.dll
2010-05-27 18:17:23 87040 -c--a-w- c:\windows\system32\dllcache\wiafbdrv.dll
2010-05-27 18:17:21 41600 -c--a-w- c:\windows\system32\dllcache\weitekp9.dll
2010-05-27 18:17:21 31232 -c--a-w- c:\windows\system32\dllcache\weitekp9.sys
2010-05-27 18:17:14 701386 -c--a-w- c:\windows\system32\dllcache\wdhaalba.sys
2010-05-27 18:17:12 23615 -c--a-w- c:\windows\system32\dllcache\wch7xxnt.sys
2010-05-27 18:17:10 31744 -c--a-w- c:\windows\system32\dllcache\wceusbsh.sys
2010-05-27 18:17:05 35871 -c--a-w- c:\windows\system32\dllcache\wbfirdma.sys
2010-05-27 18:17:00 33599 -c--a-w- c:\windows\system32\dllcache\watv04nt.sys
2010-05-27 18:15:56 53760 -c--a-w- c:\windows\system32\dllcache\vfwwdm32.dll
2010-05-27 18:15:48 687999 -c--a-w- c:\windows\system32\dllcache\usrwdxjs.sys
2010-05-27 18:15:42 765884 -c--a-w- c:\windows\system32\dllcache\usrti.sys
2010-05-27 18:15:36 113762 -c--a-w- c:\windows\system32\dllcache\usrpda.sys
2010-05-27 18:15:31 7556 -c--a-w- c:\windows\system32\dllcache\usroslba.sys
2010-05-27 18:15:24 224802 -c--a-w- c:\windows\system32\dllcache\usr1807a.sys
2010-05-27 18:15:18 794399 -c--a-w- c:\windows\system32\dllcache\usr1806v.sys
2010-05-27 18:15:13 793598 -c--a-w- c:\windows\system32\dllcache\usr1806.sys
2010-05-27 18:15:07 794654 -c--a-w- c:\windows\system32\dllcache\usr1801.sys
2010-05-27 18:15:05 26112 -c--a-w- c:\windows\system32\dllcache\usbser.sys
2010-05-27 18:15:03 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2010-05-27 18:15:02 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2010-05-27 18:15:00 17152 -c--a-w- c:\windows\system32\dllcache\usbohci.sys
2010-05-27 18:14:56 32384 -c--a-w- c:\windows\system32\dllcache\usb101et.sys
2010-05-27 18:14:47 94720 -c--a-w- c:\windows\system32\dllcache\umaxud32.dll
2010-05-27 18:14:42 28160 -c--a-w- c:\windows\system32\dllcache\umaxu40.dll
2010-05-27 18:14:37 26624 -c--a-w- c:\windows\system32\dllcache\umaxu22.dll
2010-05-27 18:14:32 69632 -c--a-w- c:\windows\system32\dllcache\umaxu12.dll
2010-05-27 18:14:26 50688 -c--a-w- c:\windows\system32\dllcache\umaxscan.dll
2010-05-27 18:14:21 22912 -c--a-w- c:\windows\system32\dllcache\umaxpcls.sys
2010-05-27 18:14:16 50176 -c--a-w- c:\windows\system32\dllcache\umaxp60.dll
2010-05-27 18:14:11 47616 -c--a-w- c:\windows\system32\dllcache\umaxcam.dll
2010-05-27 18:14:05 211968 -c--a-w- c:\windows\system32\dllcache\um54scan.dll
2010-05-27 18:14:00 216064 -c--a-w- c:\windows\system32\dllcache\um34scan.dll
2010-05-27 18:13:54 36736 -c--a-w- c:\windows\system32\dllcache\ultra.sys
2010-05-27 18:13:48 11520 -c--a-w- c:\windows\system32\dllcache\twotrack.sys
2010-05-27 18:13:47 14336 -c--a-w- c:\windows\system32\dllcache\tsprof.exe
2010-05-27 18:13:37 166784 -c--a-w- c:\windows\system32\dllcache\tridxpm.sys
2010-05-27 18:13:32 525568 -c--a-w- c:\windows\system32\dllcache\tridxp.dll
2010-05-27 18:13:27 159232 -c--a-w- c:\windows\system32\dllcache\tridkbm.sys
2010-05-27 18:13:21 440576 -c--a-w- c:\windows\system32\dllcache\tridkb.dll
2010-05-27 18:13:16 222336 -c--a-w- c:\windows\system32\dllcache\trid3dm.sys
2010-05-27 18:13:10 315520 -c--a-w- c:\windows\system32\dllcache\trid3d.dll
2010-05-27 18:13:05 34375 -c--a-w- c:\windows\system32\dllcache\tpro4.sys
2010-05-27 18:11:59 17129 -c--a-w- c:\windows\system32\dllcache\tdkcd31.sys
2010-05-27 18:11:54 37961 -c--a-w- c:\windows\system32\dllcache\tdk100b.sys
2010-05-27 18:11:54 21896 -c--a-w- c:\windows\system32\dllcache\tdipx.sys
2010-05-27 18:11:52 13192 -c--a-w- c:\windows\system32\dllcache\tdasync.sys
2010-05-27 18:11:45 30464 -c--a-w- c:\windows\system32\dllcache\tbatm155.sys
2010-05-27 18:11:37 7040 -c--a-w- c:\windows\system32\dllcache\tandqic.sys
2010-05-27 18:11:32 36640 -c--a-w- c:\windows\system32\dllcache\t2r4mini.sys
2010-05-27 18:11:27 172768 -c--a-w- c:\windows\system32\dllcache\t2r4disp.dll
2010-05-27 18:11:18 32640 -c--a-w- c:\windows\system32\dllcache\symc8xx.sys
2010-05-27 18:11:13 16256 -c--a-w- c:\windows\system32\dllcache\symc810.sys
2010-05-27 18:11:08 30688 -c--a-w- c:\windows\system32\dllcache\sym_u3.sys
2010-05-27 18:11:03 28384 -c--a-w- c:\windows\system32\dllcache\sym_hi.sys
2010-05-27 18:10:58 94293 -c--a-w- c:\windows\system32\dllcache\sxports.dll
2010-05-27 18:10:53 103936 -c--a-w- c:\windows\system32\dllcache\sx.sys
2010-05-27 18:10:48 3968 -c--a-w- c:\windows\system32\dllcache\swusbflt.sys
2010-05-27 18:10:43 10240 -c--a-w- c:\windows\system32\dllcache\swpidflt.dll
2010-05-27 18:10:38 10240 -c--a-w- c:\windows\system32\dllcache\swpdflt2.dll
2010-05-27 18:10:33 53760 -c--a-w- c:\windows\system32\dllcache\sw_wheel.dll
2010-05-27 18:10:28 41472 -c--a-w- c:\windows\system32\dllcache\sw_effct.dll
2010-05-27 18:10:25 15232 -c--a-w- c:\windows\system32\dllcache\streamip.sys
2010-05-27 18:10:19 155648 -c--a-w- c:\windows\system32\dllcache\stlnprop.dll
2010-05-27 18:10:14 53248 -c--a-w- c:\windows\system32\dllcache\stlncoin.dll
2010-05-27 18:10:09 285760 -c--a-w- c:\windows\system32\dllcache\stlnata.sys
2010-05-27 18:10:03 16896 -c--a-w- c:\windows\system32\dllcache\stcusb.sys
2010-05-27 18:09:54 48736 -c--a-w- c:\windows\system32\dllcache\srwlnd5.sys
2010-05-27 18:09:48 99328 -c--a-w- c:\windows\system32\dllcache\srusd.dll
2010-05-27 18:09:48 101376 -c--a-w- c:\windows\system32\dllcache\srusbusd.dll
2010-05-27 18:09:40 24660 -c--a-w- c:\windows\system32\dllcache\spxupchk.dll
2010-05-27 18:09:32 61824 -c--a-w- c:\windows\system32\dllcache\speed.sys
2010-05-27 18:09:27 106584 -c--a-w- c:\windows\system32\dllcache\spdports.dll
2010-05-27 18:09:22 19072 -c--a-w- c:\windows\system32\dllcache\sparrow.sys
2010-05-27 18:09:16 7552 -c--a-w- c:\windows\system32\dllcache\sonypvu1.sys
2010-05-27 18:09:12 37040 -c--a-w- c:\windows\system32\dllcache\sonypi.sys
2010-05-27 18:09:07 114688 -c--a-w- c:\windows\system32\dllcache\sonypi.dll
2010-05-27 18:09:01 20752 -c--a-w- c:\windows\system32\dllcache\sonync.sys
2010-05-27 18:07:59 33792 -c--a-w- c:\windows\system32\dllcache\smb0w.dll
2010-05-27 18:06:58 68608 -c--a-w- c:\windows\system32\dllcache\sis6306p.sys
2010-05-27 18:06:53 252032 -c--a-w- c:\windows\system32\dllcache\sis300iv.dll
2010-05-27 18:06:48 18944 -c--a-w- c:\windows\system32\dllcache\simptcp.dll
2010-05-27 18:06:48 101760 -c--a-w- c:\windows\system32\dllcache\sis300ip.sys
2010-05-27 18:06:33 161568 -c--a-w- c:\windows\system32\dllcache\sgsmusb.sys
2010-05-27 18:06:29 18400 -c--a-w- c:\windows\system32\dllcache\sgsmld.sys
2010-05-27 18:06:24 98080 -c--a-w- c:\windows\system32\dllcache\sgiulnt5.sys
2010-05-27 18:06:19 386560 -c--a-w- c:\windows\system32\dllcache\sgiul50.dll
2010-05-27 18:06:14 36480 -c--a-w- c:\windows\system32\dllcache\sfmanm.sys
2010-05-27 18:06:00 6784 -c--a-w- c:\windows\system32\dllcache\serscan.sys
2010-05-27 18:04:58 77824 -c--a-w- c:\windows\system32\dllcache\s3sav4m.sys
2010-05-27 18:03:56 20992 -c--a-w- c:\windows\system32\dllcache\rtl8139.sys
2010-05-27 18:03:51 19017 -c--a-w- c:\windows\system32\dllcache\rtl8029.sys
2010-05-27 18:03:47 30720 -c--a-w- c:\windows\system32\dllcache\rthwcls.sys
2010-05-27 18:03:40 9216 -c--a-w- c:\windows\system32\dllcache\rsmgrstr.dll
2010-05-27 18:03:35 3840 -c--a-w- c:\windows\system32\dllcache\rpfun.sys
2010-05-27 18:03:29 79104 -c--a-w- c:\windows\system32\dllcache\rocket.sys
2010-05-27 18:03:23 37563 -c--a-w- c:\windows\system32\dllcache\rlnet5.sys
2010-05-27 18:03:17 86097 -c--a-w- c:\windows\system32\dllcache\reslog32.dll
2010-05-27 18:03:15 23040 -c--a-w- c:\windows\system32\dllcache\EXCH_regtrace.exe
2010-05-27 18:03:14 14848 -c--a-w- c:\windows\system32\dllcache\register.exe
2010-05-27 18:03:01 19584 -c--a-w- c:\windows\system32\dllcache\rasirda.sys
2010-05-27 18:01:58 112574 -c--a-w- c:\windows\system32\dllcache\ptserlp.sys
2010-05-27 18:00:58 92416 -c--a-w- c:\windows\system32\dllcache\phildec.sys
2010-05-27 17:59:59 26153 -c--a-w- c:\windows\system32\dllcache\pcmlm56.sys
2010-05-27 17:58:59 25088 -c--a-w- c:\windows\system32\dllcache\ovca.sys
2010-05-27 17:58:55 54186 -c--a-w- c:\windows\system32\dllcache\otcsercb.sys
2010-05-27 17:58:50 43689 -c--a-w- c:\windows\system32\dllcache\otceth5.sys
2010-05-27 17:58:45 27209 -c--a-w- c:\windows\system32\dllcache\otc06x5.sys
2010-05-27 17:58:40 54528 -c--a-w- c:\windows\system32\dllcache\opl3sax.sys
2010-05-27 17:58:27 198144 -c--a-w- c:\windows\system32\dllcache\nv3.sys
2010-05-27 17:58:23 123776 -c--a-w- c:\windows\system32\dllcache\nv3.dll
2010-05-27 17:58:10 51552 -c--a-w- c:\windows\system32\dllcache\ntgrip.sys
2010-05-27 17:58:10 38912 -c--a-w- c:\windows\system32\dllcache\EXCH_ntfsdrv.dll
2010-05-27 17:58:04 9344 -c--a-w- c:\windows\system32\dllcache\ntapm.sys
2010-05-27 17:58:00 7552 -c--a-w- c:\windows\system32\dllcache\nsmmc.sys
2010-05-27 17:56:56 59104 -c--a-w- c:\windows\system32\dllcache\n9i128v2.dll
2010-05-27 17:56:52 13664 -c--a-w- c:\windows\system32\dllcache\n9i128.sys
2010-05-27 17:56:47 35392 -c--a-w- c:\windows\system32\dllcache\n9i128.dll
2010-05-27 17:56:43 128000 -c--a-w- c:\windows\system32\dllcache\n100325.sys
2010-05-27 17:56:39 52255 -c--a-w- c:\windows\system32\dllcache\n1000nt5.sys
2010-05-27 17:56:34 75520 -c--a-w- c:\windows\system32\dllcache\mxport.sys
2010-05-27 17:56:30 7168 -c--a-w- c:\windows\system32\dllcache\mxport.dll
2010-05-27 17:56:26 19968 -c--a-w- c:\windows\system32\dllcache\mxnic.sys
2010-05-27 17:56:22 19968 -c--a-w- c:\windows\system32\dllcache\mxicfg.dll
2010-05-27 17:56:17 229439 -c--a-w- c:\windows\system32\dllcache\multibox.dll
2010-05-27 17:56:17 21888 -c--a-w- c:\windows\system32\dllcache\mxcard.sys
2010-05-27 17:56:12 103296 -c--a-w- c:\windows\system32\dllcache\mtxvideo.sys
2010-05-27 17:55:54 5504 -c--a-w- c:\windows\system32\dllcache\mstee.sys
2010-05-27 17:55:53 49024 -c--a-w- c:\windows\system32\dllcache\mstape.sys
2010-05-27 17:55:43 12416 -c--a-w- c:\windows\system32\dllcache\msriffwv.sys
2010-05-27 17:55:33 2944 -c--a-w- c:\windows\system32\dllcache\msmpu401.sys
2010-05-27 17:55:30 22016 -c--a-w- c:\windows\system32\dllcache\msircomm.sys
2010-05-27 17:55:30 1875968 -c--a-w- c:\windows\system32\dllcache\msir3jp.lex
2010-05-27 17:55:29 98304 -c--a-w- c:\windows\system32\dllcache\msir3jp.dll
2010-05-27 17:55:15 35200 -c--a-w- c:\windows\system32\dllcache\msgame.sys
2010-05-27 17:55:11 6016 -c--a-w- c:\windows\system32\dllcache\msfsio.sys
2010-05-27 17:55:10 56832 -c--a-w- c:\windows\system32\dllcache\msdvbnp.ax
2010-05-27 17:55:09 51200 -c--a-w- c:\windows\system32\dllcache\msdv.sys
2010-05-27 17:53:56 48768 -c--a-w- c:\windows\system32\dllcache\maestro.sys
2010-05-27 17:52:58 15744 -c--a-w- c:\windows\system32\dllcache\lit220p.sys
2010-05-27 17:51:47 6144 -c--a-w- c:\windows\system32\dllcache\kbd106.dll
2010-05-27 17:50:59 90200 -c--a-w- c:\windows\system32\dllcache\io8ports.dll
2010-05-27 17:49:56 45056 -c--a-w- c:\windows\system32\dllcache\icam5com.dll
2010-05-27 17:48:59 10129408 -c--a-w- c:\windows\system32\dllcache\hwxkor.dll
2010-05-27 17:48:38 10096640 -c--a-w- c:\windows\system32\dllcache\hwxcht.dll
2010-05-27 17:48:31 488383 -c--a-w- c:\windows\system32\dllcache\hsf_v124.sys
2010-05-27 17:48:27 50751 -c--a-w- c:\windows\system32\dllcache\hsf_tone.sys
2010-05-27 17:48:23 73279 -c--a-w- c:\windows\system32\dllcache\hsf_spkp.sys
2010-05-27 17:48:16 44863 -c--a-w- c:\windows\system32\dllcache\hsf_soar.sys
2010-05-27 17:48:13 57471 -c--a-w- c:\windows\system32\dllcache\hsf_samp.sys
2010-05-27 17:48:08 542879 -c--a-w- c:\windows\system32\dllcache\hsf_msft.sys
2010-05-27 17:48:04 391199 -c--a-w- c:\windows\system32\dllcache\hsf_k56k.sys
2010-05-27 17:48:00 9759 -c--a-w- c:\windows\system32\dllcache\hsf_inst.dll
2010-05-27 17:46:56 101376 -c--a-w- c:\windows\system32\dllcache\hpgt34.dll
2010-05-27 17:45:58 320384 -c--a-w- c:\windows\system32\dllcache\g200m.sys
2010-05-27 17:44:57 43520 -c--a-w- c:\windows\system32\dllcache\EXCH_fcachdll.dll
2010-05-27 17:43:58 40704 -c--a-w- c:\windows\system32\dllcache\es1371mp.sys
2010-05-27 17:42:59 69194 -c--a-w- c:\windows\system32\dllcache\el656cd5.sys
2010-05-27 17:41:58 37962 -c--a-w- c:\windows\system32\dllcache\divaprop.dll
2010-05-27 17:40:58 110592 -c--a-w- c:\windows\system32\dllcache\dc260usd.dll
2010-05-27 17:39:54 10240 -c--a-w- c:\windows\system32\dllcache\compbatt.sys
2010-05-27 17:38:59 236032 -c--a-w- c:\windows\system32\dllcache\camext20.dll
2010-05-27 17:37:31 18432 -c--a-w- c:\windows\system32\dllcache\bdaplgin.ax
2010-05-27 17:36:59 281600 -c--a-w- c:\windows\system32\dllcache\atimtai.sys
2010-05-27 17:35:59 48128 -c--a-w- c:\windows\system32\dllcache\61883.sys
2010-05-27 17:35:59 12288 -c--a-w- c:\windows\system32\dllcache\4mmdat.sys
2010-05-27 17:35:58 689216 -c--a-w- c:\windows\system32\dllcache\3dfxvs.dll
2010-05-27 17:35:58 148352 -c--a-w- c:\windows\system32\dllcache\3dfxvsm.sys
2010-05-27 17:35:57 762780 -c--a-w- c:\windows\system32\dllcache\3cwmcru.sys
2010-05-27 17:35:57 11264 -c--a-w- c:\windows\system32\dllcache\1394vdbg.sys
2010-05-27 17:34:48 66048 -c--a-w- c:\windows\system32\dllcache\s3legacy.dll
2010-05-27 17:08:59 0 d-----w- c:\program files\Spybot - Search & Destroy
2010-05-27 17:08:59 0 d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2010-05-27 09:33:10 0 d-----w- c:\windows\system32\wbem\Repository
2010-05-21 12:45:47 0 d--h--w- c:\windows\PIF
2010-05-19 19:47:30 0 d-----w- c:\program files\SystemRequirementsLab
2010-05-19 13:03:36 274288 ----a-w- c:\windows\system32\mucltui.dll
2010-05-19 13:03:36 215920 ----a-w- c:\windows\system32\muweb.dll
2010-05-19 13:02:37 53693 ----a-w- c:\windows\UNDPX2A.sys
2010-05-19 13:02:37 15429 ----a-w- c:\windows\system32\drivers\Sacm2A.sys
2010-05-19 13:02:37 135168 ----a-w- c:\windows\UNDPX2A.exe
2010-05-19 07:00:25 0 d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2010-05-18 07:48:00 16736 ----a-w- c:\windows\system32\mucltui.dll.mui
2010-05-18 03:37:51 0 d-----w- c:\documents and settings\bobby\Tracing
2010-05-18 03:33:31 0 d-----w- c:\program files\common files\Windows Live
2010-05-14 05:13:22 0 d-----w- c:\program files\Wondershare
2010-05-11 16:37:58 2820500 ----a-w- C:\18 Twisted Love.mp3
2010-05-11 16:34:56 0 d-----w- c:\program files\Free Audio Pack
2010-05-10 00:46:39 0 d-----w- c:\program files\Hero Editor
2010-05-09 23:29:28 0 d-----w- c:\program files\Trend Micro
2010-05-08 16:53:06 0 d-----w- c:\docume~1\bobby\applic~1\Thinstall
2010-05-07 15:23:08 0 d-----w- c:\docume~1\alluse~1\applic~1\regid.1986-12.com.adobe
2010-05-07 05:20:07 0 d-----w- c:\program files\Diablo II
2010-05-07 05:19:19 0 d-----w- c:\program files\Ventrilo
2010-05-07 05:19:05 262 ----a-w- c:\windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
2010-05-07 05:18:46 0 d-----w- c:\program files\common files\Wise Installation Wizard
2010-05-07 02:43:43 0 d-----w- c:\docume~1\alluse~1\applic~1\WinMount
2010-05-05 00:18:04 0 d-----w- C:\downloads
2010-05-05 00:18:04 0 d-----w- c:\docume~1\bobby\applic~1\GrabPro
2010-05-04 01:52:11 0 d-----w- c:\program files\iPod
2010-05-04 01:45:31 0 d-----w- c:\program files\Bonjour
2010-04-29 16:41:17 0 d-----w- c:\docume~1\bobby\applic~1\TeamViewer
2010-04-29 16:41:11 0 d-----w- c:\documents and settings\bobby\temp
2010-04-28 22:02:08 0 d-----w- c:\program files\VideoLAN
2010-04-28 18:21:24 0 d-----w- c:\program files\Valve
2010-04-28 02:24:18 0 d-----w- c:\docume~1\bobby\applic~1\Vivox
==================== Find3M ====================
2010-05-10 00:44:16 249856 ------w- c:\windows\Setup1.exe
2010-05-10 00:44:13 73216 ----a-w- c:\windows\ST6UNST.EXE
2010-05-08 16:55:47 41084 ---ha-w- c:\windows\system32\mlfcache.dat
2010-04-29 19:39:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 19:39:26 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-21 19:35:08 37376 ----a-w- c:\windows\system32\drivers\WMDrive.sys
2010-04-08 17:20:02 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-04-08 17:20:02 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-04-04 19:25:38 7351 ----a-w- c:\windows\SCXEunin.dat
2010-04-04 19:25:22 72704 ----a-w- c:\windows\SCXEUnin.exe
2010-04-04 19:25:22 41268 ----a-w- c:\windows\fonts\Starcraft.ttf
2010-03-31 15:35:12 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-03-23 05:08:10 6993920 ----a-w- c:\windows\system32\logonuiX.exe
2010-03-23 04:25:40 45056 ----a-w- c:\windows\system32\sstunst3.exe
2010-03-10 06:15:52 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-03-09 21:16:28 87608 ----a-w- c:\docume~1\bobby\applic~1\inst.exe
2010-03-09 21:16:28 47360 ----a-w- c:\docume~1\bobby\applic~1\pcouffin.sys
2010-03-05 14:13:40 947472 ----a-w- c:\windows\system32\msjava.dll
2010-02-08 21:04:41 245760 --sha-w- c:\windows\system32\config\systemprofile\ietldcache\index.dat
============= FINISH: 15:10:32.85 ===============
3: GMER logfile
GMER 1.0.15.15281 -
http://www.gmer.netRootkit scan 2010-05-27 21:25:42
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\ADMINI~1.E58\LOCALS~1\Temp\pgpcykod.sys
---- Kernel code sections - GMER 1.0.15 ----
.rsrc C:\WINDOWS\system32\DRIVERS\mouclass.sys
entry point in ".rsrc" section [0xF77DB814]
---- User code sections - GMER 1.0.15 ----
.text C:\WINDOWS\system32\svchost.exe[556] ntdll.dll!NtProtectVirtualMemory
7C90D6EE 5 Bytes JMP 007E000A
.text C:\WINDOWS\system32\svchost.exe[556] ntdll.dll!NtWriteVirtualMemory
7C90DFAE 5 Bytes JMP 007F000A
.text C:\WINDOWS\system32\svchost.exe[556] ntdll.dll!KiUserExceptionDispatcher
7C90E47C 5 Bytes JMP 007D000C
.text C:\WINDOWS\system32\svchost.exe[556] ole32.dll!CoCreateInstance
7750057E 5 Bytes JMP 00B0000A
.text C:\WINDOWS\Explorer.EXE[884] ntdll.dll!NtProtectVirtualMemory
7C90D6EE 5 Bytes JMP 00C8000A
.text C:\WINDOWS\Explorer.EXE[884] ntdll.dll!NtWriteVirtualMemory
7C90DFAE 5 Bytes JMP 00D2000A
.text C:\WINDOWS\Explorer.EXE[884] ntdll.dll!KiUserExceptionDispatcher
7C90E47C 5 Bytes JMP 00C7000C
---- Devices - GMER 1.0.15 ----
Device -> \Driver\atapi \Device\Harddisk0\DR0
8A50BD01
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0
0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew
0x4E 0x40 0x54 0xC2 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0
C:\Program Files\Alcohol Soft\Alcohol 120\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0
0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew
0x18 0x07 0x87 0x5D ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew
0x48 0xE3 0x2C 0x7A ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0
0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew
0x4E 0x40 0x54 0xC2 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0
C:\Program Files\Alcohol Soft\Alcohol 120\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0
0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew
0x18 0x07 0x87 0x5D ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 (not active
ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew
0x48 0xE3 0x2C 0x7A ...
Reg HKLM\SOFTWARE\Classes\CLSID\{6302e47b-b5a2-43b0-a6f3-05c83c6dcb05}@Model
146
Reg HKLM\SOFTWARE\Classes\CLSID\{6302e47b-b5a2-43b0-a6f3-05c83c6dcb05}@Therad
21
Reg HKLM\SOFTWARE\Classes\CLSID\{6302e47b-b5a2-43b0-a6f3-05c83c6dcb05}@MData
0x73 0xD5 0xCF 0xB8 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}@scansk
0xE6 0x31 0x2F 0x75 ...
---- Files - GMER 1.0.15 ----
File C:\WINDOWS\system32\DRIVERS\mouclass.sys
suspicious modification
File C:\WINDOWS\system32\drivers\atapi.sys
suspicious modification
---- EOF - GMER 1.0.15 ----
4: Malware Bytes logfile
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 4148
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
5/27/2010 2:55:51 PM
mbam-log-2010-05-27 (14-55-51).txt
Scan type: Full scan (C:\|)
Objects scanned: 264724
Time elapsed: 1 hour(s), 33 minute(s), 57 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 16
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\Documents and Settings\Bobby\Desktop\malwarebytes\Malwarebytes Anti-Malware v1.46\patrick.exe (Trojan.Agent.CK) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Bobby\Desktop\Cerberus\DirectX.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Bobby\Local Settings\Temp\144F.tmp (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Bobby\Local Settings\Temp\UjlE.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Program Files\Adobe\Adobe Dreamweaver CS5\keygen.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3FB54717-8ED4-4CF6-8316-1C34E468C3C0}\RP138\A0034599.exe (Trojan.Refroso) ->
Quarantined and deleted successfully.
C:\System Volume Information\_restore{3FB54717-8ED4-4CF6-8316-1C34E468C3C0}\RP138\A0034607.exe (Trojan.Banker) ->
Quarantined and deleted successfully.
C:\System Volume Information\_restore{3FB54717-8ED4-4CF6-8316-1C34E468C3C0}\RP138\A0034610.exe (Trojan.Banker) ->
Quarantined and deleted successfully.
C:\System Volume Information\_restore{3FB54717-8ED4-4CF6-8316-1C34E468C3C0}\RP138\A0034612.exe (Trojan.Banker) ->
Quarantined and deleted successfully.
C:\System Volume Information\_restore{3FB54717-8ED4-4CF6-8316-1C34E468C3C0}\RP138\A0034619.exe (Trojan.Banker) ->
Quarantined and deleted successfully.
C:\System Volume Information\_restore{3FB54717-8ED4-4CF6-8316-1C34E468C3C0}\RP138\A0034604.exe (Trojan.Banker) ->
Quarantined and deleted successfully.
C:\System Volume Information\_restore{3FB54717-8ED4-4CF6-8316-1C34E468C3C0}\RP138\A0034623.exe (Trojan.Banker) ->
Quarantined and deleted successfully.
C:\System Volume Information\_restore{3FB54717-8ED4-4CF6-8316-1C34E468C3C0}\RP138\A0034630.exe (Trojan.Banker) ->
Quarantined and deleted successfully.
C:\System Volume Information\_restore{3FB54717-8ED4-4CF6-8316-1C34E468C3C0}\RP138\A0034641.exe (Trojan.Banker) ->
Quarantined and deleted successfully.
C:\System Volume Information\_restore{3FB54717-8ED4-4CF6-8316-1C34E468C3C0}\RP138\A0034642.exe (Trojan.Banker) ->
Quarantined and deleted successfully.
C:\WINDOWS\Temp\1451.tmp (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.
5: RSIT Logfile
Logfile of random's system information tool 1.07 (written by random/random)
Run by Bobby at 2010-05-28 01:32:31
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 86 GB (58%) free of 147 GB
Total RAM: 2047 MB (69% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 1:32:46 AM, on 5/28/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\No-IP\DUC20.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\TVersity\Media Server\MediaServer.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Bobby\Desktop\RSIT.exe
C:\Program Files\trend micro\Bobby.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.myspace.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [VAIO Recovery] C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [CursorXP] "C:\Program Files\CursorXP\CursorXP.exe" -s
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Startup: Digsby.lnk = C:\Documents and Settings\Bobby\Local Settings\Application Data\Digsby\App\digsby.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Bobby\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) -
http://upload.facebook.com/controls/2009.0...oUploader55.cabO16 - DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} (MySpace Uploader Control) -
http://lads.myspace.com/upload/MySpaceUploader2.cabO16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} (SysInfo Class) -
http://content.systemrequirementslab.com.s...el_4.1.66.0.cabO16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} -
http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cabO16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) -
http://gfx1.hotmail.com/mail/w4/pr01/photo...ol/MSNPUpld.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{D542AEF8-992B-4FBA-A21A-00C46D344652}: NameServer = 68.87.74.166,68.87.68.166
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NoIPDUCService - Vitalwerks LLC - C:\Program Files\No-IP\DUC20.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - StarWind Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TVersityMediaServer - Unknown owner - C:\Program Files\TVersity\Media Server\MediaServer.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
--
End of file - 11088 bytes
======Scheduled tasks folder======
C:\WINDOWS\tasks\AdobeAAMUpdater-1.0-E58AEB3F9A6342E-Bobby.job
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{FEE18DAC-672E-45DB-8D44-99D399927BC8}.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}]
IDMIEHlprObj Class - C:\Program Files\Internet Download Manager\IDMIECC.dll [2010-01-20 181680]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 1879896]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{724d43a9-0d85-11d4-9908-00400523e39a}]
C:\Program Files\Siber Systems\AI RoboForm\roboform.dll [2008-02-26 1657344]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - c:\program files\google\googletoolbar1.dll [2004-11-15 720896]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-03-31 41760]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-03-31 79648]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar1.dll [2004-11-15 720896]
{724d43a0-0d85-11d4-9908-00400523e39a} - &RoboForm - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll [2008-02-26 1657344]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AGRSMMSG"=C:\WINDOWS\AGRSMMSG.exe [2004-06-29 88363]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2004-10-21 77824]
"AlcWzrd"=C:\WINDOWS\ALCWZRD.EXE [2004-10-21 2744832]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2004-10-13 57344]
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2004-09-10 344064]
"VAIO Recovery"=C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe [2003-04-20 28672]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-09-29 61440]
"LogonStudio"=C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe [2002-09-03 987187]
"BootSkin Startup Jobs"=C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe [2004-04-26 270336]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2010-04-28 142120]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2010-03-17 421888]
"Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2010-04-29 437584]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"=C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [2010-02-08 160592]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"IDMan"=C:\Program Files\Internet Download Manager\IDMan.exe [2010-03-08 3179952]
"CursorXP"=C:\Program Files\CursorXP\CursorXP.exe [2005-01-19 140288]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2006-10-18 204288]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"VzFw"=2
"VzCdbSvc"=2
"Vcsw"=3
"VAIOMediaPlatform-VideoServer-UPnP"=3
"VAIOMediaPlatform-VideoServer-AppServer"=3
"VAIOMediaPlatform-Mobile-Gateway"=3
"VAIOMediaPlatform-IntegratedServer-UPnP"=3
"VAIOMediaPlatform-IntegratedServer-HTTP"=3
"VAIOMediaPlatform-IntegratedServer-AppServer"=3
"VAIO Entertainment TV Device Arbitration Service"=3
"VAIO Entertainment Task Scheduler"=3
"VAIO Entertainment Aggregation and Control Service"=3
C:\Documents and Settings\Bobby\Start Menu\Programs\Startup
Digsby.lnk - C:\Documents and Settings\Bobby\Local Settings\Application Data\Digsby\App\digsby.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="wbsys.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-09-29 155648]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2004-10-08 344064]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WBSrv]
C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll [2006-03-25 176128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=8
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=
"HonorAutoRunSetting"=
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Documents and Settings\Bobby\Local Settings\Temp\7zS36.tmp\SymNRT.exe"="C:\Documents and Settings\Bobby\Local Settings\Temp\7zS36.tmp\SymNRT.exe:*:Enabled:Norton Removal Tool"
"C:\Program Files\AIM\aim.exe"="C:\Program Files\AIM\aim.exe:*:Enabled:AIM"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\Novalogic\MIG-29 Fulcrum\M29.exe"="C:\Program Files\Novalogic\MIG-29 Fulcrum\M29.exe:*:Disabled:MiG29"
"C:\Program Files\BitLord\BitLord.exe"="C:\Program Files\BitLord\BitLord.exe:*:Enabled:BitLord"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\TVersity\Media Server\MediaServer.exe"="C:\Program Files\TVersity\Media Server\MediaServer.exe:*:Enabled:TVersity Media Server"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour Service"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Ventrilo\Ventrilo.exe"="C:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
shell\AutoRun\command - H:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{52c0c0cc-1677-11df-a0f5-001111dfcd8b}]
shell\AutoRun\command - K:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{77490f51-26f0-11df-a0fe-001111dfcd8b}]
shell\AutoRun\command - J:\InstallTomTomHOME.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95ce554a-14db-11df-a0e7-001111dfcd8b}]
shell\AutoRun\command - setup.exe
======File associations======
.js - edit -
.js - open -
.txt - open -
======List of files/folders created in the last 1 months======
2010-05-28 01:32:31 ----D---- C:\rsit
2010-05-27 15:26:16 ----A---- C:\WINDOWS\ntbtlog.txt
2010-05-27 13:08:59 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-05-27 13:08:59 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2010-05-27 05:09:06 ----D---- C:\Documents and Settings\Bobby\Application Data\Google
2010-05-21 08:45:47 ----HD---- C:\WINDOWS\PIF
2010-05-19 15:47:30 ----D---- C:\Program Files\SystemRequirementsLab
2010-05-19 09:03:36 ----A---- C:\WINDOWS\system32\muweb.dll
2010-05-19 09:03:36 ----A---- C:\WINDOWS\system32\mucltui.dll
2010-05-19 09:02:37 ----A---- C:\WINDOWS\UNDPX2A.exe
2010-05-19 08:49:34 ----D---- C:\Documents and Settings\Bobby\Application Data\InterVideo
2010-05-19 08:48:10 ----D---- C:\Config.Msi
2010-05-19 03:01:44 ----DC---- C:\WINDOWS\$NtUninstallKB961503$
2010-05-19 03:00:25 ----D---- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2010-05-18 03:48:00 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
2010-05-17 23:36:22 ----D---- C:\Program Files\Windows Live
2010-05-17 23:33:31 ----D---- C:\Program Files\Common Files\Windows Live
2010-05-16 20:58:37 ----A---- C:\SendRequestLog.txt
2010-05-16 20:58:37 ----A---- C:\SendLog.txt
2010-05-16 20:58:37 ----A---- C:\RecvRequestLog.txt
2010-05-16 20:58:37 ----A---- C:\RecvLog.txt
2010-05-16 20:58:37 ----A---- C:\PersonalRequestLog.txt
2010-05-14 01:13:22 ----D---- C:\Program Files\Wondershare
2010-05-13 03:00:48 ----HDC---- C:\WINDOWS\$NtUninstallKB978542$
2010-05-11 12:34:56 ----D---- C:\Program Files\Free Audio Pack
2010-05-09 20:46:39 ----D---- C:\Program Files\Hero Editor
2010-05-09 19:29:28 ----D---- C:\Program Files\Trend Micro
2010-05-08 13:24:35 ----D---- C:\Program Files\Common Files\Adobe
2010-05-08 12:53:06 ----D---- C:\Documents and Settings\Bobby\Application Data\Thinstall
2010-05-07 11:23:08 ----D---- C:\Documents and Settings\All Users\Application Data\regid.1986-12.com.adobe
2010-05-07 11:20:27 ----D---- C:\Program Files\Adobe Media Player
2010-05-07 11:19:41 ----D---- C:\Program Files\Common Files\Adobe AIR
2010-05-07 01:24:42 ----D---- C:\Documents and Settings\Bobby\Application Data\Ventrilo
2010-05-07 01:20:07 ----D---- C:\Program Files\Diablo II
2010-05-07 01:19:19 ----D---- C:\Program Files\Ventrilo
2010-05-07 01:19:05 ----A---- C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
2010-05-07 01:18:46 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2010-05-06 22:43:43 ----D---- C:\Documents and Settings\All Users\Application Data\WinMount
2010-05-06 21:55:46 ----D---- C:\Documents and Settings\All Users\Application Data\FLEXnet
2010-05-04 20:18:04 ----D---- C:\downloads
2010-05-04 20:18:04 ----D---- C:\Documents and Settings\Bobby\Application Data\GrabPro
2010-05-04 20:18:00 ----D---- C:\Documents and Settings\Bobby\Application Data\Orbit
2010-05-03 21:52:11 ----D---- C:\Program Files\iPod
2010-05-03 21:45:31 ----D---- C:\Program Files\Bonjour
2010-05-03 15:35:20 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2010-04-29 12:41:17 ----D---- C:\Documents and Settings\Bobby\Application Data\TeamViewer
======List of files/folders modified in the last 1 months======
2010-05-28 01:32:14 ----D---- C:\WINDOWS\Temp
2010-05-28 00:14:00 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-05-27 21:35:01 ----D---- C:\WINDOWS\network diagnostic
2010-05-27 21:29:58 ----D---- C:\WINDOWS\system32\CatRoot2
2010-05-27 21:29:40 ----D---- C:\Documents and Settings\Bobby\Application Data\DMCache
2010-05-27 21:29:40 ----A---- C:\WINDOWS\LogonStudio.ini
2010-05-27 15:26:58 ----D---- C:\Documents and Settings
2010-05-27 15:26:16 ----D---- C:\WINDOWS
2010-05-27 15:20:04 ----D---- C:\WINDOWS\Prefetch
2010-05-27 14:58:39 ----DC---- C:\WINDOWS\system32\dllcache
2010-05-27 14:58:03 ----HDC---- C:\WINDOWS\$NtUninstallKB958687_0$
2010-05-27 14:58:03 ----D---- C:\WINDOWS\system32\drivers
2010-05-27 14:11:54 ----SHD---- C:\WINDOWS\Installer
2010-05-27 13:11:28 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-05-27 13:08:59 ----RD---- C:\Program Files
2010-05-27 05:34:15 ----D---- C:\Program Files\uTorrent
2010-05-27 05:33:30 ----D---- C:\WINDOWS\system32\config
2010-05-27 05:33:10 ----D---- C:\WINDOWS\system32\wbem
2010-05-27 05:33:10 ----D---- C:\WINDOWS\Registration
2010-05-27 05:32:45 ----D---- C:\Documents and Settings\Bobby\Application Data\uTorrent
2010-05-27 05:09:05 ----D---- C:\Documents and Settings\All Users\Application Data\Google
2010-05-27 05:08:58 ----SD---- C:\WINDOWS\Tasks
2010-05-27 05:08:54 ----D---- C:\Program Files\Google
2010-05-26 15:13:26 ----D---- C:\Documents and Settings\Bobby\Application Data\U3
2010-05-24 14:30:36 ----D---- C:\WINDOWS\Debug
2010-05-22 14:31:28 ----D---- C:\WINDOWS\system32
2010-05-19 19:17:29 ----D---- C:\Documents and Settings\Bobby\Application Data\Vso
2010-05-19 15:47:31 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-05-19 15:44:26 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-05-19 15:43:34 ----HD---- C:\WINDOWS\inf
2010-05-19 15:43:23 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-05-19 08:52:59 ----D---- C:\WINDOWS\system32\CatRoot
2010-05-19 08:49:11 ----D---- C:\Program Files\Outlook Express
2010-05-18 03:51:36 ----HD---- C:\WINDOWS\$hf_mig$
2010-05-17 23:37:48 ----SD---- C:\Documents and Settings\Bobby\Application Data\Microsoft
2010-05-17 23:36:57 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2010-05-17 23:36:56 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-05-17 23:33:31 ----D---- C:\Program Files\Common Files
2010-05-09 23:50:37 ----D---- C:\Program Files\StarCraft
2010-05-09 20:44:16 ----N---- C:\WINDOWS\Setup1.exe
2010-05-09 20:44:13 ----A---- C:\WINDOWS\ST6UNST.EXE
2010-05-07 23:33:09 ----D---- C:\WINDOWS\WinSxS
2010-05-07 23:32:06 ----D---- C:\Documents and Settings\Bobby\Application Data\Adobe
2010-05-07 23:31:53 ----D---- C:\Program Files\Adobe
2010-05-07 23:04:07 ----D---- C:\Program Files\JDownloader
2010-05-07 22:59:26 ----RSD---- C:\WINDOWS\Fonts
2010-05-07 01:23:59 ----D---- C:\Program Files\Common Files\Blizzard Entertainment
2010-05-07 00:08:15 ----D---- C:\Program Files\StarCraft II Beta
2010-05-07 00:03:52 ----D---- C:\Program Files\iTunes
2010-05-06 23:52:42 ----HDC---- C:\WINDOWS\$NtUninstallKB950974_0$
2010-05-03 21:52:08 ----D---- C:\Program Files\Common Files\Apple
2010-05-03 15:35:59 ----D---- C:\Documents and Settings\Bobby\Application Data\AdobeUM
2010-04-30 14:51:06 ----A---- C:\WINDOWS\system32\MRT.exe
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 DMICall;Sony DMI Call service; C:\WINDOWS\system32\DRIVERS\DMICall.sys [2000-12-05 3952]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R2 NPF;NetGroup Packet Filter Driver; C:\WINDOWS\system32\drivers\npf.sys [2009-10-20 50704]
R2 WMDrive;WMDrive; \??\C:\WINDOWS\system32\drivers\WMDrive.sys []
R3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2004-06-29 1268204]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-09-30 3565056]
R3 E100B;Intel® PRO Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2007-11-16 165496]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2004-10-27 2297984]
R3 MBAMProtector;MBAMProtector; \??\C:\WINDOWS\system32\drivers\mbam.sys []
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2010-03-09 47360]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 USBCM;Scientific-Atlanta USB Cable Modem Driver; C:\WINDOWS\system32\DRIVERS\Sacm2A.sys [2004-06-10 15429]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbstor;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 adnmph30;adnmph30; C:\WINDOWS\system32\drivers\adnmph30.sys []
S3 cpudrv;cpudrv; \??\C:\Program Files\SystemRequirementsLab\cpudrv.sys []
S3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
S3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\HdAudio.sys [2004-03-17 113664]
S3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2004-10-08 752093]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-10-16 41472]
S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2010-04-16 144672]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-09-29 602112]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2010-04-08 345376]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-03-31 153376]
R2 MBAMService;MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2010-04-29 304464]
R2 NoIPDUCService;NoIPDUCService; C:\Program Files\No-IP\DUC20.exe [2010-03-30 1172992]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2009-12-23 370688]
R2 TVersityMediaServer;TVersityMediaServer; C:\Program Files\TVersity\Media Server\MediaServer.exe [2010-02-25 856064]
R2 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
R2 YahooAUService;Yahoo! Updater; C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe [2008-11-09 602392]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2010-04-28 545576]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2009-09-29 593920]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2009-10-20 117264]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 TomTomHOMEService;TomTomHOMEService; C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe [2009-11-13 92008]
S4 VAIO Entertainment Aggregation and Control Service;VAIO Entertainment Aggregation and Control Service; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe [2004-08-23 139264]
S4 VAIO Entertainment Task Scheduler;VAIO Entertainment Task Scheduler; C:\Program Files\Sony\vaio entertainment\VzTaskScheduler.exe [2004-11-02 339968]
S4 VAIO Entertainment TV Device Arbitration Service;VAIO Entertainment TV Device Arbitration Service; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe [2004-10-25 73728]
S4 VAIOMediaPlatform-IntegratedServer-AppServer;VAIO Media Integrated Server; C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe [2004-11-02 1826816]
S4 VAIOMediaPlatform-IntegratedServer-HTTP;VAIO Media Integrated Server (HTTP); C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [2004-06-16 57344]
S4 VAIOMediaPlatform-IntegratedServer-UPnP;VAIO Media Integrated Server (UPnP); C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2004-06-22 733184]
S4 VAIOMediaPlatform-Mobile-Gateway;VAIO Media Gateway Server; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe [2004-06-16 188416]
S4 VAIOMediaPlatform-VideoServer-AppServer;VAIO Media Video Server; C:\Program Files\Sony\VAIO Media Integrated Server\Video\GPVSvr.exe [2003-10-30 1286144]
S4 VAIOMediaPlatform-VideoServer-UPnP;VAIO Media Video Server (UPnP); C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [2004-06-22 733184]
S4 Vcsw;VAIO Entertainment UPnP Client Adapter; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe [2004-10-25 278528]
S4 VzCdbSvc;VAIO Entertainment Database Service; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe [2004-10-25 131072]
S4 VzFw;VAIO Entertainment File Import Service; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe [2004-10-25 118784]
-----------------EOF-----------------
Thanks! =]