Run the scans as you told and here are my logs attached. My computer is way too fine now,not experiencing the problems as before. Dunno if Comodo and MBAM would run. Didn't check that out. Anyway take a look at my log and please give me valuable suggestions
Diana
Logfile of random's system information tool 1.08 (written by random/random)
Run by Administrator at 2010-07-19 18:49:25
Microsoft Windows XP Professional Service Pack 2
System drive C: has 3 GB (27%) free of 10 GB
Total RAM: 254 MB (10% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 6:50:56 PM, on 7/19/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Tall Emu\Online Armor\OAcat.exe
C:\Program Files\Tall Emu\Online Armor\oasrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Tall Emu\Online Armor\oaui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Tall Emu\Online Armor\OAhlp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Administrator\My Documents\Downloads\RSIT.exe
C:\Program Files\trend micro\Administrator.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - E:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - E:\Program Files\Orbitdownloader\GrabPro.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [@OnlineArmor GUI] "C:\Program Files\Tall Emu\Online Armor\oaui.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Download by Orbit - res://E:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://E:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://E:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://E:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/windowsupdate/...b?1278919808125O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) -
http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cabO18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: !SASWinLogon - E:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Online Armor Helper Service (OAcat) - Unknown owner - C:\Program Files\Tall Emu\Online Armor\OAcat.exe
O23 - Service: Macrium Reflect Image Mounting Service (ReflectService) - Unknown owner - E:\Program Files\Macrium\Reflect\ReflectService.exe (file missing)
O23 - Service: Online Armor (SvcOnlineArmor) - Unknown owner - C:\Program Files\Tall Emu\Online Armor\oasrv.exe
--
End of file - 5153 bytes
======Scheduled tasks folder======
C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{558B0221-7D73-4999-86D1-B9C68896A107}.job
C:\WINDOWS\tasks\Auslogics Boost Speed Disk Defrag Console Defragmentation.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000123B4-9B42-4900-B3F7-F4B073EFC214}]
Octh Class - E:\Program Files\Orbitdownloader\orbitcth.dll [2010-05-07 240912]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-05-03 41760]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-05-03 79648]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{C55BBCD6-41AD-48AD-9953-3609C48EACC7} - Grab Pro - E:\Program Files\Orbitdownloader\GrabPro.dll [2010-05-07 666816]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2010-03-29 2145000]
"@OnlineArmor GUI"=C:\Program Files\Tall Emu\Online Armor\oaui.exe [2010-04-20 6678008]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-03 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
E:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [2009-09-04 548352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2002-10-16 315392]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]
"{4F07DA45-8170-4859-9B5F-037EF2970034}"=C:\PROGRA~1\TALLEM~1\ONLINE~1\oaevent.dll [2010-04-20 925688]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=E:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoFolderOptions"=0
"NoRun"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=255
"NoFolderOptions"=0
"NoRun"=0
"HonorAutoRunSetting"=1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\groove.exe"="C:\Program Files\Microsoft Office\Office12\groove.exe:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"E:\Program Files\uTorrent\uTorrent.exe"="E:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"E:\Program Files\Orbitdownloader\orbitdm.exe"="E:\Program Files\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit"
"E:\Program Files\Orbitdownloader\orbitnet.exe"="E:\Program Files\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit"
"E:\Downloads\PROGRAMS\utorrent.exe"="E:\Downloads\PROGRAMS\utorrent.exe:*:Enabled:µTorrent"
"D:\Downloads\Programs\utorrent.exe"="D:\Downloads\Programs\utorrent.exe:*:Enabled:µTorrent"
"C:\WINDOWS\system32\wmpfx4.exe"="C:\WINDOWS\system32\wmpfx4.exe:*:Enabled:LAN Router"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\WINDOWS\system32\wmpfx4.exe"="C:\WINDOWS\system32\wmpfx4.exe:*:Enabled:LAN Router"
======List of files/folders created in the last 1 months======
2010-07-19 18:49:25 ----D---- C:\rsit
2010-07-15 19:48:29 ----D---- C:\Documents and Settings\Administrator\Application Data\Opera
2010-07-15 19:01:24 ----D---- C:\Program Files\Mozilla Firefox
2010-07-15 02:47:50 ----D---- C:\WINDOWS\ServicePackFiles
2010-07-14 22:44:58 ----N---- C:\WINDOWS\system32\drivers\bthport.sys
2010-07-13 06:55:15 ----D---- C:\Documents and Settings\Administrator\Application Data\Mozilla
2010-07-12 22:51:38 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2010-07-12 16:53:28 ----D---- C:\Documents and Settings\All Users\Application Data\OnlineArmor
2010-07-12 16:53:28 ----D---- C:\Documents and Settings\Administrator\Application Data\OnlineArmor
2010-07-12 16:52:53 ----A---- C:\WINDOWS\system32\drivers\OAnet.sys
2010-07-12 16:52:53 ----A---- C:\WINDOWS\system32\drivers\OAmon.sys
2010-07-12 16:52:52 ----A---- C:\WINDOWS\system32\drivers\OADriver.sys
2010-07-12 16:52:38 ----D---- C:\Program Files\Tall Emu
2010-07-12 09:56:39 ----D---- C:\Program Files\ESET
2010-07-12 09:56:39 ----D---- C:\Documents and Settings\All Users\Application Data\ESET
2010-07-12 09:37:13 ----D---- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2010-07-12 01:56:22 ----D---- C:\Documents and Settings\Administrator\Application Data\Mozilla(3)
2010-07-12 01:47:09 ----HD---- C:\WINDOWS\ie8
2010-07-11 23:22:48 ----D---- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
2010-07-02 23:31:43 ----D---- C:\Documents and Settings\Administrator\Application Data\Notepad++
2010-07-02 16:16:51 ----D---- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2010-07-01 23:08:32 ----D---- C:\Documents and Settings\Administrator\Application Data\Bump Technologies, Inc
2010-07-01 23:08:03 ----A---- C:\WINDOWS\system32\XAudio2_7.dll
2010-07-01 23:08:03 ----A---- C:\WINDOWS\system32\XAPOFX1_5.dll
2010-07-01 23:08:02 ----A---- C:\WINDOWS\system32\xactengine3_7.dll
2010-07-01 23:08:01 ----A---- C:\WINDOWS\system32\d3dcsx_43.dll
2010-07-01 23:08:01 ----A---- C:\WINDOWS\system32\D3DCompiler_43.dll
2010-07-01 23:08:00 ----A---- C:\WINDOWS\system32\d3dx11_43.dll
2010-07-01 23:07:59 ----A---- C:\WINDOWS\system32\D3DX9_43.dll
2010-07-01 23:07:59 ----A---- C:\WINDOWS\system32\d3dx10_43.dll
2010-07-01 23:07:58 ----A---- C:\WINDOWS\system32\XAudio2_6.dll
2010-07-01 23:07:58 ----A---- C:\WINDOWS\system32\XAPOFX1_4.dll
2010-07-01 23:07:57 ----A---- C:\WINDOWS\system32\xactengine3_6.dll
2010-07-01 23:07:56 ----A---- C:\WINDOWS\system32\X3DAudio1_7.dll
2010-07-01 23:07:55 ----A---- C:\WINDOWS\system32\XAudio2_5.dll
2010-07-01 23:07:55 ----A---- C:\WINDOWS\system32\xactengine3_5.dll
2010-07-01 23:07:54 ----A---- C:\WINDOWS\system32\D3DCompiler_42.dll
2010-07-01 23:07:46 ----A---- C:\WINDOWS\system32\d3dcsx_42.dll
2010-07-01 23:07:45 ----A---- C:\WINDOWS\system32\d3dx11_42.dll
2010-07-01 23:07:44 ----A---- C:\WINDOWS\system32\d3dx10_42.dll
2010-07-01 23:07:43 ----A---- C:\WINDOWS\system32\D3DX9_42.dll
2010-07-01 23:07:41 ----A---- C:\WINDOWS\system32\d3dx10_41.dll
2010-07-01 23:07:41 ----A---- C:\WINDOWS\system32\D3DCompiler_41.dll
2010-07-01 23:07:40 ----A---- C:\WINDOWS\system32\D3DX9_41.dll
2010-07-01 23:07:36 ----A---- C:\WINDOWS\system32\XAudio2_4.dll
2010-07-01 23:07:36 ----A---- C:\WINDOWS\system32\XAPOFX1_3.dll
2010-07-01 23:07:36 ----A---- C:\WINDOWS\system32\xactengine3_4.dll
2010-07-01 23:07:35 ----A---- C:\WINDOWS\system32\X3DAudio1_6.dll
2010-07-01 23:07:34 ----A---- C:\WINDOWS\system32\d3dx10_40.dll
2010-07-01 23:07:34 ----A---- C:\WINDOWS\system32\D3DCompiler_40.dll
2010-07-01 23:07:33 ----A---- C:\WINDOWS\system32\D3DX9_40.dll
2010-07-01 23:07:32 ----A---- C:\WINDOWS\system32\XAudio2_3.dll
2010-07-01 23:07:32 ----A---- C:\WINDOWS\system32\XAPOFX1_2.dll
2010-07-01 23:07:32 ----A---- C:\WINDOWS\system32\xactengine3_3.dll
2010-07-01 23:07:31 ----A---- C:\WINDOWS\system32\X3DAudio1_5.dll
2010-07-01 23:07:30 ----A---- C:\WINDOWS\system32\XAudio2_2.dll
2010-07-01 23:07:30 ----A---- C:\WINDOWS\system32\XAPOFX1_1.dll
2010-07-01 23:07:30 ----A---- C:\WINDOWS\system32\xactengine3_2.dll
2010-07-01 23:07:29 ----A---- C:\WINDOWS\system32\d3dx10_39.dll
2010-07-01 23:07:29 ----A---- C:\WINDOWS\system32\D3DCompiler_39.dll
2010-07-01 23:07:28 ----A---- C:\WINDOWS\system32\D3DX9_39.dll
2010-07-01 23:07:27 ----A---- C:\WINDOWS\system32\XAudio2_1.dll
2010-07-01 23:07:27 ----A---- C:\WINDOWS\system32\XAPOFX1_0.dll
2010-07-01 23:07:26 ----A---- C:\WINDOWS\system32\xactengine3_1.dll
2010-07-01 23:07:25 ----A---- C:\WINDOWS\system32\X3DAudio1_4.dll
2010-07-01 23:07:24 ----A---- C:\WINDOWS\system32\d3dx10_38.dll
2010-07-01 23:07:24 ----A---- C:\WINDOWS\system32\D3DCompiler_38.dll
2010-07-01 23:07:23 ----A---- C:\WINDOWS\system32\XAudio2_0.dll
2010-07-01 23:07:23 ----A---- C:\WINDOWS\system32\D3DX9_38.dll
2010-07-01 23:07:22 ----A---- C:\WINDOWS\system32\xactengine3_0.dll
2010-07-01 23:07:21 ----A---- C:\WINDOWS\system32\X3DAudio1_3.dll
2010-07-01 23:07:20 ----A---- C:\WINDOWS\system32\D3DX9_37.dll
2010-07-01 23:07:20 ----A---- C:\WINDOWS\system32\d3dx10_37.dll
2010-07-01 23:07:20 ----A---- C:\WINDOWS\system32\D3DCompiler_37.dll
2010-07-01 23:07:18 ----A---- C:\WINDOWS\system32\xactengine2_10.dll
2010-07-01 23:07:17 ----A---- C:\WINDOWS\system32\d3dx10_36.dll
2010-07-01 23:07:16 ----A---- C:\WINDOWS\system32\d3dx9_36.dll
2010-07-01 23:07:16 ----A---- C:\WINDOWS\system32\D3DCompiler_36.dll
2010-07-01 23:07:14 ----A---- C:\WINDOWS\system32\xactengine2_9.dll
2010-07-01 23:07:14 ----A---- C:\WINDOWS\system32\d3dx10_35.dll
2010-07-01 23:07:14 ----A---- C:\WINDOWS\system32\D3DCompiler_35.dll
2010-07-01 23:07:13 ----A---- C:\WINDOWS\system32\d3dx9_35.dll
2010-07-01 23:07:10 ----A---- C:\WINDOWS\system32\xactengine2_8.dll
2010-07-01 23:07:10 ----A---- C:\WINDOWS\system32\X3DAudio1_2.dll
2010-07-01 23:07:09 ----A---- C:\WINDOWS\system32\d3dx10_34.dll
2010-07-01 23:07:09 ----A---- C:\WINDOWS\system32\D3DCompiler_34.dll
2010-07-01 23:07:07 ----A---- C:\WINDOWS\system32\d3dx9_34.dll
2010-07-01 23:07:06 ----A---- C:\WINDOWS\system32\xinput1_3.dll
2010-07-01 23:07:04 ----A---- C:\WINDOWS\system32\xactengine2_7.dll
2010-07-01 23:07:01 ----A---- C:\WINDOWS\system32\d3dx10_33.dll
2010-07-01 23:07:01 ----A---- C:\WINDOWS\system32\D3DCompiler_33.dll
2010-07-01 23:06:58 ----A---- C:\WINDOWS\system32\d3dx9_33.dll
2010-07-01 23:06:57 ----A---- C:\WINDOWS\system32\xactengine2_6.dll
2010-07-01 23:06:57 ----A---- C:\WINDOWS\system32\xactengine2_5.dll
2010-07-01 23:06:56 ----A---- C:\WINDOWS\system32\d3dx9_32.dll
2010-07-01 23:06:55 ----A---- C:\WINDOWS\system32\xactengine2_4.dll
2010-07-01 23:06:55 ----A---- C:\WINDOWS\system32\x3daudio1_1.dll
2010-07-01 23:06:54 ----A---- C:\WINDOWS\system32\d3dx9_31.dll
2010-07-01 23:06:53 ----A---- C:\WINDOWS\system32\xinput1_2.dll
2010-07-01 23:06:53 ----A---- C:\WINDOWS\system32\xactengine2_3.dll
2010-07-01 23:06:52 ----A---- C:\WINDOWS\system32\xinput1_1.dll
2010-07-01 23:06:52 ----A---- C:\WINDOWS\system32\xactengine2_2.dll
2010-07-01 23:06:51 ----A---- C:\WINDOWS\system32\xactengine2_1.dll
2010-07-01 23:06:47 ----A---- C:\WINDOWS\system32\d3dx9_30.dll
2010-07-01 23:06:45 ----A---- C:\WINDOWS\system32\xactengine2_0.dll
2010-07-01 23:06:45 ----A---- C:\WINDOWS\system32\x3daudio1_0.dll
2010-07-01 23:06:44 ----A---- C:\WINDOWS\system32\d3dx9_29.dll
2010-07-01 23:06:44 ----A---- C:\WINDOWS\system32\d3dx9_28.dll
2010-07-01 23:06:43 ----A---- C:\WINDOWS\system32\xinput9_1_0.dll
2010-07-01 23:06:42 ----A---- C:\WINDOWS\system32\d3dx9_27.dll
2010-07-01 23:06:41 ----A---- C:\WINDOWS\system32\d3dx9_26.dll
2010-07-01 23:06:40 ----A---- C:\WINDOWS\system32\d3dx9_25.dll
2010-07-01 23:06:37 ----A---- C:\WINDOWS\system32\d3dx9_24.dll
2010-07-01 21:51:26 ----D---- C:\WINDOWS\Logs
2010-07-01 16:38:01 ----D---- C:\Documents and Settings\Administrator\Application Data\codeblocks
2010-06-30 22:04:20 ----D---- C:\Program Files\Common Files\DirectX
2010-06-28 07:42:35 ----A---- C:\WINDOWS\system32\cmmgr32.exe
2010-06-28 07:34:16 ----D---- C:\Documents and Settings\Administrator\Application Data\Help
2010-06-28 06:47:48 ----D---- C:\WINDOWS\ERDNT
2010-06-27 22:51:31 ----D---- C:\Documents and Settings\Administrator\Application Data\InspireSoft
2010-06-27 22:24:21 ----D---- C:\Documents and Settings\Administrator\Application Data\Audacity
2010-06-27 00:52:58 ----D---- C:\Documents and Settings\Administrator\Application Data\PeaZip
2010-06-26 08:03:00 ----D---- C:\downloads
2010-06-26 08:02:44 ----D---- C:\Program Files\VideoLAN
2010-06-26 08:02:44 ----D---- C:\Program Files\Trend Micro
2010-06-26 08:02:44 ----D---- C:\Program Files\Sophos
2010-06-26 08:02:33 ----D---- C:\Config.Msiinfo.txt logfile of random's system information tool 1.08 2010-07-19 18:51:12
2010-06-25 23:02:54 ----D---- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware(2).com
2010-06-25 14:50:42 ----D---- C:\Documents and Settings\Administrator\Application Data\TeraCopy
2010-06-25 07:22:29 ----D---- C:\Program Files\NOS
2010-06-24 07:33:46 ----A---- C:\WINDOWS\system32\drivers\mcdbus.sys
======List of files/folders modified in the last 1 months======
2010-07-19 07:38:48 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-07-17 17:05:52 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-07-11 11:09:40 ----A---- C:\WINDOWS\win.ini
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 PxHelp20;PxHelp20; C:\WINDOWS\system32\DRIVERS\PxHelp20.sys [2003-10-28 20016]
R1 {6080A529-897E-4629-A488-ABA0C29B635E};Intel® Graphics Platform (SoftBIOS) Driver; C:\WINDOWS\system32\drivers\ialmsbw.sys [2002-10-25 91774]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2010-03-29 114984]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2010-03-29 95872]
R1 OADevice;OADriver; \??\C:\WINDOWS\system32\drivers\OADriver.sys []
R1 OAmon;OAmon; \??\C:\WINDOWS\system32\drivers\OAmon.sys []
R1 OAnet;OAnet; \??\C:\WINDOWS\system32\drivers\OAnet.sys []
R1 SASDIFSV;SASDIFSV; \??\E:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\E:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS []
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2010-03-29 140216]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2004-08-03 11868]
R3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91};Intel® Graphics Chipset (KCH) Driver; C:\WINDOWS\system32\drivers\ialmkchw.sys [2002-10-25 71514]
R3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter; C:\WINDOWS\system32\DRIVERS\AN983.sys [2004-08-03 36224]
R3 HSF_DP;HSF_DP; C:\WINDOWS\system32\DRIVERS\HSFDPSP2.sys [2004-08-03 1041536]
R3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\system32\DRIVERS\HSFBS2S2.sys [2004-08-03 220032]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2002-10-25 80283]
R3 mcdbus;Driver for MagicISO SCSI Host Controller; C:\WINDOWS\system32\DRIVERS\mcdbus.sys [2009-02-24 116736]
R3 SMBios;Intel ® System Managment BIOS Service; C:\WINDOWS\system32\DRIVERS\SMBios.sys [2003-06-18 35012]
R3 STAC97;Audio Driver (WDM) - SigmaTel CODEC; C:\WINDOWS\system32\drivers\STAC97.sys [2002-08-12 179664]
R3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSFCXTS2.sys [2004-08-03 685056]
S0 pssnap;Paramount Software Snapshot Filter; C:\WINDOWS\system32\DRIVERS\pssnap.sys []
S0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-06-06 691696]
S3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-23 9600]
S3 MEMSWEEP2;MEMSWEEP2; \??\C:\WINDOWS\system32\5.tmp []
S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
S3 PCIDATA;PCIDATA; \??\F:\PCIDATA.sys []
S3 PSMounter;Macrium Reflect Image Explorer Service; \??\C:\WINDOWS\system32\drivers\psmounter.sys []
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-03-29 810120]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-04-12 153376]
R2 OAcat;Online Armor Helper Service; C:\Program Files\Tall Emu\Online Armor\OAcat.exe [2010-04-20 1284600]
R2 SvcOnlineArmor;Online Armor; C:\Program Files\Tall Emu\Online Armor\oasrv.exe [2010-04-20 3364856]
S2 ReflectService;Macrium Reflect Image Mounting Service; E:\Program Files\Macrium\Reflect\ReflectService.exe []
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2010-03-29 33560]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]
S3 getPlusHelper;getPlus® Helper; C:\WINDOWS\System32\svchost.exe [2004-08-03 14336]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]
-----------------EOF-----------------
======Uninstall list======
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
7-Zip 9.15 beta-->"E:\Program Files\7-Zip\Uninstall.exe"
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil10h_ActiveX.exe -maintain activex
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil10h_Plugin.exe -maintain plugin
Auslogics Disk Defrag-->"E:\Program Files\Auslogics\Auslogics Disk Defrag\unins000.exe"
CCleaner-->"E:\Program Files\CCleaner\uninst.exe"
hp deskjet 3320 series (Remove only)-->C:\Program Files\hp deskjet 3320 series\hpfiui.exe -c -vdivid=HPF -vpnum=95 -vinstport=USB001 -vproduct=3320 -huninstall
hp deskjet 3320 series-->rundll32 hpzcon07.dll,VendorJettison hp deskjet 3320 series
ImgBurn-->"E:\Program Files\ImgBurn\uninstall.exe"
Intel® Extreme Graphics Driver Software-->RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_2562
Java 6 Update 20-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216017FF}
MagicDisc 2.7.106-->E:\PROGRA~1\MAGICD~1\UNWISE.EXE E:\PROGRA~1\MAGICD~1\INSTALL.LOG
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft .NET Framework 3.0 Service Pack 1-->MsiExec.exe /I{2BA00471-0328-3743-93BD-FA813353A783}
Microsoft .NET Framework 3.5-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\setup.exe
Microsoft .NET Framework 3.5-->MsiExec.exe /I{2FC099BD-AC9B-33EB-809C-D332E1B27C40}
Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Enterprise 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Groove MUI (English) 2007-->MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE}
Microsoft Office Groove Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (English) 2007-->MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Visual C# 2005 Express Edition - ENU-->D:\Program Files\Microsoft Visual Studio 8\Microsoft Visual C# 2005 Express Edition - ENU\setup.exe
Microsoft Visual C# 2005 Express Edition - ENU-->MsiExec.exe /X{7E7D7935-B0C8-4032-80BA-2CDC9E43C3B8}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
Mozilla Firefox (3.6.6)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
MSXML 6 Service Pack 2 (KB973686)-->MsiExec.exe /I{56EA8BC0-3751-4B93-BC9D-6651CC36E5AA}
MusicBee-->MsiExec.exe /X{0CA267D3-3CBC-4852-910C-5995698F4914}
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
Online Armor 4.0-->"C:\Program Files\Tall Emu\Online Armor\unins000.exe"
Orbit Downloader-->"E:\Program Files\Orbitdownloader\unins000.exe"
PDF-Viewer-->"C:\Program Files\Tracker Software\PDF Viewer\unins000.exe"
Revo Uninstaller 1.89-->E:\Program Files\VS Revo Group\Revo Uninstaller\uninst.exe
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Windows Internet Explorer 8 (KB971961)-->"C:\WINDOWS\ie8updates\KB971961-IE8\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 8 (KB981332)-->"C:\WINDOWS\ie8updates\KB981332-IE8\spuninst\spuninst.exe"
SigmaTel AC97 Audio Drivers-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7959721D-8268-4565-9E0E-C41A9F4848A9}\setup.exe" -l0x9 -nodialog -uninstall
SUPERAntiSpyware-->"E:\Program Files\SUPERAntiSpyware\SASUNINST.EXE" /NOUI
TeraCopy 2.12-->"E:\Program Files\TeraCopy\unins000.exe"
Teton Viewer-->C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Teton Data Systems\Teton Viewer\DeIsL2.isu" -c"C:\Program Files\Teton Data Systems\Teton Viewer\tdsun32.dll"
The KMPlayer (remove only)-->"E:\Program Files\The KMPlayer\uninstall.exe"
Unlocker 1.8.9-->E:\Program Files\Unlocker\uninst.exe
upapp-->MsiExec.exe /I{4EF69D40-4DC9-485E-95D3-B1C22F218FC8}
Update for Windows Internet Explorer 8 (KB976662)-->"C:\WINDOWS\ie8updates\KB976662-IE8\spuninst\spuninst.exe"
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Wise Registry Cleaner Free 5.41-->"E:\Program Files\Wise Registry Cleaner\unins000.exe"
Yahoo! Messenger-->C:\PROGRA~1\YAHOO!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\YAHOO!\MESSEN~1\INSTALL.LOG
Hosts File Missing
======Security center information======
AV: ESET NOD32 Antivirus 4.2
FW: Online Armor Firewall
======System event log======
Computer Name: GOD
Event Code: 4226
Message: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.
Record Number: 2969
Source Name: Tcpip
Time Written: 20100710180006.000000+330
Event Type: warning
User:
Computer Name: GOD
Event Code: 4226
Message: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.
Record Number: 2968
Source Name: Tcpip
Time Written: 20100710173247.000000+330
Event Type: warning
User:
Computer Name: GOD
Event Code: 7006
Message: The ScRegSetValueExW call failed for DeleteFlag with the following error:
Access is denied.
Record Number: 2967
Source Name: Service Control Manager
Time Written: 20100710172247.000000+330
Event Type: error
User:
Computer Name: GOD
Event Code: 7006
Message: The ScRegSetValueExW call failed for Start with the following error:
Access is denied.
Record Number: 2966
Source Name: Service Control Manager
Time Written: 20100710172247.000000+330
Event Type: error
User:
Computer Name: GOD
Event Code: 4226
Message: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.
Record Number: 2965
Source Name: Tcpip
Time Written: 20100710171903.000000+330
Event Type: warning
User:
=====Application event log=====
Computer Name: GOD
Event Code: 8
Message: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The specified server cannot perform the requested operation.
Record Number: 339
Source Name: crypt32
Time Written: 20100630200016.000000+330
Event Type: error
User:
Computer Name: GOD
Event Code: 8
Message: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This operation returned because the timeout period expired.
Record Number: 338
Source Name: crypt32
Time Written: 20100630200015.000000+330
Event Type: error
User:
Computer Name: GOD
Event Code: 5000
Message: EventType clr20r3, P1 presmgr.exe, P2 0.7.6.9, P3 4bae5b8e, P4 system.windows.forms, P5 2.0.0.0, P6 471ebf68, P7 19a3, P8 2, P9 pszqoadhx1u5zahbhohghldgiy4qixhx, P10 NIL.
Record Number: 332
Source Name: .NET Runtime 2.0 Error Reporting
Time Written: 20100630072602.000000+330
Event Type: error
User:
Computer Name: GOD
Event Code: 1023
Message: .NET Runtime version 2.0.50727.1433 - Fatal Execution Engine Error (7A06491A) (0)
Record Number: 325
Source Name: .NET Runtime
Time Written: 20100630003222.000000+330
Event Type: error
User:
Computer Name: GOD
Event Code: 1000
Message: Faulting application gta-vc.exe, version 0.0.0.0, faulting module gta-vc.exe, version 0.0.0.0, fault address 0x000bb185.
Record Number: 323
Source Name: Application Error
Time Written: 20100629184138.000000+330
Event Type: error
User:
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\WBEM
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 1 Stepping 2, GenuineIntel
"PROCESSOR_REVISION"=0102
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
-----------------EOF-----------------
GMER 1.0.15.15281 -
http://www.gmer.netRootkit scan 2010-07-19 19:13:16
Windows 5.1.2600 Service Pack 2
Running: 0k01fh43.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\pxtdqpow.sys
---- System - GMER 1.0.15 ----
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwAllocateVirtualMemory [0xF080F3E0]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwAssignProcessToJobObject [0xF080FC10]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwConnectPort [0xF080D300]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwCreateFile [0xF081CDD0]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwCreatePort [0xF080CE40]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwCreateProcess [0xF0809B80]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwCreateProcessEx [0xF0809F90]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwCreateSection [0xF0809440]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwCreateThread [0xF080B480]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwDebugActiveProcess [0xF080C0F0]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwDuplicateObject [0xF080CC50]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwLoadDriver [0xF080EA00]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwOpenFile [0xF081D450]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwOpenProcess [0xF080AF80]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwOpenSection [0xF0809860]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwOpenThread [0xF080B980]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwProtectVirtualMemory [0xF080F860]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwQueryDirectoryFile [0xF080EF80]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwQueueApcThread [0xF080FDB0]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwRequestPort [0xF080DF00]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwRequestWaitReplyPort [0xF080E500]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwRestoreKey [0xF081C960]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwResumeThread [0xF080C8A0]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwSecureConnectPort [0xF080D6F0]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwSetContextThread [0xF080BED0]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwSetInformationThread [0xF0A4D650]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwSetSecurityObject [0xF0A4D7D0]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwSetSystemInformation [0xF080C290]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwShutdownSystem [0xF080E8E0]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwSuspendProcess [0xF080CA80]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwSuspendThread [0xF080C690]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwSystemDebugControl [0xF080C4A0]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwTerminateProcess [0xF080B1E0]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwTerminateThread [0xF080BCC0]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwUnloadDriver [0xF080ED10]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwWriteVirtualMemory [0xF080FA30]
---- Kernel code sections - GMER 1.0.15 ----
.text ntoskrnl.exe!_abnormal_termination + 104 804E2770 12 Bytes [40, CE, 80, F0, 80, 9B, 80, ...]
.text ntoskrnl.exe!_abnormal_termination + 430 804E2A9C 4 Bytes CALL F3401B21
.text ntoskrnl.exe!_abnormal_termination + 440 804E2AAC 12 Bytes [80, CA, 80, F0, 90, C6, 80, ...]
---- User code sections - GMER 1.0.15 ----
.text C:\Program Files\Java\jre6\bin\jqs.exe[192] kernel32.dll!FreeLibrary + 15 7C80AC03 4 Bytes CALL 71B0003D
.text C:\WINDOWS\system32\csrss.exe[376] KERNEL32.dll!FreeLibrary + 15 7C80AC03 4 Bytes CALL 71AF003D
.text C:\WINDOWS\system32\winlogon.exe[412] kernel32.dll!FreeLibrary + 15 7C80AC03 4 Bytes CALL 71AF003D
.text C:\WINDOWS\system32\services.exe[456] kernel32.dll!FreeLibrary + 15 7C80AC03 4 Bytes CALL 71AF003D
.text C:\WINDOWS\system32\lsass.exe[468] kernel32.dll!FreeLibrary + 15 7C80AC03 4 Bytes CALL 71AF003D
.text ...
.text C:\Program Files\Tall Emu\Online Armor\oasrv.exe[940] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 009B0001
.text C:\Program Files\Tall Emu\Online Armor\oasrv.exe[940] user32.dll!LoadStringW 7E419E36 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Tall Emu\Online Armor\oasrv.exe[940] user32.dll!LoadStringA 7E42DFA8 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\Explorer.EXE[1144] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 01A10001
.text C:\WINDOWS\Explorer.EXE[1144] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\Explorer.EXE[1144] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\Explorer.EXE[1144] kernel32.dll!FreeLibrary + 15 7C80AC03 4 Bytes CALL 71AF003D
.text C:\WINDOWS\Explorer.EXE[1144] ADVAPI32.dll!CreateServiceA 77E370B9 6 Bytes JMP 5F130F5A
.text C:\WINDOWS\Explorer.EXE[1144] ADVAPI32.dll!CreateServiceW 77E37251 6 Bytes JMP 5F160F5A
.text C:\WINDOWS\Explorer.EXE[1144] USER32.dll!ExitWindowsEx 7E45A045 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\Explorer.EXE[1144] IPHLPAPI.DLL!IcmpSendEcho2 76D6B73C 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\system32\spoolsv.exe[1224] kernel32.dll!FreeLibrary + 15 7C80AC03 4 Bytes CALL 71AF003D
.text C:\Program Files\Tall Emu\Online Armor\OAhlp.exe[1308] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 01270001
.text C:\Program Files\Tall Emu\Online Armor\OAhlp.exe[1308] kernel32.dll!FreeLibrary + 15 7C80AC03 4 Bytes CALL 71B0003D
.text C:\Program Files\Tall Emu\Online Armor\OAhlp.exe[1308] user32.dll!LoadStringW 7E419E36 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Tall Emu\Online Armor\OAhlp.exe[1308] user32.dll!LoadStringA 7E42DFA8 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\svchost.exe[1628] kernel32.dll!FreeLibrary + 15 7C80AC03 4 Bytes CALL 71B0003D
.text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[1748] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 00E70001
.text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[1748] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[1748] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[1748] kernel32.dll!FreeLibrary + 15 7C80AC03 4 Bytes CALL 71B0003D
.text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[1748] USER32.dll!ExitWindowsEx 7E45A045 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[1748] ADVAPI32.dll!CreateServiceA 77E370B9 6 Bytes JMP 5F130F5A
.text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[1748] ADVAPI32.dll!CreateServiceW 77E37251 6 Bytes JMP 5F160F5A
.text C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe[1748] IPHLPAPI.DLL!IcmpSendEcho2 76D6B73C 6 Bytes JMP 5F100F5A
.text C:\Program Files\Tall Emu\Online Armor\oaui.exe[1784] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 015F0001
.text C:\Program Files\Tall Emu\Online Armor\oaui.exe[1784] kernel32.dll!FreeLibrary + 15 7C80AC03 4 Bytes CALL 71B0003D
.text C:\Program Files\Tall Emu\Online Armor\oaui.exe[1784] user32.dll!LoadStringW 7E419E36 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Tall Emu\Online Armor\oaui.exe[1784] user32.dll!LoadStringA 7E42DFA8 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\ctfmon.exe[1848] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 00C10001
.text C:\WINDOWS\system32\ctfmon.exe[1848] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\system32\ctfmon.exe[1848] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\ctfmon.exe[1848] kernel32.dll!FreeLibrary + 15 7C80AC03 4 Bytes CALL 71B0003D
.text C:\WINDOWS\system32\ctfmon.exe[1848] ADVAPI32.dll!CreateServiceA 77E370B9 6 Bytes JMP 5F130F5A
.text C:\WINDOWS\system32\ctfmon.exe[1848] ADVAPI32.dll!CreateServiceW 77E37251 6 Bytes JMP 5F160F5A
.text C:\WINDOWS\system32\ctfmon.exe[1848] USER32.dll!ExitWindowsEx 7E45A045 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\system32\ctfmon.exe[1848] IPHLPAPI.DLL!IcmpSendEcho2 76D6B73C 6 Bytes JMP 5F100F5A
.text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1856] kernel32.dll!FreeLibrary + 15 7C80AC03 4 Bytes CALL 71B0003D
.text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1856] kernel32.dll!SetUnhandledExceptionFilter 7C8447ED 4 Bytes [C2, 04, 00, 00]
.text C:\Documents and Settings\Administrator\My Documents\Downloads\0k01fh43.exe[1960] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 00CB0001
.text C:\Documents and Settings\Administrator\My Documents\Downloads\0k01fh43.exe[1960] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\Documents and Settings\Administrator\My Documents\Downloads\0k01fh43.exe[1960] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\Documents and Settings\Administrator\My Documents\Downloads\0k01fh43.exe[1960] kernel32.dll!FreeLibrary + 15 7C80AC03 4 Bytes CALL 71B0003D
.text C:\Documents and Settings\Administrator\My Documents\Downloads\0k01fh43.exe[1960] user32.dll!ExitWindowsEx 7E45A045 6 Bytes JMP 5F0D0F5A
.text C:\Documents and Settings\Administrator\My Documents\Downloads\0k01fh43.exe[1960] advapi32.dll!CreateServiceA 77E370B9 6 Bytes JMP 5F130F5A
.text C:\Documents and Settings\Administrator\My Documents\Downloads\0k01fh43.exe[1960] advapi32.dll!CreateServiceW 77E37251 6 Bytes JMP 5F160F5A
.text C:\Documents and Settings\Administrator\My Documents\Downloads\0k01fh43.exe[1960] IPHLPAPI.DLL!IcmpSendEcho2 76D6B73C 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\System32\alg.exe[2168] kernel32.dll!FreeLibrary + 15 7C80AC03 4 Bytes CALL 71B0003D
.text C:\WINDOWS\system32\wuauclt.exe[2876] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 00C00001
.text C:\WINDOWS\system32\wuauclt.exe[2876] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\system32\wuauclt.exe[2876] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\wuauclt.exe[2876] kernel32.dll!FreeLibrary + 15 7C80AC03 4 Bytes CALL 71B0003D
.text C:\WINDOWS\system32\wuauclt.exe[2876] ADVAPI32.dll!CreateServiceA 77E370B9 6 Bytes JMP 5F130F5A
.text C:\WINDOWS\system32\wuauclt.exe[2876] ADVAPI32.dll!CreateServiceW 77E37251 6 Bytes JMP 5F160F5A
.text C:\WINDOWS\system32\wuauclt.exe[2876] USER32.dll!ExitWindowsEx 7E45A045 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\system32\wuauclt.exe[2876] IPHLPAPI.DLL!IcmpSendEcho2 76D6B73C 6 Bytes JMP 5F100F5A
---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)
Device \Driver\Tcpip \Device\Ip OAmon.sys (TDI Helper Driver/Tall Emu)
Device \Driver\Tcpip \Device\Tcp OAmon.sys (TDI Helper Driver/Tall Emu)
AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdir.sys (ESET Antivirus Network Redirector/ESET)
Device \Driver\Tcpip \Device\Udp OAmon.sys (TDI Helper Driver/Tall Emu)
Device \Driver\Tcpip \Device\RawIp OAmon.sys (TDI Helper Driver/Tall Emu)
Device \Driver\Tcpip \Device\IPMULTICAST OAmon.sys (TDI Helper Driver/Tall Emu)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat eamon.sys (Amon monitor/ESET)
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 D:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x97 0x94 0xE3 0xBC ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x94 0xAC 0x62 0x88 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x0A 0x3C 0x04 0xFB ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0x5D 0xB0 0xB0 0x30 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2@hdf12 0xAE 0xBD 0x0D 0xE5 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 D:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x97 0x94 0xE3 0xBC ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x94 0xAC 0x62 0x88 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x0A 0x3C 0x04 0xFB ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0x5D 0xB0 0xB0 0x30 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2@hdf12 0xAE 0xBD 0x0D 0xE5 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 D:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x97 0x94 0xE3 0xBC ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x94 0xAC 0x62 0x88 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x0A 0x3C 0x04 0xFB ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0x5D 0xB0 0xB0 0x30 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq2@hdf12 0xAE 0xBD 0x0D 0xE5 ...
---- EOF - GMER 1.0.15 ----
Edited by aommaster, 19 July 2010 - 12:56 PM.